Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 09:34
Behavioral task
behavioral1
Sample
759de19fb373dc3534170033d679fe730a327e290f199120e893660b791f1092_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
759de19fb373dc3534170033d679fe730a327e290f199120e893660b791f1092_NeikiAnalytics.exe
-
Size
176KB
-
MD5
f1f434b436f067345da5a874e6638d50
-
SHA1
7a4718e9bcfe07b663a1e3288a8f8cbc7c9a5686
-
SHA256
759de19fb373dc3534170033d679fe730a327e290f199120e893660b791f1092
-
SHA512
50edb45fd52c39a922641604119ebc7e46ff08640fa56d6a5505891643e49ba78509bc801cbc8b23f6baca79366b12a787877ad5f2457ff8f00e9cedc1ecb92b
-
SSDEEP
3072:6hOmTsF93UYfwC6GIoutQ0tSe5yLpcka62c+8+dRNN7Yk+6C2Wb:6cm4FmowdHoSQ0tH6lCXb7Ybb
Malware Config
Signatures
-
Detect Blackmoon payload 35 IoCs
resource yara_rule behavioral1/memory/2372-11-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2180-7-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/3044-20-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2668-29-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2840-48-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2832-57-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2944-44-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2548-74-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2712-71-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/3016-90-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1644-101-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2884-111-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2608-123-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/3036-120-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1828-137-0x0000000000440000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/1452-156-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2716-159-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2520-193-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2116-209-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2348-227-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2268-294-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2052-296-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2404-309-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2848-358-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2664-365-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2664-372-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2820-452-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/988-518-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1028-544-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1932-572-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2352-593-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2380-617-0x0000000000220000-0x0000000000252000-memory.dmp family_blackmoon behavioral1/memory/2916-637-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1624-727-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1600-898-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2372 fxlfrfr.exe 3044 frrrllx.exe 2668 bthtbh.exe 2944 hhnthn.exe 2840 vddvp.exe 2832 1pjpj.exe 2712 7xlflrr.exe 2548 hnhbbn.exe 3016 hbhthn.exe 1644 9bhntt.exe 2884 lfxfrrx.exe 3036 7hhntb.exe 2608 3vdjp.exe 1828 rlxlllf.exe 2020 bbnbtt.exe 1452 ppjpv.exe 2716 9fllrrf.exe 1508 fffrxxf.exe 2156 9hthbn.exe 2316 vpjpd.exe 2520 7rllxxf.exe 2116 xrlrxll.exe 484 btnhbb.exe 1084 jjjvj.exe 2348 rrflxff.exe 1776 nhthtb.exe 1324 jjvjv.exe 2932 llfrxlx.exe 2192 btnthn.exe 1804 jdpvd.exe 848 3xrrflx.exe 2268 nhbntt.exe 2052 jdvjv.exe 2164 xlxflrf.exe 2404 xrllrfl.exe 2748 1htntb.exe 2764 vvpvv.exe 1592 dvjjj.exe 2824 xrlrxrx.exe 2304 xrfrxxl.exe 2756 nhtbhh.exe 2300 nnbttb.exe 2848 1djpp.exe 2664 jdddp.exe 2540 xrfllrr.exe 1404 bntbhb.exe 2080 5htnbh.exe 2864 jdvvj.exe 2772 5lxxxxf.exe 2884 rrfrxfl.exe 376 hbnbbn.exe 1756 pjjvp.exe 296 xrllrrf.exe 1652 xrlxfxl.exe 2020 5hbhtt.exe 2208 dvvvv.exe 2820 5jjvj.exe 2716 lfffrlr.exe 1416 1lflrrf.exe 2032 nnhtbh.exe 2312 jpvdd.exe 2836 jjdpv.exe 2520 ffxflrf.exe 332 3nntht.exe -
resource yara_rule behavioral1/memory/2180-0-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x000b0000000122ee-8.dat upx behavioral1/memory/2372-11-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2180-7-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/3044-20-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2668-29-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0007000000015d89-27.dat upx behavioral1/files/0x0008000000015d99-35.dat upx behavioral1/memory/2840-48-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2944-36-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0007000000015fbb-46.dat upx behavioral1/files/0x0007000000016126-64.dat upx behavioral1/memory/2832-57-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0007000000016020-55.dat upx behavioral1/memory/2944-44-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2548-74-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x000800000001640f-73.dat upx behavioral1/memory/2712-71-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0037000000015d02-18.dat upx behavioral1/files/0x0006000000016d21-82.dat upx behavioral1/memory/3016-90-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000016d2d-91.dat upx behavioral1/memory/1644-92-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000016d36-99.dat upx behavioral1/memory/1644-101-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2884-102-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2884-111-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000016d3e-109.dat upx behavioral1/files/0x0006000000016d46-118.dat upx behavioral1/memory/2608-123-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/3036-120-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000016d4f-129.dat upx behavioral1/memory/1828-137-0x0000000000440000-0x0000000000472000-memory.dmp upx behavioral1/files/0x0006000000016d57-138.dat upx behavioral1/memory/2020-140-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000016d5f-147.dat upx behavioral1/files/0x0006000000016d73-155.dat upx behavioral1/memory/1452-156-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2716-159-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000016d79-164.dat upx behavioral1/files/0x0006000000016d7d-172.dat upx behavioral1/memory/2156-175-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000016fa9-182.dat upx behavioral1/files/0x000600000001708c-190.dat upx behavioral1/memory/2520-193-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x00060000000171ad-199.dat upx behavioral1/files/0x000600000001738e-210.dat upx behavioral1/memory/2116-209-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x000600000001738f-217.dat upx behavioral1/files/0x00060000000173e2-225.dat upx behavioral1/memory/2348-227-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0036000000015d13-234.dat upx behavioral1/files/0x00060000000173e5-242.dat upx behavioral1/files/0x0006000000017436-251.dat upx behavioral1/memory/2932-252-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x00060000000174ef-260.dat upx behavioral1/memory/2192-261-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000017577-269.dat upx behavioral1/files/0x00060000000175f7-277.dat upx behavioral1/memory/848-278-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x00060000000175fd-286.dat upx behavioral1/memory/2268-294-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2052-296-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2404-309-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2372 2180 759de19fb373dc3534170033d679fe730a327e290f199120e893660b791f1092_NeikiAnalytics.exe 28 PID 2180 wrote to memory of 2372 2180 759de19fb373dc3534170033d679fe730a327e290f199120e893660b791f1092_NeikiAnalytics.exe 28 PID 2180 wrote to memory of 2372 2180 759de19fb373dc3534170033d679fe730a327e290f199120e893660b791f1092_NeikiAnalytics.exe 28 PID 2180 wrote to memory of 2372 2180 759de19fb373dc3534170033d679fe730a327e290f199120e893660b791f1092_NeikiAnalytics.exe 28 PID 2372 wrote to memory of 3044 2372 fxlfrfr.exe 29 PID 2372 wrote to memory of 3044 2372 fxlfrfr.exe 29 PID 2372 wrote to memory of 3044 2372 fxlfrfr.exe 29 PID 2372 wrote to memory of 3044 2372 fxlfrfr.exe 29 PID 3044 wrote to memory of 2668 3044 frrrllx.exe 30 PID 3044 wrote to memory of 2668 3044 frrrllx.exe 30 PID 3044 wrote to memory of 2668 3044 frrrllx.exe 30 PID 3044 wrote to memory of 2668 3044 frrrllx.exe 30 PID 2668 wrote to memory of 2944 2668 bthtbh.exe 31 PID 2668 wrote to memory of 2944 2668 bthtbh.exe 31 PID 2668 wrote to memory of 2944 2668 bthtbh.exe 31 PID 2668 wrote to memory of 2944 2668 bthtbh.exe 31 PID 2944 wrote to memory of 2840 2944 hhnthn.exe 32 PID 2944 wrote to memory of 2840 2944 hhnthn.exe 32 PID 2944 wrote to memory of 2840 2944 hhnthn.exe 32 PID 2944 wrote to memory of 2840 2944 hhnthn.exe 32 PID 2840 wrote to memory of 2832 2840 vddvp.exe 33 PID 2840 wrote to memory of 2832 2840 vddvp.exe 33 PID 2840 wrote to memory of 2832 2840 vddvp.exe 33 PID 2840 wrote to memory of 2832 2840 vddvp.exe 33 PID 2832 wrote to memory of 2712 2832 1pjpj.exe 34 PID 2832 wrote to memory of 2712 2832 1pjpj.exe 34 PID 2832 wrote to memory of 2712 2832 1pjpj.exe 34 PID 2832 wrote to memory of 2712 2832 1pjpj.exe 34 PID 2712 wrote to memory of 2548 2712 7xlflrr.exe 35 PID 2712 wrote to memory of 2548 2712 7xlflrr.exe 35 PID 2712 wrote to memory of 2548 2712 7xlflrr.exe 35 PID 2712 wrote to memory of 2548 2712 7xlflrr.exe 35 PID 2548 wrote to memory of 3016 2548 hnhbbn.exe 36 PID 2548 wrote to memory of 3016 2548 hnhbbn.exe 36 PID 2548 wrote to memory of 3016 2548 hnhbbn.exe 36 PID 2548 wrote to memory of 3016 2548 hnhbbn.exe 36 PID 3016 wrote to memory of 1644 3016 hbhthn.exe 37 PID 3016 wrote to memory of 1644 3016 hbhthn.exe 37 PID 3016 wrote to memory of 1644 3016 hbhthn.exe 37 PID 3016 wrote to memory of 1644 3016 hbhthn.exe 37 PID 1644 wrote to memory of 2884 1644 9bhntt.exe 38 PID 1644 wrote to memory of 2884 1644 9bhntt.exe 38 PID 1644 wrote to memory of 2884 1644 9bhntt.exe 38 PID 1644 wrote to memory of 2884 1644 9bhntt.exe 38 PID 2884 wrote to memory of 3036 2884 lfxfrrx.exe 39 PID 2884 wrote to memory of 3036 2884 lfxfrrx.exe 39 PID 2884 wrote to memory of 3036 2884 lfxfrrx.exe 39 PID 2884 wrote to memory of 3036 2884 lfxfrrx.exe 39 PID 3036 wrote to memory of 2608 3036 7hhntb.exe 40 PID 3036 wrote to memory of 2608 3036 7hhntb.exe 40 PID 3036 wrote to memory of 2608 3036 7hhntb.exe 40 PID 3036 wrote to memory of 2608 3036 7hhntb.exe 40 PID 2608 wrote to memory of 1828 2608 3vdjp.exe 41 PID 2608 wrote to memory of 1828 2608 3vdjp.exe 41 PID 2608 wrote to memory of 1828 2608 3vdjp.exe 41 PID 2608 wrote to memory of 1828 2608 3vdjp.exe 41 PID 1828 wrote to memory of 2020 1828 rlxlllf.exe 42 PID 1828 wrote to memory of 2020 1828 rlxlllf.exe 42 PID 1828 wrote to memory of 2020 1828 rlxlllf.exe 42 PID 1828 wrote to memory of 2020 1828 rlxlllf.exe 42 PID 2020 wrote to memory of 1452 2020 bbnbtt.exe 43 PID 2020 wrote to memory of 1452 2020 bbnbtt.exe 43 PID 2020 wrote to memory of 1452 2020 bbnbtt.exe 43 PID 2020 wrote to memory of 1452 2020 bbnbtt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\759de19fb373dc3534170033d679fe730a327e290f199120e893660b791f1092_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\759de19fb373dc3534170033d679fe730a327e290f199120e893660b791f1092_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\fxlfrfr.exec:\fxlfrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\frrrllx.exec:\frrrllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\bthtbh.exec:\bthtbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\hhnthn.exec:\hhnthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\vddvp.exec:\vddvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\1pjpj.exec:\1pjpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\7xlflrr.exec:\7xlflrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\hnhbbn.exec:\hnhbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\hbhthn.exec:\hbhthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\9bhntt.exec:\9bhntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\lfxfrrx.exec:\lfxfrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\7hhntb.exec:\7hhntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\3vdjp.exec:\3vdjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\rlxlllf.exec:\rlxlllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\bbnbtt.exec:\bbnbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\ppjpv.exec:\ppjpv.exe17⤵
- Executes dropped EXE
PID:1452 -
\??\c:\9fllrrf.exec:\9fllrrf.exe18⤵
- Executes dropped EXE
PID:2716 -
\??\c:\fffrxxf.exec:\fffrxxf.exe19⤵
- Executes dropped EXE
PID:1508 -
\??\c:\9hthbn.exec:\9hthbn.exe20⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vpjpd.exec:\vpjpd.exe21⤵
- Executes dropped EXE
PID:2316 -
\??\c:\7rllxxf.exec:\7rllxxf.exe22⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xrlrxll.exec:\xrlrxll.exe23⤵
- Executes dropped EXE
PID:2116 -
\??\c:\btnhbb.exec:\btnhbb.exe24⤵
- Executes dropped EXE
PID:484 -
\??\c:\jjjvj.exec:\jjjvj.exe25⤵
- Executes dropped EXE
PID:1084 -
\??\c:\rrflxff.exec:\rrflxff.exe26⤵
- Executes dropped EXE
PID:2348 -
\??\c:\nhthtb.exec:\nhthtb.exe27⤵
- Executes dropped EXE
PID:1776 -
\??\c:\jjvjv.exec:\jjvjv.exe28⤵
- Executes dropped EXE
PID:1324 -
\??\c:\llfrxlx.exec:\llfrxlx.exe29⤵
- Executes dropped EXE
PID:2932 -
\??\c:\btnthn.exec:\btnthn.exe30⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jdpvd.exec:\jdpvd.exe31⤵
- Executes dropped EXE
PID:1804 -
\??\c:\3xrrflx.exec:\3xrrflx.exe32⤵
- Executes dropped EXE
PID:848 -
\??\c:\nhbntt.exec:\nhbntt.exe33⤵
- Executes dropped EXE
PID:2268 -
\??\c:\jdvjv.exec:\jdvjv.exe34⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xlxflrf.exec:\xlxflrf.exe35⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xrllrfl.exec:\xrllrfl.exe36⤵
- Executes dropped EXE
PID:2404 -
\??\c:\1htntb.exec:\1htntb.exe37⤵
- Executes dropped EXE
PID:2748 -
\??\c:\vvpvv.exec:\vvpvv.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\dvjjj.exec:\dvjjj.exe39⤵
- Executes dropped EXE
PID:1592 -
\??\c:\xrlrxrx.exec:\xrlrxrx.exe40⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xrfrxxl.exec:\xrfrxxl.exe41⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nhtbhh.exec:\nhtbhh.exe42⤵
- Executes dropped EXE
PID:2756 -
\??\c:\nnbttb.exec:\nnbttb.exe43⤵
- Executes dropped EXE
PID:2300 -
\??\c:\1djpp.exec:\1djpp.exe44⤵
- Executes dropped EXE
PID:2848 -
\??\c:\jdddp.exec:\jdddp.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xrfllrr.exec:\xrfllrr.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\bntbhb.exec:\bntbhb.exe47⤵
- Executes dropped EXE
PID:1404 -
\??\c:\5htnbh.exec:\5htnbh.exe48⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jdvvj.exec:\jdvvj.exe49⤵
- Executes dropped EXE
PID:2864 -
\??\c:\5lxxxxf.exec:\5lxxxxf.exe50⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rrfrxfl.exec:\rrfrxfl.exe51⤵
- Executes dropped EXE
PID:2884 -
\??\c:\hbnbbn.exec:\hbnbbn.exe52⤵
- Executes dropped EXE
PID:376 -
\??\c:\pjjvp.exec:\pjjvp.exe53⤵
- Executes dropped EXE
PID:1756 -
\??\c:\xrllrrf.exec:\xrllrrf.exe54⤵
- Executes dropped EXE
PID:296 -
\??\c:\xrlxfxl.exec:\xrlxfxl.exe55⤵
- Executes dropped EXE
PID:1652 -
\??\c:\5hbhtt.exec:\5hbhtt.exe56⤵
- Executes dropped EXE
PID:2020 -
\??\c:\dvvvv.exec:\dvvvv.exe57⤵
- Executes dropped EXE
PID:2208 -
\??\c:\5jjvj.exec:\5jjvj.exe58⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lfffrlr.exec:\lfffrlr.exe59⤵
- Executes dropped EXE
PID:2716 -
\??\c:\1lflrrf.exec:\1lflrrf.exe60⤵
- Executes dropped EXE
PID:1416 -
\??\c:\nnhtbh.exec:\nnhtbh.exe61⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jpvdd.exec:\jpvdd.exe62⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jjdpv.exec:\jjdpv.exe63⤵
- Executes dropped EXE
PID:2836 -
\??\c:\ffxflrf.exec:\ffxflrf.exe64⤵
- Executes dropped EXE
PID:2520 -
\??\c:\3nntht.exec:\3nntht.exe65⤵
- Executes dropped EXE
PID:332 -
\??\c:\3nbbnn.exec:\3nbbnn.exe66⤵PID:668
-
\??\c:\dvddj.exec:\dvddj.exe67⤵PID:1492
-
\??\c:\vppvv.exec:\vppvv.exe68⤵PID:2360
-
\??\c:\lffxxrf.exec:\lffxxrf.exe69⤵PID:988
-
\??\c:\1nbhbh.exec:\1nbhbh.exe70⤵PID:896
-
\??\c:\hbbntb.exec:\hbbntb.exe71⤵PID:108
-
\??\c:\dpvvd.exec:\dpvvd.exe72⤵PID:1028
-
\??\c:\jjdjv.exec:\jjdjv.exe73⤵PID:1800
-
\??\c:\lfxxxfl.exec:\lfxxxfl.exe74⤵PID:2144
-
\??\c:\5nnhbb.exec:\5nnhbb.exe75⤵PID:1200
-
\??\c:\pjvpd.exec:\pjvpd.exe76⤵PID:1932
-
\??\c:\vjppv.exec:\vjppv.exe77⤵PID:2000
-
\??\c:\xlxxffl.exec:\xlxxffl.exe78⤵PID:2004
-
\??\c:\hbnthh.exec:\hbnthh.exe79⤵PID:2052
-
\??\c:\5bbhtb.exec:\5bbhtb.exe80⤵PID:2352
-
\??\c:\jdpvv.exec:\jdpvv.exe81⤵PID:2092
-
\??\c:\5dvdp.exec:\5dvdp.exe82⤵PID:2740
-
\??\c:\rlffffl.exec:\rlffffl.exe83⤵PID:2380
-
\??\c:\1btbhb.exec:\1btbhb.exe84⤵PID:2860
-
\??\c:\7nhntt.exec:\7nhntt.exe85⤵PID:2824
-
\??\c:\9dvdp.exec:\9dvdp.exe86⤵PID:2916
-
\??\c:\frfffll.exec:\frfffll.exe87⤵PID:2648
-
\??\c:\hbnbtt.exec:\hbnbtt.exe88⤵PID:2300
-
\??\c:\bbnnbb.exec:\bbnnbb.exe89⤵PID:2568
-
\??\c:\dvdvd.exec:\dvdvd.exe90⤵PID:2672
-
\??\c:\dvjjv.exec:\dvjjv.exe91⤵PID:2704
-
\??\c:\rrrflrf.exec:\rrrflrf.exe92⤵PID:2284
-
\??\c:\bbtbht.exec:\bbtbht.exe93⤵PID:2792
-
\??\c:\hbbbtt.exec:\hbbbtt.exe94⤵PID:2896
-
\??\c:\dvpvj.exec:\dvpvj.exe95⤵PID:2780
-
\??\c:\lfxflrx.exec:\lfxflrx.exe96⤵PID:2600
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe97⤵PID:1628
-
\??\c:\nhbtbb.exec:\nhbtbb.exe98⤵PID:276
-
\??\c:\pjvvd.exec:\pjvvd.exe99⤵PID:1964
-
\??\c:\vpdvj.exec:\vpdvj.exe100⤵PID:2240
-
\??\c:\rfrlxxl.exec:\rfrlxxl.exe101⤵PID:1624
-
\??\c:\1xrxfxr.exec:\1xrxfxr.exe102⤵PID:1832
-
\??\c:\tnhnbh.exec:\tnhnbh.exe103⤵PID:2808
-
\??\c:\hbnttb.exec:\hbnttb.exe104⤵PID:1516
-
\??\c:\3vpvj.exec:\3vpvj.exe105⤵PID:1236
-
\??\c:\7rflrfl.exec:\7rflrfl.exe106⤵PID:2156
-
\??\c:\lfrrllr.exec:\lfrrllr.exe107⤵PID:2316
-
\??\c:\nhttnb.exec:\nhttnb.exe108⤵PID:1732
-
\??\c:\9bhhnt.exec:\9bhhnt.exe109⤵PID:2968
-
\??\c:\jjvjj.exec:\jjvjj.exe110⤵PID:748
-
\??\c:\1vddv.exec:\1vddv.exe111⤵PID:1308
-
\??\c:\5rrlllr.exec:\5rrlllr.exe112⤵PID:2132
-
\??\c:\3fxllxl.exec:\3fxllxl.exe113⤵PID:1316
-
\??\c:\3btthn.exec:\3btthn.exe114⤵PID:1536
-
\??\c:\9jpdv.exec:\9jpdv.exe115⤵PID:1708
-
\??\c:\vpddd.exec:\vpddd.exe116⤵PID:1880
-
\??\c:\1lffllx.exec:\1lffllx.exe117⤵PID:1028
-
\??\c:\tntntb.exec:\tntntb.exe118⤵PID:2192
-
\??\c:\hbbhnt.exec:\hbbhnt.exe119⤵PID:1636
-
\??\c:\jdjpd.exec:\jdjpd.exe120⤵PID:2468
-
\??\c:\llxlrxr.exec:\llxlrxr.exe121⤵PID:848
-
\??\c:\flxfrlx.exec:\flxfrlx.exe122⤵PID:2992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-