Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29/06/2024, 03:51
Behavioral task
behavioral1
Sample
5d32304d13907824c2e32dc2dae7cb3ced90b51e787a143d8b7e09971ceefeae_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
5d32304d13907824c2e32dc2dae7cb3ced90b51e787a143d8b7e09971ceefeae_NeikiAnalytics.exe
-
Size
465KB
-
MD5
12950b59c16ce652fc5b168008fc81e0
-
SHA1
c115b09ee0ce25a3e0ad86952f78c2c8eb77af65
-
SHA256
5d32304d13907824c2e32dc2dae7cb3ced90b51e787a143d8b7e09971ceefeae
-
SHA512
2156898a66d94bcb9543849d0de78c380d8948cc276ed0e4ab96be125ce8d7b1cf21f40f95d910952c51b1ba39891f7dda985d70fd29fd6a22b6aa8b83dc4777
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1Vj:VeR0oykayRFp3lztP+OKaf1Vj
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/1996-11-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1700-7-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1996-19-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2992-31-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2016-29-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2588-41-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2232-50-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2400-59-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2632-68-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2376-83-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2296-91-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2548-127-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/980-153-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2116-172-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2112-187-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1808-197-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2684-215-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2208-226-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1696-241-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2064-277-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1488-329-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2860-342-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2860-343-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2752-350-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2652-364-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2400-378-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2408-385-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2060-398-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2620-423-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2268-444-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1812-488-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/764-495-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1756-508-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1156-539-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1300-560-0x0000000000250000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/880-599-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1948-705-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2388-945-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1996 1rxlffl.exe 2016 jvpjp.exe 2992 jvjjv.exe 2588 frlrxfl.exe 2232 7btttb.exe 2400 rrlxllr.exe 2632 ttntbh.exe 2376 xlrrffl.exe 2296 5ppvv.exe 2532 fxxxlrf.exe 2252 bthhtt.exe 1472 dvjdd.exe 2548 hbbhnt.exe 2268 vpdjp.exe 1864 1hhhhh.exe 980 jpjvp.exe 1760 9nhntn.exe 2852 jdjjd.exe 2116 tnnntt.exe 2112 3vddp.exe 1808 7hbntt.exe 796 7ppdj.exe 2684 nnhnbh.exe 2336 jpdvp.exe 2208 5bntbh.exe 1696 vvvjv.exe 1188 nbtntn.exe 1300 vjvvv.exe 860 xrlxflx.exe 2968 bttbnn.exe 2064 fxxflrx.exe 2820 fxxfrrf.exe 1980 pjvdp.exe 880 frlxfrl.exe 2040 9hbthn.exe 2000 1tthtt.exe 2912 dvjpp.exe 1488 rfxrffl.exe 2144 tnbnbh.exe 2860 nhnthn.exe 2640 vvpdp.exe 2752 9ffxffr.exe 2508 btttnb.exe 2652 7tnnnn.exe 2400 5dddp.exe 2408 3lxxfrr.exe 2840 5ntbhn.exe 2536 vddjv.exe 2060 lflfllr.exe 1468 1fxflrr.exe 1328 9htbnn.exe 2620 7jddj.exe 2628 1rllrxl.exe 1816 3lflrrx.exe 2268 thttbb.exe 1744 pjvpv.exe 1848 lfxflrx.exe 1636 7tbbhh.exe 2624 bhbhnn.exe 2236 pppvp.exe 1992 fffxxfr.exe 1812 1xrlrxr.exe 676 nnbnbb.exe 764 pjvpd.exe -
resource yara_rule behavioral1/memory/1700-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x000c00000001226d-9.dat upx behavioral1/memory/1996-11-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1700-7-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1996-19-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2016-20-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00360000000141c5-18.dat upx behavioral1/files/0x0008000000014342-26.dat upx behavioral1/memory/2992-31-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2016-29-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0007000000014388-38.dat upx behavioral1/memory/2588-41-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0007000000014415-48.dat upx behavioral1/memory/2232-50-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2400-59-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0007000000014508-57.dat upx behavioral1/files/0x000800000001451c-63.dat upx behavioral1/memory/2632-68-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00070000000153fd-74.dat upx behavioral1/files/0x000600000001542b-80.dat upx behavioral1/memory/2376-83-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x000600000001562c-92.dat upx behavioral1/memory/2296-91-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015679-99.dat upx behavioral1/files/0x0006000000015b63-108.dat upx behavioral1/files/0x0006000000015bc7-115.dat upx behavioral1/memory/2548-118-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2548-127-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015c82-126.dat upx behavioral1/files/0x0006000000015c8c-133.dat upx behavioral1/files/0x003600000001423a-143.dat upx behavioral1/files/0x0006000000015caf-151.dat upx behavioral1/memory/980-153-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015cb7-162.dat upx behavioral1/files/0x0006000000015cbf-170.dat upx behavioral1/memory/2116-172-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015cd6-177.dat upx behavioral1/memory/2112-187-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015ce2-188.dat upx behavioral1/files/0x0006000000015cea-198.dat upx behavioral1/memory/1808-197-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015cf3-206.dat upx behavioral1/memory/2684-207-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015cfd-216.dat upx behavioral1/memory/2684-215-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015d09-223.dat upx behavioral1/memory/2208-226-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015d13-233.dat upx behavioral1/memory/1696-241-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015d20-242.dat upx behavioral1/files/0x0006000000015d42-250.dat upx behavioral1/files/0x0006000000015d72-258.dat upx behavioral1/files/0x0006000000015d97-265.dat upx behavioral1/memory/2968-267-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015de5-275.dat upx behavioral1/memory/2064-277-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015f54-284.dat upx behavioral1/memory/2040-304-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1488-329-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2860-343-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2752-350-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2508-357-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2652-364-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2400-371-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1700 wrote to memory of 1996 1700 5d32304d13907824c2e32dc2dae7cb3ced90b51e787a143d8b7e09971ceefeae_NeikiAnalytics.exe 28 PID 1700 wrote to memory of 1996 1700 5d32304d13907824c2e32dc2dae7cb3ced90b51e787a143d8b7e09971ceefeae_NeikiAnalytics.exe 28 PID 1700 wrote to memory of 1996 1700 5d32304d13907824c2e32dc2dae7cb3ced90b51e787a143d8b7e09971ceefeae_NeikiAnalytics.exe 28 PID 1700 wrote to memory of 1996 1700 5d32304d13907824c2e32dc2dae7cb3ced90b51e787a143d8b7e09971ceefeae_NeikiAnalytics.exe 28 PID 1996 wrote to memory of 2016 1996 1rxlffl.exe 29 PID 1996 wrote to memory of 2016 1996 1rxlffl.exe 29 PID 1996 wrote to memory of 2016 1996 1rxlffl.exe 29 PID 1996 wrote to memory of 2016 1996 1rxlffl.exe 29 PID 2016 wrote to memory of 2992 2016 jvpjp.exe 30 PID 2016 wrote to memory of 2992 2016 jvpjp.exe 30 PID 2016 wrote to memory of 2992 2016 jvpjp.exe 30 PID 2016 wrote to memory of 2992 2016 jvpjp.exe 30 PID 2992 wrote to memory of 2588 2992 jvjjv.exe 31 PID 2992 wrote to memory of 2588 2992 jvjjv.exe 31 PID 2992 wrote to memory of 2588 2992 jvjjv.exe 31 PID 2992 wrote to memory of 2588 2992 jvjjv.exe 31 PID 2588 wrote to memory of 2232 2588 frlrxfl.exe 32 PID 2588 wrote to memory of 2232 2588 frlrxfl.exe 32 PID 2588 wrote to memory of 2232 2588 frlrxfl.exe 32 PID 2588 wrote to memory of 2232 2588 frlrxfl.exe 32 PID 2232 wrote to memory of 2400 2232 7btttb.exe 33 PID 2232 wrote to memory of 2400 2232 7btttb.exe 33 PID 2232 wrote to memory of 2400 2232 7btttb.exe 33 PID 2232 wrote to memory of 2400 2232 7btttb.exe 33 PID 2400 wrote to memory of 2632 2400 rrlxllr.exe 34 PID 2400 wrote to memory of 2632 2400 rrlxllr.exe 34 PID 2400 wrote to memory of 2632 2400 rrlxllr.exe 34 PID 2400 wrote to memory of 2632 2400 rrlxllr.exe 34 PID 2632 wrote to memory of 2376 2632 ttntbh.exe 35 PID 2632 wrote to memory of 2376 2632 ttntbh.exe 35 PID 2632 wrote to memory of 2376 2632 ttntbh.exe 35 PID 2632 wrote to memory of 2376 2632 ttntbh.exe 35 PID 2376 wrote to memory of 2296 2376 xlrrffl.exe 36 PID 2376 wrote to memory of 2296 2376 xlrrffl.exe 36 PID 2376 wrote to memory of 2296 2376 xlrrffl.exe 36 PID 2376 wrote to memory of 2296 2376 xlrrffl.exe 36 PID 2296 wrote to memory of 2532 2296 5ppvv.exe 37 PID 2296 wrote to memory of 2532 2296 5ppvv.exe 37 PID 2296 wrote to memory of 2532 2296 5ppvv.exe 37 PID 2296 wrote to memory of 2532 2296 5ppvv.exe 37 PID 2532 wrote to memory of 2252 2532 fxxxlrf.exe 38 PID 2532 wrote to memory of 2252 2532 fxxxlrf.exe 38 PID 2532 wrote to memory of 2252 2532 fxxxlrf.exe 38 PID 2532 wrote to memory of 2252 2532 fxxxlrf.exe 38 PID 2252 wrote to memory of 1472 2252 bthhtt.exe 39 PID 2252 wrote to memory of 1472 2252 bthhtt.exe 39 PID 2252 wrote to memory of 1472 2252 bthhtt.exe 39 PID 2252 wrote to memory of 1472 2252 bthhtt.exe 39 PID 1472 wrote to memory of 2548 1472 dvjdd.exe 40 PID 1472 wrote to memory of 2548 1472 dvjdd.exe 40 PID 1472 wrote to memory of 2548 1472 dvjdd.exe 40 PID 1472 wrote to memory of 2548 1472 dvjdd.exe 40 PID 2548 wrote to memory of 2268 2548 hbbhnt.exe 41 PID 2548 wrote to memory of 2268 2548 hbbhnt.exe 41 PID 2548 wrote to memory of 2268 2548 hbbhnt.exe 41 PID 2548 wrote to memory of 2268 2548 hbbhnt.exe 41 PID 2268 wrote to memory of 1864 2268 vpdjp.exe 42 PID 2268 wrote to memory of 1864 2268 vpdjp.exe 42 PID 2268 wrote to memory of 1864 2268 vpdjp.exe 42 PID 2268 wrote to memory of 1864 2268 vpdjp.exe 42 PID 1864 wrote to memory of 980 1864 1hhhhh.exe 43 PID 1864 wrote to memory of 980 1864 1hhhhh.exe 43 PID 1864 wrote to memory of 980 1864 1hhhhh.exe 43 PID 1864 wrote to memory of 980 1864 1hhhhh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d32304d13907824c2e32dc2dae7cb3ced90b51e787a143d8b7e09971ceefeae_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5d32304d13907824c2e32dc2dae7cb3ced90b51e787a143d8b7e09971ceefeae_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\1rxlffl.exec:\1rxlffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\jvpjp.exec:\jvpjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\jvjjv.exec:\jvjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\frlrxfl.exec:\frlrxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\7btttb.exec:\7btttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\rrlxllr.exec:\rrlxllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\ttntbh.exec:\ttntbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\xlrrffl.exec:\xlrrffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\5ppvv.exec:\5ppvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\fxxxlrf.exec:\fxxxlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\bthhtt.exec:\bthhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\dvjdd.exec:\dvjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\hbbhnt.exec:\hbbhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\vpdjp.exec:\vpdjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\1hhhhh.exec:\1hhhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\jpjvp.exec:\jpjvp.exe17⤵
- Executes dropped EXE
PID:980 -
\??\c:\9nhntn.exec:\9nhntn.exe18⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jdjjd.exec:\jdjjd.exe19⤵
- Executes dropped EXE
PID:2852 -
\??\c:\tnnntt.exec:\tnnntt.exe20⤵
- Executes dropped EXE
PID:2116 -
\??\c:\3vddp.exec:\3vddp.exe21⤵
- Executes dropped EXE
PID:2112 -
\??\c:\7hbntt.exec:\7hbntt.exe22⤵
- Executes dropped EXE
PID:1808 -
\??\c:\7ppdj.exec:\7ppdj.exe23⤵
- Executes dropped EXE
PID:796 -
\??\c:\nnhnbh.exec:\nnhnbh.exe24⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jpdvp.exec:\jpdvp.exe25⤵
- Executes dropped EXE
PID:2336 -
\??\c:\5bntbh.exec:\5bntbh.exe26⤵
- Executes dropped EXE
PID:2208 -
\??\c:\vvvjv.exec:\vvvjv.exe27⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nbtntn.exec:\nbtntn.exe28⤵
- Executes dropped EXE
PID:1188 -
\??\c:\vjvvv.exec:\vjvvv.exe29⤵
- Executes dropped EXE
PID:1300 -
\??\c:\xrlxflx.exec:\xrlxflx.exe30⤵
- Executes dropped EXE
PID:860 -
\??\c:\bttbnn.exec:\bttbnn.exe31⤵
- Executes dropped EXE
PID:2968 -
\??\c:\fxxflrx.exec:\fxxflrx.exe32⤵
- Executes dropped EXE
PID:2064 -
\??\c:\fxxfrrf.exec:\fxxfrrf.exe33⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pjvdp.exec:\pjvdp.exe34⤵
- Executes dropped EXE
PID:1980 -
\??\c:\frlxfrl.exec:\frlxfrl.exe35⤵
- Executes dropped EXE
PID:880 -
\??\c:\9hbthn.exec:\9hbthn.exe36⤵
- Executes dropped EXE
PID:2040 -
\??\c:\1tthtt.exec:\1tthtt.exe37⤵
- Executes dropped EXE
PID:2000 -
\??\c:\dvjpp.exec:\dvjpp.exe38⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rfxrffl.exec:\rfxrffl.exe39⤵
- Executes dropped EXE
PID:1488 -
\??\c:\tnbnbh.exec:\tnbnbh.exe40⤵
- Executes dropped EXE
PID:2144 -
\??\c:\nhnthn.exec:\nhnthn.exe41⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vvpdp.exec:\vvpdp.exe42⤵
- Executes dropped EXE
PID:2640 -
\??\c:\9ffxffr.exec:\9ffxffr.exe43⤵
- Executes dropped EXE
PID:2752 -
\??\c:\btttnb.exec:\btttnb.exe44⤵
- Executes dropped EXE
PID:2508 -
\??\c:\7tnnnn.exec:\7tnnnn.exe45⤵
- Executes dropped EXE
PID:2652 -
\??\c:\5dddp.exec:\5dddp.exe46⤵
- Executes dropped EXE
PID:2400 -
\??\c:\3lxxfrr.exec:\3lxxfrr.exe47⤵
- Executes dropped EXE
PID:2408 -
\??\c:\5ntbhn.exec:\5ntbhn.exe48⤵
- Executes dropped EXE
PID:2840 -
\??\c:\vddjv.exec:\vddjv.exe49⤵
- Executes dropped EXE
PID:2536 -
\??\c:\lflfllr.exec:\lflfllr.exe50⤵
- Executes dropped EXE
PID:2060 -
\??\c:\1fxflrr.exec:\1fxflrr.exe51⤵
- Executes dropped EXE
PID:1468 -
\??\c:\9htbnn.exec:\9htbnn.exe52⤵
- Executes dropped EXE
PID:1328 -
\??\c:\7jddj.exec:\7jddj.exe53⤵
- Executes dropped EXE
PID:2620 -
\??\c:\1rllrxl.exec:\1rllrxl.exe54⤵
- Executes dropped EXE
PID:2628 -
\??\c:\3lflrrx.exec:\3lflrrx.exe55⤵
- Executes dropped EXE
PID:1816 -
\??\c:\thttbb.exec:\thttbb.exe56⤵
- Executes dropped EXE
PID:2268 -
\??\c:\pjvpv.exec:\pjvpv.exe57⤵
- Executes dropped EXE
PID:1744 -
\??\c:\lfxflrx.exec:\lfxflrx.exe58⤵
- Executes dropped EXE
PID:1848 -
\??\c:\7tbbhh.exec:\7tbbhh.exe59⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bhbhnn.exec:\bhbhnn.exe60⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pppvp.exec:\pppvp.exe61⤵
- Executes dropped EXE
PID:2236 -
\??\c:\fffxxfr.exec:\fffxxfr.exe62⤵
- Executes dropped EXE
PID:1992 -
\??\c:\1xrlrxr.exec:\1xrlrxr.exe63⤵
- Executes dropped EXE
PID:1812 -
\??\c:\nnbnbb.exec:\nnbnbb.exe64⤵
- Executes dropped EXE
PID:676 -
\??\c:\pjvpd.exec:\pjvpd.exe65⤵
- Executes dropped EXE
PID:764 -
\??\c:\fxrlxxl.exec:\fxrlxxl.exe66⤵PID:1752
-
\??\c:\lfllrrx.exec:\lfllrrx.exe67⤵PID:1756
-
\??\c:\7bbbbt.exec:\7bbbbt.exe68⤵PID:1160
-
\??\c:\9ddjv.exec:\9ddjv.exe69⤵PID:2328
-
\??\c:\jdvvd.exec:\jdvvd.exe70⤵PID:2184
-
\??\c:\xrrxlrf.exec:\xrrxlrf.exe71⤵PID:1156
-
\??\c:\ttnttt.exec:\ttnttt.exe72⤵PID:1672
-
\??\c:\bttthh.exec:\bttthh.exe73⤵PID:1764
-
\??\c:\vppdp.exec:\vppdp.exe74⤵PID:1300
-
\??\c:\rrrrrxl.exec:\rrrrrxl.exe75⤵PID:936
-
\??\c:\bbbntt.exec:\bbbntt.exe76⤵PID:2140
-
\??\c:\nhnnhn.exec:\nhnnhn.exe77⤵PID:2748
-
\??\c:\3jvvv.exec:\3jvvv.exe78⤵PID:1968
-
\??\c:\xrlxfrx.exec:\xrlxfrx.exe79⤵PID:1952
-
\??\c:\5btbnn.exec:\5btbnn.exe80⤵PID:2052
-
\??\c:\hbtttb.exec:\hbtttb.exe81⤵PID:880
-
\??\c:\5vpdj.exec:\5vpdj.exe82⤵PID:2028
-
\??\c:\9rfxxxf.exec:\9rfxxxf.exe83⤵PID:1996
-
\??\c:\lxrxlrf.exec:\lxrxlrf.exe84⤵PID:2456
-
\??\c:\9nbbhb.exec:\9nbbhb.exe85⤵PID:2468
-
\??\c:\5dvjv.exec:\5dvjv.exe86⤵PID:2520
-
\??\c:\ddjvd.exec:\ddjvd.exe87⤵PID:2560
-
\??\c:\xrfffll.exec:\xrfffll.exe88⤵PID:2648
-
\??\c:\nhtbhn.exec:\nhtbhn.exe89⤵PID:2584
-
\??\c:\tbnthn.exec:\tbnthn.exe90⤵PID:2940
-
\??\c:\ddpvj.exec:\ddpvj.exe91⤵PID:2732
-
\??\c:\lrlrlrx.exec:\lrlrlrx.exe92⤵PID:1896
-
\??\c:\fxllrrx.exec:\fxllrrx.exe93⤵PID:2364
-
\??\c:\bbbhnt.exec:\bbbhnt.exe94⤵PID:2888
-
\??\c:\3jdpv.exec:\3jdpv.exe95⤵PID:2844
-
\??\c:\rlllxrx.exec:\rlllxrx.exe96⤵PID:1216
-
\??\c:\xrlflrf.exec:\xrlflrf.exe97⤵PID:356
-
\??\c:\3bntbb.exec:\3bntbb.exe98⤵PID:1948
-
\??\c:\3jvdd.exec:\3jvdd.exe99⤵PID:2352
-
\??\c:\djdjv.exec:\djdjv.exe100⤵PID:2548
-
\??\c:\9ffxffr.exec:\9ffxffr.exe101⤵PID:2284
-
\??\c:\hbtbhh.exec:\hbtbhh.exe102⤵PID:1724
-
\??\c:\bbbnbh.exec:\bbbnbh.exe103⤵PID:1560
-
\??\c:\pjddp.exec:\pjddp.exe104⤵PID:1900
-
\??\c:\dvpvd.exec:\dvpvd.exe105⤵PID:1848
-
\??\c:\3lfrrxf.exec:\3lfrrxf.exe106⤵PID:1432
-
\??\c:\xxxlrxl.exec:\xxxlrxl.exe107⤵PID:2624
-
\??\c:\1hbbbn.exec:\1hbbbn.exe108⤵PID:2236
-
\??\c:\jjpdp.exec:\jjpdp.exe109⤵PID:2104
-
\??\c:\xrflrxf.exec:\xrflrxf.exe110⤵PID:1292
-
\??\c:\rllrrxf.exec:\rllrrxf.exe111⤵PID:2464
-
\??\c:\5hbbhn.exec:\5hbbhn.exe112⤵PID:764
-
\??\c:\dvpvj.exec:\dvpvj.exe113⤵PID:1752
-
\??\c:\5xxxllx.exec:\5xxxllx.exe114⤵PID:2924
-
\??\c:\llllrxl.exec:\llllrxl.exe115⤵PID:748
-
\??\c:\btnbhh.exec:\btnbhh.exe116⤵PID:2328
-
\??\c:\9vvdv.exec:\9vvdv.exe117⤵PID:824
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe118⤵PID:1264
-
\??\c:\lflrxfl.exec:\lflrxfl.exe119⤵PID:1672
-
\??\c:\ntthnt.exec:\ntthnt.exe120⤵PID:1540
-
\??\c:\1dvvj.exec:\1dvvj.exe121⤵PID:2096
-
\??\c:\lxlxxlr.exec:\lxlxxlr.exe122⤵PID:652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-