Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 02:16
Behavioral task
behavioral1
Sample
49dd126b95b6c3c8cc62af024581c790_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
49dd126b95b6c3c8cc62af024581c790_NeikiAnalytics.exe
-
Size
81KB
-
MD5
49dd126b95b6c3c8cc62af024581c790
-
SHA1
6aa6320eadd7ea0493ebfbc28c451281d56c2944
-
SHA256
f6718eefeb9881ba5b76a42fe7b5aea1b4b69c7b83f8642903c4ceade420f08d
-
SHA512
0020a1155618b15690d017eb0735d4f2f51c935a049255568e44d8f1b9f940f87a93626280f009af3e93c4a52b5b6e1d70ca1cd60fd6d933acaa7efd6d46f959
-
SSDEEP
1536:CvQBeOGtrYS3srx93UBWfwC6Ggnouy8AelS7/7VIQH8:ChOmTsF93UYfwC6GIoutAe07zVIq8
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/1992-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1276-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/628-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1476-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1476-231-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/984-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1296-260-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1120-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-344-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-351-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-407-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1600-445-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/688-548-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/688-553-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-597-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-749-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1388-815-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-909-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/1624-1024-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/584-1074-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/316-1100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-1246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-1360-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/484-1359-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2420 jjvvd.exe 1276 lfxfrrr.exe 1940 1rlxrrf.exe 2016 rfrrfff.exe 2796 nttbnn.exe 2804 1pdvd.exe 2532 ppdvd.exe 2636 jdpjp.exe 2496 jddpp.exe 2668 7pvdj.exe 2184 bhnhbn.exe 2844 jjjdv.exe 2900 rlfxllx.exe 2484 lffllxf.exe 2148 3btthh.exe 324 vpddp.exe 1412 llffrxf.exe 3040 ffrlrlx.exe 628 hbhhtt.exe 1304 ppdvj.exe 2000 lxlrrfl.exe 1712 xrlxrrf.exe 2476 nnbbhn.exe 536 1bhhnn.exe 1476 pjjdp.exe 984 frffllr.exe 356 rrflxlr.exe 292 bthhtt.exe 1296 vpdvj.exe 1120 ppvpv.exe 2376 tnntnn.exe 940 bbhbbh.exe 1184 ddvjp.exe 2172 3xrlrxf.exe 1548 1ffrxfr.exe 2916 flrxlll.exe 1852 btbtbh.exe 1660 jdjpv.exe 2640 jdppv.exe 2648 3fllxfl.exe 2680 tnnbtb.exe 2524 bbnnhn.exe 2312 pjvvd.exe 2544 vpvvj.exe 2616 frxxfff.exe 2664 ffxxffl.exe 2572 hbbnhh.exe 2288 nhbhth.exe 1596 7jdvd.exe 2872 ddppj.exe 2912 lfllllx.exe 3012 xxfrlxl.exe 3068 nhbbhn.exe 2380 bbthhh.exe 2876 1jvjp.exe 1600 3dvpd.exe 2568 lxrxxfl.exe 1280 llxfffr.exe 3040 tnhnbb.exe 1500 nbhhnn.exe 2072 1dppv.exe 2296 vpjpp.exe 1724 5lfllrx.exe 2480 xrflfll.exe -
resource yara_rule behavioral1/memory/1992-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0007000000012120-9.dat upx behavioral1/memory/1992-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1276-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0037000000015fbb-19.dat upx behavioral1/memory/2420-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x000800000001640f-28.dat upx behavioral1/files/0x00080000000167e8-46.dat upx behavioral1/memory/2016-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x000800000001650f-37.dat upx behavioral1/memory/2796-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0007000000016c57-65.dat upx behavioral1/memory/2804-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0007000000016c5b-72.dat upx behavioral1/files/0x0007000000016c3a-56.dat upx behavioral1/memory/2804-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0008000000016d73-79.dat upx behavioral1/memory/2496-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016d7d-90.dat upx behavioral1/files/0x0006000000016fa9-97.dat upx behavioral1/files/0x000600000001708c-107.dat upx behavioral1/memory/2184-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x00060000000171ad-113.dat upx behavioral1/memory/2900-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x000600000001738e-125.dat upx behavioral1/files/0x000600000001738f-132.dat upx behavioral1/memory/2484-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x00060000000173e2-143.dat upx behavioral1/files/0x00060000000173e5-150.dat upx behavioral1/memory/324-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000017436-160.dat upx behavioral1/memory/3040-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x00060000000174ef-168.dat upx behavioral1/memory/3040-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/628-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000017577-179.dat upx behavioral1/files/0x00060000000175f7-185.dat upx behavioral1/memory/2000-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x00060000000175fd-196.dat upx behavioral1/files/0x0006000000017603-203.dat upx behavioral1/memory/2476-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x000d000000018689-213.dat upx behavioral1/files/0x00050000000186a2-221.dat upx behavioral1/memory/1476-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x000500000001870e-232.dat upx behavioral1/files/0x000500000001871c-241.dat upx behavioral1/memory/984-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0005000000018749-248.dat upx behavioral1/files/0x000500000001878f-257.dat upx behavioral1/files/0x000600000001902f-265.dat upx behavioral1/memory/1120-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0037000000016020-275.dat upx behavioral1/memory/1120-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0005000000019254-283.dat upx behavioral1/memory/2172-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-323-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-324-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-331-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2420 1992 49dd126b95b6c3c8cc62af024581c790_NeikiAnalytics.exe 28 PID 1992 wrote to memory of 2420 1992 49dd126b95b6c3c8cc62af024581c790_NeikiAnalytics.exe 28 PID 1992 wrote to memory of 2420 1992 49dd126b95b6c3c8cc62af024581c790_NeikiAnalytics.exe 28 PID 1992 wrote to memory of 2420 1992 49dd126b95b6c3c8cc62af024581c790_NeikiAnalytics.exe 28 PID 2420 wrote to memory of 1276 2420 jjvvd.exe 29 PID 2420 wrote to memory of 1276 2420 jjvvd.exe 29 PID 2420 wrote to memory of 1276 2420 jjvvd.exe 29 PID 2420 wrote to memory of 1276 2420 jjvvd.exe 29 PID 1276 wrote to memory of 1940 1276 lfxfrrr.exe 30 PID 1276 wrote to memory of 1940 1276 lfxfrrr.exe 30 PID 1276 wrote to memory of 1940 1276 lfxfrrr.exe 30 PID 1276 wrote to memory of 1940 1276 lfxfrrr.exe 30 PID 1940 wrote to memory of 2016 1940 1rlxrrf.exe 31 PID 1940 wrote to memory of 2016 1940 1rlxrrf.exe 31 PID 1940 wrote to memory of 2016 1940 1rlxrrf.exe 31 PID 1940 wrote to memory of 2016 1940 1rlxrrf.exe 31 PID 2016 wrote to memory of 2796 2016 rfrrfff.exe 32 PID 2016 wrote to memory of 2796 2016 rfrrfff.exe 32 PID 2016 wrote to memory of 2796 2016 rfrrfff.exe 32 PID 2016 wrote to memory of 2796 2016 rfrrfff.exe 32 PID 2796 wrote to memory of 2804 2796 nttbnn.exe 33 PID 2796 wrote to memory of 2804 2796 nttbnn.exe 33 PID 2796 wrote to memory of 2804 2796 nttbnn.exe 33 PID 2796 wrote to memory of 2804 2796 nttbnn.exe 33 PID 2804 wrote to memory of 2532 2804 1pdvd.exe 34 PID 2804 wrote to memory of 2532 2804 1pdvd.exe 34 PID 2804 wrote to memory of 2532 2804 1pdvd.exe 34 PID 2804 wrote to memory of 2532 2804 1pdvd.exe 34 PID 2532 wrote to memory of 2636 2532 ppdvd.exe 35 PID 2532 wrote to memory of 2636 2532 ppdvd.exe 35 PID 2532 wrote to memory of 2636 2532 ppdvd.exe 35 PID 2532 wrote to memory of 2636 2532 ppdvd.exe 35 PID 2636 wrote to memory of 2496 2636 jdpjp.exe 36 PID 2636 wrote to memory of 2496 2636 jdpjp.exe 36 PID 2636 wrote to memory of 2496 2636 jdpjp.exe 36 PID 2636 wrote to memory of 2496 2636 jdpjp.exe 36 PID 2496 wrote to memory of 2668 2496 jddpp.exe 37 PID 2496 wrote to memory of 2668 2496 jddpp.exe 37 PID 2496 wrote to memory of 2668 2496 jddpp.exe 37 PID 2496 wrote to memory of 2668 2496 jddpp.exe 37 PID 2668 wrote to memory of 2184 2668 7pvdj.exe 38 PID 2668 wrote to memory of 2184 2668 7pvdj.exe 38 PID 2668 wrote to memory of 2184 2668 7pvdj.exe 38 PID 2668 wrote to memory of 2184 2668 7pvdj.exe 38 PID 2184 wrote to memory of 2844 2184 bhnhbn.exe 39 PID 2184 wrote to memory of 2844 2184 bhnhbn.exe 39 PID 2184 wrote to memory of 2844 2184 bhnhbn.exe 39 PID 2184 wrote to memory of 2844 2184 bhnhbn.exe 39 PID 2844 wrote to memory of 2900 2844 jjjdv.exe 40 PID 2844 wrote to memory of 2900 2844 jjjdv.exe 40 PID 2844 wrote to memory of 2900 2844 jjjdv.exe 40 PID 2844 wrote to memory of 2900 2844 jjjdv.exe 40 PID 2900 wrote to memory of 2484 2900 rlfxllx.exe 41 PID 2900 wrote to memory of 2484 2900 rlfxllx.exe 41 PID 2900 wrote to memory of 2484 2900 rlfxllx.exe 41 PID 2900 wrote to memory of 2484 2900 rlfxllx.exe 41 PID 2484 wrote to memory of 2148 2484 lffllxf.exe 42 PID 2484 wrote to memory of 2148 2484 lffllxf.exe 42 PID 2484 wrote to memory of 2148 2484 lffllxf.exe 42 PID 2484 wrote to memory of 2148 2484 lffllxf.exe 42 PID 2148 wrote to memory of 324 2148 3btthh.exe 43 PID 2148 wrote to memory of 324 2148 3btthh.exe 43 PID 2148 wrote to memory of 324 2148 3btthh.exe 43 PID 2148 wrote to memory of 324 2148 3btthh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\49dd126b95b6c3c8cc62af024581c790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\49dd126b95b6c3c8cc62af024581c790_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\jjvvd.exec:\jjvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\lfxfrrr.exec:\lfxfrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\1rlxrrf.exec:\1rlxrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\rfrrfff.exec:\rfrrfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\nttbnn.exec:\nttbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\1pdvd.exec:\1pdvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\ppdvd.exec:\ppdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jdpjp.exec:\jdpjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\jddpp.exec:\jddpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\7pvdj.exec:\7pvdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\bhnhbn.exec:\bhnhbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\jjjdv.exec:\jjjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\rlfxllx.exec:\rlfxllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\lffllxf.exec:\lffllxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\3btthh.exec:\3btthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\vpddp.exec:\vpddp.exe17⤵
- Executes dropped EXE
PID:324 -
\??\c:\llffrxf.exec:\llffrxf.exe18⤵
- Executes dropped EXE
PID:1412 -
\??\c:\ffrlrlx.exec:\ffrlrlx.exe19⤵
- Executes dropped EXE
PID:3040 -
\??\c:\hbhhtt.exec:\hbhhtt.exe20⤵
- Executes dropped EXE
PID:628 -
\??\c:\ppdvj.exec:\ppdvj.exe21⤵
- Executes dropped EXE
PID:1304 -
\??\c:\lxlrrfl.exec:\lxlrrfl.exe22⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xrlxrrf.exec:\xrlxrrf.exe23⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nnbbhn.exec:\nnbbhn.exe24⤵
- Executes dropped EXE
PID:2476 -
\??\c:\1bhhnn.exec:\1bhhnn.exe25⤵
- Executes dropped EXE
PID:536 -
\??\c:\pjjdp.exec:\pjjdp.exe26⤵
- Executes dropped EXE
PID:1476 -
\??\c:\frffllr.exec:\frffllr.exe27⤵
- Executes dropped EXE
PID:984 -
\??\c:\rrflxlr.exec:\rrflxlr.exe28⤵
- Executes dropped EXE
PID:356 -
\??\c:\bthhtt.exec:\bthhtt.exe29⤵
- Executes dropped EXE
PID:292 -
\??\c:\vpdvj.exec:\vpdvj.exe30⤵
- Executes dropped EXE
PID:1296 -
\??\c:\ppvpv.exec:\ppvpv.exe31⤵
- Executes dropped EXE
PID:1120 -
\??\c:\tnntnn.exec:\tnntnn.exe32⤵
- Executes dropped EXE
PID:2376 -
\??\c:\bbhbbh.exec:\bbhbbh.exe33⤵
- Executes dropped EXE
PID:940 -
\??\c:\ddvjp.exec:\ddvjp.exe34⤵
- Executes dropped EXE
PID:1184 -
\??\c:\3xrlrxf.exec:\3xrlrxf.exe35⤵
- Executes dropped EXE
PID:2172 -
\??\c:\1ffrxfr.exec:\1ffrxfr.exe36⤵
- Executes dropped EXE
PID:1548 -
\??\c:\flrxlll.exec:\flrxlll.exe37⤵
- Executes dropped EXE
PID:2916 -
\??\c:\btbtbh.exec:\btbtbh.exe38⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jdjpv.exec:\jdjpv.exe39⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jdppv.exec:\jdppv.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\3fllxfl.exec:\3fllxfl.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\tnnbtb.exec:\tnnbtb.exe42⤵
- Executes dropped EXE
PID:2680 -
\??\c:\bbnnhn.exec:\bbnnhn.exe43⤵
- Executes dropped EXE
PID:2524 -
\??\c:\pjvvd.exec:\pjvvd.exe44⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vpvvj.exec:\vpvvj.exe45⤵
- Executes dropped EXE
PID:2544 -
\??\c:\frxxfff.exec:\frxxfff.exe46⤵
- Executes dropped EXE
PID:2616 -
\??\c:\ffxxffl.exec:\ffxxffl.exe47⤵
- Executes dropped EXE
PID:2664 -
\??\c:\hbbnhh.exec:\hbbnhh.exe48⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nhbhth.exec:\nhbhth.exe49⤵
- Executes dropped EXE
PID:2288 -
\??\c:\7jdvd.exec:\7jdvd.exe50⤵
- Executes dropped EXE
PID:1596 -
\??\c:\ddppj.exec:\ddppj.exe51⤵
- Executes dropped EXE
PID:2872 -
\??\c:\lfllllx.exec:\lfllllx.exe52⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xxfrlxl.exec:\xxfrlxl.exe53⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nhbbhn.exec:\nhbbhn.exe54⤵
- Executes dropped EXE
PID:3068 -
\??\c:\bbthhh.exec:\bbthhh.exe55⤵
- Executes dropped EXE
PID:2380 -
\??\c:\1jvjp.exec:\1jvjp.exe56⤵
- Executes dropped EXE
PID:2876 -
\??\c:\3dvpd.exec:\3dvpd.exe57⤵
- Executes dropped EXE
PID:1600 -
\??\c:\lxrxxfl.exec:\lxrxxfl.exe58⤵
- Executes dropped EXE
PID:2568 -
\??\c:\llxfffr.exec:\llxfffr.exe59⤵
- Executes dropped EXE
PID:1280 -
\??\c:\tnhnbb.exec:\tnhnbb.exe60⤵
- Executes dropped EXE
PID:3040 -
\??\c:\nbhhnn.exec:\nbhhnn.exe61⤵
- Executes dropped EXE
PID:1500 -
\??\c:\1dppv.exec:\1dppv.exe62⤵
- Executes dropped EXE
PID:2072 -
\??\c:\vpjpp.exec:\vpjpp.exe63⤵
- Executes dropped EXE
PID:2296 -
\??\c:\5lfllrx.exec:\5lfllrx.exe64⤵
- Executes dropped EXE
PID:1724 -
\??\c:\xrflfll.exec:\xrflfll.exe65⤵
- Executes dropped EXE
PID:2480 -
\??\c:\3bhnbb.exec:\3bhnbb.exe66⤵PID:2880
-
\??\c:\tnbntb.exec:\tnbntb.exe67⤵PID:484
-
\??\c:\vpjpd.exec:\vpjpd.exe68⤵PID:1796
-
\??\c:\lflxflr.exec:\lflxflr.exe69⤵PID:1476
-
\??\c:\9fxlrfl.exec:\9fxlrfl.exe70⤵PID:1760
-
\??\c:\hhtbtb.exec:\hhtbtb.exe71⤵PID:1588
-
\??\c:\hbtbhh.exec:\hbtbhh.exe72⤵PID:1932
-
\??\c:\pjpjp.exec:\pjpjp.exe73⤵PID:1028
-
\??\c:\vvpjd.exec:\vvpjd.exe74⤵PID:688
-
\??\c:\9xrxxxf.exec:\9xrxxxf.exe75⤵PID:1420
-
\??\c:\nnbnbn.exec:\nnbnbn.exe76⤵PID:1700
-
\??\c:\htbhth.exec:\htbhth.exe77⤵PID:2376
-
\??\c:\9dddp.exec:\9dddp.exe78⤵PID:1912
-
\??\c:\vpjjj.exec:\vpjjj.exe79⤵PID:1956
-
\??\c:\9rlflrx.exec:\9rlflrx.exe80⤵PID:1568
-
\??\c:\3ffrllr.exec:\3ffrllr.exe81⤵PID:2320
-
\??\c:\hhnhth.exec:\hhnhth.exe82⤵PID:1972
-
\??\c:\nhnhnb.exec:\nhnhnb.exe83⤵PID:2224
-
\??\c:\vpjvv.exec:\vpjvv.exe84⤵PID:3032
-
\??\c:\dvjpv.exec:\dvjpv.exe85⤵PID:2700
-
\??\c:\xfllrlx.exec:\xfllrlx.exe86⤵PID:2928
-
\??\c:\tnntbb.exec:\tnntbb.exe87⤵PID:2504
-
\??\c:\thtthh.exec:\thtthh.exe88⤵PID:2680
-
\??\c:\nhthbb.exec:\nhthbb.exe89⤵PID:2716
-
\??\c:\vvjpj.exec:\vvjpj.exe90⤵PID:2520
-
\??\c:\9dpdp.exec:\9dpdp.exe91⤵PID:2616
-
\??\c:\lxfrxff.exec:\lxfrxff.exe92⤵PID:2548
-
\??\c:\9rlrrfl.exec:\9rlrrfl.exe93⤵PID:2620
-
\??\c:\tnthtn.exec:\tnthtn.exe94⤵PID:2572
-
\??\c:\bnbntn.exec:\bnbntn.exe95⤵PID:2856
-
\??\c:\jvpdd.exec:\jvpdd.exe96⤵PID:2868
-
\??\c:\dpjjv.exec:\dpjjv.exe97⤵PID:3036
-
\??\c:\rlfxxfr.exec:\rlfxxfr.exe98⤵PID:2676
-
\??\c:\xrxxlrr.exec:\xrxxlrr.exe99⤵PID:1616
-
\??\c:\hbbbnt.exec:\hbbbnt.exe100⤵PID:1916
-
\??\c:\5tnbbb.exec:\5tnbbb.exe101⤵PID:2740
-
\??\c:\ppdjd.exec:\ppdjd.exe102⤵PID:2736
-
\??\c:\1dppp.exec:\1dppp.exe103⤵PID:2472
-
\??\c:\9lfrlrf.exec:\9lfrlrf.exe104⤵PID:1624
-
\??\c:\frffrlr.exec:\frffrlr.exe105⤵PID:1484
-
\??\c:\ththnn.exec:\ththnn.exe106⤵PID:852
-
\??\c:\thntbh.exec:\thntbh.exe107⤵PID:2292
-
\??\c:\vpdjv.exec:\vpdjv.exe108⤵PID:2096
-
\??\c:\3pvjd.exec:\3pvjd.exe109⤵PID:2952
-
\??\c:\9rllxxf.exec:\9rllxxf.exe110⤵PID:2240
-
\??\c:\llxfllr.exec:\llxfllr.exe111⤵PID:264
-
\??\c:\nbtbhh.exec:\nbtbhh.exe112⤵PID:536
-
\??\c:\hbtttb.exec:\hbtttb.exe113⤵PID:1808
-
\??\c:\jvjpj.exec:\jvjpj.exe114⤵PID:1508
-
\??\c:\dpjpd.exec:\dpjpd.exe115⤵PID:1388
-
\??\c:\frrxlrl.exec:\frrxlrl.exe116⤵PID:1820
-
\??\c:\llllflx.exec:\llllflx.exe117⤵PID:1932
-
\??\c:\9hbhnt.exec:\9hbhnt.exe118⤵PID:1028
-
\??\c:\pdjdp.exec:\pdjdp.exe119⤵PID:688
-
\??\c:\pjvjp.exec:\pjvjp.exe120⤵PID:300
-
\??\c:\rllrfrx.exec:\rllrfrx.exe121⤵PID:2396
-
\??\c:\fxlxxff.exec:\fxlxxff.exe122⤵PID:1748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-