Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 18:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
184143f6c170139189008c1087f7ae90_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
184143f6c170139189008c1087f7ae90_NeikiAnalytics.exe
-
Size
180KB
-
MD5
184143f6c170139189008c1087f7ae90
-
SHA1
ec649e9b43d888ddbca405153f8521663ffc7119
-
SHA256
1ab957d1b6b336153a7a0646b185a386bb80b0a4a9c400223424e5a8a2343561
-
SHA512
540c90dfa2e0066f194db81fdb129694c7862b7255f36e1a21d0c96dd04852b5ac0518e4139812c8a623da188d2dd13f6832453f30b57e0b393a1cdfd1ea2b15
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+IJPhbMm:PhOm2sI93UufdC67ciJTm5hIm
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
Processes:
resource yara_rule behavioral1/memory/2872-0-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/292-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-87-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/772-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/308-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-279-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2248-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-333-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/900-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-356-0x0000000000250000-0x0000000000279000-memory.dmp family_blackmoon behavioral1/memory/1552-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/276-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1280-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-394-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-401-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-414-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-453-0x00000000002B0000-0x00000000002D9000-memory.dmp family_blackmoon behavioral1/memory/592-452-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-534-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-541-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-670-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/788-767-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-780-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-923-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-1141-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3020-1144-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3068-1232-0x00000000002E0000-0x0000000000309000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1rlrlll.exenhbnnn.exe1jpdv.exefxxlrrx.exebtnthn.exe9pjdp.exe3vppv.exe5lxxllr.exefxrrffr.exethntbt.exevpjpd.exepjdpp.exe1lrxffl.exefxfxllr.exebtbhtn.exe9pjpv.exedpjjj.exexlrlxxf.exe3xlrffl.exe7bnntb.exedjjvv.exepjdjp.exelxffffl.exelfrrfxl.exebnttbt.exepvpdd.exejdvjv.exe5frrxrx.exebththn.exenbnttt.exe7jppp.exerrrrrlx.exellxxlfl.exebtbbbh.exe3jdpp.exefrxllxl.exerrrxlxl.exellflxfr.exe5tbhhh.exebntttb.exeppdpd.exevvdjd.exe5rflflf.exenhtbhb.exebbnhnn.exehbttnh.exevpvvd.exepjvjp.exelfrlrxf.exe3bnnnh.exebnbhbh.exexlxfrlr.exenhnbhn.exe3jvpj.exexrfrrxf.exefrxxxxf.exe9tttbh.exepjjjd.exefxlrfrr.exelfrlrll.exenbbbhb.exedvvpp.exevjjdd.exexrxxfxl.exepid process 3056 1rlrlll.exe 2748 nhbnnn.exe 2632 1jpdv.exe 2528 fxxlrrx.exe 2440 btnthn.exe 292 9pjdp.exe 2484 3vppv.exe 3012 5lxxllr.exe 1744 fxrrffr.exe 112 thntbt.exe 772 vpjpd.exe 300 pjdpp.exe 108 1lrxffl.exe 2340 fxfxllr.exe 308 btbhtn.exe 1920 9pjpv.exe 1032 dpjjj.exe 1292 xlrlxxf.exe 1280 3xlrffl.exe 2696 7bnntb.exe 1660 djjvv.exe 2392 pjdjp.exe 3060 lxffffl.exe 2472 lfrrfxl.exe 276 bnttbt.exe 2152 pvpdd.exe 1596 jdvjv.exe 1552 5frrxrx.exe 1720 bththn.exe 2248 nbnttt.exe 3016 7jppp.exe 2236 rrrrrlx.exe 2012 llxxlfl.exe 900 btbbbh.exe 2276 3jdpp.exe 2096 frxllxl.exe 1536 rrrxlxl.exe 3056 llflxfr.exe 2556 5tbhhh.exe 2572 bntttb.exe 2672 ppdpd.exe 2528 vvdjd.exe 2416 5rflflf.exe 2580 nhtbhb.exe 2468 bbnhnn.exe 2832 hbttnh.exe 3024 vpvvd.exe 2456 pjvjp.exe 2212 lfrlrxf.exe 1944 3bnnnh.exe 2316 bnbhbh.exe 2308 xlxfrlr.exe 1676 nhnbhn.exe 1688 3jvpj.exe 1904 xrfrrxf.exe 592 frxxxxf.exe 1076 9tttbh.exe 844 pjjjd.exe 1548 fxlrfrr.exe 2804 lfrlrll.exe 1752 nbbbhb.exe 2356 dvvpp.exe 2396 vjjdd.exe 1412 xrxxfxl.exe -
Processes:
resource yara_rule behavioral1/memory/2872-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/292-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/292-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/308-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/308-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-349-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/900-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/276-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1280-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-394-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-401-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-414-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-427-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-452-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-467-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-534-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-541-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/972-556-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-575-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-588-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-632-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-671-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-696-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-703-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-723-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/788-767-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-780-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/920-801-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-814-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-875-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-903-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-916-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-923-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-942-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-949-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-968-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1456-1012-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-1025-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-1185-0x0000000000220000-0x0000000000249000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
184143f6c170139189008c1087f7ae90_NeikiAnalytics.exe1rlrlll.exenhbnnn.exe1jpdv.exefxxlrrx.exebtnthn.exe9pjdp.exe3vppv.exe5lxxllr.exefxrrffr.exethntbt.exevpjpd.exepjdpp.exe1lrxffl.exefxfxllr.exebtbhtn.exedescription pid process target process PID 2872 wrote to memory of 3056 2872 184143f6c170139189008c1087f7ae90_NeikiAnalytics.exe 1rlrlll.exe PID 2872 wrote to memory of 3056 2872 184143f6c170139189008c1087f7ae90_NeikiAnalytics.exe 1rlrlll.exe PID 2872 wrote to memory of 3056 2872 184143f6c170139189008c1087f7ae90_NeikiAnalytics.exe 1rlrlll.exe PID 2872 wrote to memory of 3056 2872 184143f6c170139189008c1087f7ae90_NeikiAnalytics.exe 1rlrlll.exe PID 3056 wrote to memory of 2748 3056 1rlrlll.exe nhbnnn.exe PID 3056 wrote to memory of 2748 3056 1rlrlll.exe nhbnnn.exe PID 3056 wrote to memory of 2748 3056 1rlrlll.exe nhbnnn.exe PID 3056 wrote to memory of 2748 3056 1rlrlll.exe nhbnnn.exe PID 2748 wrote to memory of 2632 2748 nhbnnn.exe 1jpdv.exe PID 2748 wrote to memory of 2632 2748 nhbnnn.exe 1jpdv.exe PID 2748 wrote to memory of 2632 2748 nhbnnn.exe 1jpdv.exe PID 2748 wrote to memory of 2632 2748 nhbnnn.exe 1jpdv.exe PID 2632 wrote to memory of 2528 2632 1jpdv.exe vvdjd.exe PID 2632 wrote to memory of 2528 2632 1jpdv.exe vvdjd.exe PID 2632 wrote to memory of 2528 2632 1jpdv.exe vvdjd.exe PID 2632 wrote to memory of 2528 2632 1jpdv.exe vvdjd.exe PID 2528 wrote to memory of 2440 2528 fxxlrrx.exe btnthn.exe PID 2528 wrote to memory of 2440 2528 fxxlrrx.exe btnthn.exe PID 2528 wrote to memory of 2440 2528 fxxlrrx.exe btnthn.exe PID 2528 wrote to memory of 2440 2528 fxxlrrx.exe btnthn.exe PID 2440 wrote to memory of 292 2440 btnthn.exe 9pjdp.exe PID 2440 wrote to memory of 292 2440 btnthn.exe 9pjdp.exe PID 2440 wrote to memory of 292 2440 btnthn.exe 9pjdp.exe PID 2440 wrote to memory of 292 2440 btnthn.exe 9pjdp.exe PID 292 wrote to memory of 2484 292 9pjdp.exe 3vppv.exe PID 292 wrote to memory of 2484 292 9pjdp.exe 3vppv.exe PID 292 wrote to memory of 2484 292 9pjdp.exe 3vppv.exe PID 292 wrote to memory of 2484 292 9pjdp.exe 3vppv.exe PID 2484 wrote to memory of 3012 2484 3vppv.exe 5lxxllr.exe PID 2484 wrote to memory of 3012 2484 3vppv.exe 5lxxllr.exe PID 2484 wrote to memory of 3012 2484 3vppv.exe 5lxxllr.exe PID 2484 wrote to memory of 3012 2484 3vppv.exe 5lxxllr.exe PID 3012 wrote to memory of 1744 3012 5lxxllr.exe fxrrffr.exe PID 3012 wrote to memory of 1744 3012 5lxxllr.exe fxrrffr.exe PID 3012 wrote to memory of 1744 3012 5lxxllr.exe fxrrffr.exe PID 3012 wrote to memory of 1744 3012 5lxxllr.exe fxrrffr.exe PID 1744 wrote to memory of 112 1744 fxrrffr.exe thntbt.exe PID 1744 wrote to memory of 112 1744 fxrrffr.exe thntbt.exe PID 1744 wrote to memory of 112 1744 fxrrffr.exe thntbt.exe PID 1744 wrote to memory of 112 1744 fxrrffr.exe thntbt.exe PID 112 wrote to memory of 772 112 thntbt.exe vpjpd.exe PID 112 wrote to memory of 772 112 thntbt.exe vpjpd.exe PID 112 wrote to memory of 772 112 thntbt.exe vpjpd.exe PID 112 wrote to memory of 772 112 thntbt.exe vpjpd.exe PID 772 wrote to memory of 300 772 vpjpd.exe pjdpp.exe PID 772 wrote to memory of 300 772 vpjpd.exe pjdpp.exe PID 772 wrote to memory of 300 772 vpjpd.exe pjdpp.exe PID 772 wrote to memory of 300 772 vpjpd.exe pjdpp.exe PID 300 wrote to memory of 108 300 pjdpp.exe 1lrxffl.exe PID 300 wrote to memory of 108 300 pjdpp.exe 1lrxffl.exe PID 300 wrote to memory of 108 300 pjdpp.exe 1lrxffl.exe PID 300 wrote to memory of 108 300 pjdpp.exe 1lrxffl.exe PID 108 wrote to memory of 2340 108 1lrxffl.exe fxfxllr.exe PID 108 wrote to memory of 2340 108 1lrxffl.exe fxfxllr.exe PID 108 wrote to memory of 2340 108 1lrxffl.exe fxfxllr.exe PID 108 wrote to memory of 2340 108 1lrxffl.exe fxfxllr.exe PID 2340 wrote to memory of 308 2340 fxfxllr.exe btbhtn.exe PID 2340 wrote to memory of 308 2340 fxfxllr.exe btbhtn.exe PID 2340 wrote to memory of 308 2340 fxfxllr.exe btbhtn.exe PID 2340 wrote to memory of 308 2340 fxfxllr.exe btbhtn.exe PID 308 wrote to memory of 1920 308 btbhtn.exe 9pjpv.exe PID 308 wrote to memory of 1920 308 btbhtn.exe 9pjpv.exe PID 308 wrote to memory of 1920 308 btbhtn.exe 9pjpv.exe PID 308 wrote to memory of 1920 308 btbhtn.exe 9pjpv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\184143f6c170139189008c1087f7ae90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\184143f6c170139189008c1087f7ae90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\1rlrlll.exec:\1rlrlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\nhbnnn.exec:\nhbnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\1jpdv.exec:\1jpdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\fxxlrrx.exec:\fxxlrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\btnthn.exec:\btnthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\9pjdp.exec:\9pjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
\??\c:\3vppv.exec:\3vppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\5lxxllr.exec:\5lxxllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\fxrrffr.exec:\fxrrffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\thntbt.exec:\thntbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\vpjpd.exec:\vpjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\pjdpp.exec:\pjdpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\1lrxffl.exec:\1lrxffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\fxfxllr.exec:\fxfxllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\btbhtn.exec:\btbhtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\9pjpv.exec:\9pjpv.exe17⤵
- Executes dropped EXE
PID:1920 -
\??\c:\dpjjj.exec:\dpjjj.exe18⤵
- Executes dropped EXE
PID:1032 -
\??\c:\xlrlxxf.exec:\xlrlxxf.exe19⤵
- Executes dropped EXE
PID:1292 -
\??\c:\3xlrffl.exec:\3xlrffl.exe20⤵
- Executes dropped EXE
PID:1280 -
\??\c:\7bnntb.exec:\7bnntb.exe21⤵
- Executes dropped EXE
PID:2696 -
\??\c:\djjvv.exec:\djjvv.exe22⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pjdjp.exec:\pjdjp.exe23⤵
- Executes dropped EXE
PID:2392 -
\??\c:\lxffffl.exec:\lxffffl.exe24⤵
- Executes dropped EXE
PID:3060 -
\??\c:\lfrrfxl.exec:\lfrrfxl.exe25⤵
- Executes dropped EXE
PID:2472 -
\??\c:\bnttbt.exec:\bnttbt.exe26⤵
- Executes dropped EXE
PID:276 -
\??\c:\pvpdd.exec:\pvpdd.exe27⤵
- Executes dropped EXE
PID:2152 -
\??\c:\jdvjv.exec:\jdvjv.exe28⤵
- Executes dropped EXE
PID:1596 -
\??\c:\5frrxrx.exec:\5frrxrx.exe29⤵
- Executes dropped EXE
PID:1552 -
\??\c:\bththn.exec:\bththn.exe30⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nbnttt.exec:\nbnttt.exe31⤵
- Executes dropped EXE
PID:2248 -
\??\c:\7jppp.exec:\7jppp.exe32⤵
- Executes dropped EXE
PID:3016 -
\??\c:\rrrrrlx.exec:\rrrrrlx.exe33⤵
- Executes dropped EXE
PID:2236 -
\??\c:\llxxlfl.exec:\llxxlfl.exe34⤵
- Executes dropped EXE
PID:2012 -
\??\c:\btbbbh.exec:\btbbbh.exe35⤵
- Executes dropped EXE
PID:900 -
\??\c:\3jdpp.exec:\3jdpp.exe36⤵
- Executes dropped EXE
PID:2276 -
\??\c:\frxllxl.exec:\frxllxl.exe37⤵
- Executes dropped EXE
PID:2096 -
\??\c:\rrrxlxl.exec:\rrrxlxl.exe38⤵
- Executes dropped EXE
PID:1536 -
\??\c:\llflxfr.exec:\llflxfr.exe39⤵
- Executes dropped EXE
PID:3056 -
\??\c:\5tbhhh.exec:\5tbhhh.exe40⤵
- Executes dropped EXE
PID:2556 -
\??\c:\bntttb.exec:\bntttb.exe41⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ppdpd.exec:\ppdpd.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vvdjd.exec:\vvdjd.exe43⤵
- Executes dropped EXE
PID:2528 -
\??\c:\5rflflf.exec:\5rflflf.exe44⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nhtbhb.exec:\nhtbhb.exe45⤵
- Executes dropped EXE
PID:2580 -
\??\c:\bbnhnn.exec:\bbnhnn.exe46⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hbttnh.exec:\hbttnh.exe47⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vpvvd.exec:\vpvvd.exe48⤵
- Executes dropped EXE
PID:3024 -
\??\c:\pjvjp.exec:\pjvjp.exe49⤵
- Executes dropped EXE
PID:2456 -
\??\c:\lfrlrxf.exec:\lfrlrxf.exe50⤵
- Executes dropped EXE
PID:2212 -
\??\c:\3bnnnh.exec:\3bnnnh.exe51⤵
- Executes dropped EXE
PID:1944 -
\??\c:\bnbhbh.exec:\bnbhbh.exe52⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xlxfrlr.exec:\xlxfrlr.exe53⤵
- Executes dropped EXE
PID:2308 -
\??\c:\nhnbhn.exec:\nhnbhn.exe54⤵
- Executes dropped EXE
PID:1676 -
\??\c:\3jvpj.exec:\3jvpj.exe55⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xrfrrxf.exec:\xrfrrxf.exe56⤵
- Executes dropped EXE
PID:1904 -
\??\c:\frxxxxf.exec:\frxxxxf.exe57⤵
- Executes dropped EXE
PID:592 -
\??\c:\9tttbh.exec:\9tttbh.exe58⤵
- Executes dropped EXE
PID:1076 -
\??\c:\pjjjd.exec:\pjjjd.exe59⤵
- Executes dropped EXE
PID:844 -
\??\c:\fxlrfrr.exec:\fxlrfrr.exe60⤵
- Executes dropped EXE
PID:1548 -
\??\c:\lfrlrll.exec:\lfrlrll.exe61⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nbbbhb.exec:\nbbbhb.exe62⤵
- Executes dropped EXE
PID:1752 -
\??\c:\dvvpp.exec:\dvvpp.exe63⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vjjdd.exec:\vjjdd.exe64⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xrxxfxl.exec:\xrxxfxl.exe65⤵
- Executes dropped EXE
PID:1412 -
\??\c:\tnbttb.exec:\tnbttb.exe66⤵PID:1008
-
\??\c:\dvvdj.exec:\dvvdj.exe67⤵PID:1148
-
\??\c:\frffflf.exec:\frffflf.exe68⤵PID:2600
-
\??\c:\tnttbh.exec:\tnttbh.exe69⤵PID:2296
-
\??\c:\ththhb.exec:\ththhb.exe70⤵PID:1792
-
\??\c:\vpvvd.exec:\vpvvd.exe71⤵PID:1628
-
\??\c:\fxlllll.exec:\fxlllll.exe72⤵PID:1328
-
\??\c:\tnhnnn.exec:\tnhnnn.exe73⤵PID:1716
-
\??\c:\hthhhh.exec:\hthhhh.exe74⤵PID:972
-
\??\c:\5jvjd.exec:\5jvjd.exe75⤵PID:2788
-
\??\c:\7lrlrlr.exec:\7lrlrlr.exe76⤵PID:2248
-
\??\c:\7rlxllx.exec:\7rlxllx.exe77⤵PID:2116
-
\??\c:\tttthh.exec:\tttthh.exe78⤵PID:932
-
\??\c:\nhbhnh.exec:\nhbhnh.exe79⤵PID:1908
-
\??\c:\dpvjj.exec:\dpvjj.exe80⤵PID:896
-
\??\c:\3vddd.exec:\3vddd.exe81⤵PID:1984
-
\??\c:\lffflxf.exec:\lffflxf.exe82⤵PID:2872
-
\??\c:\hnhbth.exec:\hnhbth.exe83⤵PID:1896
-
\??\c:\9hhhhh.exec:\9hhhhh.exe84⤵PID:2628
-
\??\c:\pvpjp.exec:\pvpjp.exe85⤵PID:2516
-
\??\c:\pdvdd.exec:\pdvdd.exe86⤵PID:2836
-
\??\c:\ffxlxfx.exec:\ffxlxfx.exe87⤵PID:2072
-
\??\c:\5bnthn.exec:\5bnthn.exe88⤵PID:2744
-
\??\c:\nthntt.exec:\nthntt.exe89⤵PID:2936
-
\??\c:\pjjpd.exec:\pjjpd.exe90⤵PID:2588
-
\??\c:\pjjvv.exec:\pjjvv.exe91⤵PID:2416
-
\??\c:\frfxxrr.exec:\frfxxrr.exe92⤵PID:2488
-
\??\c:\bbnntt.exec:\bbnntt.exe93⤵PID:2056
-
\??\c:\tntnbt.exec:\tntnbt.exe94⤵PID:2200
-
\??\c:\vpjpv.exec:\vpjpv.exe95⤵PID:1464
-
\??\c:\fffrxlx.exec:\fffrxlx.exe96⤵PID:1736
-
\??\c:\xxxfxfr.exec:\xxxfxfr.exe97⤵PID:2304
-
\??\c:\hnntnh.exec:\hnntnh.exe98⤵PID:1564
-
\??\c:\hbtthn.exec:\hbtthn.exe99⤵PID:2300
-
\??\c:\pdvjv.exec:\pdvjv.exe100⤵PID:2308
-
\??\c:\fxllrrf.exec:\fxllrrf.exe101⤵PID:108
-
\??\c:\llrflrx.exec:\llrflrx.exe102⤵PID:2400
-
\??\c:\5nnbhn.exec:\5nnbhn.exe103⤵PID:604
-
\??\c:\nhbnht.exec:\nhbnht.exe104⤵PID:592
-
\??\c:\vvjvd.exec:\vvjvd.exe105⤵PID:1900
-
\??\c:\jvpjp.exec:\jvpjp.exe106⤵PID:788
-
\??\c:\xrrflxl.exec:\xrrflxl.exe107⤵PID:2344
-
\??\c:\ttnhhn.exec:\ttnhhn.exe108⤵PID:1284
-
\??\c:\bhthth.exec:\bhthth.exe109⤵PID:2036
-
\??\c:\jdvdj.exec:\jdvdj.exe110⤵PID:2356
-
\??\c:\llrlxrx.exec:\llrlxrx.exe111⤵PID:2396
-
\??\c:\llxflrf.exec:\llxflrf.exe112⤵PID:920
-
\??\c:\bthntb.exec:\bthntb.exe113⤵PID:640
-
\??\c:\bnbnhn.exec:\bnbnhn.exe114⤵PID:2112
-
\??\c:\dppvd.exec:\dppvd.exe115⤵PID:1992
-
\??\c:\jjdjd.exec:\jjdjd.exe116⤵PID:2480
-
\??\c:\flxlxfr.exec:\flxlxfr.exe117⤵PID:2188
-
\??\c:\3lflxxf.exec:\3lflxxf.exe118⤵PID:1484
-
\??\c:\nnnhbt.exec:\nnnhbt.exe119⤵PID:1328
-
\??\c:\bthnhh.exec:\bthnhh.exe120⤵PID:2784
-
\??\c:\ddpjj.exec:\ddpjj.exe121⤵PID:1928
-
\??\c:\ddpvd.exec:\ddpvd.exe122⤵PID:2172
-
\??\c:\rflflll.exec:\rflflll.exe123⤵PID:1156
-
\??\c:\xxxlfrl.exec:\xxxlfrl.exe124⤵PID:2740
-
\??\c:\1tnntt.exec:\1tnntt.exe125⤵PID:704
-
\??\c:\vdvdj.exec:\vdvdj.exe126⤵PID:2604
-
\??\c:\djppj.exec:\djppj.exe127⤵PID:2924
-
\??\c:\9frrflf.exec:\9frrflf.exe128⤵PID:1984
-
\??\c:\5hhhnt.exec:\5hhhnt.exe129⤵PID:2872
-
\??\c:\hntthb.exec:\hntthb.exe130⤵PID:1536
-
\??\c:\jvjjp.exec:\jvjjp.exe131⤵PID:2628
-
\??\c:\pjppd.exec:\pjppd.exe132⤵PID:2560
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe133⤵PID:2512
-
\??\c:\5lflxfr.exec:\5lflxfr.exe134⤵PID:2684
-
\??\c:\1bnthh.exec:\1bnthh.exe135⤵PID:2712
-
\??\c:\vpjvj.exec:\vpjvj.exe136⤵PID:1888
-
\??\c:\vpvjv.exec:\vpvjv.exe137⤵PID:2548
-
\??\c:\9lrxffl.exec:\9lrxffl.exe138⤵PID:2484
-
\??\c:\lxlrflr.exec:\lxlrflr.exe139⤵PID:1916
-
\??\c:\tbntnt.exec:\tbntnt.exe140⤵PID:1580
-
\??\c:\tnbbhh.exec:\tnbbhh.exe141⤵PID:2200
-
\??\c:\jdpvv.exec:\jdpvv.exe142⤵PID:1620
-
\??\c:\ddvpj.exec:\ddvpj.exe143⤵PID:1736
-
\??\c:\lxrxxlr.exec:\lxrxxlr.exe144⤵PID:112
-
\??\c:\3rfxffl.exec:\3rfxffl.exe145⤵PID:1456
-
\??\c:\btnbnb.exec:\btnbnb.exe146⤵PID:1520
-
\??\c:\5ppjp.exec:\5ppjp.exe147⤵PID:2308
-
\??\c:\vpjpp.exec:\vpjpp.exe148⤵PID:1688
-
\??\c:\fffffrf.exec:\fffffrf.exe149⤵PID:856
-
\??\c:\llflxlr.exec:\llflxlr.exe150⤵PID:580
-
\??\c:\hbttbt.exec:\hbttbt.exe151⤵PID:296
-
\??\c:\bbnbhn.exec:\bbnbhn.exe152⤵PID:1032
-
\??\c:\1dvvd.exec:\1dvvd.exe153⤵PID:484
-
\??\c:\xrxflrx.exec:\xrxflrx.exe154⤵PID:2344
-
\??\c:\rlflrfl.exec:\rlflrfl.exe155⤵PID:1608
-
\??\c:\5nhnbb.exec:\5nhnbb.exe156⤵PID:1216
-
\??\c:\nnnthh.exec:\nnnthh.exe157⤵PID:2372
-
\??\c:\jjjvj.exec:\jjjvj.exe158⤵PID:2772
-
\??\c:\rrrxxxf.exec:\rrrxxxf.exe159⤵PID:620
-
\??\c:\frffffl.exec:\frffffl.exe160⤵PID:2616
-
\??\c:\rlxxrll.exec:\rlxxrll.exe161⤵PID:2292
-
\??\c:\htbhhn.exec:\htbhhn.exe162⤵PID:860
-
\??\c:\1pvdv.exec:\1pvdv.exe163⤵PID:3032
-
\??\c:\vdjjj.exec:\vdjjj.exe164⤵PID:1696
-
\??\c:\rrlxflx.exec:\rrlxflx.exe165⤵PID:1912
-
\??\c:\fxlxfff.exec:\fxlxfff.exe166⤵PID:3020
-
\??\c:\bbhhth.exec:\bbhhth.exe167⤵PID:568
-
\??\c:\pdpvp.exec:\pdpvp.exe168⤵PID:1488
-
\??\c:\vpjpj.exec:\vpjpj.exe169⤵PID:968
-
\??\c:\xrlrxxr.exec:\xrlrxxr.exe170⤵PID:2248
-
\??\c:\rrrllxx.exec:\rrrllxx.exe171⤵PID:3016
-
\??\c:\tbhtbh.exec:\tbhtbh.exe172⤵PID:2020
-
\??\c:\bthnnt.exec:\bthnnt.exe173⤵PID:2012
-
\??\c:\pdvpv.exec:\pdvpv.exe174⤵PID:896
-
\??\c:\pdpvd.exec:\pdpvd.exe175⤵PID:1528
-
\??\c:\7lflrxf.exec:\7lflrxf.exe176⤵PID:2276
-
\??\c:\bbtbtb.exec:\bbtbtb.exe177⤵PID:2644
-
\??\c:\lfxlfxx.exec:\lfxlfxx.exe178⤵PID:1532
-
\??\c:\hhhnbb.exec:\hhhnbb.exe179⤵PID:3068
-
\??\c:\5nnttt.exec:\5nnttt.exe180⤵PID:2860
-
\??\c:\jdjpv.exec:\jdjpv.exe181⤵PID:2584
-
\??\c:\pjdjv.exec:\pjdjv.exe182⤵PID:2524
-
\??\c:\lxlflrf.exec:\lxlflrf.exe183⤵PID:2528
-
\??\c:\9ffxflr.exec:\9ffxflr.exe184⤵PID:2416
-
\??\c:\nbnhth.exec:\nbnhth.exe185⤵PID:1020
-
\??\c:\7vppd.exec:\7vppd.exe186⤵PID:2484
-
\??\c:\jpjpp.exec:\jpjpp.exe187⤵PID:2004
-
\??\c:\1fllflf.exec:\1fllflf.exe188⤵PID:2820
-
\??\c:\7rfflrx.exec:\7rfflrx.exe189⤵PID:1612
-
\??\c:\ntthnh.exec:\ntthnh.exe190⤵PID:1652
-
\??\c:\3bttbt.exec:\3bttbt.exe191⤵PID:2320
-
\??\c:\pjvjp.exec:\pjvjp.exe192⤵PID:1492
-
\??\c:\vjvdj.exec:\vjvdj.exe193⤵PID:1456
-
\??\c:\5lrxxxl.exec:\5lrxxxl.exe194⤵PID:1520
-
\??\c:\3fllrrr.exec:\3fllrrr.exe195⤵PID:468
-
\??\c:\9hbhtt.exec:\9hbhtt.exe196⤵PID:1688
-
\??\c:\nbhhbh.exec:\nbhhbh.exe197⤵PID:1864
-
\??\c:\ddvdd.exec:\ddvdd.exe198⤵PID:1276
-
\??\c:\1dpdj.exec:\1dpdj.exe199⤵PID:296
-
\??\c:\rlxxrxl.exec:\rlxxrxl.exe200⤵PID:1280
-
\??\c:\rlfrffr.exec:\rlfrffr.exe201⤵PID:1956
-
\??\c:\nhnnnn.exec:\nhnnnn.exe202⤵PID:556
-
\??\c:\hbthnb.exec:\hbthnb.exe203⤵PID:2724
-
\??\c:\dpdpp.exec:\dpdpp.exe204⤵PID:1788
-
\??\c:\vvdpp.exec:\vvdpp.exe205⤵PID:3060
-
\??\c:\lfrxllr.exec:\lfrxllr.exe206⤵PID:1468
-
\??\c:\tnhttt.exec:\tnhttt.exe207⤵PID:2360
-
\??\c:\tnbbnn.exec:\tnbbnn.exe208⤵PID:1640
-
\??\c:\hhthnn.exec:\hhthnn.exe209⤵PID:1212
-
\??\c:\pvjvv.exec:\pvjvv.exe210⤵PID:2152
-
\??\c:\lfxlflf.exec:\lfxlflf.exe211⤵PID:3036
-
\??\c:\llxrrrf.exec:\llxrrrf.exe212⤵PID:312
-
\??\c:\nhthbh.exec:\nhthbh.exe213⤵PID:1328
-
\??\c:\vvvjp.exec:\vvvjp.exe214⤵PID:2160
-
\??\c:\jdjjj.exec:\jdjjj.exe215⤵PID:2224
-
\??\c:\jjdpd.exec:\jjdpd.exe216⤵PID:1584
-
\??\c:\ffllllr.exec:\ffllllr.exe217⤵PID:1156
-
\??\c:\bthnbb.exec:\bthnbb.exe218⤵PID:1972
-
\??\c:\nnhbtb.exec:\nnhbtb.exe219⤵PID:1908
-
\??\c:\jdvpv.exec:\jdvpv.exe220⤵PID:1444
-
\??\c:\ddvdd.exec:\ddvdd.exe221⤵PID:2520
-
\??\c:\lrfxrff.exec:\lrfxrff.exe222⤵PID:1656
-
\??\c:\nntbbh.exec:\nntbbh.exe223⤵PID:2840
-
\??\c:\tbhbhb.exec:\tbhbhb.exe224⤵PID:2668
-
\??\c:\jdppp.exec:\jdppp.exe225⤵PID:3056
-
\??\c:\djjvv.exec:\djjvv.exe226⤵PID:2968
-
\??\c:\lxllrrr.exec:\lxllrrr.exe227⤵PID:2556
-
\??\c:\5rxflrr.exec:\5rxflrr.exe228⤵PID:2168
-
\??\c:\hnnhbt.exec:\hnnhbt.exe229⤵PID:2860
-
\??\c:\dvpdp.exec:\dvpdp.exe230⤵PID:2672
-
\??\c:\jjdjp.exec:\jjdjp.exe231⤵PID:2936
-
\??\c:\fflrxrl.exec:\fflrxrl.exe232⤵PID:2928
-
\??\c:\lfrxllx.exec:\lfrxllx.exe233⤵PID:2440
-
\??\c:\fxxlfrr.exec:\fxxlfrr.exe234⤵PID:2444
-
\??\c:\nhtbbb.exec:\nhtbbb.exe235⤵PID:2816
-
\??\c:\bbbnhn.exec:\bbbnhn.exe236⤵PID:1580
-
\??\c:\jdjdd.exec:\jdjdd.exe237⤵PID:2200
-
\??\c:\pvpjd.exec:\pvpjd.exe238⤵PID:1620
-
\??\c:\dpddv.exec:\dpddv.exe239⤵PID:1736
-
\??\c:\xfxfrxl.exec:\xfxfrxl.exe240⤵PID:300
-
\??\c:\lfrrrlx.exec:\lfrrrlx.exe241⤵PID:1128
-
\??\c:\7bnnnn.exec:\7bnnnn.exe242⤵PID:1616