Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 04:17
Behavioral task
behavioral1
Sample
7a7f48809ec52685607d441572d7d3a0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7a7f48809ec52685607d441572d7d3a0_NeikiAnalytics.exe
-
Size
103KB
-
MD5
7a7f48809ec52685607d441572d7d3a0
-
SHA1
1d459fe86d385434bbe27080c088b9cc889c77b5
-
SHA256
c2a5cbf5883f5c22238d23ed0c6ce02f208cf996247df042a4a67601f1b02523
-
SHA512
eb2628ab15114c0c5c6077c915ac7dc7d463243ade3e74845b77104870e29ab3c4884ce8f3fd3fef1409b3087ff07b8432779848a7e59303bc9b10483d64dc48
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFbUZJjw5Ivov1d3ZdpQm6hx:9hOmTsF93UYfwC6GIoutz5yLpRDN6hx
Malware Config
Signatures
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2904-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1548-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1884-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/356-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1744-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2160-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2076-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/796-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/628-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/628-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/352-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-300-0x0000000076D30000-0x0000000076E4F000-memory.dmp family_blackmoon behavioral1/memory/2900-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1868-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/356-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1744-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-446-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2076-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1216-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1996-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-559-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-568-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-591-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1516-680-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/688-774-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/268-775-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1784-794-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/628-809-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1528-877-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1528-876-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2144-996-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-1016-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-1146-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2420-1196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-1205-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2224 fxllxxl.exe 3060 bhbbnb.exe 2664 pdjjp.exe 2524 fflffxr.exe 2428 nhbhtt.exe 2588 nbbbtn.exe 2672 1jvvd.exe 2512 lxflrrx.exe 2080 1fxflrx.exe 1548 1tbbbt.exe 2460 vjppj.exe 2604 dvdpd.exe 1884 lxrxflx.exe 356 tbhbtn.exe 1744 pjvdj.exe 2160 pdvvv.exe 1796 rrfrrxf.exe 2732 5nnttt.exe 2076 bhbnht.exe 2756 pvpjp.exe 2032 fxlrrxf.exe 3040 xlxxflr.exe 796 9tbbhb.exe 1572 pdjpp.exe 2728 vpdjv.exe 628 xfllfxx.exe 1540 nbhntb.exe 352 1vdjd.exe 3008 ddjdd.exe 2268 rlxffll.exe 2668 3httbh.exe 1028 7pddd.exe 2840 1ddvd.exe 2312 flrrrrr.exe 2900 nbtbhh.exe 2540 jdvvd.exe 2976 lxfxfxx.exe 3060 rffffxl.exe 2960 frxffff.exe 2684 3bttbt.exe 2220 xflffrx.exe 2448 xrflrfx.exe 2436 htbnhb.exe 2672 tbnttt.exe 2720 5vvdj.exe 1868 3pvpp.exe 1852 frfxfxf.exe 2624 rllfrxx.exe 2284 tnbbhh.exe 112 1hbnhh.exe 2492 7jdpj.exe 1580 jjvjp.exe 356 ffrxlfr.exe 1744 lrfxfrr.exe 1604 hhbnbn.exe 2288 tnbhnh.exe 852 ttbhnn.exe 2732 pjvdd.exe 2076 xxflxlf.exe 1992 xrxrrrl.exe 2204 bnhnbb.exe 556 ttthnb.exe 2568 vjvpj.exe 1396 vjjpv.exe -
resource yara_rule behavioral1/memory/2904-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000012253-8.dat upx behavioral1/memory/2224-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2904-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2224-13-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x000a000000014f57-17.dat upx behavioral1/memory/3060-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2224-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015b85-27.dat upx behavioral1/memory/3060-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2664-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015c9a-38.dat upx behavioral1/memory/2524-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015ca8-46.dat upx behavioral1/files/0x0007000000015cb1-55.dat upx behavioral1/files/0x0007000000015cc5-62.dat upx behavioral1/memory/2588-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015ce3-72.dat upx behavioral1/memory/2672-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016122-80.dat upx behavioral1/files/0x00060000000163eb-88.dat upx behavioral1/files/0x00060000000164ec-96.dat upx behavioral1/memory/1548-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016575-105.dat upx behavioral1/memory/2604-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2604-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000167bf-114.dat upx behavioral1/memory/1884-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016a28-124.dat upx behavioral1/files/0x0006000000016c1f-131.dat upx behavioral1/memory/1744-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/356-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c30-143.dat upx behavioral1/memory/1744-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c38-150.dat upx behavioral1/memory/2160-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c84-160.dat upx behavioral1/files/0x0006000000016cb5-167.dat upx behavioral1/files/0x0006000000016ce0-176.dat upx behavioral1/memory/2076-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ced-185.dat upx behavioral1/files/0x0006000000016cf3-193.dat upx behavioral1/memory/3040-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cfd-202.dat upx behavioral1/memory/796-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3040-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d06-213.dat upx behavioral1/files/0x0006000000016d10-221.dat upx behavioral1/files/0x0006000000016d18-229.dat upx behavioral1/memory/628-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d21-239.dat upx behavioral1/memory/628-238-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d29-247.dat upx behavioral1/files/0x0006000000016d31-256.dat upx behavioral1/memory/352-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d81-264.dat upx behavioral1/memory/3008-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2268-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d85-274.dat upx behavioral1/memory/2668-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00340000000158d9-283.dat upx behavioral1/memory/1028-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-292-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2224 2904 7a7f48809ec52685607d441572d7d3a0_NeikiAnalytics.exe 28 PID 2904 wrote to memory of 2224 2904 7a7f48809ec52685607d441572d7d3a0_NeikiAnalytics.exe 28 PID 2904 wrote to memory of 2224 2904 7a7f48809ec52685607d441572d7d3a0_NeikiAnalytics.exe 28 PID 2904 wrote to memory of 2224 2904 7a7f48809ec52685607d441572d7d3a0_NeikiAnalytics.exe 28 PID 2224 wrote to memory of 3060 2224 fxllxxl.exe 29 PID 2224 wrote to memory of 3060 2224 fxllxxl.exe 29 PID 2224 wrote to memory of 3060 2224 fxllxxl.exe 29 PID 2224 wrote to memory of 3060 2224 fxllxxl.exe 29 PID 3060 wrote to memory of 2664 3060 bhbbnb.exe 30 PID 3060 wrote to memory of 2664 3060 bhbbnb.exe 30 PID 3060 wrote to memory of 2664 3060 bhbbnb.exe 30 PID 3060 wrote to memory of 2664 3060 bhbbnb.exe 30 PID 2664 wrote to memory of 2524 2664 pdjjp.exe 31 PID 2664 wrote to memory of 2524 2664 pdjjp.exe 31 PID 2664 wrote to memory of 2524 2664 pdjjp.exe 31 PID 2664 wrote to memory of 2524 2664 pdjjp.exe 31 PID 2524 wrote to memory of 2428 2524 fflffxr.exe 32 PID 2524 wrote to memory of 2428 2524 fflffxr.exe 32 PID 2524 wrote to memory of 2428 2524 fflffxr.exe 32 PID 2524 wrote to memory of 2428 2524 fflffxr.exe 32 PID 2428 wrote to memory of 2588 2428 nhbhtt.exe 33 PID 2428 wrote to memory of 2588 2428 nhbhtt.exe 33 PID 2428 wrote to memory of 2588 2428 nhbhtt.exe 33 PID 2428 wrote to memory of 2588 2428 nhbhtt.exe 33 PID 2588 wrote to memory of 2672 2588 nbbbtn.exe 34 PID 2588 wrote to memory of 2672 2588 nbbbtn.exe 34 PID 2588 wrote to memory of 2672 2588 nbbbtn.exe 34 PID 2588 wrote to memory of 2672 2588 nbbbtn.exe 34 PID 2672 wrote to memory of 2512 2672 1jvvd.exe 35 PID 2672 wrote to memory of 2512 2672 1jvvd.exe 35 PID 2672 wrote to memory of 2512 2672 1jvvd.exe 35 PID 2672 wrote to memory of 2512 2672 1jvvd.exe 35 PID 2512 wrote to memory of 2080 2512 lxflrrx.exe 36 PID 2512 wrote to memory of 2080 2512 lxflrrx.exe 36 PID 2512 wrote to memory of 2080 2512 lxflrrx.exe 36 PID 2512 wrote to memory of 2080 2512 lxflrrx.exe 36 PID 2080 wrote to memory of 1548 2080 1fxflrx.exe 37 PID 2080 wrote to memory of 1548 2080 1fxflrx.exe 37 PID 2080 wrote to memory of 1548 2080 1fxflrx.exe 37 PID 2080 wrote to memory of 1548 2080 1fxflrx.exe 37 PID 1548 wrote to memory of 2460 1548 1tbbbt.exe 38 PID 1548 wrote to memory of 2460 1548 1tbbbt.exe 38 PID 1548 wrote to memory of 2460 1548 1tbbbt.exe 38 PID 1548 wrote to memory of 2460 1548 1tbbbt.exe 38 PID 2460 wrote to memory of 2604 2460 vjppj.exe 39 PID 2460 wrote to memory of 2604 2460 vjppj.exe 39 PID 2460 wrote to memory of 2604 2460 vjppj.exe 39 PID 2460 wrote to memory of 2604 2460 vjppj.exe 39 PID 2604 wrote to memory of 1884 2604 dvdpd.exe 40 PID 2604 wrote to memory of 1884 2604 dvdpd.exe 40 PID 2604 wrote to memory of 1884 2604 dvdpd.exe 40 PID 2604 wrote to memory of 1884 2604 dvdpd.exe 40 PID 1884 wrote to memory of 356 1884 lxrxflx.exe 41 PID 1884 wrote to memory of 356 1884 lxrxflx.exe 41 PID 1884 wrote to memory of 356 1884 lxrxflx.exe 41 PID 1884 wrote to memory of 356 1884 lxrxflx.exe 41 PID 356 wrote to memory of 1744 356 tbhbtn.exe 42 PID 356 wrote to memory of 1744 356 tbhbtn.exe 42 PID 356 wrote to memory of 1744 356 tbhbtn.exe 42 PID 356 wrote to memory of 1744 356 tbhbtn.exe 42 PID 1744 wrote to memory of 2160 1744 pjvdj.exe 43 PID 1744 wrote to memory of 2160 1744 pjvdj.exe 43 PID 1744 wrote to memory of 2160 1744 pjvdj.exe 43 PID 1744 wrote to memory of 2160 1744 pjvdj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a7f48809ec52685607d441572d7d3a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7a7f48809ec52685607d441572d7d3a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\fxllxxl.exec:\fxllxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\bhbbnb.exec:\bhbbnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\pdjjp.exec:\pdjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\fflffxr.exec:\fflffxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\nhbhtt.exec:\nhbhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\nbbbtn.exec:\nbbbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\1jvvd.exec:\1jvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\lxflrrx.exec:\lxflrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\1fxflrx.exec:\1fxflrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\1tbbbt.exec:\1tbbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\vjppj.exec:\vjppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\dvdpd.exec:\dvdpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\lxrxflx.exec:\lxrxflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\tbhbtn.exec:\tbhbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:356 -
\??\c:\pjvdj.exec:\pjvdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\pdvvv.exec:\pdvvv.exe17⤵
- Executes dropped EXE
PID:2160 -
\??\c:\rrfrrxf.exec:\rrfrrxf.exe18⤵
- Executes dropped EXE
PID:1796 -
\??\c:\5nnttt.exec:\5nnttt.exe19⤵
- Executes dropped EXE
PID:2732 -
\??\c:\bhbnht.exec:\bhbnht.exe20⤵
- Executes dropped EXE
PID:2076 -
\??\c:\pvpjp.exec:\pvpjp.exe21⤵
- Executes dropped EXE
PID:2756 -
\??\c:\fxlrrxf.exec:\fxlrrxf.exe22⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xlxxflr.exec:\xlxxflr.exe23⤵
- Executes dropped EXE
PID:3040 -
\??\c:\9tbbhb.exec:\9tbbhb.exe24⤵
- Executes dropped EXE
PID:796 -
\??\c:\pdjpp.exec:\pdjpp.exe25⤵
- Executes dropped EXE
PID:1572 -
\??\c:\vpdjv.exec:\vpdjv.exe26⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xfllfxx.exec:\xfllfxx.exe27⤵
- Executes dropped EXE
PID:628 -
\??\c:\nbhntb.exec:\nbhntb.exe28⤵
- Executes dropped EXE
PID:1540 -
\??\c:\1vdjd.exec:\1vdjd.exe29⤵
- Executes dropped EXE
PID:352 -
\??\c:\ddjdd.exec:\ddjdd.exe30⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rlxffll.exec:\rlxffll.exe31⤵
- Executes dropped EXE
PID:2268 -
\??\c:\3httbh.exec:\3httbh.exe32⤵
- Executes dropped EXE
PID:2668 -
\??\c:\7pddd.exec:\7pddd.exe33⤵
- Executes dropped EXE
PID:1028 -
\??\c:\1ddvd.exec:\1ddvd.exe34⤵
- Executes dropped EXE
PID:2840 -
\??\c:\flrrrrr.exec:\flrrrrr.exe35⤵
- Executes dropped EXE
PID:2312 -
\??\c:\frxrrll.exec:\frxrrll.exe36⤵PID:1524
-
\??\c:\nbtbhh.exec:\nbtbhh.exe37⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jdvvd.exec:\jdvvd.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\lxfxfxx.exec:\lxfxfxx.exe39⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rffffxl.exec:\rffffxl.exe40⤵
- Executes dropped EXE
PID:3060 -
\??\c:\frxffff.exec:\frxffff.exe41⤵
- Executes dropped EXE
PID:2960 -
\??\c:\3bttbt.exec:\3bttbt.exe42⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xflffrx.exec:\xflffrx.exe43⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xrflrfx.exec:\xrflrfx.exe44⤵
- Executes dropped EXE
PID:2448 -
\??\c:\htbnhb.exec:\htbnhb.exe45⤵
- Executes dropped EXE
PID:2436 -
\??\c:\tbnttt.exec:\tbnttt.exe46⤵
- Executes dropped EXE
PID:2672 -
\??\c:\5vvdj.exec:\5vvdj.exe47⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3pvpp.exec:\3pvpp.exe48⤵
- Executes dropped EXE
PID:1868 -
\??\c:\frfxfxf.exec:\frfxfxf.exe49⤵
- Executes dropped EXE
PID:1852 -
\??\c:\rllfrxx.exec:\rllfrxx.exe50⤵
- Executes dropped EXE
PID:2624 -
\??\c:\tnbbhh.exec:\tnbbhh.exe51⤵
- Executes dropped EXE
PID:2284 -
\??\c:\1hbnhh.exec:\1hbnhh.exe52⤵
- Executes dropped EXE
PID:112 -
\??\c:\7jdpj.exec:\7jdpj.exe53⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jjvjp.exec:\jjvjp.exe54⤵
- Executes dropped EXE
PID:1580 -
\??\c:\ffrxlfr.exec:\ffrxlfr.exe55⤵
- Executes dropped EXE
PID:356 -
\??\c:\lrfxfrr.exec:\lrfxfrr.exe56⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hhbnbn.exec:\hhbnbn.exe57⤵
- Executes dropped EXE
PID:1604 -
\??\c:\tnbhnh.exec:\tnbhnh.exe58⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ttbhnn.exec:\ttbhnn.exe59⤵
- Executes dropped EXE
PID:852 -
\??\c:\pjvdd.exec:\pjvdd.exe60⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xxflxlf.exec:\xxflxlf.exe61⤵
- Executes dropped EXE
PID:2076 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe62⤵
- Executes dropped EXE
PID:1992 -
\??\c:\bnhnbb.exec:\bnhnbb.exe63⤵
- Executes dropped EXE
PID:2204 -
\??\c:\ttthnb.exec:\ttthnb.exe64⤵
- Executes dropped EXE
PID:556 -
\??\c:\vjvpj.exec:\vjvpj.exe65⤵
- Executes dropped EXE
PID:2568 -
\??\c:\vjjpv.exec:\vjjpv.exe66⤵
- Executes dropped EXE
PID:1396 -
\??\c:\lrrrfrr.exec:\lrrrfrr.exe67⤵PID:2736
-
\??\c:\9xrxxxr.exec:\9xrxxxr.exe68⤵PID:1572
-
\??\c:\bbhttt.exec:\bbhttt.exe69⤵PID:1216
-
\??\c:\5hthtt.exec:\5hthtt.exe70⤵PID:992
-
\??\c:\vpjvj.exec:\vpjvj.exe71⤵PID:1996
-
\??\c:\vvjvv.exec:\vvjvv.exe72⤵PID:2348
-
\??\c:\pjvdj.exec:\pjvdj.exe73⤵PID:624
-
\??\c:\xxfxfxf.exec:\xxfxfxf.exe74⤵PID:3044
-
\??\c:\thbntb.exec:\thbntb.exe75⤵PID:1656
-
\??\c:\bntbhh.exec:\bntbhh.exe76⤵PID:2008
-
\??\c:\pppvv.exec:\pppvv.exe77⤵PID:1640
-
\??\c:\5jvdj.exec:\5jvdj.exe78⤵PID:892
-
\??\c:\1frlrrx.exec:\1frlrrx.exe79⤵PID:540
-
\??\c:\nhtbht.exec:\nhtbht.exe80⤵PID:2312
-
\??\c:\5bnttb.exec:\5bnttb.exe81⤵PID:3024
-
\??\c:\jdjjv.exec:\jdjjv.exe82⤵PID:2228
-
\??\c:\pdppp.exec:\pdppp.exe83⤵PID:2660
-
\??\c:\lfrlfll.exec:\lfrlfll.exe84⤵PID:2484
-
\??\c:\nnbhbb.exec:\nnbhbb.exe85⤵PID:2552
-
\??\c:\tnbthh.exec:\tnbthh.exe86⤵PID:2772
-
\??\c:\dvdpv.exec:\dvdpv.exe87⤵PID:2564
-
\??\c:\vpjdp.exec:\vpjdp.exe88⤵PID:2556
-
\??\c:\dvdpd.exec:\dvdpd.exe89⤵PID:2448
-
\??\c:\5flrxfx.exec:\5flrxfx.exe90⤵PID:2412
-
\??\c:\7hbhnt.exec:\7hbhnt.exe91⤵PID:2672
-
\??\c:\9btthb.exec:\9btthb.exe92⤵PID:2444
-
\??\c:\hbhnbn.exec:\hbhnbn.exe93⤵PID:1564
-
\??\c:\vpvpd.exec:\vpvpd.exe94⤵PID:1516
-
\??\c:\7vjvv.exec:\7vjvv.exe95⤵PID:2628
-
\??\c:\9rrfrrf.exec:\9rrfrrf.exe96⤵PID:1584
-
\??\c:\frflxfr.exec:\frflxfr.exe97⤵PID:1900
-
\??\c:\ttthhh.exec:\ttthhh.exe98⤵PID:1876
-
\??\c:\nnhttt.exec:\nnhttt.exe99⤵PID:400
-
\??\c:\pdpjj.exec:\pdpjj.exe100⤵PID:2152
-
\??\c:\1jdjv.exec:\1jdjv.exe101⤵PID:1744
-
\??\c:\xlxffrl.exec:\xlxffrl.exe102⤵PID:2128
-
\??\c:\fxlxrrf.exec:\fxlxrrf.exe103⤵PID:1360
-
\??\c:\rffflfl.exec:\rffflfl.exe104⤵PID:1456
-
\??\c:\thbtnn.exec:\thbtnn.exe105⤵PID:3000
-
\??\c:\3nbbhb.exec:\3nbbhb.exe106⤵PID:320
-
\??\c:\jvjpp.exec:\jvjpp.exe107⤵PID:2044
-
\??\c:\jvppj.exec:\jvppj.exe108⤵PID:2100
-
\??\c:\rrrxffl.exec:\rrrxffl.exe109⤵PID:688
-
\??\c:\5rxxfxf.exec:\5rxxfxf.exe110⤵PID:268
-
\??\c:\3btbnh.exec:\3btbnh.exe111⤵PID:1412
-
\??\c:\thhnnt.exec:\thhnnt.exe112⤵PID:1436
-
\??\c:\1vpvj.exec:\1vpvj.exe113⤵PID:1784
-
\??\c:\jpdvd.exec:\jpdvd.exe114⤵PID:996
-
\??\c:\5xlxlrx.exec:\5xlxlrx.exe115⤵PID:628
-
\??\c:\frlffxx.exec:\frlffxx.exe116⤵PID:904
-
\??\c:\tnhntt.exec:\tnhntt.exe117⤵PID:352
-
\??\c:\5bnttt.exec:\5bnttt.exe118⤵PID:1624
-
\??\c:\5jdvj.exec:\5jdvj.exe119⤵PID:1652
-
\??\c:\vpvjp.exec:\vpvjp.exe120⤵PID:2936
-
\??\c:\5xxflrf.exec:\5xxflrf.exe121⤵PID:2260
-
\??\c:\xllrfxl.exec:\xllrfxl.exe122⤵PID:1428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-