Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:13
Behavioral task
behavioral1
Sample
152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
-
Target
152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe
-
Size
169KB
-
MD5
152ce54299cea73d2dad55769b74a770
-
SHA1
d1c60b3fea941a80511458832b2aad5e5411f49b
-
SHA256
4f63a80b019bab3517d8412ecfdf7a1c8489589459726c46de10309b57eeef89
-
SHA512
4f1b5237e86fde7897be60c80b68b3c673668297e55eb57e91f7b0bebdc3e2413dc636b3fb3b56169b53eadd14c8591a7793a49321592ee7baa8fa0bf299d072
-
SSDEEP
1536:HvQBeOGtrYS3srx93UBWfwC6Ggnouy8CUYj7FK4O8A1o4XEc3YtxD8/Ai2T:HhOmTsF93UYfwC6GIoutX8Ki3c3YT8Vk
Score
10/10
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
Processes:
resource yara_rule behavioral1/memory/2032-7-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2204-19-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1816-28-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2256-38-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2640-47-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2548-57-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2460-61-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2588-70-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2436-78-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2940-87-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1532-96-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2916-115-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1700-132-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2236-140-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2696-111-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2236-147-0x0000000000220000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/2660-165-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1260-181-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2848-191-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/448-224-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2104-233-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/568-259-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1716-268-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1992-299-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2156-319-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2852-344-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2260-351-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1800-353-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1708-390-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2784-391-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2604-510-0x0000000000220000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/900-541-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1536-555-0x00000000002B0000-0x00000000002F6000-memory.dmp family_blackmoon behavioral1/memory/1748-581-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2432-630-0x0000000001B70000-0x0000000001BB6000-memory.dmp family_blackmoon behavioral1/memory/2432-668-0x0000000001B70000-0x0000000001BB6000-memory.dmp family_blackmoon behavioral1/memory/1092-669-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1812-718-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2384-830-0x00000000002B0000-0x00000000002F6000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
64002.exe08666.exetnhtnn.exe648422.exerxfxlll.exe1lllffr.exe2266824.exevpddj.exexrrlffl.exedvjdj.exe42408.exe6082440.exevjppd.exevjpvv.exeg6408.exedvjpj.exeppdvd.exe028048.exelxlflll.exexrlrxrr.exe4240006.exew80028.exexlxxflr.exeo468440.exelflxxfl.exexrfrxfl.exe48046.exefxrlrrx.exe20624.exes2622.exethbnht.exe684082.exe646688.exe80268.exe08046.exeflxxrff.exejvddp.exetnbbtb.exexlxxlrr.exee24204.exec824228.exe4628066.exe3flrrrx.exehbtbnn.exe44880.exedpdjv.exe268800.exe5pppd.exe6426228.exe8684628.exe86802.exelfxfrlx.exe60224.exebnhbhb.exe268466.exe660022.exe9pdjj.exepvjjv.exe48446.exe4240228.exe3flrxff.exethhhtn.exenhtntn.exe202804.exepid process 2204 64002.exe 1816 08666.exe 2256 tnhtnn.exe 2640 648422.exe 2548 rxfxlll.exe 2460 1lllffr.exe 2588 2266824.exe 2436 vpddj.exe 2940 xrrlffl.exe 1532 dvjdj.exe 2696 42408.exe 2916 6082440.exe 2412 vjppd.exe 1700 vjpvv.exe 2236 g6408.exe 1984 dvjpj.exe 2660 ppdvd.exe 1604 028048.exe 1260 lxlflll.exe 2848 xrlrxrr.exe 2276 4240006.exe 584 w80028.exe 1788 xlxxflr.exe 448 o468440.exe 2104 lflxxfl.exe 1364 xrfrxfl.exe 1392 48046.exe 568 fxrlrrx.exe 2140 20624.exe 1716 s2622.exe 1740 thbnht.exe 2340 684082.exe 1668 646688.exe 1992 80268.exe 1680 08046.exe 2156 flxxrff.exe 2204 jvddp.exe 3068 tnbbtb.exe 2572 xlxxlrr.exe 2852 e24204.exe 2260 c824228.exe 1800 4628066.exe 2752 3flrrrx.exe 2612 hbtbnn.exe 2440 44880.exe 2436 dpdjv.exe 1708 268800.exe 2784 5pppd.exe 2512 6426228.exe 2816 8684628.exe 2616 86802.exe 2152 lfxfrlx.exe 1512 60224.exe 2912 bnhbhb.exe 1696 268466.exe 2492 660022.exe 1984 9pdjj.exe 2464 pvjjv.exe 3016 48446.exe 672 4240228.exe 2604 3flrxff.exe 2408 thhhtn.exe 1492 nhtntn.exe 836 202804.exe -
Processes:
resource yara_rule behavioral1/memory/3000-0-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2032-7-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\64002.exe upx behavioral1/memory/2204-9-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2204-19-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\08666.exe upx behavioral1/memory/1816-28-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\tnhtnn.exe upx behavioral1/memory/2256-32-0x0000000000220000-0x0000000000266000-memory.dmp upx C:\648422.exe upx behavioral1/memory/2256-38-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\rxfxlll.exe upx behavioral1/memory/2640-47-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/3000-48-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\1lllffr.exe upx behavioral1/memory/2548-57-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2460-61-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2588-70-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2436-78-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2940-87-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1532-96-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\dvjdj.exe upx \??\c:\xrrlffl.exe upx \??\c:\42408.exe upx behavioral1/memory/2916-115-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\vjppd.exe upx behavioral1/memory/1700-132-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\vjpvv.exe upx behavioral1/memory/2236-140-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\g6408.exe upx \??\c:\6082440.exe upx behavioral1/memory/2696-111-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\vpddj.exe upx \??\c:\2266824.exe upx C:\dvjpj.exe upx C:\ppdvd.exe upx C:\028048.exe upx behavioral1/memory/2660-165-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\lxlflll.exe upx C:\xrlrxrr.exe upx behavioral1/memory/1260-181-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2848-191-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\4240006.exe upx C:\w80028.exe upx C:\xlxxflr.exe upx C:\o468440.exe upx behavioral1/memory/448-216-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/448-224-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\lflxxfl.exe upx \??\c:\xrfrxfl.exe upx behavioral1/memory/2104-233-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\48046.exe upx C:\fxrlrrx.exe upx behavioral1/memory/568-259-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\20624.exe upx C:\s2622.exe upx behavioral1/memory/1716-268-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\thbnht.exe upx behavioral1/memory/1740-284-0x0000000000450000-0x0000000000496000-memory.dmp upx C:\684082.exe upx behavioral1/memory/1992-299-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2156-312-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2156-319-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2852-344-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Serverx = "C:\\Windows\\system32\\Serverx.exe" 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe -
Drops file in System32 directory 2 IoCs
Processes:
152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exedescription ioc process File created C:\Windows\SysWOW64\Serverx.exe 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Serverx.exe 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe64002.exe08666.exetnhtnn.exe648422.exerxfxlll.exe1lllffr.exe2266824.exevpddj.exexrrlffl.exedvjdj.exe42408.exe6082440.exevjppd.exevjpvv.exedescription pid process target process PID 3000 wrote to memory of 2032 3000 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe PID 3000 wrote to memory of 2032 3000 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe PID 3000 wrote to memory of 2032 3000 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe PID 3000 wrote to memory of 2032 3000 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe PID 2032 wrote to memory of 2204 2032 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe 64002.exe PID 2032 wrote to memory of 2204 2032 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe 64002.exe PID 2032 wrote to memory of 2204 2032 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe 64002.exe PID 2032 wrote to memory of 2204 2032 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe 64002.exe PID 2204 wrote to memory of 1816 2204 64002.exe 08666.exe PID 2204 wrote to memory of 1816 2204 64002.exe 08666.exe PID 2204 wrote to memory of 1816 2204 64002.exe 08666.exe PID 2204 wrote to memory of 1816 2204 64002.exe 08666.exe PID 1816 wrote to memory of 2256 1816 08666.exe tnhtnn.exe PID 1816 wrote to memory of 2256 1816 08666.exe tnhtnn.exe PID 1816 wrote to memory of 2256 1816 08666.exe tnhtnn.exe PID 1816 wrote to memory of 2256 1816 08666.exe tnhtnn.exe PID 2256 wrote to memory of 2640 2256 tnhtnn.exe 648422.exe PID 2256 wrote to memory of 2640 2256 tnhtnn.exe 648422.exe PID 2256 wrote to memory of 2640 2256 tnhtnn.exe 648422.exe PID 2256 wrote to memory of 2640 2256 tnhtnn.exe 648422.exe PID 2640 wrote to memory of 2548 2640 648422.exe rxfxlll.exe PID 2640 wrote to memory of 2548 2640 648422.exe rxfxlll.exe PID 2640 wrote to memory of 2548 2640 648422.exe rxfxlll.exe PID 2640 wrote to memory of 2548 2640 648422.exe rxfxlll.exe PID 2548 wrote to memory of 2460 2548 rxfxlll.exe 1lllffr.exe PID 2548 wrote to memory of 2460 2548 rxfxlll.exe 1lllffr.exe PID 2548 wrote to memory of 2460 2548 rxfxlll.exe 1lllffr.exe PID 2548 wrote to memory of 2460 2548 rxfxlll.exe 1lllffr.exe PID 2460 wrote to memory of 2588 2460 1lllffr.exe 2266824.exe PID 2460 wrote to memory of 2588 2460 1lllffr.exe 2266824.exe PID 2460 wrote to memory of 2588 2460 1lllffr.exe 2266824.exe PID 2460 wrote to memory of 2588 2460 1lllffr.exe 2266824.exe PID 2588 wrote to memory of 2436 2588 2266824.exe vpddj.exe PID 2588 wrote to memory of 2436 2588 2266824.exe vpddj.exe PID 2588 wrote to memory of 2436 2588 2266824.exe vpddj.exe PID 2588 wrote to memory of 2436 2588 2266824.exe vpddj.exe PID 2436 wrote to memory of 2940 2436 vpddj.exe xrrlffl.exe PID 2436 wrote to memory of 2940 2436 vpddj.exe xrrlffl.exe PID 2436 wrote to memory of 2940 2436 vpddj.exe xrrlffl.exe PID 2436 wrote to memory of 2940 2436 vpddj.exe xrrlffl.exe PID 2940 wrote to memory of 1532 2940 xrrlffl.exe dvjdj.exe PID 2940 wrote to memory of 1532 2940 xrrlffl.exe dvjdj.exe PID 2940 wrote to memory of 1532 2940 xrrlffl.exe dvjdj.exe PID 2940 wrote to memory of 1532 2940 xrrlffl.exe dvjdj.exe PID 1532 wrote to memory of 2696 1532 dvjdj.exe 42408.exe PID 1532 wrote to memory of 2696 1532 dvjdj.exe 42408.exe PID 1532 wrote to memory of 2696 1532 dvjdj.exe 42408.exe PID 1532 wrote to memory of 2696 1532 dvjdj.exe 42408.exe PID 2696 wrote to memory of 2916 2696 42408.exe 6082440.exe PID 2696 wrote to memory of 2916 2696 42408.exe 6082440.exe PID 2696 wrote to memory of 2916 2696 42408.exe 6082440.exe PID 2696 wrote to memory of 2916 2696 42408.exe 6082440.exe PID 2916 wrote to memory of 2412 2916 6082440.exe vjppd.exe PID 2916 wrote to memory of 2412 2916 6082440.exe vjppd.exe PID 2916 wrote to memory of 2412 2916 6082440.exe vjppd.exe PID 2916 wrote to memory of 2412 2916 6082440.exe vjppd.exe PID 2412 wrote to memory of 1700 2412 vjppd.exe vjpvv.exe PID 2412 wrote to memory of 1700 2412 vjppd.exe vjpvv.exe PID 2412 wrote to memory of 1700 2412 vjppd.exe vjpvv.exe PID 2412 wrote to memory of 1700 2412 vjppd.exe vjpvv.exe PID 1700 wrote to memory of 2236 1700 vjpvv.exe g6408.exe PID 1700 wrote to memory of 2236 1700 vjpvv.exe g6408.exe PID 1700 wrote to memory of 2236 1700 vjpvv.exe g6408.exe PID 1700 wrote to memory of 2236 1700 vjpvv.exe g6408.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\64002.exec:\64002.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\08666.exec:\08666.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\tnhtnn.exec:\tnhtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\648422.exec:\648422.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\rxfxlll.exec:\rxfxlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\1lllffr.exec:\1lllffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\2266824.exec:\2266824.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\vpddj.exec:\vpddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\xrrlffl.exec:\xrrlffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\dvjdj.exec:\dvjdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\42408.exec:\42408.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\6082440.exec:\6082440.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\vjppd.exec:\vjppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\vjpvv.exec:\vjpvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\g6408.exec:\g6408.exe18⤵
- Executes dropped EXE
PID:2236 -
\??\c:\dvjpj.exec:\dvjpj.exe19⤵
- Executes dropped EXE
PID:1984 -
\??\c:\ppdvd.exec:\ppdvd.exe20⤵
- Executes dropped EXE
PID:2660 -
\??\c:\028048.exec:\028048.exe21⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lxlflll.exec:\lxlflll.exe22⤵
- Executes dropped EXE
PID:1260 -
\??\c:\xrlrxrr.exec:\xrlrxrr.exe23⤵
- Executes dropped EXE
PID:2848 -
\??\c:\4240006.exec:\4240006.exe24⤵
- Executes dropped EXE
PID:2276 -
\??\c:\w80028.exec:\w80028.exe25⤵
- Executes dropped EXE
PID:584 -
\??\c:\xlxxflr.exec:\xlxxflr.exe26⤵
- Executes dropped EXE
PID:1788 -
\??\c:\o468440.exec:\o468440.exe27⤵
- Executes dropped EXE
PID:448 -
\??\c:\lflxxfl.exec:\lflxxfl.exe28⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xrfrxfl.exec:\xrfrxfl.exe29⤵
- Executes dropped EXE
PID:1364 -
\??\c:\48046.exec:\48046.exe30⤵
- Executes dropped EXE
PID:1392 -
\??\c:\fxrlrrx.exec:\fxrlrrx.exe31⤵
- Executes dropped EXE
PID:568 -
\??\c:\20624.exec:\20624.exe32⤵
- Executes dropped EXE
PID:2140 -
\??\c:\s2622.exec:\s2622.exe33⤵
- Executes dropped EXE
PID:1716 -
\??\c:\thbnht.exec:\thbnht.exe34⤵
- Executes dropped EXE
PID:1740 -
\??\c:\684082.exec:\684082.exe35⤵
- Executes dropped EXE
PID:2340 -
\??\c:\646688.exec:\646688.exe36⤵
- Executes dropped EXE
PID:1668 -
\??\c:\80268.exec:\80268.exe37⤵
- Executes dropped EXE
PID:1992 -
\??\c:\08046.exec:\08046.exe38⤵
- Executes dropped EXE
PID:1680 -
\??\c:\flxxrff.exec:\flxxrff.exe39⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jvddp.exec:\jvddp.exe40⤵
- Executes dropped EXE
PID:2204 -
\??\c:\tnbbtb.exec:\tnbbtb.exe41⤵
- Executes dropped EXE
PID:3068 -
\??\c:\xlxxlrr.exec:\xlxxlrr.exe42⤵
- Executes dropped EXE
PID:2572 -
\??\c:\e24204.exec:\e24204.exe43⤵
- Executes dropped EXE
PID:2852 -
\??\c:\c824228.exec:\c824228.exe44⤵
- Executes dropped EXE
PID:2260 -
\??\c:\4628066.exec:\4628066.exe45⤵
- Executes dropped EXE
PID:1800 -
\??\c:\3flrrrx.exec:\3flrrrx.exe46⤵
- Executes dropped EXE
PID:2752 -
\??\c:\hbtbnn.exec:\hbtbnn.exe47⤵
- Executes dropped EXE
PID:2612 -
\??\c:\44880.exec:\44880.exe48⤵
- Executes dropped EXE
PID:2440 -
\??\c:\dpdjv.exec:\dpdjv.exe49⤵
- Executes dropped EXE
PID:2436 -
\??\c:\268800.exec:\268800.exe50⤵
- Executes dropped EXE
PID:1708 -
\??\c:\5pppd.exec:\5pppd.exe51⤵
- Executes dropped EXE
PID:2784 -
\??\c:\6426228.exec:\6426228.exe52⤵
- Executes dropped EXE
PID:2512 -
\??\c:\8684628.exec:\8684628.exe53⤵
- Executes dropped EXE
PID:2816 -
\??\c:\86802.exec:\86802.exe54⤵
- Executes dropped EXE
PID:2616 -
\??\c:\lfxfrlx.exec:\lfxfrlx.exe55⤵
- Executes dropped EXE
PID:2152 -
\??\c:\60224.exec:\60224.exe56⤵
- Executes dropped EXE
PID:1512 -
\??\c:\bnhbhb.exec:\bnhbhb.exe57⤵
- Executes dropped EXE
PID:2912 -
\??\c:\268466.exec:\268466.exe58⤵
- Executes dropped EXE
PID:1696 -
\??\c:\660022.exec:\660022.exe59⤵
- Executes dropped EXE
PID:2492 -
\??\c:\9pdjj.exec:\9pdjj.exe60⤵
- Executes dropped EXE
PID:1984 -
\??\c:\pvjjv.exec:\pvjjv.exe61⤵
- Executes dropped EXE
PID:2464 -
\??\c:\48446.exec:\48446.exe62⤵
- Executes dropped EXE
PID:3016 -
\??\c:\4240228.exec:\4240228.exe63⤵
- Executes dropped EXE
PID:672 -
\??\c:\3flrxff.exec:\3flrxff.exe64⤵
- Executes dropped EXE
PID:2604 -
\??\c:\thhhtn.exec:\thhhtn.exe65⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nhtntn.exec:\nhtntn.exe66⤵
- Executes dropped EXE
PID:1492 -
\??\c:\202804.exec:\202804.exe67⤵
- Executes dropped EXE
PID:836 -
\??\c:\vpvjv.exec:\vpvjv.exe68⤵PID:2240
-
\??\c:\9dpdj.exec:\9dpdj.exe69⤵PID:944
-
\??\c:\9frxffr.exec:\9frxffr.exe70⤵PID:344
-
\??\c:\0084064.exec:\0084064.exe71⤵PID:1444
-
\??\c:\nnhhhh.exec:\nnhhhh.exe72⤵PID:1540
-
\??\c:\1vppv.exec:\1vppv.exe73⤵PID:2116
-
\??\c:\5nttnn.exec:\5nttnn.exe74⤵PID:900
-
\??\c:\a4624.exec:\a4624.exe75⤵PID:756
-
\??\c:\264860.exec:\264860.exe76⤵PID:1536
-
\??\c:\ffxflrl.exec:\ffxflrl.exe77⤵PID:1684
-
\??\c:\8848062.exec:\8848062.exe78⤵PID:2392
-
\??\c:\i468484.exec:\i468484.exe79⤵PID:1972
-
\??\c:\rfffxxx.exec:\rfffxxx.exe80⤵PID:1804
-
\??\c:\86846.exec:\86846.exe81⤵PID:1748
-
\??\c:\8828828.exec:\8828828.exe82⤵PID:1076
-
\??\c:\7hhbhh.exec:\7hhbhh.exe83⤵PID:1676
-
\??\c:\vpvdv.exec:\vpvdv.exe84⤵PID:2828
-
\??\c:\42640.exec:\42640.exe85⤵PID:1816
-
\??\c:\08280.exec:\08280.exe86⤵PID:1664
-
\??\c:\7pvdj.exec:\7pvdj.exe87⤵PID:2636
-
\??\c:\686826.exec:\686826.exe88⤵PID:2432
-
\??\c:\xrrlllx.exec:\xrrlllx.exe89⤵PID:2836
-
\??\c:\xrxxfff.exec:\xrxxfff.exe90⤵PID:2556
-
\??\c:\20622.exec:\20622.exe91⤵PID:2588
-
\??\c:\68440.exec:\68440.exe92⤵PID:2312
-
\??\c:\hbttnh.exec:\hbttnh.exe93⤵PID:2612
-
\??\c:\tnttht.exec:\tnttht.exe94⤵PID:2500
-
\??\c:\5xlfllr.exec:\5xlfllr.exe95⤵PID:1092
-
\??\c:\c606062.exec:\c606062.exe96⤵PID:2792
-
\??\c:\nbhhtb.exec:\nbhhtb.exe97⤵PID:2916
-
\??\c:\nhtbhn.exec:\nhtbhn.exe98⤵PID:2512
-
\??\c:\rlrllrf.exec:\rlrllrf.exe99⤵PID:2816
-
\??\c:\8688028.exec:\8688028.exe100⤵PID:2616
-
\??\c:\thtntt.exec:\thtntt.exe101⤵PID:2152
-
\??\c:\6028646.exec:\6028646.exe102⤵PID:1812
-
\??\c:\2680228.exec:\2680228.exe103⤵PID:2912
-
\??\c:\2024868.exec:\2024868.exe104⤵PID:1696
-
\??\c:\424000.exec:\424000.exe105⤵PID:2600
-
\??\c:\264028.exec:\264028.exe106⤵PID:2692
-
\??\c:\864066.exec:\864066.exe107⤵PID:1144
-
\??\c:\60248.exec:\60248.exe108⤵PID:3016
-
\??\c:\e08684.exec:\e08684.exe109⤵PID:672
-
\??\c:\82228.exec:\82228.exe110⤵PID:2604
-
\??\c:\08000.exec:\08000.exe111⤵PID:1632
-
\??\c:\64668.exec:\64668.exe112⤵PID:2968
-
\??\c:\1lrlrlr.exec:\1lrlrlr.exe113⤵PID:2376
-
\??\c:\64068.exec:\64068.exe114⤵PID:1788
-
\??\c:\684444.exec:\684444.exe115⤵PID:1132
-
\??\c:\420806.exec:\420806.exe116⤵PID:1028
-
\??\c:\2466606.exec:\2466606.exe117⤵PID:1348
-
\??\c:\820624.exec:\820624.exe118⤵PID:1672
-
\??\c:\fxlfffl.exec:\fxlfffl.exe119⤵PID:376
-
\??\c:\3httbb.exec:\3httbb.exe120⤵PID:2384
-
\??\c:\608288.exec:\608288.exe121⤵PID:600
-
\??\c:\fxlfxrr.exec:\fxlfxrr.exe122⤵PID:1948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-