Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 01:43
Behavioral task
behavioral1
Sample
1e4396f9762910d948b9ac3f4d102440_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1e4396f9762910d948b9ac3f4d102440_NeikiAnalytics.exe
-
Size
234KB
-
MD5
1e4396f9762910d948b9ac3f4d102440
-
SHA1
c36446138cd462cef6a226a8697217558adbb933
-
SHA256
42a3e7b46f0cde7079020d42b5915a357b32a8ddc7ac9661dcc88921b2136a85
-
SHA512
26e9690e006f8b4ff8b647483b3eed9bd2dcf237e5bf8bc9915c14abd1a800ea661bd18feed11ad8dabd6f407fcc1415e6c8e518a6e3498a5a20b84429fb740a
-
SSDEEP
6144:kcm4FmowdHoSSGpJw4PqhraHcpOmFTHDGYhEf5X2a1:y4wFHoSSGpJwGeeFmFTNAp2G
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2188-9-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2956-11-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2956-20-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2660-34-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2700-31-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2752-49-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1740-58-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2684-75-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2528-84-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2208-102-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2856-105-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1516-127-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1272-137-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/552-139-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1388-162-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1124-171-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2400-190-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/760-193-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1632-215-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/628-224-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1044-228-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/684-259-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2224-292-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1780-312-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2972-319-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2668-345-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1628-371-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1524-372-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1524-379-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/548-428-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/316-454-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/316-462-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2052-475-0x0000000000220000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1356-554-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2212-579-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2012-586-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2088-777-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1856-805-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1820-851-0x00000000003A0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1944-896-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2956 1fxxlll.exe 2700 1hnnbt.exe 2660 dvjjp.exe 2752 xrlxlxr.exe 1740 9tbhbh.exe 2828 ppdpd.exe 2684 fffxxrf.exe 2528 hnthnh.exe 1576 ddpjv.exe 2208 lxxxfrx.exe 2856 bbthbn.exe 2992 dvjjv.exe 1516 lxffrfx.exe 1272 3hbntb.exe 552 pdpjj.exe 316 lxfxxrl.exe 1388 rrrlxxf.exe 1124 7nnbtn.exe 2264 xxxfrxl.exe 2400 nhbtht.exe 760 jjjdj.exe 576 vdjvp.exe 1632 htbbtt.exe 628 jvpdv.exe 1044 lfxxflx.exe 2388 7hhnht.exe 1640 jjdvp.exe 684 xrllxfr.exe 1708 nnttnn.exe 852 lfflxxl.exe 2200 xffxxrl.exe 2224 5ntnhn.exe 1556 htnntn.exe 2128 fxllflr.exe 1780 rxfflfl.exe 2972 nnnhhn.exe 2448 pppjd.exe 1600 rrfxrrx.exe 2076 ddppj.exe 2756 xxrrffr.exe 2668 frxrlff.exe 2752 ttbnbh.exe 2540 jpvvv.exe 1628 rffrrfl.exe 1524 btbhtt.exe 2560 hhnbbn.exe 2520 3vpvj.exe 1988 9ttnhh.exe 3004 5vjjv.exe 2864 5dvjd.exe 2980 rlrxrfx.exe 2556 xxrfxlr.exe 1736 1nhthn.exe 548 ddvjv.exe 1648 dvvdp.exe 2816 lfrrflx.exe 1420 1nttbh.exe 316 tbthhb.exe 2008 vvdpj.exe 2052 xrlxxlx.exe 1260 hhtbtn.exe 1308 nbbtnh.exe 664 ppjvp.exe 332 pppvj.exe -
resource yara_rule behavioral1/memory/2188-0-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x001000000001226b-5.dat upx behavioral1/memory/2188-9-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2956-11-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2700-21-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2956-20-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0035000000015c7f-19.dat upx behavioral1/memory/2700-25-0x0000000000220000-0x0000000000257000-memory.dmp upx behavioral1/files/0x0007000000015ccf-40.dat upx behavioral1/memory/2660-34-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0008000000015cc7-32.dat upx behavioral1/memory/2700-31-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2752-49-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0007000000015ce3-46.dat upx behavioral1/memory/1740-58-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0007000000015cf0-56.dat upx behavioral1/files/0x0007000000015d02-65.dat upx behavioral1/files/0x0008000000015d19-74.dat upx behavioral1/memory/2684-75-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2528-84-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x000800000001663f-82.dat upx behavioral1/memory/1576-85-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x000600000001686d-92.dat upx behavioral1/files/0x0006000000016abb-101.dat upx behavioral1/memory/2208-102-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2856-105-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016c56-111.dat upx behavioral1/files/0x0006000000016c71-118.dat upx behavioral1/memory/1516-127-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016c7a-128.dat upx behavioral1/files/0x0006000000016cc3-135.dat upx behavioral1/memory/1272-137-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/552-139-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016ce7-146.dat upx behavioral1/files/0x0006000000016d1b-154.dat upx behavioral1/files/0x0035000000015c93-163.dat upx behavioral1/memory/1388-162-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016d2c-172.dat upx behavioral1/memory/1124-171-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016d34-180.dat upx behavioral1/memory/2400-190-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016d3d-189.dat upx behavioral1/memory/760-193-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016d45-199.dat upx behavioral1/files/0x0006000000016d4e-207.dat upx behavioral1/memory/1632-215-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016d61-216.dat upx behavioral1/memory/628-224-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016d65-225.dat upx behavioral1/memory/1044-228-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016d69-234.dat upx behavioral1/files/0x0006000000016d71-243.dat upx behavioral1/files/0x0006000000016dda-250.dat upx behavioral1/memory/684-251-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/684-259-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016dde-260.dat upx behavioral1/files/0x0006000000016de7-268.dat upx behavioral1/files/0x0006000000016eb9-276.dat upx behavioral1/files/0x0006000000017042-283.dat upx behavioral1/memory/2224-292-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/1780-305-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/1780-312-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2972-319-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/1600-326-0x0000000000400000-0x0000000000437000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2956 2188 1e4396f9762910d948b9ac3f4d102440_NeikiAnalytics.exe 28 PID 2188 wrote to memory of 2956 2188 1e4396f9762910d948b9ac3f4d102440_NeikiAnalytics.exe 28 PID 2188 wrote to memory of 2956 2188 1e4396f9762910d948b9ac3f4d102440_NeikiAnalytics.exe 28 PID 2188 wrote to memory of 2956 2188 1e4396f9762910d948b9ac3f4d102440_NeikiAnalytics.exe 28 PID 2956 wrote to memory of 2700 2956 1fxxlll.exe 29 PID 2956 wrote to memory of 2700 2956 1fxxlll.exe 29 PID 2956 wrote to memory of 2700 2956 1fxxlll.exe 29 PID 2956 wrote to memory of 2700 2956 1fxxlll.exe 29 PID 2700 wrote to memory of 2660 2700 1hnnbt.exe 30 PID 2700 wrote to memory of 2660 2700 1hnnbt.exe 30 PID 2700 wrote to memory of 2660 2700 1hnnbt.exe 30 PID 2700 wrote to memory of 2660 2700 1hnnbt.exe 30 PID 2660 wrote to memory of 2752 2660 dvjjp.exe 31 PID 2660 wrote to memory of 2752 2660 dvjjp.exe 31 PID 2660 wrote to memory of 2752 2660 dvjjp.exe 31 PID 2660 wrote to memory of 2752 2660 dvjjp.exe 31 PID 2752 wrote to memory of 1740 2752 xrlxlxr.exe 32 PID 2752 wrote to memory of 1740 2752 xrlxlxr.exe 32 PID 2752 wrote to memory of 1740 2752 xrlxlxr.exe 32 PID 2752 wrote to memory of 1740 2752 xrlxlxr.exe 32 PID 1740 wrote to memory of 2828 1740 9tbhbh.exe 33 PID 1740 wrote to memory of 2828 1740 9tbhbh.exe 33 PID 1740 wrote to memory of 2828 1740 9tbhbh.exe 33 PID 1740 wrote to memory of 2828 1740 9tbhbh.exe 33 PID 2828 wrote to memory of 2684 2828 ppdpd.exe 34 PID 2828 wrote to memory of 2684 2828 ppdpd.exe 34 PID 2828 wrote to memory of 2684 2828 ppdpd.exe 34 PID 2828 wrote to memory of 2684 2828 ppdpd.exe 34 PID 2684 wrote to memory of 2528 2684 fffxxrf.exe 35 PID 2684 wrote to memory of 2528 2684 fffxxrf.exe 35 PID 2684 wrote to memory of 2528 2684 fffxxrf.exe 35 PID 2684 wrote to memory of 2528 2684 fffxxrf.exe 35 PID 2528 wrote to memory of 1576 2528 hnthnh.exe 36 PID 2528 wrote to memory of 1576 2528 hnthnh.exe 36 PID 2528 wrote to memory of 1576 2528 hnthnh.exe 36 PID 2528 wrote to memory of 1576 2528 hnthnh.exe 36 PID 1576 wrote to memory of 2208 1576 ddpjv.exe 37 PID 1576 wrote to memory of 2208 1576 ddpjv.exe 37 PID 1576 wrote to memory of 2208 1576 ddpjv.exe 37 PID 1576 wrote to memory of 2208 1576 ddpjv.exe 37 PID 2208 wrote to memory of 2856 2208 lxxxfrx.exe 38 PID 2208 wrote to memory of 2856 2208 lxxxfrx.exe 38 PID 2208 wrote to memory of 2856 2208 lxxxfrx.exe 38 PID 2208 wrote to memory of 2856 2208 lxxxfrx.exe 38 PID 2856 wrote to memory of 2992 2856 bbthbn.exe 39 PID 2856 wrote to memory of 2992 2856 bbthbn.exe 39 PID 2856 wrote to memory of 2992 2856 bbthbn.exe 39 PID 2856 wrote to memory of 2992 2856 bbthbn.exe 39 PID 2992 wrote to memory of 1516 2992 dvjjv.exe 40 PID 2992 wrote to memory of 1516 2992 dvjjv.exe 40 PID 2992 wrote to memory of 1516 2992 dvjjv.exe 40 PID 2992 wrote to memory of 1516 2992 dvjjv.exe 40 PID 1516 wrote to memory of 1272 1516 lxffrfx.exe 41 PID 1516 wrote to memory of 1272 1516 lxffrfx.exe 41 PID 1516 wrote to memory of 1272 1516 lxffrfx.exe 41 PID 1516 wrote to memory of 1272 1516 lxffrfx.exe 41 PID 1272 wrote to memory of 552 1272 3hbntb.exe 42 PID 1272 wrote to memory of 552 1272 3hbntb.exe 42 PID 1272 wrote to memory of 552 1272 3hbntb.exe 42 PID 1272 wrote to memory of 552 1272 3hbntb.exe 42 PID 552 wrote to memory of 316 552 pdpjj.exe 43 PID 552 wrote to memory of 316 552 pdpjj.exe 43 PID 552 wrote to memory of 316 552 pdpjj.exe 43 PID 552 wrote to memory of 316 552 pdpjj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e4396f9762910d948b9ac3f4d102440_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1e4396f9762910d948b9ac3f4d102440_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\1fxxlll.exec:\1fxxlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\1hnnbt.exec:\1hnnbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\dvjjp.exec:\dvjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\xrlxlxr.exec:\xrlxlxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\9tbhbh.exec:\9tbhbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\ppdpd.exec:\ppdpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\fffxxrf.exec:\fffxxrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\hnthnh.exec:\hnthnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\ddpjv.exec:\ddpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\lxxxfrx.exec:\lxxxfrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\bbthbn.exec:\bbthbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\dvjjv.exec:\dvjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\lxffrfx.exec:\lxffrfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\3hbntb.exec:\3hbntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\pdpjj.exec:\pdpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\lxfxxrl.exec:\lxfxxrl.exe17⤵
- Executes dropped EXE
PID:316 -
\??\c:\rrrlxxf.exec:\rrrlxxf.exe18⤵
- Executes dropped EXE
PID:1388 -
\??\c:\7nnbtn.exec:\7nnbtn.exe19⤵
- Executes dropped EXE
PID:1124 -
\??\c:\xxxfrxl.exec:\xxxfrxl.exe20⤵
- Executes dropped EXE
PID:2264 -
\??\c:\nhbtht.exec:\nhbtht.exe21⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jjjdj.exec:\jjjdj.exe22⤵
- Executes dropped EXE
PID:760 -
\??\c:\vdjvp.exec:\vdjvp.exe23⤵
- Executes dropped EXE
PID:576 -
\??\c:\htbbtt.exec:\htbbtt.exe24⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jvpdv.exec:\jvpdv.exe25⤵
- Executes dropped EXE
PID:628 -
\??\c:\lfxxflx.exec:\lfxxflx.exe26⤵
- Executes dropped EXE
PID:1044 -
\??\c:\7hhnht.exec:\7hhnht.exe27⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jjdvp.exec:\jjdvp.exe28⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xrllxfr.exec:\xrllxfr.exe29⤵
- Executes dropped EXE
PID:684 -
\??\c:\nnttnn.exec:\nnttnn.exe30⤵
- Executes dropped EXE
PID:1708 -
\??\c:\lfflxxl.exec:\lfflxxl.exe31⤵
- Executes dropped EXE
PID:852 -
\??\c:\xffxxrl.exec:\xffxxrl.exe32⤵
- Executes dropped EXE
PID:2200 -
\??\c:\5ntnhn.exec:\5ntnhn.exe33⤵
- Executes dropped EXE
PID:2224 -
\??\c:\htnntn.exec:\htnntn.exe34⤵
- Executes dropped EXE
PID:1556 -
\??\c:\fxllflr.exec:\fxllflr.exe35⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rxfflfl.exec:\rxfflfl.exe36⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nnnhhn.exec:\nnnhhn.exe37⤵
- Executes dropped EXE
PID:2972 -
\??\c:\pppjd.exec:\pppjd.exe38⤵
- Executes dropped EXE
PID:2448 -
\??\c:\rrfxrrx.exec:\rrfxrrx.exe39⤵
- Executes dropped EXE
PID:1600 -
\??\c:\ddppj.exec:\ddppj.exe40⤵
- Executes dropped EXE
PID:2076 -
\??\c:\xxrrffr.exec:\xxrrffr.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\frxrlff.exec:\frxrlff.exe42⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ttbnbh.exec:\ttbnbh.exe43⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jpvvv.exec:\jpvvv.exe44⤵
- Executes dropped EXE
PID:2540 -
\??\c:\rffrrfl.exec:\rffrrfl.exe45⤵
- Executes dropped EXE
PID:1628 -
\??\c:\btbhtt.exec:\btbhtt.exe46⤵
- Executes dropped EXE
PID:1524 -
\??\c:\hhnbbn.exec:\hhnbbn.exe47⤵
- Executes dropped EXE
PID:2560 -
\??\c:\3vpvj.exec:\3vpvj.exe48⤵
- Executes dropped EXE
PID:2520 -
\??\c:\9ttnhh.exec:\9ttnhh.exe49⤵
- Executes dropped EXE
PID:1988 -
\??\c:\5vjjv.exec:\5vjjv.exe50⤵
- Executes dropped EXE
PID:3004 -
\??\c:\5dvjd.exec:\5dvjd.exe51⤵
- Executes dropped EXE
PID:2864 -
\??\c:\rlrxrfx.exec:\rlrxrfx.exe52⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xxrfxlr.exec:\xxrfxlr.exe53⤵
- Executes dropped EXE
PID:2556 -
\??\c:\1nhthn.exec:\1nhthn.exe54⤵
- Executes dropped EXE
PID:1736 -
\??\c:\ddvjv.exec:\ddvjv.exe55⤵
- Executes dropped EXE
PID:548 -
\??\c:\dvvdp.exec:\dvvdp.exe56⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lfrrflx.exec:\lfrrflx.exe57⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1nttbh.exec:\1nttbh.exe58⤵
- Executes dropped EXE
PID:1420 -
\??\c:\tbthhb.exec:\tbthhb.exe59⤵
- Executes dropped EXE
PID:316 -
\??\c:\vvdpj.exec:\vvdpj.exe60⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xrlxxlx.exec:\xrlxxlx.exe61⤵
- Executes dropped EXE
PID:2052 -
\??\c:\hhtbtn.exec:\hhtbtn.exe62⤵
- Executes dropped EXE
PID:1260 -
\??\c:\nbbtnh.exec:\nbbtnh.exe63⤵
- Executes dropped EXE
PID:1308 -
\??\c:\ppjvp.exec:\ppjvp.exe64⤵
- Executes dropped EXE
PID:664 -
\??\c:\pppvj.exec:\pppvj.exe65⤵
- Executes dropped EXE
PID:332 -
\??\c:\fffrflx.exec:\fffrflx.exe66⤵PID:692
-
\??\c:\bnnthb.exec:\bnnthb.exe67⤵PID:2268
-
\??\c:\3dpvv.exec:\3dpvv.exe68⤵PID:1240
-
\??\c:\rxxllxl.exec:\rxxllxl.exe69⤵PID:1816
-
\??\c:\fxlrxfx.exec:\fxlrxfx.exe70⤵PID:1352
-
\??\c:\3hnnnt.exec:\3hnnnt.exe71⤵PID:1536
-
\??\c:\jjvdp.exec:\jjvdp.exe72⤵PID:1316
-
\??\c:\5vpjd.exec:\5vpjd.exe73⤵PID:1356
-
\??\c:\rlxxflr.exec:\rlxxflr.exe74⤵PID:1788
-
\??\c:\rxrrxxx.exec:\rxrrxxx.exe75⤵PID:400
-
\??\c:\9nbbnh.exec:\9nbbnh.exe76⤵PID:2120
-
\??\c:\jpdjd.exec:\jpdjd.exe77⤵PID:2212
-
\??\c:\xrrxllr.exec:\xrrxllr.exe78⤵PID:2012
-
\??\c:\fffrlxr.exec:\fffrlxr.exe79⤵PID:2224
-
\??\c:\7bbbnh.exec:\7bbbnh.exe80⤵PID:884
-
\??\c:\jvvdd.exec:\jvvdd.exe81⤵PID:2952
-
\??\c:\7ffxffr.exec:\7ffxffr.exe82⤵PID:3052
-
\??\c:\fflfrrl.exec:\fflfrrl.exe83⤵PID:2972
-
\??\c:\bntnnb.exec:\bntnnb.exe84⤵PID:3060
-
\??\c:\7jjpd.exec:\7jjpd.exe85⤵PID:2288
-
\??\c:\lllffrl.exec:\lllffrl.exe86⤵PID:1644
-
\??\c:\9lfrlfl.exec:\9lfrlfl.exe87⤵PID:2908
-
\??\c:\5bbbnb.exec:\5bbbnb.exe88⤵PID:2668
-
\??\c:\vpjdp.exec:\vpjdp.exe89⤵PID:2788
-
\??\c:\pdvvv.exec:\pdvvv.exe90⤵PID:2524
-
\??\c:\xlflflf.exec:\xlflflf.exe91⤵PID:2516
-
\??\c:\tnhnht.exec:\tnhnht.exe92⤵PID:2568
-
\??\c:\djdvp.exec:\djdvp.exe93⤵PID:2688
-
\??\c:\rxlrxrf.exec:\rxlrxrf.exe94⤵PID:2020
-
\??\c:\ttbhnt.exec:\ttbhnt.exe95⤵PID:1748
-
\??\c:\9djvp.exec:\9djvp.exe96⤵PID:2872
-
\??\c:\jdvvv.exec:\jdvvv.exe97⤵PID:2984
-
\??\c:\llrflfl.exec:\llrflfl.exe98⤵PID:3020
-
\??\c:\hhbttn.exec:\hhbttn.exe99⤵PID:1664
-
\??\c:\ppjvj.exec:\ppjvj.exe100⤵PID:1860
-
\??\c:\ddppv.exec:\ddppv.exe101⤵PID:2704
-
\??\c:\ffffflr.exec:\ffffflr.exe102⤵PID:2732
-
\??\c:\nhhtbn.exec:\nhhtbn.exe103⤵PID:552
-
\??\c:\9jjdv.exec:\9jjdv.exe104⤵PID:2024
-
\??\c:\rlxlrxr.exec:\rlxlrxr.exe105⤵PID:2100
-
\??\c:\hhntnn.exec:\hhntnn.exe106⤵PID:840
-
\??\c:\ttnbbb.exec:\ttnbbb.exe107⤵PID:2924
-
\??\c:\jjjvv.exec:\jjjvv.exe108⤵PID:2064
-
\??\c:\9flfrxf.exec:\9flfrxf.exe109⤵PID:2088
-
\??\c:\nhbnbn.exec:\nhbnbn.exe110⤵PID:2092
-
\??\c:\ppvdj.exec:\ppvdj.exe111⤵PID:988
-
\??\c:\rrffxfx.exec:\rrffxfx.exe112⤵PID:1472
-
\??\c:\5bnnbh.exec:\5bnnbh.exe113⤵PID:1856
-
\??\c:\nhbnbn.exec:\nhbnbn.exe114⤵PID:1620
-
\??\c:\dvjpd.exec:\dvjpd.exe115⤵PID:1136
-
\??\c:\7lllxlr.exec:\7lllxlr.exe116⤵PID:2372
-
\??\c:\bnbtnt.exec:\bnbtnt.exe117⤵PID:1660
-
\??\c:\1rrrxll.exec:\1rrrxll.exe118⤵PID:1908
-
\??\c:\xrllrlx.exec:\xrllrlx.exe119⤵PID:1820
-
\??\c:\nntthn.exec:\nntthn.exe120⤵PID:944
-
\??\c:\jvppd.exec:\jvppd.exe121⤵PID:900
-
\??\c:\3flxrrf.exec:\3flxrrf.exe122⤵PID:2120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-