Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 18:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1069c3db6c04d035b6275b3b75afe5e0_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1069c3db6c04d035b6275b3b75afe5e0_NeikiAnalytics.exe
-
Size
65KB
-
MD5
1069c3db6c04d035b6275b3b75afe5e0
-
SHA1
f0853b8a2efdf932d4e136debb74a63ca965237e
-
SHA256
5f966ade735c521960c37c9ca2823d02736503e384d92e915585990ca099001f
-
SHA512
6dd9e8af0287c0b7584539ef39189352854a76b2620e97accbba61cd971f2e93a49eba0522900a7381b9ac9c94d3447c6a978382c3e521d00c4e34b1dddf2bec
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3AyXmP4:ymb3NkkiQ3mdBjFI46TQyXmP4
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral1/memory/3028-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-56-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1320-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1424-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/356-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1172-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/820-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nbhbhh.exepjjpv.exellflrxl.exehhntnb.exeppdpj.exexxlffrr.exetthhhn.exe1hbhhn.exeddjdv.exe5pppp.exeflrxlrr.exenhnbnt.exeppddp.exejjjdd.exeddpdp.exefxlfxxr.exerrfrlxx.exe5hhnhh.exettnhth.exe9pjpd.exejjdvp.exelllxrxl.exexxrlfrf.exehhhnht.exebhhntt.exe1pvjp.exejjdpj.exelfffrrx.exexrrxfxl.exebnnntn.exenhhbnb.exedvdpv.exepppdj.exefxfxffl.exexrlxlfl.exevjppv.exevvpdp.exefllflfr.exe5tnbhh.exedjddp.exedvvjp.exefllflll.exe1xxrxll.exe1btnhb.exehhnbhb.exehntbnt.exejvvvd.exedpvjj.exexxxlxfl.exe9rrfflr.exetnttbh.exebtttnn.exejjjjj.exevvpjj.exedvvpj.exexxlfxxx.exeffrxlrl.exenhbhtt.exenhbnnt.exepdpdd.exejvvvj.exefrxlxxx.exexfflxrr.exe7xlrxlr.exepid process 3028 nbhbhh.exe 2136 pjjpv.exe 2676 llflrxl.exe 2548 hhntnb.exe 2656 ppdpj.exe 2608 xxlffrr.exe 2488 tthhhn.exe 2032 1hbhhn.exe 2432 ddjdv.exe 2760 5pppp.exe 328 flrxlrr.exe 2224 nhnbnt.exe 2216 ppddp.exe 1752 jjjdd.exe 2540 ddpdp.exe 1520 fxlfxxr.exe 820 rrfrlxx.exe 2116 5hhnhh.exe 1320 ttnhth.exe 2832 9pjpd.exe 564 jjdvp.exe 1172 lllxrxl.exe 3020 xxrlfrf.exe 356 hhhnht.exe 1756 bhhntt.exe 1048 1pvjp.exe 2156 jjdpj.exe 1424 lfffrrx.exe 3016 xrrxfxl.exe 2404 bnnntn.exe 2340 nhhbnb.exe 1604 dvdpv.exe 1744 pppdj.exe 2524 fxfxffl.exe 2644 xrlxlfl.exe 2576 vjppv.exe 2984 vvpdp.exe 3024 fllflfr.exe 2812 5tnbhh.exe 2780 djddp.exe 2628 dvvjp.exe 2264 fllflll.exe 2464 1xxrxll.exe 2460 1btnhb.exe 2792 hhnbhb.exe 2208 hntbnt.exe 1872 jvvvd.exe 312 dpvjj.exe 1236 xxxlxfl.exe 2336 9rrfflr.exe 1444 tnttbh.exe 1532 btttnn.exe 1772 jjjjj.exe 2080 vvpjj.exe 1296 dvvpj.exe 2268 xxlfxxx.exe 536 ffrxlrl.exe 1104 nhbhtt.exe 1536 nhbnnt.exe 644 pdpdd.exe 2104 jvvvj.exe 2428 frxlxxx.exe 2392 xfflxrr.exe 1112 7xlrxlr.exe -
Processes:
resource yara_rule behavioral1/memory/3028-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1320-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/356-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1172-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/820-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-82-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1069c3db6c04d035b6275b3b75afe5e0_NeikiAnalytics.exenbhbhh.exepjjpv.exellflrxl.exehhntnb.exeppdpj.exexxlffrr.exetthhhn.exe1hbhhn.exeddjdv.exe5pppp.exeflrxlrr.exenhnbnt.exeppddp.exejjjdd.exeddpdp.exedescription pid process target process PID 2040 wrote to memory of 3028 2040 1069c3db6c04d035b6275b3b75afe5e0_NeikiAnalytics.exe nbhbhh.exe PID 2040 wrote to memory of 3028 2040 1069c3db6c04d035b6275b3b75afe5e0_NeikiAnalytics.exe nbhbhh.exe PID 2040 wrote to memory of 3028 2040 1069c3db6c04d035b6275b3b75afe5e0_NeikiAnalytics.exe nbhbhh.exe PID 2040 wrote to memory of 3028 2040 1069c3db6c04d035b6275b3b75afe5e0_NeikiAnalytics.exe nbhbhh.exe PID 3028 wrote to memory of 2136 3028 nbhbhh.exe pjjpv.exe PID 3028 wrote to memory of 2136 3028 nbhbhh.exe pjjpv.exe PID 3028 wrote to memory of 2136 3028 nbhbhh.exe pjjpv.exe PID 3028 wrote to memory of 2136 3028 nbhbhh.exe pjjpv.exe PID 2136 wrote to memory of 2676 2136 pjjpv.exe llflrxl.exe PID 2136 wrote to memory of 2676 2136 pjjpv.exe llflrxl.exe PID 2136 wrote to memory of 2676 2136 pjjpv.exe llflrxl.exe PID 2136 wrote to memory of 2676 2136 pjjpv.exe llflrxl.exe PID 2676 wrote to memory of 2548 2676 llflrxl.exe hhntnb.exe PID 2676 wrote to memory of 2548 2676 llflrxl.exe hhntnb.exe PID 2676 wrote to memory of 2548 2676 llflrxl.exe hhntnb.exe PID 2676 wrote to memory of 2548 2676 llflrxl.exe hhntnb.exe PID 2548 wrote to memory of 2656 2548 hhntnb.exe ppdpj.exe PID 2548 wrote to memory of 2656 2548 hhntnb.exe ppdpj.exe PID 2548 wrote to memory of 2656 2548 hhntnb.exe ppdpj.exe PID 2548 wrote to memory of 2656 2548 hhntnb.exe ppdpj.exe PID 2656 wrote to memory of 2608 2656 ppdpj.exe xxlffrr.exe PID 2656 wrote to memory of 2608 2656 ppdpj.exe xxlffrr.exe PID 2656 wrote to memory of 2608 2656 ppdpj.exe xxlffrr.exe PID 2656 wrote to memory of 2608 2656 ppdpj.exe xxlffrr.exe PID 2608 wrote to memory of 2488 2608 xxlffrr.exe tthhhn.exe PID 2608 wrote to memory of 2488 2608 xxlffrr.exe tthhhn.exe PID 2608 wrote to memory of 2488 2608 xxlffrr.exe tthhhn.exe PID 2608 wrote to memory of 2488 2608 xxlffrr.exe tthhhn.exe PID 2488 wrote to memory of 2032 2488 tthhhn.exe 1hbhhn.exe PID 2488 wrote to memory of 2032 2488 tthhhn.exe 1hbhhn.exe PID 2488 wrote to memory of 2032 2488 tthhhn.exe 1hbhhn.exe PID 2488 wrote to memory of 2032 2488 tthhhn.exe 1hbhhn.exe PID 2032 wrote to memory of 2432 2032 1hbhhn.exe ddjdv.exe PID 2032 wrote to memory of 2432 2032 1hbhhn.exe ddjdv.exe PID 2032 wrote to memory of 2432 2032 1hbhhn.exe ddjdv.exe PID 2032 wrote to memory of 2432 2032 1hbhhn.exe ddjdv.exe PID 2432 wrote to memory of 2760 2432 ddjdv.exe 5pppp.exe PID 2432 wrote to memory of 2760 2432 ddjdv.exe 5pppp.exe PID 2432 wrote to memory of 2760 2432 ddjdv.exe 5pppp.exe PID 2432 wrote to memory of 2760 2432 ddjdv.exe 5pppp.exe PID 2760 wrote to memory of 328 2760 5pppp.exe flrxlrr.exe PID 2760 wrote to memory of 328 2760 5pppp.exe flrxlrr.exe PID 2760 wrote to memory of 328 2760 5pppp.exe flrxlrr.exe PID 2760 wrote to memory of 328 2760 5pppp.exe flrxlrr.exe PID 328 wrote to memory of 2224 328 flrxlrr.exe nhnbnt.exe PID 328 wrote to memory of 2224 328 flrxlrr.exe nhnbnt.exe PID 328 wrote to memory of 2224 328 flrxlrr.exe nhnbnt.exe PID 328 wrote to memory of 2224 328 flrxlrr.exe nhnbnt.exe PID 2224 wrote to memory of 2216 2224 nhnbnt.exe ppddp.exe PID 2224 wrote to memory of 2216 2224 nhnbnt.exe ppddp.exe PID 2224 wrote to memory of 2216 2224 nhnbnt.exe ppddp.exe PID 2224 wrote to memory of 2216 2224 nhnbnt.exe ppddp.exe PID 2216 wrote to memory of 1752 2216 ppddp.exe jjjdd.exe PID 2216 wrote to memory of 1752 2216 ppddp.exe jjjdd.exe PID 2216 wrote to memory of 1752 2216 ppddp.exe jjjdd.exe PID 2216 wrote to memory of 1752 2216 ppddp.exe jjjdd.exe PID 1752 wrote to memory of 2540 1752 jjjdd.exe ddpdp.exe PID 1752 wrote to memory of 2540 1752 jjjdd.exe ddpdp.exe PID 1752 wrote to memory of 2540 1752 jjjdd.exe ddpdp.exe PID 1752 wrote to memory of 2540 1752 jjjdd.exe ddpdp.exe PID 2540 wrote to memory of 1520 2540 ddpdp.exe fxlfxxr.exe PID 2540 wrote to memory of 1520 2540 ddpdp.exe fxlfxxr.exe PID 2540 wrote to memory of 1520 2540 ddpdp.exe fxlfxxr.exe PID 2540 wrote to memory of 1520 2540 ddpdp.exe fxlfxxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1069c3db6c04d035b6275b3b75afe5e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1069c3db6c04d035b6275b3b75afe5e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\nbhbhh.exec:\nbhbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\pjjpv.exec:\pjjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\llflrxl.exec:\llflrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\hhntnb.exec:\hhntnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\ppdpj.exec:\ppdpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\xxlffrr.exec:\xxlffrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\tthhhn.exec:\tthhhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\1hbhhn.exec:\1hbhhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\ddjdv.exec:\ddjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\5pppp.exec:\5pppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\flrxlrr.exec:\flrxlrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:328 -
\??\c:\nhnbnt.exec:\nhnbnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\ppddp.exec:\ppddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\jjjdd.exec:\jjjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\ddpdp.exec:\ddpdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe17⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rrfrlxx.exec:\rrfrlxx.exe18⤵
- Executes dropped EXE
PID:820 -
\??\c:\5hhnhh.exec:\5hhnhh.exe19⤵
- Executes dropped EXE
PID:2116 -
\??\c:\ttnhth.exec:\ttnhth.exe20⤵
- Executes dropped EXE
PID:1320 -
\??\c:\9pjpd.exec:\9pjpd.exe21⤵
- Executes dropped EXE
PID:2832 -
\??\c:\jjdvp.exec:\jjdvp.exe22⤵
- Executes dropped EXE
PID:564 -
\??\c:\lllxrxl.exec:\lllxrxl.exe23⤵
- Executes dropped EXE
PID:1172 -
\??\c:\xxrlfrf.exec:\xxrlfrf.exe24⤵
- Executes dropped EXE
PID:3020 -
\??\c:\hhhnht.exec:\hhhnht.exe25⤵
- Executes dropped EXE
PID:356 -
\??\c:\bhhntt.exec:\bhhntt.exe26⤵
- Executes dropped EXE
PID:1756 -
\??\c:\1pvjp.exec:\1pvjp.exe27⤵
- Executes dropped EXE
PID:1048 -
\??\c:\jjdpj.exec:\jjdpj.exe28⤵
- Executes dropped EXE
PID:2156 -
\??\c:\lfffrrx.exec:\lfffrrx.exe29⤵
- Executes dropped EXE
PID:1424 -
\??\c:\xrrxfxl.exec:\xrrxfxl.exe30⤵
- Executes dropped EXE
PID:3016 -
\??\c:\bnnntn.exec:\bnnntn.exe31⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nhhbnb.exec:\nhhbnb.exe32⤵
- Executes dropped EXE
PID:2340 -
\??\c:\dvdpv.exec:\dvdpv.exe33⤵
- Executes dropped EXE
PID:1604 -
\??\c:\pppdj.exec:\pppdj.exe34⤵
- Executes dropped EXE
PID:1744 -
\??\c:\fxfxffl.exec:\fxfxffl.exe35⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xrlxlfl.exec:\xrlxlfl.exe36⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vjppv.exec:\vjppv.exe37⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vvpdp.exec:\vvpdp.exe38⤵
- Executes dropped EXE
PID:2984 -
\??\c:\fllflfr.exec:\fllflfr.exe39⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5tnbhh.exec:\5tnbhh.exe40⤵
- Executes dropped EXE
PID:2812 -
\??\c:\djddp.exec:\djddp.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\dvvjp.exec:\dvvjp.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\fllflll.exec:\fllflll.exe43⤵
- Executes dropped EXE
PID:2264 -
\??\c:\1xxrxll.exec:\1xxrxll.exe44⤵
- Executes dropped EXE
PID:2464 -
\??\c:\1btnhb.exec:\1btnhb.exe45⤵
- Executes dropped EXE
PID:2460 -
\??\c:\hhnbhb.exec:\hhnbhb.exe46⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hntbnt.exec:\hntbnt.exe47⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jvvvd.exec:\jvvvd.exe48⤵
- Executes dropped EXE
PID:1872 -
\??\c:\dpvjj.exec:\dpvjj.exe49⤵
- Executes dropped EXE
PID:312 -
\??\c:\xxxlxfl.exec:\xxxlxfl.exe50⤵
- Executes dropped EXE
PID:1236 -
\??\c:\9rrfflr.exec:\9rrfflr.exe51⤵
- Executes dropped EXE
PID:2336 -
\??\c:\tnttbh.exec:\tnttbh.exe52⤵
- Executes dropped EXE
PID:1444 -
\??\c:\btttnn.exec:\btttnn.exe53⤵
- Executes dropped EXE
PID:1532 -
\??\c:\jjjjj.exec:\jjjjj.exe54⤵
- Executes dropped EXE
PID:1772 -
\??\c:\vvpjj.exec:\vvpjj.exe55⤵
- Executes dropped EXE
PID:2080 -
\??\c:\dvvpj.exec:\dvvpj.exe56⤵
- Executes dropped EXE
PID:1296 -
\??\c:\xxlfxxx.exec:\xxlfxxx.exe57⤵
- Executes dropped EXE
PID:2268 -
\??\c:\ffrxlrl.exec:\ffrxlrl.exe58⤵
- Executes dropped EXE
PID:536 -
\??\c:\nhbhtt.exec:\nhbhtt.exe59⤵
- Executes dropped EXE
PID:1104 -
\??\c:\nhbnnt.exec:\nhbnnt.exe60⤵
- Executes dropped EXE
PID:1536 -
\??\c:\pdpdd.exec:\pdpdd.exe61⤵
- Executes dropped EXE
PID:644 -
\??\c:\jvvvj.exec:\jvvvj.exe62⤵
- Executes dropped EXE
PID:2104 -
\??\c:\frxlxxx.exec:\frxlxxx.exe63⤵
- Executes dropped EXE
PID:2428 -
\??\c:\xfflxrr.exec:\xfflxrr.exe64⤵
- Executes dropped EXE
PID:2392 -
\??\c:\7xlrxlr.exec:\7xlrxlr.exe65⤵
- Executes dropped EXE
PID:1112 -
\??\c:\tnbhtt.exec:\tnbhtt.exe66⤵PID:2876
-
\??\c:\nnbbbh.exec:\nnbbbh.exe67⤵PID:2824
-
\??\c:\dpvvj.exec:\dpvvj.exe68⤵PID:2944
-
\??\c:\dpvpv.exec:\dpvpv.exe69⤵PID:2128
-
\??\c:\lfxrxrr.exec:\lfxrxrr.exe70⤵PID:412
-
\??\c:\vvpvd.exec:\vvpvd.exe71⤵PID:552
-
\??\c:\xlxffxx.exec:\xlxffxx.exe72⤵PID:1748
-
\??\c:\7frlxxr.exec:\7frlxxr.exe73⤵PID:3052
-
\??\c:\bhbhhh.exec:\bhbhhh.exe74⤵PID:1604
-
\??\c:\nbthth.exec:\nbthth.exe75⤵PID:2724
-
\??\c:\9vdpd.exec:\9vdpd.exe76⤵PID:2648
-
\??\c:\djpvv.exec:\djpvv.exe77⤵PID:2524
-
\??\c:\xfrxxrx.exec:\xfrxxrx.exe78⤵PID:2684
-
\??\c:\xflrxrr.exec:\xflrxrr.exe79⤵PID:2560
-
\??\c:\xrlxffr.exec:\xrlxffr.exe80⤵PID:2984
-
\??\c:\9htbhb.exec:\9htbhb.exe81⤵PID:2492
-
\??\c:\7bnnnt.exec:\7bnnnt.exe82⤵PID:2476
-
\??\c:\vppvp.exec:\vppvp.exe83⤵PID:2892
-
\??\c:\9vjvv.exec:\9vjvv.exe84⤵PID:2908
-
\??\c:\1jvvv.exec:\1jvvv.exe85⤵PID:2904
-
\??\c:\lxxfxrl.exec:\lxxfxrl.exe86⤵PID:2440
-
\??\c:\3fxxxfl.exec:\3fxxxfl.exe87⤵PID:1712
-
\??\c:\htbtbb.exec:\htbtbb.exe88⤵PID:2200
-
\??\c:\htbnbn.exec:\htbnbn.exe89⤵PID:328
-
\??\c:\pjpvd.exec:\pjpvd.exe90⤵PID:1668
-
\??\c:\dpjdv.exec:\dpjdv.exe91⤵PID:2544
-
\??\c:\pjvvj.exec:\pjvvj.exe92⤵PID:1824
-
\??\c:\5xfffff.exec:\5xfffff.exe93⤵PID:1592
-
\??\c:\rfrfrrx.exec:\rfrfrrx.exe94⤵PID:1568
-
\??\c:\hnhhtb.exec:\hnhhtb.exe95⤵PID:2196
-
\??\c:\1htbbb.exec:\1htbbb.exe96⤵PID:2252
-
\??\c:\vpjdv.exec:\vpjdv.exe97⤵PID:2828
-
\??\c:\vvdpv.exec:\vvdpv.exe98⤵PID:2076
-
\??\c:\lxlxlrf.exec:\lxlxlrf.exe99⤵PID:2424
-
\??\c:\ffffxfl.exec:\ffffxfl.exe100⤵PID:1688
-
\??\c:\9lxfrlx.exec:\9lxfrlx.exe101⤵PID:1664
-
\??\c:\bbhnbt.exec:\bbhnbt.exe102⤵PID:1804
-
\??\c:\7tbthb.exec:\7tbthb.exe103⤵PID:2416
-
\??\c:\pjjpj.exec:\pjjpj.exe104⤵PID:2124
-
\??\c:\vjppv.exec:\vjppv.exe105⤵PID:1360
-
\??\c:\7jvdj.exec:\7jvdj.exe106⤵PID:3040
-
\??\c:\9fllflx.exec:\9fllflx.exe107⤵PID:992
-
\??\c:\lxflxxf.exec:\lxflxxf.exe108⤵PID:560
-
\??\c:\5rxfllr.exec:\5rxfllr.exe109⤵PID:2880
-
\??\c:\tbbntt.exec:\tbbntt.exe110⤵PID:1492
-
\??\c:\7hhtbn.exec:\7hhtbn.exe111⤵PID:2072
-
\??\c:\vjjjj.exec:\vjjjj.exe112⤵PID:792
-
\??\c:\pjddp.exec:\pjddp.exe113⤵PID:2024
-
\??\c:\rlfllxl.exec:\rlfllxl.exe114⤵PID:1264
-
\??\c:\7hthnn.exec:\7hthnn.exe115⤵PID:2592
-
\??\c:\vdddd.exec:\vdddd.exe116⤵PID:2964
-
\??\c:\jvdpv.exec:\jvdpv.exe117⤵PID:2176
-
\??\c:\3lrflxl.exec:\3lrflxl.exe118⤵PID:2960
-
\??\c:\btbnbb.exec:\btbnbb.exe119⤵PID:2644
-
\??\c:\hbnthn.exec:\hbnthn.exe120⤵PID:2576
-
\??\c:\lxlfrrf.exec:\lxlfrrf.exe121⤵PID:2980
-
\??\c:\9ntntn.exec:\9ntntn.exe122⤵PID:3024
-
\??\c:\jvjjv.exec:\jvjjv.exe123⤵PID:2924
-
\??\c:\fxrfxfr.exec:\fxrfxfr.exe124⤵PID:2448
-
\??\c:\jdjjj.exec:\jdjjj.exe125⤵PID:2628
-
\??\c:\flxlrfr.exec:\flxlrfr.exe126⤵PID:2264
-
\??\c:\jvvjp.exec:\jvvjp.exe127⤵PID:2464
-
\??\c:\rllxxxl.exec:\rllxxxl.exe128⤵PID:2460
-
\??\c:\1lflxlf.exec:\1lflxlf.exe129⤵PID:2420
-
\??\c:\pdpvj.exec:\pdpvj.exe130⤵PID:2208
-
\??\c:\djpvv.exec:\djpvv.exe131⤵PID:1872
-
\??\c:\flflxfr.exec:\flflxfr.exe132⤵PID:312
-
\??\c:\tbbnht.exec:\tbbnht.exe133⤵PID:1980
-
\??\c:\5vjjp.exec:\5vjjp.exe134⤵PID:2336
-
\??\c:\jpvpp.exec:\jpvpp.exe135⤵PID:1444
-
\??\c:\3frrllr.exec:\3frrllr.exe136⤵PID:1532
-
\??\c:\rlrxlxf.exec:\rlrxlxf.exe137⤵PID:1772
-
\??\c:\9vjvj.exec:\9vjvj.exe138⤵PID:2080
-
\??\c:\pddvj.exec:\pddvj.exe139⤵PID:1296
-
\??\c:\xlrlrfl.exec:\xlrlrfl.exe140⤵PID:2268
-
\??\c:\tnntbb.exec:\tnntbb.exe141⤵PID:536
-
\??\c:\jvddp.exec:\jvddp.exe142⤵PID:1104
-
\??\c:\1lffffr.exec:\1lffffr.exe143⤵PID:1536
-
\??\c:\1xlfxfr.exec:\1xlfxfr.exe144⤵PID:644
-
\??\c:\thbthh.exec:\thbthh.exe145⤵PID:1136
-
\??\c:\htnnbt.exec:\htnnbt.exe146⤵PID:2428
-
\??\c:\dvpjj.exec:\dvpjj.exe147⤵PID:2976
-
\??\c:\frrlflf.exec:\frrlflf.exe148⤵PID:1112
-
\??\c:\lrrxxll.exec:\lrrxxll.exe149⤵PID:2876
-
\??\c:\9hnhhh.exec:\9hnhhh.exe150⤵PID:2312
-
\??\c:\bthhnn.exec:\bthhnn.exe151⤵PID:1400
-
\??\c:\nhtttt.exec:\nhtttt.exe152⤵PID:2128
-
\??\c:\3vjvp.exec:\3vjvp.exe153⤵PID:2144
-
\??\c:\pdppj.exec:\pdppj.exe154⤵PID:1288
-
\??\c:\frxfxfl.exec:\frxfxfl.exe155⤵PID:1748
-
\??\c:\5xfrflr.exec:\5xfrflr.exe156⤵PID:1728
-
\??\c:\3hhhbn.exec:\3hhhbn.exe157⤵PID:1604
-
\??\c:\thbhbn.exec:\thbhbn.exe158⤵PID:2724
-
\??\c:\dvddj.exec:\dvddj.exe159⤵PID:2648
-
\??\c:\pvpvj.exec:\pvpvj.exe160⤵PID:2960
-
\??\c:\dvjvd.exec:\dvjvd.exe161⤵PID:2276
-
\??\c:\lfxlrff.exec:\lfxlrff.exe162⤵PID:3060
-
\??\c:\3hhhhn.exec:\3hhhhn.exe163⤵PID:2656
-
\??\c:\hhhnbh.exec:\hhhnbh.exe164⤵PID:2604
-
\??\c:\9hhhbb.exec:\9hhhbb.exe165⤵PID:2476
-
\??\c:\pjdjj.exec:\pjdjj.exe166⤵PID:2448
-
\??\c:\ppvvd.exec:\ppvvd.exe167⤵PID:2908
-
\??\c:\lfxffll.exec:\lfxffll.exe168⤵PID:2264
-
\??\c:\thtthb.exec:\thtthb.exe169⤵PID:2440
-
\??\c:\tnhntb.exec:\tnhntb.exe170⤵PID:1712
-
\??\c:\bbthth.exec:\bbthth.exe171⤵PID:2456
-
\??\c:\jjdpd.exec:\jjdpd.exe172⤵PID:1720
-
\??\c:\ppjvj.exec:\ppjvj.exe173⤵PID:1668
-
\??\c:\1rxxlfl.exec:\1rxxlfl.exe174⤵PID:2328
-
\??\c:\rrrfrxr.exec:\rrrfrxr.exe175⤵PID:2896
-
\??\c:\5hbbbn.exec:\5hbbbn.exe176⤵PID:2540
-
\??\c:\btntnb.exec:\btntnb.exe177⤵PID:1568
-
\??\c:\9djvj.exec:\9djvj.exe178⤵PID:1532
-
\??\c:\dpjdj.exec:\dpjdj.exe179⤵PID:1876
-
\??\c:\3jjjj.exec:\3jjjj.exe180⤵PID:2080
-
\??\c:\3fflxxr.exec:\3fflxxr.exe181⤵PID:2704
-
\??\c:\xrlxflr.exec:\xrlxflr.exe182⤵PID:696
-
\??\c:\nbnntt.exec:\nbnntt.exe183⤵PID:588
-
\??\c:\bttbbn.exec:\bttbbn.exe184⤵PID:1104
-
\??\c:\ppvvj.exec:\ppvvj.exe185⤵PID:584
-
\??\c:\ddpdp.exec:\ddpdp.exe186⤵PID:1344
-
\??\c:\flrrrrr.exec:\flrrrrr.exe187⤵PID:2124
-
\??\c:\fxlrflr.exec:\fxlrflr.exe188⤵PID:452
-
\??\c:\3vjvv.exec:\3vjvv.exe189⤵PID:852
-
\??\c:\pvjpv.exec:\pvjpv.exe190⤵PID:2868
-
\??\c:\flxrrlf.exec:\flxrrlf.exe191⤵PID:480
-
\??\c:\lllrxfr.exec:\lllrxfr.exe192⤵PID:2880
-
\??\c:\tntbbn.exec:\tntbbn.exe193⤵PID:324
-
\??\c:\7ttbhn.exec:\7ttbhn.exe194⤵PID:2128
-
\??\c:\vjjpj.exec:\vjjpj.exe195⤵PID:2484
-
\??\c:\jddjj.exec:\jddjj.exe196⤵PID:2052
-
\??\c:\rlxrrlx.exec:\rlxrrlx.exe197⤵PID:1584
-
\??\c:\rrrfxfr.exec:\rrrfxfr.exe198⤵PID:2720
-
\??\c:\ttthnb.exec:\ttthnb.exe199⤵PID:2636
-
\??\c:\tthntb.exec:\tthntb.exe200⤵PID:1760
-
\??\c:\hhntht.exec:\hhntht.exe201⤵PID:2552
-
\??\c:\vjjvv.exec:\vjjvv.exe202⤵PID:2452
-
\??\c:\5djjp.exec:\5djjp.exe203⤵PID:2480
-
\??\c:\rlfxrrf.exec:\rlfxrrf.exe204⤵PID:2580
-
\??\c:\tnbbhn.exec:\tnbbhn.exe205⤵PID:2708
-
\??\c:\hbthtt.exec:\hbthtt.exe206⤵PID:2516
-
\??\c:\pvjjp.exec:\pvjjp.exe207⤵PID:2356
-
\??\c:\xxrllfr.exec:\xxrllfr.exe208⤵PID:2692
-
\??\c:\lxlxrfx.exec:\lxlxrfx.exe209⤵PID:2740
-
\??\c:\bbbbbb.exec:\bbbbbb.exe210⤵PID:2512
-
\??\c:\hbntbb.exec:\hbntbb.exe211⤵PID:2872
-
\??\c:\ddvdp.exec:\ddvdp.exe212⤵PID:1672
-
\??\c:\xrlllrl.exec:\xrlllrl.exe213⤵PID:332
-
\??\c:\llfxllx.exec:\llfxllx.exe214⤵PID:2796
-
\??\c:\lfnbhnb.exec:\lfnbhnb.exe215⤵PID:2216
-
\??\c:\nhbhbh.exec:\nhbhbh.exe216⤵PID:1752
-
\??\c:\7dvjj.exec:\7dvjj.exe217⤵PID:1504
-
\??\c:\jdvvd.exec:\jdvvd.exe218⤵PID:2120
-
\??\c:\vvvjv.exec:\vvvjv.exe219⤵PID:636
-
\??\c:\rrrrffr.exec:\rrrrffr.exe220⤵PID:2116
-
\??\c:\nhntnt.exec:\nhntnt.exe221⤵PID:2212
-
\??\c:\9pjjd.exec:\9pjjd.exe222⤵PID:2000
-
\??\c:\vvvdd.exec:\vvvdd.exe223⤵PID:2832
-
\??\c:\frrfllr.exec:\frrfllr.exe224⤵PID:1052
-
\??\c:\tnttbh.exec:\tnttbh.exe225⤵PID:1496
-
\??\c:\nhthhh.exec:\nhthhh.exe226⤵PID:2188
-
\??\c:\djpjj.exec:\djpjj.exe227⤵PID:2840
-
\??\c:\rrxfxfr.exec:\rrxfxfr.exe228⤵PID:900
-
\??\c:\fxrxlxl.exec:\fxrxlxl.exe229⤵PID:1092
-
\??\c:\hntnbt.exec:\hntnbt.exe230⤵PID:3064
-
\??\c:\bthnnn.exec:\bthnnn.exe231⤵PID:2956
-
\??\c:\vpvjj.exec:\vpvjj.exe232⤵PID:2988
-
\??\c:\ffxlflr.exec:\ffxlflr.exe233⤵PID:1424
-
\??\c:\rllrlrx.exec:\rllrlrx.exe234⤵PID:320
-
\??\c:\nhbthb.exec:\nhbthb.exe235⤵PID:1788
-
\??\c:\nhbhhn.exec:\nhbhhn.exe236⤵PID:3016
-
\??\c:\ntthbh.exec:\ntthbh.exe237⤵PID:1700
-
\??\c:\vdjvv.exec:\vdjvv.exe238⤵PID:2308
-
\??\c:\dddvd.exec:\dddvd.exe239⤵PID:2052
-
\??\c:\7xxrxrl.exec:\7xxrxrl.exe240⤵PID:2592
-
\??\c:\fxflxrx.exec:\fxflxrx.exe241⤵PID:1744
-
\??\c:\nttnbn.exec:\nttnbn.exe242⤵PID:2600