Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 18:23
Behavioral task
behavioral1
Sample
b6227b51478fc50c793c1097f9a25270_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
b6227b51478fc50c793c1097f9a25270_NeikiAnalytics.exe
-
Size
441KB
-
MD5
b6227b51478fc50c793c1097f9a25270
-
SHA1
3cc4c3e0c12515ffe4a2b48934db399039ba516a
-
SHA256
004ab26c1eee3145a14af87d783262944abb7fd17de982d202e44f046a13c58c
-
SHA512
151b11fe654b43b815c7ec4fe8f6f60ec8073fcb75fa50348a12e94db63779b69bcf14e099973ec5b268f12108e9aea858697675e5d42b1b41bb7cb26a562cb9
-
SSDEEP
12288:M4wFHoSpg4wFHonR/nPF2LnFL4wF04wFK4wFK4wluz:UrR/nPs
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/2840-110-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/844-237-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2964-304-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2256-311-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1592-319-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2132-332-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2708-339-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2684-346-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2804-353-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2448-360-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2548-374-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2572-381-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/3032-388-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2388-395-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2388-394-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1676-367-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2036-289-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2152-280-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/904-271-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1820-262-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1068-253-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/844-244-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1392-234-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/484-225-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1984-216-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1912-207-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/3064-198-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1404-181-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1404-175-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2776-171-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2176-161-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1044-152-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/884-142-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1520-133-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/3024-99-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1668-90-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2608-81-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2928-63-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2520-72-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2696-54-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2644-45-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2588-35-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2588-34-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2920-26-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1968-17-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2320-7-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2852-402-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2852-401-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2488-409-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2508-418-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1792-427-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1792-424-0x0000000001CF0000-0x0000000001D7C000-memory.dmp family_blackmoon behavioral1/memory/2564-428-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1552-441-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2724-442-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2724-449-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/620-456-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/620-459-0x0000000001D10000-0x0000000001D9C000-memory.dmp family_blackmoon behavioral1/memory/620-464-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/3012-471-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2880-472-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2880-479-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/744-486-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1988-487-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1968 xrxrxrl.exe 2920 btnbnn.exe 2588 7pjvd.exe 2644 ffflrxl.exe 2696 tnbhtt.exe 2928 ppvdd.exe 2520 3lflxlx.exe 2608 tnnthh.exe 1668 pjvjv.exe 3024 ffxfrrf.exe 1824 hhbnht.exe 2840 9dvvj.exe 2896 9frfrrf.exe 1520 bbtnbh.exe 884 vpjvp.exe 1044 1rrfflx.exe 2176 xrlrrfl.exe 2776 pjjvp.exe 1404 pjdjj.exe 3036 rfflrxl.exe 3064 tntbnn.exe 1912 vpppj.exe 1984 rrlfrlx.exe 484 7hbtnn.exe 1392 dpjvd.exe 844 rlfrfrx.exe 1068 vvjvj.exe 1820 rlxflrx.exe 904 nnhtnn.exe 2152 9ddpj.exe 2036 3xlrllx.exe 2144 9tnthh.exe 2964 lfflxlx.exe 2256 1tntbb.exe 1592 jvvjj.exe 2028 1lxxllx.exe 2132 7bbhbh.exe 2708 pjvvj.exe 2684 3rllrrf.exe 2804 ttnbnt.exe 2448 vvpvp.exe 1676 rlllxxf.exe 2548 hhbnbh.exe 2572 vpjvj.exe 3032 rrlxllx.exe 2388 bbnbnt.exe 2852 dvvjv.exe 2488 fxlxllf.exe 2508 tthntb.exe 1792 nhtntt.exe 2564 dvjvd.exe 1552 pjpvj.exe 2724 7llflll.exe 3036 5bbhnt.exe 620 jvvjp.exe 3012 rxrrxfl.exe 2880 vvjpv.exe 744 nhbnbn.exe 1988 9hhnbt.exe 996 xrlrxxl.exe 1488 3nnbnn.exe 1532 xrflxfl.exe 1060 1nntbb.exe 2756 vjdjv.exe -
resource yara_rule behavioral1/memory/2320-1-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x000a00000001227f-5.dat upx behavioral1/memory/1968-9-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0036000000015cfd-19.dat upx behavioral1/files/0x0008000000015d42-28.dat upx behavioral1/files/0x0008000000015fd4-65.dat upx behavioral1/files/0x0008000000016d1a-82.dat upx behavioral1/memory/2840-110-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0006000000016d4c-118.dat upx behavioral1/files/0x0006000000016d6c-144.dat upx behavioral1/memory/2776-165-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0006000000016da0-173.dat upx behavioral1/files/0x0006000000016db2-183.dat upx behavioral1/files/0x0006000000016dc8-190.dat upx behavioral1/files/0x00060000000171ba-209.dat upx behavioral1/files/0x000600000001720f-218.dat upx behavioral1/files/0x0037000000015d09-227.dat upx behavioral1/memory/844-237-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x00060000000173d3-246.dat upx behavioral1/files/0x00060000000173d6-255.dat upx behavioral1/files/0x0006000000017568-264.dat upx behavioral1/files/0x00060000000175e8-273.dat upx behavioral1/files/0x00050000000186ff-291.dat upx behavioral1/memory/2964-304-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2256-311-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1592-319-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2132-332-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2708-339-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2684-346-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2804-353-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2448-360-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2548-374-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2572-381-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/3032-388-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2388-395-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1676-367-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1592-312-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2036-289-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x00060000000175f4-282.dat upx behavioral1/memory/2152-280-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/904-271-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1820-262-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1068-253-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/844-244-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x00060000000173b4-236.dat upx behavioral1/memory/1392-234-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/484-225-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1984-216-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1912-207-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0006000000016dd1-200.dat upx behavioral1/memory/3064-198-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1404-181-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1404-175-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2776-171-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0006000000016d78-163.dat upx behavioral1/files/0x0006000000016d70-154.dat upx behavioral1/memory/2176-161-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1044-152-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1044-146-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/884-142-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0006000000016d68-135.dat upx behavioral1/memory/1520-133-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0006000000016d55-126.dat upx behavioral1/files/0x0006000000016d44-109.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2320 wrote to memory of 1968 2320 b6227b51478fc50c793c1097f9a25270_NeikiAnalytics.exe 28 PID 2320 wrote to memory of 1968 2320 b6227b51478fc50c793c1097f9a25270_NeikiAnalytics.exe 28 PID 2320 wrote to memory of 1968 2320 b6227b51478fc50c793c1097f9a25270_NeikiAnalytics.exe 28 PID 2320 wrote to memory of 1968 2320 b6227b51478fc50c793c1097f9a25270_NeikiAnalytics.exe 28 PID 1968 wrote to memory of 2920 1968 xrxrxrl.exe 29 PID 1968 wrote to memory of 2920 1968 xrxrxrl.exe 29 PID 1968 wrote to memory of 2920 1968 xrxrxrl.exe 29 PID 1968 wrote to memory of 2920 1968 xrxrxrl.exe 29 PID 2920 wrote to memory of 2588 2920 btnbnn.exe 30 PID 2920 wrote to memory of 2588 2920 btnbnn.exe 30 PID 2920 wrote to memory of 2588 2920 btnbnn.exe 30 PID 2920 wrote to memory of 2588 2920 btnbnn.exe 30 PID 2588 wrote to memory of 2644 2588 7pjvd.exe 31 PID 2588 wrote to memory of 2644 2588 7pjvd.exe 31 PID 2588 wrote to memory of 2644 2588 7pjvd.exe 31 PID 2588 wrote to memory of 2644 2588 7pjvd.exe 31 PID 2644 wrote to memory of 2696 2644 ffflrxl.exe 32 PID 2644 wrote to memory of 2696 2644 ffflrxl.exe 32 PID 2644 wrote to memory of 2696 2644 ffflrxl.exe 32 PID 2644 wrote to memory of 2696 2644 ffflrxl.exe 32 PID 2696 wrote to memory of 2928 2696 tnbhtt.exe 33 PID 2696 wrote to memory of 2928 2696 tnbhtt.exe 33 PID 2696 wrote to memory of 2928 2696 tnbhtt.exe 33 PID 2696 wrote to memory of 2928 2696 tnbhtt.exe 33 PID 2928 wrote to memory of 2520 2928 ppvdd.exe 34 PID 2928 wrote to memory of 2520 2928 ppvdd.exe 34 PID 2928 wrote to memory of 2520 2928 ppvdd.exe 34 PID 2928 wrote to memory of 2520 2928 ppvdd.exe 34 PID 2520 wrote to memory of 2608 2520 3lflxlx.exe 35 PID 2520 wrote to memory of 2608 2520 3lflxlx.exe 35 PID 2520 wrote to memory of 2608 2520 3lflxlx.exe 35 PID 2520 wrote to memory of 2608 2520 3lflxlx.exe 35 PID 2608 wrote to memory of 1668 2608 tnnthh.exe 36 PID 2608 wrote to memory of 1668 2608 tnnthh.exe 36 PID 2608 wrote to memory of 1668 2608 tnnthh.exe 36 PID 2608 wrote to memory of 1668 2608 tnnthh.exe 36 PID 1668 wrote to memory of 3024 1668 pjvjv.exe 37 PID 1668 wrote to memory of 3024 1668 pjvjv.exe 37 PID 1668 wrote to memory of 3024 1668 pjvjv.exe 37 PID 1668 wrote to memory of 3024 1668 pjvjv.exe 37 PID 3024 wrote to memory of 1824 3024 ffxfrrf.exe 38 PID 3024 wrote to memory of 1824 3024 ffxfrrf.exe 38 PID 3024 wrote to memory of 1824 3024 ffxfrrf.exe 38 PID 3024 wrote to memory of 1824 3024 ffxfrrf.exe 38 PID 1824 wrote to memory of 2840 1824 hhbnht.exe 39 PID 1824 wrote to memory of 2840 1824 hhbnht.exe 39 PID 1824 wrote to memory of 2840 1824 hhbnht.exe 39 PID 1824 wrote to memory of 2840 1824 hhbnht.exe 39 PID 2840 wrote to memory of 2896 2840 9dvvj.exe 40 PID 2840 wrote to memory of 2896 2840 9dvvj.exe 40 PID 2840 wrote to memory of 2896 2840 9dvvj.exe 40 PID 2840 wrote to memory of 2896 2840 9dvvj.exe 40 PID 2896 wrote to memory of 1520 2896 9frfrrf.exe 41 PID 2896 wrote to memory of 1520 2896 9frfrrf.exe 41 PID 2896 wrote to memory of 1520 2896 9frfrrf.exe 41 PID 2896 wrote to memory of 1520 2896 9frfrrf.exe 41 PID 1520 wrote to memory of 884 1520 bbtnbh.exe 42 PID 1520 wrote to memory of 884 1520 bbtnbh.exe 42 PID 1520 wrote to memory of 884 1520 bbtnbh.exe 42 PID 1520 wrote to memory of 884 1520 bbtnbh.exe 42 PID 884 wrote to memory of 1044 884 vpjvp.exe 43 PID 884 wrote to memory of 1044 884 vpjvp.exe 43 PID 884 wrote to memory of 1044 884 vpjvp.exe 43 PID 884 wrote to memory of 1044 884 vpjvp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6227b51478fc50c793c1097f9a25270_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b6227b51478fc50c793c1097f9a25270_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\xrxrxrl.exec:\xrxrxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\btnbnn.exec:\btnbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\7pjvd.exec:\7pjvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\ffflrxl.exec:\ffflrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\tnbhtt.exec:\tnbhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\ppvdd.exec:\ppvdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\3lflxlx.exec:\3lflxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\tnnthh.exec:\tnnthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\pjvjv.exec:\pjvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\ffxfrrf.exec:\ffxfrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\hhbnht.exec:\hhbnht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\9dvvj.exec:\9dvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\9frfrrf.exec:\9frfrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\bbtnbh.exec:\bbtnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\vpjvp.exec:\vpjvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\1rrfflx.exec:\1rrfflx.exe17⤵
- Executes dropped EXE
PID:1044 -
\??\c:\xrlrrfl.exec:\xrlrrfl.exe18⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pjjvp.exec:\pjjvp.exe19⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pjdjj.exec:\pjdjj.exe20⤵
- Executes dropped EXE
PID:1404 -
\??\c:\rfflrxl.exec:\rfflrxl.exe21⤵
- Executes dropped EXE
PID:3036 -
\??\c:\tntbnn.exec:\tntbnn.exe22⤵
- Executes dropped EXE
PID:3064 -
\??\c:\vpppj.exec:\vpppj.exe23⤵
- Executes dropped EXE
PID:1912 -
\??\c:\rrlfrlx.exec:\rrlfrlx.exe24⤵
- Executes dropped EXE
PID:1984 -
\??\c:\7hbtnn.exec:\7hbtnn.exe25⤵
- Executes dropped EXE
PID:484 -
\??\c:\dpjvd.exec:\dpjvd.exe26⤵
- Executes dropped EXE
PID:1392 -
\??\c:\rlfrfrx.exec:\rlfrfrx.exe27⤵
- Executes dropped EXE
PID:844 -
\??\c:\vvjvj.exec:\vvjvj.exe28⤵
- Executes dropped EXE
PID:1068 -
\??\c:\rlxflrx.exec:\rlxflrx.exe29⤵
- Executes dropped EXE
PID:1820 -
\??\c:\nnhtnn.exec:\nnhtnn.exe30⤵
- Executes dropped EXE
PID:904 -
\??\c:\9ddpj.exec:\9ddpj.exe31⤵
- Executes dropped EXE
PID:2152 -
\??\c:\3xlrllx.exec:\3xlrllx.exe32⤵
- Executes dropped EXE
PID:2036 -
\??\c:\9tnthh.exec:\9tnthh.exe33⤵
- Executes dropped EXE
PID:2144 -
\??\c:\lfflxlx.exec:\lfflxlx.exe34⤵
- Executes dropped EXE
PID:2964 -
\??\c:\1tntbb.exec:\1tntbb.exe35⤵
- Executes dropped EXE
PID:2256 -
\??\c:\jvvjj.exec:\jvvjj.exe36⤵
- Executes dropped EXE
PID:1592 -
\??\c:\1lxxllx.exec:\1lxxllx.exe37⤵
- Executes dropped EXE
PID:2028 -
\??\c:\7bbhbh.exec:\7bbhbh.exe38⤵
- Executes dropped EXE
PID:2132 -
\??\c:\pjvvj.exec:\pjvvj.exe39⤵
- Executes dropped EXE
PID:2708 -
\??\c:\3rllrrf.exec:\3rllrrf.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\ttnbnt.exec:\ttnbnt.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\vvpvp.exec:\vvpvp.exe42⤵
- Executes dropped EXE
PID:2448 -
\??\c:\rlllxxf.exec:\rlllxxf.exe43⤵
- Executes dropped EXE
PID:1676 -
\??\c:\hhbnbh.exec:\hhbnbh.exe44⤵
- Executes dropped EXE
PID:2548 -
\??\c:\vpjvj.exec:\vpjvj.exe45⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rrlxllx.exec:\rrlxllx.exe46⤵
- Executes dropped EXE
PID:3032 -
\??\c:\bbnbnt.exec:\bbnbnt.exe47⤵
- Executes dropped EXE
PID:2388 -
\??\c:\dvvjv.exec:\dvvjv.exe48⤵
- Executes dropped EXE
PID:2852 -
\??\c:\fxlxllf.exec:\fxlxllf.exe49⤵
- Executes dropped EXE
PID:2488 -
\??\c:\tthntb.exec:\tthntb.exe50⤵
- Executes dropped EXE
PID:2508 -
\??\c:\nhtntt.exec:\nhtntt.exe51⤵
- Executes dropped EXE
PID:1792 -
\??\c:\dvjvd.exec:\dvjvd.exe52⤵
- Executes dropped EXE
PID:2564 -
\??\c:\pjpvj.exec:\pjpvj.exe53⤵
- Executes dropped EXE
PID:1552 -
\??\c:\7llflll.exec:\7llflll.exe54⤵
- Executes dropped EXE
PID:2724 -
\??\c:\5bbhnt.exec:\5bbhnt.exe55⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jvvjp.exec:\jvvjp.exe56⤵
- Executes dropped EXE
PID:620 -
\??\c:\rxrrxfl.exec:\rxrrxfl.exe57⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vvjpv.exec:\vvjpv.exe58⤵
- Executes dropped EXE
PID:2880 -
\??\c:\nhbnbn.exec:\nhbnbn.exe59⤵
- Executes dropped EXE
PID:744 -
\??\c:\9hhnbt.exec:\9hhnbt.exe60⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe61⤵
- Executes dropped EXE
PID:996 -
\??\c:\3nnbnn.exec:\3nnbnn.exe62⤵
- Executes dropped EXE
PID:1488 -
\??\c:\xrflxfl.exec:\xrflxfl.exe63⤵
- Executes dropped EXE
PID:1532 -
\??\c:\1nntbb.exec:\1nntbb.exe64⤵
- Executes dropped EXE
PID:1060 -
\??\c:\vjdjv.exec:\vjdjv.exe65⤵
- Executes dropped EXE
PID:2756 -
\??\c:\ffrfflf.exec:\ffrfflf.exe66⤵PID:1512
-
\??\c:\nbttbb.exec:\nbttbb.exe67⤵PID:916
-
\??\c:\1dddj.exec:\1dddj.exe68⤵PID:1312
-
\??\c:\nnnbhn.exec:\nnnbhn.exe69⤵PID:2036
-
\??\c:\9bbtbh.exec:\9bbtbh.exe70⤵PID:608
-
\??\c:\lfxflrf.exec:\lfxflrf.exe71⤵PID:2456
-
\??\c:\9btthh.exec:\9btthh.exe72⤵PID:2204
-
\??\c:\5hntht.exec:\5hntht.exe73⤵PID:2828
-
\??\c:\pvdpd.exec:\pvdpd.exe74⤵PID:708
-
\??\c:\xxrlxrx.exec:\xxrlxrx.exe75⤵PID:2028
-
\??\c:\5lxfllr.exec:\5lxfllr.exe76⤵PID:2364
-
\??\c:\5nhhnn.exec:\5nhhnn.exe77⤵PID:2268
-
\??\c:\tththh.exec:\tththh.exe78⤵PID:2600
-
\??\c:\7vdvv.exec:\7vdvv.exe79⤵PID:2136
-
\??\c:\fxlrrrf.exec:\fxlrrrf.exe80⤵PID:1364
-
\??\c:\tnhhnn.exec:\tnhhnn.exe81⤵PID:2620
-
\??\c:\tnbhnn.exec:\tnbhnn.exe82⤵PID:2448
-
\??\c:\pppvd.exec:\pppvd.exe83⤵PID:1972
-
\??\c:\5fxxxrf.exec:\5fxxxrf.exe84⤵PID:2668
-
\??\c:\xxlrllx.exec:\xxlrllx.exe85⤵PID:812
-
\??\c:\tnbhbh.exec:\tnbhbh.exe86⤵PID:2192
-
\??\c:\ppjpj.exec:\ppjpj.exe87⤵PID:3024
-
\??\c:\xrfllrf.exec:\xrfllrf.exe88⤵PID:1600
-
\??\c:\rxrxlxl.exec:\rxrxlxl.exe89⤵PID:2848
-
\??\c:\3tthtb.exec:\3tthtb.exe90⤵PID:2788
-
\??\c:\jddjv.exec:\jddjv.exe91⤵PID:2656
-
\??\c:\pjvjv.exec:\pjvjv.exe92⤵PID:2888
-
\??\c:\llllrrx.exec:\llllrrx.exe93⤵PID:2892
-
\??\c:\tttbhn.exec:\tttbhn.exe94⤵PID:3000
-
\??\c:\nhbntt.exec:\nhbntt.exe95⤵PID:1952
-
\??\c:\jvddd.exec:\jvddd.exe96⤵PID:2172
-
\??\c:\rlrrflx.exec:\rlrrflx.exe97⤵PID:2480
-
\??\c:\xfrlxll.exec:\xfrlxll.exe98⤵PID:2564
-
\??\c:\3nnthn.exec:\3nnthn.exe99⤵PID:2760
-
\??\c:\3nbbhh.exec:\3nbbhh.exe100⤵PID:2868
-
\??\c:\dvpdp.exec:\dvpdp.exe101⤵PID:3036
-
\??\c:\3lfllrr.exec:\3lfllrr.exe102⤵PID:3052
-
\??\c:\5tbntt.exec:\5tbntt.exe103⤵PID:2008
-
\??\c:\vjvvv.exec:\vjvvv.exe104⤵PID:1924
-
\??\c:\vjddj.exec:\vjddj.exe105⤵PID:2880
-
\??\c:\frfffrx.exec:\frfffrx.exe106⤵PID:2084
-
\??\c:\nbbhnt.exec:\nbbhnt.exe107⤵PID:1156
-
\??\c:\ddpvp.exec:\ddpvp.exe108⤵PID:900
-
\??\c:\3flrfff.exec:\3flrfff.exe109⤵PID:584
-
\??\c:\3fxrxfr.exec:\3fxrxfr.exe110⤵PID:1068
-
\??\c:\tnhhnn.exec:\tnhhnn.exe111⤵PID:832
-
\??\c:\vddjj.exec:\vddjj.exe112⤵PID:2432
-
\??\c:\1vdjd.exec:\1vdjd.exe113⤵PID:912
-
\??\c:\rllxllx.exec:\rllxllx.exe114⤵PID:1264
-
\??\c:\9bnntt.exec:\9bnntt.exe115⤵PID:2292
-
\??\c:\1hnnbb.exec:\1hnnbb.exe116⤵PID:2276
-
\??\c:\jvjpv.exec:\jvjpv.exe117⤵PID:820
-
\??\c:\5rxffll.exec:\5rxffll.exe118⤵PID:880
-
\??\c:\5xlflff.exec:\5xlflff.exe119⤵PID:2992
-
\??\c:\3bthth.exec:\3bthth.exe120⤵PID:1712
-
\??\c:\5jjpv.exec:\5jjpv.exe121⤵PID:664
-
\??\c:\dvjdv.exec:\dvjdv.exe122⤵PID:696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-