Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 08:38
Behavioral task
behavioral1
Sample
a944d804680a0a129c50abcde60ff690_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a944d804680a0a129c50abcde60ff690_NeikiAnalytics.exe
-
Size
380KB
-
MD5
a944d804680a0a129c50abcde60ff690
-
SHA1
e6103d5435b3de6e6905b466ad027d1676fb7f51
-
SHA256
7c281221372c8c956741cbadd0c764fca7ac59678c1d203081646204dd1dab91
-
SHA512
86cc81511573da2c60e3ec307cf55ecc4808b24e0b92166d518e487f325f56ecdb55bac5c5b80e02c374632906cffdf1d6e6ffa4d2c37828222894cdbf595e16
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpSwp9OD0Ibse:y4wFHoS3eFaKHpNKbbse
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1936-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2092-12-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2092-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1564-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1552-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/284-139-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1512-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/756-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1352-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1448-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/532-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1076-189-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2896-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/324-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1440-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1428-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/868-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-642-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-741-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1432-754-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/940-773-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1844-879-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-926-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1644-1015-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/844-1043-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1028-1050-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-1077-0x0000000000320000-0x0000000000347000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2092 vdjjp.exe 1648 3frxrfr.exe 2760 5xrrflx.exe 2600 3vdvd.exe 2768 lflxrxl.exe 2372 dddjv.exe 2472 xxrxlfx.exe 2168 3dddd.exe 1564 rllrrlf.exe 2676 ttnhbh.exe 2828 1rlxrrl.exe 2944 lxrlxfr.exe 1552 rrllrxr.exe 284 3tnhnh.exe 756 9llrrxr.exe 1512 ddjdp.exe 1448 lrlxxxx.exe 1352 pjvjp.exe 532 llxxlrf.exe 1076 jdvdd.exe 2896 fxxrxfr.exe 2844 jjpjp.exe 2336 5frrflx.exe 2972 rxxlxfl.exe 1228 lffrxxl.exe 1684 frfrrrx.exe 1788 1hnbnh.exe 2072 rlrflxr.exe 2224 3lxflxl.exe 2556 1lrfxfx.exe 2112 5ttbht.exe 1964 tthtnt.exe 324 vpjdj.exe 2044 rlfrxlx.exe 2980 3tnbnn.exe 2172 vpjpv.exe 2236 jdvjp.exe 2616 xrrfrxf.exe 2872 nhhbnn.exe 2804 7ppdv.exe 2512 pjddj.exe 2504 llffrxf.exe 2520 bthbhn.exe 2524 ttthth.exe 2948 vpjpp.exe 2988 xrlffrx.exe 2732 lfflxxx.exe 328 nbbtnn.exe 2840 5dpvd.exe 1904 ffxlxlf.exe 1888 rllffrx.exe 1644 tnhhnn.exe 792 vppvj.exe 796 lfrxffr.exe 2536 3xxllrr.exe 1720 1nnbhh.exe 1512 ddddd.exe 1440 frflrrf.exe 1448 3lfflxf.exe 2572 bthbhn.exe 1400 btbhbt.exe 1392 5rlrflf.exe 1428 9lrlfrx.exe 1180 nbtbhb.exe -
resource yara_rule behavioral1/memory/1936-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c00000001226d-5.dat upx behavioral1/memory/2092-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0037000000015bc7-18.dat upx behavioral1/memory/2092-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015cbf-27.dat upx behavioral1/memory/1648-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015ce2-38.dat upx behavioral1/memory/2760-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015cea-45.dat upx behavioral1/files/0x0007000000015cf3-55.dat upx behavioral1/memory/2372-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d09-64.dat upx behavioral1/files/0x00070000000165d4-73.dat upx behavioral1/memory/2168-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2472-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1564-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016824-84.dat upx behavioral1/files/0x0006000000016a7d-95.dat upx behavioral1/memory/1564-91-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000016c4a-102.dat upx behavioral1/files/0x0006000000016c5d-109.dat upx behavioral1/memory/2944-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2828-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1552-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c67-122.dat upx behavioral1/memory/2944-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016caf-128.dat upx behavioral1/files/0x0006000000016cde-140.dat upx behavioral1/files/0x0037000000015c82-147.dat upx behavioral1/memory/1512-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/756-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d05-158.dat upx behavioral1/files/0x0006000000016d1a-164.dat upx behavioral1/memory/1352-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1448-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d22-176.dat upx behavioral1/memory/532-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d2b-186.dat upx behavioral1/memory/2896-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d33-194.dat upx behavioral1/files/0x0006000000016d3b-205.dat upx behavioral1/memory/2896-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d44-212.dat upx behavioral1/memory/2336-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d4c-222.dat upx behavioral1/files/0x0006000000016d55-229.dat upx behavioral1/files/0x0006000000016d68-238.dat upx behavioral1/files/0x0006000000016d6c-246.dat upx behavioral1/files/0x0006000000016d70-254.dat upx behavioral1/memory/2072-256-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d78-264.dat upx behavioral1/files/0x0006000000016da0-272.dat upx behavioral1/memory/2556-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016db2-282.dat upx behavioral1/files/0x0006000000016dc8-292.dat upx behavioral1/memory/1964-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/324-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2616-331-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-344-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2524-375-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2948-382-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2092 1936 a944d804680a0a129c50abcde60ff690_NeikiAnalytics.exe 28 PID 1936 wrote to memory of 2092 1936 a944d804680a0a129c50abcde60ff690_NeikiAnalytics.exe 28 PID 1936 wrote to memory of 2092 1936 a944d804680a0a129c50abcde60ff690_NeikiAnalytics.exe 28 PID 1936 wrote to memory of 2092 1936 a944d804680a0a129c50abcde60ff690_NeikiAnalytics.exe 28 PID 2092 wrote to memory of 1648 2092 vdjjp.exe 29 PID 2092 wrote to memory of 1648 2092 vdjjp.exe 29 PID 2092 wrote to memory of 1648 2092 vdjjp.exe 29 PID 2092 wrote to memory of 1648 2092 vdjjp.exe 29 PID 1648 wrote to memory of 2760 1648 3frxrfr.exe 30 PID 1648 wrote to memory of 2760 1648 3frxrfr.exe 30 PID 1648 wrote to memory of 2760 1648 3frxrfr.exe 30 PID 1648 wrote to memory of 2760 1648 3frxrfr.exe 30 PID 2760 wrote to memory of 2600 2760 5xrrflx.exe 31 PID 2760 wrote to memory of 2600 2760 5xrrflx.exe 31 PID 2760 wrote to memory of 2600 2760 5xrrflx.exe 31 PID 2760 wrote to memory of 2600 2760 5xrrflx.exe 31 PID 2600 wrote to memory of 2768 2600 3vdvd.exe 32 PID 2600 wrote to memory of 2768 2600 3vdvd.exe 32 PID 2600 wrote to memory of 2768 2600 3vdvd.exe 32 PID 2600 wrote to memory of 2768 2600 3vdvd.exe 32 PID 2768 wrote to memory of 2372 2768 lflxrxl.exe 33 PID 2768 wrote to memory of 2372 2768 lflxrxl.exe 33 PID 2768 wrote to memory of 2372 2768 lflxrxl.exe 33 PID 2768 wrote to memory of 2372 2768 lflxrxl.exe 33 PID 2372 wrote to memory of 2472 2372 dddjv.exe 34 PID 2372 wrote to memory of 2472 2372 dddjv.exe 34 PID 2372 wrote to memory of 2472 2372 dddjv.exe 34 PID 2372 wrote to memory of 2472 2372 dddjv.exe 34 PID 2472 wrote to memory of 2168 2472 xxrxlfx.exe 35 PID 2472 wrote to memory of 2168 2472 xxrxlfx.exe 35 PID 2472 wrote to memory of 2168 2472 xxrxlfx.exe 35 PID 2472 wrote to memory of 2168 2472 xxrxlfx.exe 35 PID 2168 wrote to memory of 1564 2168 3dddd.exe 36 PID 2168 wrote to memory of 1564 2168 3dddd.exe 36 PID 2168 wrote to memory of 1564 2168 3dddd.exe 36 PID 2168 wrote to memory of 1564 2168 3dddd.exe 36 PID 1564 wrote to memory of 2676 1564 rllrrlf.exe 37 PID 1564 wrote to memory of 2676 1564 rllrrlf.exe 37 PID 1564 wrote to memory of 2676 1564 rllrrlf.exe 37 PID 1564 wrote to memory of 2676 1564 rllrrlf.exe 37 PID 2676 wrote to memory of 2828 2676 ttnhbh.exe 38 PID 2676 wrote to memory of 2828 2676 ttnhbh.exe 38 PID 2676 wrote to memory of 2828 2676 ttnhbh.exe 38 PID 2676 wrote to memory of 2828 2676 ttnhbh.exe 38 PID 2828 wrote to memory of 2944 2828 1rlxrrl.exe 39 PID 2828 wrote to memory of 2944 2828 1rlxrrl.exe 39 PID 2828 wrote to memory of 2944 2828 1rlxrrl.exe 39 PID 2828 wrote to memory of 2944 2828 1rlxrrl.exe 39 PID 2944 wrote to memory of 1552 2944 lxrlxfr.exe 40 PID 2944 wrote to memory of 1552 2944 lxrlxfr.exe 40 PID 2944 wrote to memory of 1552 2944 lxrlxfr.exe 40 PID 2944 wrote to memory of 1552 2944 lxrlxfr.exe 40 PID 1552 wrote to memory of 284 1552 rrllrxr.exe 41 PID 1552 wrote to memory of 284 1552 rrllrxr.exe 41 PID 1552 wrote to memory of 284 1552 rrllrxr.exe 41 PID 1552 wrote to memory of 284 1552 rrllrxr.exe 41 PID 284 wrote to memory of 756 284 3tnhnh.exe 42 PID 284 wrote to memory of 756 284 3tnhnh.exe 42 PID 284 wrote to memory of 756 284 3tnhnh.exe 42 PID 284 wrote to memory of 756 284 3tnhnh.exe 42 PID 756 wrote to memory of 1512 756 9llrrxr.exe 43 PID 756 wrote to memory of 1512 756 9llrrxr.exe 43 PID 756 wrote to memory of 1512 756 9llrrxr.exe 43 PID 756 wrote to memory of 1512 756 9llrrxr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\a944d804680a0a129c50abcde60ff690_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a944d804680a0a129c50abcde60ff690_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\vdjjp.exec:\vdjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\3frxrfr.exec:\3frxrfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\5xrrflx.exec:\5xrrflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\3vdvd.exec:\3vdvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\lflxrxl.exec:\lflxrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\dddjv.exec:\dddjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\xxrxlfx.exec:\xxrxlfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\3dddd.exec:\3dddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\rllrrlf.exec:\rllrrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\ttnhbh.exec:\ttnhbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\1rlxrrl.exec:\1rlxrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\lxrlxfr.exec:\lxrlxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\rrllrxr.exec:\rrllrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\3tnhnh.exec:\3tnhnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:284 -
\??\c:\9llrrxr.exec:\9llrrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\ddjdp.exec:\ddjdp.exe17⤵
- Executes dropped EXE
PID:1512 -
\??\c:\lrlxxxx.exec:\lrlxxxx.exe18⤵
- Executes dropped EXE
PID:1448 -
\??\c:\pjvjp.exec:\pjvjp.exe19⤵
- Executes dropped EXE
PID:1352 -
\??\c:\llxxlrf.exec:\llxxlrf.exe20⤵
- Executes dropped EXE
PID:532 -
\??\c:\jdvdd.exec:\jdvdd.exe21⤵
- Executes dropped EXE
PID:1076 -
\??\c:\fxxrxfr.exec:\fxxrxfr.exe22⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jjpjp.exec:\jjpjp.exe23⤵
- Executes dropped EXE
PID:2844 -
\??\c:\5frrflx.exec:\5frrflx.exe24⤵
- Executes dropped EXE
PID:2336 -
\??\c:\rxxlxfl.exec:\rxxlxfl.exe25⤵
- Executes dropped EXE
PID:2972 -
\??\c:\lffrxxl.exec:\lffrxxl.exe26⤵
- Executes dropped EXE
PID:1228 -
\??\c:\frfrrrx.exec:\frfrrrx.exe27⤵
- Executes dropped EXE
PID:1684 -
\??\c:\1hnbnh.exec:\1hnbnh.exe28⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rlrflxr.exec:\rlrflxr.exe29⤵
- Executes dropped EXE
PID:2072 -
\??\c:\3lxflxl.exec:\3lxflxl.exe30⤵
- Executes dropped EXE
PID:2224 -
\??\c:\1lrfxfx.exec:\1lrfxfx.exe31⤵
- Executes dropped EXE
PID:2556 -
\??\c:\5ttbht.exec:\5ttbht.exe32⤵
- Executes dropped EXE
PID:2112 -
\??\c:\tthtnt.exec:\tthtnt.exe33⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vpjdj.exec:\vpjdj.exe34⤵
- Executes dropped EXE
PID:324 -
\??\c:\rlfrxlx.exec:\rlfrxlx.exe35⤵
- Executes dropped EXE
PID:2044 -
\??\c:\3tnbnn.exec:\3tnbnn.exe36⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vpjpv.exec:\vpjpv.exe37⤵
- Executes dropped EXE
PID:2172 -
\??\c:\jdvjp.exec:\jdvjp.exe38⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xrrfrxf.exec:\xrrfrxf.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nhhbnn.exec:\nhhbnn.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\7ppdv.exec:\7ppdv.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\pjddj.exec:\pjddj.exe42⤵
- Executes dropped EXE
PID:2512 -
\??\c:\llffrxf.exec:\llffrxf.exe43⤵
- Executes dropped EXE
PID:2504 -
\??\c:\bthbhn.exec:\bthbhn.exe44⤵
- Executes dropped EXE
PID:2520 -
\??\c:\ttthth.exec:\ttthth.exe45⤵
- Executes dropped EXE
PID:2524 -
\??\c:\vpjpp.exec:\vpjpp.exe46⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xrlffrx.exec:\xrlffrx.exe47⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lfflxxx.exec:\lfflxxx.exe48⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nbbtnn.exec:\nbbtnn.exe49⤵
- Executes dropped EXE
PID:328 -
\??\c:\5dpvd.exec:\5dpvd.exe50⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ffxlxlf.exec:\ffxlxlf.exe51⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rllffrx.exec:\rllffrx.exe52⤵
- Executes dropped EXE
PID:1888 -
\??\c:\tnhhnn.exec:\tnhhnn.exe53⤵
- Executes dropped EXE
PID:1644 -
\??\c:\vppvj.exec:\vppvj.exe54⤵
- Executes dropped EXE
PID:792 -
\??\c:\lfrxffr.exec:\lfrxffr.exe55⤵
- Executes dropped EXE
PID:796 -
\??\c:\3xxllrr.exec:\3xxllrr.exe56⤵
- Executes dropped EXE
PID:2536 -
\??\c:\1nnbhh.exec:\1nnbhh.exe57⤵
- Executes dropped EXE
PID:1720 -
\??\c:\ddddd.exec:\ddddd.exe58⤵
- Executes dropped EXE
PID:1512 -
\??\c:\frflrrf.exec:\frflrrf.exe59⤵
- Executes dropped EXE
PID:1440 -
\??\c:\3lfflxf.exec:\3lfflxf.exe60⤵
- Executes dropped EXE
PID:1448 -
\??\c:\bthbhn.exec:\bthbhn.exe61⤵
- Executes dropped EXE
PID:2572 -
\??\c:\btbhbt.exec:\btbhbt.exe62⤵
- Executes dropped EXE
PID:1400 -
\??\c:\5rlrflf.exec:\5rlrflf.exe63⤵
- Executes dropped EXE
PID:1392 -
\??\c:\9lrlfrx.exec:\9lrlfrx.exe64⤵
- Executes dropped EXE
PID:1428 -
\??\c:\nbtbhb.exec:\nbtbhb.exe65⤵
- Executes dropped EXE
PID:1180 -
\??\c:\pjdpd.exec:\pjdpd.exe66⤵PID:1736
-
\??\c:\llflxll.exec:\llflxll.exe67⤵PID:2448
-
\??\c:\nhtbht.exec:\nhtbht.exe68⤵PID:3048
-
\??\c:\ttntbh.exec:\ttntbh.exe69⤵PID:868
-
\??\c:\5vjvd.exec:\5vjvd.exe70⤵PID:1956
-
\??\c:\xxxfrff.exec:\xxxfrff.exe71⤵PID:1308
-
\??\c:\7rxrflx.exec:\7rxrflx.exe72⤵PID:1628
-
\??\c:\hbtbnn.exec:\hbtbnn.exe73⤵PID:880
-
\??\c:\1jjjj.exec:\1jjjj.exe74⤵PID:2184
-
\??\c:\dvvvp.exec:\dvvvp.exe75⤵PID:780
-
\??\c:\1llrlxr.exec:\1llrlxr.exe76⤵PID:2388
-
\??\c:\bbnhhb.exec:\bbnhhb.exe77⤵PID:1636
-
\??\c:\nnhbnb.exec:\nnhbnb.exe78⤵PID:2460
-
\??\c:\vdjvv.exec:\vdjvv.exe79⤵PID:2380
-
\??\c:\5xllrxl.exec:\5xllrxl.exe80⤵PID:1668
-
\??\c:\tbtnnn.exec:\tbtnnn.exe81⤵PID:1496
-
\??\c:\1htntb.exec:\1htntb.exe82⤵PID:2620
-
\??\c:\dvpjd.exec:\dvpjd.exe83⤵PID:2580
-
\??\c:\xxxlxfx.exec:\xxxlxfx.exe84⤵PID:2764
-
\??\c:\1flxrxr.exec:\1flxrxr.exe85⤵PID:2728
-
\??\c:\7nntbh.exec:\7nntbh.exe86⤵PID:2812
-
\??\c:\3tntth.exec:\3tntth.exe87⤵PID:2564
-
\??\c:\1lxfrrx.exec:\1lxfrrx.exe88⤵PID:2612
-
\??\c:\xxrflxf.exec:\xxrflxf.exe89⤵PID:2496
-
\??\c:\bnnbhn.exec:\bnnbhn.exe90⤵PID:2208
-
\??\c:\vjddp.exec:\vjddp.exe91⤵PID:2472
-
\??\c:\pddjj.exec:\pddjj.exe92⤵PID:1928
-
\??\c:\rlrxxrl.exec:\rlrxxrl.exe93⤵PID:2988
-
\??\c:\9bhhnt.exec:\9bhhnt.exe94⤵PID:2732
-
\??\c:\vvdpj.exec:\vvdpj.exe95⤵PID:328
-
\??\c:\ddpvv.exec:\ddpvv.exe96⤵PID:1504
-
\??\c:\rxxrrxf.exec:\rxxrrxf.exe97⤵PID:1724
-
\??\c:\tbttnn.exec:\tbttnn.exe98⤵PID:1968
-
\??\c:\pvdpp.exec:\pvdpp.exe99⤵PID:540
-
\??\c:\fllfxfr.exec:\fllfxfr.exe100⤵PID:1896
-
\??\c:\rxrrrll.exec:\rxrrrll.exe101⤵PID:1588
-
\??\c:\ntbhtb.exec:\ntbhtb.exe102⤵PID:1712
-
\??\c:\vvpjp.exec:\vvpjp.exe103⤵PID:2392
-
\??\c:\pppdp.exec:\pppdp.exe104⤵PID:1432
-
\??\c:\fllxlrf.exec:\fllxlrf.exe105⤵PID:2976
-
\??\c:\hhtthn.exec:\hhtthn.exe106⤵PID:1352
-
\??\c:\dddpp.exec:\dddpp.exe107⤵PID:940
-
\??\c:\7rlrllr.exec:\7rlrllr.exe108⤵PID:536
-
\??\c:\1thbht.exec:\1thbht.exe109⤵PID:1408
-
\??\c:\ddvjv.exec:\ddvjv.exe110⤵PID:1952
-
\??\c:\rlflxfr.exec:\rlflxfr.exe111⤵PID:2332
-
\??\c:\lxfxrrx.exec:\lxfxrrx.exe112⤵PID:2300
-
\??\c:\tbhtth.exec:\tbhtth.exe113⤵PID:1312
-
\??\c:\djpvv.exec:\djpvv.exe114⤵PID:668
-
\??\c:\xrllxfl.exec:\xrllxfl.exe115⤵PID:3048
-
\??\c:\5hhntt.exec:\5hhntt.exe116⤵PID:948
-
\??\c:\1ntbhb.exec:\1ntbhb.exe117⤵PID:1016
-
\??\c:\9jpdp.exec:\9jpdp.exe118⤵PID:2228
-
\??\c:\rlfrfrf.exec:\rlfrfrf.exe119⤵PID:1976
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe120⤵PID:2416
-
\??\c:\hhbnbb.exec:\hhbnbb.exe121⤵PID:2188
-
\??\c:\ddvpv.exec:\ddvpv.exe122⤵PID:780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-