Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 16:53
Behavioral task
behavioral1
Sample
641466484d848b03b6b0e2be1110e430_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
641466484d848b03b6b0e2be1110e430_NeikiAnalytics.exe
-
Size
84KB
-
MD5
641466484d848b03b6b0e2be1110e430
-
SHA1
20c2dc4a2c66098cfcdb9ff018452504dc20f8d3
-
SHA256
de1e895241e9df273a62bb652c983833e2a25f5a4bf645e0c5eefa2f18a93160
-
SHA512
93aa4398364c4a8c45255f1e1be015e321c5cb019bc5ff4fb5c70ec22dadea8076bac9a98cac45798142fe7442e591e62e6711619fd625ae6e0bde08dd52d1a6
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6TQpCihfys:zhOmTsF93UYfwC6GIoutiTU2HVS64hf
Malware Config
Signatures
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2040-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2144-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-55-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2640-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-95-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2420-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/272-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-139-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1792-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1072-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/332-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1332-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1076-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1296-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-263-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/2112-272-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1756-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-313-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1580-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/684-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/672-640-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-674-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/860-700-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/796-788-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/288-794-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-800-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-811-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1992-813-0x0000000077770000-0x000000007788F000-memory.dmp family_blackmoon behavioral1/memory/2520-869-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2056 vdjdv.exe 1208 fxrxllx.exe 2144 hhtthn.exe 2720 1pjdj.exe 2724 lfxfxfx.exe 2640 bhnhhb.exe 2840 jjdpd.exe 2688 xxlrlrf.exe 2536 1nnbnt.exe 3000 jdjjp.exe 2420 rxlfxxr.exe 1628 fxxxrrf.exe 2584 5hbbht.exe 1800 vdvdp.exe 272 xrrlxlx.exe 1692 bbttth.exe 1792 vjjjd.exe 1040 1xrlffr.exe 1072 5bbnnh.exe 332 tnhnbh.exe 844 vvppv.exe 1332 fxrlrxr.exe 2308 tbnhbn.exe 2268 vpjdv.exe 2484 vvvvv.exe 1096 xlrlfxf.exe 340 hhnhth.exe 1840 3tbttb.exe 1076 pvppd.exe 1296 fflxrfl.exe 620 lffxlrf.exe 2016 bthbbn.exe 1928 jjjdj.exe 2112 rrllrrf.exe 1756 rlflfrf.exe 2492 tnhbhh.exe 1988 9ppdp.exe 1312 jdppd.exe 2796 btnbnt.exe 2864 btnnnn.exe 2664 jvjjp.exe 1580 pjpjj.exe 2876 9rlrrrl.exe 2676 thttbb.exe 2556 thbthb.exe 2684 pjvjj.exe 2660 jdppj.exe 2576 xlrrxfl.exe 2568 bnbbhh.exe 1736 nbnnhh.exe 2352 jdvvd.exe 3000 lfrrxfl.exe 776 rlflrxx.exe 1920 btnbtt.exe 2804 tnnnnn.exe 1940 dvpjv.exe 2224 jdpjd.exe 2432 xrrfflr.exe 268 7xrxlrx.exe 1652 5hhtnn.exe 2236 hbbntb.exe 864 5vjvj.exe 536 xrxlrxf.exe 684 fxlrrxl.exe -
resource yara_rule behavioral1/memory/2040-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2040-3-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x000e00000001226f-7.dat upx behavioral1/memory/2040-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0035000000016d61-17.dat upx behavioral1/memory/2056-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016dde-23.dat upx behavioral1/memory/2144-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016eb9-32.dat upx behavioral1/memory/2144-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2720-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000017042-38.dat upx behavioral1/memory/2724-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000017477-48.dat upx behavioral1/memory/2640-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017495-57.dat upx behavioral1/files/0x0006000000019228-66.dat upx behavioral1/memory/2840-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001923b-73.dat upx behavioral1/memory/2688-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2536-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2536-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001925d-83.dat upx behavioral1/files/0x0005000000019260-90.dat upx behavioral1/memory/3000-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2420-95-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019275-100.dat upx behavioral1/memory/2420-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019277-107.dat upx behavioral1/files/0x0005000000019283-114.dat upx behavioral1/memory/2584-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001933a-122.dat upx behavioral1/memory/1800-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019381-130.dat upx behavioral1/memory/272-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001939f-138.dat upx behavioral1/memory/1692-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1792-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a5-149.dat upx behavioral1/files/0x00050000000193b1-156.dat upx behavioral1/files/0x0005000000019433-163.dat upx behavioral1/memory/1072-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/332-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001943e-171.dat upx behavioral1/files/0x0005000000019457-179.dat upx behavioral1/memory/1332-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019462-187.dat upx behavioral1/files/0x0005000000019491-194.dat upx behavioral1/files/0x00050000000194a8-201.dat upx behavioral1/files/0x00050000000194b8-209.dat upx behavioral1/files/0x0034000000016d65-215.dat upx behavioral1/memory/340-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194eb-224.dat upx behavioral1/memory/1076-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ef-232.dat upx behavioral1/files/0x0005000000019501-239.dat upx behavioral1/memory/1296-241-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019507-247.dat upx behavioral1/files/0x000500000001954b-254.dat upx behavioral1/memory/1756-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2492-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2796-295-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2664-312-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2056 2040 641466484d848b03b6b0e2be1110e430_NeikiAnalytics.exe 28 PID 2040 wrote to memory of 2056 2040 641466484d848b03b6b0e2be1110e430_NeikiAnalytics.exe 28 PID 2040 wrote to memory of 2056 2040 641466484d848b03b6b0e2be1110e430_NeikiAnalytics.exe 28 PID 2040 wrote to memory of 2056 2040 641466484d848b03b6b0e2be1110e430_NeikiAnalytics.exe 28 PID 2056 wrote to memory of 1208 2056 vdjdv.exe 29 PID 2056 wrote to memory of 1208 2056 vdjdv.exe 29 PID 2056 wrote to memory of 1208 2056 vdjdv.exe 29 PID 2056 wrote to memory of 1208 2056 vdjdv.exe 29 PID 1208 wrote to memory of 2144 1208 fxrxllx.exe 30 PID 1208 wrote to memory of 2144 1208 fxrxllx.exe 30 PID 1208 wrote to memory of 2144 1208 fxrxllx.exe 30 PID 1208 wrote to memory of 2144 1208 fxrxllx.exe 30 PID 2144 wrote to memory of 2720 2144 hhtthn.exe 31 PID 2144 wrote to memory of 2720 2144 hhtthn.exe 31 PID 2144 wrote to memory of 2720 2144 hhtthn.exe 31 PID 2144 wrote to memory of 2720 2144 hhtthn.exe 31 PID 2720 wrote to memory of 2724 2720 1pjdj.exe 32 PID 2720 wrote to memory of 2724 2720 1pjdj.exe 32 PID 2720 wrote to memory of 2724 2720 1pjdj.exe 32 PID 2720 wrote to memory of 2724 2720 1pjdj.exe 32 PID 2724 wrote to memory of 2640 2724 lfxfxfx.exe 33 PID 2724 wrote to memory of 2640 2724 lfxfxfx.exe 33 PID 2724 wrote to memory of 2640 2724 lfxfxfx.exe 33 PID 2724 wrote to memory of 2640 2724 lfxfxfx.exe 33 PID 2640 wrote to memory of 2840 2640 bhnhhb.exe 34 PID 2640 wrote to memory of 2840 2640 bhnhhb.exe 34 PID 2640 wrote to memory of 2840 2640 bhnhhb.exe 34 PID 2640 wrote to memory of 2840 2640 bhnhhb.exe 34 PID 2840 wrote to memory of 2688 2840 jjdpd.exe 35 PID 2840 wrote to memory of 2688 2840 jjdpd.exe 35 PID 2840 wrote to memory of 2688 2840 jjdpd.exe 35 PID 2840 wrote to memory of 2688 2840 jjdpd.exe 35 PID 2688 wrote to memory of 2536 2688 xxlrlrf.exe 36 PID 2688 wrote to memory of 2536 2688 xxlrlrf.exe 36 PID 2688 wrote to memory of 2536 2688 xxlrlrf.exe 36 PID 2688 wrote to memory of 2536 2688 xxlrlrf.exe 36 PID 2536 wrote to memory of 3000 2536 1nnbnt.exe 37 PID 2536 wrote to memory of 3000 2536 1nnbnt.exe 37 PID 2536 wrote to memory of 3000 2536 1nnbnt.exe 37 PID 2536 wrote to memory of 3000 2536 1nnbnt.exe 37 PID 3000 wrote to memory of 2420 3000 jdjjp.exe 38 PID 3000 wrote to memory of 2420 3000 jdjjp.exe 38 PID 3000 wrote to memory of 2420 3000 jdjjp.exe 38 PID 3000 wrote to memory of 2420 3000 jdjjp.exe 38 PID 2420 wrote to memory of 1628 2420 rxlfxxr.exe 39 PID 2420 wrote to memory of 1628 2420 rxlfxxr.exe 39 PID 2420 wrote to memory of 1628 2420 rxlfxxr.exe 39 PID 2420 wrote to memory of 1628 2420 rxlfxxr.exe 39 PID 1628 wrote to memory of 2584 1628 fxxxrrf.exe 40 PID 1628 wrote to memory of 2584 1628 fxxxrrf.exe 40 PID 1628 wrote to memory of 2584 1628 fxxxrrf.exe 40 PID 1628 wrote to memory of 2584 1628 fxxxrrf.exe 40 PID 2584 wrote to memory of 1800 2584 5hbbht.exe 41 PID 2584 wrote to memory of 1800 2584 5hbbht.exe 41 PID 2584 wrote to memory of 1800 2584 5hbbht.exe 41 PID 2584 wrote to memory of 1800 2584 5hbbht.exe 41 PID 1800 wrote to memory of 272 1800 vdvdp.exe 42 PID 1800 wrote to memory of 272 1800 vdvdp.exe 42 PID 1800 wrote to memory of 272 1800 vdvdp.exe 42 PID 1800 wrote to memory of 272 1800 vdvdp.exe 42 PID 272 wrote to memory of 1692 272 xrrlxlx.exe 43 PID 272 wrote to memory of 1692 272 xrrlxlx.exe 43 PID 272 wrote to memory of 1692 272 xrrlxlx.exe 43 PID 272 wrote to memory of 1692 272 xrrlxlx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\641466484d848b03b6b0e2be1110e430_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\641466484d848b03b6b0e2be1110e430_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\vdjdv.exec:\vdjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\fxrxllx.exec:\fxrxllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\hhtthn.exec:\hhtthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\1pjdj.exec:\1pjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\lfxfxfx.exec:\lfxfxfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\bhnhhb.exec:\bhnhhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\jjdpd.exec:\jjdpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\xxlrlrf.exec:\xxlrlrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\1nnbnt.exec:\1nnbnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\jdjjp.exec:\jdjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\rxlfxxr.exec:\rxlfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\fxxxrrf.exec:\fxxxrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\5hbbht.exec:\5hbbht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\vdvdp.exec:\vdvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\xrrlxlx.exec:\xrrlxlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:272 -
\??\c:\bbttth.exec:\bbttth.exe17⤵
- Executes dropped EXE
PID:1692 -
\??\c:\vjjjd.exec:\vjjjd.exe18⤵
- Executes dropped EXE
PID:1792 -
\??\c:\1xrlffr.exec:\1xrlffr.exe19⤵
- Executes dropped EXE
PID:1040 -
\??\c:\5bbnnh.exec:\5bbnnh.exe20⤵
- Executes dropped EXE
PID:1072 -
\??\c:\tnhnbh.exec:\tnhnbh.exe21⤵
- Executes dropped EXE
PID:332 -
\??\c:\vvppv.exec:\vvppv.exe22⤵
- Executes dropped EXE
PID:844 -
\??\c:\fxrlrxr.exec:\fxrlrxr.exe23⤵
- Executes dropped EXE
PID:1332 -
\??\c:\tbnhbn.exec:\tbnhbn.exe24⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vpjdv.exec:\vpjdv.exe25⤵
- Executes dropped EXE
PID:2268 -
\??\c:\vvvvv.exec:\vvvvv.exe26⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xlrlfxf.exec:\xlrlfxf.exe27⤵
- Executes dropped EXE
PID:1096 -
\??\c:\hhnhth.exec:\hhnhth.exe28⤵
- Executes dropped EXE
PID:340 -
\??\c:\3tbttb.exec:\3tbttb.exe29⤵
- Executes dropped EXE
PID:1840 -
\??\c:\pvppd.exec:\pvppd.exe30⤵
- Executes dropped EXE
PID:1076 -
\??\c:\fflxrfl.exec:\fflxrfl.exe31⤵
- Executes dropped EXE
PID:1296 -
\??\c:\lffxlrf.exec:\lffxlrf.exe32⤵
- Executes dropped EXE
PID:620 -
\??\c:\bthbbn.exec:\bthbbn.exe33⤵
- Executes dropped EXE
PID:2016 -
\??\c:\jjjdj.exec:\jjjdj.exe34⤵
- Executes dropped EXE
PID:1928 -
\??\c:\rrllrrf.exec:\rrllrrf.exe35⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rlflfrf.exec:\rlflfrf.exe36⤵
- Executes dropped EXE
PID:1756 -
\??\c:\tnhbhh.exec:\tnhbhh.exe37⤵
- Executes dropped EXE
PID:2492 -
\??\c:\9ppdp.exec:\9ppdp.exe38⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jdppd.exec:\jdppd.exe39⤵
- Executes dropped EXE
PID:1312 -
\??\c:\btnbnt.exec:\btnbnt.exe40⤵
- Executes dropped EXE
PID:2796 -
\??\c:\btnnnn.exec:\btnnnn.exe41⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jvjjp.exec:\jvjjp.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pjpjj.exec:\pjpjj.exe43⤵
- Executes dropped EXE
PID:1580 -
\??\c:\9rlrrrl.exec:\9rlrrrl.exe44⤵
- Executes dropped EXE
PID:2876 -
\??\c:\thttbb.exec:\thttbb.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\thbthb.exec:\thbthb.exe46⤵
- Executes dropped EXE
PID:2556 -
\??\c:\pjvjj.exec:\pjvjj.exe47⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jdppj.exec:\jdppj.exe48⤵
- Executes dropped EXE
PID:2660 -
\??\c:\xlrrxfl.exec:\xlrrxfl.exe49⤵
- Executes dropped EXE
PID:2576 -
\??\c:\bnbbhh.exec:\bnbbhh.exe50⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nbnnhh.exec:\nbnnhh.exe51⤵
- Executes dropped EXE
PID:1736 -
\??\c:\jdvvd.exec:\jdvvd.exe52⤵
- Executes dropped EXE
PID:2352 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe53⤵
- Executes dropped EXE
PID:3000 -
\??\c:\rlflrxx.exec:\rlflrxx.exe54⤵
- Executes dropped EXE
PID:776 -
\??\c:\btnbtt.exec:\btnbtt.exe55⤵
- Executes dropped EXE
PID:1920 -
\??\c:\tnnnnn.exec:\tnnnnn.exe56⤵
- Executes dropped EXE
PID:2804 -
\??\c:\dvpjv.exec:\dvpjv.exe57⤵
- Executes dropped EXE
PID:1940 -
\??\c:\jdpjd.exec:\jdpjd.exe58⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xrrfflr.exec:\xrrfflr.exe59⤵
- Executes dropped EXE
PID:2432 -
\??\c:\7xrxlrx.exec:\7xrxlrx.exe60⤵
- Executes dropped EXE
PID:268 -
\??\c:\5hhtnn.exec:\5hhtnn.exe61⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hbbntb.exec:\hbbntb.exe62⤵
- Executes dropped EXE
PID:2236 -
\??\c:\5vjvj.exec:\5vjvj.exe63⤵
- Executes dropped EXE
PID:864 -
\??\c:\xrxlrxf.exec:\xrxlrxf.exe64⤵
- Executes dropped EXE
PID:536 -
\??\c:\fxlrrxl.exec:\fxlrrxl.exe65⤵
- Executes dropped EXE
PID:684 -
\??\c:\hhttht.exec:\hhttht.exe66⤵PID:1764
-
\??\c:\nhtthn.exec:\nhtthn.exe67⤵PID:1444
-
\??\c:\vpdpv.exec:\vpdpv.exe68⤵PID:1336
-
\??\c:\jdvdd.exec:\jdvdd.exe69⤵PID:2620
-
\??\c:\flfflll.exec:\flfflll.exe70⤵PID:2952
-
\??\c:\llrfffl.exec:\llrfffl.exe71⤵PID:2936
-
\??\c:\7nbbnn.exec:\7nbbnn.exe72⤵PID:2716
-
\??\c:\vjppj.exec:\vjppj.exe73⤵PID:2984
-
\??\c:\jvpvj.exec:\jvpvj.exe74⤵PID:1360
-
\??\c:\ffxlfxf.exec:\ffxlfxf.exe75⤵PID:1664
-
\??\c:\bththt.exec:\bththt.exe76⤵PID:1368
-
\??\c:\9btbth.exec:\9btbth.exe77⤵PID:3012
-
\??\c:\dvjjj.exec:\dvjjj.exe78⤵PID:968
-
\??\c:\1ppjj.exec:\1ppjj.exe79⤵PID:888
-
\??\c:\fxffflr.exec:\fxffflr.exe80⤵PID:1296
-
\??\c:\rlflrxf.exec:\rlflrxf.exe81⤵PID:2084
-
\??\c:\3nhhhn.exec:\3nhhhn.exe82⤵PID:1616
-
\??\c:\thtbnt.exec:\thtbnt.exe83⤵PID:288
-
\??\c:\jdvjd.exec:\jdvjd.exe84⤵PID:1752
-
\??\c:\dvvvj.exec:\dvvvj.exe85⤵PID:3004
-
\??\c:\lfflrxf.exec:\lfflrxf.exe86⤵PID:1828
-
\??\c:\fxrfrxl.exec:\fxrfrxl.exe87⤵PID:2492
-
\??\c:\hhbnnh.exec:\hhbnnh.exe88⤵PID:1988
-
\??\c:\bbhhnb.exec:\bbhhnb.exe89⤵PID:1728
-
\??\c:\vdpvd.exec:\vdpvd.exe90⤵PID:2068
-
\??\c:\djpjp.exec:\djpjp.exe91⤵PID:2632
-
\??\c:\fxllrff.exec:\fxllrff.exe92⤵PID:2468
-
\??\c:\fxrxlxf.exec:\fxrxlxf.exe93⤵PID:1588
-
\??\c:\hnttbt.exec:\hnttbt.exe94⤵PID:2648
-
\??\c:\5hbbtb.exec:\5hbbtb.exe95⤵PID:3064
-
\??\c:\9vdjp.exec:\9vdjp.exe96⤵PID:2724
-
\??\c:\jjpdj.exec:\jjpdj.exe97⤵PID:2784
-
\??\c:\rlllrxl.exec:\rlllrxl.exe98⤵PID:2820
-
\??\c:\xlxfxxx.exec:\xlxfxxx.exe99⤵PID:2516
-
\??\c:\tthbnn.exec:\tthbnn.exe100⤵PID:2596
-
\??\c:\bnbhtt.exec:\bnbhtt.exe101⤵PID:2540
-
\??\c:\dvjjj.exec:\dvjjj.exe102⤵PID:1252
-
\??\c:\jdpdd.exec:\jdpdd.exe103⤵PID:1668
-
\??\c:\fxrlxxf.exec:\fxrlxxf.exe104⤵PID:672
-
\??\c:\9flrffx.exec:\9flrffx.exe105⤵PID:1508
-
\??\c:\7thntb.exec:\7thntb.exe106⤵PID:2764
-
\??\c:\3bnnnt.exec:\3bnnnt.exe107⤵PID:1948
-
\??\c:\vpjdv.exec:\vpjdv.exe108⤵PID:1060
-
\??\c:\9lxrrrx.exec:\9lxrrrx.exe109⤵PID:272
-
\??\c:\fxllrxf.exec:\fxllrxf.exe110⤵PID:1656
-
\??\c:\nbbhnt.exec:\nbbhnt.exe111⤵PID:2244
-
\??\c:\nhbnnt.exec:\nhbnnt.exe112⤵PID:2844
-
\??\c:\5jvjp.exec:\5jvjp.exe113⤵PID:1512
-
\??\c:\jdpdv.exec:\jdpdv.exe114⤵PID:600
-
\??\c:\frxffxf.exec:\frxffxf.exe115⤵PID:1044
-
\??\c:\5fxfrrx.exec:\5fxfrrx.exe116⤵PID:860
-
\??\c:\3hbbnt.exec:\3hbbnt.exe117⤵PID:1340
-
\??\c:\hbbhtb.exec:\hbbhtb.exe118⤵PID:2312
-
\??\c:\3pjjv.exec:\3pjjv.exe119⤵PID:2348
-
\??\c:\jvjpd.exec:\jvjpd.exe120⤵PID:2300
-
\??\c:\lrfrrfr.exec:\lrfrrfr.exe121⤵PID:2292
-
\??\c:\nhnbbh.exec:\nhnbbh.exe122⤵PID:2376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-