Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 01:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4f1b579425b09dd37ba4e79ff5a72200_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4f1b579425b09dd37ba4e79ff5a72200_NeikiAnalytics.exe
-
Size
211KB
-
MD5
4f1b579425b09dd37ba4e79ff5a72200
-
SHA1
d1c513b2a3f0809e1ccea95e6a11ccdf22e1483c
-
SHA256
cfbcf45797965effe65361b7fb54c5be3745750cbd5d06c09317b0c14a4cf003
-
SHA512
b4eeb6346b6ab7dce15cbdfb04d66e8dabe62809bf74322ea3f8c0cc9f43cb8f128e0839623a9425008b3f3dd3ee99beabd91b39302e1cb7196b81682e68312d
-
SSDEEP
1536:wvQBeOGtrYSSsrc93UBIfdC67m6AJiqQfg3Cip8iXAsG5M0nj:whOm2sI93UufdC67cizfmCiiiXA/
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2556-29-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2512-57-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2440-76-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/344-122-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2540-319-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2516-356-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1532-394-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2184-407-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/604-490-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2080-1194-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2080-1202-0x00000000005C0000-0x00000000005EC000-memory.dmp family_blackmoon behavioral1/memory/2780-802-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1692-552-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1932-453-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2708-427-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/788-263-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/3068-252-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1196-235-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/980-227-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1912-202-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2212-193-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2008-175-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1084-157-0x0000000000220000-0x000000000024C000-memory.dmp family_blackmoon behavioral1/memory/1084-156-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2172-147-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2304-138-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1652-120-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1272-103-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1564-87-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2884-85-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2524-59-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2748-47-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2760-32-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2556-27-0x0000000000260000-0x000000000028C000-memory.dmp family_blackmoon behavioral1/memory/2600-19-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1568-9-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2600 lffflrx.exe 2556 bhhnnh.exe 2760 9hbtth.exe 2748 ddpdv.exe 2512 5jdjp.exe 2524 rfxfllr.exe 2440 tntbhn.exe 2884 hbtttt.exe 1564 dppdj.exe 1272 xrllrrx.exe 2720 9xflrrx.exe 1652 tnhhnt.exe 344 jdppp.exe 2304 vjpvv.exe 2172 9lxrflr.exe 1084 tnbntb.exe 3004 7nttnt.exe 2024 pjpjv.exe 2008 rlxxflr.exe 2212 5nnntb.exe 1912 hnhnbh.exe 580 vjjpj.exe 1004 fxrrxfl.exe 980 7fxrxxf.exe 1196 vppdd.exe 772 pjpdv.exe 3068 frlrxfl.exe 936 3hbnth.exe 788 pjdjp.exe 804 xrfflfr.exe 2264 nnhbth.exe 1956 3nnhtb.exe 2496 jdddj.exe 1756 xfrrrrr.exe 2548 3rfllrx.exe 1544 btnbth.exe 2540 ttthnt.exe 2692 jvjpv.exe 2528 7lrlllf.exe 2456 lfrrffl.exe 2484 thtbnn.exe 2452 bbbbtt.exe 2516 vjppv.exe 1044 jdjvv.exe 2504 1xrxrrf.exe 1288 rrlrlxf.exe 2648 tbtntb.exe 1532 vvvpp.exe 312 jppjv.exe 2184 9rllfxl.exe 2316 rfffllx.exe 2172 hbnbbn.exe 2040 htntht.exe 2708 pdvpd.exe 2976 dvjjp.exe 2508 lxxfrff.exe 1932 lfrxllr.exe 2140 hhthtb.exe 2088 ddpvd.exe 608 jjvjd.exe 796 dddjv.exe 1332 rlxxlrf.exe 604 fxfrlxl.exe 2840 tnbntt.exe -
resource yara_rule behavioral1/memory/2556-29-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2512-57-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2440-76-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2720-104-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/344-122-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2540-319-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2516-356-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1532-394-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2184-407-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2976-434-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/604-490-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2376-503-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2304-968-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1952-1092-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2548-1149-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2080-1194-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1592-1246-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2144-1265-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1788-1227-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2636-1169-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2384-1018-0x00000000003C0000-0x00000000003EC000-memory.dmp upx behavioral1/memory/1432-981-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1208-961-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2588-942-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2780-802-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/676-747-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1968-716-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2280-675-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1692-552-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1932-453-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2708-427-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/804-271-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/788-263-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/3068-252-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1196-235-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/980-227-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1912-202-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2212-193-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2212-183-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2008-175-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1084-156-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2172-147-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2304-138-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1652-120-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1272-103-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1564-87-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2884-85-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2440-67-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2524-59-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2512-48-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2748-47-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2760-32-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2600-19-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2600-10-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1568-9-0x0000000000400000-0x000000000042C000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1568 wrote to memory of 2600 1568 4f1b579425b09dd37ba4e79ff5a72200_NeikiAnalytics.exe 28 PID 1568 wrote to memory of 2600 1568 4f1b579425b09dd37ba4e79ff5a72200_NeikiAnalytics.exe 28 PID 1568 wrote to memory of 2600 1568 4f1b579425b09dd37ba4e79ff5a72200_NeikiAnalytics.exe 28 PID 1568 wrote to memory of 2600 1568 4f1b579425b09dd37ba4e79ff5a72200_NeikiAnalytics.exe 28 PID 2600 wrote to memory of 2556 2600 lffflrx.exe 29 PID 2600 wrote to memory of 2556 2600 lffflrx.exe 29 PID 2600 wrote to memory of 2556 2600 lffflrx.exe 29 PID 2600 wrote to memory of 2556 2600 lffflrx.exe 29 PID 2556 wrote to memory of 2760 2556 bhhnnh.exe 30 PID 2556 wrote to memory of 2760 2556 bhhnnh.exe 30 PID 2556 wrote to memory of 2760 2556 bhhnnh.exe 30 PID 2556 wrote to memory of 2760 2556 bhhnnh.exe 30 PID 2760 wrote to memory of 2748 2760 9hbtth.exe 31 PID 2760 wrote to memory of 2748 2760 9hbtth.exe 31 PID 2760 wrote to memory of 2748 2760 9hbtth.exe 31 PID 2760 wrote to memory of 2748 2760 9hbtth.exe 31 PID 2748 wrote to memory of 2512 2748 ddpdv.exe 32 PID 2748 wrote to memory of 2512 2748 ddpdv.exe 32 PID 2748 wrote to memory of 2512 2748 ddpdv.exe 32 PID 2748 wrote to memory of 2512 2748 ddpdv.exe 32 PID 2512 wrote to memory of 2524 2512 5jdjp.exe 33 PID 2512 wrote to memory of 2524 2512 5jdjp.exe 33 PID 2512 wrote to memory of 2524 2512 5jdjp.exe 33 PID 2512 wrote to memory of 2524 2512 5jdjp.exe 33 PID 2524 wrote to memory of 2440 2524 rfxfllr.exe 34 PID 2524 wrote to memory of 2440 2524 rfxfllr.exe 34 PID 2524 wrote to memory of 2440 2524 rfxfllr.exe 34 PID 2524 wrote to memory of 2440 2524 rfxfllr.exe 34 PID 2440 wrote to memory of 2884 2440 tntbhn.exe 35 PID 2440 wrote to memory of 2884 2440 tntbhn.exe 35 PID 2440 wrote to memory of 2884 2440 tntbhn.exe 35 PID 2440 wrote to memory of 2884 2440 tntbhn.exe 35 PID 2884 wrote to memory of 1564 2884 hbtttt.exe 36 PID 2884 wrote to memory of 1564 2884 hbtttt.exe 36 PID 2884 wrote to memory of 1564 2884 hbtttt.exe 36 PID 2884 wrote to memory of 1564 2884 hbtttt.exe 36 PID 1564 wrote to memory of 1272 1564 dppdj.exe 37 PID 1564 wrote to memory of 1272 1564 dppdj.exe 37 PID 1564 wrote to memory of 1272 1564 dppdj.exe 37 PID 1564 wrote to memory of 1272 1564 dppdj.exe 37 PID 1272 wrote to memory of 2720 1272 xrllrrx.exe 38 PID 1272 wrote to memory of 2720 1272 xrllrrx.exe 38 PID 1272 wrote to memory of 2720 1272 xrllrrx.exe 38 PID 1272 wrote to memory of 2720 1272 xrllrrx.exe 38 PID 2720 wrote to memory of 1652 2720 9xflrrx.exe 39 PID 2720 wrote to memory of 1652 2720 9xflrrx.exe 39 PID 2720 wrote to memory of 1652 2720 9xflrrx.exe 39 PID 2720 wrote to memory of 1652 2720 9xflrrx.exe 39 PID 1652 wrote to memory of 344 1652 tnhhnt.exe 40 PID 1652 wrote to memory of 344 1652 tnhhnt.exe 40 PID 1652 wrote to memory of 344 1652 tnhhnt.exe 40 PID 1652 wrote to memory of 344 1652 tnhhnt.exe 40 PID 344 wrote to memory of 2304 344 jdppp.exe 41 PID 344 wrote to memory of 2304 344 jdppp.exe 41 PID 344 wrote to memory of 2304 344 jdppp.exe 41 PID 344 wrote to memory of 2304 344 jdppp.exe 41 PID 2304 wrote to memory of 2172 2304 vjpvv.exe 42 PID 2304 wrote to memory of 2172 2304 vjpvv.exe 42 PID 2304 wrote to memory of 2172 2304 vjpvv.exe 42 PID 2304 wrote to memory of 2172 2304 vjpvv.exe 42 PID 2172 wrote to memory of 1084 2172 9lxrflr.exe 43 PID 2172 wrote to memory of 1084 2172 9lxrflr.exe 43 PID 2172 wrote to memory of 1084 2172 9lxrflr.exe 43 PID 2172 wrote to memory of 1084 2172 9lxrflr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f1b579425b09dd37ba4e79ff5a72200_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4f1b579425b09dd37ba4e79ff5a72200_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\lffflrx.exec:\lffflrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\bhhnnh.exec:\bhhnnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\9hbtth.exec:\9hbtth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\ddpdv.exec:\ddpdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\5jdjp.exec:\5jdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\rfxfllr.exec:\rfxfllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\tntbhn.exec:\tntbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\hbtttt.exec:\hbtttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\dppdj.exec:\dppdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\xrllrrx.exec:\xrllrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\9xflrrx.exec:\9xflrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\tnhhnt.exec:\tnhhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\jdppp.exec:\jdppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\vjpvv.exec:\vjpvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\9lxrflr.exec:\9lxrflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\tnbntb.exec:\tnbntb.exe17⤵
- Executes dropped EXE
PID:1084 -
\??\c:\7nttnt.exec:\7nttnt.exe18⤵
- Executes dropped EXE
PID:3004 -
\??\c:\pjpjv.exec:\pjpjv.exe19⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rlxxflr.exec:\rlxxflr.exe20⤵
- Executes dropped EXE
PID:2008 -
\??\c:\5nnntb.exec:\5nnntb.exe21⤵
- Executes dropped EXE
PID:2212 -
\??\c:\hnhnbh.exec:\hnhnbh.exe22⤵
- Executes dropped EXE
PID:1912 -
\??\c:\vjjpj.exec:\vjjpj.exe23⤵
- Executes dropped EXE
PID:580 -
\??\c:\fxrrxfl.exec:\fxrrxfl.exe24⤵
- Executes dropped EXE
PID:1004 -
\??\c:\7fxrxxf.exec:\7fxrxxf.exe25⤵
- Executes dropped EXE
PID:980 -
\??\c:\vppdd.exec:\vppdd.exe26⤵
- Executes dropped EXE
PID:1196 -
\??\c:\pjpdv.exec:\pjpdv.exe27⤵
- Executes dropped EXE
PID:772 -
\??\c:\frlrxfl.exec:\frlrxfl.exe28⤵
- Executes dropped EXE
PID:3068 -
\??\c:\3hbnth.exec:\3hbnth.exe29⤵
- Executes dropped EXE
PID:936 -
\??\c:\pjdjp.exec:\pjdjp.exe30⤵
- Executes dropped EXE
PID:788 -
\??\c:\xrfflfr.exec:\xrfflfr.exe31⤵
- Executes dropped EXE
PID:804 -
\??\c:\nnhbth.exec:\nnhbth.exe32⤵
- Executes dropped EXE
PID:2264 -
\??\c:\3nnhtb.exec:\3nnhtb.exe33⤵
- Executes dropped EXE
PID:1956 -
\??\c:\jdddj.exec:\jdddj.exe34⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xfrrrrr.exec:\xfrrrrr.exe35⤵
- Executes dropped EXE
PID:1756 -
\??\c:\3rfllrx.exec:\3rfllrx.exe36⤵
- Executes dropped EXE
PID:2548 -
\??\c:\btnbth.exec:\btnbth.exe37⤵
- Executes dropped EXE
PID:1544 -
\??\c:\ttthnt.exec:\ttthnt.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jvjpv.exec:\jvjpv.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\7lrlllf.exec:\7lrlllf.exe40⤵
- Executes dropped EXE
PID:2528 -
\??\c:\lfrrffl.exec:\lfrrffl.exe41⤵
- Executes dropped EXE
PID:2456 -
\??\c:\thtbnn.exec:\thtbnn.exe42⤵
- Executes dropped EXE
PID:2484 -
\??\c:\bbbbtt.exec:\bbbbtt.exe43⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vjppv.exec:\vjppv.exe44⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jdjvv.exec:\jdjvv.exe45⤵
- Executes dropped EXE
PID:1044 -
\??\c:\1xrxrrf.exec:\1xrxrrf.exe46⤵
- Executes dropped EXE
PID:2504 -
\??\c:\rrlrlxf.exec:\rrlrlxf.exe47⤵
- Executes dropped EXE
PID:1288 -
\??\c:\tbtntb.exec:\tbtntb.exe48⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vvvpp.exec:\vvvpp.exe49⤵
- Executes dropped EXE
PID:1532 -
\??\c:\jppjv.exec:\jppjv.exe50⤵
- Executes dropped EXE
PID:312 -
\??\c:\9rllfxl.exec:\9rllfxl.exe51⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rfffllx.exec:\rfffllx.exe52⤵
- Executes dropped EXE
PID:2316 -
\??\c:\hbnbbn.exec:\hbnbbn.exe53⤵
- Executes dropped EXE
PID:2172 -
\??\c:\htntht.exec:\htntht.exe54⤵
- Executes dropped EXE
PID:2040 -
\??\c:\pdvpd.exec:\pdvpd.exe55⤵
- Executes dropped EXE
PID:2708 -
\??\c:\dvjjp.exec:\dvjjp.exe56⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lxxfrff.exec:\lxxfrff.exe57⤵
- Executes dropped EXE
PID:2508 -
\??\c:\lfrxllr.exec:\lfrxllr.exe58⤵
- Executes dropped EXE
PID:1932 -
\??\c:\hhthtb.exec:\hhthtb.exe59⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ddpvd.exec:\ddpvd.exe60⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jjvjd.exec:\jjvjd.exe61⤵
- Executes dropped EXE
PID:608 -
\??\c:\dddjv.exec:\dddjv.exe62⤵
- Executes dropped EXE
PID:796 -
\??\c:\rlxxlrf.exec:\rlxxlrf.exe63⤵
- Executes dropped EXE
PID:1332 -
\??\c:\fxfrlxl.exec:\fxfrlxl.exe64⤵
- Executes dropped EXE
PID:604 -
\??\c:\tnbntt.exec:\tnbntt.exe65⤵
- Executes dropped EXE
PID:2840 -
\??\c:\btthnn.exec:\btthnn.exe66⤵PID:1280
-
\??\c:\jjjdd.exec:\jjjdd.exe67⤵PID:2376
-
\??\c:\5jdvd.exec:\5jdvd.exe68⤵PID:1772
-
\??\c:\1fflxlr.exec:\1fflxlr.exe69⤵PID:2780
-
\??\c:\rfxrfxl.exec:\rfxrfxl.exe70⤵PID:1988
-
\??\c:\tnnnbb.exec:\tnnnbb.exe71⤵PID:644
-
\??\c:\hhhbnt.exec:\hhhbnt.exe72⤵PID:2596
-
\??\c:\dvppd.exec:\dvppd.exe73⤵PID:700
-
\??\c:\9vvdv.exec:\9vvdv.exe74⤵PID:916
-
\??\c:\lfxllrf.exec:\lfxllrf.exe75⤵PID:1692
-
\??\c:\rlflxxr.exec:\rlflxxr.exe76⤵PID:1552
-
\??\c:\lffrffr.exec:\lffrffr.exe77⤵PID:2872
-
\??\c:\hhbbnh.exec:\hhbbnh.exe78⤵PID:2220
-
\??\c:\tnhnhn.exec:\tnhnhn.exe79⤵PID:1756
-
\??\c:\vppdj.exec:\vppdj.exe80⤵PID:1536
-
\??\c:\vvvvj.exec:\vvvvj.exe81⤵PID:2536
-
\??\c:\frrxrfx.exec:\frrxrfx.exe82⤵PID:2208
-
\??\c:\1rxxxfr.exec:\1rxxxfr.exe83⤵PID:2432
-
\??\c:\nnhbbt.exec:\nnhbbt.exe84⤵PID:924
-
\??\c:\btbnbh.exec:\btbnbh.exe85⤵PID:2240
-
\??\c:\dvjjd.exec:\dvjjd.exe86⤵PID:2524
-
\??\c:\dppdv.exec:\dppdv.exe87⤵PID:2080
-
\??\c:\lflfrxr.exec:\lflfrxr.exe88⤵PID:2440
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe89⤵PID:2396
-
\??\c:\9bbntn.exec:\9bbntn.exe90⤵PID:2656
-
\??\c:\9bntth.exec:\9bntth.exe91⤵PID:1648
-
\??\c:\1hhtht.exec:\1hhtht.exe92⤵PID:1528
-
\??\c:\vpjdd.exec:\vpjdd.exe93⤵PID:2720
-
\??\c:\1dvdj.exec:\1dvdj.exe94⤵PID:2532
-
\??\c:\9xfxffr.exec:\9xfxffr.exe95⤵PID:2280
-
\??\c:\fxrfxlr.exec:\fxrfxlr.exe96⤵PID:344
-
\??\c:\hbhhtb.exec:\hbhhtb.exe97⤵PID:2164
-
\??\c:\nbhbtn.exec:\nbhbtn.exe98⤵PID:1084
-
\??\c:\9pvdj.exec:\9pvdj.exe99⤵PID:2028
-
\??\c:\7ddjj.exec:\7ddjj.exe100⤵PID:240
-
\??\c:\lfxlrlf.exec:\lfxlrlf.exe101⤵PID:1968
-
\??\c:\5nnhtb.exec:\5nnhtb.exe102⤵PID:1616
-
\??\c:\nnntbt.exec:\nnntbt.exe103⤵PID:2384
-
\??\c:\ddpdp.exec:\ddpdp.exe104⤵PID:320
-
\??\c:\vvvjd.exec:\vvvjd.exe105⤵PID:540
-
\??\c:\rrllrrr.exec:\rrllrrr.exe106⤵PID:676
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe107⤵PID:1576
-
\??\c:\bthbnh.exec:\bthbnh.exe108⤵PID:1820
-
\??\c:\1bbnth.exec:\1bbnth.exe109⤵PID:1268
-
\??\c:\pppvd.exec:\pppvd.exe110⤵PID:2960
-
\??\c:\vddpp.exec:\vddpp.exe111⤵PID:404
-
\??\c:\5flrflr.exec:\5flrflr.exe112⤵PID:1828
-
\??\c:\3xlflrx.exec:\3xlflrx.exe113⤵PID:1412
-
\??\c:\hhtthb.exec:\hhtthb.exe114⤵PID:984
-
\??\c:\nhttbb.exec:\nhttbb.exe115⤵PID:2780
-
\??\c:\hhnbtb.exec:\hhnbtb.exe116⤵PID:2036
-
\??\c:\jjvjv.exec:\jjvjv.exe117⤵PID:488
-
\??\c:\9jjpv.exec:\9jjpv.exe118⤵PID:2332
-
\??\c:\rllxrxx.exec:\rllxrxx.exe119⤵PID:788
-
\??\c:\5rrfrrx.exec:\5rrfrrx.exe120⤵PID:2352
-
\??\c:\tnbtnh.exec:\tnbtnh.exe121⤵PID:1444
-
\??\c:\ppdjp.exec:\ppdjp.exe122⤵PID:1440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-