Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 05:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9bbe85413287cb6d1e2e020bd81ea50_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b9bbe85413287cb6d1e2e020bd81ea50_NeikiAnalytics.exe
-
Size
487KB
-
MD5
b9bbe85413287cb6d1e2e020bd81ea50
-
SHA1
a59abfde525ada15999edb3cd7bde72a3ca8cf7c
-
SHA256
e4df639d014862674de44cec137d91bc785bdc061d5c2a7dcd3ce8c82da6e833
-
SHA512
8dbf912ce5125712bb0c712a0a543ba0d9f01bef147cc5156bc032bafea50c9a0d0a3198a49a80633e9e1bb574ceca26f9bbc746674cc7c89c0c7f89898d2bb5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwu1b26X1wjdgyPPB1:q7Tc2NYHUrAwqzQ7PPD
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
Processes:
resource yara_rule behavioral1/memory/1956-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-53-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2688-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/672-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-621-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2560-632-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1936-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-933-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2104-1042-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/788-1061-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-1249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-1367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
btnhhh.exexrlxllx.exevvjdp.exejjdvp.exehbhnhh.exeddjvj.exe7htntb.exevvvjp.exelllrxll.exe3jjvd.exelxxfllf.exebtbhbt.exe1xxlrrf.exenbnhnb.exejddjj.exerfxllrx.exejddjd.exe1lxfrxr.exe3bthth.exerfrlxll.exehthntn.exeppdpd.exethhbbb.exepjvvv.exetnbbhh.exellxxfxf.exeppppj.exetnhbnt.exe3dppd.exexlxrxxx.exetththn.exevvjvp.exe5xlrfxx.exebbnbbh.exepjdpj.exevpjjp.exexrrxlrl.exebttbnt.exe1tttbb.exejdvdj.exe5rxlrxl.exefxlrlxx.exe3bttbn.exejddpp.exexrrlxll.exexfxfxll.exenhnhbb.exeddpvd.exe7pjpj.exeffxlflx.exehbthnt.exethbnnh.exe5vpvj.exelllxrfr.exe9ntntn.exe3nnbht.exe7pjjj.exerrrfxlf.exelfrrxfr.exebbbbnb.exevdddv.exe1lxfflr.exe5xfflrf.exe1bbnhn.exepid process 1956 btnhhh.exe 2932 xrlxllx.exe 3048 vvjdp.exe 2784 jjdvp.exe 2636 hbhnhh.exe 2688 ddjvj.exe 2596 7htntb.exe 2600 vvvjp.exe 2452 lllrxll.exe 2788 3jjvd.exe 2608 lxxfllf.exe 2148 btbhbt.exe 1516 1xxlrrf.exe 2620 nbnhnb.exe 2160 jddjj.exe 2424 rfxllrx.exe 1408 jddjd.exe 2276 1lxfrxr.exe 1584 3bthth.exe 2292 rfrlxll.exe 1552 hthntn.exe 1876 ppdpd.exe 1100 thhbbb.exe 1976 pjvvv.exe 532 tnbbhh.exe 2028 llxxfxf.exe 2852 ppppj.exe 2000 tnhbnt.exe 1216 3dppd.exe 2984 xlxrxxx.exe 2216 tththn.exe 2352 vvjvp.exe 2360 5xlrfxx.exe 1612 bbnbbh.exe 2520 pjdpj.exe 1624 vpjjp.exe 3028 xrrxlrl.exe 2280 bttbnt.exe 2584 1tttbb.exe 2628 jdvdj.exe 2592 5rxlrxl.exe 2444 fxlrlxx.exe 2624 3bttbn.exe 2572 jddpp.exe 2460 xrrlxll.exe 2508 xfxfxll.exe 2452 nhnhbb.exe 2232 ddpvd.exe 1616 7pjpj.exe 2524 ffxlflx.exe 3040 hbthnt.exe 1652 thbnnh.exe 1472 5vpvj.exe 2820 lllxrfr.exe 2816 9ntntn.exe 2836 3nnbht.exe 2288 7pjjj.exe 672 rrrfxlf.exe 2252 lfrrxfr.exe 1952 bbbbnb.exe 1868 vdddv.exe 1728 1lxfflr.exe 580 5xfflrf.exe 1048 1bbnhn.exe -
Processes:
resource yara_rule behavioral1/memory/1660-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-621-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2484-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-769-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-809-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-920-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-933-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2460-934-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-1003-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-1042-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-1061-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-1081-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-1112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-1125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-1218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-1249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-1304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/392-1335-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b9bbe85413287cb6d1e2e020bd81ea50_NeikiAnalytics.exebtnhhh.exexrlxllx.exevvjdp.exejjdvp.exehbhnhh.exeddjvj.exe7htntb.exevvvjp.exelllrxll.exe3jjvd.exelxxfllf.exebtbhbt.exe1xxlrrf.exenbnhnb.exejddjj.exedescription pid process target process PID 1660 wrote to memory of 1956 1660 b9bbe85413287cb6d1e2e020bd81ea50_NeikiAnalytics.exe btnhhh.exe PID 1660 wrote to memory of 1956 1660 b9bbe85413287cb6d1e2e020bd81ea50_NeikiAnalytics.exe btnhhh.exe PID 1660 wrote to memory of 1956 1660 b9bbe85413287cb6d1e2e020bd81ea50_NeikiAnalytics.exe btnhhh.exe PID 1660 wrote to memory of 1956 1660 b9bbe85413287cb6d1e2e020bd81ea50_NeikiAnalytics.exe btnhhh.exe PID 1956 wrote to memory of 2932 1956 btnhhh.exe xrlxllx.exe PID 1956 wrote to memory of 2932 1956 btnhhh.exe xrlxllx.exe PID 1956 wrote to memory of 2932 1956 btnhhh.exe xrlxllx.exe PID 1956 wrote to memory of 2932 1956 btnhhh.exe xrlxllx.exe PID 2932 wrote to memory of 3048 2932 xrlxllx.exe vvjdp.exe PID 2932 wrote to memory of 3048 2932 xrlxllx.exe vvjdp.exe PID 2932 wrote to memory of 3048 2932 xrlxllx.exe vvjdp.exe PID 2932 wrote to memory of 3048 2932 xrlxllx.exe vvjdp.exe PID 3048 wrote to memory of 2784 3048 vvjdp.exe jjdvp.exe PID 3048 wrote to memory of 2784 3048 vvjdp.exe jjdvp.exe PID 3048 wrote to memory of 2784 3048 vvjdp.exe jjdvp.exe PID 3048 wrote to memory of 2784 3048 vvjdp.exe jjdvp.exe PID 2784 wrote to memory of 2636 2784 jjdvp.exe hbhnhh.exe PID 2784 wrote to memory of 2636 2784 jjdvp.exe hbhnhh.exe PID 2784 wrote to memory of 2636 2784 jjdvp.exe hbhnhh.exe PID 2784 wrote to memory of 2636 2784 jjdvp.exe hbhnhh.exe PID 2636 wrote to memory of 2688 2636 hbhnhh.exe ddjvj.exe PID 2636 wrote to memory of 2688 2636 hbhnhh.exe ddjvj.exe PID 2636 wrote to memory of 2688 2636 hbhnhh.exe ddjvj.exe PID 2636 wrote to memory of 2688 2636 hbhnhh.exe ddjvj.exe PID 2688 wrote to memory of 2596 2688 ddjvj.exe 7htntb.exe PID 2688 wrote to memory of 2596 2688 ddjvj.exe 7htntb.exe PID 2688 wrote to memory of 2596 2688 ddjvj.exe 7htntb.exe PID 2688 wrote to memory of 2596 2688 ddjvj.exe 7htntb.exe PID 2596 wrote to memory of 2600 2596 7htntb.exe vvvjp.exe PID 2596 wrote to memory of 2600 2596 7htntb.exe vvvjp.exe PID 2596 wrote to memory of 2600 2596 7htntb.exe vvvjp.exe PID 2596 wrote to memory of 2600 2596 7htntb.exe vvvjp.exe PID 2600 wrote to memory of 2452 2600 vvvjp.exe lllrxll.exe PID 2600 wrote to memory of 2452 2600 vvvjp.exe lllrxll.exe PID 2600 wrote to memory of 2452 2600 vvvjp.exe lllrxll.exe PID 2600 wrote to memory of 2452 2600 vvvjp.exe lllrxll.exe PID 2452 wrote to memory of 2788 2452 lllrxll.exe 3jjvd.exe PID 2452 wrote to memory of 2788 2452 lllrxll.exe 3jjvd.exe PID 2452 wrote to memory of 2788 2452 lllrxll.exe 3jjvd.exe PID 2452 wrote to memory of 2788 2452 lllrxll.exe 3jjvd.exe PID 2788 wrote to memory of 2608 2788 3jjvd.exe lxxfllf.exe PID 2788 wrote to memory of 2608 2788 3jjvd.exe lxxfllf.exe PID 2788 wrote to memory of 2608 2788 3jjvd.exe lxxfllf.exe PID 2788 wrote to memory of 2608 2788 3jjvd.exe lxxfllf.exe PID 2608 wrote to memory of 2148 2608 lxxfllf.exe btbhbt.exe PID 2608 wrote to memory of 2148 2608 lxxfllf.exe btbhbt.exe PID 2608 wrote to memory of 2148 2608 lxxfllf.exe btbhbt.exe PID 2608 wrote to memory of 2148 2608 lxxfllf.exe btbhbt.exe PID 2148 wrote to memory of 1516 2148 btbhbt.exe 1xxlrrf.exe PID 2148 wrote to memory of 1516 2148 btbhbt.exe 1xxlrrf.exe PID 2148 wrote to memory of 1516 2148 btbhbt.exe 1xxlrrf.exe PID 2148 wrote to memory of 1516 2148 btbhbt.exe 1xxlrrf.exe PID 1516 wrote to memory of 2620 1516 1xxlrrf.exe nbnhnb.exe PID 1516 wrote to memory of 2620 1516 1xxlrrf.exe nbnhnb.exe PID 1516 wrote to memory of 2620 1516 1xxlrrf.exe nbnhnb.exe PID 1516 wrote to memory of 2620 1516 1xxlrrf.exe nbnhnb.exe PID 2620 wrote to memory of 2160 2620 nbnhnb.exe jddjj.exe PID 2620 wrote to memory of 2160 2620 nbnhnb.exe jddjj.exe PID 2620 wrote to memory of 2160 2620 nbnhnb.exe jddjj.exe PID 2620 wrote to memory of 2160 2620 nbnhnb.exe jddjj.exe PID 2160 wrote to memory of 2424 2160 jddjj.exe rfxllrx.exe PID 2160 wrote to memory of 2424 2160 jddjj.exe rfxllrx.exe PID 2160 wrote to memory of 2424 2160 jddjj.exe rfxllrx.exe PID 2160 wrote to memory of 2424 2160 jddjj.exe rfxllrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9bbe85413287cb6d1e2e020bd81ea50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b9bbe85413287cb6d1e2e020bd81ea50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\btnhhh.exec:\btnhhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\xrlxllx.exec:\xrlxllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\vvjdp.exec:\vvjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\jjdvp.exec:\jjdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\hbhnhh.exec:\hbhnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\ddjvj.exec:\ddjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\7htntb.exec:\7htntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\vvvjp.exec:\vvvjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\lllrxll.exec:\lllrxll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\3jjvd.exec:\3jjvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\lxxfllf.exec:\lxxfllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\btbhbt.exec:\btbhbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\1xxlrrf.exec:\1xxlrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\nbnhnb.exec:\nbnhnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\jddjj.exec:\jddjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\rfxllrx.exec:\rfxllrx.exe17⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jddjd.exec:\jddjd.exe18⤵
- Executes dropped EXE
PID:1408 -
\??\c:\1lxfrxr.exec:\1lxfrxr.exe19⤵
- Executes dropped EXE
PID:2276 -
\??\c:\3bthth.exec:\3bthth.exe20⤵
- Executes dropped EXE
PID:1584 -
\??\c:\rfrlxll.exec:\rfrlxll.exe21⤵
- Executes dropped EXE
PID:2292 -
\??\c:\hthntn.exec:\hthntn.exe22⤵
- Executes dropped EXE
PID:1552 -
\??\c:\ppdpd.exec:\ppdpd.exe23⤵
- Executes dropped EXE
PID:1876 -
\??\c:\thhbbb.exec:\thhbbb.exe24⤵
- Executes dropped EXE
PID:1100 -
\??\c:\pjvvv.exec:\pjvvv.exe25⤵
- Executes dropped EXE
PID:1976 -
\??\c:\tnbbhh.exec:\tnbbhh.exe26⤵
- Executes dropped EXE
PID:532 -
\??\c:\llxxfxf.exec:\llxxfxf.exe27⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ppppj.exec:\ppppj.exe28⤵
- Executes dropped EXE
PID:2852 -
\??\c:\tnhbnt.exec:\tnhbnt.exe29⤵
- Executes dropped EXE
PID:2000 -
\??\c:\3dppd.exec:\3dppd.exe30⤵
- Executes dropped EXE
PID:1216 -
\??\c:\xlxrxxx.exec:\xlxrxxx.exe31⤵
- Executes dropped EXE
PID:2984 -
\??\c:\tththn.exec:\tththn.exe32⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vvjvp.exec:\vvjvp.exe33⤵
- Executes dropped EXE
PID:2352 -
\??\c:\5xlrfxx.exec:\5xlrfxx.exe34⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bbnbbh.exec:\bbnbbh.exe35⤵
- Executes dropped EXE
PID:1612 -
\??\c:\pjdpj.exec:\pjdpj.exe36⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vpjjp.exec:\vpjjp.exe37⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xrrxlrl.exec:\xrrxlrl.exe38⤵
- Executes dropped EXE
PID:3028 -
\??\c:\bttbnt.exec:\bttbnt.exe39⤵
- Executes dropped EXE
PID:2280 -
\??\c:\1tttbb.exec:\1tttbb.exe40⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jdvdj.exec:\jdvdj.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\5rxlrxl.exec:\5rxlrxl.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\fxlrlxx.exec:\fxlrlxx.exe43⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3bttbn.exec:\3bttbn.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jddpp.exec:\jddpp.exe45⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xrrlxll.exec:\xrrlxll.exe46⤵
- Executes dropped EXE
PID:2460 -
\??\c:\xfxfxll.exec:\xfxfxll.exe47⤵
- Executes dropped EXE
PID:2508 -
\??\c:\nhnhbb.exec:\nhnhbb.exe48⤵
- Executes dropped EXE
PID:2452 -
\??\c:\ddpvd.exec:\ddpvd.exe49⤵
- Executes dropped EXE
PID:2232 -
\??\c:\7pjpj.exec:\7pjpj.exe50⤵
- Executes dropped EXE
PID:1616 -
\??\c:\ffxlflx.exec:\ffxlflx.exe51⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hbthnt.exec:\hbthnt.exe52⤵
- Executes dropped EXE
PID:3040 -
\??\c:\thbnnh.exec:\thbnnh.exe53⤵
- Executes dropped EXE
PID:1652 -
\??\c:\5vpvj.exec:\5vpvj.exe54⤵
- Executes dropped EXE
PID:1472 -
\??\c:\lllxrfr.exec:\lllxrfr.exe55⤵
- Executes dropped EXE
PID:2820 -
\??\c:\9ntntn.exec:\9ntntn.exe56⤵
- Executes dropped EXE
PID:2816 -
\??\c:\3nnbht.exec:\3nnbht.exe57⤵
- Executes dropped EXE
PID:2836 -
\??\c:\7pjjj.exec:\7pjjj.exe58⤵
- Executes dropped EXE
PID:2288 -
\??\c:\rrrfxlf.exec:\rrrfxlf.exe59⤵
- Executes dropped EXE
PID:672 -
\??\c:\lfrrxfr.exec:\lfrrxfr.exe60⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bbbbnb.exec:\bbbbnb.exe61⤵
- Executes dropped EXE
PID:1952 -
\??\c:\vdddv.exec:\vdddv.exe62⤵
- Executes dropped EXE
PID:1868 -
\??\c:\1lxfflr.exec:\1lxfflr.exe63⤵
- Executes dropped EXE
PID:1728 -
\??\c:\5xfflrf.exec:\5xfflrf.exe64⤵
- Executes dropped EXE
PID:580 -
\??\c:\1bbnhn.exec:\1bbnhn.exe65⤵
- Executes dropped EXE
PID:1048 -
\??\c:\vpdjd.exec:\vpdjd.exe66⤵PID:1648
-
\??\c:\ffxfxfx.exec:\ffxfxfx.exe67⤵PID:1488
-
\??\c:\rxrrflx.exec:\rxrrflx.exe68⤵PID:1996
-
\??\c:\9hnbnb.exec:\9hnbnb.exe69⤵PID:1792
-
\??\c:\pjddp.exec:\pjddp.exe70⤵PID:804
-
\??\c:\9vpvp.exec:\9vpvp.exe71⤵PID:2020
-
\??\c:\5lxlfrx.exec:\5lxlfrx.exe72⤵PID:2852
-
\??\c:\nnnbbh.exec:\nnnbbh.exe73⤵PID:1992
-
\??\c:\jjjvd.exec:\jjjvd.exe74⤵PID:1912
-
\??\c:\ppdjj.exec:\ppdjj.exe75⤵PID:2420
-
\??\c:\xfxrlxl.exec:\xfxrlxl.exe76⤵PID:2300
-
\??\c:\bhnbnb.exec:\bhnbnb.exe77⤵PID:2892
-
\??\c:\vjvvd.exec:\vjvvd.exe78⤵PID:1704
-
\??\c:\jjvpp.exec:\jjvpp.exe79⤵PID:2920
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe80⤵PID:1580
-
\??\c:\tntbnn.exec:\tntbnn.exe81⤵PID:3004
-
\??\c:\5jddv.exec:\5jddv.exe82⤵PID:3020
-
\??\c:\7dpvp.exec:\7dpvp.exe83⤵PID:2376
-
\??\c:\3fllrfl.exec:\3fllrfl.exe84⤵PID:2564
-
\??\c:\nnhtnt.exec:\nnhtnt.exe85⤵PID:1212
-
\??\c:\hbbbhh.exec:\hbbbhh.exe86⤵PID:2648
-
\??\c:\9ppdp.exec:\9ppdp.exe87⤵PID:2560
-
\??\c:\rxfllrl.exec:\rxfllrl.exe88⤵PID:2724
-
\??\c:\bnnbhn.exec:\bnnbhn.exe89⤵PID:2552
-
\??\c:\vddjd.exec:\vddjd.exe90⤵PID:2696
-
\??\c:\fxxxlxx.exec:\fxxxlxx.exe91⤵PID:2500
-
\??\c:\nnbhbt.exec:\nnbhbt.exe92⤵PID:2512
-
\??\c:\1thhnb.exec:\1thhnb.exe93⤵PID:3060
-
\??\c:\djvjp.exec:\djvjp.exe94⤵PID:2484
-
\??\c:\lrffllx.exec:\lrffllx.exe95⤵PID:1936
-
\??\c:\nbnbbh.exec:\nbnbbh.exe96⤵PID:2828
-
\??\c:\hhnhhn.exec:\hhnhhn.exe97⤵PID:1072
-
\??\c:\pjvdp.exec:\pjvdp.exe98⤵PID:2732
-
\??\c:\xrfrxlf.exec:\xrfrxlf.exe99⤵PID:2620
-
\??\c:\llffxfr.exec:\llffxfr.exe100⤵PID:2796
-
\??\c:\bhhbtb.exec:\bhhbtb.exe101⤵PID:2160
-
\??\c:\dpvvp.exec:\dpvvp.exe102⤵PID:2140
-
\??\c:\3lrlxfl.exec:\3lrlxfl.exe103⤵PID:1408
-
\??\c:\xxrxlrl.exec:\xxrxlrl.exe104⤵PID:1784
-
\??\c:\bhhbhh.exec:\bhhbhh.exe105⤵PID:944
-
\??\c:\dpdpv.exec:\dpdpv.exe106⤵PID:1740
-
\??\c:\jjjpv.exec:\jjjpv.exe107⤵PID:1528
-
\??\c:\lrlxrrx.exec:\lrlxrrx.exe108⤵PID:1724
-
\??\c:\3nhnht.exec:\3nhnht.exe109⤵PID:784
-
\??\c:\pdjvv.exec:\pdjvv.exe110⤵PID:1876
-
\??\c:\9pjjp.exec:\9pjjp.exe111⤵PID:1100
-
\??\c:\xxxfrxx.exec:\xxxfrxx.exe112⤵PID:1116
-
\??\c:\httbtb.exec:\httbtb.exe113⤵PID:2400
-
\??\c:\hhhhbh.exec:\hhhhbh.exe114⤵PID:1440
-
\??\c:\7jjjd.exec:\7jjjd.exe115⤵PID:2024
-
\??\c:\ffrxllx.exec:\ffrxllx.exe116⤵PID:2016
-
\??\c:\nnhnht.exec:\nnhnht.exe117⤵PID:976
-
\??\c:\pdpjd.exec:\pdpjd.exe118⤵PID:2896
-
\??\c:\rllrfrf.exec:\rllrfrf.exe119⤵PID:3052
-
\??\c:\llxfrxf.exec:\llxfrxf.exe120⤵PID:2984
-
\??\c:\3bthbn.exec:\3bthbn.exe121⤵PID:2420
-
\??\c:\vpjjp.exec:\vpjjp.exe122⤵PID:2364
-
\??\c:\rfrfxlf.exec:\rfrfxlf.exe123⤵PID:1932
-
\??\c:\hhbthn.exec:\hhbthn.exe124⤵PID:2360
-
\??\c:\7vpdv.exec:\7vpdv.exe125⤵PID:2712
-
\??\c:\frxfrxl.exec:\frxfrxl.exe126⤵PID:2516
-
\??\c:\ffrrxlx.exec:\ffrrxlx.exe127⤵PID:1424
-
\??\c:\9bttnn.exec:\9bttnn.exe128⤵PID:2540
-
\??\c:\ddvdj.exec:\ddvdj.exe129⤵PID:2640
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe130⤵PID:2872
-
\??\c:\rfrxlfr.exec:\rfrxlfr.exe131⤵PID:2644
-
\??\c:\3hhthn.exec:\3hhthn.exe132⤵PID:3024
-
\??\c:\vdjdv.exec:\vdjdv.exe133⤵PID:2464
-
\??\c:\lfxrrrr.exec:\lfxrrrr.exe134⤵PID:2668
-
\??\c:\7rfrffl.exec:\7rfrffl.exe135⤵PID:2448
-
\??\c:\3thhtb.exec:\3thhtb.exe136⤵PID:2460
-
\??\c:\1jddp.exec:\1jddp.exe137⤵PID:2792
-
\??\c:\rfxfrxl.exec:\rfxfrxl.exe138⤵PID:2964
-
\??\c:\rlflflf.exec:\rlflflf.exe139⤵PID:2960
-
\??\c:\hthtbb.exec:\hthtbb.exe140⤵PID:2040
-
\??\c:\pvpdv.exec:\pvpdv.exe141⤵PID:2532
-
\??\c:\7vvvd.exec:\7vvvd.exe142⤵PID:2752
-
\??\c:\fxlxfrx.exec:\fxlxfrx.exe143⤵PID:2612
-
\??\c:\htnnbn.exec:\htnnbn.exe144⤵PID:2800
-
\??\c:\3vvdd.exec:\3vvdd.exe145⤵PID:1948
-
\??\c:\rxrrxxx.exec:\rxrrxxx.exe146⤵PID:2816
-
\??\c:\fxlxrll.exec:\fxlxrll.exe147⤵PID:1404
-
\??\c:\hbthtb.exec:\hbthtb.exe148⤵PID:2060
-
\??\c:\jpjvp.exec:\jpjvp.exe149⤵PID:1784
-
\??\c:\9xxfxfr.exec:\9xxfxfr.exe150⤵PID:1640
-
\??\c:\llrfxfx.exec:\llrfxfx.exe151⤵PID:1740
-
\??\c:\vjdvd.exec:\vjdvd.exe152⤵PID:540
-
\??\c:\pvvdd.exec:\pvvdd.exe153⤵PID:2104
-
\??\c:\rrllxlf.exec:\rrllxlf.exe154⤵PID:1508
-
\??\c:\hnhthh.exec:\hnhthh.exe155⤵PID:584
-
\??\c:\pjpdd.exec:\pjpdd.exe156⤵PID:788
-
\??\c:\llflrxl.exec:\llflrxl.exe157⤵PID:2324
-
\??\c:\nhbhbn.exec:\nhbhbn.exe158⤵PID:1544
-
\??\c:\5bhntb.exec:\5bhntb.exe159⤵PID:1440
-
\??\c:\pvdvv.exec:\pvdvv.exe160⤵PID:2024
-
\??\c:\xfxllff.exec:\xfxllff.exe161⤵PID:2016
-
\??\c:\hntnbb.exec:\hntnbb.exe162⤵PID:884
-
\??\c:\jppvj.exec:\jppvj.exe163⤵PID:312
-
\??\c:\9pjjd.exec:\9pjjd.exe164⤵PID:1236
-
\??\c:\rrllrfr.exec:\rrllrfr.exe165⤵PID:3000
-
\??\c:\bhbnbb.exec:\bhbnbb.exe166⤵PID:1760
-
\??\c:\vdjvj.exec:\vdjvj.exe167⤵PID:1660
-
\??\c:\rxrfrrx.exec:\rxrfrrx.exe168⤵PID:2168
-
\??\c:\thhhhb.exec:\thhhhb.exe169⤵PID:1932
-
\??\c:\tnthnn.exec:\tnthnn.exe170⤵PID:1268
-
\??\c:\pjvdj.exec:\pjvdj.exe171⤵PID:3004
-
\??\c:\fxflllr.exec:\fxflllr.exe172⤵PID:1428
-
\??\c:\bhhtnb.exec:\bhhtnb.exe173⤵PID:1424
-
\??\c:\1httnb.exec:\1httnb.exe174⤵PID:2564
-
\??\c:\7dpvj.exec:\7dpvj.exe175⤵PID:2380
-
\??\c:\rrrrxxl.exec:\rrrrxxl.exe176⤵PID:2872
-
\??\c:\rfxfrrx.exec:\rfxfrrx.exe177⤵PID:2584
-
\??\c:\hthhnn.exec:\hthhnn.exe178⤵PID:2596
-
\??\c:\jvpvj.exec:\jvpvj.exe179⤵PID:2464
-
\??\c:\jjjpv.exec:\jjjpv.exe180⤵PID:2488
-
\??\c:\rlxlffr.exec:\rlxlffr.exe181⤵PID:2652
-
\??\c:\bntbhh.exec:\bntbhh.exe182⤵PID:2460
-
\??\c:\1vddv.exec:\1vddv.exe183⤵PID:3060
-
\??\c:\vpjvv.exec:\vpjvv.exe184⤵PID:1616
-
\??\c:\fxfflrx.exec:\fxfflrx.exe185⤵PID:1936
-
\??\c:\5hnhnh.exec:\5hnhnh.exe186⤵PID:1080
-
\??\c:\dpdpv.exec:\dpdpv.exe187⤵PID:2412
-
\??\c:\vdvdp.exec:\vdvdp.exe188⤵PID:2752
-
\??\c:\xflrllr.exec:\xflrllr.exe189⤵PID:1472
-
\??\c:\7rlrxxl.exec:\7rlrxxl.exe190⤵PID:2952
-
\??\c:\3tbbhn.exec:\3tbbhn.exe191⤵PID:2936
-
\??\c:\dvjjv.exec:\dvjjv.exe192⤵PID:1084
-
\??\c:\lxlrfxx.exec:\lxlrfxx.exe193⤵PID:1408
-
\??\c:\7xrlrll.exec:\7xrlrll.exe194⤵PID:768
-
\??\c:\tthnbh.exec:\tthnbh.exe195⤵PID:2256
-
\??\c:\5djdj.exec:\5djdj.exe196⤵PID:1584
-
\??\c:\1rlxlrf.exec:\1rlxlrf.exe197⤵PID:1528
-
\??\c:\rlxxffx.exec:\rlxxffx.exe198⤵PID:1724
-
\??\c:\btbbhn.exec:\btbbhn.exe199⤵PID:488
-
\??\c:\dvjpp.exec:\dvjpp.exe200⤵PID:392
-
\??\c:\pjppv.exec:\pjppv.exe201⤵PID:1984
-
\??\c:\lxrxffr.exec:\lxrxffr.exe202⤵PID:1812
-
\??\c:\hhttnh.exec:\hhttnh.exe203⤵PID:1152
-
\??\c:\dvpvd.exec:\dvpvd.exe204⤵PID:2028
-
\??\c:\lfllrrf.exec:\lfllrrf.exe205⤵PID:2368
-
\??\c:\1fxxffl.exec:\1fxxffl.exe206⤵PID:960
-
\??\c:\thhthb.exec:\thhthb.exe207⤵PID:984
-
\??\c:\pjpjv.exec:\pjpjv.exe208⤵PID:872
-
\??\c:\llflxxr.exec:\llflxxr.exe209⤵PID:1680
-
\??\c:\rlfxrrf.exec:\rlfxrrf.exe210⤵PID:2900
-
\??\c:\5tntnn.exec:\5tntnn.exe211⤵PID:2980
-
\??\c:\dvvdd.exec:\dvvdd.exe212⤵PID:2904
-
\??\c:\jjpdd.exec:\jjpdd.exe213⤵PID:1716
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe214⤵PID:1660
-
\??\c:\tnbbbb.exec:\tnbbbb.exe215⤵PID:2168
-
\??\c:\tbnttn.exec:\tbnttn.exe216⤵PID:2920
-
\??\c:\jdvdp.exec:\jdvdp.exe217⤵PID:1268
-
\??\c:\lffxffr.exec:\lffxffr.exe218⤵PID:3004
-
\??\c:\nbbttb.exec:\nbbttb.exe219⤵PID:2072
-
\??\c:\9bbntb.exec:\9bbntb.exe220⤵PID:1424
-
\??\c:\7jdjv.exec:\7jdjv.exe221⤵PID:2664
-
\??\c:\tbbntn.exec:\tbbntn.exe222⤵PID:2380
-
\??\c:\nbnnnn.exec:\nbnnnn.exe223⤵PID:2636
-
\??\c:\ddddp.exec:\ddddp.exe224⤵PID:2644
-
\??\c:\5xrfrxl.exec:\5xrfrxl.exe225⤵PID:2472
-
\??\c:\flllxfx.exec:\flllxfx.exe226⤵PID:2480
-
\??\c:\hbtbbh.exec:\hbtbbh.exe227⤵PID:2476
-
\??\c:\7vdjd.exec:\7vdjd.exe228⤵PID:2448
-
\??\c:\7vdjp.exec:\7vdjp.exe229⤵PID:2452
-
\??\c:\rrlrlrl.exec:\rrlrlrl.exe230⤵PID:2964
-
\??\c:\nbnbhb.exec:\nbnbhb.exe231⤵PID:2484
-
\??\c:\dddpj.exec:\dddpj.exe232⤵PID:2040
-
\??\c:\dpdvj.exec:\dpdvj.exe233⤵PID:2720
-
\??\c:\flllffr.exec:\flllffr.exe234⤵PID:2740
-
\??\c:\hhnthh.exec:\hhnthh.exe235⤵PID:2768
-
\??\c:\dvddp.exec:\dvddp.exe236⤵PID:2832
-
\??\c:\vppdj.exec:\vppdj.exe237⤵PID:2916
-
\??\c:\fffllrf.exec:\fffllrf.exe238⤵PID:1920
-
\??\c:\xrlffrx.exec:\xrlffrx.exe239⤵PID:1772
-
\??\c:\5hhntt.exec:\5hhntt.exe240⤵PID:2276
-
\??\c:\dvpjj.exec:\dvpjj.exe241⤵PID:2264
-
\??\c:\jdjvd.exec:\jdjvd.exe242⤵PID:2316