Analysis
-
max time kernel
110s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 21:05
Behavioral task
behavioral1
Sample
86fed020b362b1af6b35e0fd36f365d0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
86fed020b362b1af6b35e0fd36f365d0_NeikiAnalytics.exe
-
Size
334KB
-
MD5
86fed020b362b1af6b35e0fd36f365d0
-
SHA1
7add22fe2aa1ff1b32078d9bd5bd0fb9ed3e8506
-
SHA256
6f877b3cc18b5257e311426b0b7a509d4d5b2d90798b101a43a32b8029afb494
-
SHA512
5f91ccdbfcc6081dddab0a672b91dd5477c827c365922d24b1e5adee224e65d08bf98c507ed2e7a82097bda24c5a488ba9ec6661da4527b8a9a53718a2fc6ac5
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1i/f:x4wFHoS3eFaKHpv/VycgE8of
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/1932-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1904-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2172-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1772-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1316-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1652-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1080-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-457-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1148-502-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/756-592-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-717-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1276-755-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1220-799-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-849-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/908-1128-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/292-1312-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1924 7tttbn.exe 2756 rlfxlfl.exe 2416 dppjp.exe 2684 vpjjv.exe 2740 htbbhh.exe 2732 ntbtnt.exe 2920 xrrfxfx.exe 2472 5nntbn.exe 2592 ppdjp.exe 2908 rfxrffr.exe 1664 jjvpv.exe 2760 1dpvj.exe 2888 fffrrxl.exe 1904 1fxfrrf.exe 1968 nnhhnn.exe 2172 1jdvj.exe 2132 3nhnnh.exe 2240 ppjvv.exe 912 hbtbtt.exe 2832 9vvjv.exe 1772 htntbh.exe 1240 nbthbb.exe 2104 rlflrfx.exe 1132 tnbhtn.exe 2436 jvvjp.exe 1316 fxxflfx.exe 1652 3thhnt.exe 1080 ppjjp.exe 3064 5bbhtb.exe 840 9fxlflx.exe 2808 7hntnb.exe 2152 9hbbnb.exe 1156 xrfrflx.exe 1560 9tnbhh.exe 1708 jjvpp.exe 2216 frxxfrx.exe 2968 xrflrrx.exe 2748 nbhhnn.exe 2756 7jddd.exe 2688 rfxfllr.exe 2820 7xfxfff.exe 2596 9ttbhn.exe 2500 vpddd.exe 2632 jvjvv.exe 2484 9xxlfrf.exe 2548 tnbntb.exe 2736 vpddv.exe 2592 dddpp.exe 1908 frrxxfr.exe 2128 fxxrffl.exe 2784 hthbhh.exe 2760 vjdjp.exe 1988 9ffxffl.exe 1956 xflxfxr.exe 1296 9nbbbb.exe 2380 1pppv.exe 2340 ppjpd.exe 1740 xlllxfr.exe 2276 btnhtt.exe 1152 5bnthb.exe 912 ddvjp.exe 2236 1fxfrlx.exe 388 hbthtb.exe 1148 bthhhh.exe -
resource yara_rule behavioral1/memory/1932-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1932-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1924-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000012274-8.dat upx behavioral1/files/0x0037000000015682-19.dat upx behavioral1/memory/1924-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015ca2-25.dat upx behavioral1/memory/2416-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015cc7-37.dat upx behavioral1/files/0x0007000000015ccf-43.dat upx behavioral1/memory/2740-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015ce3-55.dat upx behavioral1/files/0x0008000000015d02-62.dat upx behavioral1/memory/2920-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016255-72.dat upx behavioral1/memory/2920-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016310-80.dat upx behavioral1/memory/2472-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2592-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000164a9-90.dat upx behavioral1/files/0x00060000000165a8-98.dat upx behavioral1/memory/2908-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1664-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001663f-108.dat upx behavioral1/files/0x000600000001686d-116.dat upx behavioral1/memory/2888-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016abb-126.dat upx behavioral1/files/0x0006000000016c56-133.dat upx behavioral1/memory/1904-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c71-143.dat upx behavioral1/files/0x0006000000016c7a-150.dat upx behavioral1/memory/2172-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0037000000015c6f-161.dat upx behavioral1/memory/2132-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2240-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cc3-170.dat upx behavioral1/files/0x0006000000016ce7-179.dat upx behavioral1/files/0x0006000000016d1b-188.dat upx behavioral1/memory/2832-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1772-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d2c-197.dat upx behavioral1/files/0x0006000000016d34-205.dat upx behavioral1/files/0x0006000000016d3d-213.dat upx behavioral1/memory/1132-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d45-222.dat upx behavioral1/memory/2436-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d4e-231.dat upx behavioral1/files/0x0006000000016d61-240.dat upx behavioral1/memory/1316-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1652-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d65-249.dat upx behavioral1/memory/1080-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d69-258.dat upx behavioral1/files/0x0006000000016d71-267.dat upx behavioral1/memory/3064-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dda-275.dat upx behavioral1/memory/2808-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dde-284.dat upx behavioral1/memory/2152-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1708-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2484-372-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2128-403-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1932 wrote to memory of 1924 1932 86fed020b362b1af6b35e0fd36f365d0_NeikiAnalytics.exe 28 PID 1932 wrote to memory of 1924 1932 86fed020b362b1af6b35e0fd36f365d0_NeikiAnalytics.exe 28 PID 1932 wrote to memory of 1924 1932 86fed020b362b1af6b35e0fd36f365d0_NeikiAnalytics.exe 28 PID 1932 wrote to memory of 1924 1932 86fed020b362b1af6b35e0fd36f365d0_NeikiAnalytics.exe 28 PID 1924 wrote to memory of 2756 1924 7tttbn.exe 29 PID 1924 wrote to memory of 2756 1924 7tttbn.exe 29 PID 1924 wrote to memory of 2756 1924 7tttbn.exe 29 PID 1924 wrote to memory of 2756 1924 7tttbn.exe 29 PID 2756 wrote to memory of 2416 2756 rlfxlfl.exe 30 PID 2756 wrote to memory of 2416 2756 rlfxlfl.exe 30 PID 2756 wrote to memory of 2416 2756 rlfxlfl.exe 30 PID 2756 wrote to memory of 2416 2756 rlfxlfl.exe 30 PID 2416 wrote to memory of 2684 2416 dppjp.exe 31 PID 2416 wrote to memory of 2684 2416 dppjp.exe 31 PID 2416 wrote to memory of 2684 2416 dppjp.exe 31 PID 2416 wrote to memory of 2684 2416 dppjp.exe 31 PID 2684 wrote to memory of 2740 2684 vpjjv.exe 32 PID 2684 wrote to memory of 2740 2684 vpjjv.exe 32 PID 2684 wrote to memory of 2740 2684 vpjjv.exe 32 PID 2684 wrote to memory of 2740 2684 vpjjv.exe 32 PID 2740 wrote to memory of 2732 2740 htbbhh.exe 33 PID 2740 wrote to memory of 2732 2740 htbbhh.exe 33 PID 2740 wrote to memory of 2732 2740 htbbhh.exe 33 PID 2740 wrote to memory of 2732 2740 htbbhh.exe 33 PID 2732 wrote to memory of 2920 2732 ntbtnt.exe 34 PID 2732 wrote to memory of 2920 2732 ntbtnt.exe 34 PID 2732 wrote to memory of 2920 2732 ntbtnt.exe 34 PID 2732 wrote to memory of 2920 2732 ntbtnt.exe 34 PID 2920 wrote to memory of 2472 2920 xrrfxfx.exe 35 PID 2920 wrote to memory of 2472 2920 xrrfxfx.exe 35 PID 2920 wrote to memory of 2472 2920 xrrfxfx.exe 35 PID 2920 wrote to memory of 2472 2920 xrrfxfx.exe 35 PID 2472 wrote to memory of 2592 2472 5nntbn.exe 36 PID 2472 wrote to memory of 2592 2472 5nntbn.exe 36 PID 2472 wrote to memory of 2592 2472 5nntbn.exe 36 PID 2472 wrote to memory of 2592 2472 5nntbn.exe 36 PID 2592 wrote to memory of 2908 2592 ppdjp.exe 37 PID 2592 wrote to memory of 2908 2592 ppdjp.exe 37 PID 2592 wrote to memory of 2908 2592 ppdjp.exe 37 PID 2592 wrote to memory of 2908 2592 ppdjp.exe 37 PID 2908 wrote to memory of 1664 2908 rfxrffr.exe 38 PID 2908 wrote to memory of 1664 2908 rfxrffr.exe 38 PID 2908 wrote to memory of 1664 2908 rfxrffr.exe 38 PID 2908 wrote to memory of 1664 2908 rfxrffr.exe 38 PID 1664 wrote to memory of 2760 1664 jjvpv.exe 39 PID 1664 wrote to memory of 2760 1664 jjvpv.exe 39 PID 1664 wrote to memory of 2760 1664 jjvpv.exe 39 PID 1664 wrote to memory of 2760 1664 jjvpv.exe 39 PID 2760 wrote to memory of 2888 2760 1dpvj.exe 40 PID 2760 wrote to memory of 2888 2760 1dpvj.exe 40 PID 2760 wrote to memory of 2888 2760 1dpvj.exe 40 PID 2760 wrote to memory of 2888 2760 1dpvj.exe 40 PID 2888 wrote to memory of 1904 2888 fffrrxl.exe 41 PID 2888 wrote to memory of 1904 2888 fffrrxl.exe 41 PID 2888 wrote to memory of 1904 2888 fffrrxl.exe 41 PID 2888 wrote to memory of 1904 2888 fffrrxl.exe 41 PID 1904 wrote to memory of 1968 1904 1fxfrrf.exe 42 PID 1904 wrote to memory of 1968 1904 1fxfrrf.exe 42 PID 1904 wrote to memory of 1968 1904 1fxfrrf.exe 42 PID 1904 wrote to memory of 1968 1904 1fxfrrf.exe 42 PID 1968 wrote to memory of 2172 1968 nnhhnn.exe 43 PID 1968 wrote to memory of 2172 1968 nnhhnn.exe 43 PID 1968 wrote to memory of 2172 1968 nnhhnn.exe 43 PID 1968 wrote to memory of 2172 1968 nnhhnn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\86fed020b362b1af6b35e0fd36f365d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\86fed020b362b1af6b35e0fd36f365d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\7tttbn.exec:\7tttbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\rlfxlfl.exec:\rlfxlfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\dppjp.exec:\dppjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\vpjjv.exec:\vpjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\htbbhh.exec:\htbbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\ntbtnt.exec:\ntbtnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\xrrfxfx.exec:\xrrfxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\5nntbn.exec:\5nntbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\ppdjp.exec:\ppdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rfxrffr.exec:\rfxrffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\jjvpv.exec:\jjvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\1dpvj.exec:\1dpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\fffrrxl.exec:\fffrrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\1fxfrrf.exec:\1fxfrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\nnhhnn.exec:\nnhhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\1jdvj.exec:\1jdvj.exe17⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3nhnnh.exec:\3nhnnh.exe18⤵
- Executes dropped EXE
PID:2132 -
\??\c:\ppjvv.exec:\ppjvv.exe19⤵
- Executes dropped EXE
PID:2240 -
\??\c:\hbtbtt.exec:\hbtbtt.exe20⤵
- Executes dropped EXE
PID:912 -
\??\c:\9vvjv.exec:\9vvjv.exe21⤵
- Executes dropped EXE
PID:2832 -
\??\c:\htntbh.exec:\htntbh.exe22⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nbthbb.exec:\nbthbb.exe23⤵
- Executes dropped EXE
PID:1240 -
\??\c:\rlflrfx.exec:\rlflrfx.exe24⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tnbhtn.exec:\tnbhtn.exe25⤵
- Executes dropped EXE
PID:1132 -
\??\c:\jvvjp.exec:\jvvjp.exe26⤵
- Executes dropped EXE
PID:2436 -
\??\c:\fxxflfx.exec:\fxxflfx.exe27⤵
- Executes dropped EXE
PID:1316 -
\??\c:\3thhnt.exec:\3thhnt.exe28⤵
- Executes dropped EXE
PID:1652 -
\??\c:\ppjjp.exec:\ppjjp.exe29⤵
- Executes dropped EXE
PID:1080 -
\??\c:\5bbhtb.exec:\5bbhtb.exe30⤵
- Executes dropped EXE
PID:3064 -
\??\c:\9fxlflx.exec:\9fxlflx.exe31⤵
- Executes dropped EXE
PID:840 -
\??\c:\7hntnb.exec:\7hntnb.exe32⤵
- Executes dropped EXE
PID:2808 -
\??\c:\9hbbnb.exec:\9hbbnb.exe33⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xrfrflx.exec:\xrfrflx.exe34⤵
- Executes dropped EXE
PID:1156 -
\??\c:\9tnbhh.exec:\9tnbhh.exe35⤵
- Executes dropped EXE
PID:1560 -
\??\c:\jjvpp.exec:\jjvpp.exe36⤵
- Executes dropped EXE
PID:1708 -
\??\c:\frxxfrx.exec:\frxxfrx.exe37⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xrflrrx.exec:\xrflrrx.exe38⤵
- Executes dropped EXE
PID:2968 -
\??\c:\nbhhnn.exec:\nbhhnn.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7jddd.exec:\7jddd.exe40⤵
- Executes dropped EXE
PID:2756 -
\??\c:\rfxfllr.exec:\rfxfllr.exe41⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7xfxfff.exec:\7xfxfff.exe42⤵
- Executes dropped EXE
PID:2820 -
\??\c:\9ttbhn.exec:\9ttbhn.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vpddd.exec:\vpddd.exe44⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jvjvv.exec:\jvjvv.exe45⤵
- Executes dropped EXE
PID:2632 -
\??\c:\9xxlfrf.exec:\9xxlfrf.exe46⤵
- Executes dropped EXE
PID:2484 -
\??\c:\tnbntb.exec:\tnbntb.exe47⤵
- Executes dropped EXE
PID:2548 -
\??\c:\vpddv.exec:\vpddv.exe48⤵
- Executes dropped EXE
PID:2736 -
\??\c:\dddpp.exec:\dddpp.exe49⤵
- Executes dropped EXE
PID:2592 -
\??\c:\frrxxfr.exec:\frrxxfr.exe50⤵
- Executes dropped EXE
PID:1908 -
\??\c:\fxxrffl.exec:\fxxrffl.exe51⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hthbhh.exec:\hthbhh.exe52⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vjdjp.exec:\vjdjp.exe53⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9ffxffl.exec:\9ffxffl.exe54⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xflxfxr.exec:\xflxfxr.exe55⤵
- Executes dropped EXE
PID:1956 -
\??\c:\9nbbbb.exec:\9nbbbb.exe56⤵
- Executes dropped EXE
PID:1296 -
\??\c:\1pppv.exec:\1pppv.exe57⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ppjpd.exec:\ppjpd.exe58⤵
- Executes dropped EXE
PID:2340 -
\??\c:\xlllxfr.exec:\xlllxfr.exe59⤵
- Executes dropped EXE
PID:1740 -
\??\c:\btnhtt.exec:\btnhtt.exe60⤵
- Executes dropped EXE
PID:2276 -
\??\c:\5bnthb.exec:\5bnthb.exe61⤵
- Executes dropped EXE
PID:1152 -
\??\c:\ddvjp.exec:\ddvjp.exe62⤵
- Executes dropped EXE
PID:912 -
\??\c:\1fxfrlx.exec:\1fxfrlx.exe63⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hbthtb.exec:\hbthtb.exe64⤵
- Executes dropped EXE
PID:388 -
\??\c:\bthhhh.exec:\bthhhh.exe65⤵
- Executes dropped EXE
PID:1148 -
\??\c:\ddpdd.exec:\ddpdd.exe66⤵PID:1896
-
\??\c:\3xlrrxf.exec:\3xlrrxf.exe67⤵PID:2104
-
\??\c:\xxrxrxr.exec:\xxrxrxr.exe68⤵PID:1672
-
\??\c:\hbbhnt.exec:\hbbhnt.exe69⤵PID:2284
-
\??\c:\vddvd.exec:\vddvd.exe70⤵PID:1656
-
\??\c:\1dvdp.exec:\1dvdp.exe71⤵PID:2384
-
\??\c:\xrffxff.exec:\xrffxff.exe72⤵PID:1652
-
\??\c:\hhbbnn.exec:\hhbbnn.exe73⤵PID:1044
-
\??\c:\bhbtbt.exec:\bhbtbt.exe74⤵PID:2880
-
\??\c:\3vddj.exec:\3vddj.exe75⤵PID:692
-
\??\c:\jvppv.exec:\jvppv.exe76⤵PID:2064
-
\??\c:\frlxxxl.exec:\frlxxxl.exe77⤵PID:1428
-
\??\c:\hbhbtt.exec:\hbhbtt.exe78⤵PID:3040
-
\??\c:\jdvjp.exec:\jdvjp.exe79⤵PID:756
-
\??\c:\jdpvj.exec:\jdpvj.exe80⤵PID:3024
-
\??\c:\ffrfrfr.exec:\ffrfrfr.exe81⤵PID:1584
-
\??\c:\7bnntn.exec:\7bnntn.exe82⤵PID:1952
-
\??\c:\htbbht.exec:\htbbht.exe83⤵PID:2564
-
\??\c:\vpdpd.exec:\vpdpd.exe84⤵PID:2980
-
\??\c:\7fffllf.exec:\7fffllf.exe85⤵PID:2268
-
\??\c:\lfrflrx.exec:\lfrflrx.exe86⤵PID:2668
-
\??\c:\5nhbtb.exec:\5nhbtb.exe87⤵PID:2692
-
\??\c:\1pjjp.exec:\1pjjp.exe88⤵PID:1700
-
\??\c:\3lfrrxl.exec:\3lfrrxl.exe89⤵PID:2752
-
\??\c:\3ffxrfr.exec:\3ffxrfr.exe90⤵PID:2768
-
\??\c:\3thhbb.exec:\3thhbb.exe91⤵PID:2504
-
\??\c:\nhtnth.exec:\nhtnth.exe92⤵PID:2484
-
\??\c:\1pdjv.exec:\1pdjv.exe93⤵PID:2548
-
\??\c:\rfxxfxl.exec:\rfxxfxl.exe94⤵PID:2736
-
\??\c:\5xlxxlr.exec:\5xlxxlr.exe95⤵PID:2912
-
\??\c:\5nbbhn.exec:\5nbbhn.exe96⤵PID:1664
-
\??\c:\9jdjp.exec:\9jdjp.exe97⤵PID:2128
-
\??\c:\jvpvj.exec:\jvpvj.exe98⤵PID:2708
-
\??\c:\3rrlrxf.exec:\3rrlrxf.exe99⤵PID:1288
-
\??\c:\bnhtbh.exec:\bnhtbh.exe100⤵PID:2888
-
\??\c:\hbthnt.exec:\hbthnt.exe101⤵PID:1984
-
\??\c:\pdvdp.exec:\pdvdp.exe102⤵PID:2360
-
\??\c:\xrrfxfl.exec:\xrrfxfl.exe103⤵PID:2172
-
\??\c:\ffrfxrf.exec:\ffrfxrf.exe104⤵PID:1732
-
\??\c:\3thnhn.exec:\3thnhn.exe105⤵PID:1276
-
\??\c:\vvppp.exec:\vvppp.exe106⤵PID:2228
-
\??\c:\3vvjd.exec:\3vvjd.exe107⤵PID:2452
-
\??\c:\lfrrrfl.exec:\lfrrrfl.exe108⤵PID:2840
-
\??\c:\1nnbhn.exec:\1nnbhn.exe109⤵PID:484
-
\??\c:\1hntbh.exec:\1hntbh.exe110⤵PID:1476
-
\??\c:\vvpvj.exec:\vvpvj.exe111⤵PID:528
-
\??\c:\dppdp.exec:\dppdp.exe112⤵PID:1808
-
\??\c:\rfrrxfl.exec:\rfrrxfl.exe113⤵PID:1220
-
\??\c:\bbbbtb.exec:\bbbbtb.exe114⤵PID:2348
-
\??\c:\nhbnbn.exec:\nhbnbn.exe115⤵PID:1336
-
\??\c:\pvvdj.exec:\pvvdj.exe116⤵PID:2016
-
\??\c:\rrfrfxl.exec:\rrfrfxl.exe117⤵PID:872
-
\??\c:\tthnbb.exec:\tthnbb.exe118⤵PID:2860
-
\??\c:\ttbhbt.exec:\ttbhbt.exe119⤵PID:764
-
\??\c:\3jddd.exec:\3jddd.exe120⤵PID:2884
-
\??\c:\5djdj.exec:\5djdj.exe121⤵PID:848
-
\??\c:\rfxxffr.exec:\rfxxffr.exe122⤵PID:1744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-