Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 17:59
Behavioral task
behavioral1
Sample
23d2562433303108e6efeac264d75030_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
23d2562433303108e6efeac264d75030_NeikiAnalytics.exe
-
Size
454KB
-
MD5
23d2562433303108e6efeac264d75030
-
SHA1
003382a99d8cde5aef9a622a203532100846e7fd
-
SHA256
1afeeb82be5fac0d4eeff75f60e7d5c269bf036c87b62f2202fc69d7d3a4f808
-
SHA512
1c1ef3f41d51c6c5237d7da5aff4bf175c8bdf336b6bb22ba5e89c1a68efa247ddc6f430d0bcc7d3e8d8894ed0c1ee3fa0ea492446b8769d02c36334e76bcfea
-
SSDEEP
12288:y4wFHoS3eFp3IDvSbh5nPYERAAUDCa4NYm9:HFp3lz1XUDCaGYm9
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
Processes:
resource yara_rule behavioral1/memory/2416-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-41-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2644-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1432-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1156-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-458-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1360-534-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/300-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1264-805-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-829-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/988-856-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-925-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1816-994-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/292-1001-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-1081-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1960-1134-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2136-1184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-1247-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1924-1313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-1411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-1414-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rrlrlrl.exelllxflx.exe3hhhnt.exedddpd.exellfllrl.exeddvjv.exettbhtb.exe5xrrrrx.exethnbtb.exe7pjjp.exehbbhtb.exeddvdv.exelxlflrx.exejppdj.exettbbnt.exevjpjp.exenhtbhh.exenhthtb.exe3frllrf.exetthhnn.exefxrfxfl.exettbnbn.exeddvvj.exennhnht.exe1flxxrf.exetthhhh.exe9jvdv.exerfrlxxx.exevdjvv.exelfxllxr.exejdpdp.exefxrxffx.exe1nbhbh.exerlfxxlf.exehbbbhh.exe9thhbh.exejjddp.exerrlrffr.exennbnbn.exe9vdvd.exe1dppv.exe7rrfrxr.exenhttbh.exe5dvpv.exerlflrrl.exehbbhnn.exebnntbh.exe7jjpj.exe3rfflll.exehnbnbt.exedddjd.exelrlrflx.exebtthnn.exebtnnbb.exejjpdd.exelffrfxl.exebbthnn.exevpjjd.exevpjjj.exe7rfrxlx.exebbthtt.exeddvvj.exelffrxxr.exe3frxxfl.exepid process 2112 rrlrlrl.exe 3064 lllxflx.exe 2108 3hhhnt.exe 2768 dddpd.exe 2640 llfllrl.exe 2692 ddvjv.exe 2644 ttbhtb.exe 2504 5xrrrrx.exe 2208 thnbtb.exe 3020 7pjjp.exe 2728 hbbhtb.exe 2840 ddvdv.exe 2992 lxlflrx.exe 956 jppdj.exe 1632 ttbbnt.exe 1924 vjpjp.exe 1432 nhtbhh.exe 1308 nhthtb.exe 1156 3frllrf.exe 2248 tthhnn.exe 1712 fxrfxfl.exe 2780 ttbnbn.exe 580 ddvvj.exe 2480 nnhnht.exe 1132 1flxxrf.exe 1732 tthhhh.exe 1524 9jvdv.exe 604 rfrlxxx.exe 1028 vdjvv.exe 1040 lfxllxr.exe 1508 jdpdp.exe 1660 fxrxffx.exe 2260 1nbhbh.exe 2432 rlfxxlf.exe 2416 hbbbhh.exe 1592 9thhbh.exe 2348 jjddp.exe 2600 rrlrffr.exe 2652 nnbnbn.exe 2788 9vdvd.exe 2772 1dppv.exe 2292 7rrfrxr.exe 2832 nhttbh.exe 2552 5dvpv.exe 2508 rlflrrl.exe 2572 hbbhnn.exe 2520 bnntbh.exe 3004 7jjpj.exe 2712 3rfflll.exe 2856 hnbnbt.exe 2880 dddjd.exe 2848 lrlrflx.exe 2992 btthnn.exe 1996 btnnbb.exe 1396 jjpdd.exe 2404 lffrfxl.exe 1704 bbthnn.exe 2568 vpjjd.exe 2704 vpjjj.exe 804 7rfrxlx.exe 2068 bbthtt.exe 2900 ddvvj.exe 1748 lffrxxr.exe 1576 3frxxfl.exe -
Processes:
resource yara_rule behavioral1/memory/2416-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2112-10-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrlrlrl.exe upx behavioral1/memory/2416-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2112-18-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lllxflx.exe upx C:\3hhhnt.exe upx behavioral1/memory/3064-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2108-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dddpd.exe upx behavioral1/memory/2768-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2640-48-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\llfllrl.exe upx C:\ddvjv.exe upx behavioral1/memory/2692-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttbhtb.exe upx C:\5xrrrrx.exe upx behavioral1/memory/2644-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thnbtb.exe upx behavioral1/memory/2208-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2504-82-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7pjjp.exe upx C:\hbbhtb.exe upx behavioral1/memory/2728-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3020-100-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddvdv.exe upx C:\lxlflrx.exe upx C:\jppdj.exe upx behavioral1/memory/2992-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/956-127-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttbbnt.exe upx behavioral1/memory/1632-137-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjpjp.exe upx C:\nhtbhh.exe upx behavioral1/memory/1432-154-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhthtb.exe upx C:\3frllrf.exe upx behavioral1/memory/1156-171-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tthhnn.exe upx C:\fxrfxfl.exe upx behavioral1/memory/1712-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2248-187-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttbnbn.exe upx behavioral1/memory/1712-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-199-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ddvvj.exe upx C:\nnhnht.exe upx C:\1flxxrf.exe upx C:\tthhhh.exe upx C:\9jvdv.exe upx behavioral1/memory/1524-241-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfrlxxx.exe upx C:\vdjvv.exe upx behavioral1/memory/604-255-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfxllxr.exe upx C:\jdpdp.exe upx C:\fxrxffx.exe upx behavioral1/memory/1508-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1660-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2260-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2432-304-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-335-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-342-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2292-355-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
23d2562433303108e6efeac264d75030_NeikiAnalytics.exerrlrlrl.exelllxflx.exe3hhhnt.exedddpd.exellfllrl.exeddvjv.exettbhtb.exe5xrrrrx.exethnbtb.exe7pjjp.exehbbhtb.exeddvdv.exelxlflrx.exejppdj.exettbbnt.exedescription pid process target process PID 2416 wrote to memory of 2112 2416 23d2562433303108e6efeac264d75030_NeikiAnalytics.exe rrlrlrl.exe PID 2416 wrote to memory of 2112 2416 23d2562433303108e6efeac264d75030_NeikiAnalytics.exe rrlrlrl.exe PID 2416 wrote to memory of 2112 2416 23d2562433303108e6efeac264d75030_NeikiAnalytics.exe rrlrlrl.exe PID 2416 wrote to memory of 2112 2416 23d2562433303108e6efeac264d75030_NeikiAnalytics.exe rrlrlrl.exe PID 2112 wrote to memory of 3064 2112 rrlrlrl.exe lllxflx.exe PID 2112 wrote to memory of 3064 2112 rrlrlrl.exe lllxflx.exe PID 2112 wrote to memory of 3064 2112 rrlrlrl.exe lllxflx.exe PID 2112 wrote to memory of 3064 2112 rrlrlrl.exe lllxflx.exe PID 3064 wrote to memory of 2108 3064 lllxflx.exe 3hhhnt.exe PID 3064 wrote to memory of 2108 3064 lllxflx.exe 3hhhnt.exe PID 3064 wrote to memory of 2108 3064 lllxflx.exe 3hhhnt.exe PID 3064 wrote to memory of 2108 3064 lllxflx.exe 3hhhnt.exe PID 2108 wrote to memory of 2768 2108 3hhhnt.exe dddpd.exe PID 2108 wrote to memory of 2768 2108 3hhhnt.exe dddpd.exe PID 2108 wrote to memory of 2768 2108 3hhhnt.exe dddpd.exe PID 2108 wrote to memory of 2768 2108 3hhhnt.exe dddpd.exe PID 2768 wrote to memory of 2640 2768 dddpd.exe llfllrl.exe PID 2768 wrote to memory of 2640 2768 dddpd.exe llfllrl.exe PID 2768 wrote to memory of 2640 2768 dddpd.exe llfllrl.exe PID 2768 wrote to memory of 2640 2768 dddpd.exe llfllrl.exe PID 2640 wrote to memory of 2692 2640 llfllrl.exe ddvjv.exe PID 2640 wrote to memory of 2692 2640 llfllrl.exe ddvjv.exe PID 2640 wrote to memory of 2692 2640 llfllrl.exe ddvjv.exe PID 2640 wrote to memory of 2692 2640 llfllrl.exe ddvjv.exe PID 2692 wrote to memory of 2644 2692 ddvjv.exe ttbhtb.exe PID 2692 wrote to memory of 2644 2692 ddvjv.exe ttbhtb.exe PID 2692 wrote to memory of 2644 2692 ddvjv.exe ttbhtb.exe PID 2692 wrote to memory of 2644 2692 ddvjv.exe ttbhtb.exe PID 2644 wrote to memory of 2504 2644 ttbhtb.exe 5xrrrrx.exe PID 2644 wrote to memory of 2504 2644 ttbhtb.exe 5xrrrrx.exe PID 2644 wrote to memory of 2504 2644 ttbhtb.exe 5xrrrrx.exe PID 2644 wrote to memory of 2504 2644 ttbhtb.exe 5xrrrrx.exe PID 2504 wrote to memory of 2208 2504 5xrrrrx.exe thnbtb.exe PID 2504 wrote to memory of 2208 2504 5xrrrrx.exe thnbtb.exe PID 2504 wrote to memory of 2208 2504 5xrrrrx.exe thnbtb.exe PID 2504 wrote to memory of 2208 2504 5xrrrrx.exe thnbtb.exe PID 2208 wrote to memory of 3020 2208 thnbtb.exe 7pjjp.exe PID 2208 wrote to memory of 3020 2208 thnbtb.exe 7pjjp.exe PID 2208 wrote to memory of 3020 2208 thnbtb.exe 7pjjp.exe PID 2208 wrote to memory of 3020 2208 thnbtb.exe 7pjjp.exe PID 3020 wrote to memory of 2728 3020 7pjjp.exe hbbhtb.exe PID 3020 wrote to memory of 2728 3020 7pjjp.exe hbbhtb.exe PID 3020 wrote to memory of 2728 3020 7pjjp.exe hbbhtb.exe PID 3020 wrote to memory of 2728 3020 7pjjp.exe hbbhtb.exe PID 2728 wrote to memory of 2840 2728 hbbhtb.exe ddvdv.exe PID 2728 wrote to memory of 2840 2728 hbbhtb.exe ddvdv.exe PID 2728 wrote to memory of 2840 2728 hbbhtb.exe ddvdv.exe PID 2728 wrote to memory of 2840 2728 hbbhtb.exe ddvdv.exe PID 2840 wrote to memory of 2992 2840 ddvdv.exe lxlflrx.exe PID 2840 wrote to memory of 2992 2840 ddvdv.exe lxlflrx.exe PID 2840 wrote to memory of 2992 2840 ddvdv.exe lxlflrx.exe PID 2840 wrote to memory of 2992 2840 ddvdv.exe lxlflrx.exe PID 2992 wrote to memory of 956 2992 lxlflrx.exe jppdj.exe PID 2992 wrote to memory of 956 2992 lxlflrx.exe jppdj.exe PID 2992 wrote to memory of 956 2992 lxlflrx.exe jppdj.exe PID 2992 wrote to memory of 956 2992 lxlflrx.exe jppdj.exe PID 956 wrote to memory of 1632 956 jppdj.exe ttbbnt.exe PID 956 wrote to memory of 1632 956 jppdj.exe ttbbnt.exe PID 956 wrote to memory of 1632 956 jppdj.exe ttbbnt.exe PID 956 wrote to memory of 1632 956 jppdj.exe ttbbnt.exe PID 1632 wrote to memory of 1924 1632 ttbbnt.exe vjpjp.exe PID 1632 wrote to memory of 1924 1632 ttbbnt.exe vjpjp.exe PID 1632 wrote to memory of 1924 1632 ttbbnt.exe vjpjp.exe PID 1632 wrote to memory of 1924 1632 ttbbnt.exe vjpjp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23d2562433303108e6efeac264d75030_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\23d2562433303108e6efeac264d75030_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\rrlrlrl.exec:\rrlrlrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\lllxflx.exec:\lllxflx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\3hhhnt.exec:\3hhhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\dddpd.exec:\dddpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\llfllrl.exec:\llfllrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\ddvjv.exec:\ddvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\ttbhtb.exec:\ttbhtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\5xrrrrx.exec:\5xrrrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\thnbtb.exec:\thnbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\7pjjp.exec:\7pjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\hbbhtb.exec:\hbbhtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\ddvdv.exec:\ddvdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\lxlflrx.exec:\lxlflrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\jppdj.exec:\jppdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\ttbbnt.exec:\ttbbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\vjpjp.exec:\vjpjp.exe17⤵
- Executes dropped EXE
PID:1924 -
\??\c:\nhtbhh.exec:\nhtbhh.exe18⤵
- Executes dropped EXE
PID:1432 -
\??\c:\nhthtb.exec:\nhthtb.exe19⤵
- Executes dropped EXE
PID:1308 -
\??\c:\3frllrf.exec:\3frllrf.exe20⤵
- Executes dropped EXE
PID:1156 -
\??\c:\tthhnn.exec:\tthhnn.exe21⤵
- Executes dropped EXE
PID:2248 -
\??\c:\fxrfxfl.exec:\fxrfxfl.exe22⤵
- Executes dropped EXE
PID:1712 -
\??\c:\ttbnbn.exec:\ttbnbn.exe23⤵
- Executes dropped EXE
PID:2780 -
\??\c:\ddvvj.exec:\ddvvj.exe24⤵
- Executes dropped EXE
PID:580 -
\??\c:\nnhnht.exec:\nnhnht.exe25⤵
- Executes dropped EXE
PID:2480 -
\??\c:\1flxxrf.exec:\1flxxrf.exe26⤵
- Executes dropped EXE
PID:1132 -
\??\c:\tthhhh.exec:\tthhhh.exe27⤵
- Executes dropped EXE
PID:1732 -
\??\c:\9jvdv.exec:\9jvdv.exe28⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rfrlxxx.exec:\rfrlxxx.exe29⤵
- Executes dropped EXE
PID:604 -
\??\c:\vdjvv.exec:\vdjvv.exe30⤵
- Executes dropped EXE
PID:1028 -
\??\c:\lfxllxr.exec:\lfxllxr.exe31⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jdpdp.exec:\jdpdp.exe32⤵
- Executes dropped EXE
PID:1508 -
\??\c:\fxrxffx.exec:\fxrxffx.exe33⤵
- Executes dropped EXE
PID:1660 -
\??\c:\1nbhbh.exec:\1nbhbh.exe34⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rlfxxlf.exec:\rlfxxlf.exe35⤵
- Executes dropped EXE
PID:2432 -
\??\c:\hbbbhh.exec:\hbbbhh.exe36⤵
- Executes dropped EXE
PID:2416 -
\??\c:\9thhbh.exec:\9thhbh.exe37⤵
- Executes dropped EXE
PID:1592 -
\??\c:\jjddp.exec:\jjddp.exe38⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rrlrffr.exec:\rrlrffr.exe39⤵
- Executes dropped EXE
PID:2600 -
\??\c:\nnbnbn.exec:\nnbnbn.exe40⤵
- Executes dropped EXE
PID:2652 -
\??\c:\9vdvd.exec:\9vdvd.exe41⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1dppv.exec:\1dppv.exe42⤵
- Executes dropped EXE
PID:2772 -
\??\c:\7rrfrxr.exec:\7rrfrxr.exe43⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nhttbh.exec:\nhttbh.exe44⤵
- Executes dropped EXE
PID:2832 -
\??\c:\5dvpv.exec:\5dvpv.exe45⤵
- Executes dropped EXE
PID:2552 -
\??\c:\rlflrrl.exec:\rlflrrl.exe46⤵
- Executes dropped EXE
PID:2508 -
\??\c:\hbbhnn.exec:\hbbhnn.exe47⤵
- Executes dropped EXE
PID:2572 -
\??\c:\bnntbh.exec:\bnntbh.exe48⤵
- Executes dropped EXE
PID:2520 -
\??\c:\7jjpj.exec:\7jjpj.exe49⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3rfflll.exec:\3rfflll.exe50⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hnbnbt.exec:\hnbnbt.exe51⤵
- Executes dropped EXE
PID:2856 -
\??\c:\dddjd.exec:\dddjd.exe52⤵
- Executes dropped EXE
PID:2880 -
\??\c:\lrlrflx.exec:\lrlrflx.exe53⤵
- Executes dropped EXE
PID:2848 -
\??\c:\btthnn.exec:\btthnn.exe54⤵
- Executes dropped EXE
PID:2992 -
\??\c:\btnnbb.exec:\btnnbb.exe55⤵
- Executes dropped EXE
PID:1996 -
\??\c:\jjpdd.exec:\jjpdd.exe56⤵
- Executes dropped EXE
PID:1396 -
\??\c:\lffrfxl.exec:\lffrfxl.exe57⤵
- Executes dropped EXE
PID:2404 -
\??\c:\bbthnn.exec:\bbthnn.exe58⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vpjjd.exec:\vpjjd.exe59⤵
- Executes dropped EXE
PID:2568 -
\??\c:\vpjjj.exec:\vpjjj.exe60⤵
- Executes dropped EXE
PID:2704 -
\??\c:\7rfrxlx.exec:\7rfrxlx.exe61⤵
- Executes dropped EXE
PID:804 -
\??\c:\bbthtt.exec:\bbthtt.exe62⤵
- Executes dropped EXE
PID:2068 -
\??\c:\ddvvj.exec:\ddvvj.exe63⤵
- Executes dropped EXE
PID:2900 -
\??\c:\lffrxxr.exec:\lffrxxr.exe64⤵
- Executes dropped EXE
PID:1748 -
\??\c:\3frxxfl.exec:\3frxxfl.exe65⤵
- Executes dropped EXE
PID:1576 -
\??\c:\3bnntn.exec:\3bnntn.exe66⤵PID:1516
-
\??\c:\vvjdj.exec:\vvjdj.exe67⤵PID:580
-
\??\c:\lfxfrxr.exec:\lfxfrxr.exe68⤵PID:836
-
\??\c:\thnhhn.exec:\thnhhn.exe69⤵PID:2384
-
\??\c:\djvvd.exec:\djvvd.exe70⤵PID:1760
-
\??\c:\9xfrrxf.exec:\9xfrrxf.exe71⤵PID:1360
-
\??\c:\rxfrrfx.exec:\rxfrrfx.exe72⤵PID:1016
-
\??\c:\btbtbt.exec:\btbtbt.exe73⤵PID:992
-
\??\c:\pvdvd.exec:\pvdvd.exe74⤵PID:1984
-
\??\c:\3fxlffl.exec:\3fxlffl.exe75⤵PID:1708
-
\??\c:\7bhnbh.exec:\7bhnbh.exe76⤵PID:1788
-
\??\c:\ppjdj.exec:\ppjdj.exe77⤵PID:1800
-
\??\c:\rlfrxxx.exec:\rlfrxxx.exe78⤵PID:300
-
\??\c:\rrrrllx.exec:\rrrrllx.exe79⤵PID:1908
-
\??\c:\tnhhnn.exec:\tnhhnn.exe80⤵PID:2424
-
\??\c:\5vdvd.exec:\5vdvd.exe81⤵PID:1560
-
\??\c:\3xxxllx.exec:\3xxxllx.exe82⤵PID:1696
-
\??\c:\fxfrxfx.exec:\fxfrxfx.exe83⤵PID:1684
-
\??\c:\nbhhnn.exec:\nbhhnn.exe84⤵PID:2612
-
\??\c:\jdvpv.exec:\jdvpv.exe85⤵PID:2748
-
\??\c:\5fxffrr.exec:\5fxffrr.exe86⤵PID:2760
-
\??\c:\3lfffxf.exec:\3lfffxf.exe87⤵PID:2668
-
\??\c:\bnbnbn.exec:\bnbnbn.exe88⤵PID:2804
-
\??\c:\vpjjv.exec:\vpjjv.exe89⤵PID:2812
-
\??\c:\frrrxll.exec:\frrrxll.exe90⤵PID:2792
-
\??\c:\1lrflxx.exec:\1lrflxx.exe91⤵PID:2528
-
\??\c:\tnbbtb.exec:\tnbbtb.exe92⤵PID:3000
-
\??\c:\5jjpv.exec:\5jjpv.exe93⤵PID:2388
-
\??\c:\7xlrflr.exec:\7xlrflr.exe94⤵PID:2680
-
\??\c:\htthth.exec:\htthth.exe95⤵PID:2836
-
\??\c:\dpdjd.exec:\dpdjd.exe96⤵PID:2728
-
\??\c:\vvpvd.exec:\vvpvd.exe97⤵PID:2896
-
\??\c:\llrfrrl.exec:\llrfrrl.exe98⤵PID:2980
-
\??\c:\nnbbnb.exec:\nnbbnb.exe99⤵PID:1256
-
\??\c:\1jdpd.exec:\1jdpd.exe100⤵PID:1808
-
\??\c:\5jdjp.exec:\5jdjp.exe101⤵PID:2320
-
\??\c:\xrffrrx.exec:\xrffrrx.exe102⤵PID:2156
-
\??\c:\5nbbbb.exec:\5nbbbb.exe103⤵PID:1724
-
\??\c:\jdddp.exec:\jdddp.exe104⤵PID:772
-
\??\c:\pdpvj.exec:\pdpvj.exe105⤵PID:808
-
\??\c:\xrflrxl.exec:\xrflrxl.exe106⤵PID:1744
-
\??\c:\bnhnbb.exec:\bnhnbb.exe107⤵PID:1752
-
\??\c:\jpdpp.exec:\jpdpp.exe108⤵PID:1896
-
\??\c:\rlfllxx.exec:\rlfllxx.exe109⤵PID:2296
-
\??\c:\nnbnbh.exec:\nnbnbh.exe110⤵PID:2936
-
\??\c:\jjvdj.exec:\jjvdj.exe111⤵PID:2104
-
\??\c:\vpdjv.exec:\vpdjv.exe112⤵PID:324
-
\??\c:\5rxlfrr.exec:\5rxlfrr.exe113⤵PID:1264
-
\??\c:\9nhtnb.exec:\9nhtnb.exe114⤵PID:1132
-
\??\c:\pddjv.exec:\pddjv.exe115⤵PID:2596
-
\??\c:\5rlrrxf.exec:\5rlrrxf.exe116⤵PID:1524
-
\??\c:\lfflflr.exec:\lfflflr.exe117⤵PID:2020
-
\??\c:\ththnb.exec:\ththnb.exe118⤵PID:1960
-
\??\c:\vpdpv.exec:\vpdpv.exe119⤵PID:1956
-
\??\c:\1fxxfll.exec:\1fxxfll.exe120⤵PID:2216
-
\??\c:\1lflxfx.exec:\1lflxfx.exe121⤵PID:1688
-
\??\c:\bbtntb.exec:\bbtntb.exe122⤵PID:988
-
\??\c:\pjjdj.exec:\pjjdj.exe123⤵PID:876
-
\??\c:\7rfrxfl.exec:\7rfrxfl.exe124⤵PID:1544
-
\??\c:\btnhnt.exec:\btnhnt.exe125⤵PID:1908
-
\??\c:\1vpvv.exec:\1vpvv.exe126⤵PID:2416
-
\??\c:\1xllxxl.exec:\1xllxxl.exe127⤵PID:2184
-
\??\c:\9fxrffl.exec:\9fxrffl.exe128⤵PID:1696
-
\??\c:\nhbhnt.exec:\nhbhnt.exe129⤵PID:2648
-
\??\c:\pvpdv.exec:\pvpdv.exe130⤵PID:2924
-
\??\c:\rfrxffl.exec:\rfrxffl.exe131⤵PID:2776
-
\??\c:\llxfxxl.exec:\llxfxxl.exe132⤵PID:2772
-
\??\c:\ttnnhn.exec:\ttnnhn.exe133⤵PID:2292
-
\??\c:\dvvpd.exec:\dvvpd.exe134⤵PID:2832
-
\??\c:\lllflrx.exec:\lllflrx.exe135⤵PID:1964
-
\??\c:\ttthtt.exec:\ttthtt.exe136⤵PID:2620
-
\??\c:\nbntnh.exec:\nbntnh.exe137⤵PID:2212
-
\??\c:\5pjjv.exec:\5pjjv.exe138⤵PID:2520
-
\??\c:\frrxxrf.exec:\frrxxrf.exe139⤵PID:3024
-
\??\c:\5nhtbh.exec:\5nhtbh.exe140⤵PID:2736
-
\??\c:\9hhhtt.exec:\9hhhtt.exe141⤵PID:2904
-
\??\c:\dpjpv.exec:\dpjpv.exe142⤵PID:1032
-
\??\c:\flxfffr.exec:\flxfffr.exe143⤵PID:2840
-
\??\c:\7htbbh.exec:\7htbbh.exe144⤵PID:1816
-
\??\c:\hnntht.exec:\hnntht.exe145⤵PID:292
-
\??\c:\vvpdp.exec:\vvpdp.exe146⤵PID:1396
-
\??\c:\rlfrxxl.exec:\rlfrxxl.exe147⤵PID:2496
-
\??\c:\tthnbh.exec:\tthnbh.exe148⤵PID:2732
-
\??\c:\jdddp.exec:\jdddp.exe149⤵PID:316
-
\??\c:\pppvj.exec:\pppvj.exe150⤵PID:1604
-
\??\c:\fxrfrfl.exec:\fxrfrfl.exe151⤵PID:1156
-
\??\c:\nnnbnh.exec:\nnnbnh.exe152⤵PID:1624
-
\??\c:\pjpdp.exec:\pjpdp.exe153⤵PID:2940
-
\??\c:\rllffrr.exec:\rllffrr.exe154⤵PID:1712
-
\??\c:\xrrxlrf.exec:\xrrxlrf.exe155⤵PID:716
-
\??\c:\5nbbth.exec:\5nbbth.exe156⤵PID:448
-
\??\c:\jjjvj.exec:\jjjvj.exe157⤵PID:2024
-
\??\c:\fxfrxlf.exec:\fxfrxlf.exe158⤵PID:1844
-
\??\c:\hnbnnh.exec:\hnbnnh.exe159⤵PID:2960
-
\??\c:\jjdjj.exec:\jjdjj.exe160⤵PID:1264
-
\??\c:\rrflffx.exec:\rrflffx.exe161⤵PID:1132
-
\??\c:\5xflxfx.exec:\5xflxfx.exe162⤵PID:2596
-
\??\c:\bhbttt.exec:\bhbttt.exe163⤵PID:1524
-
\??\c:\vpdpd.exec:\vpdpd.exe164⤵PID:2020
-
\??\c:\5frlllf.exec:\5frlllf.exe165⤵PID:1960
-
\??\c:\3bnhtb.exec:\3bnhtb.exe166⤵PID:1716
-
\??\c:\hnhntt.exec:\hnhntt.exe167⤵PID:2456
-
\??\c:\5dpvp.exec:\5dpvp.exe168⤵PID:1688
-
\??\c:\flflrrf.exec:\flflrrf.exe169⤵PID:544
-
\??\c:\5hbtnn.exec:\5hbtnn.exe170⤵PID:2116
-
\??\c:\vdvjp.exec:\vdvjp.exe171⤵PID:1544
-
\??\c:\dpvjv.exec:\dpvjv.exe172⤵PID:2372
-
\??\c:\3rlrffr.exec:\3rlrffr.exe173⤵PID:2824
-
\??\c:\tnbnnn.exec:\tnbnnn.exe174⤵PID:2136
-
\??\c:\5tntbb.exec:\5tntbb.exe175⤵PID:2612
-
\??\c:\jpdpv.exec:\jpdpv.exe176⤵PID:2108
-
\??\c:\rrlrllx.exec:\rrlrllx.exe177⤵PID:2924
-
\??\c:\1hbtbt.exec:\1hbtbt.exe178⤵PID:2776
-
\??\c:\3vjvp.exec:\3vjvp.exe179⤵PID:2608
-
\??\c:\vvpdp.exec:\vvpdp.exe180⤵PID:2292
-
\??\c:\5frxffr.exec:\5frxffr.exe181⤵PID:2644
-
\??\c:\3bnntb.exec:\3bnntb.exe182⤵PID:2540
-
\??\c:\jjvjv.exec:\jjvjv.exe183⤵PID:2792
-
\??\c:\ffrflxl.exec:\ffrflxl.exe184⤵PID:2740
-
\??\c:\rfxlfrl.exec:\rfxlfrl.exe185⤵PID:2160
-
\??\c:\hbbnbb.exec:\hbbnbb.exe186⤵PID:2844
-
\??\c:\pjvdj.exec:\pjvdj.exe187⤵PID:2728
-
\??\c:\7rlxrfl.exec:\7rlxrfl.exe188⤵PID:2696
-
\??\c:\xffrfrf.exec:\xffrfrf.exe189⤵PID:2980
-
\??\c:\hhbttb.exec:\hhbttb.exe190⤵PID:1248
-
\??\c:\vpjpd.exec:\vpjpd.exe191⤵PID:1856
-
\??\c:\lfflrrf.exec:\lfflrrf.exe192⤵PID:1932
-
\??\c:\htnntb.exec:\htnntb.exe193⤵PID:2156
-
\??\c:\1nhtbb.exec:\1nhtbb.exe194⤵PID:1924
-
\??\c:\ppppd.exec:\ppppd.exe195⤵PID:1776
-
\??\c:\fxrlxxl.exec:\fxrlxxl.exe196⤵PID:1288
-
\??\c:\hhbthn.exec:\hhbthn.exe197⤵PID:1604
-
\??\c:\1vjpv.exec:\1vjpv.exe198⤵PID:1476
-
\??\c:\9dvdp.exec:\9dvdp.exe199⤵PID:2952
-
\??\c:\1rlrfxf.exec:\1rlrfxf.exe200⤵PID:1668
-
\??\c:\1bnthb.exec:\1bnthb.exe201⤵PID:1784
-
\??\c:\pvdjp.exec:\pvdjp.exe202⤵PID:2008
-
\??\c:\pjddp.exec:\pjddp.exe203⤵PID:2412
-
\??\c:\rrlrlrl.exec:\rrlrlrl.exe204⤵PID:2480
-
\??\c:\btntnt.exec:\btntnt.exe205⤵PID:1844
-
\??\c:\pvppd.exec:\pvppd.exe206⤵PID:1792
-
\??\c:\3lfflrf.exec:\3lfflrf.exe207⤵PID:1852
-
\??\c:\9fllxfx.exec:\9fllxfx.exe208⤵PID:1316
-
\??\c:\5nhnbb.exec:\5nhnbb.exe209⤵PID:1600
-
\??\c:\pjppv.exec:\pjppv.exe210⤵PID:604
-
\??\c:\xrlrllf.exec:\xrlrllf.exe211⤵PID:2064
-
\??\c:\xxlxlxl.exec:\xxlxlxl.exe212⤵PID:2172
-
\??\c:\9nbhnn.exec:\9nbhnn.exe213⤵PID:1788
-
\??\c:\vpjvp.exec:\vpjvp.exe214⤵PID:1596
-
\??\c:\flfxrfx.exec:\flfxrfx.exe215⤵PID:300
-
\??\c:\rlflxxr.exec:\rlflxxr.exe216⤵PID:988
-
\??\c:\1tnttt.exec:\1tnttt.exe217⤵PID:2424
-
\??\c:\jdjdv.exec:\jdjdv.exe218⤵PID:1544
-
\??\c:\fxllxrf.exec:\fxllxrf.exe219⤵PID:2360
-
\??\c:\frfxxxf.exec:\frfxxxf.exe220⤵PID:2824
-
\??\c:\btttnn.exec:\btttnn.exe221⤵PID:2240
-
\??\c:\vpvdp.exec:\vpvdp.exe222⤵PID:2688
-
\??\c:\pvjvj.exec:\pvjvj.exe223⤵PID:2108
-
\??\c:\llxfrxf.exec:\llxfrxf.exe224⤵PID:2816
-
\??\c:\tnhbnt.exec:\tnhbnt.exe225⤵PID:2776
-
\??\c:\5pjpp.exec:\5pjpp.exe226⤵PID:2564
-
\??\c:\3jjvj.exec:\3jjvj.exe227⤵PID:2080
-
\??\c:\ffxlrrx.exec:\ffxlrrx.exe228⤵PID:1964
-
\??\c:\5tthnb.exec:\5tthnb.exe229⤵PID:1720
-
\??\c:\pjvjd.exec:\pjvjd.exe230⤵PID:2336
-
\??\c:\rlffrxl.exec:\rlffrxl.exe231⤵PID:2556
-
\??\c:\flflxff.exec:\flflxff.exe232⤵PID:3024
-
\??\c:\ttntbh.exec:\ttntbh.exe233⤵PID:1060
-
\??\c:\vpvpv.exec:\vpvpv.exe234⤵PID:2876
-
\??\c:\rlflflr.exec:\rlflflr.exe235⤵PID:2728
-
\??\c:\tnbntt.exec:\tnbntt.exe236⤵PID:1300
-
\??\c:\hnhhtb.exec:\hnhhtb.exe237⤵PID:2980
-
\??\c:\vvpdj.exec:\vvpdj.exe238⤵PID:1640
-
\??\c:\xxrlxll.exec:\xxrlxll.exe239⤵PID:1808
-
\??\c:\7thhnb.exec:\7thhnb.exe240⤵PID:1704
-
\??\c:\ttnthh.exec:\ttnthh.exe241⤵PID:2256
-
\??\c:\3jdjj.exec:\3jdjj.exe242⤵PID:1308