Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 22:29
Behavioral task
behavioral1
Sample
10fb5aa4a1fd0af47205251dcaa919d0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
10fb5aa4a1fd0af47205251dcaa919d0_NeikiAnalytics.exe
-
Size
91KB
-
MD5
10fb5aa4a1fd0af47205251dcaa919d0
-
SHA1
895f89235478f31eca8c434a5dd39401c31948a9
-
SHA256
349fdae109278a8dc86464df309b7fce2fcfb8d0ba0b4c01dc0e409daffced02
-
SHA512
a280af0a7ea60db915ec2c19ab1daec058cf5070198d5ec6dfa8d1b82e8f9b0526afdc199e6a6b65e7cf427c585993a88ed8479841b1b080ad5089d3506f020f
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWp3:8hOmTsF93UYfwC6GIout0fmCiiiXA6m5
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2004-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2424-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/296-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1368-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1464-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1464-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1232-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1408-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1460-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1240-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1432-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-562-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-639-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/912-746-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-842-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-853-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-919-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2568-921-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1348-10669-0x0000000077200000-0x000000007731F000-memory.dmp family_blackmoon behavioral1/memory/1348-10946-0x0000000077200000-0x000000007731F000-memory.dmp family_blackmoon behavioral1/memory/1348-19299-0x0000000077200000-0x000000007731F000-memory.dmp family_blackmoon behavioral1/memory/1348-21925-0x0000000077100000-0x00000000771FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1928 xrlrxlx.exe 2972 hbnhnt.exe 2584 jddpj.exe 1964 vpvpj.exe 2624 frffxfl.exe 2532 thhttn.exe 2652 jjvdp.exe 2424 jjdpv.exe 2148 lfxfflf.exe 2464 thtttn.exe 2632 hhbnbh.exe 296 vpdpv.exe 1612 lflxrxx.exe 1912 frxxrfx.exe 2288 nnhnhn.exe 1864 9pjvp.exe 1368 vdjdd.exe 2152 7lrrrxf.exe 1464 hnhhbn.exe 2864 nhtbbh.exe 1232 vdpjv.exe 2116 dvjpp.exe 2064 7rllrlx.exe 684 hbhnth.exe 1408 ttthtb.exe 412 vpvvp.exe 1968 1rflxfl.exe 1460 xfxlrlr.exe 1560 7nbbhh.exe 1240 dvpdv.exe 2756 xlxxxxf.exe 2792 xrlrlrf.exe 1988 nhbbtt.exe 2348 tbtthn.exe 2784 vpddp.exe 1432 dvjjj.exe 320 lfxfrxl.exe 2004 lfxrlxl.exe 1632 tnbtnn.exe 2300 htnntt.exe 2960 vpddj.exe 1268 djjjp.exe 2956 9llxfrf.exe 2544 1btbnn.exe 2096 ttbbhh.exe 2608 vjjpj.exe 2524 ppdpd.exe 2736 llxxrfl.exe 2648 lflrrxl.exe 2444 hbthtt.exe 2424 nhbnbb.exe 2148 9vpdd.exe 2432 dvdjj.exe 2100 rrflxfl.exe 1892 lfrrxfr.exe 2292 nhbhnn.exe 1508 nhbbhn.exe 1896 ddvdp.exe 344 pjjpp.exe 1832 9xxxflr.exe 1948 xxxlxxl.exe 1864 tnbbbh.exe 352 3hnbhh.exe 2160 dvjjp.exe -
resource yara_rule behavioral1/memory/2004-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2004-3-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000b0000000143e5-9.dat upx behavioral1/memory/2004-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000146f4-16.dat upx behavioral1/memory/1928-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2972-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2972-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001487f-25.dat upx behavioral1/memory/2584-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014a9a-34.dat upx behavioral1/memory/2584-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1964-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1964-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014b18-43.dat upx behavioral1/files/0x0009000000014b4c-51.dat upx behavioral1/memory/2624-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2532-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000014bbc-60.dat upx behavioral1/memory/2652-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015ccd-68.dat upx behavioral1/memory/2424-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cd9-75.dat upx behavioral1/files/0x0006000000015ce3-83.dat upx behavioral1/files/0x0006000000015cff-90.dat upx behavioral1/memory/2464-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d20-99.dat upx behavioral1/files/0x0006000000015d42-109.dat upx behavioral1/memory/1612-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/296-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d4e-116.dat upx behavioral1/files/0x0006000000015d56-123.dat upx behavioral1/memory/2288-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d5f-131.dat upx behavioral1/files/0x0006000000015d6b-138.dat upx behavioral1/memory/1864-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1368-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d7f-147.dat upx behavioral1/files/0x0006000000015d87-154.dat upx behavioral1/memory/1464-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d93-162.dat upx behavioral1/memory/1464-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015e32-171.dat upx behavioral1/memory/2864-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1232-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1232-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015ecc-181.dat upx behavioral1/files/0x0006000000015f65-188.dat upx behavioral1/memory/2116-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015fe5-196.dat upx behavioral1/files/0x000600000001610f-203.dat upx behavioral1/files/0x000600000001621e-211.dat upx behavioral1/memory/1408-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001630a-218.dat upx behavioral1/memory/1968-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000164aa-226.dat upx behavioral1/files/0x000600000001658a-234.dat upx behavioral1/memory/1460-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016616-241.dat upx behavioral1/memory/1240-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016851-249.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2004 wrote to memory of 1928 2004 10fb5aa4a1fd0af47205251dcaa919d0_NeikiAnalytics.exe 28 PID 2004 wrote to memory of 1928 2004 10fb5aa4a1fd0af47205251dcaa919d0_NeikiAnalytics.exe 28 PID 2004 wrote to memory of 1928 2004 10fb5aa4a1fd0af47205251dcaa919d0_NeikiAnalytics.exe 28 PID 2004 wrote to memory of 1928 2004 10fb5aa4a1fd0af47205251dcaa919d0_NeikiAnalytics.exe 28 PID 1928 wrote to memory of 2972 1928 xrlrxlx.exe 29 PID 1928 wrote to memory of 2972 1928 xrlrxlx.exe 29 PID 1928 wrote to memory of 2972 1928 xrlrxlx.exe 29 PID 1928 wrote to memory of 2972 1928 xrlrxlx.exe 29 PID 2972 wrote to memory of 2584 2972 hbnhnt.exe 30 PID 2972 wrote to memory of 2584 2972 hbnhnt.exe 30 PID 2972 wrote to memory of 2584 2972 hbnhnt.exe 30 PID 2972 wrote to memory of 2584 2972 hbnhnt.exe 30 PID 2584 wrote to memory of 1964 2584 jddpj.exe 31 PID 2584 wrote to memory of 1964 2584 jddpj.exe 31 PID 2584 wrote to memory of 1964 2584 jddpj.exe 31 PID 2584 wrote to memory of 1964 2584 jddpj.exe 31 PID 1964 wrote to memory of 2624 1964 vpvpj.exe 32 PID 1964 wrote to memory of 2624 1964 vpvpj.exe 32 PID 1964 wrote to memory of 2624 1964 vpvpj.exe 32 PID 1964 wrote to memory of 2624 1964 vpvpj.exe 32 PID 2624 wrote to memory of 2532 2624 frffxfl.exe 33 PID 2624 wrote to memory of 2532 2624 frffxfl.exe 33 PID 2624 wrote to memory of 2532 2624 frffxfl.exe 33 PID 2624 wrote to memory of 2532 2624 frffxfl.exe 33 PID 2532 wrote to memory of 2652 2532 thhttn.exe 34 PID 2532 wrote to memory of 2652 2532 thhttn.exe 34 PID 2532 wrote to memory of 2652 2532 thhttn.exe 34 PID 2532 wrote to memory of 2652 2532 thhttn.exe 34 PID 2652 wrote to memory of 2424 2652 jjvdp.exe 35 PID 2652 wrote to memory of 2424 2652 jjvdp.exe 35 PID 2652 wrote to memory of 2424 2652 jjvdp.exe 35 PID 2652 wrote to memory of 2424 2652 jjvdp.exe 35 PID 2424 wrote to memory of 2148 2424 jjdpv.exe 36 PID 2424 wrote to memory of 2148 2424 jjdpv.exe 36 PID 2424 wrote to memory of 2148 2424 jjdpv.exe 36 PID 2424 wrote to memory of 2148 2424 jjdpv.exe 36 PID 2148 wrote to memory of 2464 2148 lfxfflf.exe 37 PID 2148 wrote to memory of 2464 2148 lfxfflf.exe 37 PID 2148 wrote to memory of 2464 2148 lfxfflf.exe 37 PID 2148 wrote to memory of 2464 2148 lfxfflf.exe 37 PID 2464 wrote to memory of 2632 2464 thtttn.exe 38 PID 2464 wrote to memory of 2632 2464 thtttn.exe 38 PID 2464 wrote to memory of 2632 2464 thtttn.exe 38 PID 2464 wrote to memory of 2632 2464 thtttn.exe 38 PID 2632 wrote to memory of 296 2632 hhbnbh.exe 39 PID 2632 wrote to memory of 296 2632 hhbnbh.exe 39 PID 2632 wrote to memory of 296 2632 hhbnbh.exe 39 PID 2632 wrote to memory of 296 2632 hhbnbh.exe 39 PID 296 wrote to memory of 1612 296 vpdpv.exe 40 PID 296 wrote to memory of 1612 296 vpdpv.exe 40 PID 296 wrote to memory of 1612 296 vpdpv.exe 40 PID 296 wrote to memory of 1612 296 vpdpv.exe 40 PID 1612 wrote to memory of 1912 1612 lflxrxx.exe 41 PID 1612 wrote to memory of 1912 1612 lflxrxx.exe 41 PID 1612 wrote to memory of 1912 1612 lflxrxx.exe 41 PID 1612 wrote to memory of 1912 1612 lflxrxx.exe 41 PID 1912 wrote to memory of 2288 1912 frxxrfx.exe 42 PID 1912 wrote to memory of 2288 1912 frxxrfx.exe 42 PID 1912 wrote to memory of 2288 1912 frxxrfx.exe 42 PID 1912 wrote to memory of 2288 1912 frxxrfx.exe 42 PID 2288 wrote to memory of 1864 2288 nnhnhn.exe 43 PID 2288 wrote to memory of 1864 2288 nnhnhn.exe 43 PID 2288 wrote to memory of 1864 2288 nnhnhn.exe 43 PID 2288 wrote to memory of 1864 2288 nnhnhn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\10fb5aa4a1fd0af47205251dcaa919d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\10fb5aa4a1fd0af47205251dcaa919d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\xrlrxlx.exec:\xrlrxlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\hbnhnt.exec:\hbnhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\jddpj.exec:\jddpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\vpvpj.exec:\vpvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\frffxfl.exec:\frffxfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\thhttn.exec:\thhttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jjvdp.exec:\jjvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\jjdpv.exec:\jjdpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\lfxfflf.exec:\lfxfflf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\thtttn.exec:\thtttn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\hhbnbh.exec:\hhbnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\vpdpv.exec:\vpdpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
\??\c:\lflxrxx.exec:\lflxrxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\frxxrfx.exec:\frxxrfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\nnhnhn.exec:\nnhnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\9pjvp.exec:\9pjvp.exe17⤵
- Executes dropped EXE
PID:1864 -
\??\c:\vdjdd.exec:\vdjdd.exe18⤵
- Executes dropped EXE
PID:1368 -
\??\c:\7lrrrxf.exec:\7lrrrxf.exe19⤵
- Executes dropped EXE
PID:2152 -
\??\c:\hnhhbn.exec:\hnhhbn.exe20⤵
- Executes dropped EXE
PID:1464 -
\??\c:\nhtbbh.exec:\nhtbbh.exe21⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vdpjv.exec:\vdpjv.exe22⤵
- Executes dropped EXE
PID:1232 -
\??\c:\dvjpp.exec:\dvjpp.exe23⤵
- Executes dropped EXE
PID:2116 -
\??\c:\7rllrlx.exec:\7rllrlx.exe24⤵
- Executes dropped EXE
PID:2064 -
\??\c:\hbhnth.exec:\hbhnth.exe25⤵
- Executes dropped EXE
PID:684 -
\??\c:\ttthtb.exec:\ttthtb.exe26⤵
- Executes dropped EXE
PID:1408 -
\??\c:\vpvvp.exec:\vpvvp.exe27⤵
- Executes dropped EXE
PID:412 -
\??\c:\1rflxfl.exec:\1rflxfl.exe28⤵
- Executes dropped EXE
PID:1968 -
\??\c:\xfxlrlr.exec:\xfxlrlr.exe29⤵
- Executes dropped EXE
PID:1460 -
\??\c:\7nbbhh.exec:\7nbbhh.exe30⤵
- Executes dropped EXE
PID:1560 -
\??\c:\dvpdv.exec:\dvpdv.exe31⤵
- Executes dropped EXE
PID:1240 -
\??\c:\xlxxxxf.exec:\xlxxxxf.exe32⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xrlrlrf.exec:\xrlrlrf.exe33⤵
- Executes dropped EXE
PID:2792 -
\??\c:\nhbbtt.exec:\nhbbtt.exe34⤵
- Executes dropped EXE
PID:1988 -
\??\c:\tbtthn.exec:\tbtthn.exe35⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vpddp.exec:\vpddp.exe36⤵
- Executes dropped EXE
PID:2784 -
\??\c:\dvjjj.exec:\dvjjj.exe37⤵
- Executes dropped EXE
PID:1432 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe38⤵
- Executes dropped EXE
PID:320 -
\??\c:\lfxrlxl.exec:\lfxrlxl.exe39⤵
- Executes dropped EXE
PID:2004 -
\??\c:\tnbtnn.exec:\tnbtnn.exe40⤵
- Executes dropped EXE
PID:1632 -
\??\c:\htnntt.exec:\htnntt.exe41⤵
- Executes dropped EXE
PID:2300 -
\??\c:\vpddj.exec:\vpddj.exe42⤵
- Executes dropped EXE
PID:2960 -
\??\c:\djjjp.exec:\djjjp.exe43⤵
- Executes dropped EXE
PID:1268 -
\??\c:\9llxfrf.exec:\9llxfrf.exe44⤵
- Executes dropped EXE
PID:2956 -
\??\c:\1btbnn.exec:\1btbnn.exe45⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ttbbhh.exec:\ttbbhh.exe46⤵
- Executes dropped EXE
PID:2096 -
\??\c:\vjjpj.exec:\vjjpj.exe47⤵
- Executes dropped EXE
PID:2608 -
\??\c:\ppdpd.exec:\ppdpd.exe48⤵
- Executes dropped EXE
PID:2524 -
\??\c:\llxxrfl.exec:\llxxrfl.exe49⤵
- Executes dropped EXE
PID:2736 -
\??\c:\lflrrxl.exec:\lflrrxl.exe50⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hbthtt.exec:\hbthtt.exe51⤵
- Executes dropped EXE
PID:2444 -
\??\c:\nhbnbb.exec:\nhbnbb.exe52⤵
- Executes dropped EXE
PID:2424 -
\??\c:\9vpdd.exec:\9vpdd.exe53⤵
- Executes dropped EXE
PID:2148 -
\??\c:\dvdjj.exec:\dvdjj.exe54⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rrflxfl.exec:\rrflxfl.exe55⤵
- Executes dropped EXE
PID:2100 -
\??\c:\lfrrxfr.exec:\lfrrxfr.exe56⤵
- Executes dropped EXE
PID:1892 -
\??\c:\nhbhnn.exec:\nhbhnn.exe57⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nhbbhn.exec:\nhbbhn.exe58⤵
- Executes dropped EXE
PID:1508 -
\??\c:\ddvdp.exec:\ddvdp.exe59⤵
- Executes dropped EXE
PID:1896 -
\??\c:\pjjpp.exec:\pjjpp.exe60⤵
- Executes dropped EXE
PID:344 -
\??\c:\9xxxflr.exec:\9xxxflr.exe61⤵
- Executes dropped EXE
PID:1832 -
\??\c:\xxxlxxl.exec:\xxxlxxl.exe62⤵
- Executes dropped EXE
PID:1948 -
\??\c:\tnbbbh.exec:\tnbbbh.exe63⤵
- Executes dropped EXE
PID:1864 -
\??\c:\3hnbhh.exec:\3hnbhh.exe64⤵
- Executes dropped EXE
PID:352 -
\??\c:\dvjjp.exec:\dvjjp.exe65⤵
- Executes dropped EXE
PID:2160 -
\??\c:\vpjpp.exec:\vpjpp.exe66⤵PID:1436
-
\??\c:\vpvpp.exec:\vpvpp.exe67⤵PID:2676
-
\??\c:\5xrflxf.exec:\5xrflxf.exe68⤵PID:2796
-
\??\c:\7bnntt.exec:\7bnntt.exe69⤵PID:2692
-
\??\c:\nnnbbb.exec:\nnnbbb.exe70⤵PID:2496
-
\??\c:\dppvd.exec:\dppvd.exe71⤵PID:680
-
\??\c:\vpjpv.exec:\vpjpv.exe72⤵PID:944
-
\??\c:\rflrxrx.exec:\rflrxrx.exe73⤵PID:588
-
\??\c:\fxlrrxf.exec:\fxlrrxf.exe74⤵PID:684
-
\??\c:\9btntt.exec:\9btntt.exe75⤵PID:1404
-
\??\c:\tnnntb.exec:\tnnntb.exe76⤵PID:1780
-
\??\c:\ppvjj.exec:\ppvjj.exe77⤵PID:1668
-
\??\c:\ppjjv.exec:\ppjjv.exe78⤵PID:952
-
\??\c:\rrrrxlf.exec:\rrrrxlf.exe79⤵PID:772
-
\??\c:\7flrxxl.exec:\7flrxxl.exe80⤵PID:1536
-
\??\c:\thnnbt.exec:\thnnbt.exe81⤵PID:1576
-
\??\c:\ttntht.exec:\ttntht.exe82⤵PID:1532
-
\??\c:\dvdvp.exec:\dvdvp.exe83⤵PID:2924
-
\??\c:\3vvjp.exec:\3vvjp.exe84⤵PID:2728
-
\??\c:\xxlrfxf.exec:\xxlrfxf.exe85⤵PID:2792
-
\??\c:\btttht.exec:\btttht.exe86⤵PID:1732
-
\??\c:\bntbhh.exec:\bntbhh.exe87⤵PID:2264
-
\??\c:\dvpdj.exec:\dvpdj.exe88⤵PID:1428
-
\??\c:\pdpvv.exec:\pdpvv.exe89⤵PID:2804
-
\??\c:\1dvdd.exec:\1dvdd.exe90⤵PID:1712
-
\??\c:\5xrxfxx.exec:\5xrxfxx.exe91⤵PID:1520
-
\??\c:\nnhbbt.exec:\nnhbbt.exe92⤵PID:1524
-
\??\c:\nbntnn.exec:\nbntnn.exe93⤵PID:3068
-
\??\c:\vvjdj.exec:\vvjdj.exe94⤵PID:1260
-
\??\c:\3vvjp.exec:\3vvjp.exe95⤵PID:2028
-
\??\c:\fxflllr.exec:\fxflllr.exe96⤵PID:2540
-
\??\c:\xffffrx.exec:\xffffrx.exe97⤵PID:2600
-
\??\c:\bbbnnt.exec:\bbbnnt.exe98⤵PID:1964
-
\??\c:\jdjdj.exec:\jdjdj.exe99⤵PID:2560
-
\??\c:\ppdpv.exec:\ppdpv.exe100⤵PID:2688
-
\??\c:\rrlxlrx.exec:\rrlxlrx.exe101⤵PID:2104
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe102⤵PID:2656
-
\??\c:\tbnbnh.exec:\tbnbnh.exe103⤵PID:2428
-
\??\c:\hhbhtn.exec:\hhbhtn.exe104⤵PID:2520
-
\??\c:\jdvvd.exec:\jdvvd.exe105⤵PID:2832
-
\??\c:\3vpjv.exec:\3vpjv.exe106⤵PID:2452
-
\??\c:\7xxfrfr.exec:\7xxfrfr.exe107⤵PID:2100
-
\??\c:\bbbnth.exec:\bbbnth.exe108⤵PID:1940
-
\??\c:\ttbnht.exec:\ttbnht.exe109⤵PID:804
-
\??\c:\jdvdp.exec:\jdvdp.exe110⤵PID:1888
-
\??\c:\pvpdd.exec:\pvpdd.exe111⤵PID:1896
-
\??\c:\xlfflfr.exec:\xlfflfr.exe112⤵PID:344
-
\??\c:\3hbnnn.exec:\3hbnnn.exe113⤵PID:1700
-
\??\c:\hbnbhn.exec:\hbnbhn.exe114⤵PID:1948
-
\??\c:\pvvvp.exec:\pvvvp.exe115⤵PID:1588
-
\??\c:\pvvjd.exec:\pvvjd.exe116⤵PID:352
-
\??\c:\lfxflll.exec:\lfxflll.exe117⤵PID:1564
-
\??\c:\xrlrxff.exec:\xrlrxff.exe118⤵PID:1436
-
\??\c:\1nnttn.exec:\1nnttn.exe119⤵PID:2580
-
\??\c:\tthnbn.exec:\tthnbn.exe120⤵PID:2440
-
\??\c:\pjddp.exec:\pjddp.exe121⤵PID:2868
-
\??\c:\vjvdp.exec:\vjvdp.exe122⤵PID:2116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-