Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 01:43
Behavioral task
behavioral1
Sample
1e4396f9762910d948b9ac3f4d102440_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1e4396f9762910d948b9ac3f4d102440_NeikiAnalytics.exe
-
Size
234KB
-
MD5
1e4396f9762910d948b9ac3f4d102440
-
SHA1
c36446138cd462cef6a226a8697217558adbb933
-
SHA256
42a3e7b46f0cde7079020d42b5915a357b32a8ddc7ac9661dcc88921b2136a85
-
SHA512
26e9690e006f8b4ff8b647483b3eed9bd2dcf237e5bf8bc9915c14abd1a800ea661bd18feed11ad8dabd6f407fcc1415e6c8e518a6e3498a5a20b84429fb740a
-
SSDEEP
6144:kcm4FmowdHoSSGpJw4PqhraHcpOmFTHDGYhEf5X2a1:y4wFHoSSGpJwGeeFmFTNAp2G
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2212-0-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2732-7-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2124-12-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/5044-23-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2000-31-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3248-38-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2236-60-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1132-95-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4336-103-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4436-142-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3328-159-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1516-204-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1728-249-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1112-262-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/5028-265-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/764-273-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1848-277-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1840-281-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3968-294-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3296-348-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/5048-357-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3604-402-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/464-419-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/972-470-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3988-490-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2284-510-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1428-447-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4448-413-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4972-391-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4092-352-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3052-269-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3724-257-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4836-239-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/752-229-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4948-224-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2976-213-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2384-209-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2056-199-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3296-194-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4572-172-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2216-167-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2868-148-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3504-133-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/684-127-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2428-114-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3464-101-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3044-86-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2448-82-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4360-66-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/752-50-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2992-48-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2284-33-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1160-538-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1196-545-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2916-552-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4060-566-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1956-584-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/408-664-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1812-673-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1108-681-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2824-708-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2124-775-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1728-867-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1728-871-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2732 frlfxxx.exe 2124 frxrfrl.exe 5044 httnhb.exe 2000 dvjdp.exe 2284 djpjd.exe 3248 lxxxlfl.exe 2992 hhthhb.exe 752 9vdvd.exe 2236 jdddj.exe 4360 lrrlfxr.exe 2596 9hnhbt.exe 2864 5pvvp.exe 2448 dpvpj.exe 3044 frxrllr.exe 1132 tnnhtt.exe 3464 pjdvj.exe 4336 fxlflfl.exe 2428 7ntnnt.exe 876 pjjjd.exe 2856 7ppjd.exe 684 rxfffll.exe 3504 hthhnh.exe 4436 ppvpj.exe 2868 frxrflf.exe 4608 frllfxx.exe 3328 bnbtnh.exe 2216 pvpjd.exe 3024 xfxxxxx.exe 4572 lxxrlrf.exe 432 tnntnb.exe 1164 ppddp.exe 4372 9lrffff.exe 3296 lxxrllf.exe 2056 bhbbnn.exe 1516 vjdvp.exe 4708 7ffxrlf.exe 2384 xrxxxxf.exe 2976 ththth.exe 1608 3hhnhb.exe 1104 vvdvj.exe 4948 jddvj.exe 752 rrxfxfr.exe 3556 hbtnnn.exe 2480 nbnnhh.exe 4972 dpvvv.exe 4836 1rlrrff.exe 2864 xxxrlrx.exe 1728 bbnhhh.exe 2448 tthbtt.exe 3724 vpjdv.exe 1112 3fxlffr.exe 5028 xxxfffr.exe 3052 ntbtnn.exe 764 7hnhbt.exe 1848 vvdvp.exe 2792 pvddd.exe 1840 rffrrrf.exe 4664 bnbhbn.exe 4884 vvdvp.exe 3968 jdpjd.exe 216 xrlrfxl.exe 1968 rrlffxx.exe 1588 bhhtbt.exe 3228 dvppd.exe -
resource yara_rule behavioral2/memory/2212-0-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0008000000023297-3.dat upx behavioral2/memory/2732-7-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0008000000023451-9.dat upx behavioral2/memory/2124-12-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023455-13.dat upx behavioral2/memory/5044-18-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023456-24.dat upx behavioral2/memory/5044-23-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2000-25-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023458-29.dat upx behavioral2/memory/2000-31-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3248-38-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x000700000002345a-43.dat upx behavioral2/files/0x000700000002345b-46.dat upx behavioral2/files/0x000700000002345c-55.dat upx behavioral2/files/0x000700000002345d-61.dat upx behavioral2/memory/2236-60-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2864-73-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023461-83.dat upx behavioral2/files/0x0007000000023463-93.dat upx behavioral2/memory/1132-95-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4336-103-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023467-118.dat upx behavioral2/files/0x0007000000023468-125.dat upx behavioral2/files/0x0007000000023469-131.dat upx behavioral2/files/0x000700000002346a-137.dat upx behavioral2/memory/4436-142-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x000700000002346b-143.dat upx behavioral2/files/0x000700000002346c-149.dat upx behavioral2/memory/3328-159-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x000700000002297b-175.dat upx behavioral2/files/0x0008000000023452-180.dat upx behavioral2/memory/2056-195-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1516-204-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1728-249-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3724-253-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1112-262-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/5028-265-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/764-273-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1848-277-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1840-281-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3968-294-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4084-307-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3576-314-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1996-327-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1800-334-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3296-348-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/5048-357-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3604-402-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/464-419-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/972-470-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1996-477-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3988-490-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2440-503-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2284-510-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2144-454-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1428-447-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4448-413-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3604-398-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4972-391-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/5048-353-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4092-352-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3296-344-0x0000000000400000-0x0000000000437000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2732 2212 1e4396f9762910d948b9ac3f4d102440_NeikiAnalytics.exe 84 PID 2212 wrote to memory of 2732 2212 1e4396f9762910d948b9ac3f4d102440_NeikiAnalytics.exe 84 PID 2212 wrote to memory of 2732 2212 1e4396f9762910d948b9ac3f4d102440_NeikiAnalytics.exe 84 PID 2732 wrote to memory of 2124 2732 frlfxxx.exe 85 PID 2732 wrote to memory of 2124 2732 frlfxxx.exe 85 PID 2732 wrote to memory of 2124 2732 frlfxxx.exe 85 PID 2124 wrote to memory of 5044 2124 frxrfrl.exe 86 PID 2124 wrote to memory of 5044 2124 frxrfrl.exe 86 PID 2124 wrote to memory of 5044 2124 frxrfrl.exe 86 PID 5044 wrote to memory of 2000 5044 httnhb.exe 87 PID 5044 wrote to memory of 2000 5044 httnhb.exe 87 PID 5044 wrote to memory of 2000 5044 httnhb.exe 87 PID 2000 wrote to memory of 2284 2000 dvjdp.exe 214 PID 2000 wrote to memory of 2284 2000 dvjdp.exe 214 PID 2000 wrote to memory of 2284 2000 dvjdp.exe 214 PID 2284 wrote to memory of 3248 2284 djpjd.exe 89 PID 2284 wrote to memory of 3248 2284 djpjd.exe 89 PID 2284 wrote to memory of 3248 2284 djpjd.exe 89 PID 3248 wrote to memory of 2992 3248 lxxxlfl.exe 90 PID 3248 wrote to memory of 2992 3248 lxxxlfl.exe 90 PID 3248 wrote to memory of 2992 3248 lxxxlfl.exe 90 PID 2992 wrote to memory of 752 2992 hhthhb.exe 91 PID 2992 wrote to memory of 752 2992 hhthhb.exe 91 PID 2992 wrote to memory of 752 2992 hhthhb.exe 91 PID 752 wrote to memory of 2236 752 9vdvd.exe 92 PID 752 wrote to memory of 2236 752 9vdvd.exe 92 PID 752 wrote to memory of 2236 752 9vdvd.exe 92 PID 2236 wrote to memory of 4360 2236 jdddj.exe 221 PID 2236 wrote to memory of 4360 2236 jdddj.exe 221 PID 2236 wrote to memory of 4360 2236 jdddj.exe 221 PID 4360 wrote to memory of 2596 4360 lrrlfxr.exe 95 PID 4360 wrote to memory of 2596 4360 lrrlfxr.exe 95 PID 4360 wrote to memory of 2596 4360 lrrlfxr.exe 95 PID 2596 wrote to memory of 2864 2596 9hnhbt.exe 97 PID 2596 wrote to memory of 2864 2596 9hnhbt.exe 97 PID 2596 wrote to memory of 2864 2596 9hnhbt.exe 97 PID 2864 wrote to memory of 2448 2864 5pvvp.exe 136 PID 2864 wrote to memory of 2448 2864 5pvvp.exe 136 PID 2864 wrote to memory of 2448 2864 5pvvp.exe 136 PID 2448 wrote to memory of 3044 2448 dpvpj.exe 100 PID 2448 wrote to memory of 3044 2448 dpvpj.exe 100 PID 2448 wrote to memory of 3044 2448 dpvpj.exe 100 PID 3044 wrote to memory of 1132 3044 frxrllr.exe 102 PID 3044 wrote to memory of 1132 3044 frxrllr.exe 102 PID 3044 wrote to memory of 1132 3044 frxrllr.exe 102 PID 1132 wrote to memory of 3464 1132 tnnhtt.exe 103 PID 1132 wrote to memory of 3464 1132 tnnhtt.exe 103 PID 1132 wrote to memory of 3464 1132 tnnhtt.exe 103 PID 3464 wrote to memory of 4336 3464 pjdvj.exe 104 PID 3464 wrote to memory of 4336 3464 pjdvj.exe 104 PID 3464 wrote to memory of 4336 3464 pjdvj.exe 104 PID 4336 wrote to memory of 2428 4336 fxlflfl.exe 105 PID 4336 wrote to memory of 2428 4336 fxlflfl.exe 105 PID 4336 wrote to memory of 2428 4336 fxlflfl.exe 105 PID 2428 wrote to memory of 876 2428 7ntnnt.exe 106 PID 2428 wrote to memory of 876 2428 7ntnnt.exe 106 PID 2428 wrote to memory of 876 2428 7ntnnt.exe 106 PID 876 wrote to memory of 2856 876 pjjjd.exe 107 PID 876 wrote to memory of 2856 876 pjjjd.exe 107 PID 876 wrote to memory of 2856 876 pjjjd.exe 107 PID 2856 wrote to memory of 684 2856 7ppjd.exe 108 PID 2856 wrote to memory of 684 2856 7ppjd.exe 108 PID 2856 wrote to memory of 684 2856 7ppjd.exe 108 PID 684 wrote to memory of 3504 684 rxfffll.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e4396f9762910d948b9ac3f4d102440_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1e4396f9762910d948b9ac3f4d102440_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\frlfxxx.exec:\frlfxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\frxrfrl.exec:\frxrfrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\httnhb.exec:\httnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\dvjdp.exec:\dvjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\djpjd.exec:\djpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\lxxxlfl.exec:\lxxxlfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\hhthhb.exec:\hhthhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\9vdvd.exec:\9vdvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\jdddj.exec:\jdddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\9hnhbt.exec:\9hnhbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\5pvvp.exec:\5pvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\dpvpj.exec:\dpvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\frxrllr.exec:\frxrllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\tnnhtt.exec:\tnnhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\pjdvj.exec:\pjdvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\fxlflfl.exec:\fxlflfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\7ntnnt.exec:\7ntnnt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\pjjjd.exec:\pjjjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\7ppjd.exec:\7ppjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\rxfffll.exec:\rxfffll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\hthhnh.exec:\hthhnh.exe23⤵
- Executes dropped EXE
PID:3504 -
\??\c:\ppvpj.exec:\ppvpj.exe24⤵
- Executes dropped EXE
PID:4436 -
\??\c:\frxrflf.exec:\frxrflf.exe25⤵
- Executes dropped EXE
PID:2868 -
\??\c:\frllfxx.exec:\frllfxx.exe26⤵
- Executes dropped EXE
PID:4608 -
\??\c:\bnbtnh.exec:\bnbtnh.exe27⤵
- Executes dropped EXE
PID:3328 -
\??\c:\pvpjd.exec:\pvpjd.exe28⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xfxxxxx.exec:\xfxxxxx.exe29⤵
- Executes dropped EXE
PID:3024 -
\??\c:\lxxrlrf.exec:\lxxrlrf.exe30⤵
- Executes dropped EXE
PID:4572 -
\??\c:\tnntnb.exec:\tnntnb.exe31⤵
- Executes dropped EXE
PID:432 -
\??\c:\ppddp.exec:\ppddp.exe32⤵
- Executes dropped EXE
PID:1164 -
\??\c:\9lrffff.exec:\9lrffff.exe33⤵
- Executes dropped EXE
PID:4372 -
\??\c:\lxxrllf.exec:\lxxrllf.exe34⤵
- Executes dropped EXE
PID:3296 -
\??\c:\bhbbnn.exec:\bhbbnn.exe35⤵
- Executes dropped EXE
PID:2056 -
\??\c:\vjdvp.exec:\vjdvp.exe36⤵
- Executes dropped EXE
PID:1516 -
\??\c:\7ffxrlf.exec:\7ffxrlf.exe37⤵
- Executes dropped EXE
PID:4708 -
\??\c:\xrxxxxf.exec:\xrxxxxf.exe38⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ththth.exec:\ththth.exe39⤵
- Executes dropped EXE
PID:2976 -
\??\c:\3hhnhb.exec:\3hhnhb.exe40⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vvdvj.exec:\vvdvj.exe41⤵
- Executes dropped EXE
PID:1104 -
\??\c:\jddvj.exec:\jddvj.exe42⤵
- Executes dropped EXE
PID:4948 -
\??\c:\rrxfxfr.exec:\rrxfxfr.exe43⤵
- Executes dropped EXE
PID:752 -
\??\c:\hbtnnn.exec:\hbtnnn.exe44⤵
- Executes dropped EXE
PID:3556 -
\??\c:\nbnnhh.exec:\nbnnhh.exe45⤵
- Executes dropped EXE
PID:2480 -
\??\c:\dpvvv.exec:\dpvvv.exe46⤵
- Executes dropped EXE
PID:4972 -
\??\c:\1rlrrff.exec:\1rlrrff.exe47⤵
- Executes dropped EXE
PID:4836 -
\??\c:\xxxrlrx.exec:\xxxrlrx.exe48⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bbnhhh.exec:\bbnhhh.exe49⤵
- Executes dropped EXE
PID:1728 -
\??\c:\tthbtt.exec:\tthbtt.exe50⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vpjdv.exec:\vpjdv.exe51⤵
- Executes dropped EXE
PID:3724 -
\??\c:\3fxlffr.exec:\3fxlffr.exe52⤵
- Executes dropped EXE
PID:1112 -
\??\c:\xxxfffr.exec:\xxxfffr.exe53⤵
- Executes dropped EXE
PID:5028 -
\??\c:\ntbtnn.exec:\ntbtnn.exe54⤵
- Executes dropped EXE
PID:3052 -
\??\c:\7hnhbt.exec:\7hnhbt.exe55⤵
- Executes dropped EXE
PID:764 -
\??\c:\vvdvp.exec:\vvdvp.exe56⤵
- Executes dropped EXE
PID:1848 -
\??\c:\pvddd.exec:\pvddd.exe57⤵
- Executes dropped EXE
PID:2792 -
\??\c:\rffrrrf.exec:\rffrrrf.exe58⤵
- Executes dropped EXE
PID:1840 -
\??\c:\bnbhbn.exec:\bnbhbn.exe59⤵
- Executes dropped EXE
PID:4664 -
\??\c:\vvdvp.exec:\vvdvp.exe60⤵
- Executes dropped EXE
PID:4884 -
\??\c:\jdpjd.exec:\jdpjd.exe61⤵
- Executes dropped EXE
PID:3968 -
\??\c:\xrlrfxl.exec:\xrlrfxl.exe62⤵
- Executes dropped EXE
PID:216 -
\??\c:\rrlffxx.exec:\rrlffxx.exe63⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bhhtbt.exec:\bhhtbt.exe64⤵
- Executes dropped EXE
PID:1588 -
\??\c:\dvppd.exec:\dvppd.exe65⤵
- Executes dropped EXE
PID:3228 -
\??\c:\dpvpj.exec:\dpvpj.exe66⤵PID:4084
-
\??\c:\jjjdd.exec:\jjjdd.exe67⤵PID:548
-
\??\c:\lffxrrl.exec:\lffxrrl.exe68⤵PID:3576
-
\??\c:\tnbntt.exec:\tnbntt.exe69⤵PID:972
-
\??\c:\httnhh.exec:\httnhh.exe70⤵PID:3012
-
\??\c:\1pvpj.exec:\1pvpj.exe71⤵PID:4904
-
\??\c:\jddvp.exec:\jddvp.exe72⤵PID:1996
-
\??\c:\xlxrxrx.exec:\xlxrxrx.exe73⤵PID:5096
-
\??\c:\3xxrllf.exec:\3xxrllf.exe74⤵PID:1800
-
\??\c:\ntnbtt.exec:\ntnbtt.exe75⤵PID:3988
-
\??\c:\tbbtnh.exec:\tbbtnh.exe76⤵PID:2212
-
\??\c:\pppjj.exec:\pppjj.exe77⤵PID:3296
-
\??\c:\5pvvv.exec:\5pvvv.exe78⤵PID:4092
-
\??\c:\xrfxrlf.exec:\xrfxrlf.exe79⤵PID:5048
-
\??\c:\9lffxxl.exec:\9lffxxl.exe80⤵PID:4960
-
\??\c:\bnhtbh.exec:\bnhtbh.exe81⤵PID:868
-
\??\c:\nhhtnh.exec:\nhhtnh.exe82⤵PID:4008
-
\??\c:\vjjvp.exec:\vjjvp.exe83⤵PID:736
-
\??\c:\vjpjd.exec:\vjpjd.exe84⤵PID:968
-
\??\c:\rffrlxx.exec:\rffrlxx.exe85⤵PID:2632
-
\??\c:\lffrfxx.exec:\lffrfxx.exe86⤵PID:4236
-
\??\c:\3bnhtn.exec:\3bnhtn.exe87⤵PID:3232
-
\??\c:\nnbttt.exec:\nnbttt.exe88⤵PID:1316
-
\??\c:\pvddp.exec:\pvddp.exe89⤵PID:1160
-
\??\c:\7ddpd.exec:\7ddpd.exe90⤵PID:1108
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe91⤵PID:4972
-
\??\c:\lxrfxfr.exec:\lxrfxfr.exe92⤵PID:1924
-
\??\c:\3ttnnh.exec:\3ttnnh.exe93⤵PID:3604
-
\??\c:\hnbnnh.exec:\hnbnnh.exe94⤵PID:5040
-
\??\c:\3vjdp.exec:\3vjdp.exe95⤵PID:2936
-
\??\c:\1vvpv.exec:\1vvpv.exe96⤵PID:4776
-
\??\c:\xrlxxrr.exec:\xrlxxrr.exe97⤵PID:4448
-
\??\c:\lrlxlfr.exec:\lrlxlfr.exe98⤵PID:464
-
\??\c:\nnnbtn.exec:\nnnbtn.exe99⤵PID:4612
-
\??\c:\bnthbt.exec:\bnthbt.exe100⤵PID:4408
-
\??\c:\jdjdp.exec:\jdjdp.exe101⤵PID:1764
-
\??\c:\ppvjv.exec:\ppvjv.exe102⤵PID:4116
-
\??\c:\flfxlfr.exec:\flfxlfr.exe103⤵PID:1396
-
\??\c:\3fflxrl.exec:\3fflxrl.exe104⤵PID:1840
-
\??\c:\hbhtbt.exec:\hbhtbt.exe105⤵PID:1044
-
\??\c:\tnnnhh.exec:\tnnnhh.exe106⤵PID:2180
-
\??\c:\bnnbtn.exec:\bnnbtn.exe107⤵PID:1428
-
\??\c:\vvdvd.exec:\vvdvd.exe108⤵PID:4964
-
\??\c:\flrrrrl.exec:\flrrrrl.exe109⤵PID:2120
-
\??\c:\9xxllfr.exec:\9xxllfr.exe110⤵PID:2144
-
\??\c:\1hhhbb.exec:\1hhhbb.exe111⤵PID:692
-
\??\c:\tnhhtb.exec:\tnhhtb.exe112⤵PID:2948
-
\??\c:\bnbtnh.exec:\bnbtnh.exe113⤵PID:5000
-
\??\c:\3pjdv.exec:\3pjdv.exe114⤵PID:972
-
\??\c:\djjdj.exec:\djjdj.exe115⤵PID:4452
-
\??\c:\rfrlrlx.exec:\rfrlrlx.exe116⤵PID:3448
-
\??\c:\fllxrlf.exec:\fllxrlf.exe117⤵PID:1996
-
\??\c:\hnhhtn.exec:\hnhhtn.exe118⤵PID:1124
-
\??\c:\bhtnhn.exec:\bhtnhn.exe119⤵PID:316
-
\??\c:\jdvpd.exec:\jdvpd.exe120⤵PID:3988
-
\??\c:\jppjv.exec:\jppjv.exe121⤵PID:2212
-
\??\c:\lffxrrl.exec:\lffxrrl.exe122⤵PID:3812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-