Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 22:15
Behavioral task
behavioral1
Sample
0d24812ff9a62bf9c8ec60ca5392b950_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0d24812ff9a62bf9c8ec60ca5392b950_NeikiAnalytics.exe
-
Size
81KB
-
MD5
0d24812ff9a62bf9c8ec60ca5392b950
-
SHA1
3e41e8a79936cc3eb8c45da06e58575263ded0ea
-
SHA256
406d715393fb856dbebc89556b7aedc1dee79d9d6a843efe59fc7cb4e2168ffa
-
SHA512
f386361e467e5c281340e18cef33052cb22009cf084c0e37f5f0f0ce41d5994ee2e9f923e6cc69d3c680b5a32c7839db43a1f871cf61807a1ac00979632e280b
-
SSDEEP
1536:CvQBeOGtrYS3srx93UBWfwC6Ggnouy8AelS7/7VIQHW:ChOmTsF93UYfwC6GIoutAe07zVIqW
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/3012-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-367-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/2584-397-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1144-515-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/900-528-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2136-662-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-712-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-870-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-1001-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-1321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-1295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-1138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-920-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-795-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-739-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-669-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-561-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/936-470-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1528-432-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-406-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-396-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2660-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1236-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1184-160-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1744-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1184-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1216-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1216 jdjpv.exe 3000 llfxxrl.exe 3012 xlxfxfl.exe 2556 3bbhtn.exe 2716 1nthhh.exe 2752 vvpdv.exe 2632 vpjpd.exe 2620 1lxrlrl.exe 2464 rlrrflx.exe 1184 1bbhbn.exe 2956 5tnnbb.exe 2672 pjjvj.exe 1828 jjvdv.exe 1312 1frlxfl.exe 2340 xxllxrf.exe 2696 xrfxllr.exe 1744 bnhtnh.exe 1556 nnhnbb.exe 2968 pddvd.exe 2296 pppdd.exe 2028 xlfrxfl.exe 540 3xxxxxx.exe 1236 ttthbt.exe 584 7ttthh.exe 1788 pjdvj.exe 1996 jjpjv.exe 1912 lffrfxf.exe 2884 xlfxrrf.exe 2164 tbnnbt.exe 2144 vpjdv.exe 2264 ddvpp.exe 1700 5rrxxff.exe 3052 xrfxfrx.exe 2224 rrfrxfl.exe 2872 tnhbtt.exe 2532 bntthh.exe 2808 bnhhbb.exe 2660 vdvdj.exe 2608 9vpdj.exe 2708 lfxrxlx.exe 2288 llfrllx.exe 2624 tnbnht.exe 2452 hnhhhh.exe 2504 dvvdj.exe 2492 7vdpp.exe 1184 xflrxfx.exe 1652 xrlrxxl.exe 2584 3bnbth.exe 2596 9thnnn.exe 1632 nbtbbh.exe 2588 vvpdj.exe 2768 frffxff.exe 936 flxfllx.exe 1528 bhnbth.exe 1464 tnttnt.exe 2844 jppvv.exe 2116 ppdvj.exe 864 rxfrxrx.exe 1208 rrxlrfr.exe 784 3tnthb.exe 1248 5nhhbh.exe 592 jdvvp.exe 3048 jdpvv.exe 1916 rlrrlrx.exe -
resource yara_rule behavioral1/memory/2380-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0008000000014539-27.dat upx behavioral1/memory/3012-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x00090000000146c0-62.dat upx behavioral1/memory/2464-88-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/files/0x0007000000014abe-91.dat upx behavioral1/memory/1184-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0007000000014af6-99.dat upx behavioral1/files/0x0006000000014b70-117.dat upx behavioral1/files/0x0006000000014ef8-136.dat upx behavioral1/files/0x00060000000155ed-154.dat upx behavioral1/files/0x00060000000155f3-167.dat upx behavioral1/memory/1556-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000015616-193.dat upx behavioral1/files/0x0006000000015626-202.dat upx behavioral1/files/0x0006000000015c83-258.dat upx behavioral1/memory/2144-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-489-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1144-515-0x00000000003C0000-0x00000000003E9000-memory.dmp upx behavioral1/memory/2256-594-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-662-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-712-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-870-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-877-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-1001-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-1046-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-1276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-1321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1112-1355-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-1348-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-1328-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-1314-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-1295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-1269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-1214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-1138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-1089-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1436-1033-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-1020-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-988-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1184-945-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-920-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1120-821-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/576-814-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-795-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-746-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-739-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-732-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-719-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-669-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-601-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-563-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-561-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-554-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-535-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-496-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1464-438-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-432-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-406-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000015cee-293.dat upx behavioral1/memory/2264-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000015cce-284.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 1216 2380 0d24812ff9a62bf9c8ec60ca5392b950_NeikiAnalytics.exe 28 PID 2380 wrote to memory of 1216 2380 0d24812ff9a62bf9c8ec60ca5392b950_NeikiAnalytics.exe 28 PID 2380 wrote to memory of 1216 2380 0d24812ff9a62bf9c8ec60ca5392b950_NeikiAnalytics.exe 28 PID 2380 wrote to memory of 1216 2380 0d24812ff9a62bf9c8ec60ca5392b950_NeikiAnalytics.exe 28 PID 1216 wrote to memory of 3000 1216 jdjpv.exe 29 PID 1216 wrote to memory of 3000 1216 jdjpv.exe 29 PID 1216 wrote to memory of 3000 1216 jdjpv.exe 29 PID 1216 wrote to memory of 3000 1216 jdjpv.exe 29 PID 3000 wrote to memory of 3012 3000 llfxxrl.exe 30 PID 3000 wrote to memory of 3012 3000 llfxxrl.exe 30 PID 3000 wrote to memory of 3012 3000 llfxxrl.exe 30 PID 3000 wrote to memory of 3012 3000 llfxxrl.exe 30 PID 3012 wrote to memory of 2556 3012 xlxfxfl.exe 31 PID 3012 wrote to memory of 2556 3012 xlxfxfl.exe 31 PID 3012 wrote to memory of 2556 3012 xlxfxfl.exe 31 PID 3012 wrote to memory of 2556 3012 xlxfxfl.exe 31 PID 2556 wrote to memory of 2716 2556 3bbhtn.exe 32 PID 2556 wrote to memory of 2716 2556 3bbhtn.exe 32 PID 2556 wrote to memory of 2716 2556 3bbhtn.exe 32 PID 2556 wrote to memory of 2716 2556 3bbhtn.exe 32 PID 2716 wrote to memory of 2752 2716 1nthhh.exe 33 PID 2716 wrote to memory of 2752 2716 1nthhh.exe 33 PID 2716 wrote to memory of 2752 2716 1nthhh.exe 33 PID 2716 wrote to memory of 2752 2716 1nthhh.exe 33 PID 2752 wrote to memory of 2632 2752 vvpdv.exe 34 PID 2752 wrote to memory of 2632 2752 vvpdv.exe 34 PID 2752 wrote to memory of 2632 2752 vvpdv.exe 34 PID 2752 wrote to memory of 2632 2752 vvpdv.exe 34 PID 2632 wrote to memory of 2620 2632 vpjpd.exe 35 PID 2632 wrote to memory of 2620 2632 vpjpd.exe 35 PID 2632 wrote to memory of 2620 2632 vpjpd.exe 35 PID 2632 wrote to memory of 2620 2632 vpjpd.exe 35 PID 2620 wrote to memory of 2464 2620 1lxrlrl.exe 36 PID 2620 wrote to memory of 2464 2620 1lxrlrl.exe 36 PID 2620 wrote to memory of 2464 2620 1lxrlrl.exe 36 PID 2620 wrote to memory of 2464 2620 1lxrlrl.exe 36 PID 2464 wrote to memory of 1184 2464 rlrrflx.exe 37 PID 2464 wrote to memory of 1184 2464 rlrrflx.exe 37 PID 2464 wrote to memory of 1184 2464 rlrrflx.exe 37 PID 2464 wrote to memory of 1184 2464 rlrrflx.exe 37 PID 1184 wrote to memory of 2956 1184 1bbhbn.exe 38 PID 1184 wrote to memory of 2956 1184 1bbhbn.exe 38 PID 1184 wrote to memory of 2956 1184 1bbhbn.exe 38 PID 1184 wrote to memory of 2956 1184 1bbhbn.exe 38 PID 2956 wrote to memory of 2672 2956 5tnnbb.exe 39 PID 2956 wrote to memory of 2672 2956 5tnnbb.exe 39 PID 2956 wrote to memory of 2672 2956 5tnnbb.exe 39 PID 2956 wrote to memory of 2672 2956 5tnnbb.exe 39 PID 2672 wrote to memory of 1828 2672 pjjvj.exe 40 PID 2672 wrote to memory of 1828 2672 pjjvj.exe 40 PID 2672 wrote to memory of 1828 2672 pjjvj.exe 40 PID 2672 wrote to memory of 1828 2672 pjjvj.exe 40 PID 1828 wrote to memory of 1312 1828 jjvdv.exe 41 PID 1828 wrote to memory of 1312 1828 jjvdv.exe 41 PID 1828 wrote to memory of 1312 1828 jjvdv.exe 41 PID 1828 wrote to memory of 1312 1828 jjvdv.exe 41 PID 1312 wrote to memory of 2340 1312 1frlxfl.exe 42 PID 1312 wrote to memory of 2340 1312 1frlxfl.exe 42 PID 1312 wrote to memory of 2340 1312 1frlxfl.exe 42 PID 1312 wrote to memory of 2340 1312 1frlxfl.exe 42 PID 2340 wrote to memory of 2696 2340 xxllxrf.exe 43 PID 2340 wrote to memory of 2696 2340 xxllxrf.exe 43 PID 2340 wrote to memory of 2696 2340 xxllxrf.exe 43 PID 2340 wrote to memory of 2696 2340 xxllxrf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d24812ff9a62bf9c8ec60ca5392b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0d24812ff9a62bf9c8ec60ca5392b950_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\jdjpv.exec:\jdjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\llfxxrl.exec:\llfxxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\xlxfxfl.exec:\xlxfxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\3bbhtn.exec:\3bbhtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\1nthhh.exec:\1nthhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\vvpdv.exec:\vvpdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\vpjpd.exec:\vpjpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\1lxrlrl.exec:\1lxrlrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\rlrrflx.exec:\rlrrflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\1bbhbn.exec:\1bbhbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\5tnnbb.exec:\5tnnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\pjjvj.exec:\pjjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\jjvdv.exec:\jjvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\1frlxfl.exec:\1frlxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\xxllxrf.exec:\xxllxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\xrfxllr.exec:\xrfxllr.exe17⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bnhtnh.exec:\bnhtnh.exe18⤵
- Executes dropped EXE
PID:1744 -
\??\c:\nnhnbb.exec:\nnhnbb.exe19⤵
- Executes dropped EXE
PID:1556 -
\??\c:\pddvd.exec:\pddvd.exe20⤵
- Executes dropped EXE
PID:2968 -
\??\c:\pppdd.exec:\pppdd.exe21⤵
- Executes dropped EXE
PID:2296 -
\??\c:\xlfrxfl.exec:\xlfrxfl.exe22⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3xxxxxx.exec:\3xxxxxx.exe23⤵
- Executes dropped EXE
PID:540 -
\??\c:\ttthbt.exec:\ttthbt.exe24⤵
- Executes dropped EXE
PID:1236 -
\??\c:\7ttthh.exec:\7ttthh.exe25⤵
- Executes dropped EXE
PID:584 -
\??\c:\pjdvj.exec:\pjdvj.exe26⤵
- Executes dropped EXE
PID:1788 -
\??\c:\jjpjv.exec:\jjpjv.exe27⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lffrfxf.exec:\lffrfxf.exe28⤵
- Executes dropped EXE
PID:1912 -
\??\c:\xlfxrrf.exec:\xlfxrrf.exe29⤵
- Executes dropped EXE
PID:2884 -
\??\c:\tbnnbt.exec:\tbnnbt.exe30⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vpjdv.exec:\vpjdv.exe31⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ddvpp.exec:\ddvpp.exe32⤵
- Executes dropped EXE
PID:2264 -
\??\c:\5rrxxff.exec:\5rrxxff.exe33⤵
- Executes dropped EXE
PID:1700 -
\??\c:\xrfxfrx.exec:\xrfxfrx.exe34⤵
- Executes dropped EXE
PID:3052 -
\??\c:\rrfrxfl.exec:\rrfrxfl.exe35⤵
- Executes dropped EXE
PID:2224 -
\??\c:\tnhbtt.exec:\tnhbtt.exe36⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bntthh.exec:\bntthh.exe37⤵
- Executes dropped EXE
PID:2532 -
\??\c:\bnhhbb.exec:\bnhhbb.exe38⤵
- Executes dropped EXE
PID:2808 -
\??\c:\vdvdj.exec:\vdvdj.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\9vpdj.exec:\9vpdj.exe40⤵
- Executes dropped EXE
PID:2608 -
\??\c:\lfxrxlx.exec:\lfxrxlx.exe41⤵
- Executes dropped EXE
PID:2708 -
\??\c:\llfrllx.exec:\llfrllx.exe42⤵
- Executes dropped EXE
PID:2288 -
\??\c:\tnbnht.exec:\tnbnht.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\hnhhhh.exec:\hnhhhh.exe44⤵
- Executes dropped EXE
PID:2452 -
\??\c:\dvvdj.exec:\dvvdj.exe45⤵
- Executes dropped EXE
PID:2504 -
\??\c:\7vdpp.exec:\7vdpp.exe46⤵
- Executes dropped EXE
PID:2492 -
\??\c:\xflrxfx.exec:\xflrxfx.exe47⤵
- Executes dropped EXE
PID:1184 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe48⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3bnbth.exec:\3bnbth.exe49⤵
- Executes dropped EXE
PID:2584 -
\??\c:\9thnnn.exec:\9thnnn.exe50⤵
- Executes dropped EXE
PID:2596 -
\??\c:\nbtbbh.exec:\nbtbbh.exe51⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vvpdj.exec:\vvpdj.exe52⤵
- Executes dropped EXE
PID:2588 -
\??\c:\frffxff.exec:\frffxff.exe53⤵
- Executes dropped EXE
PID:2768 -
\??\c:\flxfllx.exec:\flxfllx.exe54⤵
- Executes dropped EXE
PID:936 -
\??\c:\bhnbth.exec:\bhnbth.exe55⤵
- Executes dropped EXE
PID:1528 -
\??\c:\tnttnt.exec:\tnttnt.exe56⤵
- Executes dropped EXE
PID:1464 -
\??\c:\jppvv.exec:\jppvv.exe57⤵
- Executes dropped EXE
PID:2844 -
\??\c:\ppdvj.exec:\ppdvj.exe58⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rxfrxrx.exec:\rxfrxrx.exe59⤵
- Executes dropped EXE
PID:864 -
\??\c:\rrxlrfr.exec:\rrxlrfr.exe60⤵
- Executes dropped EXE
PID:1208 -
\??\c:\3tnthb.exec:\3tnthb.exe61⤵
- Executes dropped EXE
PID:784 -
\??\c:\5nhhbh.exec:\5nhhbh.exe62⤵
- Executes dropped EXE
PID:1248 -
\??\c:\jdvvp.exec:\jdvvp.exe63⤵
- Executes dropped EXE
PID:592 -
\??\c:\jdpvv.exec:\jdpvv.exe64⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rlrrlrx.exec:\rlrrlrx.exe65⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xlrflfr.exec:\xlrflfr.exe66⤵PID:2788
-
\??\c:\xrfrxxf.exec:\xrfrxxf.exe67⤵PID:1144
-
\??\c:\tbhnhb.exec:\tbhnhb.exe68⤵PID:2232
-
\??\c:\bthntn.exec:\bthntn.exe69⤵PID:900
-
\??\c:\hbbnth.exec:\hbbnth.exe70⤵PID:1956
-
\??\c:\jjjpj.exec:\jjjpj.exe71⤵PID:2376
-
\??\c:\pjpvj.exec:\pjpvj.exe72⤵PID:2408
-
\??\c:\fflffrl.exec:\fflffrl.exe73⤵PID:1748
-
\??\c:\3tntbh.exec:\3tntbh.exe74⤵PID:2992
-
\??\c:\tnhbbn.exec:\tnhbbn.exe75⤵PID:2132
-
\??\c:\pjvdp.exec:\pjvdp.exe76⤵PID:1216
-
\??\c:\vpjjv.exec:\vpjjv.exe77⤵PID:1904
-
\??\c:\vpdpv.exec:\vpdpv.exe78⤵PID:1856
-
\??\c:\lxrlrrf.exec:\lxrlrrf.exe79⤵PID:1692
-
\??\c:\lrxffrl.exec:\lrxffrl.exe80⤵PID:2256
-
\??\c:\hhhttt.exec:\hhhttt.exe81⤵PID:2852
-
\??\c:\ttnbtt.exec:\ttnbtt.exe82⤵PID:2556
-
\??\c:\dddvv.exec:\dddvv.exe83⤵PID:3016
-
\??\c:\pjdjp.exec:\pjdjp.exe84⤵PID:2456
-
\??\c:\pdjvv.exec:\pdjvv.exe85⤵PID:2568
-
\??\c:\lfllrfl.exec:\lfllrfl.exe86⤵PID:3036
-
\??\c:\rxlxfll.exec:\rxlxfll.exe87⤵PID:2632
-
\??\c:\tnntbh.exec:\tnntbh.exe88⤵PID:2508
-
\??\c:\9btbnt.exec:\9btbnt.exe89⤵PID:2652
-
\??\c:\nhttth.exec:\nhttth.exe90⤵PID:2136
-
\??\c:\dvjdj.exec:\dvjdj.exe91⤵PID:1672
-
\??\c:\5pjjp.exec:\5pjjp.exe92⤵PID:2368
-
\??\c:\pjpdp.exec:\pjpdp.exe93⤵PID:1572
-
\??\c:\dpvvj.exec:\dpvvj.exe94⤵PID:892
-
\??\c:\7fxfrrr.exec:\7fxfrrr.exe95⤵PID:1308
-
\??\c:\llxlrxl.exec:\llxlrxl.exe96⤵PID:3032
-
\??\c:\fxxrxxf.exec:\fxxrxxf.exe97⤵PID:2720
-
\??\c:\7hntbt.exec:\7hntbt.exe98⤵PID:2524
-
\??\c:\1nbhhn.exec:\1nbhhn.exe99⤵PID:1524
-
\??\c:\5hbnhh.exec:\5hbnhh.exe100⤵PID:2692
-
\??\c:\jvvdd.exec:\jvvdd.exe101⤵PID:1776
-
\??\c:\pvjpj.exec:\pvjpj.exe102⤵PID:2968
-
\??\c:\dpjpp.exec:\dpjpp.exe103⤵PID:2024
-
\??\c:\1fxfxll.exec:\1fxfxll.exe104⤵PID:1676
-
\??\c:\fxxffff.exec:\fxxffff.exe105⤵PID:2700
-
\??\c:\ffxxrfr.exec:\ffxxrfr.exe106⤵PID:280
-
\??\c:\1hnhhh.exec:\1hnhhh.exe107⤵PID:548
-
\??\c:\nttttn.exec:\nttttn.exe108⤵PID:1424
-
\??\c:\tnhhnt.exec:\tnhhnt.exe109⤵PID:3048
-
\??\c:\ppjvj.exec:\ppjvj.exe110⤵PID:2748
-
\??\c:\djppd.exec:\djppd.exe111⤵PID:1872
-
\??\c:\9pjpd.exec:\9pjpd.exe112⤵PID:2984
-
\??\c:\9rfllrr.exec:\9rfllrr.exe113⤵PID:960
-
\??\c:\rlflxfx.exec:\rlflxfx.exe114⤵PID:900
-
\??\c:\3frxllr.exec:\3frxllr.exe115⤵PID:576
-
\??\c:\bhtnnh.exec:\bhtnnh.exe116⤵PID:1120
-
\??\c:\nnhnnb.exec:\nnhnnb.exe117⤵PID:2408
-
\??\c:\5hbnhh.exec:\5hbnhh.exe118⤵PID:2144
-
\??\c:\vjvvp.exec:\vjvvp.exe119⤵PID:2264
-
\??\c:\vpdjd.exec:\vpdjd.exe120⤵PID:3052
-
\??\c:\dpdvp.exec:\dpdvp.exe121⤵PID:848
-
\??\c:\xxllflf.exec:\xxllflf.exe122⤵PID:1820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-