Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 23:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5abf03ab66548363ebf3f3710993a740_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
5abf03ab66548363ebf3f3710993a740_NeikiAnalytics.exe
-
Size
201KB
-
MD5
5abf03ab66548363ebf3f3710993a740
-
SHA1
4097961fd8ad226ef7983979adec252bd75dec06
-
SHA256
5cd0305839d51de9bbef9562baaff2e4536057dc1b836a2bb5f62ae2611853af
-
SHA512
b1465108dc388304ee330c1cb494c31301b8061b4e2d3b2f1e4561f6f573c8a73ed45ea92165379d2de2f22ce63f1d5c3e17aad020771a51527636451a15e252
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+C2HVM1p6T79:PhOm2sI93UufdC67ciJTU2HVS639
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2320-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1472-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/756-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-151-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2732-172-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1196-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-208-0x00000000002F0000-0x0000000000319000-memory.dmp family_blackmoon behavioral1/memory/1256-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/940-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1224-307-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1520-305-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2720-320-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-334-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-342-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-355-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-380-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-419-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-457-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-520-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-560-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-610-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-898-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2684-897-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1880-906-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/376-964-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2352-1042-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2352-1043-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2780-1153-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3036 xlxlxxf.exe 2608 vpvvv.exe 2728 llrffxr.exe 2872 9tnhnn.exe 2772 jvvpj.exe 2828 rrlfrrf.exe 2784 htnbnh.exe 2576 9xlfllf.exe 1932 1nnbhh.exe 2184 9djjp.exe 1472 9lffflx.exe 1760 nhnnhh.exe 756 7pddj.exe 1804 rlfrflr.exe 1608 hhntbn.exe 1872 ppjjp.exe 636 fflfffx.exe 2732 nhbnhn.exe 1196 jdvjv.exe 2824 llrxlxf.exe 2276 tthhbb.exe 2060 dddvj.exe 1668 3lxlllr.exe 2712 ttnbnt.exe 2364 lllrxrr.exe 1256 llxflxr.exe 940 3bhnbb.exe 1224 5rlxllr.exe 2856 5htnhn.exe 2932 pjdpd.exe 628 xrfrflx.exe 1648 dvdjv.exe 2320 dvddj.exe 1520 llxrflr.exe 3044 3hhnbh.exe 2720 tnntbb.exe 2716 pjvvj.exe 2392 3lrxrxr.exe 2388 ffxfxfr.exe 2672 ttntbh.exe 2556 1jdpd.exe 2232 fffrxxx.exe 2948 rrxllxf.exe 2244 7thbhn.exe 292 tttnbn.exe 1976 ppjpv.exe 316 7pdpd.exe 1428 1bbnbn.exe 1568 btnbnt.exe 2476 vdvvv.exe 756 flxxlff.exe 2408 3tnntt.exe 2736 tbbtth.exe 880 jdddj.exe 1188 xrfrxff.exe 1332 9frxffr.exe 2744 hththb.exe 2840 9pvvv.exe 2812 xflxxxl.exe 1936 ffflflr.exe 2100 bbthnn.exe 2352 pjjdj.exe 1788 vpdpd.exe 1792 llflllr.exe -
resource yara_rule behavioral1/memory/2320-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/756-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-151-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/1196-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-208-0x00000000002F0000-0x0000000000319000-memory.dmp upx behavioral1/memory/1256-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/940-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-305-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2720-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-334-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-348-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-355-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/316-388-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-419-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-457-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-464-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-507-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-520-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-527-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-534-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-541-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-560-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-591-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-610-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-617-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-642-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-667-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/372-674-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-731-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-738-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-751-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-770-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-795-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-814-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-821-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-840-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-847-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-897-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/1880-906-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-925-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1848-939-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2320 wrote to memory of 3036 2320 5abf03ab66548363ebf3f3710993a740_NeikiAnalytics.exe 28 PID 2320 wrote to memory of 3036 2320 5abf03ab66548363ebf3f3710993a740_NeikiAnalytics.exe 28 PID 2320 wrote to memory of 3036 2320 5abf03ab66548363ebf3f3710993a740_NeikiAnalytics.exe 28 PID 2320 wrote to memory of 3036 2320 5abf03ab66548363ebf3f3710993a740_NeikiAnalytics.exe 28 PID 3036 wrote to memory of 2608 3036 xlxlxxf.exe 29 PID 3036 wrote to memory of 2608 3036 xlxlxxf.exe 29 PID 3036 wrote to memory of 2608 3036 xlxlxxf.exe 29 PID 3036 wrote to memory of 2608 3036 xlxlxxf.exe 29 PID 2608 wrote to memory of 2728 2608 vpvvv.exe 30 PID 2608 wrote to memory of 2728 2608 vpvvv.exe 30 PID 2608 wrote to memory of 2728 2608 vpvvv.exe 30 PID 2608 wrote to memory of 2728 2608 vpvvv.exe 30 PID 2728 wrote to memory of 2872 2728 llrffxr.exe 31 PID 2728 wrote to memory of 2872 2728 llrffxr.exe 31 PID 2728 wrote to memory of 2872 2728 llrffxr.exe 31 PID 2728 wrote to memory of 2872 2728 llrffxr.exe 31 PID 2872 wrote to memory of 2772 2872 9tnhnn.exe 32 PID 2872 wrote to memory of 2772 2872 9tnhnn.exe 32 PID 2872 wrote to memory of 2772 2872 9tnhnn.exe 32 PID 2872 wrote to memory of 2772 2872 9tnhnn.exe 32 PID 2772 wrote to memory of 2828 2772 jvvpj.exe 33 PID 2772 wrote to memory of 2828 2772 jvvpj.exe 33 PID 2772 wrote to memory of 2828 2772 jvvpj.exe 33 PID 2772 wrote to memory of 2828 2772 jvvpj.exe 33 PID 2828 wrote to memory of 2784 2828 rrlfrrf.exe 34 PID 2828 wrote to memory of 2784 2828 rrlfrrf.exe 34 PID 2828 wrote to memory of 2784 2828 rrlfrrf.exe 34 PID 2828 wrote to memory of 2784 2828 rrlfrrf.exe 34 PID 2784 wrote to memory of 2576 2784 htnbnh.exe 35 PID 2784 wrote to memory of 2576 2784 htnbnh.exe 35 PID 2784 wrote to memory of 2576 2784 htnbnh.exe 35 PID 2784 wrote to memory of 2576 2784 htnbnh.exe 35 PID 2576 wrote to memory of 1932 2576 9xlfllf.exe 36 PID 2576 wrote to memory of 1932 2576 9xlfllf.exe 36 PID 2576 wrote to memory of 1932 2576 9xlfllf.exe 36 PID 2576 wrote to memory of 1932 2576 9xlfllf.exe 36 PID 1932 wrote to memory of 2184 1932 1nnbhh.exe 37 PID 1932 wrote to memory of 2184 1932 1nnbhh.exe 37 PID 1932 wrote to memory of 2184 1932 1nnbhh.exe 37 PID 1932 wrote to memory of 2184 1932 1nnbhh.exe 37 PID 2184 wrote to memory of 1472 2184 9djjp.exe 38 PID 2184 wrote to memory of 1472 2184 9djjp.exe 38 PID 2184 wrote to memory of 1472 2184 9djjp.exe 38 PID 2184 wrote to memory of 1472 2184 9djjp.exe 38 PID 1472 wrote to memory of 1760 1472 9lffflx.exe 39 PID 1472 wrote to memory of 1760 1472 9lffflx.exe 39 PID 1472 wrote to memory of 1760 1472 9lffflx.exe 39 PID 1472 wrote to memory of 1760 1472 9lffflx.exe 39 PID 1760 wrote to memory of 756 1760 nhnnhh.exe 40 PID 1760 wrote to memory of 756 1760 nhnnhh.exe 40 PID 1760 wrote to memory of 756 1760 nhnnhh.exe 40 PID 1760 wrote to memory of 756 1760 nhnnhh.exe 40 PID 756 wrote to memory of 1804 756 7pddj.exe 41 PID 756 wrote to memory of 1804 756 7pddj.exe 41 PID 756 wrote to memory of 1804 756 7pddj.exe 41 PID 756 wrote to memory of 1804 756 7pddj.exe 41 PID 1804 wrote to memory of 1608 1804 rlfrflr.exe 42 PID 1804 wrote to memory of 1608 1804 rlfrflr.exe 42 PID 1804 wrote to memory of 1608 1804 rlfrflr.exe 42 PID 1804 wrote to memory of 1608 1804 rlfrflr.exe 42 PID 1608 wrote to memory of 1872 1608 hhntbn.exe 43 PID 1608 wrote to memory of 1872 1608 hhntbn.exe 43 PID 1608 wrote to memory of 1872 1608 hhntbn.exe 43 PID 1608 wrote to memory of 1872 1608 hhntbn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\5abf03ab66548363ebf3f3710993a740_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5abf03ab66548363ebf3f3710993a740_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\xlxlxxf.exec:\xlxlxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\vpvvv.exec:\vpvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\llrffxr.exec:\llrffxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\9tnhnn.exec:\9tnhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\jvvpj.exec:\jvvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\rrlfrrf.exec:\rrlfrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\htnbnh.exec:\htnbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\9xlfllf.exec:\9xlfllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\1nnbhh.exec:\1nnbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\9djjp.exec:\9djjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\9lffflx.exec:\9lffflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\nhnnhh.exec:\nhnnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\7pddj.exec:\7pddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\rlfrflr.exec:\rlfrflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\hhntbn.exec:\hhntbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\ppjjp.exec:\ppjjp.exe17⤵
- Executes dropped EXE
PID:1872 -
\??\c:\fflfffx.exec:\fflfffx.exe18⤵
- Executes dropped EXE
PID:636 -
\??\c:\nhbnhn.exec:\nhbnhn.exe19⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jdvjv.exec:\jdvjv.exe20⤵
- Executes dropped EXE
PID:1196 -
\??\c:\llrxlxf.exec:\llrxlxf.exe21⤵
- Executes dropped EXE
PID:2824 -
\??\c:\tthhbb.exec:\tthhbb.exe22⤵
- Executes dropped EXE
PID:2276 -
\??\c:\dddvj.exec:\dddvj.exe23⤵
- Executes dropped EXE
PID:2060 -
\??\c:\3lxlllr.exec:\3lxlllr.exe24⤵
- Executes dropped EXE
PID:1668 -
\??\c:\ttnbnt.exec:\ttnbnt.exe25⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lllrxrr.exec:\lllrxrr.exe26⤵
- Executes dropped EXE
PID:2364 -
\??\c:\llxflxr.exec:\llxflxr.exe27⤵
- Executes dropped EXE
PID:1256 -
\??\c:\3bhnbb.exec:\3bhnbb.exe28⤵
- Executes dropped EXE
PID:940 -
\??\c:\5rlxllr.exec:\5rlxllr.exe29⤵
- Executes dropped EXE
PID:1224 -
\??\c:\5htnhn.exec:\5htnhn.exe30⤵
- Executes dropped EXE
PID:2856 -
\??\c:\pjdpd.exec:\pjdpd.exe31⤵
- Executes dropped EXE
PID:2932 -
\??\c:\xrfrflx.exec:\xrfrflx.exe32⤵
- Executes dropped EXE
PID:628 -
\??\c:\dvdjv.exec:\dvdjv.exe33⤵
- Executes dropped EXE
PID:1648 -
\??\c:\dvddj.exec:\dvddj.exe34⤵
- Executes dropped EXE
PID:2320 -
\??\c:\llxrflr.exec:\llxrflr.exe35⤵
- Executes dropped EXE
PID:1520 -
\??\c:\3hhnbh.exec:\3hhnbh.exe36⤵
- Executes dropped EXE
PID:3044 -
\??\c:\tnntbb.exec:\tnntbb.exe37⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pjvvj.exec:\pjvvj.exe38⤵
- Executes dropped EXE
PID:2716 -
\??\c:\3lrxrxr.exec:\3lrxrxr.exe39⤵
- Executes dropped EXE
PID:2392 -
\??\c:\ffxfxfr.exec:\ffxfxfr.exe40⤵
- Executes dropped EXE
PID:2388 -
\??\c:\ttntbh.exec:\ttntbh.exe41⤵
- Executes dropped EXE
PID:2672 -
\??\c:\1jdpd.exec:\1jdpd.exe42⤵
- Executes dropped EXE
PID:2556 -
\??\c:\fffrxxx.exec:\fffrxxx.exe43⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rrxllxf.exec:\rrxllxf.exe44⤵
- Executes dropped EXE
PID:2948 -
\??\c:\7thbhn.exec:\7thbhn.exe45⤵
- Executes dropped EXE
PID:2244 -
\??\c:\tttnbn.exec:\tttnbn.exe46⤵
- Executes dropped EXE
PID:292 -
\??\c:\ppjpv.exec:\ppjpv.exe47⤵
- Executes dropped EXE
PID:1976 -
\??\c:\7pdpd.exec:\7pdpd.exe48⤵
- Executes dropped EXE
PID:316 -
\??\c:\1bbnbn.exec:\1bbnbn.exe49⤵
- Executes dropped EXE
PID:1428 -
\??\c:\btnbnt.exec:\btnbnt.exe50⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vdvvv.exec:\vdvvv.exe51⤵
- Executes dropped EXE
PID:2476 -
\??\c:\flxxlff.exec:\flxxlff.exe52⤵
- Executes dropped EXE
PID:756 -
\??\c:\3tnntt.exec:\3tnntt.exe53⤵
- Executes dropped EXE
PID:2408 -
\??\c:\tbbtth.exec:\tbbtth.exe54⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jdddj.exec:\jdddj.exe55⤵
- Executes dropped EXE
PID:880 -
\??\c:\xrfrxff.exec:\xrfrxff.exe56⤵
- Executes dropped EXE
PID:1188 -
\??\c:\9frxffr.exec:\9frxffr.exe57⤵
- Executes dropped EXE
PID:1332 -
\??\c:\hththb.exec:\hththb.exe58⤵
- Executes dropped EXE
PID:2744 -
\??\c:\9pvvv.exec:\9pvvv.exe59⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xflxxxl.exec:\xflxxxl.exe60⤵
- Executes dropped EXE
PID:2812 -
\??\c:\ffflflr.exec:\ffflflr.exe61⤵
- Executes dropped EXE
PID:1936 -
\??\c:\bbthnn.exec:\bbthnn.exe62⤵
- Executes dropped EXE
PID:2100 -
\??\c:\pjjdj.exec:\pjjdj.exe63⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vpdpd.exec:\vpdpd.exe64⤵
- Executes dropped EXE
PID:1788 -
\??\c:\llflllr.exec:\llflllr.exe65⤵
- Executes dropped EXE
PID:1792 -
\??\c:\bbbnhn.exec:\bbbnhn.exe66⤵PID:2236
-
\??\c:\nhbnht.exec:\nhbnht.exe67⤵PID:2924
-
\??\c:\dpjjp.exec:\dpjjp.exe68⤵PID:324
-
\??\c:\lrlrflr.exec:\lrlrflr.exe69⤵PID:1716
-
\??\c:\frlllfr.exec:\frlllfr.exe70⤵PID:1636
-
\??\c:\9thbhh.exec:\9thbhh.exe71⤵PID:2076
-
\??\c:\jjvdv.exec:\jjvdv.exe72⤵PID:1312
-
\??\c:\xxflffl.exec:\xxflffl.exe73⤵PID:2040
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe74⤵PID:1420
-
\??\c:\3bbhhh.exec:\3bbhhh.exe75⤵PID:1904
-
\??\c:\ppddp.exec:\ppddp.exe76⤵PID:1648
-
\??\c:\ddvdd.exec:\ddvdd.exe77⤵PID:1508
-
\??\c:\3xxxffr.exec:\3xxxffr.exe78⤵PID:1620
-
\??\c:\rlflrrf.exec:\rlflrrf.exe79⤵PID:2648
-
\??\c:\5bbbnb.exec:\5bbbnb.exe80⤵PID:2884
-
\??\c:\dddjd.exec:\dddjd.exe81⤵PID:2748
-
\??\c:\lfrllrf.exec:\lfrllrf.exe82⤵PID:2872
-
\??\c:\1llrflf.exec:\1llrflf.exe83⤵PID:2684
-
\??\c:\bbbnht.exec:\bbbnht.exe84⤵PID:2664
-
\??\c:\pjjvp.exec:\pjjvp.exe85⤵PID:2516
-
\??\c:\ffrflrf.exec:\ffrflrf.exe86⤵PID:2556
-
\??\c:\fxlrxxx.exec:\fxlrxxx.exe87⤵PID:2784
-
\??\c:\3nhbtn.exec:\3nhbtn.exe88⤵PID:3000
-
\??\c:\dppvd.exec:\dppvd.exe89⤵PID:2244
-
\??\c:\vvvdv.exec:\vvvdv.exe90⤵PID:1796
-
\??\c:\3lffllr.exec:\3lffllr.exe91⤵PID:2180
-
\??\c:\tnhhtb.exec:\tnhhtb.exe92⤵PID:760
-
\??\c:\nhttbb.exec:\nhttbb.exe93⤵PID:372
-
\??\c:\djvjp.exec:\djvjp.exe94⤵PID:1496
-
\??\c:\xxxrfll.exec:\xxxrfll.exe95⤵PID:344
-
\??\c:\thbtnb.exec:\thbtnb.exe96⤵PID:1592
-
\??\c:\tnthbh.exec:\tnthbh.exe97⤵PID:2408
-
\??\c:\vvpvj.exec:\vvpvj.exe98⤵PID:668
-
\??\c:\ddjpp.exec:\ddjpp.exe99⤵PID:532
-
\??\c:\xrxxfxr.exec:\xrxxfxr.exe100⤵PID:1188
-
\??\c:\7bhtnb.exec:\7bhtnb.exe101⤵PID:836
-
\??\c:\ddpdv.exec:\ddpdv.exe102⤵PID:1244
-
\??\c:\jdvjv.exec:\jdvjv.exe103⤵PID:2724
-
\??\c:\lfrflrl.exec:\lfrflrl.exe104⤵PID:2740
-
\??\c:\nnntth.exec:\nnntth.exe105⤵PID:1936
-
\??\c:\1hnbhn.exec:\1hnbhn.exe106⤵PID:2060
-
\??\c:\vjjvd.exec:\vjjvd.exe107⤵PID:2804
-
\??\c:\flffllx.exec:\flffllx.exe108⤵PID:1788
-
\??\c:\llfrxfx.exec:\llfrxfx.exe109⤵PID:2568
-
\??\c:\tttnbn.exec:\tttnbn.exe110⤵PID:2236
-
\??\c:\tnhtbn.exec:\tnhtbn.exe111⤵PID:864
-
\??\c:\pjddj.exec:\pjddj.exe112⤵PID:324
-
\??\c:\rrrfrxl.exec:\rrrfrxl.exe113⤵PID:940
-
\??\c:\9xfxlxf.exec:\9xfxlxf.exe114⤵PID:1120
-
\??\c:\3btbhn.exec:\3btbhn.exe115⤵PID:2076
-
\??\c:\dppvd.exec:\dppvd.exe116⤵PID:1564
-
\??\c:\jjvjv.exec:\jjvjv.exe117⤵PID:2040
-
\??\c:\llxffrf.exec:\llxffrf.exe118⤵PID:1424
-
\??\c:\hbtbth.exec:\hbtbth.exe119⤵PID:1904
-
\??\c:\nthhht.exec:\nthhht.exe120⤵PID:2688
-
\??\c:\djjjp.exec:\djjjp.exe121⤵PID:1520
-
\??\c:\1xfflfx.exec:\1xfflfx.exe122⤵PID:3020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-