Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 05:48
Behavioral task
behavioral1
Sample
21605f73fc3c5ce1211c0903b47a9da0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
21605f73fc3c5ce1211c0903b47a9da0_NeikiAnalytics.exe
-
Size
367KB
-
MD5
21605f73fc3c5ce1211c0903b47a9da0
-
SHA1
c858c4467f4dd038b059f156782b70617ba6f016
-
SHA256
4b591ac061c6eca1a8867f5b30ddde0c06c447c3a97ed1276a4c25a4ad844d54
-
SHA512
cecfb591f5668d1b69ae1656425f7c6854c668540530b880cf4fd3205e3c8d3d519d1524725f9bcbf751d2809aae838e9e93b399156e2843fafdffe558f2c923
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOFltH4tiAlSpgFZAzwdjcIlSpgFZZr3GSM/xK:y4wFHoS3eFplAlSpgFZAKjcIlSpgFZZf
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
Processes:
resource yara_rule behavioral1/memory/2844-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1348-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1940-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/840-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1776-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/736-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1504-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1504-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2348-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-487-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/876-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-705-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1192-750-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-757-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-816-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/784-1021-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1312-1040-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1956-1113-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hbbnhh.exexxlrxxr.exehhbnht.exe3ddvd.exebthnbb.exe9jvjv.exelllrxlx.exe7bntnt.exedjddp.exe7xrllrx.exevvjjv.exefxflxll.exehnbhbt.exelfxrfrx.exenhhtnb.exefffrfrf.exe7jvdp.exexrrrlrl.exehthhbb.exexrxlrrf.exe9bthbb.exe5pjjd.exexrrrxfx.exebnhntb.exejppjv.exennhnbh.exellfrxfr.exelfrxffr.exedvvvd.exe1frxffl.exenhbbtb.exejjjjv.exennhntb.exevpdpd.exe1dpvd.exelxrlrfl.exebbthhn.exevvpjv.exerffxlxx.exebtbbhh.exevvddp.exe7fxlrfl.exebhhhth.exentbhtn.exevpddj.exelrlxllr.exe7fxrlrf.exenhntht.exepdvpd.exejvdvp.exeflfrlrf.exebtnnth.exehtnbnb.exedvjpd.exellrrllx.exehhbhnh.exehhbhtb.exedvjpd.exellflrxl.exerrlrflx.exennnhnh.exe3pjpd.exevppjp.exelrlfrxl.exepid process 1872 hbbnhh.exe 2052 xxlrxxr.exe 3044 hhbnht.exe 2704 3ddvd.exe 2856 bthnbb.exe 2852 9jvjv.exe 2512 lllrxlx.exe 2200 7bntnt.exe 2560 djddp.exe 2952 7xrllrx.exe 2476 vvjjv.exe 2792 fxflxll.exe 2924 hnbhbt.exe 1640 lfxrfrx.exe 1608 nhhtnb.exe 2020 fffrfrf.exe 264 7jvdp.exe 1348 xrrrlrl.exe 1100 hthhbb.exe 2584 xrxlrrf.exe 2044 9bthbb.exe 1940 5pjjd.exe 2872 xrrrxfx.exe 2884 bnhntb.exe 840 jppjv.exe 1776 nnhnbh.exe 1276 llfrxfr.exe 2072 lfrxffr.exe 736 dvvvd.exe 1960 1frxffl.exe 296 nhbbtb.exe 2108 jjjjv.exe 1516 nnhntb.exe 1924 vpdpd.exe 1568 1dpvd.exe 2036 lxrlrfl.exe 2772 bbthhn.exe 3012 vvpjv.exe 2716 rffxlxx.exe 2760 btbbhh.exe 2496 vvddp.exe 1952 7fxlrfl.exe 2624 bhhhth.exe 2492 ntbhtn.exe 2724 vpddj.exe 2416 lrlxllr.exe 2992 7fxrlrf.exe 1804 nhntht.exe 2808 pdvpd.exe 2476 jvdvp.exe 616 flfrlrf.exe 2380 btnnth.exe 1504 htnbnb.exe 1616 dvjpd.exe 1076 llrrllx.exe 1304 hhbhnh.exe 624 hhbhtb.exe 264 dvjpd.exe 1452 llflrxl.exe 2208 rrlrflx.exe 2348 nnnhnh.exe 1756 3pjpd.exe 2044 vppjp.exe 1720 lrlfrxl.exe -
Processes:
resource yara_rule behavioral1/memory/2844-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbbnhh.exe upx behavioral1/memory/1872-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2844-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1872-18-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxlrxxr.exe upx C:\hhbnht.exe upx behavioral1/memory/3044-29-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3ddvd.exe upx C:\bthnbb.exe upx behavioral1/memory/2704-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2852-53-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9jvjv.exe upx C:\lllrxlx.exe upx behavioral1/memory/2512-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2852-62-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7bntnt.exe upx C:\7xrllrx.exe upx behavioral1/memory/2560-84-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\djddp.exe upx C:\vvjjv.exe upx behavioral1/memory/2476-107-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxflxll.exe upx C:\hnbhbt.exe upx behavioral1/memory/2792-116-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfxrfrx.exe upx behavioral1/memory/2924-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1640-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhhtnb.exe upx behavioral1/memory/1640-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1608-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1608-145-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\fffrfrf.exe upx C:\7jvdp.exe upx behavioral1/memory/2020-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/264-162-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrrrlrl.exe upx C:\hthhbb.exe upx behavioral1/memory/1348-172-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrxlrrf.exe upx C:\9bthbb.exe upx behavioral1/memory/2584-189-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5pjjd.exe upx C:\xrrrxfx.exe upx behavioral1/memory/1940-206-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnhntb.exe upx behavioral1/memory/2884-222-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jppjv.exe upx C:\nnhnbh.exe upx behavioral1/memory/840-231-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llfrxfr.exe upx behavioral1/memory/1776-240-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfrxffr.exe upx C:\dvvvd.exe upx behavioral1/memory/736-259-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1frxffl.exe upx C:\nhbbtb.exe upx C:\jjjjv.exe upx behavioral1/memory/1924-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1924-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2036-316-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-323-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-330-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-337-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
21605f73fc3c5ce1211c0903b47a9da0_NeikiAnalytics.exehbbnhh.exexxlrxxr.exehhbnht.exe3ddvd.exebthnbb.exe9jvjv.exelllrxlx.exe7bntnt.exedjddp.exe7xrllrx.exevvjjv.exefxflxll.exehnbhbt.exelfxrfrx.exenhhtnb.exedescription pid process target process PID 2844 wrote to memory of 1872 2844 21605f73fc3c5ce1211c0903b47a9da0_NeikiAnalytics.exe hbbnhh.exe PID 2844 wrote to memory of 1872 2844 21605f73fc3c5ce1211c0903b47a9da0_NeikiAnalytics.exe hbbnhh.exe PID 2844 wrote to memory of 1872 2844 21605f73fc3c5ce1211c0903b47a9da0_NeikiAnalytics.exe hbbnhh.exe PID 2844 wrote to memory of 1872 2844 21605f73fc3c5ce1211c0903b47a9da0_NeikiAnalytics.exe hbbnhh.exe PID 1872 wrote to memory of 2052 1872 hbbnhh.exe xxlrxxr.exe PID 1872 wrote to memory of 2052 1872 hbbnhh.exe xxlrxxr.exe PID 1872 wrote to memory of 2052 1872 hbbnhh.exe xxlrxxr.exe PID 1872 wrote to memory of 2052 1872 hbbnhh.exe xxlrxxr.exe PID 2052 wrote to memory of 3044 2052 xxlrxxr.exe hhbnht.exe PID 2052 wrote to memory of 3044 2052 xxlrxxr.exe hhbnht.exe PID 2052 wrote to memory of 3044 2052 xxlrxxr.exe hhbnht.exe PID 2052 wrote to memory of 3044 2052 xxlrxxr.exe hhbnht.exe PID 3044 wrote to memory of 2704 3044 hhbnht.exe 3ddvd.exe PID 3044 wrote to memory of 2704 3044 hhbnht.exe 3ddvd.exe PID 3044 wrote to memory of 2704 3044 hhbnht.exe 3ddvd.exe PID 3044 wrote to memory of 2704 3044 hhbnht.exe 3ddvd.exe PID 2704 wrote to memory of 2856 2704 3ddvd.exe bthnbb.exe PID 2704 wrote to memory of 2856 2704 3ddvd.exe bthnbb.exe PID 2704 wrote to memory of 2856 2704 3ddvd.exe bthnbb.exe PID 2704 wrote to memory of 2856 2704 3ddvd.exe bthnbb.exe PID 2856 wrote to memory of 2852 2856 bthnbb.exe 9jvjv.exe PID 2856 wrote to memory of 2852 2856 bthnbb.exe 9jvjv.exe PID 2856 wrote to memory of 2852 2856 bthnbb.exe 9jvjv.exe PID 2856 wrote to memory of 2852 2856 bthnbb.exe 9jvjv.exe PID 2852 wrote to memory of 2512 2852 9jvjv.exe lllrxlx.exe PID 2852 wrote to memory of 2512 2852 9jvjv.exe lllrxlx.exe PID 2852 wrote to memory of 2512 2852 9jvjv.exe lllrxlx.exe PID 2852 wrote to memory of 2512 2852 9jvjv.exe lllrxlx.exe PID 2512 wrote to memory of 2200 2512 lllrxlx.exe 7bntnt.exe PID 2512 wrote to memory of 2200 2512 lllrxlx.exe 7bntnt.exe PID 2512 wrote to memory of 2200 2512 lllrxlx.exe 7bntnt.exe PID 2512 wrote to memory of 2200 2512 lllrxlx.exe 7bntnt.exe PID 2200 wrote to memory of 2560 2200 7bntnt.exe djddp.exe PID 2200 wrote to memory of 2560 2200 7bntnt.exe djddp.exe PID 2200 wrote to memory of 2560 2200 7bntnt.exe djddp.exe PID 2200 wrote to memory of 2560 2200 7bntnt.exe djddp.exe PID 2560 wrote to memory of 2952 2560 djddp.exe 7xrllrx.exe PID 2560 wrote to memory of 2952 2560 djddp.exe 7xrllrx.exe PID 2560 wrote to memory of 2952 2560 djddp.exe 7xrllrx.exe PID 2560 wrote to memory of 2952 2560 djddp.exe 7xrllrx.exe PID 2952 wrote to memory of 2476 2952 7xrllrx.exe vvjjv.exe PID 2952 wrote to memory of 2476 2952 7xrllrx.exe vvjjv.exe PID 2952 wrote to memory of 2476 2952 7xrllrx.exe vvjjv.exe PID 2952 wrote to memory of 2476 2952 7xrllrx.exe vvjjv.exe PID 2476 wrote to memory of 2792 2476 vvjjv.exe fxflxll.exe PID 2476 wrote to memory of 2792 2476 vvjjv.exe fxflxll.exe PID 2476 wrote to memory of 2792 2476 vvjjv.exe fxflxll.exe PID 2476 wrote to memory of 2792 2476 vvjjv.exe fxflxll.exe PID 2792 wrote to memory of 2924 2792 fxflxll.exe hnbhbt.exe PID 2792 wrote to memory of 2924 2792 fxflxll.exe hnbhbt.exe PID 2792 wrote to memory of 2924 2792 fxflxll.exe hnbhbt.exe PID 2792 wrote to memory of 2924 2792 fxflxll.exe hnbhbt.exe PID 2924 wrote to memory of 1640 2924 hnbhbt.exe lfxrfrx.exe PID 2924 wrote to memory of 1640 2924 hnbhbt.exe lfxrfrx.exe PID 2924 wrote to memory of 1640 2924 hnbhbt.exe lfxrfrx.exe PID 2924 wrote to memory of 1640 2924 hnbhbt.exe lfxrfrx.exe PID 1640 wrote to memory of 1608 1640 lfxrfrx.exe nhhtnb.exe PID 1640 wrote to memory of 1608 1640 lfxrfrx.exe nhhtnb.exe PID 1640 wrote to memory of 1608 1640 lfxrfrx.exe nhhtnb.exe PID 1640 wrote to memory of 1608 1640 lfxrfrx.exe nhhtnb.exe PID 1608 wrote to memory of 2020 1608 nhhtnb.exe fffrfrf.exe PID 1608 wrote to memory of 2020 1608 nhhtnb.exe fffrfrf.exe PID 1608 wrote to memory of 2020 1608 nhhtnb.exe fffrfrf.exe PID 1608 wrote to memory of 2020 1608 nhhtnb.exe fffrfrf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21605f73fc3c5ce1211c0903b47a9da0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\21605f73fc3c5ce1211c0903b47a9da0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\hbbnhh.exec:\hbbnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\xxlrxxr.exec:\xxlrxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\hhbnht.exec:\hhbnht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\3ddvd.exec:\3ddvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\bthnbb.exec:\bthnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\9jvjv.exec:\9jvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\lllrxlx.exec:\lllrxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\7bntnt.exec:\7bntnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\djddp.exec:\djddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\7xrllrx.exec:\7xrllrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\vvjjv.exec:\vvjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\fxflxll.exec:\fxflxll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\hnbhbt.exec:\hnbhbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\lfxrfrx.exec:\lfxrfrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\nhhtnb.exec:\nhhtnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\fffrfrf.exec:\fffrfrf.exe17⤵
- Executes dropped EXE
PID:2020 -
\??\c:\7jvdp.exec:\7jvdp.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\xrrrlrl.exec:\xrrrlrl.exe19⤵
- Executes dropped EXE
PID:1348 -
\??\c:\hthhbb.exec:\hthhbb.exe20⤵
- Executes dropped EXE
PID:1100 -
\??\c:\xrxlrrf.exec:\xrxlrrf.exe21⤵
- Executes dropped EXE
PID:2584 -
\??\c:\9bthbb.exec:\9bthbb.exe22⤵
- Executes dropped EXE
PID:2044 -
\??\c:\5pjjd.exec:\5pjjd.exe23⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xrrrxfx.exec:\xrrrxfx.exe24⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bnhntb.exec:\bnhntb.exe25⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jppjv.exec:\jppjv.exe26⤵
- Executes dropped EXE
PID:840 -
\??\c:\nnhnbh.exec:\nnhnbh.exe27⤵
- Executes dropped EXE
PID:1776 -
\??\c:\llfrxfr.exec:\llfrxfr.exe28⤵
- Executes dropped EXE
PID:1276 -
\??\c:\lfrxffr.exec:\lfrxffr.exe29⤵
- Executes dropped EXE
PID:2072 -
\??\c:\dvvvd.exec:\dvvvd.exe30⤵
- Executes dropped EXE
PID:736 -
\??\c:\1frxffl.exec:\1frxffl.exe31⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nhbbtb.exec:\nhbbtb.exe32⤵
- Executes dropped EXE
PID:296 -
\??\c:\jjjjv.exec:\jjjjv.exe33⤵
- Executes dropped EXE
PID:2108 -
\??\c:\nnhntb.exec:\nnhntb.exe34⤵
- Executes dropped EXE
PID:1516 -
\??\c:\vpdpd.exec:\vpdpd.exe35⤵
- Executes dropped EXE
PID:1924 -
\??\c:\1dpvd.exec:\1dpvd.exe36⤵
- Executes dropped EXE
PID:1568 -
\??\c:\lxrlrfl.exec:\lxrlrfl.exe37⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bbthhn.exec:\bbthhn.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vvpjv.exec:\vvpjv.exe39⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rffxlxx.exec:\rffxlxx.exe40⤵
- Executes dropped EXE
PID:2716 -
\??\c:\btbbhh.exec:\btbbhh.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vvddp.exec:\vvddp.exe42⤵
- Executes dropped EXE
PID:2496 -
\??\c:\7fxlrfl.exec:\7fxlrfl.exe43⤵
- Executes dropped EXE
PID:1952 -
\??\c:\bhhhth.exec:\bhhhth.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\ntbhtn.exec:\ntbhtn.exe45⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vpddj.exec:\vpddj.exe46⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lrlxllr.exec:\lrlxllr.exe47⤵
- Executes dropped EXE
PID:2416 -
\??\c:\7fxrlrf.exec:\7fxrlrf.exe48⤵
- Executes dropped EXE
PID:2992 -
\??\c:\nhntht.exec:\nhntht.exe49⤵
- Executes dropped EXE
PID:1804 -
\??\c:\pdvpd.exec:\pdvpd.exe50⤵
- Executes dropped EXE
PID:2808 -
\??\c:\jvdvp.exec:\jvdvp.exe51⤵
- Executes dropped EXE
PID:2476 -
\??\c:\flfrlrf.exec:\flfrlrf.exe52⤵
- Executes dropped EXE
PID:616 -
\??\c:\btnnth.exec:\btnnth.exe53⤵
- Executes dropped EXE
PID:2380 -
\??\c:\htnbnb.exec:\htnbnb.exe54⤵
- Executes dropped EXE
PID:1504 -
\??\c:\dvjpd.exec:\dvjpd.exe55⤵
- Executes dropped EXE
PID:1616 -
\??\c:\llrrllx.exec:\llrrllx.exe56⤵
- Executes dropped EXE
PID:1076 -
\??\c:\hhbhnh.exec:\hhbhnh.exe57⤵
- Executes dropped EXE
PID:1304 -
\??\c:\hhbhtb.exec:\hhbhtb.exe58⤵
- Executes dropped EXE
PID:624 -
\??\c:\dvjpd.exec:\dvjpd.exe59⤵
- Executes dropped EXE
PID:264 -
\??\c:\llflrxl.exec:\llflrxl.exe60⤵
- Executes dropped EXE
PID:1452 -
\??\c:\rrlrflx.exec:\rrlrflx.exe61⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nnnhnh.exec:\nnnhnh.exe62⤵
- Executes dropped EXE
PID:2348 -
\??\c:\3pjpd.exec:\3pjpd.exe63⤵
- Executes dropped EXE
PID:1756 -
\??\c:\vppjp.exec:\vppjp.exe64⤵
- Executes dropped EXE
PID:2044 -
\??\c:\lrlfrxl.exec:\lrlfrxl.exe65⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hbntbn.exec:\hbntbn.exe66⤵PID:2876
-
\??\c:\nhttbn.exec:\nhttbn.exe67⤵PID:2528
-
\??\c:\jjjpd.exec:\jjjpd.exe68⤵PID:1416
-
\??\c:\lllxlrf.exec:\lllxlrf.exe69⤵PID:1512
-
\??\c:\9nnbbt.exec:\9nnbbt.exe70⤵PID:1776
-
\??\c:\nbhthh.exec:\nbhthh.exe71⤵PID:1276
-
\??\c:\7pppp.exec:\7pppp.exe72⤵PID:884
-
\??\c:\rrrfflx.exec:\rrrfflx.exe73⤵PID:2120
-
\??\c:\nthttn.exec:\nthttn.exe74⤵PID:1732
-
\??\c:\thbhnn.exec:\thbhnn.exe75⤵PID:1964
-
\??\c:\3jjvd.exec:\3jjvd.exe76⤵PID:296
-
\??\c:\vvjpd.exec:\vvjpd.exe77⤵PID:876
-
\??\c:\xxfxrxx.exec:\xxfxrxx.exe78⤵PID:2892
-
\??\c:\hhbbbh.exec:\hhbbbh.exe79⤵PID:2844
-
\??\c:\9jjvd.exec:\9jjvd.exe80⤵PID:1532
-
\??\c:\3dpvj.exec:\3dpvj.exe81⤵PID:2184
-
\??\c:\rlffxlr.exec:\rlffxlr.exe82⤵PID:2580
-
\??\c:\5bnthh.exec:\5bnthh.exe83⤵PID:2360
-
\??\c:\7djvv.exec:\7djvv.exe84⤵PID:2696
-
\??\c:\3dpvd.exec:\3dpvd.exe85⤵PID:2632
-
\??\c:\5fxrffl.exec:\5fxrffl.exe86⤵PID:2760
-
\??\c:\llflflx.exec:\llflflx.exe87⤵PID:1152
-
\??\c:\bthntb.exec:\bthntb.exe88⤵PID:1952
-
\??\c:\jpjvj.exec:\jpjvj.exe89⤵PID:2500
-
\??\c:\pjvpd.exec:\pjvpd.exe90⤵PID:2520
-
\??\c:\5xllxfr.exec:\5xllxfr.exe91⤵PID:2560
-
\??\c:\tttttb.exec:\tttttb.exe92⤵PID:1540
-
\??\c:\nhttnh.exec:\nhttnh.exe93⤵PID:2956
-
\??\c:\pvpvj.exec:\pvpvj.exe94⤵PID:2820
-
\??\c:\lfxlrfr.exec:\lfxlrfr.exe95⤵PID:2928
-
\??\c:\5hbbnt.exec:\5hbbnt.exe96⤵PID:2144
-
\??\c:\tnbhnn.exec:\tnbhnn.exe97⤵PID:2924
-
\??\c:\dvdjd.exec:\dvdjd.exe98⤵PID:1576
-
\??\c:\3vvjv.exec:\3vvjv.exe99⤵PID:1572
-
\??\c:\rfxffff.exec:\rfxffff.exe100⤵PID:1616
-
\??\c:\1tthhn.exec:\1tthhn.exe101⤵PID:784
-
\??\c:\pjddp.exec:\pjddp.exe102⤵PID:856
-
\??\c:\vvvjv.exec:\vvvjv.exe103⤵PID:756
-
\??\c:\1lffffr.exec:\1lffffr.exe104⤵PID:264
-
\??\c:\rxrfrfx.exec:\rxrfrfx.exe105⤵PID:1192
-
\??\c:\1tnbbn.exec:\1tnbbn.exe106⤵PID:2276
-
\??\c:\jjvpp.exec:\jjvpp.exe107⤵PID:2248
-
\??\c:\ffxxfrr.exec:\ffxxfrr.exe108⤵PID:2088
-
\??\c:\tttnht.exec:\tttnht.exe109⤵PID:2272
-
\??\c:\tthhtb.exec:\tthhtb.exe110⤵PID:2004
-
\??\c:\jjppd.exec:\jjppd.exe111⤵PID:2880
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe112⤵PID:2472
-
\??\c:\7xflrxl.exec:\7xflrxl.exe113⤵PID:1908
-
\??\c:\3hbhtt.exec:\3hbhtt.exe114⤵PID:1500
-
\??\c:\dpdpp.exec:\dpdpp.exe115⤵PID:2840
-
\??\c:\dvpvd.exec:\dvpvd.exe116⤵PID:796
-
\??\c:\7lllxfr.exec:\7lllxfr.exe117⤵PID:884
-
\??\c:\ttthnt.exec:\ttthnt.exe118⤵PID:676
-
\??\c:\bnttbb.exec:\bnttbb.exe119⤵PID:284
-
\??\c:\jdpdj.exec:\jdpdj.exe120⤵PID:1960
-
\??\c:\5frflrf.exec:\5frflrf.exe121⤵PID:296
-
\??\c:\hhbhtt.exec:\hhbhtt.exe122⤵PID:2996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-