Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 15:25
Behavioral task
behavioral1
Sample
e3237ec00c4ed0f69bdb032345362260_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e3237ec00c4ed0f69bdb032345362260_NeikiAnalytics.exe
-
Size
58KB
-
MD5
e3237ec00c4ed0f69bdb032345362260
-
SHA1
71f8db1cf626661167fdc8233685ae578b2fe5e1
-
SHA256
2c5a83e71d498dbd46e00adab5bdf8bb0f82d8c7717e2fd2098b9d649ccbdd0a
-
SHA512
4d068487d4787dee168341db076bd3087bdffe70d1271429c20bae3d5fc000c92c5851f5b06dd6c4a16e68d72de1d779c8f9cea3bd354b2706372253d6aebbe5
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+IJPhbMiFH:zhOmTsF93UYfwC6GIoutiTm5hIiFH
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1716-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-6-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2300-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-32-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2864-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-132-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1956-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1028-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1228-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-206-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1140-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1240-234-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1240-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1336-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/336-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1084-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1672-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1080-692-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-720-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-812-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2296-819-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-822-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1272-906-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2824-918-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-991-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-10677-0x0000000077600000-0x00000000776FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1696 xrlrflr.exe 2300 bbbnhn.exe 2716 1jpdj.exe 2708 rrlxlxx.exe 2728 tbhbbn.exe 2864 fxlrxfr.exe 2680 rrrfxll.exe 2504 nnnnnt.exe 2196 jvddd.exe 3000 llflfll.exe 1264 3hhthn.exe 2808 vpdpj.exe 2840 1jdjj.exe 2868 rrrfxlf.exe 2428 frxfrrr.exe 1956 hbttbh.exe 2400 ddjvp.exe 1028 xrxfrff.exe 480 nthnht.exe 996 1bnhtn.exe 2408 5ddpv.exe 1228 xxrxllf.exe 2604 lfllfff.exe 2984 bbhhnn.exe 2492 bntbhh.exe 1140 5jjdj.exe 1928 djpdp.exe 1240 1tnbhn.exe 1336 1jddj.exe 2592 lfrflxf.exe 568 xlxffxl.exe 1720 nnbtbh.exe 336 tnntth.exe 2956 pjpdj.exe 2480 lffxlxr.exe 1628 frflllr.exe 1684 nnnntt.exe 2096 nnbhhn.exe 2616 jdvjv.exe 1592 5jjjj.exe 2656 xflffxr.exe 2652 frffllr.exe 2632 htbhhh.exe 2640 pdjpj.exe 2668 5flxxrx.exe 2732 7xrrfxl.exe 2556 3thnnn.exe 2644 1nbnnn.exe 2552 vvjdj.exe 2996 dvjjp.exe 2472 frflrxf.exe 2196 xlflxrr.exe 2496 nhtbbn.exe 2784 dvjjd.exe 2804 9ppjj.exe 2860 rfrxlfl.exe 2432 lfrrrrx.exe 1652 5nhnbb.exe 1288 tnnbbn.exe 1800 ddvvd.exe 1872 vjdjp.exe 1824 llffffr.exe 532 lfrxxxf.exe 264 hbhhnn.exe -
resource yara_rule behavioral1/memory/1716-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b00000001226d-8.dat upx behavioral1/memory/1716-6-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1696-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0037000000015cb7-18.dat upx behavioral1/files/0x0008000000015cf3-25.dat upx behavioral1/memory/2300-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1696-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2716-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d09-34.dat upx behavioral1/files/0x0007000000015d13-42.dat upx behavioral1/memory/2728-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d20-53.dat upx behavioral1/files/0x0008000000015d42-60.dat upx behavioral1/memory/2864-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d72-67.dat upx behavioral1/memory/2504-75-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x0006000000016c67-77.dat upx behavioral1/memory/2504-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016caf-84.dat upx behavioral1/memory/2196-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3000-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cde-95.dat upx behavioral1/memory/3000-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d05-102.dat upx behavioral1/memory/2808-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d1a-110.dat upx behavioral1/files/0x0006000000016d22-117.dat upx behavioral1/files/0x0006000000016d2b-124.dat upx behavioral1/memory/2428-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d33-134.dat upx behavioral1/memory/2428-132-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000016d3b-142.dat upx behavioral1/memory/1956-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d44-149.dat upx behavioral1/memory/1028-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d4c-158.dat upx behavioral1/memory/1028-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d55-166.dat upx behavioral1/files/0x0006000000016d68-172.dat upx behavioral1/files/0x0006000000016d6c-179.dat upx behavioral1/memory/1228-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d70-187.dat upx behavioral1/files/0x0006000000016d78-195.dat upx behavioral1/memory/2604-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016da0-202.dat upx behavioral1/files/0x0006000000016db2-212.dat upx behavioral1/memory/2492-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2492-206-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/memory/1140-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dc8-219.dat upx behavioral1/files/0x0006000000016dd1-226.dat upx behavioral1/files/0x0037000000015cbf-235.dat upx behavioral1/memory/1240-234-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1240-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000171ba-243.dat upx behavioral1/memory/1336-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2592-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001720f-251.dat upx behavioral1/files/0x00060000000173b4-259.dat upx behavioral1/memory/1720-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/336-271-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1716 wrote to memory of 1696 1716 e3237ec00c4ed0f69bdb032345362260_NeikiAnalytics.exe 28 PID 1716 wrote to memory of 1696 1716 e3237ec00c4ed0f69bdb032345362260_NeikiAnalytics.exe 28 PID 1716 wrote to memory of 1696 1716 e3237ec00c4ed0f69bdb032345362260_NeikiAnalytics.exe 28 PID 1716 wrote to memory of 1696 1716 e3237ec00c4ed0f69bdb032345362260_NeikiAnalytics.exe 28 PID 1696 wrote to memory of 2300 1696 xrlrflr.exe 29 PID 1696 wrote to memory of 2300 1696 xrlrflr.exe 29 PID 1696 wrote to memory of 2300 1696 xrlrflr.exe 29 PID 1696 wrote to memory of 2300 1696 xrlrflr.exe 29 PID 2300 wrote to memory of 2716 2300 bbbnhn.exe 30 PID 2300 wrote to memory of 2716 2300 bbbnhn.exe 30 PID 2300 wrote to memory of 2716 2300 bbbnhn.exe 30 PID 2300 wrote to memory of 2716 2300 bbbnhn.exe 30 PID 2716 wrote to memory of 2708 2716 1jpdj.exe 31 PID 2716 wrote to memory of 2708 2716 1jpdj.exe 31 PID 2716 wrote to memory of 2708 2716 1jpdj.exe 31 PID 2716 wrote to memory of 2708 2716 1jpdj.exe 31 PID 2708 wrote to memory of 2728 2708 rrlxlxx.exe 32 PID 2708 wrote to memory of 2728 2708 rrlxlxx.exe 32 PID 2708 wrote to memory of 2728 2708 rrlxlxx.exe 32 PID 2708 wrote to memory of 2728 2708 rrlxlxx.exe 32 PID 2728 wrote to memory of 2864 2728 tbhbbn.exe 33 PID 2728 wrote to memory of 2864 2728 tbhbbn.exe 33 PID 2728 wrote to memory of 2864 2728 tbhbbn.exe 33 PID 2728 wrote to memory of 2864 2728 tbhbbn.exe 33 PID 2864 wrote to memory of 2680 2864 fxlrxfr.exe 34 PID 2864 wrote to memory of 2680 2864 fxlrxfr.exe 34 PID 2864 wrote to memory of 2680 2864 fxlrxfr.exe 34 PID 2864 wrote to memory of 2680 2864 fxlrxfr.exe 34 PID 2680 wrote to memory of 2504 2680 rrrfxll.exe 35 PID 2680 wrote to memory of 2504 2680 rrrfxll.exe 35 PID 2680 wrote to memory of 2504 2680 rrrfxll.exe 35 PID 2680 wrote to memory of 2504 2680 rrrfxll.exe 35 PID 2504 wrote to memory of 2196 2504 nnnnnt.exe 36 PID 2504 wrote to memory of 2196 2504 nnnnnt.exe 36 PID 2504 wrote to memory of 2196 2504 nnnnnt.exe 36 PID 2504 wrote to memory of 2196 2504 nnnnnt.exe 36 PID 2196 wrote to memory of 3000 2196 jvddd.exe 37 PID 2196 wrote to memory of 3000 2196 jvddd.exe 37 PID 2196 wrote to memory of 3000 2196 jvddd.exe 37 PID 2196 wrote to memory of 3000 2196 jvddd.exe 37 PID 3000 wrote to memory of 1264 3000 llflfll.exe 38 PID 3000 wrote to memory of 1264 3000 llflfll.exe 38 PID 3000 wrote to memory of 1264 3000 llflfll.exe 38 PID 3000 wrote to memory of 1264 3000 llflfll.exe 38 PID 1264 wrote to memory of 2808 1264 3hhthn.exe 39 PID 1264 wrote to memory of 2808 1264 3hhthn.exe 39 PID 1264 wrote to memory of 2808 1264 3hhthn.exe 39 PID 1264 wrote to memory of 2808 1264 3hhthn.exe 39 PID 2808 wrote to memory of 2840 2808 vpdpj.exe 40 PID 2808 wrote to memory of 2840 2808 vpdpj.exe 40 PID 2808 wrote to memory of 2840 2808 vpdpj.exe 40 PID 2808 wrote to memory of 2840 2808 vpdpj.exe 40 PID 2840 wrote to memory of 2868 2840 1jdjj.exe 41 PID 2840 wrote to memory of 2868 2840 1jdjj.exe 41 PID 2840 wrote to memory of 2868 2840 1jdjj.exe 41 PID 2840 wrote to memory of 2868 2840 1jdjj.exe 41 PID 2868 wrote to memory of 2428 2868 rrrfxlf.exe 42 PID 2868 wrote to memory of 2428 2868 rrrfxlf.exe 42 PID 2868 wrote to memory of 2428 2868 rrrfxlf.exe 42 PID 2868 wrote to memory of 2428 2868 rrrfxlf.exe 42 PID 2428 wrote to memory of 1956 2428 frxfrrr.exe 43 PID 2428 wrote to memory of 1956 2428 frxfrrr.exe 43 PID 2428 wrote to memory of 1956 2428 frxfrrr.exe 43 PID 2428 wrote to memory of 1956 2428 frxfrrr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3237ec00c4ed0f69bdb032345362260_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e3237ec00c4ed0f69bdb032345362260_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\xrlrflr.exec:\xrlrflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\bbbnhn.exec:\bbbnhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\1jpdj.exec:\1jpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\rrlxlxx.exec:\rrlxlxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\tbhbbn.exec:\tbhbbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\fxlrxfr.exec:\fxlrxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\rrrfxll.exec:\rrrfxll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\nnnnnt.exec:\nnnnnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\jvddd.exec:\jvddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\llflfll.exec:\llflfll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\3hhthn.exec:\3hhthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\vpdpj.exec:\vpdpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\1jdjj.exec:\1jdjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rrrfxlf.exec:\rrrfxlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\frxfrrr.exec:\frxfrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\hbttbh.exec:\hbttbh.exe17⤵
- Executes dropped EXE
PID:1956 -
\??\c:\ddjvp.exec:\ddjvp.exe18⤵
- Executes dropped EXE
PID:2400 -
\??\c:\xrxfrff.exec:\xrxfrff.exe19⤵
- Executes dropped EXE
PID:1028 -
\??\c:\nthnht.exec:\nthnht.exe20⤵
- Executes dropped EXE
PID:480 -
\??\c:\1bnhtn.exec:\1bnhtn.exe21⤵
- Executes dropped EXE
PID:996 -
\??\c:\5ddpv.exec:\5ddpv.exe22⤵
- Executes dropped EXE
PID:2408 -
\??\c:\xxrxllf.exec:\xxrxllf.exe23⤵
- Executes dropped EXE
PID:1228 -
\??\c:\lfllfff.exec:\lfllfff.exe24⤵
- Executes dropped EXE
PID:2604 -
\??\c:\bbhhnn.exec:\bbhhnn.exe25⤵
- Executes dropped EXE
PID:2984 -
\??\c:\bntbhh.exec:\bntbhh.exe26⤵
- Executes dropped EXE
PID:2492 -
\??\c:\5jjdj.exec:\5jjdj.exe27⤵
- Executes dropped EXE
PID:1140 -
\??\c:\djpdp.exec:\djpdp.exe28⤵
- Executes dropped EXE
PID:1928 -
\??\c:\1tnbhn.exec:\1tnbhn.exe29⤵
- Executes dropped EXE
PID:1240 -
\??\c:\1jddj.exec:\1jddj.exe30⤵
- Executes dropped EXE
PID:1336 -
\??\c:\lfrflxf.exec:\lfrflxf.exe31⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xlxffxl.exec:\xlxffxl.exe32⤵
- Executes dropped EXE
PID:568 -
\??\c:\nnbtbh.exec:\nnbtbh.exe33⤵
- Executes dropped EXE
PID:1720 -
\??\c:\tnntth.exec:\tnntth.exe34⤵
- Executes dropped EXE
PID:336 -
\??\c:\pjpdj.exec:\pjpdj.exe35⤵
- Executes dropped EXE
PID:2956 -
\??\c:\lffxlxr.exec:\lffxlxr.exe36⤵
- Executes dropped EXE
PID:2480 -
\??\c:\frflllr.exec:\frflllr.exe37⤵
- Executes dropped EXE
PID:1628 -
\??\c:\nnnntt.exec:\nnnntt.exe38⤵
- Executes dropped EXE
PID:1684 -
\??\c:\nnbhhn.exec:\nnbhhn.exe39⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jdvjv.exec:\jdvjv.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\5jjjj.exec:\5jjjj.exe41⤵
- Executes dropped EXE
PID:1592 -
\??\c:\xflffxr.exec:\xflffxr.exe42⤵
- Executes dropped EXE
PID:2656 -
\??\c:\frffllr.exec:\frffllr.exe43⤵
- Executes dropped EXE
PID:2652 -
\??\c:\htbhhh.exec:\htbhhh.exe44⤵
- Executes dropped EXE
PID:2632 -
\??\c:\pdjpj.exec:\pdjpj.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\5flxxrx.exec:\5flxxrx.exe46⤵
- Executes dropped EXE
PID:2668 -
\??\c:\7xrrfxl.exec:\7xrrfxl.exe47⤵
- Executes dropped EXE
PID:2732 -
\??\c:\3thnnn.exec:\3thnnn.exe48⤵
- Executes dropped EXE
PID:2556 -
\??\c:\1nbnnn.exec:\1nbnnn.exe49⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vvjdj.exec:\vvjdj.exe50⤵
- Executes dropped EXE
PID:2552 -
\??\c:\dvjjp.exec:\dvjjp.exe51⤵
- Executes dropped EXE
PID:2996 -
\??\c:\frflrxf.exec:\frflrxf.exe52⤵
- Executes dropped EXE
PID:2472 -
\??\c:\xlflxrr.exec:\xlflxrr.exe53⤵
- Executes dropped EXE
PID:2196 -
\??\c:\nhtbbn.exec:\nhtbbn.exe54⤵
- Executes dropped EXE
PID:2496 -
\??\c:\dvjjd.exec:\dvjjd.exe55⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9ppjj.exec:\9ppjj.exe56⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rfrxlfl.exec:\rfrxlfl.exe57⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe58⤵
- Executes dropped EXE
PID:2432 -
\??\c:\5nhnbb.exec:\5nhnbb.exe59⤵
- Executes dropped EXE
PID:1652 -
\??\c:\tnnbbn.exec:\tnnbbn.exe60⤵
- Executes dropped EXE
PID:1288 -
\??\c:\ddvvd.exec:\ddvvd.exe61⤵
- Executes dropped EXE
PID:1800 -
\??\c:\vjdjp.exec:\vjdjp.exe62⤵
- Executes dropped EXE
PID:1872 -
\??\c:\llffffr.exec:\llffffr.exe63⤵
- Executes dropped EXE
PID:1824 -
\??\c:\lfrxxxf.exec:\lfrxxxf.exe64⤵
- Executes dropped EXE
PID:532 -
\??\c:\hbhhnn.exec:\hbhhnn.exe65⤵
- Executes dropped EXE
PID:264 -
\??\c:\9hnnht.exec:\9hnnht.exe66⤵PID:1084
-
\??\c:\ppdpp.exec:\ppdpp.exe67⤵PID:1636
-
\??\c:\rrfllff.exec:\rrfllff.exe68⤵PID:2884
-
\??\c:\lxllllr.exec:\lxllllr.exe69⤵PID:308
-
\??\c:\nnhnbb.exec:\nnhnbb.exe70⤵PID:1224
-
\??\c:\bbbhnt.exec:\bbbhnt.exe71⤵PID:3008
-
\??\c:\pjpvv.exec:\pjpvv.exe72⤵PID:580
-
\??\c:\1djdj.exec:\1djdj.exe73⤵PID:1792
-
\??\c:\3rlrlrx.exec:\3rlrlrx.exe74⤵PID:2812
-
\??\c:\ffxlflf.exec:\ffxlflf.exe75⤵PID:1352
-
\??\c:\hthhnn.exec:\hthhnn.exe76⤵PID:2464
-
\??\c:\pjdvv.exec:\pjdvv.exe77⤵PID:1752
-
\??\c:\7dpvj.exec:\7dpvj.exe78⤵PID:1932
-
\??\c:\fxrxflr.exec:\fxrxflr.exe79⤵PID:1240
-
\??\c:\5xxlxxf.exec:\5xxlxxf.exe80⤵PID:3016
-
\??\c:\hbbhtt.exec:\hbbhtt.exe81⤵PID:912
-
\??\c:\nhbttb.exec:\nhbttb.exe82⤵PID:2164
-
\??\c:\dppjj.exec:\dppjj.exe83⤵PID:2912
-
\??\c:\xrllxfr.exec:\xrllxfr.exe84⤵PID:2952
-
\??\c:\9lfrxxf.exec:\9lfrxxf.exe85⤵PID:1096
-
\??\c:\nhtttb.exec:\nhtttb.exe86⤵PID:2968
-
\??\c:\7httht.exec:\7httht.exe87⤵PID:896
-
\??\c:\5vvdd.exec:\5vvdd.exe88⤵PID:1724
-
\??\c:\ffxrfrr.exec:\ffxrfrr.exe89⤵PID:1672
-
\??\c:\xrflrrf.exec:\xrflrrf.exe90⤵PID:1716
-
\??\c:\hbthtb.exec:\hbthtb.exe91⤵PID:2980
-
\??\c:\tnthht.exec:\tnthht.exe92⤵PID:1588
-
\??\c:\9vdjp.exec:\9vdjp.exe93⤵PID:2720
-
\??\c:\jdpjp.exec:\jdpjp.exe94⤵PID:2664
-
\??\c:\5xxfrrr.exec:\5xxfrrr.exe95⤵PID:2704
-
\??\c:\fxllxfl.exec:\fxllxfl.exe96⤵PID:2708
-
\??\c:\hhhtbb.exec:\hhhtbb.exe97⤵PID:2696
-
\??\c:\nnbbnh.exec:\nnbbnh.exe98⤵PID:2668
-
\??\c:\pjjpv.exec:\pjjpv.exe99⤵PID:2104
-
\??\c:\ddvdv.exec:\ddvdv.exe100⤵PID:2556
-
\??\c:\rlxlrxf.exec:\rlxlrxf.exe101⤵PID:2520
-
\??\c:\rlxllrx.exec:\rlxllrx.exe102⤵PID:2540
-
\??\c:\tnhthn.exec:\tnhthn.exe103⤵PID:2560
-
\??\c:\hbnthn.exec:\hbnthn.exe104⤵PID:3004
-
\??\c:\pjvvd.exec:\pjvvd.exe105⤵PID:1864
-
\??\c:\1vvdp.exec:\1vvdp.exe106⤵PID:2792
-
\??\c:\fllrxlf.exec:\fllrxlf.exe107⤵PID:2596
-
\??\c:\fxlrfxx.exec:\fxlrfxx.exe108⤵PID:2828
-
\??\c:\tnttnn.exec:\tnttnn.exe109⤵PID:2848
-
\??\c:\nbtthn.exec:\nbtthn.exe110⤵PID:2020
-
\??\c:\vpdpv.exec:\vpdpv.exe111⤵PID:2168
-
\??\c:\pjvpd.exec:\pjvpd.exe112⤵PID:2440
-
\??\c:\frllrrx.exec:\frllrrx.exe113⤵PID:1956
-
\??\c:\3rlllrr.exec:\3rlllrr.exe114⤵PID:1080
-
\??\c:\1nnthn.exec:\1nnthn.exe115⤵PID:2400
-
\??\c:\nnbhhh.exec:\nnbhhh.exe116⤵PID:604
-
\??\c:\5ddjv.exec:\5ddjv.exe117⤵PID:524
-
\??\c:\5jvvd.exec:\5jvvd.exe118⤵PID:1296
-
\??\c:\fxrxllr.exec:\fxrxllr.exe119⤵PID:1816
-
\??\c:\9xlxxfl.exec:\9xlxxfl.exe120⤵PID:1756
-
\??\c:\rfffrrf.exec:\rfffrrf.exe121⤵PID:2360
-
\??\c:\btthtt.exec:\btthtt.exe122⤵PID:1444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-