Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 19:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
32dd3716420b5e067b8bb89183e865d0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
32dd3716420b5e067b8bb89183e865d0_NeikiAnalytics.exe
-
Size
72KB
-
MD5
32dd3716420b5e067b8bb89183e865d0
-
SHA1
4374ee0dda13302183ddd17829f6a60f3d3560ea
-
SHA256
0c1612e63eae0bc875c848cb622676327f8d24563ecb18baec074a7bb264c993
-
SHA512
2f9e17bfb498df35093bdad3a134b67d1238dd4db633773d4187e1d8c4fd3e8fd5251011a918c0a89b0ae5a5a0ab7dd4c18a97159f7a0ade6d41c5c285bdc7a6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7GToUVlQ:ymb3NkkiQ3mdBjFIW0U3Q
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral1/memory/2432-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-86-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1088-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1884-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-7669-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bbtbnn.exejjdjv.exebthtbh.exetbnhnn.exe5fllrxl.exehntttt.exejvpjv.exepddvd.exehbhhnt.exehtnthh.exe1vjdj.exepjpvp.exexxrlxxl.exethtthh.exevppvj.exeppjvd.exe5xxlxlx.exehnnthn.exe5vpvd.exevpdpv.exellfrxfl.exelxrrflr.exehbtbhn.exejjpvj.exe9xrrffx.exebnttbh.exedvppd.exedjppp.exefxxxlll.exebnbhtb.exennbbtt.exevppvd.exerlxlxxl.exefrlflfr.exennhntb.exepjppv.exevpjjv.exelrxxffl.exelfxrllr.exetthnbb.exetnbnbh.exe9dvjj.exejdppv.exellxlxlx.exexlxrxfl.exetnbhtb.exe7btbnn.exevpjvj.exe5jjdp.exexlfxfrf.exe1lrxlrf.exehbnnbh.exenntnnb.exe3pjpd.exedvppd.exeffxrllx.exettntbb.exehhbbnb.exevvjvj.exedvpvj.exexfxxlfl.exelflxlxl.exe1tnbnt.exehbnbhb.exepid process 2096 bbtbnn.exe 3052 jjdjv.exe 2772 bthtbh.exe 2896 tbnhnn.exe 2624 5fllrxl.exe 2812 hntttt.exe 2612 jvpjv.exe 2392 pddvd.exe 348 hbhhnt.exe 2848 htnthh.exe 3000 1vjdj.exe 1804 pjpvp.exe 2172 xxrlxxl.exe 1664 thtthh.exe 2220 vppvj.exe 1668 ppjvd.exe 1736 5xxlxlx.exe 2112 hnnthn.exe 2924 5vpvd.exe 3044 vpdpv.exe 2460 llfrxfl.exe 1088 lxrrflr.exe 1656 hbtbhn.exe 1928 jjpvj.exe 692 9xrrffx.exe 2120 bnttbh.exe 1884 dvppd.exe 2436 djppp.exe 980 fxxxlll.exe 1404 bnbhtb.exe 1516 nnbbtt.exe 2432 vppvd.exe 1620 rlxlxxl.exe 2164 frlflfr.exe 2680 nnhntb.exe 3052 pjppv.exe 2668 vpjjv.exe 2772 lrxxffl.exe 2564 lfxrllr.exe 2196 tthnbb.exe 2548 tnbnbh.exe 2452 9dvjj.exe 2608 jdppv.exe 2032 llxlxlx.exe 2800 xlxrxfl.exe 2860 tnbhtb.exe 2852 7btbnn.exe 2956 vpjvj.exe 1068 5jjdp.exe 1032 xlfxfrf.exe 2172 1lrxlrf.exe 1664 hbnnbh.exe 2200 nntnnb.exe 2212 3pjpd.exe 2300 dvppd.exe 1376 ffxrllx.exe 2136 ttntbb.exe 2444 hhbbnb.exe 848 vvjvj.exe 264 dvpvj.exe 1488 xfxxlfl.exe 1088 lflxlxl.exe 1656 1tnbnt.exe 448 hbnbhb.exe -
Processes:
resource yara_rule behavioral1/memory/2432-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/348-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1884-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-302-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-7669-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
32dd3716420b5e067b8bb89183e865d0_NeikiAnalytics.exebbtbnn.exejjdjv.exebthtbh.exetbnhnn.exe5fllrxl.exehntttt.exejvpjv.exepddvd.exehbhhnt.exehtnthh.exe1vjdj.exepjpvp.exexxrlxxl.exethtthh.exevppvj.exedescription pid process target process PID 2432 wrote to memory of 2096 2432 32dd3716420b5e067b8bb89183e865d0_NeikiAnalytics.exe bbtbnn.exe PID 2432 wrote to memory of 2096 2432 32dd3716420b5e067b8bb89183e865d0_NeikiAnalytics.exe bbtbnn.exe PID 2432 wrote to memory of 2096 2432 32dd3716420b5e067b8bb89183e865d0_NeikiAnalytics.exe bbtbnn.exe PID 2432 wrote to memory of 2096 2432 32dd3716420b5e067b8bb89183e865d0_NeikiAnalytics.exe bbtbnn.exe PID 2096 wrote to memory of 3052 2096 bbtbnn.exe jjdjv.exe PID 2096 wrote to memory of 3052 2096 bbtbnn.exe jjdjv.exe PID 2096 wrote to memory of 3052 2096 bbtbnn.exe jjdjv.exe PID 2096 wrote to memory of 3052 2096 bbtbnn.exe jjdjv.exe PID 3052 wrote to memory of 2772 3052 jjdjv.exe bthtbh.exe PID 3052 wrote to memory of 2772 3052 jjdjv.exe bthtbh.exe PID 3052 wrote to memory of 2772 3052 jjdjv.exe bthtbh.exe PID 3052 wrote to memory of 2772 3052 jjdjv.exe bthtbh.exe PID 2772 wrote to memory of 2896 2772 bthtbh.exe tbnhnn.exe PID 2772 wrote to memory of 2896 2772 bthtbh.exe tbnhnn.exe PID 2772 wrote to memory of 2896 2772 bthtbh.exe tbnhnn.exe PID 2772 wrote to memory of 2896 2772 bthtbh.exe tbnhnn.exe PID 2896 wrote to memory of 2624 2896 tbnhnn.exe 5fllrxl.exe PID 2896 wrote to memory of 2624 2896 tbnhnn.exe 5fllrxl.exe PID 2896 wrote to memory of 2624 2896 tbnhnn.exe 5fllrxl.exe PID 2896 wrote to memory of 2624 2896 tbnhnn.exe 5fllrxl.exe PID 2624 wrote to memory of 2812 2624 5fllrxl.exe hntttt.exe PID 2624 wrote to memory of 2812 2624 5fllrxl.exe hntttt.exe PID 2624 wrote to memory of 2812 2624 5fllrxl.exe hntttt.exe PID 2624 wrote to memory of 2812 2624 5fllrxl.exe hntttt.exe PID 2812 wrote to memory of 2612 2812 hntttt.exe jvpjv.exe PID 2812 wrote to memory of 2612 2812 hntttt.exe jvpjv.exe PID 2812 wrote to memory of 2612 2812 hntttt.exe jvpjv.exe PID 2812 wrote to memory of 2612 2812 hntttt.exe jvpjv.exe PID 2612 wrote to memory of 2392 2612 jvpjv.exe pddvd.exe PID 2612 wrote to memory of 2392 2612 jvpjv.exe pddvd.exe PID 2612 wrote to memory of 2392 2612 jvpjv.exe pddvd.exe PID 2612 wrote to memory of 2392 2612 jvpjv.exe pddvd.exe PID 2392 wrote to memory of 348 2392 pddvd.exe hbhhnt.exe PID 2392 wrote to memory of 348 2392 pddvd.exe hbhhnt.exe PID 2392 wrote to memory of 348 2392 pddvd.exe hbhhnt.exe PID 2392 wrote to memory of 348 2392 pddvd.exe hbhhnt.exe PID 348 wrote to memory of 2848 348 hbhhnt.exe htnthh.exe PID 348 wrote to memory of 2848 348 hbhhnt.exe htnthh.exe PID 348 wrote to memory of 2848 348 hbhhnt.exe htnthh.exe PID 348 wrote to memory of 2848 348 hbhhnt.exe htnthh.exe PID 2848 wrote to memory of 3000 2848 htnthh.exe 1vjdj.exe PID 2848 wrote to memory of 3000 2848 htnthh.exe 1vjdj.exe PID 2848 wrote to memory of 3000 2848 htnthh.exe 1vjdj.exe PID 2848 wrote to memory of 3000 2848 htnthh.exe 1vjdj.exe PID 3000 wrote to memory of 1804 3000 1vjdj.exe pjpvp.exe PID 3000 wrote to memory of 1804 3000 1vjdj.exe pjpvp.exe PID 3000 wrote to memory of 1804 3000 1vjdj.exe pjpvp.exe PID 3000 wrote to memory of 1804 3000 1vjdj.exe pjpvp.exe PID 1804 wrote to memory of 2172 1804 pjpvp.exe xxrlxxl.exe PID 1804 wrote to memory of 2172 1804 pjpvp.exe xxrlxxl.exe PID 1804 wrote to memory of 2172 1804 pjpvp.exe xxrlxxl.exe PID 1804 wrote to memory of 2172 1804 pjpvp.exe xxrlxxl.exe PID 2172 wrote to memory of 1664 2172 xxrlxxl.exe thtthh.exe PID 2172 wrote to memory of 1664 2172 xxrlxxl.exe thtthh.exe PID 2172 wrote to memory of 1664 2172 xxrlxxl.exe thtthh.exe PID 2172 wrote to memory of 1664 2172 xxrlxxl.exe thtthh.exe PID 1664 wrote to memory of 2220 1664 thtthh.exe vppvj.exe PID 1664 wrote to memory of 2220 1664 thtthh.exe vppvj.exe PID 1664 wrote to memory of 2220 1664 thtthh.exe vppvj.exe PID 1664 wrote to memory of 2220 1664 thtthh.exe vppvj.exe PID 2220 wrote to memory of 1668 2220 vppvj.exe ppjvd.exe PID 2220 wrote to memory of 1668 2220 vppvj.exe ppjvd.exe PID 2220 wrote to memory of 1668 2220 vppvj.exe ppjvd.exe PID 2220 wrote to memory of 1668 2220 vppvj.exe ppjvd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32dd3716420b5e067b8bb89183e865d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\32dd3716420b5e067b8bb89183e865d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\bbtbnn.exec:\bbtbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\jjdjv.exec:\jjdjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\bthtbh.exec:\bthtbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\tbnhnn.exec:\tbnhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\5fllrxl.exec:\5fllrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\hntttt.exec:\hntttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\jvpjv.exec:\jvpjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\pddvd.exec:\pddvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\hbhhnt.exec:\hbhhnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\htnthh.exec:\htnthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\1vjdj.exec:\1vjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\pjpvp.exec:\pjpvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\xxrlxxl.exec:\xxrlxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\thtthh.exec:\thtthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\vppvj.exec:\vppvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\ppjvd.exec:\ppjvd.exe17⤵
- Executes dropped EXE
PID:1668 -
\??\c:\5xxlxlx.exec:\5xxlxlx.exe18⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hnnthn.exec:\hnnthn.exe19⤵
- Executes dropped EXE
PID:2112 -
\??\c:\5vpvd.exec:\5vpvd.exe20⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vpdpv.exec:\vpdpv.exe21⤵
- Executes dropped EXE
PID:3044 -
\??\c:\llfrxfl.exec:\llfrxfl.exe22⤵
- Executes dropped EXE
PID:2460 -
\??\c:\lxrrflr.exec:\lxrrflr.exe23⤵
- Executes dropped EXE
PID:1088 -
\??\c:\hbtbhn.exec:\hbtbhn.exe24⤵
- Executes dropped EXE
PID:1656 -
\??\c:\jjpvj.exec:\jjpvj.exe25⤵
- Executes dropped EXE
PID:1928 -
\??\c:\9xrrffx.exec:\9xrrffx.exe26⤵
- Executes dropped EXE
PID:692 -
\??\c:\bnttbh.exec:\bnttbh.exe27⤵
- Executes dropped EXE
PID:2120 -
\??\c:\dvppd.exec:\dvppd.exe28⤵
- Executes dropped EXE
PID:1884 -
\??\c:\djppp.exec:\djppp.exe29⤵
- Executes dropped EXE
PID:2436 -
\??\c:\fxxxlll.exec:\fxxxlll.exe30⤵
- Executes dropped EXE
PID:980 -
\??\c:\bnbhtb.exec:\bnbhtb.exe31⤵
- Executes dropped EXE
PID:1404 -
\??\c:\nnbbtt.exec:\nnbbtt.exe32⤵
- Executes dropped EXE
PID:1516 -
\??\c:\vppvd.exec:\vppvd.exe33⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rlxlxxl.exec:\rlxlxxl.exe34⤵
- Executes dropped EXE
PID:1620 -
\??\c:\frlflfr.exec:\frlflfr.exe35⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nnhntb.exec:\nnhntb.exe36⤵
- Executes dropped EXE
PID:2680 -
\??\c:\pjppv.exec:\pjppv.exe37⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vpjjv.exec:\vpjjv.exe38⤵
- Executes dropped EXE
PID:2668 -
\??\c:\lrxxffl.exec:\lrxxffl.exe39⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lfxrllr.exec:\lfxrllr.exe40⤵
- Executes dropped EXE
PID:2564 -
\??\c:\tthnbb.exec:\tthnbb.exe41⤵
- Executes dropped EXE
PID:2196 -
\??\c:\tnbnbh.exec:\tnbnbh.exe42⤵
- Executes dropped EXE
PID:2548 -
\??\c:\9dvjj.exec:\9dvjj.exe43⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jdppv.exec:\jdppv.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\llxlxlx.exec:\llxlxlx.exe45⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xlxrxfl.exec:\xlxrxfl.exe46⤵
- Executes dropped EXE
PID:2800 -
\??\c:\tnbhtb.exec:\tnbhtb.exe47⤵
- Executes dropped EXE
PID:2860 -
\??\c:\7btbnn.exec:\7btbnn.exe48⤵
- Executes dropped EXE
PID:2852 -
\??\c:\vpjvj.exec:\vpjvj.exe49⤵
- Executes dropped EXE
PID:2956 -
\??\c:\5jjdp.exec:\5jjdp.exe50⤵
- Executes dropped EXE
PID:1068 -
\??\c:\xlfxfrf.exec:\xlfxfrf.exe51⤵
- Executes dropped EXE
PID:1032 -
\??\c:\1lrxlrf.exec:\1lrxlrf.exe52⤵
- Executes dropped EXE
PID:2172 -
\??\c:\hbnnbh.exec:\hbnnbh.exe53⤵
- Executes dropped EXE
PID:1664 -
\??\c:\nntnnb.exec:\nntnnb.exe54⤵
- Executes dropped EXE
PID:2200 -
\??\c:\3pjpd.exec:\3pjpd.exe55⤵
- Executes dropped EXE
PID:2212 -
\??\c:\dvppd.exec:\dvppd.exe56⤵
- Executes dropped EXE
PID:2300 -
\??\c:\ffxrllx.exec:\ffxrllx.exe57⤵
- Executes dropped EXE
PID:1376 -
\??\c:\ttntbb.exec:\ttntbb.exe58⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hhbbnb.exec:\hhbbnb.exe59⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vvjvj.exec:\vvjvj.exe60⤵
- Executes dropped EXE
PID:848 -
\??\c:\dvpvj.exec:\dvpvj.exe61⤵
- Executes dropped EXE
PID:264 -
\??\c:\xfxxlfl.exec:\xfxxlfl.exe62⤵
- Executes dropped EXE
PID:1488 -
\??\c:\lflxlxl.exec:\lflxlxl.exe63⤵
- Executes dropped EXE
PID:1088 -
\??\c:\1tnbnt.exec:\1tnbnt.exe64⤵
- Executes dropped EXE
PID:1656 -
\??\c:\hbnbhb.exec:\hbnbhb.exe65⤵
- Executes dropped EXE
PID:448 -
\??\c:\9ppdv.exec:\9ppdv.exe66⤵PID:628
-
\??\c:\jjpdd.exec:\jjpdd.exe67⤵PID:3036
-
\??\c:\rrrlxll.exec:\rrrlxll.exe68⤵PID:1520
-
\??\c:\nnnnhh.exec:\nnnnhh.exe69⤵PID:1244
-
\??\c:\hthbht.exec:\hthbht.exe70⤵PID:1768
-
\??\c:\dddpd.exec:\dddpd.exe71⤵PID:2932
-
\??\c:\5vjpp.exec:\5vjpp.exe72⤵PID:1512
-
\??\c:\lfxlxlf.exec:\lfxlxlf.exe73⤵PID:2960
-
\??\c:\ntnhnn.exec:\ntnhnn.exe74⤵PID:1516
-
\??\c:\nhttbb.exec:\nhttbb.exe75⤵PID:1612
-
\??\c:\vvpvj.exec:\vvpvj.exe76⤵PID:1712
-
\??\c:\dvpdd.exec:\dvpdd.exe77⤵PID:2732
-
\??\c:\llfrflf.exec:\llfrflf.exe78⤵PID:2692
-
\??\c:\nntthh.exec:\nntthh.exe79⤵PID:2660
-
\??\c:\bnhbnt.exec:\bnhbnt.exe80⤵PID:2288
-
\??\c:\jdjdv.exec:\jdjdv.exe81⤵PID:2832
-
\??\c:\3pdpv.exec:\3pdpv.exe82⤵PID:2540
-
\??\c:\llfrxxr.exec:\llfrxxr.exe83⤵PID:2552
-
\??\c:\hbtbnt.exec:\hbtbnt.exe84⤵PID:2812
-
\??\c:\hhnnbb.exec:\hhnnbb.exe85⤵PID:2984
-
\??\c:\jjpvv.exec:\jjpvv.exe86⤵PID:2612
-
\??\c:\3vvdd.exec:\3vvdd.exe87⤵PID:2780
-
\??\c:\fxlrrxx.exec:\fxlrrxx.exe88⤵PID:2636
-
\??\c:\rlflffl.exec:\rlflffl.exe89⤵PID:1816
-
\??\c:\hbntbh.exec:\hbntbh.exe90⤵PID:2848
-
\??\c:\nhthtt.exec:\nhthtt.exe91⤵PID:2016
-
\??\c:\pdddd.exec:\pdddd.exe92⤵PID:1824
-
\??\c:\9vvjv.exec:\9vvjv.exe93⤵PID:304
-
\??\c:\fxrxflf.exec:\fxrxflf.exe94⤵PID:2180
-
\??\c:\1fxlrxl.exec:\1fxlrxl.exe95⤵PID:2272
-
\??\c:\htthht.exec:\htthht.exe96⤵PID:2200
-
\??\c:\thtbhh.exec:\thtbhh.exe97⤵PID:1640
-
\??\c:\7vpdp.exec:\7vpdp.exe98⤵PID:272
-
\??\c:\fffflfr.exec:\fffflfr.exe99⤵PID:2516
-
\??\c:\xrfrffr.exec:\xrfrffr.exe100⤵PID:2140
-
\??\c:\3nhnbh.exec:\3nhnbh.exe101⤵PID:2372
-
\??\c:\bthtbn.exec:\bthtbn.exe102⤵PID:1168
-
\??\c:\dvpvv.exec:\dvpvv.exe103⤵PID:1492
-
\??\c:\xxxrxll.exec:\xxxrxll.exe104⤵PID:1924
-
\??\c:\rlflflf.exec:\rlflflf.exe105⤵PID:1940
-
\??\c:\hbbhtt.exec:\hbbhtt.exe106⤵PID:1928
-
\??\c:\bthnnn.exec:\bthnnn.exe107⤵PID:692
-
\??\c:\7vppp.exec:\7vppp.exe108⤵PID:1752
-
\??\c:\jvppv.exec:\jvppv.exe109⤵PID:1148
-
\??\c:\fxxfrff.exec:\fxxfrff.exe110⤵PID:888
-
\??\c:\nnnbhb.exec:\nnnbhb.exe111⤵PID:1100
-
\??\c:\thbnbb.exec:\thbnbb.exe112⤵PID:2156
-
\??\c:\jjddv.exec:\jjddv.exe113⤵PID:2268
-
\??\c:\dvjvj.exec:\dvjvj.exe114⤵PID:2256
-
\??\c:\llfrlfl.exec:\llfrlfl.exe115⤵PID:1744
-
\??\c:\rrlffxf.exec:\rrlffxf.exe116⤵PID:1084
-
\??\c:\3tnbtn.exec:\3tnbtn.exe117⤵PID:2184
-
\??\c:\3vjjv.exec:\3vjjv.exe118⤵PID:2164
-
\??\c:\pjdpp.exec:\pjdpp.exe119⤵PID:2680
-
\??\c:\1ffrffl.exec:\1ffrffl.exe120⤵PID:2408
-
\??\c:\7fxfllf.exec:\7fxfllf.exe121⤵PID:2820
-
\??\c:\bbtnbt.exec:\bbtnbt.exe122⤵PID:2772
-
\??\c:\1nbhnn.exec:\1nbhnn.exe123⤵PID:2564
-
\??\c:\ddvpd.exec:\ddvpd.exe124⤵PID:2196
-
\??\c:\rlflxfr.exec:\rlflxfr.exe125⤵PID:2980
-
\??\c:\lfxlfrl.exec:\lfxlfrl.exe126⤵PID:2992
-
\??\c:\nhbbnb.exec:\nhbbnb.exe127⤵PID:2512
-
\??\c:\hnnnnb.exec:\hnnnnb.exe128⤵PID:2032
-
\??\c:\pjdjv.exec:\pjdjv.exe129⤵PID:2800
-
\??\c:\7xflffl.exec:\7xflffl.exe130⤵PID:2792
-
\??\c:\xxlxrxf.exec:\xxlxrxf.exe131⤵PID:2012
-
\??\c:\bbhbtb.exec:\bbhbtb.exe132⤵PID:2852
-
\??\c:\bnhbhh.exec:\bnhbhh.exe133⤵PID:1036
-
\??\c:\vppdp.exec:\vppdp.exe134⤵PID:1032
-
\??\c:\jjvvj.exec:\jjvvj.exe135⤵PID:2224
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe136⤵PID:1664
-
\??\c:\rfffrxx.exec:\rfffrxx.exe137⤵PID:1732
-
\??\c:\hhntnh.exec:\hhntnh.exe138⤵PID:1740
-
\??\c:\hbnnhb.exec:\hbnnhb.exe139⤵PID:2300
-
\??\c:\pdpvj.exec:\pdpvj.exe140⤵PID:1720
-
\??\c:\dvppd.exec:\dvppd.exe141⤵PID:2868
-
\??\c:\1frxlfl.exec:\1frxlfl.exe142⤵PID:2444
-
\??\c:\rrllflx.exec:\rrllflx.exe143⤵PID:1316
-
\??\c:\hbnntt.exec:\hbnntt.exe144⤵PID:264
-
\??\c:\vvjvj.exec:\vvjvj.exe145⤵PID:2576
-
\??\c:\vpddp.exec:\vpddp.exe146⤵PID:1088
-
\??\c:\9lflllx.exec:\9lflllx.exe147⤵PID:1484
-
\??\c:\fxrrffl.exec:\fxrrffl.exe148⤵PID:1928
-
\??\c:\9hbbhh.exec:\9hbbhh.exe149⤵PID:1888
-
\??\c:\3hnbtb.exec:\3hnbtb.exe150⤵PID:628
-
\??\c:\pvppv.exec:\pvppv.exe151⤵PID:1520
-
\??\c:\fxxlxfl.exec:\fxxlxfl.exe152⤵PID:920
-
\??\c:\xxfrlrl.exec:\xxfrlrl.exe153⤵PID:2108
-
\??\c:\nthbth.exec:\nthbth.exe154⤵PID:2156
-
\??\c:\hbbthh.exec:\hbbthh.exe155⤵PID:2324
-
\??\c:\dddvv.exec:\dddvv.exe156⤵PID:1512
-
\??\c:\lrrllfx.exec:\lrrllfx.exe157⤵PID:2092
-
\??\c:\xxxxrfl.exec:\xxxxrfl.exe158⤵PID:1516
-
\??\c:\tthntt.exec:\tthntt.exe159⤵PID:1620
-
\??\c:\1vppd.exec:\1vppd.exe160⤵PID:2684
-
\??\c:\pvvpj.exec:\pvvpj.exe161⤵PID:2900
-
\??\c:\fffxflx.exec:\fffxflx.exe162⤵PID:2660
-
\??\c:\tthntb.exec:\tthntb.exe163⤵PID:2288
-
\??\c:\7jjjp.exec:\7jjjp.exe164⤵PID:2668
-
\??\c:\dddpv.exec:\dddpv.exe165⤵PID:2580
-
\??\c:\rlrxfll.exec:\rlrxfll.exe166⤵PID:2552
-
\??\c:\btbnbn.exec:\btbnbn.exe167⤵PID:2452
-
\??\c:\bntnth.exec:\bntnth.exe168⤵PID:2812
-
\??\c:\jjjpp.exec:\jjjpp.exe169⤵PID:2612
-
\??\c:\vvddd.exec:\vvddd.exe170⤵PID:2608
-
\??\c:\fxrfrfx.exec:\fxrfrfx.exe171⤵PID:2864
-
\??\c:\3nbhbt.exec:\3nbhbt.exe172⤵PID:2636
-
\??\c:\hbhbht.exec:\hbhbht.exe173⤵PID:1804
-
\??\c:\hbhbtb.exec:\hbhbtb.exe174⤵PID:1068
-
\??\c:\djvdp.exec:\djvdp.exe175⤵PID:1824
-
\??\c:\jjvdp.exec:\jjvdp.exe176⤵PID:2172
-
\??\c:\ffrlxff.exec:\ffrlxff.exe177⤵PID:2180
-
\??\c:\ffrfrrr.exec:\ffrfrrr.exe178⤵PID:1588
-
\??\c:\nbthhh.exec:\nbthhh.exe179⤵PID:2212
-
\??\c:\xlfrfll.exec:\xlfrfll.exe180⤵PID:2200
-
\??\c:\hbnnbb.exec:\hbnnbb.exe181⤵PID:1668
-
\??\c:\dvjjd.exec:\dvjjd.exe182⤵PID:2716
-
\??\c:\vjpvd.exec:\vjpvd.exe183⤵PID:2868
-
\??\c:\xxxfllx.exec:\xxxfllx.exe184⤵PID:2444
-
\??\c:\thtbbn.exec:\thtbbn.exe185⤵PID:2912
-
\??\c:\vppvj.exec:\vppvj.exe186⤵PID:1696
-
\??\c:\jpvvd.exec:\jpvvd.exe187⤵PID:2460
-
\??\c:\llxfrxr.exec:\llxfrxr.exe188⤵PID:1088
-
\??\c:\bbbbtb.exec:\bbbbtb.exe189⤵PID:1940
-
\??\c:\hbbhbn.exec:\hbbhbn.exe190⤵PID:940
-
\??\c:\ppjvj.exec:\ppjvj.exe191⤵PID:684
-
\??\c:\7lxxlxr.exec:\7lxxlxr.exe192⤵PID:628
-
\??\c:\nhtnnn.exec:\nhtnnn.exe193⤵PID:1244
-
\??\c:\btnbbt.exec:\btnbbt.exe194⤵PID:888
-
\??\c:\7dvjv.exec:\7dvjv.exe195⤵PID:1992
-
\??\c:\vvppv.exec:\vvppv.exe196⤵PID:2252
-
\??\c:\7xxlllr.exec:\7xxlllr.exe197⤵PID:2932
-
\??\c:\bbhhnb.exec:\bbhhnb.exe198⤵PID:2256
-
\??\c:\pjppp.exec:\pjppp.exe199⤵PID:844
-
\??\c:\ddddp.exec:\ddddp.exe200⤵PID:1084
-
\??\c:\lflrxfl.exec:\lflrxfl.exe201⤵PID:2652
-
\??\c:\xrfflfr.exec:\xrfflfr.exe202⤵PID:2164
-
\??\c:\nnbhtb.exec:\nnbhtb.exe203⤵PID:1692
-
\??\c:\jpvdd.exec:\jpvdd.exe204⤵PID:2660
-
\??\c:\vjdjv.exec:\vjdjv.exe205⤵PID:2736
-
\??\c:\fxxxxxf.exec:\fxxxxxf.exe206⤵PID:2772
-
\??\c:\7xrrxxx.exec:\7xrrxxx.exe207⤵PID:2816
-
\??\c:\htnnhn.exec:\htnnhn.exe208⤵PID:2976
-
\??\c:\htnthh.exec:\htnthh.exe209⤵PID:2984
-
\??\c:\pjdjp.exec:\pjdjp.exe210⤵PID:2812
-
\??\c:\jdppd.exec:\jdppd.exe211⤵PID:2596
-
\??\c:\xrllrxf.exec:\xrllrxf.exe212⤵PID:2860
-
\??\c:\nnbtnn.exec:\nnbtnn.exe213⤵PID:2864
-
\??\c:\thtntn.exec:\thtntn.exe214⤵PID:2012
-
\??\c:\vpvpv.exec:\vpvpv.exe215⤵PID:2332
-
\??\c:\llxxrll.exec:\llxxrll.exe216⤵PID:300
-
\??\c:\xrxllrx.exec:\xrxllrx.exe217⤵PID:1824
-
\??\c:\nhtthh.exec:\nhtthh.exe218⤵PID:2172
-
\??\c:\7vjvj.exec:\7vjvj.exe219⤵PID:1636
-
\??\c:\dvdjj.exec:\dvdjj.exe220⤵PID:2116
-
\??\c:\rrffllx.exec:\rrffllx.exe221⤵PID:2212
-
\??\c:\3bbtnb.exec:\3bbtnb.exe222⤵PID:2200
-
\??\c:\3vddj.exec:\3vddj.exe223⤵PID:1860
-
\??\c:\vppvj.exec:\vppvj.exe224⤵PID:1720
-
\??\c:\llfllrx.exec:\llfllrx.exe225⤵PID:484
-
\??\c:\rfxxrxf.exec:\rfxxrxf.exe226⤵PID:788
-
\??\c:\nhtttb.exec:\nhtttb.exe227⤵PID:2372
-
\??\c:\pppvd.exec:\pppvd.exe228⤵PID:1316
-
\??\c:\jvjvp.exec:\jvjvp.exe229⤵PID:1924
-
\??\c:\xrrxrxf.exec:\xrrxrxf.exe230⤵PID:2576
-
\??\c:\lflfxfr.exec:\lflfxfr.exe231⤵PID:1528
-
\??\c:\ttntnt.exec:\ttntnt.exe232⤵PID:1484
-
\??\c:\7ppdv.exec:\7ppdv.exe233⤵PID:2192
-
\??\c:\5jjpj.exec:\5jjpj.exe234⤵PID:1880
-
\??\c:\lfxlxfr.exec:\lfxlxfr.exe235⤵PID:628
-
\??\c:\llrxlrf.exec:\llrxlrf.exe236⤵PID:1876
-
\??\c:\httnbh.exec:\httnbh.exe237⤵PID:1768
-
\??\c:\7jvpj.exec:\7jvpj.exe238⤵PID:2108
-
\??\c:\dvppj.exec:\dvppj.exe239⤵PID:2156
-
\??\c:\fllxxxl.exec:\fllxxxl.exe240⤵PID:2324
-
\??\c:\llrxxfr.exec:\llrxxfr.exe241⤵PID:2072
-
\??\c:\tnbnhh.exec:\tnbnhh.exe242⤵PID:2092