Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 05:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f8e755246fba718660341b0f41d35930_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
f8e755246fba718660341b0f41d35930_NeikiAnalytics.exe
-
Size
286KB
-
MD5
f8e755246fba718660341b0f41d35930
-
SHA1
c098780c7e444652fd5edc18196bc49c800baa44
-
SHA256
dad1ce0389ee0c38bf289c48b9a839869da3b124fb547d126ae2bc2bf5bcdb89
-
SHA512
20f2ac704e3293f9b086244e4d61eb9804ac43c1d7c5c4a61a4e50dfaa4bf94a765d592fd2adaf39842a1c1afc3fe86f429a9f2420a5f4ce13bd17fc939e0285
-
SSDEEP
3072:ThOm2sI93UufdC67cipfmCiiiXAQ5lpBoGYwNNhu0CzhKPx:Tcm7ImGddXlWrXF5lpKGYV0wh6x
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2756-13-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2388-10-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/3028-28-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2640-30-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2580-47-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2712-56-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2880-67-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2880-66-0x0000000000220000-0x000000000024B000-memory.dmp family_blackmoon behavioral1/memory/2188-75-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1232-92-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/768-103-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1540-111-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2740-122-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2040-131-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1936-156-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1488-173-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/856-175-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/324-190-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/580-199-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/836-208-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/748-235-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2876-275-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/3016-292-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2764-343-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2004-356-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/484-482-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2400-497-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/748-522-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1044-548-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2812-585-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2656-612-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2060-754-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1372-809-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2816-859-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2456-919-0x0000000000220000-0x000000000024B000-memory.dmp family_blackmoon behavioral1/memory/2008-1142-0x0000000000220000-0x000000000024B000-memory.dmp family_blackmoon behavioral1/memory/1560-1157-0x00000000001B0000-0x00000000001DB000-memory.dmp family_blackmoon behavioral1/memory/1416-1245-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2756 thhtnt.exe 3028 jvvjd.exe 2640 pdpjd.exe 2580 djdpv.exe 2712 tnhnbb.exe 2880 3pjpd.exe 2188 rlxflrx.exe 2496 btttbn.exe 1232 3jvvj.exe 768 llfrrxl.exe 1540 nhbbhh.exe 2740 jdpvj.exe 2040 rlxlfxl.exe 2356 hnbbtn.exe 1000 ppdjp.exe 1936 rrlffxr.exe 1564 bbnnbh.exe 1488 1pdjd.exe 856 xrflrxf.exe 324 9tbhht.exe 580 xrlrxlx.exe 836 1ppdp.exe 1240 ffxrrrl.exe 1804 hbnnhh.exe 748 ppdjp.exe 272 xlfrlrx.exe 1028 thnhnb.exe 1784 dvppv.exe 2800 ffxlfll.exe 2876 hbnbth.exe 2820 vppvj.exe 3016 rrrrrlf.exe 2812 tnhnbb.exe 1928 pdvjv.exe 1560 5xlrxxl.exe 2920 7btthn.exe 1112 hhbhtb.exe 3028 vvppj.exe 2948 xlfllrx.exe 2764 xlxxlxl.exe 2664 ttthth.exe 2004 jvjjp.exe 2548 xxrxlrx.exe 2928 thnhtn.exe 2512 hbbhhn.exe 2496 pvpdv.exe 1232 5lxxlxx.exe 1416 9lfxfrl.exe 2720 bthnnb.exe 2824 3jpjv.exe 2472 frfrrfx.exe 2352 nbhnhb.exe 1296 bbhhth.exe 2356 jvddj.exe 1000 lxlffff.exe 2168 rrxllrl.exe 804 nhbnbh.exe 3056 djdpv.exe 1428 rrrlrrl.exe 2108 tnhbtt.exe 1080 nntbhb.exe 484 jjjpd.exe 580 xxrfxlx.exe 2400 bttthn.exe -
resource yara_rule behavioral1/memory/2756-13-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2388-10-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/3028-28-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2640-30-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2580-38-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2580-47-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2712-48-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2712-56-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2880-67-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2188-75-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1232-92-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/768-103-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1540-111-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2740-113-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2740-122-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2040-131-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1936-156-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1488-173-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/856-175-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/324-190-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/580-199-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/836-208-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1240-210-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/748-235-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2876-275-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/3016-292-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2948-330-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2764-343-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2004-356-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2720-394-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1296-420-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/484-482-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/580-483-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2400-490-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2400-497-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/748-522-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1044-548-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2812-578-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2812-585-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2280-586-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2656-605-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2656-612-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2456-625-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1632-675-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1000-719-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/3056-739-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2060-754-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/588-761-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1372-809-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2816-859-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2584-878-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1112-886-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1960-979-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1944-986-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/944-1079-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/944-1086-0x0000000000220000-0x000000000024B000-memory.dmp upx behavioral1/memory/940-1087-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1628-1208-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1416-1245-0x0000000000400000-0x000000000042B000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2756 2388 f8e755246fba718660341b0f41d35930_NeikiAnalytics.exe 28 PID 2388 wrote to memory of 2756 2388 f8e755246fba718660341b0f41d35930_NeikiAnalytics.exe 28 PID 2388 wrote to memory of 2756 2388 f8e755246fba718660341b0f41d35930_NeikiAnalytics.exe 28 PID 2388 wrote to memory of 2756 2388 f8e755246fba718660341b0f41d35930_NeikiAnalytics.exe 28 PID 2756 wrote to memory of 3028 2756 thhtnt.exe 29 PID 2756 wrote to memory of 3028 2756 thhtnt.exe 29 PID 2756 wrote to memory of 3028 2756 thhtnt.exe 29 PID 2756 wrote to memory of 3028 2756 thhtnt.exe 29 PID 3028 wrote to memory of 2640 3028 jvvjd.exe 30 PID 3028 wrote to memory of 2640 3028 jvvjd.exe 30 PID 3028 wrote to memory of 2640 3028 jvvjd.exe 30 PID 3028 wrote to memory of 2640 3028 jvvjd.exe 30 PID 2640 wrote to memory of 2580 2640 pdpjd.exe 31 PID 2640 wrote to memory of 2580 2640 pdpjd.exe 31 PID 2640 wrote to memory of 2580 2640 pdpjd.exe 31 PID 2640 wrote to memory of 2580 2640 pdpjd.exe 31 PID 2580 wrote to memory of 2712 2580 djdpv.exe 32 PID 2580 wrote to memory of 2712 2580 djdpv.exe 32 PID 2580 wrote to memory of 2712 2580 djdpv.exe 32 PID 2580 wrote to memory of 2712 2580 djdpv.exe 32 PID 2712 wrote to memory of 2880 2712 tnhnbb.exe 33 PID 2712 wrote to memory of 2880 2712 tnhnbb.exe 33 PID 2712 wrote to memory of 2880 2712 tnhnbb.exe 33 PID 2712 wrote to memory of 2880 2712 tnhnbb.exe 33 PID 2880 wrote to memory of 2188 2880 3pjpd.exe 34 PID 2880 wrote to memory of 2188 2880 3pjpd.exe 34 PID 2880 wrote to memory of 2188 2880 3pjpd.exe 34 PID 2880 wrote to memory of 2188 2880 3pjpd.exe 34 PID 2188 wrote to memory of 2496 2188 rlxflrx.exe 35 PID 2188 wrote to memory of 2496 2188 rlxflrx.exe 35 PID 2188 wrote to memory of 2496 2188 rlxflrx.exe 35 PID 2188 wrote to memory of 2496 2188 rlxflrx.exe 35 PID 2496 wrote to memory of 1232 2496 btttbn.exe 36 PID 2496 wrote to memory of 1232 2496 btttbn.exe 36 PID 2496 wrote to memory of 1232 2496 btttbn.exe 36 PID 2496 wrote to memory of 1232 2496 btttbn.exe 36 PID 1232 wrote to memory of 768 1232 3jvvj.exe 37 PID 1232 wrote to memory of 768 1232 3jvvj.exe 37 PID 1232 wrote to memory of 768 1232 3jvvj.exe 37 PID 1232 wrote to memory of 768 1232 3jvvj.exe 37 PID 768 wrote to memory of 1540 768 llfrrxl.exe 38 PID 768 wrote to memory of 1540 768 llfrrxl.exe 38 PID 768 wrote to memory of 1540 768 llfrrxl.exe 38 PID 768 wrote to memory of 1540 768 llfrrxl.exe 38 PID 1540 wrote to memory of 2740 1540 nhbbhh.exe 39 PID 1540 wrote to memory of 2740 1540 nhbbhh.exe 39 PID 1540 wrote to memory of 2740 1540 nhbbhh.exe 39 PID 1540 wrote to memory of 2740 1540 nhbbhh.exe 39 PID 2740 wrote to memory of 2040 2740 jdpvj.exe 40 PID 2740 wrote to memory of 2040 2740 jdpvj.exe 40 PID 2740 wrote to memory of 2040 2740 jdpvj.exe 40 PID 2740 wrote to memory of 2040 2740 jdpvj.exe 40 PID 2040 wrote to memory of 2356 2040 rlxlfxl.exe 41 PID 2040 wrote to memory of 2356 2040 rlxlfxl.exe 41 PID 2040 wrote to memory of 2356 2040 rlxlfxl.exe 41 PID 2040 wrote to memory of 2356 2040 rlxlfxl.exe 41 PID 2356 wrote to memory of 1000 2356 hnbbtn.exe 42 PID 2356 wrote to memory of 1000 2356 hnbbtn.exe 42 PID 2356 wrote to memory of 1000 2356 hnbbtn.exe 42 PID 2356 wrote to memory of 1000 2356 hnbbtn.exe 42 PID 1000 wrote to memory of 1936 1000 ppdjp.exe 43 PID 1000 wrote to memory of 1936 1000 ppdjp.exe 43 PID 1000 wrote to memory of 1936 1000 ppdjp.exe 43 PID 1000 wrote to memory of 1936 1000 ppdjp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8e755246fba718660341b0f41d35930_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f8e755246fba718660341b0f41d35930_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\thhtnt.exec:\thhtnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\jvvjd.exec:\jvvjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\pdpjd.exec:\pdpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\djdpv.exec:\djdpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\tnhnbb.exec:\tnhnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\3pjpd.exec:\3pjpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\rlxflrx.exec:\rlxflrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\btttbn.exec:\btttbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\3jvvj.exec:\3jvvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\llfrrxl.exec:\llfrrxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\nhbbhh.exec:\nhbbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\jdpvj.exec:\jdpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\rlxlfxl.exec:\rlxlfxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\hnbbtn.exec:\hnbbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\ppdjp.exec:\ppdjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\rrlffxr.exec:\rrlffxr.exe17⤵
- Executes dropped EXE
PID:1936 -
\??\c:\bbnnbh.exec:\bbnnbh.exe18⤵
- Executes dropped EXE
PID:1564 -
\??\c:\1pdjd.exec:\1pdjd.exe19⤵
- Executes dropped EXE
PID:1488 -
\??\c:\xrflrxf.exec:\xrflrxf.exe20⤵
- Executes dropped EXE
PID:856 -
\??\c:\9tbhht.exec:\9tbhht.exe21⤵
- Executes dropped EXE
PID:324 -
\??\c:\xrlrxlx.exec:\xrlrxlx.exe22⤵
- Executes dropped EXE
PID:580 -
\??\c:\1ppdp.exec:\1ppdp.exe23⤵
- Executes dropped EXE
PID:836 -
\??\c:\ffxrrrl.exec:\ffxrrrl.exe24⤵
- Executes dropped EXE
PID:1240 -
\??\c:\hbnnhh.exec:\hbnnhh.exe25⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ppdjp.exec:\ppdjp.exe26⤵
- Executes dropped EXE
PID:748 -
\??\c:\xlfrlrx.exec:\xlfrlrx.exe27⤵
- Executes dropped EXE
PID:272 -
\??\c:\thnhnb.exec:\thnhnb.exe28⤵
- Executes dropped EXE
PID:1028 -
\??\c:\dvppv.exec:\dvppv.exe29⤵
- Executes dropped EXE
PID:1784 -
\??\c:\ffxlfll.exec:\ffxlfll.exe30⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hbnbth.exec:\hbnbth.exe31⤵
- Executes dropped EXE
PID:2876 -
\??\c:\vppvj.exec:\vppvj.exe32⤵
- Executes dropped EXE
PID:2820 -
\??\c:\rrrrrlf.exec:\rrrrrlf.exe33⤵
- Executes dropped EXE
PID:3016 -
\??\c:\tnhnbb.exec:\tnhnbb.exe34⤵
- Executes dropped EXE
PID:2812 -
\??\c:\pdvjv.exec:\pdvjv.exe35⤵
- Executes dropped EXE
PID:1928 -
\??\c:\5xlrxxl.exec:\5xlrxxl.exe36⤵
- Executes dropped EXE
PID:1560 -
\??\c:\7btthn.exec:\7btthn.exe37⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hhbhtb.exec:\hhbhtb.exe38⤵
- Executes dropped EXE
PID:1112 -
\??\c:\vvppj.exec:\vvppj.exe39⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xlfllrx.exec:\xlfllrx.exe40⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xlxxlxl.exec:\xlxxlxl.exe41⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ttthth.exec:\ttthth.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jvjjp.exec:\jvjjp.exe43⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xxrxlrx.exec:\xxrxlrx.exe44⤵
- Executes dropped EXE
PID:2548 -
\??\c:\thnhtn.exec:\thnhtn.exe45⤵
- Executes dropped EXE
PID:2928 -
\??\c:\hbbhhn.exec:\hbbhhn.exe46⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pvpdv.exec:\pvpdv.exe47⤵
- Executes dropped EXE
PID:2496 -
\??\c:\5lxxlxx.exec:\5lxxlxx.exe48⤵
- Executes dropped EXE
PID:1232 -
\??\c:\9lfxfrl.exec:\9lfxfrl.exe49⤵
- Executes dropped EXE
PID:1416 -
\??\c:\bthnnb.exec:\bthnnb.exe50⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3jpjv.exec:\3jpjv.exe51⤵
- Executes dropped EXE
PID:2824 -
\??\c:\frfrrfx.exec:\frfrrfx.exe52⤵
- Executes dropped EXE
PID:2472 -
\??\c:\nbhnhb.exec:\nbhnhb.exe53⤵
- Executes dropped EXE
PID:2352 -
\??\c:\bbhhth.exec:\bbhhth.exe54⤵
- Executes dropped EXE
PID:1296 -
\??\c:\jvddj.exec:\jvddj.exe55⤵
- Executes dropped EXE
PID:2356 -
\??\c:\lxlffff.exec:\lxlffff.exe56⤵
- Executes dropped EXE
PID:1000 -
\??\c:\rrxllrl.exec:\rrxllrl.exe57⤵
- Executes dropped EXE
PID:2168 -
\??\c:\nhbnbh.exec:\nhbnbh.exe58⤵
- Executes dropped EXE
PID:804 -
\??\c:\djdpv.exec:\djdpv.exe59⤵
- Executes dropped EXE
PID:3056 -
\??\c:\rrrlrrl.exec:\rrrlrrl.exe60⤵
- Executes dropped EXE
PID:1428 -
\??\c:\tnhbtt.exec:\tnhbtt.exe61⤵
- Executes dropped EXE
PID:2108 -
\??\c:\nntbhb.exec:\nntbhb.exe62⤵
- Executes dropped EXE
PID:1080 -
\??\c:\jjjpd.exec:\jjjpd.exe63⤵
- Executes dropped EXE
PID:484 -
\??\c:\xxrfxlx.exec:\xxrfxlx.exe64⤵
- Executes dropped EXE
PID:580 -
\??\c:\bttthn.exec:\bttthn.exe65⤵
- Executes dropped EXE
PID:2400 -
\??\c:\ppdjv.exec:\ppdjv.exe66⤵PID:908
-
\??\c:\pdvdd.exec:\pdvdd.exe67⤵PID:2304
-
\??\c:\1nntbh.exec:\1nntbh.exe68⤵PID:1804
-
\??\c:\nnnhtb.exec:\nnnhtb.exe69⤵PID:748
-
\??\c:\pjdjv.exec:\pjdjv.exe70⤵PID:2968
-
\??\c:\3rllrxf.exec:\3rllrxf.exe71⤵PID:1012
-
\??\c:\htnhnt.exec:\htnhnt.exe72⤵PID:880
-
\??\c:\tbtbbn.exec:\tbtbbn.exe73⤵PID:896
-
\??\c:\pjjpd.exec:\pjjpd.exe74⤵PID:1044
-
\??\c:\frfxffl.exec:\frfxffl.exe75⤵PID:3060
-
\??\c:\hthbbn.exec:\hthbbn.exe76⤵PID:2148
-
\??\c:\pjddj.exec:\pjddj.exe77⤵PID:2820
-
\??\c:\jjdjv.exec:\jjdjv.exe78⤵PID:2124
-
\??\c:\rlfrflr.exec:\rlfrflr.exe79⤵PID:2812
-
\??\c:\nhttbb.exec:\nhttbb.exe80⤵PID:2280
-
\??\c:\dvppd.exec:\dvppd.exe81⤵PID:2564
-
\??\c:\xrlrffl.exec:\xrlrffl.exe82⤵PID:2920
-
\??\c:\bthhnh.exec:\bthhnh.exe83⤵PID:2656
-
\??\c:\vpjpp.exec:\vpjpp.exe84⤵PID:2676
-
\??\c:\rlxlxxl.exec:\rlxlxxl.exe85⤵PID:2468
-
\??\c:\9lffxll.exec:\9lffxll.exe86⤵PID:2456
-
\??\c:\3tnhtb.exec:\3tnhtb.exe87⤵PID:2680
-
\??\c:\vvjpd.exec:\vvjpd.exe88⤵PID:2880
-
\??\c:\vjpjp.exec:\vjpjp.exe89⤵PID:2464
-
\??\c:\ffxxlrx.exec:\ffxxlrx.exe90⤵PID:2928
-
\??\c:\9htnth.exec:\9htnth.exe91⤵PID:2556
-
\??\c:\vpjjj.exec:\vpjjj.exe92⤵PID:2496
-
\??\c:\3pdvd.exec:\3pdvd.exe93⤵PID:1660
-
\??\c:\lxfxlff.exec:\lxfxlff.exe94⤵PID:1632
-
\??\c:\lfflflr.exec:\lfflflr.exe95⤵PID:2716
-
\??\c:\hbnthh.exec:\hbnthh.exe96⤵PID:2824
-
\??\c:\jvvvj.exec:\jvvvj.exe97⤵PID:2344
-
\??\c:\jjvdj.exec:\jjvdj.exe98⤵PID:1956
-
\??\c:\rlxrflr.exec:\rlxrflr.exe99⤵PID:1296
-
\??\c:\7rlrfxl.exec:\7rlrfxl.exe100⤵PID:1840
-
\??\c:\nnntnb.exec:\nnntnb.exe101⤵PID:1000
-
\??\c:\vvpvj.exec:\vvpvj.exe102⤵PID:2168
-
\??\c:\xlrrlrf.exec:\xlrrlrf.exe103⤵PID:2192
-
\??\c:\xxxlxxl.exec:\xxxlxxl.exe104⤵PID:3056
-
\??\c:\9hhhtt.exec:\9hhhtt.exe105⤵PID:2060
-
\??\c:\vvjvd.exec:\vvjvd.exe106⤵PID:1048
-
\??\c:\rlxrrlf.exec:\rlxrrlf.exe107⤵PID:588
-
\??\c:\3nbhnt.exec:\3nbhnt.exe108⤵PID:1124
-
\??\c:\bnbttn.exec:\bnbttn.exe109⤵PID:1848
-
\??\c:\1vjpv.exec:\1vjpv.exe110⤵PID:2136
-
\??\c:\xrlrxfl.exec:\xrlrxfl.exe111⤵PID:2912
-
\??\c:\xrxflxl.exec:\xrxflxl.exe112⤵PID:1912
-
\??\c:\ttnntt.exec:\ttnntt.exe113⤵PID:1372
-
\??\c:\vpjvv.exec:\vpjvv.exe114⤵PID:272
-
\??\c:\pjdjv.exec:\pjdjv.exe115⤵PID:2976
-
\??\c:\xxrrflr.exec:\xxrrflr.exe116⤵PID:2808
-
\??\c:\tthhtb.exec:\tthhtb.exe117⤵PID:1776
-
\??\c:\jvjvv.exec:\jvjvv.exe118⤵PID:2760
-
\??\c:\vpjpd.exec:\vpjpd.exe119⤵PID:1204
-
\??\c:\3fxxfff.exec:\3fxxfff.exe120⤵PID:2832
-
\??\c:\xlflrxf.exec:\xlflrxf.exe121⤵PID:2368
-
\??\c:\nbtthn.exec:\nbtthn.exe122⤵PID:2816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-