Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 17:03
Behavioral task
behavioral1
Sample
ce88f39dfba8740aaea79de93efef8a0_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
ce88f39dfba8740aaea79de93efef8a0_NeikiAnalytics.exe
-
Size
91KB
-
MD5
ce88f39dfba8740aaea79de93efef8a0
-
SHA1
71952686c1bafdae42e77a468d642268bcc0ddec
-
SHA256
b0af3f1c6e24242afcd80bc6fb6cd1f669473ce2ee6a444973a0d94d1267ccd1
-
SHA512
57475d6d8ffaab5dc7e75380e8b5ac3b172c4c084558801b844a462777790e365a244fd1d87ba486ffeb9308d5134eb0c7a97ae6039525ddb6542944e0f53cfc
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWp/:8hOmTsF93UYfwC6GIout0fmCiiiXA6mt
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2256-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1036-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1032-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1056-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1828-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1532-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/356-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1152-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1548-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1892-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1596-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1368-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-560-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-611-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-672-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1876-1055-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-1177-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2528-1188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-1215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-1218-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1724-8973-0x0000000076EA0000-0x0000000076F9A000-memory.dmp family_blackmoon behavioral1/memory/1724-8972-0x0000000076FA0000-0x00000000770BF000-memory.dmp family_blackmoon behavioral1/memory/1724-11427-0x0000000076EA0000-0x0000000076F9A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2256 hhbhtt.exe 2800 jdpjv.exe 2828 frllrxf.exe 2980 nbhhbb.exe 2600 pdjvj.exe 2564 fxxxfll.exe 2652 rrflxfl.exe 2696 bbttbb.exe 2692 vpvjd.exe 2404 xxrlrxl.exe 1036 hhtthh.exe 1568 hbttnh.exe 1908 pjvjp.exe 2168 3xlrffl.exe 2136 lfrxfrf.exe 1960 nntthn.exe 2016 ppdjv.exe 2344 xrffxfl.exe 1828 rrlrffr.exe 1372 bbttbb.exe 1032 nhtntb.exe 3028 3pppd.exe 1056 ffxllrf.exe 2396 5fxlfxr.exe 716 btntnh.exe 1532 ttbbbb.exe 1204 pjdpp.exe 1060 llfrffr.exe 356 bhtbnb.exe 1912 9tthtb.exe 1976 dvpdp.exe 1152 lxlrrxf.exe 2232 thnhhb.exe 1612 nbnnbt.exe 2108 vvjvd.exe 108 1jjjv.exe 1752 1xrxflr.exe 2852 rxfllfx.exe 1724 hbnntt.exe 1540 lxlfxll.exe 1548 rlxlrlr.exe 2948 bthtbh.exe 2072 bntbhh.exe 2856 1vvpv.exe 2592 vvjdv.exe 2556 lfxfrxl.exe 2664 fxlllrx.exe 2552 5btnhn.exe 1560 nnnnhn.exe 2444 pjdjp.exe 2716 fxllrfl.exe 2692 xrlrlff.exe 2528 bbntbt.exe 2792 bhbbhh.exe 1964 pjdvj.exe 1892 ppjpd.exe 1992 ddpvd.exe 2184 xrrxlrf.exe 2168 3nnbth.exe 2172 3htttb.exe 2132 9nnhtb.exe 1960 vvpjd.exe 2016 jdjjp.exe 2324 xrfllxx.exe -
resource yara_rule behavioral1/memory/2272-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000015c85-5.dat upx behavioral1/memory/2256-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2272-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015cd9-16.dat upx behavioral1/memory/2800-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2828-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d24-25.dat upx behavioral1/files/0x0007000000015d44-32.dat upx behavioral1/memory/2980-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d4c-41.dat upx behavioral1/memory/2980-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2600-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015e09-49.dat upx behavioral1/memory/2564-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015e6d-57.dat upx behavioral1/memory/2564-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2652-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016cb2-65.dat upx behavioral1/memory/2696-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ce4-73.dat upx behavioral1/files/0x0006000000016cf5-81.dat upx behavioral1/memory/2404-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cfd-90.dat upx behavioral1/files/0x0006000000016d05-98.dat upx behavioral1/memory/1036-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d0e-105.dat upx behavioral1/memory/1908-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d16-113.dat upx behavioral1/memory/2168-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d1f-121.dat upx behavioral1/memory/2168-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d32-130.dat upx behavioral1/memory/2136-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1960-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d36-137.dat upx behavioral1/files/0x0006000000016d3a-146.dat upx behavioral1/memory/2016-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d9f-153.dat upx behavioral1/memory/1032-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016da4-161.dat upx behavioral1/memory/1032-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016db3-169.dat upx behavioral1/files/0x0006000000016e78-177.dat upx behavioral1/memory/1056-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016fe8-185.dat upx behavioral1/files/0x000600000001739d-192.dat upx behavioral1/files/0x00060000000173e5-200.dat upx behavioral1/files/0x000600000001744c-209.dat upx behavioral1/memory/1532-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175ac-215.dat upx behavioral1/files/0x00060000000175b2-222.dat upx behavioral1/memory/356-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175b8-230.dat upx behavioral1/files/0x001500000001863c-237.dat upx behavioral1/files/0x0009000000018640-244.dat upx behavioral1/memory/1152-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1152-253-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015ce3-254.dat upx behavioral1/memory/1612-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1612-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2852-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2852-288-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1724-290-0x0000000076FA0000-0x00000000770BF000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2256 2272 ce88f39dfba8740aaea79de93efef8a0_NeikiAnalytics.exe 28 PID 2272 wrote to memory of 2256 2272 ce88f39dfba8740aaea79de93efef8a0_NeikiAnalytics.exe 28 PID 2272 wrote to memory of 2256 2272 ce88f39dfba8740aaea79de93efef8a0_NeikiAnalytics.exe 28 PID 2272 wrote to memory of 2256 2272 ce88f39dfba8740aaea79de93efef8a0_NeikiAnalytics.exe 28 PID 2256 wrote to memory of 2800 2256 hhbhtt.exe 29 PID 2256 wrote to memory of 2800 2256 hhbhtt.exe 29 PID 2256 wrote to memory of 2800 2256 hhbhtt.exe 29 PID 2256 wrote to memory of 2800 2256 hhbhtt.exe 29 PID 2800 wrote to memory of 2828 2800 jdpjv.exe 30 PID 2800 wrote to memory of 2828 2800 jdpjv.exe 30 PID 2800 wrote to memory of 2828 2800 jdpjv.exe 30 PID 2800 wrote to memory of 2828 2800 jdpjv.exe 30 PID 2828 wrote to memory of 2980 2828 frllrxf.exe 31 PID 2828 wrote to memory of 2980 2828 frllrxf.exe 31 PID 2828 wrote to memory of 2980 2828 frllrxf.exe 31 PID 2828 wrote to memory of 2980 2828 frllrxf.exe 31 PID 2980 wrote to memory of 2600 2980 nbhhbb.exe 32 PID 2980 wrote to memory of 2600 2980 nbhhbb.exe 32 PID 2980 wrote to memory of 2600 2980 nbhhbb.exe 32 PID 2980 wrote to memory of 2600 2980 nbhhbb.exe 32 PID 2600 wrote to memory of 2564 2600 pdjvj.exe 33 PID 2600 wrote to memory of 2564 2600 pdjvj.exe 33 PID 2600 wrote to memory of 2564 2600 pdjvj.exe 33 PID 2600 wrote to memory of 2564 2600 pdjvj.exe 33 PID 2564 wrote to memory of 2652 2564 fxxxfll.exe 34 PID 2564 wrote to memory of 2652 2564 fxxxfll.exe 34 PID 2564 wrote to memory of 2652 2564 fxxxfll.exe 34 PID 2564 wrote to memory of 2652 2564 fxxxfll.exe 34 PID 2652 wrote to memory of 2696 2652 rrflxfl.exe 35 PID 2652 wrote to memory of 2696 2652 rrflxfl.exe 35 PID 2652 wrote to memory of 2696 2652 rrflxfl.exe 35 PID 2652 wrote to memory of 2696 2652 rrflxfl.exe 35 PID 2696 wrote to memory of 2692 2696 bbttbb.exe 36 PID 2696 wrote to memory of 2692 2696 bbttbb.exe 36 PID 2696 wrote to memory of 2692 2696 bbttbb.exe 36 PID 2696 wrote to memory of 2692 2696 bbttbb.exe 36 PID 2692 wrote to memory of 2404 2692 vpvjd.exe 37 PID 2692 wrote to memory of 2404 2692 vpvjd.exe 37 PID 2692 wrote to memory of 2404 2692 vpvjd.exe 37 PID 2692 wrote to memory of 2404 2692 vpvjd.exe 37 PID 2404 wrote to memory of 1036 2404 xxrlrxl.exe 38 PID 2404 wrote to memory of 1036 2404 xxrlrxl.exe 38 PID 2404 wrote to memory of 1036 2404 xxrlrxl.exe 38 PID 2404 wrote to memory of 1036 2404 xxrlrxl.exe 38 PID 1036 wrote to memory of 1568 1036 hhtthh.exe 39 PID 1036 wrote to memory of 1568 1036 hhtthh.exe 39 PID 1036 wrote to memory of 1568 1036 hhtthh.exe 39 PID 1036 wrote to memory of 1568 1036 hhtthh.exe 39 PID 1568 wrote to memory of 1908 1568 hbttnh.exe 40 PID 1568 wrote to memory of 1908 1568 hbttnh.exe 40 PID 1568 wrote to memory of 1908 1568 hbttnh.exe 40 PID 1568 wrote to memory of 1908 1568 hbttnh.exe 40 PID 1908 wrote to memory of 2168 1908 pjvjp.exe 41 PID 1908 wrote to memory of 2168 1908 pjvjp.exe 41 PID 1908 wrote to memory of 2168 1908 pjvjp.exe 41 PID 1908 wrote to memory of 2168 1908 pjvjp.exe 41 PID 2168 wrote to memory of 2136 2168 3xlrffl.exe 42 PID 2168 wrote to memory of 2136 2168 3xlrffl.exe 42 PID 2168 wrote to memory of 2136 2168 3xlrffl.exe 42 PID 2168 wrote to memory of 2136 2168 3xlrffl.exe 42 PID 2136 wrote to memory of 1960 2136 lfrxfrf.exe 43 PID 2136 wrote to memory of 1960 2136 lfrxfrf.exe 43 PID 2136 wrote to memory of 1960 2136 lfrxfrf.exe 43 PID 2136 wrote to memory of 1960 2136 lfrxfrf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce88f39dfba8740aaea79de93efef8a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ce88f39dfba8740aaea79de93efef8a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\hhbhtt.exec:\hhbhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\jdpjv.exec:\jdpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\frllrxf.exec:\frllrxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\nbhhbb.exec:\nbhhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\pdjvj.exec:\pdjvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\fxxxfll.exec:\fxxxfll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\rrflxfl.exec:\rrflxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\bbttbb.exec:\bbttbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\vpvjd.exec:\vpvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\xxrlrxl.exec:\xxrlrxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\hhtthh.exec:\hhtthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\hbttnh.exec:\hbttnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\pjvjp.exec:\pjvjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\3xlrffl.exec:\3xlrffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\lfrxfrf.exec:\lfrxfrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\nntthn.exec:\nntthn.exe17⤵
- Executes dropped EXE
PID:1960 -
\??\c:\ppdjv.exec:\ppdjv.exe18⤵
- Executes dropped EXE
PID:2016 -
\??\c:\xrffxfl.exec:\xrffxfl.exe19⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rrlrffr.exec:\rrlrffr.exe20⤵
- Executes dropped EXE
PID:1828 -
\??\c:\bbttbb.exec:\bbttbb.exe21⤵
- Executes dropped EXE
PID:1372 -
\??\c:\nhtntb.exec:\nhtntb.exe22⤵
- Executes dropped EXE
PID:1032 -
\??\c:\3pppd.exec:\3pppd.exe23⤵
- Executes dropped EXE
PID:3028 -
\??\c:\ffxllrf.exec:\ffxllrf.exe24⤵
- Executes dropped EXE
PID:1056 -
\??\c:\5fxlfxr.exec:\5fxlfxr.exe25⤵
- Executes dropped EXE
PID:2396 -
\??\c:\btntnh.exec:\btntnh.exe26⤵
- Executes dropped EXE
PID:716 -
\??\c:\ttbbbb.exec:\ttbbbb.exe27⤵
- Executes dropped EXE
PID:1532 -
\??\c:\pjdpp.exec:\pjdpp.exe28⤵
- Executes dropped EXE
PID:1204 -
\??\c:\llfrffr.exec:\llfrffr.exe29⤵
- Executes dropped EXE
PID:1060 -
\??\c:\bhtbnb.exec:\bhtbnb.exe30⤵
- Executes dropped EXE
PID:356 -
\??\c:\9tthtb.exec:\9tthtb.exe31⤵
- Executes dropped EXE
PID:1912 -
\??\c:\dvpdp.exec:\dvpdp.exe32⤵
- Executes dropped EXE
PID:1976 -
\??\c:\lxlrrxf.exec:\lxlrrxf.exe33⤵
- Executes dropped EXE
PID:1152 -
\??\c:\thnhhb.exec:\thnhhb.exe34⤵
- Executes dropped EXE
PID:2232 -
\??\c:\nbnnbt.exec:\nbnnbt.exe35⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vvjvd.exec:\vvjvd.exe36⤵
- Executes dropped EXE
PID:2108 -
\??\c:\1jjjv.exec:\1jjjv.exe37⤵
- Executes dropped EXE
PID:108 -
\??\c:\1xrxflr.exec:\1xrxflr.exe38⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rxfllfx.exec:\rxfllfx.exe39⤵
- Executes dropped EXE
PID:2852 -
\??\c:\hbnntt.exec:\hbnntt.exe40⤵
- Executes dropped EXE
PID:1724 -
\??\c:\hhttbn.exec:\hhttbn.exe41⤵PID:1996
-
\??\c:\lxlfxll.exec:\lxlfxll.exe42⤵
- Executes dropped EXE
PID:1540 -
\??\c:\rlxlrlr.exec:\rlxlrlr.exe43⤵
- Executes dropped EXE
PID:1548 -
\??\c:\bthtbh.exec:\bthtbh.exe44⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bntbhh.exec:\bntbhh.exe45⤵
- Executes dropped EXE
PID:2072 -
\??\c:\1vvpv.exec:\1vvpv.exe46⤵
- Executes dropped EXE
PID:2856 -
\??\c:\vvjdv.exec:\vvjdv.exe47⤵
- Executes dropped EXE
PID:2592 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe48⤵
- Executes dropped EXE
PID:2556 -
\??\c:\fxlllrx.exec:\fxlllrx.exe49⤵
- Executes dropped EXE
PID:2664 -
\??\c:\5btnhn.exec:\5btnhn.exe50⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nnnnhn.exec:\nnnnhn.exe51⤵
- Executes dropped EXE
PID:1560 -
\??\c:\pjdjp.exec:\pjdjp.exe52⤵
- Executes dropped EXE
PID:2444 -
\??\c:\fxllrfl.exec:\fxllrfl.exe53⤵
- Executes dropped EXE
PID:2716 -
\??\c:\xrlrlff.exec:\xrlrlff.exe54⤵
- Executes dropped EXE
PID:2692 -
\??\c:\bbntbt.exec:\bbntbt.exe55⤵
- Executes dropped EXE
PID:2528 -
\??\c:\bhbbhh.exec:\bhbbhh.exe56⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pjdvj.exec:\pjdvj.exe57⤵
- Executes dropped EXE
PID:1964 -
\??\c:\ppjpd.exec:\ppjpd.exe58⤵
- Executes dropped EXE
PID:1892 -
\??\c:\ddpvd.exec:\ddpvd.exe59⤵
- Executes dropped EXE
PID:1992 -
\??\c:\xrrxlrf.exec:\xrrxlrf.exe60⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3nnbth.exec:\3nnbth.exe61⤵
- Executes dropped EXE
PID:2168 -
\??\c:\3htttb.exec:\3htttb.exe62⤵
- Executes dropped EXE
PID:2172 -
\??\c:\9nnhtb.exec:\9nnhtb.exe63⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vvpjd.exec:\vvpjd.exe64⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jdjjp.exec:\jdjjp.exe65⤵
- Executes dropped EXE
PID:2016 -
\??\c:\xrfllxx.exec:\xrfllxx.exe66⤵
- Executes dropped EXE
PID:2324 -
\??\c:\lffrxxr.exec:\lffrxxr.exe67⤵PID:1756
-
\??\c:\tnhthh.exec:\tnhthh.exe68⤵PID:1596
-
\??\c:\nbnnbt.exec:\nbnnbt.exe69⤵PID:3020
-
\??\c:\vpdjp.exec:\vpdjp.exe70⤵PID:1528
-
\??\c:\3jjjj.exec:\3jjjj.exe71⤵PID:3068
-
\??\c:\xllrxxl.exec:\xllrxxl.exe72⤵PID:1056
-
\??\c:\tnhnbh.exec:\tnhnbh.exe73⤵PID:1368
-
\??\c:\nnbhtb.exec:\nnbhtb.exe74⤵PID:2848
-
\??\c:\1jvvv.exec:\1jvvv.exe75⤵PID:1684
-
\??\c:\vvvdd.exec:\vvvdd.exe76⤵PID:1276
-
\??\c:\1dvdj.exec:\1dvdj.exe77⤵PID:1984
-
\??\c:\3xrlrrx.exec:\3xrlrrx.exe78⤵PID:2360
-
\??\c:\xrlrfff.exec:\xrlrfff.exe79⤵PID:1664
-
\??\c:\bthtbh.exec:\bthtbh.exe80⤵PID:1556
-
\??\c:\nhnhbt.exec:\nhnhbt.exe81⤵PID:1844
-
\??\c:\jvjpv.exec:\jvjpv.exe82⤵PID:1868
-
\??\c:\7jdjj.exec:\7jdjj.exe83⤵PID:2740
-
\??\c:\fxrrllr.exec:\fxrrllr.exe84⤵PID:3060
-
\??\c:\fxrxlfx.exec:\fxrxlfx.exe85⤵PID:2284
-
\??\c:\btnbnb.exec:\btnbnb.exe86⤵PID:1612
-
\??\c:\bhnbnt.exec:\bhnbnt.exe87⤵PID:3004
-
\??\c:\jpjjv.exec:\jpjjv.exe88⤵PID:920
-
\??\c:\ddpjv.exec:\ddpjv.exe89⤵PID:1752
-
\??\c:\xlrxxxl.exec:\xlrxxxl.exe90⤵PID:3048
-
\??\c:\3lfrllr.exec:\3lfrllr.exe91⤵PID:2228
-
\??\c:\nhhnbh.exec:\nhhnbh.exe92⤵PID:1652
-
\??\c:\hbtbbb.exec:\hbtbbb.exe93⤵PID:1384
-
\??\c:\hhnnbb.exec:\hhnnbb.exe94⤵PID:2216
-
\??\c:\vpvjp.exec:\vpvjp.exe95⤵PID:2208
-
\??\c:\ppdjp.exec:\ppdjp.exe96⤵PID:2548
-
\??\c:\rrfrrff.exec:\rrfrrff.exe97⤵PID:2884
-
\??\c:\xrlrfff.exec:\xrlrfff.exe98⤵PID:2636
-
\??\c:\nnhthn.exec:\nnhthn.exe99⤵PID:2732
-
\??\c:\tnbhnt.exec:\tnbhnt.exe100⤵PID:2540
-
\??\c:\pppvj.exec:\pppvj.exe101⤵PID:2564
-
\??\c:\ddjpp.exec:\ddjpp.exe102⤵PID:2544
-
\??\c:\fllxrxl.exec:\fllxrxl.exe103⤵PID:2696
-
\??\c:\frxxxxl.exec:\frxxxxl.exe104⤵PID:2424
-
\??\c:\7hnntb.exec:\7hnntb.exe105⤵PID:2316
-
\??\c:\tntbhn.exec:\tntbhn.exe106⤵PID:2472
-
\??\c:\7jppv.exec:\7jppv.exe107⤵PID:2840
-
\??\c:\dvvjp.exec:\dvvjp.exe108⤵PID:2984
-
\??\c:\rlrfxxl.exec:\rlrfxxl.exe109⤵PID:1820
-
\??\c:\xrfrflf.exec:\xrfrflf.exe110⤵PID:1760
-
\??\c:\9bbnbb.exec:\9bbnbb.exe111⤵PID:2028
-
\??\c:\nntbnt.exec:\nntbnt.exe112⤵PID:344
-
\??\c:\9jjdp.exec:\9jjdp.exe113⤵PID:1836
-
\??\c:\1flrflx.exec:\1flrflx.exe114⤵PID:2020
-
\??\c:\7xxlxlx.exec:\7xxlxlx.exe115⤵PID:2032
-
\??\c:\bhtttb.exec:\bhtttb.exe116⤵PID:320
-
\??\c:\tnhhtt.exec:\tnhhtt.exe117⤵PID:1264
-
\??\c:\7pdpd.exec:\7pdpd.exe118⤵PID:2344
-
\??\c:\dvdpv.exec:\dvdpv.exe119⤵PID:2384
-
\??\c:\rlxflrf.exec:\rlxflrf.exe120⤵PID:276
-
\??\c:\rlflrfl.exec:\rlflrfl.exe121⤵PID:2300
-
\??\c:\nhttbb.exec:\nhttbb.exe122⤵PID:892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-