Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 14:28
Behavioral task
behavioral1
Sample
5da63458769513ee07487d8e8426a080_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
5da63458769513ee07487d8e8426a080_NeikiAnalytics.exe
-
Size
272KB
-
MD5
5da63458769513ee07487d8e8426a080
-
SHA1
e495bc4f297759b49e302891b4847c2a5631c179
-
SHA256
3cedbf1daec1016d9d784f71c6a05985116296a86824252279e0f5ec212e2fdb
-
SHA512
ffe2e3e90663160eed25e386f08a316d04a8dc115ab0b9597b9d42701c3147a46bfe4fc9ec84a7499312745044cc73d509b1c7098547ab6603ea1041811be1a2
-
SSDEEP
6144:Ycm4FmowdHoSgWrXF5lpKGYV0aTk/BO0XJm4UEPOshN/xdKnvP48bmX:e4wFHoSgWjdpKGATTk/jYIOWN/KnnPg
Malware Config
Signatures
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2224-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/300-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-248-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2092-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-289-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1756-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1504-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/836-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1276-550-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-606-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2768-722-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-731-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1032-742-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2428-868-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-911-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1788-1073-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1992-7033-0x00000000779D0000-0x0000000077ACA000-memory.dmp family_blackmoon behavioral1/memory/1992-12184-0x0000000077AD0000-0x0000000077BEF000-memory.dmp family_blackmoon behavioral1/memory/1992-17698-0x0000000077AD0000-0x0000000077BEF000-memory.dmp family_blackmoon behavioral1/memory/1992-20625-0x0000000077AD0000-0x0000000077BEF000-memory.dmp family_blackmoon behavioral1/memory/1992-21212-0x0000000077AD0000-0x0000000077BEF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2212 pvvdv.exe 2100 dppdv.exe 2604 rrlfllf.exe 2724 hhhthn.exe 2620 9rrxrxl.exe 2892 xrrrflr.exe 2780 btnthn.exe 2556 xrrrxrf.exe 2528 httnbt.exe 2996 3bbtbn.exe 3044 rrflfrf.exe 2844 hhhhtb.exe 3004 jjdpj.exe 3024 7fflxfx.exe 2580 9thtbb.exe 1608 dpvdj.exe 2248 tbtthb.exe 300 vjvdj.exe 2752 xxrfrrf.exe 2124 nhbnnn.exe 2060 xxrlrfx.exe 2608 9btbtb.exe 2496 xxrxflf.exe 976 hnhbht.exe 1096 dvjpd.exe 1520 7ffrrfx.exe 2472 nhtbbh.exe 2380 3jppd.exe 1764 tnnthn.exe 1576 hbhbtn.exe 2092 xxxxlrf.exe 1612 9bnntb.exe 680 7jjvj.exe 2136 rlxxfrx.exe 1064 nhnbhh.exe 2272 tnntbh.exe 2276 djdvv.exe 1756 5fxrxfr.exe 2112 ttnbnh.exe 2224 bnnthn.exe 1588 vpdjp.exe 2104 lflrrxr.exe 2196 btnhtb.exe 2192 9nhbbh.exe 2728 ppjjp.exe 2712 3lxfrxx.exe 2660 hnthbt.exe 2644 dvpdp.exe 2704 lfxlflr.exe 2536 fxrxffl.exe 2780 9ttbhn.exe 2524 5jjpp.exe 2584 5dvjp.exe 1396 rxffllr.exe 2072 nnbhtb.exe 2836 jdvvv.exe 2868 jddvv.exe 2952 xxrfrrl.exe 2172 btbnbh.exe 3016 tttnbn.exe 1312 vjppp.exe 288 vpjjv.exe 2396 fxrrxxr.exe 344 hhhnhh.exe -
resource yara_rule behavioral1/memory/2224-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d0000000122eb-5.dat upx behavioral1/memory/2224-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2212-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0036000000015cb8-16.dat upx behavioral1/memory/2212-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d08-25.dat upx behavioral1/memory/2604-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2100-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d24-35.dat upx behavioral1/memory/2604-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2724-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d3b-45.dat upx behavioral1/memory/2620-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d53-52.dat upx behavioral1/memory/2892-59-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0008000000015d7b-61.dat upx behavioral1/files/0x0007000000016835-69.dat upx behavioral1/memory/2780-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016a8a-76.dat upx behavioral1/memory/2556-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c52-84.dat upx behavioral1/memory/2528-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2996-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c6f-92.dat upx behavioral1/memory/3044-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c78-101.dat upx behavioral1/memory/3044-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cc1-109.dat upx behavioral1/memory/2844-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ceb-117.dat upx behavioral1/memory/3004-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d17-125.dat upx behavioral1/files/0x0006000000016d2a-132.dat upx behavioral1/memory/2580-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d32-139.dat upx behavioral1/memory/1608-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d3b-148.dat upx behavioral1/files/0x0036000000015cc7-154.dat upx behavioral1/memory/300-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d43-163.dat upx behavioral1/files/0x0006000000016d4b-171.dat upx behavioral1/memory/2124-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d5f-178.dat upx behavioral1/files/0x0006000000016d64-185.dat upx behavioral1/memory/2496-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d68-193.dat upx behavioral1/files/0x0006000000016d6f-200.dat upx behavioral1/files/0x0006000000016d8b-207.dat upx behavioral1/files/0x0006000000016d9f-217.dat upx behavioral1/memory/2472-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dba-224.dat upx behavioral1/files/0x0006000000016dc8-233.dat upx behavioral1/files/0x0006000000016dd1-240.dat upx behavioral1/files/0x0006000000016ddc-249.dat upx behavioral1/files/0x0006000000016de3-257.dat upx behavioral1/memory/2092-256-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1756-295-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2112-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2224-302-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2224-308-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-331-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2536-357-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2524-373-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2224 wrote to memory of 2212 2224 5da63458769513ee07487d8e8426a080_NeikiAnalytics.exe 28 PID 2224 wrote to memory of 2212 2224 5da63458769513ee07487d8e8426a080_NeikiAnalytics.exe 28 PID 2224 wrote to memory of 2212 2224 5da63458769513ee07487d8e8426a080_NeikiAnalytics.exe 28 PID 2224 wrote to memory of 2212 2224 5da63458769513ee07487d8e8426a080_NeikiAnalytics.exe 28 PID 2212 wrote to memory of 2100 2212 pvvdv.exe 29 PID 2212 wrote to memory of 2100 2212 pvvdv.exe 29 PID 2212 wrote to memory of 2100 2212 pvvdv.exe 29 PID 2212 wrote to memory of 2100 2212 pvvdv.exe 29 PID 2100 wrote to memory of 2604 2100 dppdv.exe 30 PID 2100 wrote to memory of 2604 2100 dppdv.exe 30 PID 2100 wrote to memory of 2604 2100 dppdv.exe 30 PID 2100 wrote to memory of 2604 2100 dppdv.exe 30 PID 2604 wrote to memory of 2724 2604 rrlfllf.exe 31 PID 2604 wrote to memory of 2724 2604 rrlfllf.exe 31 PID 2604 wrote to memory of 2724 2604 rrlfllf.exe 31 PID 2604 wrote to memory of 2724 2604 rrlfllf.exe 31 PID 2724 wrote to memory of 2620 2724 hhhthn.exe 32 PID 2724 wrote to memory of 2620 2724 hhhthn.exe 32 PID 2724 wrote to memory of 2620 2724 hhhthn.exe 32 PID 2724 wrote to memory of 2620 2724 hhhthn.exe 32 PID 2620 wrote to memory of 2892 2620 9rrxrxl.exe 33 PID 2620 wrote to memory of 2892 2620 9rrxrxl.exe 33 PID 2620 wrote to memory of 2892 2620 9rrxrxl.exe 33 PID 2620 wrote to memory of 2892 2620 9rrxrxl.exe 33 PID 2892 wrote to memory of 2780 2892 xrrrflr.exe 34 PID 2892 wrote to memory of 2780 2892 xrrrflr.exe 34 PID 2892 wrote to memory of 2780 2892 xrrrflr.exe 34 PID 2892 wrote to memory of 2780 2892 xrrrflr.exe 34 PID 2780 wrote to memory of 2556 2780 btnthn.exe 35 PID 2780 wrote to memory of 2556 2780 btnthn.exe 35 PID 2780 wrote to memory of 2556 2780 btnthn.exe 35 PID 2780 wrote to memory of 2556 2780 btnthn.exe 35 PID 2556 wrote to memory of 2528 2556 xrrrxrf.exe 36 PID 2556 wrote to memory of 2528 2556 xrrrxrf.exe 36 PID 2556 wrote to memory of 2528 2556 xrrrxrf.exe 36 PID 2556 wrote to memory of 2528 2556 xrrrxrf.exe 36 PID 2528 wrote to memory of 2996 2528 httnbt.exe 37 PID 2528 wrote to memory of 2996 2528 httnbt.exe 37 PID 2528 wrote to memory of 2996 2528 httnbt.exe 37 PID 2528 wrote to memory of 2996 2528 httnbt.exe 37 PID 2996 wrote to memory of 3044 2996 3bbtbn.exe 38 PID 2996 wrote to memory of 3044 2996 3bbtbn.exe 38 PID 2996 wrote to memory of 3044 2996 3bbtbn.exe 38 PID 2996 wrote to memory of 3044 2996 3bbtbn.exe 38 PID 3044 wrote to memory of 2844 3044 rrflfrf.exe 39 PID 3044 wrote to memory of 2844 3044 rrflfrf.exe 39 PID 3044 wrote to memory of 2844 3044 rrflfrf.exe 39 PID 3044 wrote to memory of 2844 3044 rrflfrf.exe 39 PID 2844 wrote to memory of 3004 2844 hhhhtb.exe 40 PID 2844 wrote to memory of 3004 2844 hhhhtb.exe 40 PID 2844 wrote to memory of 3004 2844 hhhhtb.exe 40 PID 2844 wrote to memory of 3004 2844 hhhhtb.exe 40 PID 3004 wrote to memory of 3024 3004 jjdpj.exe 41 PID 3004 wrote to memory of 3024 3004 jjdpj.exe 41 PID 3004 wrote to memory of 3024 3004 jjdpj.exe 41 PID 3004 wrote to memory of 3024 3004 jjdpj.exe 41 PID 3024 wrote to memory of 2580 3024 7fflxfx.exe 42 PID 3024 wrote to memory of 2580 3024 7fflxfx.exe 42 PID 3024 wrote to memory of 2580 3024 7fflxfx.exe 42 PID 3024 wrote to memory of 2580 3024 7fflxfx.exe 42 PID 2580 wrote to memory of 1608 2580 9thtbb.exe 43 PID 2580 wrote to memory of 1608 2580 9thtbb.exe 43 PID 2580 wrote to memory of 1608 2580 9thtbb.exe 43 PID 2580 wrote to memory of 1608 2580 9thtbb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\5da63458769513ee07487d8e8426a080_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5da63458769513ee07487d8e8426a080_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\pvvdv.exec:\pvvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\dppdv.exec:\dppdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\rrlfllf.exec:\rrlfllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\hhhthn.exec:\hhhthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\9rrxrxl.exec:\9rrxrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xrrrflr.exec:\xrrrflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\btnthn.exec:\btnthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\xrrrxrf.exec:\xrrrxrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\httnbt.exec:\httnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\3bbtbn.exec:\3bbtbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\rrflfrf.exec:\rrflfrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\hhhhtb.exec:\hhhhtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\jjdpj.exec:\jjdpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\7fflxfx.exec:\7fflxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\9thtbb.exec:\9thtbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\dpvdj.exec:\dpvdj.exe17⤵
- Executes dropped EXE
PID:1608 -
\??\c:\tbtthb.exec:\tbtthb.exe18⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vjvdj.exec:\vjvdj.exe19⤵
- Executes dropped EXE
PID:300 -
\??\c:\xxrfrrf.exec:\xxrfrrf.exe20⤵
- Executes dropped EXE
PID:2752 -
\??\c:\nhbnnn.exec:\nhbnnn.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\xxrlrfx.exec:\xxrlrfx.exe22⤵
- Executes dropped EXE
PID:2060 -
\??\c:\9btbtb.exec:\9btbtb.exe23⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xxrxflf.exec:\xxrxflf.exe24⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hnhbht.exec:\hnhbht.exe25⤵
- Executes dropped EXE
PID:976 -
\??\c:\dvjpd.exec:\dvjpd.exe26⤵
- Executes dropped EXE
PID:1096 -
\??\c:\7ffrrfx.exec:\7ffrrfx.exe27⤵
- Executes dropped EXE
PID:1520 -
\??\c:\nhtbbh.exec:\nhtbbh.exe28⤵
- Executes dropped EXE
PID:2472 -
\??\c:\3jppd.exec:\3jppd.exe29⤵
- Executes dropped EXE
PID:2380 -
\??\c:\tnnthn.exec:\tnnthn.exe30⤵
- Executes dropped EXE
PID:1764 -
\??\c:\hbhbtn.exec:\hbhbtn.exe31⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xxxxlrf.exec:\xxxxlrf.exe32⤵
- Executes dropped EXE
PID:2092 -
\??\c:\9bnntb.exec:\9bnntb.exe33⤵
- Executes dropped EXE
PID:1612 -
\??\c:\7jjvj.exec:\7jjvj.exe34⤵
- Executes dropped EXE
PID:680 -
\??\c:\rlxxfrx.exec:\rlxxfrx.exe35⤵
- Executes dropped EXE
PID:2136 -
\??\c:\nhnbhh.exec:\nhnbhh.exe36⤵
- Executes dropped EXE
PID:1064 -
\??\c:\tnntbh.exec:\tnntbh.exe37⤵
- Executes dropped EXE
PID:2272 -
\??\c:\djdvv.exec:\djdvv.exe38⤵
- Executes dropped EXE
PID:2276 -
\??\c:\5fxrxfr.exec:\5fxrxfr.exe39⤵
- Executes dropped EXE
PID:1756 -
\??\c:\ttnbnh.exec:\ttnbnh.exe40⤵
- Executes dropped EXE
PID:2112 -
\??\c:\bnnthn.exec:\bnnthn.exe41⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vpdjp.exec:\vpdjp.exe42⤵
- Executes dropped EXE
PID:1588 -
\??\c:\lflrrxr.exec:\lflrrxr.exe43⤵
- Executes dropped EXE
PID:2104 -
\??\c:\btnhtb.exec:\btnhtb.exe44⤵
- Executes dropped EXE
PID:2196 -
\??\c:\9nhbbh.exec:\9nhbbh.exe45⤵
- Executes dropped EXE
PID:2192 -
\??\c:\ppjjp.exec:\ppjjp.exe46⤵
- Executes dropped EXE
PID:2728 -
\??\c:\3lxfrxx.exec:\3lxfrxx.exe47⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hnthbt.exec:\hnthbt.exe48⤵
- Executes dropped EXE
PID:2660 -
\??\c:\dvpdp.exec:\dvpdp.exe49⤵
- Executes dropped EXE
PID:2644 -
\??\c:\lfxlflr.exec:\lfxlflr.exe50⤵
- Executes dropped EXE
PID:2704 -
\??\c:\fxrxffl.exec:\fxrxffl.exe51⤵
- Executes dropped EXE
PID:2536 -
\??\c:\9ttbhn.exec:\9ttbhn.exe52⤵
- Executes dropped EXE
PID:2780 -
\??\c:\5jjpp.exec:\5jjpp.exe53⤵
- Executes dropped EXE
PID:2524 -
\??\c:\5dvjp.exec:\5dvjp.exe54⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rxffllr.exec:\rxffllr.exe55⤵
- Executes dropped EXE
PID:1396 -
\??\c:\nnbhtb.exec:\nnbhtb.exe56⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jdvvv.exec:\jdvvv.exe57⤵
- Executes dropped EXE
PID:2836 -
\??\c:\jddvv.exec:\jddvv.exe58⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xxrfrrl.exec:\xxrfrrl.exe59⤵
- Executes dropped EXE
PID:2952 -
\??\c:\btbnbh.exec:\btbnbh.exe60⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tttnbn.exec:\tttnbn.exe61⤵
- Executes dropped EXE
PID:3016 -
\??\c:\vjppp.exec:\vjppp.exe62⤵
- Executes dropped EXE
PID:1312 -
\??\c:\vpjjv.exec:\vpjjv.exe63⤵
- Executes dropped EXE
PID:288 -
\??\c:\fxrrxxr.exec:\fxrrxxr.exe64⤵
- Executes dropped EXE
PID:2396 -
\??\c:\hhhnhh.exec:\hhhnhh.exe65⤵
- Executes dropped EXE
PID:344 -
\??\c:\9nnthn.exec:\9nnthn.exe66⤵PID:372
-
\??\c:\ddjdj.exec:\ddjdj.exe67⤵PID:2756
-
\??\c:\jdvdp.exec:\jdvdp.exe68⤵PID:304
-
\??\c:\xrfffrf.exec:\xrfffrf.exe69⤵PID:1504
-
\??\c:\9hhbbt.exec:\9hhbbt.exe70⤵PID:2284
-
\??\c:\tttbnt.exec:\tttbnt.exe71⤵PID:784
-
\??\c:\1vpjv.exec:\1vpjv.exe72⤵PID:2492
-
\??\c:\vpjpd.exec:\vpjpd.exe73⤵PID:572
-
\??\c:\5rrrrfl.exec:\5rrrrfl.exe74⤵PID:944
-
\??\c:\fllxrxl.exec:\fllxrxl.exe75⤵PID:552
-
\??\c:\bthnbh.exec:\bthnbh.exe76⤵PID:836
-
\??\c:\pvdvv.exec:\pvdvv.exe77⤵PID:1128
-
\??\c:\frrlrlx.exec:\frrlrlx.exe78⤵PID:876
-
\??\c:\xxflrfx.exec:\xxflrfx.exe79⤵PID:1076
-
\??\c:\bbbbnh.exec:\bbbbnh.exe80⤵PID:2364
-
\??\c:\1bbthn.exec:\1bbthn.exe81⤵PID:1732
-
\??\c:\jjvjj.exec:\jjvjj.exe82⤵PID:1348
-
\??\c:\llxrllx.exec:\llxrllx.exe83⤵PID:2288
-
\??\c:\llflxrx.exec:\llflxrx.exe84⤵PID:1592
-
\??\c:\hhntth.exec:\hhntth.exe85⤵PID:924
-
\??\c:\3jvdp.exec:\3jvdp.exe86⤵PID:1256
-
\??\c:\3dpdv.exec:\3dpdv.exe87⤵PID:1276
-
\??\c:\fxxrxlx.exec:\fxxrxlx.exe88⤵PID:2376
-
\??\c:\hbtntt.exec:\hbtntt.exe89⤵PID:2900
-
\??\c:\tnnntt.exec:\tnnntt.exe90⤵PID:2176
-
\??\c:\jdpdj.exec:\jdpdj.exe91⤵PID:2044
-
\??\c:\rlfrfrf.exec:\rlfrfrf.exe92⤵PID:2424
-
\??\c:\lrrrlxf.exec:\lrrrlxf.exe93⤵PID:1584
-
\??\c:\hbthnn.exec:\hbthnn.exe94⤵PID:2884
-
\??\c:\3pjjp.exec:\3pjjp.exe95⤵PID:1400
-
\??\c:\pppvv.exec:\pppvv.exe96⤵PID:2104
-
\??\c:\rrfxrlx.exec:\rrfxrlx.exe97⤵PID:1688
-
\??\c:\bbbtbn.exec:\bbbtbn.exe98⤵PID:2708
-
\??\c:\pjppv.exec:\pjppv.exe99⤵PID:2728
-
\??\c:\9dvpp.exec:\9dvpp.exe100⤵PID:2712
-
\??\c:\1rllffr.exec:\1rllffr.exe101⤵PID:2628
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe102⤵PID:2644
-
\??\c:\3bthtb.exec:\3bthtb.exe103⤵PID:2704
-
\??\c:\jjdvd.exec:\jjdvd.exe104⤵PID:2536
-
\??\c:\9pvjv.exec:\9pvjv.exe105⤵PID:2780
-
\??\c:\rrlfrxl.exec:\rrlfrxl.exe106⤵PID:2400
-
\??\c:\hhbnbn.exec:\hhbnbn.exe107⤵PID:2684
-
\??\c:\tttthn.exec:\tttthn.exe108⤵PID:1056
-
\??\c:\9pvjv.exec:\9pvjv.exe109⤵PID:2072
-
\??\c:\xflxlxx.exec:\xflxlxx.exe110⤵PID:2848
-
\??\c:\fxxfxlx.exec:\fxxfxlx.exe111⤵PID:2876
-
\??\c:\hntbht.exec:\hntbht.exe112⤵PID:3028
-
\??\c:\5pvjv.exec:\5pvjv.exe113⤵PID:1628
-
\??\c:\ppjvj.exec:\ppjvj.exe114⤵PID:1956
-
\??\c:\1flxflx.exec:\1flxflx.exe115⤵PID:2580
-
\??\c:\nbnhnb.exec:\nbnhnb.exe116⤵PID:2012
-
\??\c:\thntnn.exec:\thntnn.exe117⤵PID:1772
-
\??\c:\dddpp.exec:\dddpp.exe118⤵PID:2500
-
\??\c:\jvdpd.exec:\jvdpd.exe119⤵PID:2768
-
\??\c:\3xrrxfr.exec:\3xrrxfr.exe120⤵PID:2840
-
\??\c:\bbnbnt.exec:\bbnbnt.exe121⤵PID:1032
-
\??\c:\dpjjp.exec:\dpjjp.exe122⤵PID:1232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-