Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 02:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
56b16c3b219c45bc8083d4e4904d6440_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
56b16c3b219c45bc8083d4e4904d6440_NeikiAnalytics.exe
-
Size
182KB
-
MD5
56b16c3b219c45bc8083d4e4904d6440
-
SHA1
97b452375ba28f4d2e486ecf8b984283da74f56b
-
SHA256
bc1cb1cb60312ae86d0d418783751fb5163221477f2717bc69c8af0e3ffc158c
-
SHA512
6c8d0d99b1c070a6c7b242e38bd6802f73b88a6c4d277108f307991def8e6cd1b22b120be67b202c36f8ce0ef6311a82d9acb193fc73d8a6144196746bd70cf7
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+IJPhbMqr:PhOm2sI93UufdC67ciJTm5hIU
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/1612-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1360-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/492-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/576-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/556-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-344-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1236-395-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1504-422-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-489-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1280-508-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-521-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-540-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-568-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-836-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-874-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2040-1053-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-1228-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1952 3jvdp.exe 3004 lxlxrxl.exe 2652 xxlxfrf.exe 2560 rrrlflx.exe 2552 ddvjj.exe 2788 xrflxfx.exe 2672 hhbbhh.exe 2508 nhthhb.exe 2740 jdjjp.exe 1444 5bhbbt.exe 1360 ddvvj.exe 2724 fxrfllr.exe 2700 tbbtbn.exe 380 jdvpd.exe 1648 1rffllr.exe 1744 7bhhtt.exe 2064 ppdjp.exe 2036 lllrxfr.exe 492 tbtnhb.exe 2688 ddpdv.exe 3012 xfflffr.exe 576 ntnbbt.exe 772 vvddd.exe 1972 1rrflxf.exe 2408 bhbnbn.exe 3056 jdvjv.exe 1256 7ffxffl.exe 1820 thhbnb.exe 884 pjvvj.exe 556 rlxfllr.exe 2128 7hhthh.exe 2292 hthbht.exe 2116 jdvdj.exe 2364 rrlrffl.exe 1776 nntthh.exe 1528 vpjdj.exe 1952 lfxfxxx.exe 2528 rfxxrrx.exe 2636 bnbbnb.exe 2760 1vvdp.exe 2728 xrxflll.exe 2472 fxrfrxl.exe 2552 hbthnt.exe 2944 jdppv.exe 2500 xffrflx.exe 2904 xlfrrrx.exe 1760 hbhtnt.exe 1236 9nnttb.exe 1128 pjdjv.exe 2504 9fxrffl.exe 2240 9xxxffl.exe 2120 nthtnt.exe 1504 7ppvd.exe 1016 vpjpd.exe 1436 frfrxxf.exe 2112 nhhbtt.exe 1232 3hbhnt.exe 2100 ppjvj.exe 1032 ffxrlrf.exe 2040 5htbnn.exe 2784 nhbbbt.exe 1920 1jvvv.exe 2268 lfflrrl.exe 1400 flrfffl.exe -
resource yara_rule behavioral1/memory/1612-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/492-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/576-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/556-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-344-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-357-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1236-395-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-422-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-452-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-483-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-489-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1280-508-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-521-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-540-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/900-549-0x00000000001B0000-0x00000000001D9000-memory.dmp upx behavioral1/memory/884-554-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-568-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-575-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-594-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-607-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-645-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-791-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-836-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-887-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1220-963-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-988-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-1020-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-1053-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-1108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-1151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-1158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-1177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-1192-0x00000000003C0000-0x00000000003E9000-memory.dmp upx behavioral1/memory/3052-1235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-1241-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/1548-1306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-1349-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1612 wrote to memory of 1952 1612 56b16c3b219c45bc8083d4e4904d6440_NeikiAnalytics.exe 28 PID 1612 wrote to memory of 1952 1612 56b16c3b219c45bc8083d4e4904d6440_NeikiAnalytics.exe 28 PID 1612 wrote to memory of 1952 1612 56b16c3b219c45bc8083d4e4904d6440_NeikiAnalytics.exe 28 PID 1612 wrote to memory of 1952 1612 56b16c3b219c45bc8083d4e4904d6440_NeikiAnalytics.exe 28 PID 1952 wrote to memory of 3004 1952 3jvdp.exe 29 PID 1952 wrote to memory of 3004 1952 3jvdp.exe 29 PID 1952 wrote to memory of 3004 1952 3jvdp.exe 29 PID 1952 wrote to memory of 3004 1952 3jvdp.exe 29 PID 3004 wrote to memory of 2652 3004 lxlxrxl.exe 30 PID 3004 wrote to memory of 2652 3004 lxlxrxl.exe 30 PID 3004 wrote to memory of 2652 3004 lxlxrxl.exe 30 PID 3004 wrote to memory of 2652 3004 lxlxrxl.exe 30 PID 2652 wrote to memory of 2560 2652 xxlxfrf.exe 31 PID 2652 wrote to memory of 2560 2652 xxlxfrf.exe 31 PID 2652 wrote to memory of 2560 2652 xxlxfrf.exe 31 PID 2652 wrote to memory of 2560 2652 xxlxfrf.exe 31 PID 2560 wrote to memory of 2552 2560 rrrlflx.exe 32 PID 2560 wrote to memory of 2552 2560 rrrlflx.exe 32 PID 2560 wrote to memory of 2552 2560 rrrlflx.exe 32 PID 2560 wrote to memory of 2552 2560 rrrlflx.exe 32 PID 2552 wrote to memory of 2788 2552 ddvjj.exe 33 PID 2552 wrote to memory of 2788 2552 ddvjj.exe 33 PID 2552 wrote to memory of 2788 2552 ddvjj.exe 33 PID 2552 wrote to memory of 2788 2552 ddvjj.exe 33 PID 2788 wrote to memory of 2672 2788 xrflxfx.exe 34 PID 2788 wrote to memory of 2672 2788 xrflxfx.exe 34 PID 2788 wrote to memory of 2672 2788 xrflxfx.exe 34 PID 2788 wrote to memory of 2672 2788 xrflxfx.exe 34 PID 2672 wrote to memory of 2508 2672 hhbbhh.exe 35 PID 2672 wrote to memory of 2508 2672 hhbbhh.exe 35 PID 2672 wrote to memory of 2508 2672 hhbbhh.exe 35 PID 2672 wrote to memory of 2508 2672 hhbbhh.exe 35 PID 2508 wrote to memory of 2740 2508 nhthhb.exe 36 PID 2508 wrote to memory of 2740 2508 nhthhb.exe 36 PID 2508 wrote to memory of 2740 2508 nhthhb.exe 36 PID 2508 wrote to memory of 2740 2508 nhthhb.exe 36 PID 2740 wrote to memory of 1444 2740 jdjjp.exe 37 PID 2740 wrote to memory of 1444 2740 jdjjp.exe 37 PID 2740 wrote to memory of 1444 2740 jdjjp.exe 37 PID 2740 wrote to memory of 1444 2740 jdjjp.exe 37 PID 1444 wrote to memory of 1360 1444 5bhbbt.exe 38 PID 1444 wrote to memory of 1360 1444 5bhbbt.exe 38 PID 1444 wrote to memory of 1360 1444 5bhbbt.exe 38 PID 1444 wrote to memory of 1360 1444 5bhbbt.exe 38 PID 1360 wrote to memory of 2724 1360 ddvvj.exe 39 PID 1360 wrote to memory of 2724 1360 ddvvj.exe 39 PID 1360 wrote to memory of 2724 1360 ddvvj.exe 39 PID 1360 wrote to memory of 2724 1360 ddvvj.exe 39 PID 2724 wrote to memory of 2700 2724 fxrfllr.exe 40 PID 2724 wrote to memory of 2700 2724 fxrfllr.exe 40 PID 2724 wrote to memory of 2700 2724 fxrfllr.exe 40 PID 2724 wrote to memory of 2700 2724 fxrfllr.exe 40 PID 2700 wrote to memory of 380 2700 tbbtbn.exe 41 PID 2700 wrote to memory of 380 2700 tbbtbn.exe 41 PID 2700 wrote to memory of 380 2700 tbbtbn.exe 41 PID 2700 wrote to memory of 380 2700 tbbtbn.exe 41 PID 380 wrote to memory of 1648 380 jdvpd.exe 42 PID 380 wrote to memory of 1648 380 jdvpd.exe 42 PID 380 wrote to memory of 1648 380 jdvpd.exe 42 PID 380 wrote to memory of 1648 380 jdvpd.exe 42 PID 1648 wrote to memory of 1744 1648 1rffllr.exe 43 PID 1648 wrote to memory of 1744 1648 1rffllr.exe 43 PID 1648 wrote to memory of 1744 1648 1rffllr.exe 43 PID 1648 wrote to memory of 1744 1648 1rffllr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\56b16c3b219c45bc8083d4e4904d6440_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\56b16c3b219c45bc8083d4e4904d6440_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\3jvdp.exec:\3jvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\lxlxrxl.exec:\lxlxrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\xxlxfrf.exec:\xxlxfrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\rrrlflx.exec:\rrrlflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\ddvjj.exec:\ddvjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\xrflxfx.exec:\xrflxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\hhbbhh.exec:\hhbbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\nhthhb.exec:\nhthhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\jdjjp.exec:\jdjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\5bhbbt.exec:\5bhbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\ddvvj.exec:\ddvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\fxrfllr.exec:\fxrfllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\tbbtbn.exec:\tbbtbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\jdvpd.exec:\jdvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\1rffllr.exec:\1rffllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\7bhhtt.exec:\7bhhtt.exe17⤵
- Executes dropped EXE
PID:1744 -
\??\c:\ppdjp.exec:\ppdjp.exe18⤵
- Executes dropped EXE
PID:2064 -
\??\c:\lllrxfr.exec:\lllrxfr.exe19⤵
- Executes dropped EXE
PID:2036 -
\??\c:\tbtnhb.exec:\tbtnhb.exe20⤵
- Executes dropped EXE
PID:492 -
\??\c:\ddpdv.exec:\ddpdv.exe21⤵
- Executes dropped EXE
PID:2688 -
\??\c:\xfflffr.exec:\xfflffr.exe22⤵
- Executes dropped EXE
PID:3012 -
\??\c:\ntnbbt.exec:\ntnbbt.exe23⤵
- Executes dropped EXE
PID:576 -
\??\c:\vvddd.exec:\vvddd.exe24⤵
- Executes dropped EXE
PID:772 -
\??\c:\1rrflxf.exec:\1rrflxf.exe25⤵
- Executes dropped EXE
PID:1972 -
\??\c:\bhbnbn.exec:\bhbnbn.exe26⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jdvjv.exec:\jdvjv.exe27⤵
- Executes dropped EXE
PID:3056 -
\??\c:\7ffxffl.exec:\7ffxffl.exe28⤵
- Executes dropped EXE
PID:1256 -
\??\c:\thhbnb.exec:\thhbnb.exe29⤵
- Executes dropped EXE
PID:1820 -
\??\c:\pjvvj.exec:\pjvvj.exe30⤵
- Executes dropped EXE
PID:884 -
\??\c:\rlxfllr.exec:\rlxfllr.exe31⤵
- Executes dropped EXE
PID:556 -
\??\c:\7hhthh.exec:\7hhthh.exe32⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hthbht.exec:\hthbht.exe33⤵
- Executes dropped EXE
PID:2292 -
\??\c:\jdvdj.exec:\jdvdj.exe34⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rrlrffl.exec:\rrlrffl.exe35⤵
- Executes dropped EXE
PID:2364 -
\??\c:\nntthh.exec:\nntthh.exe36⤵
- Executes dropped EXE
PID:1776 -
\??\c:\vpjdj.exec:\vpjdj.exe37⤵
- Executes dropped EXE
PID:1528 -
\??\c:\lfxfxxx.exec:\lfxfxxx.exe38⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rfxxrrx.exec:\rfxxrrx.exe39⤵
- Executes dropped EXE
PID:2528 -
\??\c:\bnbbnb.exec:\bnbbnb.exe40⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1vvdp.exec:\1vvdp.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xrxflll.exec:\xrxflll.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\fxrfrxl.exec:\fxrfrxl.exe43⤵
- Executes dropped EXE
PID:2472 -
\??\c:\hbthnt.exec:\hbthnt.exe44⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jdppv.exec:\jdppv.exe45⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xffrflx.exec:\xffrflx.exe46⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xlfrrrx.exec:\xlfrrrx.exe47⤵
- Executes dropped EXE
PID:2904 -
\??\c:\hbhtnt.exec:\hbhtnt.exe48⤵
- Executes dropped EXE
PID:1760 -
\??\c:\9nnttb.exec:\9nnttb.exe49⤵
- Executes dropped EXE
PID:1236 -
\??\c:\pjdjv.exec:\pjdjv.exe50⤵
- Executes dropped EXE
PID:1128 -
\??\c:\9fxrffl.exec:\9fxrffl.exe51⤵
- Executes dropped EXE
PID:2504 -
\??\c:\9xxxffl.exec:\9xxxffl.exe52⤵
- Executes dropped EXE
PID:2240 -
\??\c:\nthtnt.exec:\nthtnt.exe53⤵
- Executes dropped EXE
PID:2120 -
\??\c:\7ppvd.exec:\7ppvd.exe54⤵
- Executes dropped EXE
PID:1504 -
\??\c:\vpjpd.exec:\vpjpd.exe55⤵
- Executes dropped EXE
PID:1016 -
\??\c:\frfrxxf.exec:\frfrxxf.exe56⤵
- Executes dropped EXE
PID:1436 -
\??\c:\nhhbtt.exec:\nhhbtt.exe57⤵
- Executes dropped EXE
PID:2112 -
\??\c:\3hbhnt.exec:\3hbhnt.exe58⤵
- Executes dropped EXE
PID:1232 -
\??\c:\ppjvj.exec:\ppjvj.exe59⤵
- Executes dropped EXE
PID:2100 -
\??\c:\ffxrlrf.exec:\ffxrlrf.exe60⤵
- Executes dropped EXE
PID:1032 -
\??\c:\5htbnn.exec:\5htbnn.exe61⤵
- Executes dropped EXE
PID:2040 -
\??\c:\nhbbbt.exec:\nhbbbt.exe62⤵
- Executes dropped EXE
PID:2784 -
\??\c:\1jvvv.exec:\1jvvv.exe63⤵
- Executes dropped EXE
PID:1920 -
\??\c:\lfflrrl.exec:\lfflrrl.exe64⤵
- Executes dropped EXE
PID:2268 -
\??\c:\flrfffl.exec:\flrfffl.exe65⤵
- Executes dropped EXE
PID:1400 -
\??\c:\htthnb.exec:\htthnb.exe66⤵PID:800
-
\??\c:\ppvvj.exec:\ppvvj.exe67⤵PID:1280
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe68⤵PID:408
-
\??\c:\lfxrfxl.exec:\lfxrfxl.exe69⤵PID:1972
-
\??\c:\bbnnbn.exec:\bbnnbn.exe70⤵PID:2160
-
\??\c:\dpdjv.exec:\dpdjv.exe71⤵PID:1696
-
\??\c:\7xlllrx.exec:\7xlllrx.exe72⤵PID:1668
-
\??\c:\frflxfr.exec:\frflxfr.exe73⤵PID:1536
-
\??\c:\tnhtnn.exec:\tnhtnn.exe74⤵PID:900
-
\??\c:\jdvvv.exec:\jdvvv.exe75⤵PID:884
-
\??\c:\xlfrlxr.exec:\xlfrlxr.exe76⤵PID:556
-
\??\c:\hhnttn.exec:\hhnttn.exe77⤵PID:1656
-
\??\c:\btntnn.exec:\btntnn.exe78⤵PID:2848
-
\??\c:\7vjvp.exec:\7vjvp.exe79⤵PID:1464
-
\??\c:\fxrflrx.exec:\fxrflrx.exe80⤵PID:1780
-
\??\c:\9rrxlxl.exec:\9rrxlxl.exe81⤵PID:1616
-
\??\c:\tnhbhh.exec:\tnhbhh.exe82⤵PID:1520
-
\??\c:\pddpd.exec:\pddpd.exe83⤵PID:3040
-
\??\c:\1pppp.exec:\1pppp.exe84⤵PID:2564
-
\??\c:\7fxfxll.exec:\7fxfxll.exe85⤵PID:2544
-
\??\c:\nhnbbh.exec:\nhnbbh.exe86⤵PID:2652
-
\??\c:\tnhnhh.exec:\tnhnhh.exe87⤵PID:2816
-
\??\c:\jddjj.exec:\jddjj.exe88⤵PID:2600
-
\??\c:\dvjvd.exec:\dvjvd.exe89⤵PID:2464
-
\??\c:\ffxfxxl.exec:\ffxfxxl.exe90⤵PID:2552
-
\??\c:\bnbbnn.exec:\bnbbnn.exe91⤵PID:2788
-
\??\c:\bthntt.exec:\bthntt.exe92⤵PID:2500
-
\??\c:\ppvdv.exec:\ppvdv.exe93⤵PID:1596
-
\??\c:\lrrxrxl.exec:\lrrxrxl.exe94⤵PID:2740
-
\??\c:\1rffxxl.exec:\1rffxxl.exe95⤵PID:1160
-
\??\c:\ttnhhh.exec:\ttnhhh.exe96⤵PID:2704
-
\??\c:\tnbnth.exec:\tnbnth.exe97⤵PID:992
-
\??\c:\ppjpd.exec:\ppjpd.exe98⤵PID:1540
-
\??\c:\1xllxfl.exec:\1xllxfl.exe99⤵PID:788
-
\??\c:\flfrrxr.exec:\flfrrxr.exe100⤵PID:1244
-
\??\c:\hbbbnn.exec:\hbbbnn.exe101⤵PID:1452
-
\??\c:\dddvv.exec:\dddvv.exe102⤵PID:1556
-
\??\c:\vvddp.exec:\vvddp.exe103⤵PID:836
-
\??\c:\rxxflfx.exec:\rxxflfx.exe104⤵PID:2088
-
\??\c:\hhhhtn.exec:\hhhhtn.exe105⤵PID:2064
-
\??\c:\pddpv.exec:\pddpv.exe106⤵PID:1676
-
\??\c:\rrlxrfx.exec:\rrlxrfx.exe107⤵PID:2532
-
\??\c:\5fxfllx.exec:\5fxfllx.exe108⤵PID:2040
-
\??\c:\tnbnhn.exec:\tnbnhn.exe109⤵PID:1928
-
\??\c:\9btbht.exec:\9btbht.exe110⤵PID:1864
-
\??\c:\dvpdj.exec:\dvpdj.exe111⤵PID:2688
-
\??\c:\pvjdd.exec:\pvjdd.exe112⤵PID:1400
-
\??\c:\lxlxfxx.exec:\lxlxfxx.exe113⤵PID:2392
-
\??\c:\btbbbt.exec:\btbbbt.exe114⤵PID:2404
-
\??\c:\ppppj.exec:\ppppj.exe115⤵PID:988
-
\??\c:\lxrlrxx.exec:\lxrlrxx.exe116⤵PID:2076
-
\??\c:\rxxlxfr.exec:\rxxlxfr.exe117⤵PID:3056
-
\??\c:\tbnhht.exec:\tbnhht.exe118⤵PID:1592
-
\??\c:\pvpvj.exec:\pvpvj.exe119⤵PID:1668
-
\??\c:\5xflxfr.exec:\5xflxfr.exe120⤵PID:736
-
\??\c:\bbtntt.exec:\bbtntt.exe121⤵PID:2804
-
\??\c:\dvjdj.exec:\dvjdj.exe122⤵PID:1896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-