Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 07:58
Behavioral task
behavioral1
Sample
a72698afdad1a8e6880299ef380c5a20_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a72698afdad1a8e6880299ef380c5a20_NeikiAnalytics.exe
-
Size
339KB
-
MD5
a72698afdad1a8e6880299ef380c5a20
-
SHA1
65e635ac7d11b4edfd215695aacf6f9bc089cbae
-
SHA256
7a0f172229c2e6f41d28bb1d1e3fd74f0c7fcda44dfa2c0e025278acd4fcf766
-
SHA512
2afc7d1b896b725aed1364774fcaf56c8cde1e9209bf02c89cbeb547ffb2e43f934cf332b83890c817d5daed4a9140a4f8f9797b1461f249eaedcd9fe8783be8
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBHNgu5ex1B2OkEv0KvmhNiV:9cm4FmowdHoS4BtguSPKyHV
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
Processes:
resource yara_rule behavioral1/memory/2276-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-23-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2600-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-34-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2692-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1900-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-103-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3000-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-125-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2528-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-174-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2892-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1104-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1044-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/864-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1528-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2252-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1796-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1456-488-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1516-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-560-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-737-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1876-777-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1760-798-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1448-950-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bnbhbb.exe7pvvv.exefrxlrxx.exenhbhhn.exe9xllrxl.exexlxxfxl.exedvjpv.exefrfrlff.exenbhnhh.exeddpvj.exexflrflr.exehbbnbb.exejdpdp.exe5fflfxf.exetnhtht.exenbnhhh.exelxrrlfr.exellrxxrx.exehhthnt.exefrflflr.exetbbhtb.exetbbbtt.exe9xllrrx.exexlxfllr.exe1vdjp.exe7llllff.exepjddv.exejvdvp.exentnbhn.exejvddj.exerlrlllr.exebntbhh.exe5ddvd.exe9vpjp.exefrxflxl.exenbntbh.exethttbn.exe5vjpp.exe1vvdv.exerffxrll.exebnttbh.exedpvpj.exevjvvj.exexrlrflx.exetnnnhh.exejddvp.exevjvdj.exe7lrrxxl.exenhbhnn.exepdppp.exevpjvd.exerfflfff.exetnbbnb.exenhtbnh.exe1djdd.exe9fxrrrr.exe3lrrffr.exebbttbb.exebthnnn.exedpjvp.exefrrlxrr.exexxrfrxl.exe7hntbh.exenbhhhh.exepid process 1632 bnbhbb.exe 2736 7pvvv.exe 2600 frxlrxx.exe 2692 nhbhhn.exe 2112 9xllrxl.exe 2644 xlxxfxl.exe 2724 dvjpv.exe 2472 frfrlff.exe 1900 nbhnhh.exe 2312 ddpvj.exe 3000 xflrflr.exe 2064 hbbnbb.exe 1644 jdpdp.exe 2528 5fflfxf.exe 2636 tnhtht.exe 1592 nbnhhh.exe 2856 lxrrlfr.exe 1356 llrxxrx.exe 1576 hhthnt.exe 2556 frflflr.exe 2904 tbbhtb.exe 2892 tbbbtt.exe 3060 9xllrrx.exe 404 xlxfllr.exe 1104 1vdjp.exe 1044 7llllff.exe 1040 pjddv.exe 920 jvdvp.exe 1304 ntnbhn.exe 864 jvddj.exe 2420 rlrlllr.exe 1528 bntbhh.exe 1680 5ddvd.exe 2252 9vpjp.exe 2168 frxflxl.exe 3068 nbntbh.exe 2664 thttbn.exe 2660 5vjpp.exe 2584 1vvdv.exe 1712 rffxrll.exe 2796 bnttbh.exe 2496 dpvpj.exe 2644 vjvvj.exe 2492 xrlrflx.exe 2628 tnnnhh.exe 2536 jddvp.exe 2780 vjvdj.exe 2312 7lrrxxl.exe 3008 nhbhnn.exe 1796 pdppp.exe 2812 vpjvd.exe 2448 rfflfff.exe 2528 tnbbnb.exe 2636 nhtbnh.exe 2952 1djdd.exe 2864 9fxrrrr.exe 2848 3lrrffr.exe 1552 bbttbb.exe 1748 bthnnn.exe 1732 dpjvp.exe 1456 frrlxrr.exe 2128 xxrfrxl.exe 2652 7hntbh.exe 1300 nbhhhh.exe -
Processes:
resource yara_rule behavioral1/memory/2276-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2276-7-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bnbhbb.exe upx C:\7pvvv.exe upx behavioral1/memory/1632-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2736-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1632-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2736-23-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\frxlrxx.exe upx behavioral1/memory/2600-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2692-40-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbhhn.exe upx C:\9xllrxl.exe upx behavioral1/memory/2692-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-58-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlxxfxl.exe upx behavioral1/memory/2644-67-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvjpv.exe upx behavioral1/memory/2724-76-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frfrlff.exe upx behavioral1/memory/2472-78-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbhnhh.exe upx C:\ddpvj.exe upx behavioral1/memory/1900-93-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xflrflr.exe upx C:\hbbnbb.exe upx behavioral1/memory/3000-112-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdpdp.exe upx behavioral1/memory/1644-121-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5fflfxf.exe upx C:\tnhtht.exe upx behavioral1/memory/2528-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-142-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbnhhh.exe upx C:\lxrrlfr.exe upx C:\llrxxrx.exe upx C:\hhthnt.exe upx behavioral1/memory/1356-172-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frflflr.exe upx C:\tbbhtb.exe upx C:\tbbbtt.exe upx C:\9xllrrx.exe upx behavioral1/memory/2892-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3060-217-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlxfllr.exe upx C:\1vdjp.exe upx behavioral1/memory/1104-228-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7llllff.exe upx behavioral1/memory/1044-243-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjddv.exe upx C:\jvdvp.exe upx C:\ntnbhn.exe upx C:\jvddj.exe upx behavioral1/memory/864-277-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlrlllr.exe upx C:\bntbhh.exe upx behavioral1/memory/1528-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2252-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2168-308-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3068-315-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2660-334-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1712-341-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1712-348-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2628-374-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a72698afdad1a8e6880299ef380c5a20_NeikiAnalytics.exebnbhbb.exe7pvvv.exefrxlrxx.exenhbhhn.exe9xllrxl.exexlxxfxl.exedvjpv.exefrfrlff.exenbhnhh.exeddpvj.exexflrflr.exehbbnbb.exejdpdp.exe5fflfxf.exetnhtht.exedescription pid process target process PID 2276 wrote to memory of 1632 2276 a72698afdad1a8e6880299ef380c5a20_NeikiAnalytics.exe bnbhbb.exe PID 2276 wrote to memory of 1632 2276 a72698afdad1a8e6880299ef380c5a20_NeikiAnalytics.exe bnbhbb.exe PID 2276 wrote to memory of 1632 2276 a72698afdad1a8e6880299ef380c5a20_NeikiAnalytics.exe bnbhbb.exe PID 2276 wrote to memory of 1632 2276 a72698afdad1a8e6880299ef380c5a20_NeikiAnalytics.exe bnbhbb.exe PID 1632 wrote to memory of 2736 1632 bnbhbb.exe 7pvvv.exe PID 1632 wrote to memory of 2736 1632 bnbhbb.exe 7pvvv.exe PID 1632 wrote to memory of 2736 1632 bnbhbb.exe 7pvvv.exe PID 1632 wrote to memory of 2736 1632 bnbhbb.exe 7pvvv.exe PID 2736 wrote to memory of 2600 2736 7pvvv.exe frxlrxx.exe PID 2736 wrote to memory of 2600 2736 7pvvv.exe frxlrxx.exe PID 2736 wrote to memory of 2600 2736 7pvvv.exe frxlrxx.exe PID 2736 wrote to memory of 2600 2736 7pvvv.exe frxlrxx.exe PID 2600 wrote to memory of 2692 2600 frxlrxx.exe nhbhhn.exe PID 2600 wrote to memory of 2692 2600 frxlrxx.exe nhbhhn.exe PID 2600 wrote to memory of 2692 2600 frxlrxx.exe nhbhhn.exe PID 2600 wrote to memory of 2692 2600 frxlrxx.exe nhbhhn.exe PID 2692 wrote to memory of 2112 2692 nhbhhn.exe 9xllrxl.exe PID 2692 wrote to memory of 2112 2692 nhbhhn.exe 9xllrxl.exe PID 2692 wrote to memory of 2112 2692 nhbhhn.exe 9xllrxl.exe PID 2692 wrote to memory of 2112 2692 nhbhhn.exe 9xllrxl.exe PID 2112 wrote to memory of 2644 2112 9xllrxl.exe xlxxfxl.exe PID 2112 wrote to memory of 2644 2112 9xllrxl.exe xlxxfxl.exe PID 2112 wrote to memory of 2644 2112 9xllrxl.exe xlxxfxl.exe PID 2112 wrote to memory of 2644 2112 9xllrxl.exe xlxxfxl.exe PID 2644 wrote to memory of 2724 2644 xlxxfxl.exe dvjpv.exe PID 2644 wrote to memory of 2724 2644 xlxxfxl.exe dvjpv.exe PID 2644 wrote to memory of 2724 2644 xlxxfxl.exe dvjpv.exe PID 2644 wrote to memory of 2724 2644 xlxxfxl.exe dvjpv.exe PID 2724 wrote to memory of 2472 2724 dvjpv.exe frfrlff.exe PID 2724 wrote to memory of 2472 2724 dvjpv.exe frfrlff.exe PID 2724 wrote to memory of 2472 2724 dvjpv.exe frfrlff.exe PID 2724 wrote to memory of 2472 2724 dvjpv.exe frfrlff.exe PID 2472 wrote to memory of 1900 2472 frfrlff.exe nbhnhh.exe PID 2472 wrote to memory of 1900 2472 frfrlff.exe nbhnhh.exe PID 2472 wrote to memory of 1900 2472 frfrlff.exe nbhnhh.exe PID 2472 wrote to memory of 1900 2472 frfrlff.exe nbhnhh.exe PID 1900 wrote to memory of 2312 1900 nbhnhh.exe ddpvj.exe PID 1900 wrote to memory of 2312 1900 nbhnhh.exe ddpvj.exe PID 1900 wrote to memory of 2312 1900 nbhnhh.exe ddpvj.exe PID 1900 wrote to memory of 2312 1900 nbhnhh.exe ddpvj.exe PID 2312 wrote to memory of 3000 2312 ddpvj.exe xflrflr.exe PID 2312 wrote to memory of 3000 2312 ddpvj.exe xflrflr.exe PID 2312 wrote to memory of 3000 2312 ddpvj.exe xflrflr.exe PID 2312 wrote to memory of 3000 2312 ddpvj.exe xflrflr.exe PID 3000 wrote to memory of 2064 3000 xflrflr.exe hbbnbb.exe PID 3000 wrote to memory of 2064 3000 xflrflr.exe hbbnbb.exe PID 3000 wrote to memory of 2064 3000 xflrflr.exe hbbnbb.exe PID 3000 wrote to memory of 2064 3000 xflrflr.exe hbbnbb.exe PID 2064 wrote to memory of 1644 2064 hbbnbb.exe jdpdp.exe PID 2064 wrote to memory of 1644 2064 hbbnbb.exe jdpdp.exe PID 2064 wrote to memory of 1644 2064 hbbnbb.exe jdpdp.exe PID 2064 wrote to memory of 1644 2064 hbbnbb.exe jdpdp.exe PID 1644 wrote to memory of 2528 1644 jdpdp.exe 5fflfxf.exe PID 1644 wrote to memory of 2528 1644 jdpdp.exe 5fflfxf.exe PID 1644 wrote to memory of 2528 1644 jdpdp.exe 5fflfxf.exe PID 1644 wrote to memory of 2528 1644 jdpdp.exe 5fflfxf.exe PID 2528 wrote to memory of 2636 2528 5fflfxf.exe tnhtht.exe PID 2528 wrote to memory of 2636 2528 5fflfxf.exe tnhtht.exe PID 2528 wrote to memory of 2636 2528 5fflfxf.exe tnhtht.exe PID 2528 wrote to memory of 2636 2528 5fflfxf.exe tnhtht.exe PID 2636 wrote to memory of 1592 2636 tnhtht.exe nbnhhh.exe PID 2636 wrote to memory of 1592 2636 tnhtht.exe nbnhhh.exe PID 2636 wrote to memory of 1592 2636 tnhtht.exe nbnhhh.exe PID 2636 wrote to memory of 1592 2636 tnhtht.exe nbnhhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a72698afdad1a8e6880299ef380c5a20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a72698afdad1a8e6880299ef380c5a20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\bnbhbb.exec:\bnbhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\7pvvv.exec:\7pvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\frxlrxx.exec:\frxlrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\nhbhhn.exec:\nhbhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\9xllrxl.exec:\9xllrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\xlxxfxl.exec:\xlxxfxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\dvjpv.exec:\dvjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\frfrlff.exec:\frfrlff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\nbhnhh.exec:\nbhnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\ddpvj.exec:\ddpvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\xflrflr.exec:\xflrflr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\hbbnbb.exec:\hbbnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\jdpdp.exec:\jdpdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\5fflfxf.exec:\5fflfxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\tnhtht.exec:\tnhtht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\nbnhhh.exec:\nbnhhh.exe17⤵
- Executes dropped EXE
PID:1592 -
\??\c:\lxrrlfr.exec:\lxrrlfr.exe18⤵
- Executes dropped EXE
PID:2856 -
\??\c:\llrxxrx.exec:\llrxxrx.exe19⤵
- Executes dropped EXE
PID:1356 -
\??\c:\hhthnt.exec:\hhthnt.exe20⤵
- Executes dropped EXE
PID:1576 -
\??\c:\frflflr.exec:\frflflr.exe21⤵
- Executes dropped EXE
PID:2556 -
\??\c:\tbbhtb.exec:\tbbhtb.exe22⤵
- Executes dropped EXE
PID:2904 -
\??\c:\tbbbtt.exec:\tbbbtt.exe23⤵
- Executes dropped EXE
PID:2892 -
\??\c:\9xllrrx.exec:\9xllrrx.exe24⤵
- Executes dropped EXE
PID:3060 -
\??\c:\xlxfllr.exec:\xlxfllr.exe25⤵
- Executes dropped EXE
PID:404 -
\??\c:\1vdjp.exec:\1vdjp.exe26⤵
- Executes dropped EXE
PID:1104 -
\??\c:\7llllff.exec:\7llllff.exe27⤵
- Executes dropped EXE
PID:1044 -
\??\c:\pjddv.exec:\pjddv.exe28⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jvdvp.exec:\jvdvp.exe29⤵
- Executes dropped EXE
PID:920 -
\??\c:\ntnbhn.exec:\ntnbhn.exe30⤵
- Executes dropped EXE
PID:1304 -
\??\c:\jvddj.exec:\jvddj.exe31⤵
- Executes dropped EXE
PID:864 -
\??\c:\rlrlllr.exec:\rlrlllr.exe32⤵
- Executes dropped EXE
PID:2420 -
\??\c:\bntbhh.exec:\bntbhh.exe33⤵
- Executes dropped EXE
PID:1528 -
\??\c:\5ddvd.exec:\5ddvd.exe34⤵
- Executes dropped EXE
PID:1680 -
\??\c:\9vpjp.exec:\9vpjp.exe35⤵
- Executes dropped EXE
PID:2252 -
\??\c:\frxflxl.exec:\frxflxl.exe36⤵
- Executes dropped EXE
PID:2168 -
\??\c:\nbntbh.exec:\nbntbh.exe37⤵
- Executes dropped EXE
PID:3068 -
\??\c:\thttbn.exec:\thttbn.exe38⤵
- Executes dropped EXE
PID:2664 -
\??\c:\5vjpp.exec:\5vjpp.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\1vvdv.exec:\1vvdv.exe40⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rffxrll.exec:\rffxrll.exe41⤵
- Executes dropped EXE
PID:1712 -
\??\c:\bnttbh.exec:\bnttbh.exe42⤵
- Executes dropped EXE
PID:2796 -
\??\c:\dpvpj.exec:\dpvpj.exe43⤵
- Executes dropped EXE
PID:2496 -
\??\c:\vjvvj.exec:\vjvvj.exe44⤵
- Executes dropped EXE
PID:2644 -
\??\c:\xrlrflx.exec:\xrlrflx.exe45⤵
- Executes dropped EXE
PID:2492 -
\??\c:\tnnnhh.exec:\tnnnhh.exe46⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jddvp.exec:\jddvp.exe47⤵
- Executes dropped EXE
PID:2536 -
\??\c:\vjvdj.exec:\vjvdj.exe48⤵
- Executes dropped EXE
PID:2780 -
\??\c:\7lrrxxl.exec:\7lrrxxl.exe49⤵
- Executes dropped EXE
PID:2312 -
\??\c:\nhbhnn.exec:\nhbhnn.exe50⤵
- Executes dropped EXE
PID:3008 -
\??\c:\pdppp.exec:\pdppp.exe51⤵
- Executes dropped EXE
PID:1796 -
\??\c:\vpjvd.exec:\vpjvd.exe52⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rfflfff.exec:\rfflfff.exe53⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tnbbnb.exec:\tnbbnb.exe54⤵
- Executes dropped EXE
PID:2528 -
\??\c:\nhtbnh.exec:\nhtbnh.exe55⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1djdd.exec:\1djdd.exe56⤵
- Executes dropped EXE
PID:2952 -
\??\c:\9fxrrrr.exec:\9fxrrrr.exe57⤵
- Executes dropped EXE
PID:2864 -
\??\c:\3lrrffr.exec:\3lrrffr.exe58⤵
- Executes dropped EXE
PID:2848 -
\??\c:\bbttbb.exec:\bbttbb.exe59⤵
- Executes dropped EXE
PID:1552 -
\??\c:\bthnnn.exec:\bthnnn.exe60⤵
- Executes dropped EXE
PID:1748 -
\??\c:\dpjvp.exec:\dpjvp.exe61⤵
- Executes dropped EXE
PID:1732 -
\??\c:\frrlxrr.exec:\frrlxrr.exe62⤵
- Executes dropped EXE
PID:1456 -
\??\c:\xxrfrxl.exec:\xxrfrxl.exe63⤵
- Executes dropped EXE
PID:2128 -
\??\c:\7hntbh.exec:\7hntbh.exe64⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nbhhhh.exec:\nbhhhh.exe65⤵
- Executes dropped EXE
PID:1300 -
\??\c:\dvjpd.exec:\dvjpd.exe66⤵PID:1516
-
\??\c:\frlflrx.exec:\frlflrx.exe67⤵PID:2236
-
\??\c:\7lllxfr.exec:\7lllxfr.exe68⤵PID:756
-
\??\c:\9hnbbt.exec:\9hnbbt.exe69⤵PID:972
-
\??\c:\3dppv.exec:\3dppv.exe70⤵PID:936
-
\??\c:\1vjvd.exec:\1vjvd.exe71⤵PID:1032
-
\??\c:\fxfxrlr.exec:\fxfxrlr.exe72⤵PID:816
-
\??\c:\btbhth.exec:\btbhth.exe73⤵PID:1964
-
\??\c:\btbhhh.exec:\btbhhh.exe74⤵PID:1816
-
\??\c:\5vjpd.exec:\5vjpd.exe75⤵PID:912
-
\??\c:\fxllxfr.exec:\fxllxfr.exe76⤵PID:2920
-
\??\c:\xrllfrx.exec:\xrllfrx.exe77⤵PID:2380
-
\??\c:\htnnth.exec:\htnnth.exe78⤵PID:1628
-
\??\c:\vdpdd.exec:\vdpdd.exe79⤵PID:1948
-
\??\c:\jjddd.exec:\jjddd.exe80⤵PID:2004
-
\??\c:\xxrxflx.exec:\xxrxflx.exe81⤵PID:1296
-
\??\c:\1xrfllr.exec:\1xrfllr.exe82⤵PID:2588
-
\??\c:\nhbtnt.exec:\nhbtnt.exe83⤵PID:2688
-
\??\c:\vjvvd.exec:\vjvvd.exe84⤵PID:2884
-
\??\c:\jdppv.exec:\jdppv.exe85⤵PID:1712
-
\??\c:\llrfrxl.exec:\llrfrxl.exe86⤵PID:2828
-
\??\c:\nhbntb.exec:\nhbntb.exe87⤵PID:1960
-
\??\c:\hbnnbb.exec:\hbnnbb.exe88⤵PID:2644
-
\??\c:\1vjvd.exec:\1vjvd.exe89⤵PID:2532
-
\??\c:\7frxxxf.exec:\7frxxxf.exe90⤵PID:1640
-
\??\c:\ffrxflx.exec:\ffrxflx.exe91⤵PID:2992
-
\??\c:\9hnthh.exec:\9hnthh.exe92⤵PID:1268
-
\??\c:\pjvvj.exec:\pjvvj.exe93⤵PID:3048
-
\??\c:\dvjjj.exec:\dvjjj.exe94⤵PID:2840
-
\??\c:\xxlrlfr.exec:\xxlrlfr.exe95⤵PID:2548
-
\??\c:\9lxrfll.exec:\9lxrfll.exe96⤵PID:2008
-
\??\c:\9bnthn.exec:\9bnthn.exe97⤵PID:776
-
\??\c:\pjdjp.exec:\pjdjp.exe98⤵PID:2852
-
\??\c:\pvddd.exec:\pvddd.exe99⤵PID:2348
-
\??\c:\frrxfxl.exec:\frrxfxl.exe100⤵PID:1812
-
\??\c:\thtthn.exec:\thtthn.exe101⤵PID:1808
-
\??\c:\nhnntb.exec:\nhnntb.exe102⤵PID:2328
-
\??\c:\ddvdj.exec:\ddvdj.exe103⤵PID:1576
-
\??\c:\vdjvd.exec:\vdjvd.exe104⤵PID:1408
-
\??\c:\frfffxf.exec:\frfffxf.exe105⤵PID:2440
-
\??\c:\1lxfflf.exec:\1lxfflf.exe106⤵PID:1876
-
\??\c:\bbhnbt.exec:\bbhnbt.exe107⤵PID:708
-
\??\c:\vppdd.exec:\vppdd.exe108⤵PID:336
-
\??\c:\pdjpp.exec:\pdjpp.exe109⤵PID:1300
-
\??\c:\1flxrfr.exec:\1flxrfr.exe110⤵PID:1760
-
\??\c:\nhnnbb.exec:\nhnnbb.exe111⤵PID:2272
-
\??\c:\bbbnbb.exec:\bbbnbb.exe112⤵PID:1972
-
\??\c:\jvvdd.exec:\jvvdd.exe113⤵PID:1956
-
\??\c:\pdjvd.exec:\pdjvd.exe114⤵PID:3028
-
\??\c:\1llxxfr.exec:\1llxxfr.exe115⤵PID:568
-
\??\c:\3thhhh.exec:\3thhhh.exe116⤵PID:312
-
\??\c:\bthbhn.exec:\bthbhn.exe117⤵PID:1964
-
\??\c:\pdppv.exec:\pdppv.exe118⤵PID:1656
-
\??\c:\jvdjj.exec:\jvdjj.exe119⤵PID:2276
-
\??\c:\7lllrxf.exec:\7lllrxf.exe120⤵PID:2204
-
\??\c:\3nnhhh.exec:\3nnhhh.exe121⤵PID:2364
-
\??\c:\7nbntn.exec:\7nbntn.exe122⤵PID:2252
-
\??\c:\9pppp.exec:\9pppp.exe123⤵PID:2168
-
\??\c:\frxxxxf.exec:\frxxxxf.exe124⤵PID:3068
-
\??\c:\frxfrlr.exec:\frxfrlr.exe125⤵PID:2736
-
\??\c:\3nhnnt.exec:\3nhnnt.exe126⤵PID:2660
-
\??\c:\vppvj.exec:\vppvj.exe127⤵PID:2732
-
\??\c:\pdjjj.exec:\pdjjj.exe128⤵PID:2576
-
\??\c:\fxrlllr.exec:\fxrlllr.exe129⤵PID:2112
-
\??\c:\5rllxrr.exec:\5rllxrr.exe130⤵PID:1728
-
\??\c:\1btbhb.exec:\1btbhb.exe131⤵PID:2456
-
\??\c:\7hbttn.exec:\7hbttn.exe132⤵PID:2508
-
\??\c:\vjppv.exec:\vjppv.exe133⤵PID:3020
-
\??\c:\rrfrrxf.exec:\rrfrrxf.exe134⤵PID:1448
-
\??\c:\9fllxxr.exec:\9fllxxr.exe135⤵PID:2968
-
\??\c:\nthhhb.exec:\nthhhb.exe136⤵PID:2408
-
\??\c:\nbnnhh.exec:\nbnnhh.exe137⤵PID:1344
-
\??\c:\5jpvd.exec:\5jpvd.exe138⤵PID:1980
-
\??\c:\vpjjp.exec:\vpjjp.exe139⤵PID:2792
-
\??\c:\3rxrlff.exec:\3rxrlff.exe140⤵PID:2824
-
\??\c:\7nnhnh.exec:\7nnhnh.exe141⤵PID:2752
-
\??\c:\3bnhhh.exec:\3bnhhh.exe142⤵PID:2816
-
\??\c:\vjvpv.exec:\vjvpv.exe143⤵PID:2832
-
\??\c:\jvdvv.exec:\jvdvv.exe144⤵PID:640
-
\??\c:\rlfxlrf.exec:\rlfxlrf.exe145⤵PID:1536
-
\??\c:\9nnttt.exec:\9nnttt.exe146⤵PID:2320
-
\??\c:\btnntt.exec:\btnntt.exe147⤵PID:2896
-
\??\c:\vpdpd.exec:\vpdpd.exe148⤵PID:2052
-
\??\c:\xrfflfr.exec:\xrfflfr.exe149⤵PID:1408
-
\??\c:\llxrxrx.exec:\llxrxrx.exe150⤵PID:2904
-
\??\c:\bnnnhn.exec:\bnnnhn.exe151⤵PID:2404
-
\??\c:\jdjpd.exec:\jdjpd.exe152⤵PID:708
-
\??\c:\fxllrxr.exec:\fxllrxr.exe153⤵PID:1496
-
\??\c:\bnbhnt.exec:\bnbhnt.exe154⤵PID:1508
-
\??\c:\pjdjv.exec:\pjdjv.exe155⤵PID:852
-
\??\c:\rrllrfl.exec:\rrllrfl.exe156⤵PID:2072
-
\??\c:\fxflflf.exec:\fxflflf.exe157⤵PID:1972
-
\??\c:\jdppp.exec:\jdppp.exe158⤵PID:968
-
\??\c:\jvdvv.exec:\jvdvv.exe159⤵PID:3028
-
\??\c:\xrlllrl.exec:\xrlllrl.exe160⤵PID:1672
-
\??\c:\7bttbt.exec:\7bttbt.exe161⤵PID:1316
-
\??\c:\nbhtbt.exec:\nbhtbt.exe162⤵PID:1176
-
\??\c:\vjppp.exec:\vjppp.exe163⤵PID:2356
-
\??\c:\9vpvj.exec:\9vpvj.exe164⤵PID:1144
-
\??\c:\7xllllr.exec:\7xllllr.exe165⤵PID:2012
-
\??\c:\1bhttt.exec:\1bhttt.exe166⤵PID:2380
-
\??\c:\3bbhnt.exec:\3bbhnt.exe167⤵PID:1620
-
\??\c:\9vvdd.exec:\9vvdd.exe168⤵PID:1056
-
\??\c:\5pppj.exec:\5pppj.exe169⤵PID:2004
-
\??\c:\7rlrxfl.exec:\7rlrxfl.exe170⤵PID:1296
-
\??\c:\nhtthn.exec:\nhtthn.exe171⤵PID:2880
-
\??\c:\nhhttb.exec:\nhhttb.exe172⤵PID:2592
-
\??\c:\jpvvp.exec:\jpvvp.exe173⤵PID:2820
-
\??\c:\5pjpp.exec:\5pjpp.exe174⤵PID:2596
-
\??\c:\5rxrrll.exec:\5rxrrll.exe175⤵PID:2496
-
\??\c:\lffxlrx.exec:\lffxlrx.exe176⤵PID:2476
-
\??\c:\hbtbnt.exec:\hbtbnt.exe177⤵PID:2644
-
\??\c:\3dppd.exec:\3dppd.exe178⤵PID:1900
-
\??\c:\3jpjp.exec:\3jpjp.exe179⤵PID:2956
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe180⤵PID:2780
-
\??\c:\bnbtnn.exec:\bnbtnn.exe181⤵PID:2968
-
\??\c:\3tnhnn.exec:\3tnhnn.exe182⤵PID:2800
-
\??\c:\1jjdv.exec:\1jjdv.exe183⤵PID:3000
-
\??\c:\jvjjj.exec:\jvjjj.exe184⤵PID:2712
-
\??\c:\frxxxxf.exec:\frxxxxf.exe185⤵PID:2436
-
\??\c:\7frrrrx.exec:\7frrrrx.exe186⤵PID:2340
-
\??\c:\3hbtnt.exec:\3hbtnt.exe187⤵PID:1592
-
\??\c:\vpjpj.exec:\vpjpj.exe188⤵PID:2348
-
\??\c:\jvdpp.exec:\jvdpp.exe189⤵PID:2864
-
\??\c:\flffrrx.exec:\flffrrx.exe190⤵PID:2232
-
\??\c:\tnthnt.exec:\tnthnt.exe191⤵PID:880
-
\??\c:\hthtbh.exec:\hthtbh.exe192⤵PID:1576
-
\??\c:\9dppp.exec:\9dppp.exe193⤵PID:2304
-
\??\c:\pppdj.exec:\pppdj.exe194⤵PID:1456
-
\??\c:\lrfflfx.exec:\lrfflfx.exe195⤵PID:1732
-
\??\c:\nnbbhh.exec:\nnbbhh.exe196⤵PID:1060
-
\??\c:\htbhbt.exec:\htbhbt.exe197⤵PID:924
-
\??\c:\ddpjd.exec:\ddpjd.exe198⤵PID:1076
-
\??\c:\9lxrlll.exec:\9lxrlll.exe199⤵PID:404
-
\??\c:\fxrrflr.exec:\fxrrflr.exe200⤵PID:2176
-
\??\c:\bhhnhb.exec:\bhhnhb.exe201⤵PID:2000
-
\??\c:\bnbnbt.exec:\bnbnbt.exe202⤵PID:972
-
\??\c:\jpdjv.exec:\jpdjv.exe203⤵PID:936
-
\??\c:\lxlrxxf.exec:\lxlrxxf.exe204⤵PID:1780
-
\??\c:\xlxxfxr.exec:\xlxxfxr.exe205⤵PID:968
-
\??\c:\nhtbhh.exec:\nhtbhh.exe206⤵PID:3044
-
\??\c:\7thtnh.exec:\7thtnh.exe207⤵PID:2184
-
\??\c:\dppdv.exec:\dppdv.exe208⤵PID:2212
-
\??\c:\lxlxxxx.exec:\lxlxxxx.exe209⤵PID:2392
-
\??\c:\llxfrrf.exec:\llxfrrf.exe210⤵PID:3012
-
\??\c:\nbnntb.exec:\nbnntb.exe211⤵PID:2744
-
\??\c:\1tnbhh.exec:\1tnbhh.exe212⤵PID:2296
-
\??\c:\1jjpp.exec:\1jjpp.exe213⤵PID:2860
-
\??\c:\fffrfrx.exec:\fffrfrx.exe214⤵PID:2224
-
\??\c:\lxlrlrx.exec:\lxlrlrx.exe215⤵PID:2680
-
\??\c:\1tnnnn.exec:\1tnnnn.exe216⤵PID:2564
-
\??\c:\bnbtnn.exec:\bnbtnn.exe217⤵PID:2880
-
\??\c:\1vddd.exec:\1vddd.exe218⤵PID:2576
-
\??\c:\7pvpp.exec:\7pvpp.exe219⤵PID:2700
-
\??\c:\lxrfffr.exec:\lxrfffr.exe220⤵PID:2596
-
\??\c:\5nhhnn.exec:\5nhhnn.exe221⤵PID:1892
-
\??\c:\tnntnn.exec:\tnntnn.exe222⤵PID:2476
-
\??\c:\vdppv.exec:\vdppv.exe223⤵PID:2644
-
\??\c:\frxrxxf.exec:\frxrxxf.exe224⤵PID:2976
-
\??\c:\xlxrrxx.exec:\xlxrrxx.exe225⤵PID:1640
-
\??\c:\tnhnbb.exec:\tnhnbb.exe226⤵PID:2780
-
\??\c:\3dddd.exec:\3dddd.exe227⤵PID:3048
-
\??\c:\vjddj.exec:\vjddj.exe228⤵PID:2768
-
\??\c:\xxrfrxr.exec:\xxrfrxr.exe229⤵PID:1644
-
\??\c:\flxxrrr.exec:\flxxrrr.exe230⤵PID:2792
-
\??\c:\bnnnhb.exec:\bnnnhb.exe231⤵PID:2808
-
\??\c:\nbhhhh.exec:\nbhhhh.exe232⤵PID:2772
-
\??\c:\9rxffxx.exec:\9rxffxx.exe233⤵PID:2748
-
\??\c:\xlfrlfl.exec:\xlfrlfl.exe234⤵PID:2832
-
\??\c:\hbnhnh.exec:\hbnhnh.exe235⤵PID:2848
-
\??\c:\nbntbb.exec:\nbntbb.exe236⤵PID:1444
-
\??\c:\vdjdd.exec:\vdjdd.exe237⤵PID:2836
-
\??\c:\5jjvp.exec:\5jjvp.exe238⤵PID:2556
-
\??\c:\3frxxxx.exec:\3frxxxx.exe239⤵PID:2052
-
\??\c:\7rfxfxx.exec:\7rfxfxx.exe240⤵PID:2220
-
\??\c:\nbnntt.exec:\nbnntt.exe241⤵PID:2904
-
\??\c:\htbttn.exec:\htbttn.exe242⤵PID:584