Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:26
Behavioral task
behavioral1
Sample
5795e7d1e5ae624b824c2fe9e3cfd4c0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5795e7d1e5ae624b824c2fe9e3cfd4c0_NeikiAnalytics.exe
-
Size
81KB
-
MD5
5795e7d1e5ae624b824c2fe9e3cfd4c0
-
SHA1
20e3134dceec4f5e91e332de5c19382a004bf0d6
-
SHA256
22c2c9a00d98dca419a0dd3285b1622eddf585b7e66d588d90d22ab70db80f64
-
SHA512
d5afc922f75b8d21c16fd1ee581e00770228b81d015c9fb972adfac6b7e753d32c050419f622649e93a18d79b9f497433e6b923db80d2fc622388f0cef557d1e
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6T7QGIC:zhOmTsF93UYfwC6GIoutiTU2HVS63Qg
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
Processes:
resource yara_rule behavioral1/memory/2388-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1528-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-60-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2832-59-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2636-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-106-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2764-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1292-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/960-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-163-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1984-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2244-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1104-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/488-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/800-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/788-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1596-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/992-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-620-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-820-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-971-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-988-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/780-999-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-1143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-1355-0x0000000077A30000-0x0000000077B4F000-memory.dmp family_blackmoon behavioral1/memory/2868-8345-0x0000000077A30000-0x0000000077B4F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lllxflr.exebthnbn.exe7rrlxll.exe9lrfrrx.exetthnnh.exevvjpj.exe7xrlllr.exe5fllxxx.exenhtbbh.exejjvvp.exedvdpj.exerrrrxxr.exe5xxflxf.exebthnnb.exedvdjd.exeddpjd.exefrrxlrf.exe1nbhtb.exe9thtnb.exedvdpd.exelfxfxfl.exebbhhbh.exe1nbhth.exe3dvdp.exeddpdv.exerxllllx.exehbnbbn.exejvddv.exevpjpd.exexxlllff.exefrffffl.exebhhnth.exe9jddj.exexfxfrrx.exerlrrlrl.exe5nbhnt.exetnbnbh.exevdvpd.exepjvjv.exelllrffr.exellfrffl.exehbthth.exedddpj.exeddvvj.exejppdj.exedpvvv.exerfrrxrx.exeththth.exebnbnhb.exe9dpdp.exexrllrrx.exe5xxrrxx.exehbnhtb.exehbhhtb.exepjjjp.exe5dppj.exe7fxllfx.exerfrfxfr.exetbnthn.exe1hbbnn.exe9ppdv.exejvddp.exe1lxrxlr.exexxfrflx.exepid process 2388 lllxflr.exe 1528 bthnbn.exe 2132 7rrlxll.exe 2552 9lrfrrx.exe 2652 tthnnh.exe 2832 vvjpj.exe 2636 7xrlllr.exe 2720 5fllxxx.exe 2444 nhtbbh.exe 2512 jjvvp.exe 2744 dvdpj.exe 2920 rrrrxxr.exe 2764 5xxflxf.exe 968 bthnnb.exe 1916 dvdjd.exe 1292 ddpjd.exe 960 frrxlrf.exe 2748 1nbhtb.exe 1984 9thtnb.exe 1740 dvdpd.exe 2244 lfxfxfl.exe 1104 bbhhbh.exe 1976 1nbhth.exe 2272 3dvdp.exe 488 ddpdv.exe 800 rxllllx.exe 2084 hbnbbn.exe 1184 jvddv.exe 788 vpjpd.exe 1888 xxlllff.exe 1076 frffffl.exe 2296 bhhnth.exe 1952 9jddj.exe 1724 xfxfrrx.exe 2228 rlrrlrl.exe 2972 5nbhnt.exe 3000 tnbnbh.exe 2356 vdvpd.exe 3020 pjvjv.exe 1596 lllrffr.exe 2540 llfrffl.exe 2140 hbthth.exe 2588 dddpj.exe 2640 ddvvj.exe 2648 jppdj.exe 2704 dpvvv.exe 2712 rfrrxrx.exe 2980 ththth.exe 2580 bnbnhb.exe 2456 9dpdp.exe 2696 xrllrrx.exe 2488 5xxrrxx.exe 2912 hbnhtb.exe 2008 hbhhtb.exe 2432 pjjjp.exe 2732 5dppj.exe 2764 7fxllfx.exe 956 rfrfxfr.exe 1648 tbnthn.exe 1196 1hbbnn.exe 2000 9ppdv.exe 2768 jvddp.exe 2756 1lxrxlr.exe 1584 xxfrflx.exe -
Processes:
resource yara_rule behavioral1/memory/2820-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2388-12-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lllxflr.exe upx behavioral1/memory/2820-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2820-6-0x00000000001B0000-0x00000000001D7000-memory.dmp upx C:\bthnbn.exe upx C:\7rrlxll.exe upx behavioral1/memory/1528-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2132-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2132-35-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9lrfrrx.exe upx behavioral1/memory/2552-43-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tthnnh.exe upx behavioral1/memory/2652-46-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvjpj.exe upx behavioral1/memory/2832-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7xrlllr.exe upx behavioral1/memory/2636-70-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5fllxxx.exe upx C:\nhtbbh.exe upx C:\jjvvp.exe upx C:\dvdpj.exe upx behavioral1/memory/2512-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrrrxxr.exe upx C:\5xxflxf.exe upx behavioral1/memory/2764-109-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bthnnb.exe upx behavioral1/memory/2764-117-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvdjd.exe upx C:\ddpjd.exe upx behavioral1/memory/1292-139-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frrxlrf.exe upx behavioral1/memory/960-141-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1nbhtb.exe upx C:\9thtnb.exe upx behavioral1/memory/2748-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1984-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1984-165-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvdpd.exe upx C:\lfxfxfl.exe upx behavioral1/memory/2244-173-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbhhbh.exe upx behavioral1/memory/2244-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1104-183-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1nbhth.exe upx behavioral1/memory/1976-192-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3dvdp.exe upx behavioral1/memory/2272-205-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddpdv.exe upx C:\rxllllx.exe upx behavioral1/memory/488-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/800-221-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbnbbn.exe upx \??\c:\jvddv.exe upx C:\vpjpd.exe upx behavioral1/memory/788-239-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxlllff.exe upx C:\frffffl.exe upx C:\bhhnth.exe upx behavioral1/memory/1952-270-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2228-276-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2972-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2356-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1596-309-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5795e7d1e5ae624b824c2fe9e3cfd4c0_NeikiAnalytics.exelllxflr.exebthnbn.exe7rrlxll.exe9lrfrrx.exetthnnh.exevvjpj.exe7xrlllr.exe5fllxxx.exenhtbbh.exejjvvp.exedvdpj.exerrrrxxr.exe5xxflxf.exebthnnb.exedvdjd.exedescription pid process target process PID 2820 wrote to memory of 2388 2820 5795e7d1e5ae624b824c2fe9e3cfd4c0_NeikiAnalytics.exe lllxflr.exe PID 2820 wrote to memory of 2388 2820 5795e7d1e5ae624b824c2fe9e3cfd4c0_NeikiAnalytics.exe lllxflr.exe PID 2820 wrote to memory of 2388 2820 5795e7d1e5ae624b824c2fe9e3cfd4c0_NeikiAnalytics.exe lllxflr.exe PID 2820 wrote to memory of 2388 2820 5795e7d1e5ae624b824c2fe9e3cfd4c0_NeikiAnalytics.exe lllxflr.exe PID 2388 wrote to memory of 1528 2388 lllxflr.exe bthnbn.exe PID 2388 wrote to memory of 1528 2388 lllxflr.exe bthnbn.exe PID 2388 wrote to memory of 1528 2388 lllxflr.exe bthnbn.exe PID 2388 wrote to memory of 1528 2388 lllxflr.exe bthnbn.exe PID 1528 wrote to memory of 2132 1528 bthnbn.exe 7rrlxll.exe PID 1528 wrote to memory of 2132 1528 bthnbn.exe 7rrlxll.exe PID 1528 wrote to memory of 2132 1528 bthnbn.exe 7rrlxll.exe PID 1528 wrote to memory of 2132 1528 bthnbn.exe 7rrlxll.exe PID 2132 wrote to memory of 2552 2132 7rrlxll.exe 9lrfrrx.exe PID 2132 wrote to memory of 2552 2132 7rrlxll.exe 9lrfrrx.exe PID 2132 wrote to memory of 2552 2132 7rrlxll.exe 9lrfrrx.exe PID 2132 wrote to memory of 2552 2132 7rrlxll.exe 9lrfrrx.exe PID 2552 wrote to memory of 2652 2552 9lrfrrx.exe tthnnh.exe PID 2552 wrote to memory of 2652 2552 9lrfrrx.exe tthnnh.exe PID 2552 wrote to memory of 2652 2552 9lrfrrx.exe tthnnh.exe PID 2552 wrote to memory of 2652 2552 9lrfrrx.exe tthnnh.exe PID 2652 wrote to memory of 2832 2652 tthnnh.exe vvjpj.exe PID 2652 wrote to memory of 2832 2652 tthnnh.exe vvjpj.exe PID 2652 wrote to memory of 2832 2652 tthnnh.exe vvjpj.exe PID 2652 wrote to memory of 2832 2652 tthnnh.exe vvjpj.exe PID 2832 wrote to memory of 2636 2832 vvjpj.exe 7xrlllr.exe PID 2832 wrote to memory of 2636 2832 vvjpj.exe 7xrlllr.exe PID 2832 wrote to memory of 2636 2832 vvjpj.exe 7xrlllr.exe PID 2832 wrote to memory of 2636 2832 vvjpj.exe 7xrlllr.exe PID 2636 wrote to memory of 2720 2636 7xrlllr.exe 5fllxxx.exe PID 2636 wrote to memory of 2720 2636 7xrlllr.exe 5fllxxx.exe PID 2636 wrote to memory of 2720 2636 7xrlllr.exe 5fllxxx.exe PID 2636 wrote to memory of 2720 2636 7xrlllr.exe 5fllxxx.exe PID 2720 wrote to memory of 2444 2720 5fllxxx.exe nhtbbh.exe PID 2720 wrote to memory of 2444 2720 5fllxxx.exe nhtbbh.exe PID 2720 wrote to memory of 2444 2720 5fllxxx.exe nhtbbh.exe PID 2720 wrote to memory of 2444 2720 5fllxxx.exe nhtbbh.exe PID 2444 wrote to memory of 2512 2444 nhtbbh.exe jjvvp.exe PID 2444 wrote to memory of 2512 2444 nhtbbh.exe jjvvp.exe PID 2444 wrote to memory of 2512 2444 nhtbbh.exe jjvvp.exe PID 2444 wrote to memory of 2512 2444 nhtbbh.exe jjvvp.exe PID 2512 wrote to memory of 2744 2512 jjvvp.exe dvdpj.exe PID 2512 wrote to memory of 2744 2512 jjvvp.exe dvdpj.exe PID 2512 wrote to memory of 2744 2512 jjvvp.exe dvdpj.exe PID 2512 wrote to memory of 2744 2512 jjvvp.exe dvdpj.exe PID 2744 wrote to memory of 2920 2744 dvdpj.exe rrrrxxr.exe PID 2744 wrote to memory of 2920 2744 dvdpj.exe rrrrxxr.exe PID 2744 wrote to memory of 2920 2744 dvdpj.exe rrrrxxr.exe PID 2744 wrote to memory of 2920 2744 dvdpj.exe rrrrxxr.exe PID 2920 wrote to memory of 2764 2920 rrrrxxr.exe 5xxflxf.exe PID 2920 wrote to memory of 2764 2920 rrrrxxr.exe 5xxflxf.exe PID 2920 wrote to memory of 2764 2920 rrrrxxr.exe 5xxflxf.exe PID 2920 wrote to memory of 2764 2920 rrrrxxr.exe 5xxflxf.exe PID 2764 wrote to memory of 968 2764 5xxflxf.exe bthnnb.exe PID 2764 wrote to memory of 968 2764 5xxflxf.exe bthnnb.exe PID 2764 wrote to memory of 968 2764 5xxflxf.exe bthnnb.exe PID 2764 wrote to memory of 968 2764 5xxflxf.exe bthnnb.exe PID 968 wrote to memory of 1916 968 bthnnb.exe dvdjd.exe PID 968 wrote to memory of 1916 968 bthnnb.exe dvdjd.exe PID 968 wrote to memory of 1916 968 bthnnb.exe dvdjd.exe PID 968 wrote to memory of 1916 968 bthnnb.exe dvdjd.exe PID 1916 wrote to memory of 1292 1916 dvdjd.exe ddpjd.exe PID 1916 wrote to memory of 1292 1916 dvdjd.exe ddpjd.exe PID 1916 wrote to memory of 1292 1916 dvdjd.exe ddpjd.exe PID 1916 wrote to memory of 1292 1916 dvdjd.exe ddpjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5795e7d1e5ae624b824c2fe9e3cfd4c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5795e7d1e5ae624b824c2fe9e3cfd4c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\lllxflr.exec:\lllxflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\bthnbn.exec:\bthnbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\7rrlxll.exec:\7rrlxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\9lrfrrx.exec:\9lrfrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\tthnnh.exec:\tthnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vvjpj.exec:\vvjpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\7xrlllr.exec:\7xrlllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\5fllxxx.exec:\5fllxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\nhtbbh.exec:\nhtbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\jjvvp.exec:\jjvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\dvdpj.exec:\dvdpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\rrrrxxr.exec:\rrrrxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\5xxflxf.exec:\5xxflxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\bthnnb.exec:\bthnnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\dvdjd.exec:\dvdjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\ddpjd.exec:\ddpjd.exe17⤵
- Executes dropped EXE
PID:1292 -
\??\c:\frrxlrf.exec:\frrxlrf.exe18⤵
- Executes dropped EXE
PID:960 -
\??\c:\1nbhtb.exec:\1nbhtb.exe19⤵
- Executes dropped EXE
PID:2748 -
\??\c:\9thtnb.exec:\9thtnb.exe20⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dvdpd.exec:\dvdpd.exe21⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lfxfxfl.exec:\lfxfxfl.exe22⤵
- Executes dropped EXE
PID:2244 -
\??\c:\bbhhbh.exec:\bbhhbh.exe23⤵
- Executes dropped EXE
PID:1104 -
\??\c:\1nbhth.exec:\1nbhth.exe24⤵
- Executes dropped EXE
PID:1976 -
\??\c:\3dvdp.exec:\3dvdp.exe25⤵
- Executes dropped EXE
PID:2272 -
\??\c:\ddpdv.exec:\ddpdv.exe26⤵
- Executes dropped EXE
PID:488 -
\??\c:\rxllllx.exec:\rxllllx.exe27⤵
- Executes dropped EXE
PID:800 -
\??\c:\hbnbbn.exec:\hbnbbn.exe28⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jvddv.exec:\jvddv.exe29⤵
- Executes dropped EXE
PID:1184 -
\??\c:\vpjpd.exec:\vpjpd.exe30⤵
- Executes dropped EXE
PID:788 -
\??\c:\xxlllff.exec:\xxlllff.exe31⤵
- Executes dropped EXE
PID:1888 -
\??\c:\frffffl.exec:\frffffl.exe32⤵
- Executes dropped EXE
PID:1076 -
\??\c:\bhhnth.exec:\bhhnth.exe33⤵
- Executes dropped EXE
PID:2296 -
\??\c:\9jddj.exec:\9jddj.exe34⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xfxfrrx.exec:\xfxfrrx.exe35⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rlrrlrl.exec:\rlrrlrl.exe36⤵
- Executes dropped EXE
PID:2228 -
\??\c:\5nbhnt.exec:\5nbhnt.exe37⤵
- Executes dropped EXE
PID:2972 -
\??\c:\tnbnbh.exec:\tnbnbh.exe38⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vdvpd.exec:\vdvpd.exe39⤵
- Executes dropped EXE
PID:2356 -
\??\c:\pjvjv.exec:\pjvjv.exe40⤵
- Executes dropped EXE
PID:3020 -
\??\c:\lllrffr.exec:\lllrffr.exe41⤵
- Executes dropped EXE
PID:1596 -
\??\c:\llfrffl.exec:\llfrffl.exe42⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hbthth.exec:\hbthth.exe43⤵
- Executes dropped EXE
PID:2140 -
\??\c:\dddpj.exec:\dddpj.exe44⤵
- Executes dropped EXE
PID:2588 -
\??\c:\ddvvj.exec:\ddvvj.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\jppdj.exec:\jppdj.exe46⤵
- Executes dropped EXE
PID:2648 -
\??\c:\dpvvv.exec:\dpvvv.exe47⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rfrrxrx.exec:\rfrrxrx.exe48⤵
- Executes dropped EXE
PID:2712 -
\??\c:\ththth.exec:\ththth.exe49⤵
- Executes dropped EXE
PID:2980 -
\??\c:\bnbnhb.exec:\bnbnhb.exe50⤵
- Executes dropped EXE
PID:2580 -
\??\c:\9dpdp.exec:\9dpdp.exe51⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xrllrrx.exec:\xrllrrx.exe52⤵
- Executes dropped EXE
PID:2696 -
\??\c:\5xxrrxx.exec:\5xxrrxx.exe53⤵
- Executes dropped EXE
PID:2488 -
\??\c:\hbnhtb.exec:\hbnhtb.exe54⤵
- Executes dropped EXE
PID:2912 -
\??\c:\hbhhtb.exec:\hbhhtb.exe55⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pjjjp.exec:\pjjjp.exe56⤵
- Executes dropped EXE
PID:2432 -
\??\c:\5dppj.exec:\5dppj.exe57⤵
- Executes dropped EXE
PID:2732 -
\??\c:\7fxllfx.exec:\7fxllfx.exe58⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rfrfxfr.exec:\rfrfxfr.exe59⤵
- Executes dropped EXE
PID:956 -
\??\c:\tbnthn.exec:\tbnthn.exe60⤵
- Executes dropped EXE
PID:1648 -
\??\c:\1hbbnn.exec:\1hbbnn.exe61⤵
- Executes dropped EXE
PID:1196 -
\??\c:\9ppdv.exec:\9ppdv.exe62⤵
- Executes dropped EXE
PID:2000 -
\??\c:\jvddp.exec:\jvddp.exe63⤵
- Executes dropped EXE
PID:2768 -
\??\c:\1lxrxlr.exec:\1lxrxlr.exe64⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xxfrflx.exec:\xxfrflx.exe65⤵
- Executes dropped EXE
PID:1584 -
\??\c:\bnbhtn.exec:\bnbhtn.exe66⤵PID:1984
-
\??\c:\hbbhnb.exec:\hbbhnb.exe67⤵PID:3024
-
\??\c:\dddpj.exec:\dddpj.exe68⤵PID:2932
-
\??\c:\pjvjv.exec:\pjvjv.exe69⤵PID:2240
-
\??\c:\xflflxr.exec:\xflflxr.exe70⤵PID:2112
-
\??\c:\rlrllfl.exec:\rlrllfl.exe71⤵PID:1884
-
\??\c:\tntnhh.exec:\tntnhh.exe72⤵PID:2236
-
\??\c:\vpjvj.exec:\vpjvj.exe73⤵PID:2280
-
\??\c:\vpjdd.exec:\vpjdd.exe74⤵PID:3012
-
\??\c:\3lfrxll.exec:\3lfrxll.exe75⤵PID:1468
-
\??\c:\3rfxlrf.exec:\3rfxlrf.exe76⤵PID:1536
-
\??\c:\tnbbnn.exec:\tnbbnn.exe77⤵PID:992
-
\??\c:\3tnhbh.exec:\3tnhbh.exe78⤵PID:1184
-
\??\c:\pjvdd.exec:\pjvdd.exe79⤵PID:2376
-
\??\c:\fxlrffr.exec:\fxlrffr.exe80⤵PID:1820
-
\??\c:\ffrlfxr.exec:\ffrlfxr.exe81⤵PID:700
-
\??\c:\bhntnn.exec:\bhntnn.exe82⤵PID:3056
-
\??\c:\7nttbb.exec:\7nttbb.exe83⤵PID:2872
-
\??\c:\dvpvd.exec:\dvpvd.exe84⤵PID:1556
-
\??\c:\pjjdj.exec:\pjjdj.exe85⤵PID:2288
-
\??\c:\xflxrfr.exec:\xflxrfr.exe86⤵PID:912
-
\??\c:\5xxxllx.exec:\5xxxllx.exe87⤵PID:2312
-
\??\c:\nhtnbn.exec:\nhtnbn.exe88⤵PID:1732
-
\??\c:\nnnnhh.exec:\nnnnhh.exe89⤵PID:1412
-
\??\c:\vjvjj.exec:\vjvjj.exe90⤵PID:2356
-
\??\c:\9ppdj.exec:\9ppdj.exe91⤵PID:2196
-
\??\c:\9jpvd.exec:\9jpvd.exe92⤵PID:2352
-
\??\c:\ffrxflx.exec:\ffrxflx.exe93⤵PID:2540
-
\??\c:\fffxxll.exec:\fffxxll.exe94⤵PID:1876
-
\??\c:\hthttb.exec:\hthttb.exe95⤵PID:2664
-
\??\c:\nhbhbn.exec:\nhbhbn.exe96⤵PID:2640
-
\??\c:\jvddv.exec:\jvddv.exe97⤵PID:2648
-
\??\c:\ppppv.exec:\ppppv.exe98⤵PID:2644
-
\??\c:\rlffrrf.exec:\rlffrrf.exe99⤵PID:2712
-
\??\c:\9tnbth.exec:\9tnbth.exe100⤵PID:2468
-
\??\c:\7hhtnn.exec:\7hhtnn.exe101⤵PID:2720
-
\??\c:\9bbtbn.exec:\9bbtbn.exe102⤵PID:2096
-
\??\c:\vvjvv.exec:\vvjvv.exe103⤵PID:2496
-
\??\c:\pjvdj.exec:\pjvdj.exe104⤵PID:2728
-
\??\c:\xlxlrxf.exec:\xlxlrxf.exe105⤵PID:2044
-
\??\c:\rfflxlf.exec:\rfflxlf.exe106⤵PID:2008
-
\??\c:\tnnbtb.exec:\tnnbtb.exe107⤵PID:1436
-
\??\c:\ntbnnt.exec:\ntbnnt.exe108⤵PID:1664
-
\??\c:\djddj.exec:\djddj.exe109⤵PID:1208
-
\??\c:\pdvjp.exec:\pdvjp.exe110⤵PID:1480
-
\??\c:\vpdjd.exec:\vpdjd.exe111⤵PID:1872
-
\??\c:\xrfrlfr.exec:\xrfrlfr.exe112⤵PID:2332
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe113⤵PID:1264
-
\??\c:\tbnhbn.exec:\tbnhbn.exe114⤵PID:948
-
\??\c:\nhtthn.exec:\nhtthn.exe115⤵PID:2412
-
\??\c:\5pjvd.exec:\5pjvd.exe116⤵PID:2812
-
\??\c:\dvppd.exec:\dvppd.exe117⤵PID:1700
-
\??\c:\fxrrllr.exec:\fxrrllr.exe118⤵PID:2904
-
\??\c:\rfxlrlr.exec:\rfxlrlr.exe119⤵PID:2244
-
\??\c:\nbhbbb.exec:\nbhbbb.exe120⤵PID:2268
-
\??\c:\hbntnt.exec:\hbntnt.exe121⤵PID:1428
-
\??\c:\ppdpp.exec:\ppdpp.exe122⤵PID:324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-