Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 07:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e20ed3a49116236f9082d348b665060_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
9e20ed3a49116236f9082d348b665060_NeikiAnalytics.exe
-
Size
193KB
-
MD5
9e20ed3a49116236f9082d348b665060
-
SHA1
80f8af9a3529c40b32e11b21f6799f5d6e356894
-
SHA256
9abb3779f02827fd1b363a7e84d5f3b29ed152991bcdebf913037e8cb5d0355a
-
SHA512
a52a03af5fa775fc0b5cbefeb990ed404638c38a3e4da1edd046a09c86046a7585acedfe866d89da0872e61e1dce435cdc7b66221d643ec37b7e9cac3b15ded2
-
SSDEEP
1536:VvQBeOGtrYSSsrc93UBIfdC67m6AJiqHlHdmAWI:VhOm2sI93UufdC67ciVAWI
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2168-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-380-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/332-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/240-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-646-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1600-683-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2316-731-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2472-836-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-903-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/904-1082-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/584-1265-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1744-1319-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2784-1340-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2004 3nbtnt.exe 3036 7pddp.exe 2684 rrxllfl.exe 2648 60840.exe 2548 0428442.exe 2928 3btbtt.exe 2384 864004.exe 2460 080024.exe 2956 866244.exe 1468 u228006.exe 2616 dpvdd.exe 2776 lfffrfr.exe 1724 vpjjp.exe 1912 22028.exe 804 6042008.exe 2280 82442.exe 540 vjjpd.exe 1412 pjvdd.exe 2568 04268.exe 880 a2002.exe 2744 jdpvj.exe 1992 ntnhth.exe 2836 486428.exe 2208 60228.exe 2792 486284.exe 1952 a2086.exe 1004 ddvjj.exe 348 g6888.exe 2240 s6624.exe 2964 26062.exe 560 6608220.exe 2472 260206.exe 1668 e22844.exe 2032 hhtttt.exe 2532 pdvjj.exe 1496 vvjpd.exe 2668 nnhbnn.exe 2708 44462.exe 2672 0466884.exe 2812 64860.exe 2548 a8040.exe 2396 1hbthb.exe 2284 k48804.exe 2460 602468.exe 2596 btttbh.exe 2408 9bhtht.exe 2452 xfxflfr.exe 2800 08024.exe 1548 486022.exe 1724 5lfflxx.exe 1912 260246.exe 2112 k48686.exe 2592 m6062.exe 320 fffrrfr.exe 688 0862884.exe 2316 s0802.exe 332 m6006.exe 1680 lrxlxrr.exe 2772 486800.exe 2332 484466.exe 1992 080884.exe 2364 1djdp.exe 2836 4422842.exe 916 k02244.exe -
resource yara_rule behavioral1/memory/2168-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/240-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/240-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-683-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2356-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-836-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-850-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-882-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-934-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-1069-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-1144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-1151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-1164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-1179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-1247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-1305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-1312-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2004 2168 9e20ed3a49116236f9082d348b665060_NeikiAnalytics.exe 28 PID 2168 wrote to memory of 2004 2168 9e20ed3a49116236f9082d348b665060_NeikiAnalytics.exe 28 PID 2168 wrote to memory of 2004 2168 9e20ed3a49116236f9082d348b665060_NeikiAnalytics.exe 28 PID 2168 wrote to memory of 2004 2168 9e20ed3a49116236f9082d348b665060_NeikiAnalytics.exe 28 PID 2004 wrote to memory of 3036 2004 3nbtnt.exe 29 PID 2004 wrote to memory of 3036 2004 3nbtnt.exe 29 PID 2004 wrote to memory of 3036 2004 3nbtnt.exe 29 PID 2004 wrote to memory of 3036 2004 3nbtnt.exe 29 PID 3036 wrote to memory of 2684 3036 7pddp.exe 30 PID 3036 wrote to memory of 2684 3036 7pddp.exe 30 PID 3036 wrote to memory of 2684 3036 7pddp.exe 30 PID 3036 wrote to memory of 2684 3036 7pddp.exe 30 PID 2684 wrote to memory of 2648 2684 rrxllfl.exe 31 PID 2684 wrote to memory of 2648 2684 rrxllfl.exe 31 PID 2684 wrote to memory of 2648 2684 rrxllfl.exe 31 PID 2684 wrote to memory of 2648 2684 rrxllfl.exe 31 PID 2648 wrote to memory of 2548 2648 60840.exe 68 PID 2648 wrote to memory of 2548 2648 60840.exe 68 PID 2648 wrote to memory of 2548 2648 60840.exe 68 PID 2648 wrote to memory of 2548 2648 60840.exe 68 PID 2548 wrote to memory of 2928 2548 0428442.exe 33 PID 2548 wrote to memory of 2928 2548 0428442.exe 33 PID 2548 wrote to memory of 2928 2548 0428442.exe 33 PID 2548 wrote to memory of 2928 2548 0428442.exe 33 PID 2928 wrote to memory of 2384 2928 3btbtt.exe 34 PID 2928 wrote to memory of 2384 2928 3btbtt.exe 34 PID 2928 wrote to memory of 2384 2928 3btbtt.exe 34 PID 2928 wrote to memory of 2384 2928 3btbtt.exe 34 PID 2384 wrote to memory of 2460 2384 864004.exe 35 PID 2384 wrote to memory of 2460 2384 864004.exe 35 PID 2384 wrote to memory of 2460 2384 864004.exe 35 PID 2384 wrote to memory of 2460 2384 864004.exe 35 PID 2460 wrote to memory of 2956 2460 080024.exe 36 PID 2460 wrote to memory of 2956 2460 080024.exe 36 PID 2460 wrote to memory of 2956 2460 080024.exe 36 PID 2460 wrote to memory of 2956 2460 080024.exe 36 PID 2956 wrote to memory of 1468 2956 866244.exe 37 PID 2956 wrote to memory of 1468 2956 866244.exe 37 PID 2956 wrote to memory of 1468 2956 866244.exe 37 PID 2956 wrote to memory of 1468 2956 866244.exe 37 PID 1468 wrote to memory of 2616 1468 u228006.exe 38 PID 1468 wrote to memory of 2616 1468 u228006.exe 38 PID 1468 wrote to memory of 2616 1468 u228006.exe 38 PID 1468 wrote to memory of 2616 1468 u228006.exe 38 PID 2616 wrote to memory of 2776 2616 dpvdd.exe 39 PID 2616 wrote to memory of 2776 2616 dpvdd.exe 39 PID 2616 wrote to memory of 2776 2616 dpvdd.exe 39 PID 2616 wrote to memory of 2776 2616 dpvdd.exe 39 PID 2776 wrote to memory of 1724 2776 lfffrfr.exe 40 PID 2776 wrote to memory of 1724 2776 lfffrfr.exe 40 PID 2776 wrote to memory of 1724 2776 lfffrfr.exe 40 PID 2776 wrote to memory of 1724 2776 lfffrfr.exe 40 PID 1724 wrote to memory of 1912 1724 vpjjp.exe 41 PID 1724 wrote to memory of 1912 1724 vpjjp.exe 41 PID 1724 wrote to memory of 1912 1724 vpjjp.exe 41 PID 1724 wrote to memory of 1912 1724 vpjjp.exe 41 PID 1912 wrote to memory of 804 1912 22028.exe 42 PID 1912 wrote to memory of 804 1912 22028.exe 42 PID 1912 wrote to memory of 804 1912 22028.exe 42 PID 1912 wrote to memory of 804 1912 22028.exe 42 PID 804 wrote to memory of 2280 804 6042008.exe 43 PID 804 wrote to memory of 2280 804 6042008.exe 43 PID 804 wrote to memory of 2280 804 6042008.exe 43 PID 804 wrote to memory of 2280 804 6042008.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e20ed3a49116236f9082d348b665060_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9e20ed3a49116236f9082d348b665060_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\3nbtnt.exec:\3nbtnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\7pddp.exec:\7pddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\rrxllfl.exec:\rrxllfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\60840.exec:\60840.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\0428442.exec:\0428442.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\3btbtt.exec:\3btbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\864004.exec:\864004.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\080024.exec:\080024.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\866244.exec:\866244.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\u228006.exec:\u228006.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\dpvdd.exec:\dpvdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\lfffrfr.exec:\lfffrfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\vpjjp.exec:\vpjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\22028.exec:\22028.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\6042008.exec:\6042008.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\82442.exec:\82442.exe17⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vjjpd.exec:\vjjpd.exe18⤵
- Executes dropped EXE
PID:540 -
\??\c:\pjvdd.exec:\pjvdd.exe19⤵
- Executes dropped EXE
PID:1412 -
\??\c:\04268.exec:\04268.exe20⤵
- Executes dropped EXE
PID:2568 -
\??\c:\a2002.exec:\a2002.exe21⤵
- Executes dropped EXE
PID:880 -
\??\c:\jdpvj.exec:\jdpvj.exe22⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ntnhth.exec:\ntnhth.exe23⤵
- Executes dropped EXE
PID:1992 -
\??\c:\486428.exec:\486428.exe24⤵
- Executes dropped EXE
PID:2836 -
\??\c:\60228.exec:\60228.exe25⤵
- Executes dropped EXE
PID:2208 -
\??\c:\486284.exec:\486284.exe26⤵
- Executes dropped EXE
PID:2792 -
\??\c:\a2086.exec:\a2086.exe27⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ddvjj.exec:\ddvjj.exe28⤵
- Executes dropped EXE
PID:1004 -
\??\c:\g6888.exec:\g6888.exe29⤵
- Executes dropped EXE
PID:348 -
\??\c:\s6624.exec:\s6624.exe30⤵
- Executes dropped EXE
PID:2240 -
\??\c:\26062.exec:\26062.exe31⤵
- Executes dropped EXE
PID:2964 -
\??\c:\6608220.exec:\6608220.exe32⤵
- Executes dropped EXE
PID:560 -
\??\c:\260206.exec:\260206.exe33⤵
- Executes dropped EXE
PID:2472 -
\??\c:\e22844.exec:\e22844.exe34⤵
- Executes dropped EXE
PID:1668 -
\??\c:\hhtttt.exec:\hhtttt.exe35⤵
- Executes dropped EXE
PID:2032 -
\??\c:\pdvjj.exec:\pdvjj.exe36⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vvjpd.exec:\vvjpd.exe37⤵
- Executes dropped EXE
PID:1496 -
\??\c:\nnhbnn.exec:\nnhbnn.exe38⤵
- Executes dropped EXE
PID:2668 -
\??\c:\44462.exec:\44462.exe39⤵
- Executes dropped EXE
PID:2708 -
\??\c:\0466884.exec:\0466884.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\64860.exec:\64860.exe41⤵
- Executes dropped EXE
PID:2812 -
\??\c:\a8040.exec:\a8040.exe42⤵
- Executes dropped EXE
PID:2548 -
\??\c:\1hbthb.exec:\1hbthb.exe43⤵
- Executes dropped EXE
PID:2396 -
\??\c:\k48804.exec:\k48804.exe44⤵
- Executes dropped EXE
PID:2284 -
\??\c:\602468.exec:\602468.exe45⤵
- Executes dropped EXE
PID:2460 -
\??\c:\btttbh.exec:\btttbh.exe46⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9bhtht.exec:\9bhtht.exe47⤵
- Executes dropped EXE
PID:2408 -
\??\c:\xfxflfr.exec:\xfxflfr.exe48⤵
- Executes dropped EXE
PID:2452 -
\??\c:\08024.exec:\08024.exe49⤵
- Executes dropped EXE
PID:2800 -
\??\c:\486022.exec:\486022.exe50⤵
- Executes dropped EXE
PID:1548 -
\??\c:\5lfflxx.exec:\5lfflxx.exe51⤵
- Executes dropped EXE
PID:1724 -
\??\c:\260246.exec:\260246.exe52⤵
- Executes dropped EXE
PID:1912 -
\??\c:\k48686.exec:\k48686.exe53⤵
- Executes dropped EXE
PID:2112 -
\??\c:\m6062.exec:\m6062.exe54⤵
- Executes dropped EXE
PID:2592 -
\??\c:\fffrrfr.exec:\fffrrfr.exe55⤵
- Executes dropped EXE
PID:320 -
\??\c:\0862884.exec:\0862884.exe56⤵
- Executes dropped EXE
PID:688 -
\??\c:\s0802.exec:\s0802.exe57⤵
- Executes dropped EXE
PID:2316 -
\??\c:\m6006.exec:\m6006.exe58⤵
- Executes dropped EXE
PID:332 -
\??\c:\lrxlxrr.exec:\lrxlxrr.exe59⤵
- Executes dropped EXE
PID:1680 -
\??\c:\486800.exec:\486800.exe60⤵
- Executes dropped EXE
PID:2772 -
\??\c:\484466.exec:\484466.exe61⤵
- Executes dropped EXE
PID:2332 -
\??\c:\080884.exec:\080884.exe62⤵
- Executes dropped EXE
PID:1992 -
\??\c:\1djdp.exec:\1djdp.exe63⤵
- Executes dropped EXE
PID:2364 -
\??\c:\4422842.exec:\4422842.exe64⤵
- Executes dropped EXE
PID:2836 -
\??\c:\k02244.exec:\k02244.exe65⤵
- Executes dropped EXE
PID:916 -
\??\c:\5ffflrx.exec:\5ffflrx.exe66⤵PID:1008
-
\??\c:\602022.exec:\602022.exe67⤵PID:268
-
\??\c:\4800840.exec:\4800840.exe68⤵PID:988
-
\??\c:\ddppj.exec:\ddppj.exe69⤵PID:240
-
\??\c:\xxflfrl.exec:\xxflfrl.exe70⤵PID:348
-
\??\c:\6022002.exec:\6022002.exe71⤵PID:1988
-
\??\c:\66068.exec:\66068.exe72⤵PID:2916
-
\??\c:\tntttt.exec:\tntttt.exe73⤵PID:2424
-
\??\c:\886802.exec:\886802.exe74⤵PID:1864
-
\??\c:\vpddp.exec:\vpddp.exe75⤵PID:2020
-
\??\c:\e82424.exec:\e82424.exe76⤵PID:2480
-
\??\c:\ddvjd.exec:\ddvjd.exe77⤵PID:2032
-
\??\c:\ffxlffr.exec:\ffxlffr.exe78⤵PID:2040
-
\??\c:\4802806.exec:\4802806.exe79⤵PID:2716
-
\??\c:\264062.exec:\264062.exe80⤵PID:1308
-
\??\c:\s4668.exec:\s4668.exe81⤵PID:2676
-
\??\c:\vpddp.exec:\vpddp.exe82⤵PID:1916
-
\??\c:\4262440.exec:\4262440.exe83⤵PID:2180
-
\??\c:\08020.exec:\08020.exe84⤵PID:2312
-
\??\c:\fxrxllf.exec:\fxrxllf.exe85⤵PID:2400
-
\??\c:\u806880.exec:\u806880.exe86⤵PID:2428
-
\??\c:\rlxxllf.exec:\rlxxllf.exe87⤵PID:2284
-
\??\c:\80846.exec:\80846.exe88⤵PID:2184
-
\??\c:\860088.exec:\860088.exe89⤵PID:2584
-
\??\c:\g4266.exec:\g4266.exe90⤵PID:2972
-
\??\c:\c828480.exec:\c828480.exe91⤵PID:2196
-
\??\c:\o206286.exec:\o206286.exe92⤵PID:2476
-
\??\c:\04028.exec:\04028.exe93⤵PID:1852
-
\??\c:\bnbnnt.exec:\bnbnnt.exe94⤵PID:1600
-
\??\c:\5btnbn.exec:\5btnbn.exe95⤵PID:1724
-
\??\c:\rflfllx.exec:\rflfllx.exe96⤵PID:2320
-
\??\c:\606684.exec:\606684.exe97⤵PID:672
-
\??\c:\q02222.exec:\q02222.exe98⤵PID:2760
-
\??\c:\4480462.exec:\4480462.exe99⤵PID:2348
-
\??\c:\u462884.exec:\u462884.exe100⤵PID:2356
-
\??\c:\dvjvv.exec:\dvjvv.exe101⤵PID:2316
-
\??\c:\424000.exec:\424000.exe102⤵PID:2756
-
\??\c:\4660482.exec:\4660482.exe103⤵PID:1736
-
\??\c:\lxrxxfl.exec:\lxrxxfl.exe104⤵PID:3052
-
\??\c:\nhbhnt.exec:\nhbhnt.exe105⤵PID:2588
-
\??\c:\284842.exec:\284842.exe106⤵PID:2444
-
\??\c:\xlxxfxl.exec:\xlxxfxl.exe107⤵PID:588
-
\??\c:\pvjpj.exec:\pvjpj.exe108⤵PID:1064
-
\??\c:\9nntnn.exec:\9nntnn.exe109⤵PID:1336
-
\??\c:\268460.exec:\268460.exe110⤵PID:1952
-
\??\c:\88662.exec:\88662.exe111⤵PID:2820
-
\??\c:\6044220.exec:\6044220.exe112⤵PID:948
-
\??\c:\2226442.exec:\2226442.exe113⤵PID:1004
-
\??\c:\9ttbhn.exec:\9ttbhn.exe114⤵PID:1368
-
\??\c:\48280.exec:\48280.exe115⤵PID:2964
-
\??\c:\vvpdj.exec:\vvpdj.exe116⤵PID:1424
-
\??\c:\rlffxxf.exec:\rlffxxf.exe117⤵PID:2908
-
\??\c:\hbhnnn.exec:\hbhnnn.exe118⤵PID:2472
-
\??\c:\068020.exec:\068020.exe119⤵PID:2168
-
\??\c:\08466.exec:\08466.exe120⤵PID:2004
-
\??\c:\rfrxxxf.exec:\rfrxxxf.exe121⤵PID:2656
-
\??\c:\084444.exec:\084444.exe122⤵PID:2528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-