Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 15:46
Behavioral task
behavioral1
Sample
cc92f0bc50e485763a0db8ebece4c830_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
cc92f0bc50e485763a0db8ebece4c830_NeikiAnalytics.exe
-
Size
130KB
-
MD5
cc92f0bc50e485763a0db8ebece4c830
-
SHA1
35c83bf6c866485fb9c4ab5146bbb008c415c236
-
SHA256
8e6cc40b58c73c7ab673a1ef0ce5bd98a7f2c17d942fd9a99f7a449b38050aa8
-
SHA512
2def062f3818b7e997343e94018ad5fd1d9bd438d3c6a744516f6d875b3d384be7302f0e4a837bc9bee85f14a949bb27e1b7e564b3f78c62d36b184d7a819214
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLQS7ByFqAxTOUIZX3UCmK:9cm4FmowdHoSdSyEAxyFXEVK
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/3016-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-123-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2864-117-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1636-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1272-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1300-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/616-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1036-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1784-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1276-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/496-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/496-449-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2656-627-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-641-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-692-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2856-772-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-775-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1736-878-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1472-1084-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2104-1349-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3016 xrxlxff.exe 2684 lfxlfrx.exe 2644 fflfxrr.exe 2916 vpddj.exe 2512 7ffflrx.exe 2840 3frlxxf.exe 2668 7nhhnn.exe 2504 vvppj.exe 2624 rlflffr.exe 2248 tththn.exe 2764 tnhntt.exe 2864 vdjjp.exe 3000 rlfxlrl.exe 1988 3frlrxl.exe 1968 ttbhth.exe 1272 1ppvp.exe 1636 rrllrfr.exe 2492 3xrxlrx.exe 1532 3hthth.exe 2056 djppd.exe 1300 3xlrflx.exe 1904 9tbhtb.exe 2060 3jdpv.exe 332 rrrfrfr.exe 1476 fxrxlrx.exe 2360 bthntb.exe 1668 tnhnbh.exe 616 vvppv.exe 1036 9thntb.exe 2324 nhbhtn.exe 1784 3ppvd.exe 2136 xxrxlrf.exe 888 9htntt.exe 1692 nhbntt.exe 2944 ddvpp.exe 1604 lrxrrrx.exe 2888 lfrfllx.exe 2824 ttnhtn.exe 2688 pjdjj.exe 2780 lfrrlrf.exe 2612 xlrrffr.exe 2308 tnbbtn.exe 2512 9jvjj.exe 2640 pjpvj.exe 2788 lfrlrrf.exe 2524 frrrlxx.exe 2508 ttnbnt.exe 2332 bthntb.exe 344 jvpvj.exe 2828 fxffrrf.exe 2592 5llxflr.exe 2736 bthhtt.exe 1576 nhtntt.exe 1276 3dvvj.exe 1680 frxxlrx.exe 1972 lfxrxrx.exe 496 3nhntt.exe 1308 bttbth.exe 1192 dvvvj.exe 1416 xxfrfrf.exe 1388 1llrffr.exe 2092 btntbb.exe 2104 bthnbh.exe 2932 jdjpd.exe -
resource yara_rule behavioral1/memory/2944-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3016-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0036000000015d02-19.dat upx behavioral1/files/0x000c00000001227b-12.dat upx behavioral1/memory/3016-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2944-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d89-27.dat upx behavioral1/memory/2684-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d99-37.dat upx behavioral1/memory/2644-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015fbb-46.dat upx behavioral1/memory/2916-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2512-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016020-57.dat upx behavioral1/files/0x0007000000016126-64.dat upx behavioral1/files/0x000900000001640f-73.dat upx behavioral1/memory/2668-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2504-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d2d-85.dat upx behavioral1/memory/2504-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d36-92.dat upx behavioral1/files/0x0006000000016d3e-101.dat upx behavioral1/memory/2764-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d46-110.dat upx behavioral1/files/0x0006000000016d4f-120.dat upx behavioral1/memory/2864-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d57-129.dat upx behavioral1/files/0x0006000000016d5f-137.dat upx behavioral1/files/0x0006000000016d73-144.dat upx behavioral1/files/0x0006000000016d79-151.dat upx behavioral1/memory/1636-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d7d-161.dat upx behavioral1/memory/1272-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2492-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016fa9-169.dat upx behavioral1/files/0x000600000001708c-179.dat upx behavioral1/files/0x00060000000171ad-186.dat upx behavioral1/memory/2056-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001738e-197.dat upx behavioral1/memory/1300-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001738f-204.dat upx behavioral1/files/0x00060000000173e2-214.dat upx behavioral1/memory/2060-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173e5-223.dat upx behavioral1/files/0x0006000000017436-230.dat upx behavioral1/memory/2360-238-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174ef-240.dat upx behavioral1/files/0x0036000000015d13-247.dat upx behavioral1/memory/2360-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/616-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017577-256.dat upx behavioral1/memory/1036-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175f7-265.dat upx behavioral1/files/0x00060000000175fd-273.dat upx behavioral1/files/0x0006000000017603-282.dat upx behavioral1/memory/1784-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2136-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1692-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-322-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-329-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-336-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-343-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2508-386-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2944 wrote to memory of 3016 2944 cc92f0bc50e485763a0db8ebece4c830_NeikiAnalytics.exe 28 PID 2944 wrote to memory of 3016 2944 cc92f0bc50e485763a0db8ebece4c830_NeikiAnalytics.exe 28 PID 2944 wrote to memory of 3016 2944 cc92f0bc50e485763a0db8ebece4c830_NeikiAnalytics.exe 28 PID 2944 wrote to memory of 3016 2944 cc92f0bc50e485763a0db8ebece4c830_NeikiAnalytics.exe 28 PID 3016 wrote to memory of 2684 3016 xrxlxff.exe 29 PID 3016 wrote to memory of 2684 3016 xrxlxff.exe 29 PID 3016 wrote to memory of 2684 3016 xrxlxff.exe 29 PID 3016 wrote to memory of 2684 3016 xrxlxff.exe 29 PID 2684 wrote to memory of 2644 2684 lfxlfrx.exe 30 PID 2684 wrote to memory of 2644 2684 lfxlfrx.exe 30 PID 2684 wrote to memory of 2644 2684 lfxlfrx.exe 30 PID 2684 wrote to memory of 2644 2684 lfxlfrx.exe 30 PID 2644 wrote to memory of 2916 2644 fflfxrr.exe 31 PID 2644 wrote to memory of 2916 2644 fflfxrr.exe 31 PID 2644 wrote to memory of 2916 2644 fflfxrr.exe 31 PID 2644 wrote to memory of 2916 2644 fflfxrr.exe 31 PID 2916 wrote to memory of 2512 2916 vpddj.exe 32 PID 2916 wrote to memory of 2512 2916 vpddj.exe 32 PID 2916 wrote to memory of 2512 2916 vpddj.exe 32 PID 2916 wrote to memory of 2512 2916 vpddj.exe 32 PID 2512 wrote to memory of 2840 2512 7ffflrx.exe 33 PID 2512 wrote to memory of 2840 2512 7ffflrx.exe 33 PID 2512 wrote to memory of 2840 2512 7ffflrx.exe 33 PID 2512 wrote to memory of 2840 2512 7ffflrx.exe 33 PID 2840 wrote to memory of 2668 2840 3frlxxf.exe 34 PID 2840 wrote to memory of 2668 2840 3frlxxf.exe 34 PID 2840 wrote to memory of 2668 2840 3frlxxf.exe 34 PID 2840 wrote to memory of 2668 2840 3frlxxf.exe 34 PID 2668 wrote to memory of 2504 2668 7nhhnn.exe 35 PID 2668 wrote to memory of 2504 2668 7nhhnn.exe 35 PID 2668 wrote to memory of 2504 2668 7nhhnn.exe 35 PID 2668 wrote to memory of 2504 2668 7nhhnn.exe 35 PID 2504 wrote to memory of 2624 2504 vvppj.exe 36 PID 2504 wrote to memory of 2624 2504 vvppj.exe 36 PID 2504 wrote to memory of 2624 2504 vvppj.exe 36 PID 2504 wrote to memory of 2624 2504 vvppj.exe 36 PID 2624 wrote to memory of 2248 2624 rlflffr.exe 37 PID 2624 wrote to memory of 2248 2624 rlflffr.exe 37 PID 2624 wrote to memory of 2248 2624 rlflffr.exe 37 PID 2624 wrote to memory of 2248 2624 rlflffr.exe 37 PID 2248 wrote to memory of 2764 2248 tththn.exe 38 PID 2248 wrote to memory of 2764 2248 tththn.exe 38 PID 2248 wrote to memory of 2764 2248 tththn.exe 38 PID 2248 wrote to memory of 2764 2248 tththn.exe 38 PID 2764 wrote to memory of 2864 2764 tnhntt.exe 39 PID 2764 wrote to memory of 2864 2764 tnhntt.exe 39 PID 2764 wrote to memory of 2864 2764 tnhntt.exe 39 PID 2764 wrote to memory of 2864 2764 tnhntt.exe 39 PID 2864 wrote to memory of 3000 2864 vdjjp.exe 40 PID 2864 wrote to memory of 3000 2864 vdjjp.exe 40 PID 2864 wrote to memory of 3000 2864 vdjjp.exe 40 PID 2864 wrote to memory of 3000 2864 vdjjp.exe 40 PID 3000 wrote to memory of 1988 3000 rlfxlrl.exe 41 PID 3000 wrote to memory of 1988 3000 rlfxlrl.exe 41 PID 3000 wrote to memory of 1988 3000 rlfxlrl.exe 41 PID 3000 wrote to memory of 1988 3000 rlfxlrl.exe 41 PID 1988 wrote to memory of 1968 1988 3frlrxl.exe 42 PID 1988 wrote to memory of 1968 1988 3frlrxl.exe 42 PID 1988 wrote to memory of 1968 1988 3frlrxl.exe 42 PID 1988 wrote to memory of 1968 1988 3frlrxl.exe 42 PID 1968 wrote to memory of 1272 1968 ttbhth.exe 43 PID 1968 wrote to memory of 1272 1968 ttbhth.exe 43 PID 1968 wrote to memory of 1272 1968 ttbhth.exe 43 PID 1968 wrote to memory of 1272 1968 ttbhth.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc92f0bc50e485763a0db8ebece4c830_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cc92f0bc50e485763a0db8ebece4c830_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\xrxlxff.exec:\xrxlxff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\lfxlfrx.exec:\lfxlfrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\fflfxrr.exec:\fflfxrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\vpddj.exec:\vpddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\7ffflrx.exec:\7ffflrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\3frlxxf.exec:\3frlxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\7nhhnn.exec:\7nhhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\vvppj.exec:\vvppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\rlflffr.exec:\rlflffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\tththn.exec:\tththn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\tnhntt.exec:\tnhntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\vdjjp.exec:\vdjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\rlfxlrl.exec:\rlfxlrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\3frlrxl.exec:\3frlrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\ttbhth.exec:\ttbhth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\1ppvp.exec:\1ppvp.exe17⤵
- Executes dropped EXE
PID:1272 -
\??\c:\rrllrfr.exec:\rrllrfr.exe18⤵
- Executes dropped EXE
PID:1636 -
\??\c:\3xrxlrx.exec:\3xrxlrx.exe19⤵
- Executes dropped EXE
PID:2492 -
\??\c:\3hthth.exec:\3hthth.exe20⤵
- Executes dropped EXE
PID:1532 -
\??\c:\djppd.exec:\djppd.exe21⤵
- Executes dropped EXE
PID:2056 -
\??\c:\3xlrflx.exec:\3xlrflx.exe22⤵
- Executes dropped EXE
PID:1300 -
\??\c:\9tbhtb.exec:\9tbhtb.exe23⤵
- Executes dropped EXE
PID:1904 -
\??\c:\3jdpv.exec:\3jdpv.exe24⤵
- Executes dropped EXE
PID:2060 -
\??\c:\rrrfrfr.exec:\rrrfrfr.exe25⤵
- Executes dropped EXE
PID:332 -
\??\c:\fxrxlrx.exec:\fxrxlrx.exe26⤵
- Executes dropped EXE
PID:1476 -
\??\c:\bthntb.exec:\bthntb.exe27⤵
- Executes dropped EXE
PID:2360 -
\??\c:\tnhnbh.exec:\tnhnbh.exe28⤵
- Executes dropped EXE
PID:1668 -
\??\c:\vvppv.exec:\vvppv.exe29⤵
- Executes dropped EXE
PID:616 -
\??\c:\9thntb.exec:\9thntb.exe30⤵
- Executes dropped EXE
PID:1036 -
\??\c:\nhbhtn.exec:\nhbhtn.exe31⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3ppvd.exec:\3ppvd.exe32⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe33⤵
- Executes dropped EXE
PID:2136 -
\??\c:\9htntt.exec:\9htntt.exe34⤵
- Executes dropped EXE
PID:888 -
\??\c:\nhbntt.exec:\nhbntt.exe35⤵
- Executes dropped EXE
PID:1692 -
\??\c:\ddvpp.exec:\ddvpp.exe36⤵
- Executes dropped EXE
PID:2944 -
\??\c:\lrxrrrx.exec:\lrxrrrx.exe37⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lfrfllx.exec:\lfrfllx.exe38⤵
- Executes dropped EXE
PID:2888 -
\??\c:\ttnhtn.exec:\ttnhtn.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\pjdjj.exec:\pjdjj.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lfrrlrf.exec:\lfrrlrf.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xlrrffr.exec:\xlrrffr.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\tnbbtn.exec:\tnbbtn.exe43⤵
- Executes dropped EXE
PID:2308 -
\??\c:\9jvjj.exec:\9jvjj.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pjpvj.exec:\pjpvj.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\lfrlrrf.exec:\lfrlrrf.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\frrrlxx.exec:\frrrlxx.exe47⤵
- Executes dropped EXE
PID:2524 -
\??\c:\ttnbnt.exec:\ttnbnt.exe48⤵
- Executes dropped EXE
PID:2508 -
\??\c:\bthntb.exec:\bthntb.exe49⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jvpvj.exec:\jvpvj.exe50⤵
- Executes dropped EXE
PID:344 -
\??\c:\fxffrrf.exec:\fxffrrf.exe51⤵
- Executes dropped EXE
PID:2828 -
\??\c:\5llxflr.exec:\5llxflr.exe52⤵
- Executes dropped EXE
PID:2592 -
\??\c:\bthhtt.exec:\bthhtt.exe53⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nhtntt.exec:\nhtntt.exe54⤵
- Executes dropped EXE
PID:1576 -
\??\c:\3dvvj.exec:\3dvvj.exe55⤵
- Executes dropped EXE
PID:1276 -
\??\c:\frxxlrx.exec:\frxxlrx.exe56⤵
- Executes dropped EXE
PID:1680 -
\??\c:\lfxrxrx.exec:\lfxrxrx.exe57⤵
- Executes dropped EXE
PID:1972 -
\??\c:\3nhntt.exec:\3nhntt.exe58⤵
- Executes dropped EXE
PID:496 -
\??\c:\bttbth.exec:\bttbth.exe59⤵
- Executes dropped EXE
PID:1308 -
\??\c:\dvvvj.exec:\dvvvj.exe60⤵
- Executes dropped EXE
PID:1192 -
\??\c:\xxfrfrf.exec:\xxfrfrf.exe61⤵
- Executes dropped EXE
PID:1416 -
\??\c:\1llrffr.exec:\1llrffr.exe62⤵
- Executes dropped EXE
PID:1388 -
\??\c:\btntbb.exec:\btntbb.exe63⤵
- Executes dropped EXE
PID:2092 -
\??\c:\bthnbh.exec:\bthnbh.exe64⤵
- Executes dropped EXE
PID:2104 -
\??\c:\jdjpd.exec:\jdjpd.exe65⤵
- Executes dropped EXE
PID:2932 -
\??\c:\5jjjj.exec:\5jjjj.exe66⤵PID:2088
-
\??\c:\xrrxxff.exec:\xrrxxff.exe67⤵PID:692
-
\??\c:\rlrxlfr.exec:\rlrxlfr.exe68⤵PID:780
-
\??\c:\tnbbnn.exec:\tnbbnn.exe69⤵PID:2344
-
\??\c:\5btnbb.exec:\5btnbb.exe70⤵PID:1764
-
\??\c:\pjvjp.exec:\pjvjp.exe71⤵PID:1592
-
\??\c:\pjvpp.exec:\pjvpp.exe72⤵PID:552
-
\??\c:\3rlfrrx.exec:\3rlfrrx.exe73⤵PID:1720
-
\??\c:\7lffllr.exec:\7lffllr.exe74⤵PID:916
-
\??\c:\btbbhh.exec:\btbbhh.exe75⤵PID:1316
-
\??\c:\jjvjd.exec:\jjvjd.exe76⤵PID:2324
-
\??\c:\pppvd.exec:\pppvd.exe77⤵PID:2156
-
\??\c:\lfxflfr.exec:\lfxflfr.exe78⤵PID:1496
-
\??\c:\rxfrxlf.exec:\rxfrxlf.exe79⤵PID:2240
-
\??\c:\3hhbnb.exec:\3hhbnb.exe80⤵PID:1752
-
\??\c:\bnbbhh.exec:\bnbbhh.exe81⤵PID:3032
-
\??\c:\3vpdp.exec:\3vpdp.exe82⤵PID:1716
-
\??\c:\jdpvd.exec:\jdpvd.exe83⤵PID:2284
-
\??\c:\llrrxfl.exec:\llrrxfl.exe84⤵PID:1260
-
\??\c:\bthnhh.exec:\bthnhh.exe85⤵PID:2684
-
\??\c:\tnnnbb.exec:\tnnnbb.exe86⤵PID:2656
-
\??\c:\ppdpj.exec:\ppdpj.exe87⤵PID:2784
-
\??\c:\vpjjp.exec:\vpjjp.exe88⤵PID:2612
-
\??\c:\fxlrrrf.exec:\fxlrrrf.exe89⤵PID:2308
-
\??\c:\tththn.exec:\tththn.exe90⤵PID:2840
-
\??\c:\1nbttn.exec:\1nbttn.exe91⤵PID:2520
-
\??\c:\ppjpv.exec:\ppjpv.exe92⤵PID:2568
-
\??\c:\jdvdp.exec:\jdvdp.exe93⤵PID:2988
-
\??\c:\9lffllr.exec:\9lffllr.exe94⤵PID:1840
-
\??\c:\ffrxlrl.exec:\ffrxlrl.exe95⤵PID:2332
-
\??\c:\nnntbb.exec:\nnntbb.exe96⤵PID:2604
-
\??\c:\vpjvj.exec:\vpjvj.exe97⤵PID:2828
-
\??\c:\jdvvj.exec:\jdvvj.exe98⤵PID:2876
-
\??\c:\1xxlrrf.exec:\1xxlrrf.exe99⤵PID:2736
-
\??\c:\htbbbt.exec:\htbbbt.exe100⤵PID:1576
-
\??\c:\5pjvv.exec:\5pjvv.exe101⤵PID:2028
-
\??\c:\vvppj.exec:\vvppj.exe102⤵PID:1680
-
\??\c:\frllrxf.exec:\frllrxf.exe103⤵PID:1800
-
\??\c:\1tbbhn.exec:\1tbbhn.exe104⤵PID:2760
-
\??\c:\tnbtnb.exec:\tnbtnb.exe105⤵PID:2076
-
\??\c:\dvddj.exec:\dvddj.exe106⤵PID:836
-
\??\c:\pjppd.exec:\pjppd.exe107⤵PID:1092
-
\??\c:\lfflxxl.exec:\lfflxxl.exe108⤵PID:2064
-
\??\c:\xrffrrr.exec:\xrffrrr.exe109⤵PID:2856
-
\??\c:\nhbttb.exec:\nhbttb.exe110⤵PID:2912
-
\??\c:\hbnhtt.exec:\hbnhtt.exe111⤵PID:536
-
\??\c:\1jvpj.exec:\1jvpj.exe112⤵PID:1860
-
\??\c:\lffflrx.exec:\lffflrx.exe113⤵PID:596
-
\??\c:\ffrflxl.exec:\ffrflxl.exe114⤵PID:2320
-
\??\c:\5hhhtn.exec:\5hhhtn.exe115⤵PID:1380
-
\??\c:\3pdjp.exec:\3pdjp.exe116⤵PID:808
-
\??\c:\1dddj.exec:\1dddj.exe117⤵PID:3052
-
\??\c:\lfrrffl.exec:\lfrrffl.exe118⤵PID:1012
-
\??\c:\xrflrrf.exec:\xrflrrf.exe119⤵PID:884
-
\??\c:\tntbbn.exec:\tntbbn.exe120⤵PID:3044
-
\??\c:\jdjjv.exec:\jdjjv.exe121⤵PID:352
-
\??\c:\jdjpv.exec:\jdjpv.exe122⤵PID:3040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-