Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 00:18
Behavioral task
behavioral1
Sample
28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe
-
Size
82KB
-
MD5
28dafbfb70746a46d5c57b7b03416ed0
-
SHA1
388896c5a9a354c074f6bccaf549387ba8bc62cd
-
SHA256
fe3ed9ef1414624e5972a1e302523b7d0623b5a254d139013ec29ac06aaeb618
-
SHA512
137627af8eea2d016e63bcf132426281b31414a35adfd9c307e9db8e941d654c4000131d3b4dcd878f318321c6214a6a45130af7c5366022d3e6a83f66fe25cd
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6TQpCi1PC:zhOmTsF93UYfwC6GIoutiTU2HVS64NC
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2416-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1400-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-117-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3024-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1260-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2144-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/680-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1552-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1944-424-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1868-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-541-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-702-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-839-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-850-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-1164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-1195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1992-7721-0x0000000077AD0000-0x0000000077BEF000-memory.dmp family_blackmoon behavioral1/memory/1992-17571-0x00000000779D0000-0x0000000077ACA000-memory.dmp family_blackmoon behavioral1/memory/1992-31548-0x0000000077AD0000-0x0000000077BEF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2204 pjvvj.exe 1400 xxlrflr.exe 2384 llrxxxf.exe 2720 nnbhht.exe 2668 jjddv.exe 2812 5fxxffr.exe 1712 hhhhbn.exe 2676 vjdpp.exe 2524 rllllrf.exe 2996 3lflrxf.exe 2992 hbnhnn.exe 2848 jddjv.exe 2964 lfrflrf.exe 3024 nbntbb.exe 2552 vvjpd.exe 1260 5vjjv.exe 2248 xxlxlxr.exe 300 bbbhtb.exe 2752 hbtnbt.exe 304 vpjpd.exe 1656 rlfrxfr.exe 264 bbbnbn.exe 1436 tnbhnt.exe 1292 1pjjp.exe 2920 fxrrfrx.exe 2144 lxflllf.exe 444 thbntb.exe 2340 pjvpd.exe 968 xrrrffx.exe 2008 5nbhth.exe 1868 bthnbb.exe 896 pvpjj.exe 680 rrrflrl.exe 2476 bnttbb.exe 536 3ddjd.exe 2936 9dvvv.exe 2200 lxlrrrx.exe 1760 fxrllrx.exe 1992 htnttb.exe 2884 tnttbn.exe 3000 hbtbtt.exe 1552 jvdjv.exe 2192 vpjpv.exe 2716 ffflxxf.exe 2664 1bbbnn.exe 2660 hnbbnb.exe 2668 pjdpj.exe 2704 lrffllr.exe 2780 rlxlxrx.exe 2624 hnbtbt.exe 2532 3bbnnb.exe 2528 vpvdp.exe 2632 1jpjj.exe 3048 llfflrf.exe 2832 hbtbnn.exe 2868 5btbtt.exe 3020 1jjdj.exe 3004 pddjp.exe 888 xrfllxf.exe 1312 9xxfxxf.exe 1684 3hhhnn.exe 1944 tthntt.exe 2168 7ppvd.exe 2784 9vjpj.exe -
resource yara_rule behavioral1/memory/2416-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d0000000122eb-7.dat upx behavioral1/memory/2204-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2416-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1400-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0036000000015cb8-18.dat upx behavioral1/files/0x0008000000015d08-26.dat upx behavioral1/memory/2384-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d24-33.dat upx behavioral1/memory/2204-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d3b-40.dat upx behavioral1/memory/2720-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2668-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d53-49.dat upx behavioral1/memory/1712-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016835-65.dat upx behavioral1/files/0x0008000000015d7b-59.dat upx behavioral1/memory/2812-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016a8a-73.dat upx behavioral1/memory/2524-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c52-82.dat upx behavioral1/files/0x0006000000016c6f-89.dat upx behavioral1/memory/2992-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2996-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c78-99.dat upx behavioral1/memory/2992-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cc1-106.dat upx behavioral1/memory/2848-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2964-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ceb-115.dat upx behavioral1/memory/3024-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d17-124.dat upx behavioral1/files/0x0006000000016d2a-131.dat upx behavioral1/files/0x0006000000016d32-138.dat upx behavioral1/memory/1260-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d3b-146.dat upx behavioral1/files/0x0006000000016d43-152.dat upx behavioral1/files/0x0006000000016d4b-160.dat upx behavioral1/memory/2752-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1656-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d5f-168.dat upx behavioral1/files/0x0006000000016d64-176.dat upx behavioral1/memory/264-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d68-184.dat upx behavioral1/memory/1436-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d6f-192.dat upx behavioral1/files/0x0006000000016d8b-199.dat upx behavioral1/files/0x0006000000016d9f-206.dat upx behavioral1/memory/2144-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dba-214.dat upx behavioral1/files/0x0006000000016dc8-221.dat upx behavioral1/files/0x0006000000016dd1-228.dat upx behavioral1/files/0x0036000000015cc7-235.dat upx behavioral1/files/0x0006000000016ddc-243.dat upx behavioral1/memory/2008-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016de3-250.dat upx behavioral1/memory/680-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/680-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2476-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2200-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1760-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2884-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3000-305-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2204 2416 28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe 28 PID 2416 wrote to memory of 2204 2416 28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe 28 PID 2416 wrote to memory of 2204 2416 28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe 28 PID 2416 wrote to memory of 2204 2416 28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe 28 PID 2204 wrote to memory of 1400 2204 pjvvj.exe 29 PID 2204 wrote to memory of 1400 2204 pjvvj.exe 29 PID 2204 wrote to memory of 1400 2204 pjvvj.exe 29 PID 2204 wrote to memory of 1400 2204 pjvvj.exe 29 PID 1400 wrote to memory of 2384 1400 xxlrflr.exe 30 PID 1400 wrote to memory of 2384 1400 xxlrflr.exe 30 PID 1400 wrote to memory of 2384 1400 xxlrflr.exe 30 PID 1400 wrote to memory of 2384 1400 xxlrflr.exe 30 PID 2384 wrote to memory of 2720 2384 llrxxxf.exe 31 PID 2384 wrote to memory of 2720 2384 llrxxxf.exe 31 PID 2384 wrote to memory of 2720 2384 llrxxxf.exe 31 PID 2384 wrote to memory of 2720 2384 llrxxxf.exe 31 PID 2720 wrote to memory of 2668 2720 nnbhht.exe 32 PID 2720 wrote to memory of 2668 2720 nnbhht.exe 32 PID 2720 wrote to memory of 2668 2720 nnbhht.exe 32 PID 2720 wrote to memory of 2668 2720 nnbhht.exe 32 PID 2668 wrote to memory of 2812 2668 jjddv.exe 33 PID 2668 wrote to memory of 2812 2668 jjddv.exe 33 PID 2668 wrote to memory of 2812 2668 jjddv.exe 33 PID 2668 wrote to memory of 2812 2668 jjddv.exe 33 PID 2812 wrote to memory of 1712 2812 5fxxffr.exe 34 PID 2812 wrote to memory of 1712 2812 5fxxffr.exe 34 PID 2812 wrote to memory of 1712 2812 5fxxffr.exe 34 PID 2812 wrote to memory of 1712 2812 5fxxffr.exe 34 PID 1712 wrote to memory of 2676 1712 hhhhbn.exe 35 PID 1712 wrote to memory of 2676 1712 hhhhbn.exe 35 PID 1712 wrote to memory of 2676 1712 hhhhbn.exe 35 PID 1712 wrote to memory of 2676 1712 hhhhbn.exe 35 PID 2676 wrote to memory of 2524 2676 vjdpp.exe 36 PID 2676 wrote to memory of 2524 2676 vjdpp.exe 36 PID 2676 wrote to memory of 2524 2676 vjdpp.exe 36 PID 2676 wrote to memory of 2524 2676 vjdpp.exe 36 PID 2524 wrote to memory of 2996 2524 rllllrf.exe 37 PID 2524 wrote to memory of 2996 2524 rllllrf.exe 37 PID 2524 wrote to memory of 2996 2524 rllllrf.exe 37 PID 2524 wrote to memory of 2996 2524 rllllrf.exe 37 PID 2996 wrote to memory of 2992 2996 3lflrxf.exe 38 PID 2996 wrote to memory of 2992 2996 3lflrxf.exe 38 PID 2996 wrote to memory of 2992 2996 3lflrxf.exe 38 PID 2996 wrote to memory of 2992 2996 3lflrxf.exe 38 PID 2992 wrote to memory of 2848 2992 hbnhnn.exe 39 PID 2992 wrote to memory of 2848 2992 hbnhnn.exe 39 PID 2992 wrote to memory of 2848 2992 hbnhnn.exe 39 PID 2992 wrote to memory of 2848 2992 hbnhnn.exe 39 PID 2848 wrote to memory of 2964 2848 jddjv.exe 40 PID 2848 wrote to memory of 2964 2848 jddjv.exe 40 PID 2848 wrote to memory of 2964 2848 jddjv.exe 40 PID 2848 wrote to memory of 2964 2848 jddjv.exe 40 PID 2964 wrote to memory of 3024 2964 lfrflrf.exe 41 PID 2964 wrote to memory of 3024 2964 lfrflrf.exe 41 PID 2964 wrote to memory of 3024 2964 lfrflrf.exe 41 PID 2964 wrote to memory of 3024 2964 lfrflrf.exe 41 PID 3024 wrote to memory of 2552 3024 nbntbb.exe 42 PID 3024 wrote to memory of 2552 3024 nbntbb.exe 42 PID 3024 wrote to memory of 2552 3024 nbntbb.exe 42 PID 3024 wrote to memory of 2552 3024 nbntbb.exe 42 PID 2552 wrote to memory of 1260 2552 vvjpd.exe 43 PID 2552 wrote to memory of 1260 2552 vvjpd.exe 43 PID 2552 wrote to memory of 1260 2552 vvjpd.exe 43 PID 2552 wrote to memory of 1260 2552 vvjpd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\pjvvj.exec:\pjvvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\xxlrflr.exec:\xxlrflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\llrxxxf.exec:\llrxxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\nnbhht.exec:\nnbhht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jjddv.exec:\jjddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\5fxxffr.exec:\5fxxffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\hhhhbn.exec:\hhhhbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\vjdpp.exec:\vjdpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\rllllrf.exec:\rllllrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\3lflrxf.exec:\3lflrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\hbnhnn.exec:\hbnhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\jddjv.exec:\jddjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\lfrflrf.exec:\lfrflrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\nbntbb.exec:\nbntbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\vvjpd.exec:\vvjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\5vjjv.exec:\5vjjv.exe17⤵
- Executes dropped EXE
PID:1260 -
\??\c:\xxlxlxr.exec:\xxlxlxr.exe18⤵
- Executes dropped EXE
PID:2248 -
\??\c:\bbbhtb.exec:\bbbhtb.exe19⤵
- Executes dropped EXE
PID:300 -
\??\c:\hbtnbt.exec:\hbtnbt.exe20⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vpjpd.exec:\vpjpd.exe21⤵
- Executes dropped EXE
PID:304 -
\??\c:\rlfrxfr.exec:\rlfrxfr.exe22⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bbbnbn.exec:\bbbnbn.exe23⤵
- Executes dropped EXE
PID:264 -
\??\c:\tnbhnt.exec:\tnbhnt.exe24⤵
- Executes dropped EXE
PID:1436 -
\??\c:\1pjjp.exec:\1pjjp.exe25⤵
- Executes dropped EXE
PID:1292 -
\??\c:\fxrrfrx.exec:\fxrrfrx.exe26⤵
- Executes dropped EXE
PID:2920 -
\??\c:\lxflllf.exec:\lxflllf.exe27⤵
- Executes dropped EXE
PID:2144 -
\??\c:\thbntb.exec:\thbntb.exe28⤵
- Executes dropped EXE
PID:444 -
\??\c:\pjvpd.exec:\pjvpd.exe29⤵
- Executes dropped EXE
PID:2340 -
\??\c:\xrrrffx.exec:\xrrrffx.exe30⤵
- Executes dropped EXE
PID:968 -
\??\c:\5nbhth.exec:\5nbhth.exe31⤵
- Executes dropped EXE
PID:2008 -
\??\c:\bthnbb.exec:\bthnbb.exe32⤵
- Executes dropped EXE
PID:1868 -
\??\c:\pvpjj.exec:\pvpjj.exe33⤵
- Executes dropped EXE
PID:896 -
\??\c:\rrrflrl.exec:\rrrflrl.exe34⤵
- Executes dropped EXE
PID:680 -
\??\c:\bnttbb.exec:\bnttbb.exe35⤵
- Executes dropped EXE
PID:2476 -
\??\c:\3ddjd.exec:\3ddjd.exe36⤵
- Executes dropped EXE
PID:536 -
\??\c:\9dvvv.exec:\9dvvv.exe37⤵
- Executes dropped EXE
PID:2936 -
\??\c:\lxlrrrx.exec:\lxlrrrx.exe38⤵
- Executes dropped EXE
PID:2200 -
\??\c:\fxrllrx.exec:\fxrllrx.exe39⤵
- Executes dropped EXE
PID:1760 -
\??\c:\htnttb.exec:\htnttb.exe40⤵
- Executes dropped EXE
PID:1992 -
\??\c:\jvjjp.exec:\jvjjp.exe41⤵PID:2432
-
\??\c:\tnttbn.exec:\tnttbn.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\hbtbtt.exec:\hbtbtt.exe43⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jvdjv.exec:\jvdjv.exe44⤵
- Executes dropped EXE
PID:1552 -
\??\c:\vpjpv.exec:\vpjpv.exe45⤵
- Executes dropped EXE
PID:2192 -
\??\c:\ffflxxf.exec:\ffflxxf.exe46⤵
- Executes dropped EXE
PID:2716 -
\??\c:\1bbbnn.exec:\1bbbnn.exe47⤵
- Executes dropped EXE
PID:2664 -
\??\c:\hnbbnb.exec:\hnbbnb.exe48⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pjdpj.exec:\pjdpj.exe49⤵
- Executes dropped EXE
PID:2668 -
\??\c:\lrffllr.exec:\lrffllr.exe50⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rlxlxrx.exec:\rlxlxrx.exe51⤵
- Executes dropped EXE
PID:2780 -
\??\c:\hnbtbt.exec:\hnbtbt.exe52⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3bbnnb.exec:\3bbnnb.exe53⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vpvdp.exec:\vpvdp.exe54⤵
- Executes dropped EXE
PID:2528 -
\??\c:\1jpjj.exec:\1jpjj.exe55⤵
- Executes dropped EXE
PID:2632 -
\??\c:\llfflrf.exec:\llfflrf.exe56⤵
- Executes dropped EXE
PID:3048 -
\??\c:\hbtbnn.exec:\hbtbnn.exe57⤵
- Executes dropped EXE
PID:2832 -
\??\c:\5btbtt.exec:\5btbtt.exe58⤵
- Executes dropped EXE
PID:2868 -
\??\c:\1jjdj.exec:\1jjdj.exe59⤵
- Executes dropped EXE
PID:3020 -
\??\c:\pddjp.exec:\pddjp.exe60⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xrfllxf.exec:\xrfllxf.exe61⤵
- Executes dropped EXE
PID:888 -
\??\c:\9xxfxxf.exec:\9xxfxxf.exe62⤵
- Executes dropped EXE
PID:1312 -
\??\c:\3hhhnn.exec:\3hhhnn.exe63⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tthntt.exec:\tthntt.exe64⤵
- Executes dropped EXE
PID:1944 -
\??\c:\7ppvd.exec:\7ppvd.exe65⤵
- Executes dropped EXE
PID:2168 -
\??\c:\9vjpj.exec:\9vjpj.exe66⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rlxfxxl.exec:\rlxfxxl.exe67⤵PID:2840
-
\??\c:\ffrrrrx.exec:\ffrrrrx.exe68⤵PID:2752
-
\??\c:\nbhnhn.exec:\nbhnhn.exe69⤵PID:2388
-
\??\c:\1nbnnn.exec:\1nbnnn.exe70⤵PID:2116
-
\??\c:\vpvvd.exec:\vpvvd.exe71⤵PID:1508
-
\??\c:\lxlfrrf.exec:\lxlfrrf.exe72⤵PID:1500
-
\??\c:\rlfrffr.exec:\rlfrffr.exe73⤵PID:2284
-
\??\c:\bbnhnn.exec:\bbnhnn.exe74⤵PID:2608
-
\??\c:\5bntbb.exec:\5bntbb.exe75⤵PID:1292
-
\??\c:\pjdpv.exec:\pjdpv.exe76⤵PID:2076
-
\??\c:\pvdpv.exec:\pvdpv.exe77⤵PID:876
-
\??\c:\lffxrrf.exec:\lffxrrf.exe78⤵PID:404
-
\??\c:\9xxlfrf.exec:\9xxlfrf.exe79⤵PID:2392
-
\??\c:\nbnbbh.exec:\nbnbbh.exe80⤵PID:2412
-
\??\c:\hnbbnh.exec:\hnbbnh.exe81⤵PID:1576
-
\??\c:\dpjpv.exec:\dpjpv.exe82⤵PID:1352
-
\??\c:\pddpp.exec:\pddpp.exe83⤵PID:2420
-
\??\c:\xrflxfl.exec:\xrflxfl.exe84⤵PID:1868
-
\??\c:\rlflxfl.exec:\rlflxfl.exe85⤵PID:2488
-
\??\c:\hthtbh.exec:\hthtbh.exe86⤵PID:1276
-
\??\c:\pddpp.exec:\pddpp.exe87⤵PID:2376
-
\??\c:\dvddj.exec:\dvddj.exe88⤵PID:2308
-
\??\c:\fxlrlrx.exec:\fxlrlrx.exe89⤵PID:1432
-
\??\c:\frllffr.exec:\frllffr.exe90⤵PID:2044
-
\??\c:\bbnbhh.exec:\bbnbhh.exe91⤵PID:1544
-
\??\c:\bnthhh.exec:\bnthhh.exe92⤵PID:2424
-
\??\c:\3bnntt.exec:\3bnntt.exe93⤵PID:2696
-
\??\c:\jdvjp.exec:\jdvjp.exe94⤵PID:2100
-
\??\c:\jvppp.exec:\jvppp.exe95⤵PID:2652
-
\??\c:\lrlfrrx.exec:\lrlfrrx.exe96⤵PID:1696
-
\??\c:\rlfllrx.exec:\rlfllrx.exe97⤵PID:2212
-
\??\c:\1bbtbn.exec:\1bbtbn.exe98⤵PID:1304
-
\??\c:\bnnhbb.exec:\bnnhbb.exe99⤵PID:2252
-
\??\c:\vjdjv.exec:\vjdjv.exe100⤵PID:2296
-
\??\c:\rlxfllr.exec:\rlxfllr.exe101⤵PID:2804
-
\??\c:\xrrxffl.exec:\xrrxffl.exe102⤵PID:2812
-
\??\c:\lffffff.exec:\lffffff.exe103⤵PID:2740
-
\??\c:\tthnnn.exec:\tthnnn.exe104⤵PID:3068
-
\??\c:\hhtttt.exec:\hhtttt.exe105⤵PID:2544
-
\??\c:\dpjjv.exec:\dpjjv.exe106⤵PID:2532
-
\??\c:\9dpdp.exec:\9dpdp.exe107⤵PID:2684
-
\??\c:\3xfrxxf.exec:\3xfrxxf.exe108⤵PID:2632
-
\??\c:\7xlxlll.exec:\7xlxlll.exe109⤵PID:2028
-
\??\c:\bbbthn.exec:\bbbthn.exe110⤵PID:2844
-
\??\c:\ththhb.exec:\ththhb.exe111⤵PID:2952
-
\??\c:\jdjvd.exec:\jdjvd.exe112⤵PID:3020
-
\??\c:\1vppv.exec:\1vppv.exe113⤵PID:3016
-
\??\c:\rxlxxxr.exec:\rxlxxxr.exe114⤵PID:888
-
\??\c:\nbnbht.exec:\nbnbht.exe115⤵PID:1312
-
\??\c:\tnhtbb.exec:\tnhtbb.exe116⤵PID:1940
-
\??\c:\3ppjv.exec:\3ppjv.exe117⤵PID:2572
-
\??\c:\1dppj.exec:\1dppj.exe118⤵PID:1768
-
\??\c:\fxrlxxf.exec:\fxrlxxf.exe119⤵PID:2688
-
\??\c:\frflrxf.exec:\frflrxf.exe120⤵PID:2840
-
\??\c:\5tnhnt.exec:\5tnhnt.exe121⤵PID:2752
-
\??\c:\7bttbb.exec:\7bttbb.exe122⤵PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-