Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 00:00
Behavioral task
behavioral1
Sample
5b92f2427a5f93964fe212e9de9e57c0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5b92f2427a5f93964fe212e9de9e57c0_NeikiAnalytics.exe
-
Size
380KB
-
MD5
5b92f2427a5f93964fe212e9de9e57c0
-
SHA1
fb2db1205ec31fa018bca8bf442fb0079d243d30
-
SHA256
0d9407c8ca4f9e784de928b19a0e5db1ca585c4eba052cc4731ddb42dc88a446
-
SHA512
4e156955cd9b959aea88c505626f915521e817b2debbea7ba0b061bc542796be084e8d3722bc98dff3979208788b9e89183d063971648f8f08ec8aff1fb1226c
-
SSDEEP
6144:Ocm4FmowdHoSsm4FIc1/cm4FmowdHoSsiNlcJcmHYC9/jvvfwL+TLPfSRcm4FVoM:w4wFHoSl4h4wFHoS24yTgL+zfu4/FHoE
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/3040-9-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2044-11-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2044-18-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2516-28-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2900-38-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2540-48-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2656-56-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2664-67-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2468-69-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2468-77-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2452-94-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2864-113-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2696-105-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/944-125-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1780-143-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1880-152-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/944-133-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1404-183-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1404-182-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/772-192-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2172-173-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1608-163-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1984-212-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/636-203-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2808-232-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1544-242-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1432-275-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2972-292-0x0000000001CB0000-0x0000000001D22000-memory.dmp family_blackmoon behavioral1/memory/940-303-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1592-318-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2908-326-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2536-353-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2556-360-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2548-372-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2848-392-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2848-391-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1800-405-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1612-440-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1740-449-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1740-447-0x00000000002C0000-0x0000000000332000-memory.dmp family_blackmoon behavioral1/memory/2160-457-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1364-456-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2160-464-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/476-472-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/268-471-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/476-480-0x0000000000480000-0x00000000004F2000-memory.dmp family_blackmoon behavioral1/memory/476-479-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/476-478-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1944-487-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2112-488-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2112-495-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2688-503-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/652-502-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2688-511-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/3056-519-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1692-518-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/3056-525-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1544-528-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/3056-527-0x0000000001CD0000-0x0000000001D42000-memory.dmp family_blackmoon behavioral1/memory/3056-526-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1544-536-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/776-543-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/776-544-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1140-553-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2044 9vjpj.exe 2516 lflrxxl.exe 2900 1tnhhn.exe 2540 xlrfxll.exe 2656 pdpdj.exe 2664 fxrrfll.exe 2468 tttbhn.exe 2568 rfxfllr.exe 2452 dpjpd.exe 2696 5vpdp.exe 2864 htbnth.exe 320 hhbtbn.exe 944 3xrlllx.exe 1780 nhtttb.exe 1880 jvdjj.exe 1608 dvpvd.exe 2172 7lxfrrx.exe 1404 1xrrxfr.exe 772 bthhnh.exe 636 5xrfrfx.exe 1984 9rrfxxr.exe 444 bbbthn.exe 2808 jvjjp.exe 1544 fffxfxx.exe 780 jdpdj.exe 2932 lfxfxfx.exe 1104 7thnbh.exe 1432 dvvpd.exe 564 rlxlxrx.exe 2972 3bnnnn.exe 940 rlxxlrl.exe 3040 hnbtht.exe 1592 fxlrxff.exe 2908 lrrfllx.exe 2252 hbtnbb.exe 2576 jjdpd.exe 2728 pjvpd.exe 2536 xrrflxr.exe 2620 xrllxfx.exe 2556 hbthnt.exe 2548 pvpvj.exe 2468 vpdjv.exe 2464 rrllxxf.exe 2848 tnhhtt.exe 2968 ttnthn.exe 1800 vpjvv.exe 2204 rlxxlrx.exe 1616 7flrffr.exe 1676 btbntt.exe 2188 pvpjv.exe 1612 7rrxxrx.exe 1740 bttbhn.exe 1364 pjpdv.exe 2160 rlxrxlx.exe 268 dpddd.exe 476 jdpjj.exe 1944 nhhntb.exe 2112 vjvdj.exe 652 lffrxlr.exe 2688 5dpdv.exe 1692 lfffffl.exe 3056 tnnthh.exe 1544 3fxrflx.exe 776 nhthth.exe -
resource yara_rule behavioral1/memory/3040-0-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x000b000000014abe-6.dat upx behavioral1/memory/3040-9-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2044-11-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0009000000015018-19.dat upx behavioral1/memory/2044-18-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/3040-3-0x0000000001CF0000-0x0000000001D62000-memory.dmp upx behavioral1/files/0x0008000000015605-26.dat upx behavioral1/memory/2900-29-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2516-28-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0007000000015616-36.dat upx behavioral1/memory/2900-38-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2540-39-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0007000000015626-46.dat upx behavioral1/memory/2540-48-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0007000000015b6f-57.dat upx behavioral1/memory/2656-56-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2664-58-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2664-67-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2468-69-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0008000000015c52-68.dat upx behavioral1/files/0x0009000000015c78-75.dat upx behavioral1/memory/2468-77-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2568-78-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0007000000015c83-87.dat upx behavioral1/memory/2696-96-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0007000000015c9f-95.dat upx behavioral1/memory/2452-94-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0009000000015cb6-102.dat upx behavioral1/memory/320-115-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0008000000015cce-114.dat upx behavioral1/memory/2864-113-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2696-105-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0006000000015cee-122.dat upx behavioral1/memory/944-125-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0006000000015cf6-135.dat upx behavioral1/memory/1780-134-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/1880-145-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0006000000015cfe-144.dat upx behavioral1/memory/1780-143-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0006000000015d07-153.dat upx behavioral1/memory/1608-154-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/1880-152-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/944-133-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2172-165-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x00090000000155ed-171.dat upx behavioral1/memory/1404-174-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0006000000015d1a-184.dat upx behavioral1/memory/1404-183-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/636-194-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0006000000015d27-193.dat upx behavioral1/memory/772-192-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/1404-177-0x0000000000220000-0x0000000000292000-memory.dmp upx behavioral1/memory/2172-173-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0006000000015d0f-164.dat upx behavioral1/memory/1608-163-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0006000000015d31-201.dat upx behavioral1/memory/1984-205-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0006000000015d98-213.dat upx behavioral1/memory/1984-212-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/636-203-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0006000000015df1-224.dat upx behavioral1/memory/1544-233-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/2808-232-0x0000000000400000-0x0000000000472000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2044 3040 5b92f2427a5f93964fe212e9de9e57c0_NeikiAnalytics.exe 28 PID 3040 wrote to memory of 2044 3040 5b92f2427a5f93964fe212e9de9e57c0_NeikiAnalytics.exe 28 PID 3040 wrote to memory of 2044 3040 5b92f2427a5f93964fe212e9de9e57c0_NeikiAnalytics.exe 28 PID 3040 wrote to memory of 2044 3040 5b92f2427a5f93964fe212e9de9e57c0_NeikiAnalytics.exe 28 PID 2044 wrote to memory of 2516 2044 9vjpj.exe 29 PID 2044 wrote to memory of 2516 2044 9vjpj.exe 29 PID 2044 wrote to memory of 2516 2044 9vjpj.exe 29 PID 2044 wrote to memory of 2516 2044 9vjpj.exe 29 PID 2516 wrote to memory of 2900 2516 lflrxxl.exe 30 PID 2516 wrote to memory of 2900 2516 lflrxxl.exe 30 PID 2516 wrote to memory of 2900 2516 lflrxxl.exe 30 PID 2516 wrote to memory of 2900 2516 lflrxxl.exe 30 PID 2900 wrote to memory of 2540 2900 1tnhhn.exe 31 PID 2900 wrote to memory of 2540 2900 1tnhhn.exe 31 PID 2900 wrote to memory of 2540 2900 1tnhhn.exe 31 PID 2900 wrote to memory of 2540 2900 1tnhhn.exe 31 PID 2540 wrote to memory of 2656 2540 xlrfxll.exe 32 PID 2540 wrote to memory of 2656 2540 xlrfxll.exe 32 PID 2540 wrote to memory of 2656 2540 xlrfxll.exe 32 PID 2540 wrote to memory of 2656 2540 xlrfxll.exe 32 PID 2656 wrote to memory of 2664 2656 pdpdj.exe 33 PID 2656 wrote to memory of 2664 2656 pdpdj.exe 33 PID 2656 wrote to memory of 2664 2656 pdpdj.exe 33 PID 2656 wrote to memory of 2664 2656 pdpdj.exe 33 PID 2664 wrote to memory of 2468 2664 fxrrfll.exe 69 PID 2664 wrote to memory of 2468 2664 fxrrfll.exe 69 PID 2664 wrote to memory of 2468 2664 fxrrfll.exe 69 PID 2664 wrote to memory of 2468 2664 fxrrfll.exe 69 PID 2468 wrote to memory of 2568 2468 tttbhn.exe 35 PID 2468 wrote to memory of 2568 2468 tttbhn.exe 35 PID 2468 wrote to memory of 2568 2468 tttbhn.exe 35 PID 2468 wrote to memory of 2568 2468 tttbhn.exe 35 PID 2568 wrote to memory of 2452 2568 rfxfllr.exe 36 PID 2568 wrote to memory of 2452 2568 rfxfllr.exe 36 PID 2568 wrote to memory of 2452 2568 rfxfllr.exe 36 PID 2568 wrote to memory of 2452 2568 rfxfllr.exe 36 PID 2452 wrote to memory of 2696 2452 dpjpd.exe 37 PID 2452 wrote to memory of 2696 2452 dpjpd.exe 37 PID 2452 wrote to memory of 2696 2452 dpjpd.exe 37 PID 2452 wrote to memory of 2696 2452 dpjpd.exe 37 PID 2696 wrote to memory of 2864 2696 5vpdp.exe 38 PID 2696 wrote to memory of 2864 2696 5vpdp.exe 38 PID 2696 wrote to memory of 2864 2696 5vpdp.exe 38 PID 2696 wrote to memory of 2864 2696 5vpdp.exe 38 PID 2864 wrote to memory of 320 2864 htbnth.exe 39 PID 2864 wrote to memory of 320 2864 htbnth.exe 39 PID 2864 wrote to memory of 320 2864 htbnth.exe 39 PID 2864 wrote to memory of 320 2864 htbnth.exe 39 PID 320 wrote to memory of 944 320 hhbtbn.exe 40 PID 320 wrote to memory of 944 320 hhbtbn.exe 40 PID 320 wrote to memory of 944 320 hhbtbn.exe 40 PID 320 wrote to memory of 944 320 hhbtbn.exe 40 PID 944 wrote to memory of 1780 944 3xrlllx.exe 41 PID 944 wrote to memory of 1780 944 3xrlllx.exe 41 PID 944 wrote to memory of 1780 944 3xrlllx.exe 41 PID 944 wrote to memory of 1780 944 3xrlllx.exe 41 PID 1780 wrote to memory of 1880 1780 nhtttb.exe 42 PID 1780 wrote to memory of 1880 1780 nhtttb.exe 42 PID 1780 wrote to memory of 1880 1780 nhtttb.exe 42 PID 1780 wrote to memory of 1880 1780 nhtttb.exe 42 PID 1880 wrote to memory of 1608 1880 jvdjj.exe 43 PID 1880 wrote to memory of 1608 1880 jvdjj.exe 43 PID 1880 wrote to memory of 1608 1880 jvdjj.exe 43 PID 1880 wrote to memory of 1608 1880 jvdjj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b92f2427a5f93964fe212e9de9e57c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5b92f2427a5f93964fe212e9de9e57c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\9vjpj.exec:\9vjpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\lflrxxl.exec:\lflrxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\1tnhhn.exec:\1tnhhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\xlrfxll.exec:\xlrfxll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\pdpdj.exec:\pdpdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\fxrrfll.exec:\fxrrfll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\tttbhn.exec:\tttbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\rfxfllr.exec:\rfxfllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\dpjpd.exec:\dpjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\5vpdp.exec:\5vpdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\htbnth.exec:\htbnth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\hhbtbn.exec:\hhbtbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\3xrlllx.exec:\3xrlllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\nhtttb.exec:\nhtttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\jvdjj.exec:\jvdjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\dvpvd.exec:\dvpvd.exe17⤵
- Executes dropped EXE
PID:1608 -
\??\c:\7lxfrrx.exec:\7lxfrrx.exe18⤵
- Executes dropped EXE
PID:2172 -
\??\c:\1xrrxfr.exec:\1xrrxfr.exe19⤵
- Executes dropped EXE
PID:1404 -
\??\c:\bthhnh.exec:\bthhnh.exe20⤵
- Executes dropped EXE
PID:772 -
\??\c:\5xrfrfx.exec:\5xrfrfx.exe21⤵
- Executes dropped EXE
PID:636 -
\??\c:\9rrfxxr.exec:\9rrfxxr.exe22⤵
- Executes dropped EXE
PID:1984 -
\??\c:\bbbthn.exec:\bbbthn.exe23⤵
- Executes dropped EXE
PID:444 -
\??\c:\jvjjp.exec:\jvjjp.exe24⤵
- Executes dropped EXE
PID:2808 -
\??\c:\fffxfxx.exec:\fffxfxx.exe25⤵
- Executes dropped EXE
PID:1544 -
\??\c:\jdpdj.exec:\jdpdj.exe26⤵
- Executes dropped EXE
PID:780 -
\??\c:\lfxfxfx.exec:\lfxfxfx.exe27⤵
- Executes dropped EXE
PID:2932 -
\??\c:\7thnbh.exec:\7thnbh.exe28⤵
- Executes dropped EXE
PID:1104 -
\??\c:\dvvpd.exec:\dvvpd.exe29⤵
- Executes dropped EXE
PID:1432 -
\??\c:\rlxlxrx.exec:\rlxlxrx.exe30⤵
- Executes dropped EXE
PID:564 -
\??\c:\3bnnnn.exec:\3bnnnn.exe31⤵
- Executes dropped EXE
PID:2972 -
\??\c:\rlxxlrl.exec:\rlxxlrl.exe32⤵
- Executes dropped EXE
PID:940 -
\??\c:\hnbtht.exec:\hnbtht.exe33⤵
- Executes dropped EXE
PID:3040 -
\??\c:\fxlrxff.exec:\fxlrxff.exe34⤵
- Executes dropped EXE
PID:1592 -
\??\c:\lrrfllx.exec:\lrrfllx.exe35⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hbtnbb.exec:\hbtnbb.exe36⤵
- Executes dropped EXE
PID:2252 -
\??\c:\jjdpd.exec:\jjdpd.exe37⤵
- Executes dropped EXE
PID:2576 -
\??\c:\pjvpd.exec:\pjvpd.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xrrflxr.exec:\xrrflxr.exe39⤵
- Executes dropped EXE
PID:2536 -
\??\c:\xrllxfx.exec:\xrllxfx.exe40⤵
- Executes dropped EXE
PID:2620 -
\??\c:\hbthnt.exec:\hbthnt.exe41⤵
- Executes dropped EXE
PID:2556 -
\??\c:\pvpvj.exec:\pvpvj.exe42⤵
- Executes dropped EXE
PID:2548 -
\??\c:\vpdjv.exec:\vpdjv.exe43⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rrllxxf.exec:\rrllxxf.exe44⤵
- Executes dropped EXE
PID:2464 -
\??\c:\tnhhtt.exec:\tnhhtt.exe45⤵
- Executes dropped EXE
PID:2848 -
\??\c:\ttnthn.exec:\ttnthn.exe46⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vpjvv.exec:\vpjvv.exe47⤵
- Executes dropped EXE
PID:1800 -
\??\c:\rlxxlrx.exec:\rlxxlrx.exe48⤵
- Executes dropped EXE
PID:2204 -
\??\c:\7flrffr.exec:\7flrffr.exe49⤵
- Executes dropped EXE
PID:1616 -
\??\c:\btbntt.exec:\btbntt.exe50⤵
- Executes dropped EXE
PID:1676 -
\??\c:\pvpjv.exec:\pvpjv.exe51⤵
- Executes dropped EXE
PID:2188 -
\??\c:\7rrxxrx.exec:\7rrxxrx.exe52⤵
- Executes dropped EXE
PID:1612 -
\??\c:\bttbhn.exec:\bttbhn.exe53⤵
- Executes dropped EXE
PID:1740 -
\??\c:\pjpdv.exec:\pjpdv.exe54⤵
- Executes dropped EXE
PID:1364 -
\??\c:\rlxrxlx.exec:\rlxrxlx.exe55⤵
- Executes dropped EXE
PID:2160 -
\??\c:\dpddd.exec:\dpddd.exe56⤵
- Executes dropped EXE
PID:268 -
\??\c:\jdpjj.exec:\jdpjj.exe57⤵
- Executes dropped EXE
PID:476 -
\??\c:\nhhntb.exec:\nhhntb.exe58⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vjvdj.exec:\vjvdj.exe59⤵
- Executes dropped EXE
PID:2112 -
\??\c:\lffrxlr.exec:\lffrxlr.exe60⤵
- Executes dropped EXE
PID:652 -
\??\c:\5dpdv.exec:\5dpdv.exe61⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lfffffl.exec:\lfffffl.exe62⤵
- Executes dropped EXE
PID:1692 -
\??\c:\tnnthh.exec:\tnnthh.exe63⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3fxrflx.exec:\3fxrflx.exe64⤵
- Executes dropped EXE
PID:1544 -
\??\c:\nhthth.exec:\nhthth.exe65⤵
- Executes dropped EXE
PID:776 -
\??\c:\9bttnt.exec:\9bttnt.exe66⤵PID:2336
-
\??\c:\9nhnnt.exec:\9nhnnt.exe67⤵PID:1140
-
\??\c:\lrfrlrf.exec:\lrfrlrf.exe68⤵PID:2348
-
\??\c:\lffxrlx.exec:\lffxrlx.exe69⤵PID:2084
-
\??\c:\hbnbbt.exec:\hbnbbt.exe70⤵PID:2964
-
\??\c:\vdpdd.exec:\vdpdd.exe71⤵PID:3048
-
\??\c:\frlrfrr.exec:\frlrfrr.exe72⤵PID:2980
-
\??\c:\rrffxfl.exec:\rrffxfl.exe73⤵PID:1152
-
\??\c:\5vvdp.exec:\5vvdp.exe74⤵PID:2768
-
\??\c:\3hhbnt.exec:\3hhbnt.exe75⤵PID:860
-
\??\c:\3rfrxfx.exec:\3rfrxfx.exe76⤵PID:1588
-
\??\c:\bbnnbh.exec:\bbnnbh.exe77⤵PID:2584
-
\??\c:\1ttnht.exec:\1ttnht.exe78⤵PID:1704
-
\??\c:\7vjvp.exec:\7vjvp.exe79⤵PID:2152
-
\??\c:\dpdvd.exec:\dpdvd.exe80⤵PID:2736
-
\??\c:\9xrflxl.exec:\9xrflxl.exe81⤵PID:2484
-
\??\c:\1nthtt.exec:\1nthtt.exe82⤵PID:2456
-
\??\c:\1tntnt.exec:\1tntnt.exe83⤵PID:2468
-
\??\c:\dddjv.exec:\dddjv.exe84⤵PID:2452
-
\??\c:\rlfrfrf.exec:\rlfrfrf.exe85⤵PID:2848
-
\??\c:\nnhhtb.exec:\nnhhtb.exe86⤵PID:948
-
\??\c:\nhnbbh.exec:\nhnbbh.exe87⤵PID:2184
-
\??\c:\dpjpp.exec:\dpjpp.exe88⤵PID:1268
-
\??\c:\dvppd.exec:\dvppd.exe89⤵PID:1652
-
\??\c:\rlfrllf.exec:\rlfrllf.exe90⤵PID:1732
-
\??\c:\1hhntb.exec:\1hhntb.exe91⤵PID:2192
-
\??\c:\tnhtbb.exec:\tnhtbb.exe92⤵PID:2188
-
\??\c:\lxrxlfr.exec:\lxrxlfr.exe93⤵PID:936
-
\??\c:\7xxxlfl.exec:\7xxxlfl.exe94⤵PID:2164
-
\??\c:\tttbhn.exec:\tttbhn.exe95⤵PID:1520
-
\??\c:\7nbbbb.exec:\7nbbbb.exe96⤵PID:1404
-
\??\c:\pjdjv.exec:\pjdjv.exe97⤵PID:2612
-
\??\c:\1fxxrlr.exec:\1fxxrlr.exe98⤵PID:2052
-
\??\c:\xxlxlrf.exec:\xxlxlrf.exe99⤵PID:2076
-
\??\c:\hbttbh.exec:\hbttbh.exe100⤵PID:1760
-
\??\c:\ddvpj.exec:\ddvpj.exe101⤵PID:1496
-
\??\c:\pppjd.exec:\pppjd.exe102⤵PID:636
-
\??\c:\lrrfrfr.exec:\lrrfrfr.exe103⤵PID:1988
-
\??\c:\bnhtht.exec:\bnhtht.exe104⤵PID:2688
-
\??\c:\dvjdv.exec:\dvjdv.exe105⤵PID:2412
-
\??\c:\5jdpv.exec:\5jdpv.exe106⤵PID:1620
-
\??\c:\xrlxxrr.exec:\xrlxxrr.exe107⤵PID:1764
-
\??\c:\hhbbnt.exec:\hhbbnt.exe108⤵PID:1776
-
\??\c:\bntthb.exec:\bntthb.exe109⤵PID:780
-
\??\c:\vjvjj.exec:\vjvjj.exe110⤵PID:692
-
\??\c:\rfxxflx.exec:\rfxxflx.exe111⤵PID:608
-
\??\c:\ffxxllx.exec:\ffxxllx.exe112⤵PID:1524
-
\??\c:\7bthnb.exec:\7bthnb.exe113⤵PID:2348
-
\??\c:\jjdjp.exec:\jjdjp.exe114⤵PID:2084
-
\??\c:\pjppp.exec:\pjppp.exe115⤵PID:2144
-
\??\c:\3fffrxl.exec:\3fffrxl.exe116⤵PID:1008
-
\??\c:\1nhnbn.exec:\1nhnbn.exe117⤵PID:1052
-
\??\c:\hhhbht.exec:\hhhbht.exe118⤵PID:1592
-
\??\c:\vdvpd.exec:\vdvpd.exe119⤵PID:1152
-
\??\c:\xxrxxfl.exec:\xxrxxfl.exe120⤵PID:1276
-
\??\c:\rrllxlr.exec:\rrllxlr.exe121⤵PID:2632
-
\??\c:\nnhntb.exec:\nnhntb.exe122⤵PID:2576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-