Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 05:29
Behavioral task
behavioral1
Sample
b93706016c764fbd88acf14760156490_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b93706016c764fbd88acf14760156490_NeikiAnalytics.exe
-
Size
455KB
-
MD5
b93706016c764fbd88acf14760156490
-
SHA1
15a0960c4bb46cc26ea24a2b99834bf2af635125
-
SHA256
8601fbe0d1a0c97b1a6f129e999ad252b9a8aa2fc755ac5bb3fe362e8cc27fd2
-
SHA512
f6e3e2cfecc78e96775bcbc597fb5620a067ad080c3025b89f75c9f2c2b217d91bc20a90aab0a26f59f134a46131c4e515b940d4062564d71e60fc430c89638b
-
SSDEEP
12288:y4wFHoS3eFp3IDvSbh5nPYERAAUDCa4NYmU:HFp3lz1XUDCaGYmU
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/2936-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1680-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1252-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1504-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2252-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/596-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1856-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/568-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-409-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1308-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1540-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-268-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1080-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1752-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-603-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-616-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1784-840-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-917-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-975-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1780-1015-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-1170-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tnbnbb.exe3nbhtt.exettnthn.exejdjvv.exejdjvd.exelxllxxl.exetbtbtb.exejdppv.exerfrxlfr.exehhhbnt.exe1dppj.exe7xxfflr.exebbbbth.exepjdjv.exe9ffxllx.exenhbhnt.exedjdpj.exerrlrxfl.exennnnbn.exevjjpv.exelxrxllr.exebnbthn.exejvjpv.exejvddp.exelfrllxl.exehbnnbn.exe3frrrrf.exenhnhhh.exe9nhhtn.exe3frrxxx.exe9lfffxf.exenhtbnn.exejvjvd.exelfrrllf.exe3xllrxx.exebnbhbn.exe1jjjv.exe1fllfrx.exerlxxxxf.exehhnbnt.exejdvpp.exexrflrxl.exebtbhhn.exe7dppp.exeddjjd.exefxrxllx.exenhtbht.exejdppv.exeddppd.exelxllllr.exehnbhhb.exehbbnbh.exepjvdv.exefxxlrxr.exerrxfrfr.exethbbtb.exevjdvp.exejvdpd.exefxlrrxf.exehbttnb.exe3ppdp.exe9vdvv.exe3fxxflr.exebbttht.exepid process 1680 tnbnbb.exe 1252 3nbhtt.exe 1708 ttnthn.exe 2640 jdjvv.exe 2604 jdjvd.exe 2828 lxllxxl.exe 2476 tbtbtb.exe 2448 jdppv.exe 2524 rfrxlfr.exe 2108 hhhbnt.exe 1624 1dppj.exe 2684 7xxfflr.exe 2812 bbbbth.exe 1964 pjdjv.exe 1504 9ffxllx.exe 1704 nhbhnt.exe 1920 djdpj.exe 1752 rrlrxfl.exe 1080 nnnnbn.exe 2252 vjjpv.exe 2280 lxrxllr.exe 2080 bnbthn.exe 596 jvjpv.exe 580 jvddp.exe 1856 lfrllxl.exe 1628 hbnnbn.exe 2336 3frrrrf.exe 568 nhnhhh.exe 2324 9nhhtn.exe 1540 3frrxxx.exe 904 9lfffxf.exe 2772 nhtbnn.exe 3036 jvjvd.exe 1716 lfrrllf.exe 3008 3xllrxx.exe 3044 bnbhbn.exe 2168 1jjjv.exe 2672 1fllfrx.exe 2580 rlxxxxf.exe 2604 hhnbnt.exe 2948 jdvpp.exe 2620 xrflrxl.exe 2276 btbhhn.exe 2900 7dppp.exe 2524 ddjjd.exe 2500 fxrxllx.exe 2764 nhtbht.exe 2492 jdppv.exe 2400 ddppd.exe 1872 lxllllr.exe 1196 hnbhhb.exe 772 hbbnbh.exe 1948 pjvdv.exe 2328 fxxlrxr.exe 1668 rrxfrfr.exe 1832 thbbtb.exe 2104 vjdvp.exe 2128 jvdpd.exe 2164 fxlrrxf.exe 1984 hbttnb.exe 2024 3ppdp.exe 480 9vdvv.exe 1340 3fxxflr.exe 992 bbttht.exe -
Processes:
resource yara_rule behavioral1/memory/2936-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2936-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1680-9-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tnbnbb.exe upx behavioral1/memory/1680-18-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3nbhtt.exe upx behavioral1/memory/1252-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1252-28-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttnthn.exe upx C:\jdjvv.exe upx behavioral1/memory/2640-37-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdjvd.exe upx behavioral1/memory/2640-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2604-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxllxxl.exe upx behavioral1/memory/2828-57-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbtbtb.exe upx behavioral1/memory/2828-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2476-68-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdppv.exe upx \??\c:\rfrxlfr.exe upx behavioral1/memory/2448-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2524-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhhbnt.exe upx \??\c:\1dppj.exe upx \??\c:\7xxfflr.exe upx behavioral1/memory/2812-124-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bbbbth.exe upx C:\pjdjv.exe upx behavioral1/memory/1504-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1704-150-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\djdpj.exe upx C:\rrlrxfl.exe upx \??\c:\nnnnbn.exe upx behavioral1/memory/2252-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2252-195-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lxrxllr.exe upx \??\c:\bnbthn.exe upx behavioral1/memory/596-221-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbnnbn.exe upx behavioral1/memory/1628-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1856-231-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfrllxl.exe upx \??\c:\3frrrrf.exe upx C:\9nhhtn.exe upx behavioral1/memory/568-263-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3frrxxx.exe upx \??\c:\9lfffxf.exe upx behavioral1/memory/2500-382-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1340-489-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2324-544-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1308-514-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-369-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2620-356-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3044-316-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhtbnn.exe upx behavioral1/memory/1540-275-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhnhhh.exe upx \??\c:\jvddp.exe upx \??\c:\jvjpv.exe upx behavioral1/memory/596-212-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vjjpv.exe upx behavioral1/memory/1080-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1752-175-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b93706016c764fbd88acf14760156490_NeikiAnalytics.exetnbnbb.exe3nbhtt.exettnthn.exejdjvv.exejdjvd.exelxllxxl.exetbtbtb.exejdppv.exerfrxlfr.exehhhbnt.exe1dppj.exe7xxfflr.exebbbbth.exepjdjv.exe9ffxllx.exedescription pid process target process PID 2936 wrote to memory of 1680 2936 b93706016c764fbd88acf14760156490_NeikiAnalytics.exe tnbnbb.exe PID 2936 wrote to memory of 1680 2936 b93706016c764fbd88acf14760156490_NeikiAnalytics.exe tnbnbb.exe PID 2936 wrote to memory of 1680 2936 b93706016c764fbd88acf14760156490_NeikiAnalytics.exe tnbnbb.exe PID 2936 wrote to memory of 1680 2936 b93706016c764fbd88acf14760156490_NeikiAnalytics.exe tnbnbb.exe PID 1680 wrote to memory of 1252 1680 tnbnbb.exe 3nbhtt.exe PID 1680 wrote to memory of 1252 1680 tnbnbb.exe 3nbhtt.exe PID 1680 wrote to memory of 1252 1680 tnbnbb.exe 3nbhtt.exe PID 1680 wrote to memory of 1252 1680 tnbnbb.exe 3nbhtt.exe PID 1252 wrote to memory of 1708 1252 3nbhtt.exe ttnthn.exe PID 1252 wrote to memory of 1708 1252 3nbhtt.exe ttnthn.exe PID 1252 wrote to memory of 1708 1252 3nbhtt.exe ttnthn.exe PID 1252 wrote to memory of 1708 1252 3nbhtt.exe ttnthn.exe PID 1708 wrote to memory of 2640 1708 ttnthn.exe jdjvv.exe PID 1708 wrote to memory of 2640 1708 ttnthn.exe jdjvv.exe PID 1708 wrote to memory of 2640 1708 ttnthn.exe jdjvv.exe PID 1708 wrote to memory of 2640 1708 ttnthn.exe jdjvv.exe PID 2640 wrote to memory of 2604 2640 jdjvv.exe jdjvd.exe PID 2640 wrote to memory of 2604 2640 jdjvv.exe jdjvd.exe PID 2640 wrote to memory of 2604 2640 jdjvv.exe jdjvd.exe PID 2640 wrote to memory of 2604 2640 jdjvv.exe jdjvd.exe PID 2604 wrote to memory of 2828 2604 jdjvd.exe lxllxxl.exe PID 2604 wrote to memory of 2828 2604 jdjvd.exe lxllxxl.exe PID 2604 wrote to memory of 2828 2604 jdjvd.exe lxllxxl.exe PID 2604 wrote to memory of 2828 2604 jdjvd.exe lxllxxl.exe PID 2828 wrote to memory of 2476 2828 lxllxxl.exe tbtbtb.exe PID 2828 wrote to memory of 2476 2828 lxllxxl.exe tbtbtb.exe PID 2828 wrote to memory of 2476 2828 lxllxxl.exe tbtbtb.exe PID 2828 wrote to memory of 2476 2828 lxllxxl.exe tbtbtb.exe PID 2476 wrote to memory of 2448 2476 tbtbtb.exe jdppv.exe PID 2476 wrote to memory of 2448 2476 tbtbtb.exe jdppv.exe PID 2476 wrote to memory of 2448 2476 tbtbtb.exe jdppv.exe PID 2476 wrote to memory of 2448 2476 tbtbtb.exe jdppv.exe PID 2448 wrote to memory of 2524 2448 jdppv.exe ddjjd.exe PID 2448 wrote to memory of 2524 2448 jdppv.exe ddjjd.exe PID 2448 wrote to memory of 2524 2448 jdppv.exe ddjjd.exe PID 2448 wrote to memory of 2524 2448 jdppv.exe ddjjd.exe PID 2524 wrote to memory of 2108 2524 rfrxlfr.exe hhhbnt.exe PID 2524 wrote to memory of 2108 2524 rfrxlfr.exe hhhbnt.exe PID 2524 wrote to memory of 2108 2524 rfrxlfr.exe hhhbnt.exe PID 2524 wrote to memory of 2108 2524 rfrxlfr.exe hhhbnt.exe PID 2108 wrote to memory of 1624 2108 hhhbnt.exe 1dppj.exe PID 2108 wrote to memory of 1624 2108 hhhbnt.exe 1dppj.exe PID 2108 wrote to memory of 1624 2108 hhhbnt.exe 1dppj.exe PID 2108 wrote to memory of 1624 2108 hhhbnt.exe 1dppj.exe PID 1624 wrote to memory of 2684 1624 1dppj.exe 7xxfflr.exe PID 1624 wrote to memory of 2684 1624 1dppj.exe 7xxfflr.exe PID 1624 wrote to memory of 2684 1624 1dppj.exe 7xxfflr.exe PID 1624 wrote to memory of 2684 1624 1dppj.exe 7xxfflr.exe PID 2684 wrote to memory of 2812 2684 7xxfflr.exe bbbbth.exe PID 2684 wrote to memory of 2812 2684 7xxfflr.exe bbbbth.exe PID 2684 wrote to memory of 2812 2684 7xxfflr.exe bbbbth.exe PID 2684 wrote to memory of 2812 2684 7xxfflr.exe bbbbth.exe PID 2812 wrote to memory of 1964 2812 bbbbth.exe pjdjv.exe PID 2812 wrote to memory of 1964 2812 bbbbth.exe pjdjv.exe PID 2812 wrote to memory of 1964 2812 bbbbth.exe pjdjv.exe PID 2812 wrote to memory of 1964 2812 bbbbth.exe pjdjv.exe PID 1964 wrote to memory of 1504 1964 pjdjv.exe 9ffxllx.exe PID 1964 wrote to memory of 1504 1964 pjdjv.exe 9ffxllx.exe PID 1964 wrote to memory of 1504 1964 pjdjv.exe 9ffxllx.exe PID 1964 wrote to memory of 1504 1964 pjdjv.exe 9ffxllx.exe PID 1504 wrote to memory of 1704 1504 9ffxllx.exe nhbhnt.exe PID 1504 wrote to memory of 1704 1504 9ffxllx.exe nhbhnt.exe PID 1504 wrote to memory of 1704 1504 9ffxllx.exe nhbhnt.exe PID 1504 wrote to memory of 1704 1504 9ffxllx.exe nhbhnt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b93706016c764fbd88acf14760156490_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b93706016c764fbd88acf14760156490_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\tnbnbb.exec:\tnbnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\3nbhtt.exec:\3nbhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\ttnthn.exec:\ttnthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\jdjvv.exec:\jdjvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\jdjvd.exec:\jdjvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\lxllxxl.exec:\lxllxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\tbtbtb.exec:\tbtbtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\jdppv.exec:\jdppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\rfrxlfr.exec:\rfrxlfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\hhhbnt.exec:\hhhbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\1dppj.exec:\1dppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\7xxfflr.exec:\7xxfflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\bbbbth.exec:\bbbbth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\pjdjv.exec:\pjdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\9ffxllx.exec:\9ffxllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\nhbhnt.exec:\nhbhnt.exe17⤵
- Executes dropped EXE
PID:1704 -
\??\c:\djdpj.exec:\djdpj.exe18⤵
- Executes dropped EXE
PID:1920 -
\??\c:\rrlrxfl.exec:\rrlrxfl.exe19⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nnnnbn.exec:\nnnnbn.exe20⤵
- Executes dropped EXE
PID:1080 -
\??\c:\vjjpv.exec:\vjjpv.exe21⤵
- Executes dropped EXE
PID:2252 -
\??\c:\lxrxllr.exec:\lxrxllr.exe22⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bnbthn.exec:\bnbthn.exe23⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jvjpv.exec:\jvjpv.exe24⤵
- Executes dropped EXE
PID:596 -
\??\c:\jvddp.exec:\jvddp.exe25⤵
- Executes dropped EXE
PID:580 -
\??\c:\lfrllxl.exec:\lfrllxl.exe26⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hbnnbn.exec:\hbnnbn.exe27⤵
- Executes dropped EXE
PID:1628 -
\??\c:\3frrrrf.exec:\3frrrrf.exe28⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nhnhhh.exec:\nhnhhh.exe29⤵
- Executes dropped EXE
PID:568 -
\??\c:\9nhhtn.exec:\9nhhtn.exe30⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3frrxxx.exec:\3frrxxx.exe31⤵
- Executes dropped EXE
PID:1540 -
\??\c:\9lfffxf.exec:\9lfffxf.exe32⤵
- Executes dropped EXE
PID:904 -
\??\c:\nhtbnn.exec:\nhtbnn.exe33⤵
- Executes dropped EXE
PID:2772 -
\??\c:\jvjvd.exec:\jvjvd.exe34⤵
- Executes dropped EXE
PID:3036 -
\??\c:\lfrrllf.exec:\lfrrllf.exe35⤵
- Executes dropped EXE
PID:1716 -
\??\c:\3xllrxx.exec:\3xllrxx.exe36⤵
- Executes dropped EXE
PID:3008 -
\??\c:\bnbhbn.exec:\bnbhbn.exe37⤵
- Executes dropped EXE
PID:3044 -
\??\c:\1jjjv.exec:\1jjjv.exe38⤵
- Executes dropped EXE
PID:2168 -
\??\c:\1fllfrx.exec:\1fllfrx.exe39⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\hhnbnt.exec:\hhnbnt.exe41⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jdvpp.exec:\jdvpp.exe42⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xrflrxl.exec:\xrflrxl.exe43⤵
- Executes dropped EXE
PID:2620 -
\??\c:\btbhhn.exec:\btbhhn.exe44⤵
- Executes dropped EXE
PID:2276 -
\??\c:\7dppp.exec:\7dppp.exe45⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ddjjd.exec:\ddjjd.exe46⤵
- Executes dropped EXE
PID:2524 -
\??\c:\fxrxllx.exec:\fxrxllx.exe47⤵
- Executes dropped EXE
PID:2500 -
\??\c:\nhtbht.exec:\nhtbht.exe48⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jdppv.exec:\jdppv.exe49⤵
- Executes dropped EXE
PID:2492 -
\??\c:\ddppd.exec:\ddppd.exe50⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lxllllr.exec:\lxllllr.exe51⤵
- Executes dropped EXE
PID:1872 -
\??\c:\hnbhhb.exec:\hnbhhb.exe52⤵
- Executes dropped EXE
PID:1196 -
\??\c:\hbbnbh.exec:\hbbnbh.exe53⤵
- Executes dropped EXE
PID:772 -
\??\c:\pjvdv.exec:\pjvdv.exe54⤵
- Executes dropped EXE
PID:1948 -
\??\c:\fxxlrxr.exec:\fxxlrxr.exe55⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rrxfrfr.exec:\rrxfrfr.exe56⤵
- Executes dropped EXE
PID:1668 -
\??\c:\thbbtb.exec:\thbbtb.exe57⤵
- Executes dropped EXE
PID:1832 -
\??\c:\vjdvp.exec:\vjdvp.exe58⤵
- Executes dropped EXE
PID:2104 -
\??\c:\jvdpd.exec:\jvdpd.exe59⤵
- Executes dropped EXE
PID:2128 -
\??\c:\fxlrrxf.exec:\fxlrrxf.exe60⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hbttnb.exec:\hbttnb.exe61⤵
- Executes dropped EXE
PID:1984 -
\??\c:\3ppdp.exec:\3ppdp.exe62⤵
- Executes dropped EXE
PID:2024 -
\??\c:\9vdvv.exec:\9vdvv.exe63⤵
- Executes dropped EXE
PID:480 -
\??\c:\3fxxflr.exec:\3fxxflr.exe64⤵
- Executes dropped EXE
PID:1340 -
\??\c:\bbttht.exec:\bbttht.exe65⤵
- Executes dropped EXE
PID:992 -
\??\c:\nnnbnn.exec:\nnnbnn.exe66⤵PID:1916
-
\??\c:\5jpvp.exec:\5jpvp.exe67⤵PID:1308
-
\??\c:\ffxxxfx.exec:\ffxxxfx.exe68⤵PID:796
-
\??\c:\1lflrrf.exec:\1lflrrf.exe69⤵PID:384
-
\??\c:\bbhnnt.exec:\bbhnnt.exe70⤵PID:2068
-
\??\c:\jdjjd.exec:\jdjjd.exe71⤵PID:1316
-
\??\c:\jdppv.exec:\jdppv.exe72⤵PID:2324
-
\??\c:\1xfrxll.exec:\1xfrxll.exe73⤵PID:2416
-
\??\c:\5nthnt.exec:\5nthnt.exe74⤵PID:2140
-
\??\c:\bbbbbt.exec:\bbbbbt.exe75⤵PID:2304
-
\??\c:\vpjpv.exec:\vpjpv.exe76⤵PID:2772
-
\??\c:\rrlrfrx.exec:\rrlrfrx.exe77⤵PID:2624
-
\??\c:\7rxflll.exec:\7rxflll.exe78⤵PID:2120
-
\??\c:\vjjvp.exec:\vjjvp.exe79⤵PID:1252
-
\??\c:\lxlrxff.exec:\lxlrxff.exe80⤵PID:3044
-
\??\c:\3nhbnh.exec:\3nhbnh.exe81⤵PID:2168
-
\??\c:\dpdjj.exec:\dpdjj.exe82⤵PID:2996
-
\??\c:\hbntbh.exec:\hbntbh.exe83⤵PID:2580
-
\??\c:\vjvvv.exec:\vjvvv.exe84⤵PID:2372
-
\??\c:\1xlrrxf.exec:\1xlrrxf.exe85⤵PID:2496
-
\??\c:\hthnbb.exec:\hthnbb.exe86⤵PID:2464
-
\??\c:\5pvdp.exec:\5pvdp.exe87⤵PID:2380
-
\??\c:\rlfflxf.exec:\rlfflxf.exe88⤵PID:640
-
\??\c:\tthnbb.exec:\tthnbb.exe89⤵PID:2540
-
\??\c:\9dppv.exec:\9dppv.exe90⤵PID:2516
-
\??\c:\5thhtt.exec:\5thhtt.exe91⤵PID:1972
-
\??\c:\dvjdj.exec:\dvjdj.exe92⤵PID:2472
-
\??\c:\tbtnnh.exec:\tbtnnh.exe93⤵PID:1788
-
\??\c:\1pdpp.exec:\1pdpp.exe94⤵PID:844
-
\??\c:\djvdj.exec:\djvdj.exe95⤵PID:1964
-
\??\c:\frfxxxx.exec:\frfxxxx.exe96⤵PID:1196
-
\??\c:\9btnnn.exec:\9btnnn.exe97⤵PID:2792
-
\??\c:\dpddj.exec:\dpddj.exe98⤵PID:1928
-
\??\c:\fxlfffx.exec:\fxlfffx.exe99⤵PID:1664
-
\??\c:\fflxfrf.exec:\fflxfrf.exe100⤵PID:1764
-
\??\c:\7bhnhh.exec:\7bhnhh.exe101⤵PID:1080
-
\??\c:\jjpjd.exec:\jjpjd.exe102⤵PID:544
-
\??\c:\pdpvv.exec:\pdpvv.exe103⤵PID:2292
-
\??\c:\xlxxfxx.exec:\xlxxfxx.exe104⤵PID:2132
-
\??\c:\bbnnbt.exec:\bbnnbt.exe105⤵PID:2248
-
\??\c:\jdvpv.exec:\jdvpv.exe106⤵PID:1300
-
\??\c:\lfxrrrx.exec:\lfxrrrx.exe107⤵PID:3024
-
\??\c:\frrrffl.exec:\frrrffl.exe108⤵PID:1028
-
\??\c:\bthttt.exec:\bthttt.exe109⤵PID:1868
-
\??\c:\5dvvd.exec:\5dvvd.exe110⤵PID:1240
-
\??\c:\9vddj.exec:\9vddj.exe111⤵PID:1656
-
\??\c:\xrfxllf.exec:\xrfxllf.exe112⤵PID:1040
-
\??\c:\rlfrffl.exec:\rlfrffl.exe113⤵PID:568
-
\??\c:\9bnhhb.exec:\9bnhhb.exe114⤵PID:1084
-
\??\c:\5pddd.exec:\5pddd.exe115⤵PID:924
-
\??\c:\9xrxxfl.exec:\9xrxxfl.exe116⤵PID:3068
-
\??\c:\hbtttt.exec:\hbtttt.exe117⤵PID:2860
-
\??\c:\tntttt.exec:\tntttt.exe118⤵PID:1784
-
\??\c:\vpdjj.exec:\vpdjj.exe119⤵PID:2172
-
\??\c:\lrllxfl.exec:\lrllxfl.exe120⤵PID:2988
-
\??\c:\nhttht.exec:\nhttht.exe121⤵PID:2588
-
\??\c:\thbntn.exec:\thbntn.exe122⤵PID:2976
-
\??\c:\vjvvv.exec:\vjvvv.exe123⤵PID:2288
-
\??\c:\xrrxffl.exec:\xrrxffl.exe124⤵PID:2980
-
\??\c:\hbthnn.exec:\hbthnn.exe125⤵PID:1480
-
\??\c:\pjvjp.exec:\pjvjp.exe126⤵PID:1596
-
\??\c:\9xrxxxf.exec:\9xrxxxf.exe127⤵PID:2612
-
\??\c:\3rllxxf.exec:\3rllxxf.exe128⤵PID:2828
-
\??\c:\3tntbb.exec:\3tntbb.exe129⤵PID:2452
-
\??\c:\ppvdp.exec:\ppvdp.exe130⤵PID:2724
-
\??\c:\flxfxrl.exec:\flxfxrl.exe131⤵PID:2804
-
\??\c:\1htthh.exec:\1htthh.exe132⤵PID:2696
-
\??\c:\3jvdj.exec:\3jvdj.exe133⤵PID:2540
-
\??\c:\5lxxlrx.exec:\5lxxlrx.exe134⤵PID:2704
-
\??\c:\1xfllxf.exec:\1xfllxf.exe135⤵PID:2492
-
\??\c:\7bthnn.exec:\7bthnn.exe136⤵PID:2412
-
\??\c:\vjvdp.exec:\vjvdp.exe137⤵PID:2808
-
\??\c:\jvpdp.exec:\jvpdp.exe138⤵PID:2628
-
\??\c:\rxffllr.exec:\rxffllr.exe139⤵PID:1932
-
\??\c:\htntbh.exec:\htntbh.exe140⤵PID:1648
-
\??\c:\dpjjp.exec:\dpjjp.exe141⤵PID:1936
-
\??\c:\dvpjp.exec:\dvpjp.exe142⤵PID:2244
-
\??\c:\xrflxfx.exec:\xrflxfx.exe143⤵PID:320
-
\??\c:\nhtbnn.exec:\nhtbnn.exe144⤵PID:2728
-
\??\c:\9hnhhb.exec:\9hnhhb.exe145⤵PID:1780
-
\??\c:\pjjvd.exec:\pjjvd.exe146⤵PID:1864
-
\??\c:\5pvdd.exec:\5pvdd.exe147⤵PID:588
-
\??\c:\xrlrfxl.exec:\xrlrfxl.exe148⤵PID:800
-
\??\c:\btnthh.exec:\btnthh.exe149⤵PID:596
-
\??\c:\vpdvp.exec:\vpdvp.exe150⤵PID:784
-
\??\c:\7pdvp.exec:\7pdvp.exe151⤵PID:1812
-
\??\c:\lflfrlr.exec:\lflfrlr.exe152⤵PID:1916
-
\??\c:\fllxlxr.exec:\fllxlxr.exe153⤵PID:2228
-
\??\c:\tnbhnn.exec:\tnbhnn.exe154⤵PID:2336
-
\??\c:\jvjpd.exec:\jvjpd.exe155⤵PID:2836
-
\??\c:\vjjvp.exec:\vjjvp.exe156⤵PID:2856
-
\??\c:\xrrxlrl.exec:\xrrxlrl.exe157⤵PID:1316
-
\??\c:\hbbbtt.exec:\hbbbtt.exe158⤵PID:332
-
\??\c:\3bnnbb.exec:\3bnnbb.exe159⤵PID:924
-
\??\c:\5dvpv.exec:\5dvpv.exe160⤵PID:3068
-
\??\c:\1rlxlrx.exec:\1rlxlrx.exe161⤵PID:2192
-
\??\c:\tnnnbh.exec:\tnnnbh.exe162⤵PID:2768
-
\??\c:\hhtbnt.exec:\hhtbnt.exe163⤵PID:2816
-
\??\c:\pdpvj.exec:\pdpvj.exe164⤵PID:2968
-
\??\c:\jdvvj.exec:\jdvvj.exe165⤵PID:2660
-
\??\c:\fxrxrxl.exec:\fxrxrxl.exe166⤵PID:2284
-
\??\c:\nbnhtt.exec:\nbnhtt.exe167⤵PID:2576
-
\??\c:\ddvdv.exec:\ddvdv.exe168⤵PID:2980
-
\??\c:\vppdp.exec:\vppdp.exe169⤵PID:2264
-
\??\c:\rfrrllr.exec:\rfrrllr.exe170⤵PID:2796
-
\??\c:\7httbh.exec:\7httbh.exe171⤵PID:2372
-
\??\c:\3nttnn.exec:\3nttnn.exe172⤵PID:2468
-
\??\c:\dvpjj.exec:\dvpjj.exe173⤵PID:2452
-
\??\c:\7lxfrrf.exec:\7lxfrrf.exe174⤵PID:2196
-
\??\c:\5fxfrxf.exec:\5fxfrxf.exe175⤵PID:2804
-
\??\c:\ttnbhn.exec:\ttnbhn.exe176⤵PID:1956
-
\??\c:\vpjjd.exec:\vpjjd.exe177⤵PID:2696
-
\??\c:\5dvvv.exec:\5dvvv.exe178⤵PID:2360
-
\??\c:\5lrlfxx.exec:\5lrlfxx.exe179⤵PID:1736
-
\??\c:\flxxxxf.exec:\flxxxxf.exe180⤵PID:872
-
\??\c:\bthnbt.exec:\bthnbt.exe181⤵PID:1924
-
\??\c:\jvddj.exec:\jvddj.exe182⤵PID:2808
-
\??\c:\pdppv.exec:\pdppv.exe183⤵PID:276
-
\??\c:\5xlrxlr.exec:\5xlrxlr.exe184⤵PID:2232
-
\??\c:\1hbbnt.exec:\1hbbnt.exe185⤵PID:1996
-
\??\c:\vjdpv.exec:\vjdpv.exe186⤵PID:1532
-
\??\c:\ddjjv.exec:\ddjjv.exe187⤵PID:1056
-
\??\c:\9xrrflf.exec:\9xrrflf.exe188⤵PID:2432
-
\??\c:\bbhtnb.exec:\bbhtnb.exe189⤵PID:2104
-
\??\c:\bbnbnt.exec:\bbnbnt.exe190⤵PID:1780
-
\??\c:\pdjjj.exec:\pdjjj.exe191⤵PID:2136
-
\??\c:\rlffrrl.exec:\rlffrrl.exe192⤵PID:1976
-
\??\c:\lfrrlrf.exec:\lfrrlrf.exe193⤵PID:2248
-
\??\c:\btbttt.exec:\btbttt.exe194⤵PID:1340
-
\??\c:\3dpvv.exec:\3dpvv.exe195⤵PID:2912
-
\??\c:\dpjjd.exec:\dpjjd.exe196⤵PID:1692
-
\??\c:\xrffxfr.exec:\xrffxfr.exe197⤵PID:1112
-
\??\c:\5bthhn.exec:\5bthhn.exe198⤵PID:1628
-
\??\c:\1hbnhb.exec:\1hbnhb.exe199⤵PID:1568
-
\??\c:\jdppv.exec:\jdppv.exe200⤵PID:2312
-
\??\c:\xrxlrxr.exec:\xrxlrxr.exe201⤵PID:1556
-
\??\c:\lxrfxfl.exec:\lxrfxfl.exe202⤵PID:2316
-
\??\c:\1tnbnt.exec:\1tnbnt.exe203⤵PID:2416
-
\??\c:\3vpvd.exec:\3vpvd.exe204⤵PID:2528
-
\??\c:\xllflll.exec:\xllflll.exe205⤵PID:1612
-
\??\c:\lflxflx.exec:\lflxflx.exe206⤵PID:1164
-
\??\c:\thtthh.exec:\thtthh.exe207⤵PID:2768
-
\??\c:\3vdjd.exec:\3vdjd.exe208⤵PID:1716
-
\??\c:\pjddv.exec:\pjddv.exe209⤵PID:2644
-
\??\c:\1xllrxx.exec:\1xllrxx.exe210⤵PID:2552
-
\??\c:\xxxrxrr.exec:\xxxrxrr.exe211⤵PID:2288
-
\??\c:\nhnntt.exec:\nhnntt.exe212⤵PID:2596
-
\??\c:\htnnnn.exec:\htnnnn.exe213⤵PID:2832
-
\??\c:\dpdjp.exec:\dpdjp.exe214⤵PID:2604
-
\??\c:\rlxxlfl.exec:\rlxxlfl.exe215⤵PID:2460
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe216⤵PID:2620
-
\??\c:\9httbb.exec:\9httbb.exe217⤵PID:2780
-
\??\c:\dpppd.exec:\dpppd.exe218⤵PID:2924
-
\??\c:\7jjjv.exec:\7jjjv.exe219⤵PID:2688
-
\??\c:\fxrxllx.exec:\fxrxllx.exe220⤵PID:1624
-
\??\c:\nbtbbn.exec:\nbtbbn.exe221⤵PID:2016
-
\??\c:\dvjpd.exec:\dvjpd.exe222⤵PID:2548
-
\??\c:\pjpjp.exec:\pjpjp.exe223⤵PID:1972
-
\??\c:\rlflrxl.exec:\rlflrxl.exe224⤵PID:2360
-
\??\c:\rrfrxfr.exec:\rrfrxfr.exe225⤵PID:2784
-
\??\c:\nbhhnn.exec:\nbhhnn.exe226⤵PID:2740
-
\??\c:\7pdpd.exec:\7pdpd.exe227⤵PID:1924
-
\??\c:\ddddd.exec:\ddddd.exe228⤵PID:1952
-
\??\c:\5rrfrrl.exec:\5rrfrrl.exe229⤵PID:276
-
\??\c:\hbttnt.exec:\hbttnt.exe230⤵PID:1928
-
\??\c:\hnbbtt.exec:\hnbbtt.exe231⤵PID:1996
-
\??\c:\vppvj.exec:\vppvj.exe232⤵PID:2244
-
\??\c:\fxxlrrx.exec:\fxxlrrx.exe233⤵PID:2328
-
\??\c:\xlflrrx.exec:\xlflrrx.exe234⤵PID:2084
-
\??\c:\thhhbt.exec:\thhhbt.exe235⤵PID:2252
-
\??\c:\7pdjp.exec:\7pdjp.exe236⤵PID:536
-
\??\c:\jjdvp.exec:\jjdvp.exe237⤵PID:2544
-
\??\c:\rrllffr.exec:\rrllffr.exe238⤵PID:556
-
\??\c:\ththnn.exec:\ththnn.exe239⤵PID:664
-
\??\c:\3bbnth.exec:\3bbnth.exe240⤵PID:596
-
\??\c:\3vjjv.exec:\3vjjv.exe241⤵PID:624
-
\??\c:\xrffffl.exec:\xrffffl.exe242⤵PID:1812