Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 02:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
24237c1bd743aa179b0c88080e8862c0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
24237c1bd743aa179b0c88080e8862c0_NeikiAnalytics.exe
-
Size
351KB
-
MD5
24237c1bd743aa179b0c88080e8862c0
-
SHA1
249f1c7eae874bfd3a2e0b4155950e176b431b2f
-
SHA256
43e3eb45ab67e21ce85e775c3d9fc4b85de5a5f366d6d446040da06da16cd711
-
SHA512
886cef713bc4c044399f763768ee9cc56d2c4b063c8f1ad7088fd1341a967d56fa410baeb9870a6bfe919ed7756cd5e15599523f3ffe9b36ef46a947f034553f
-
SSDEEP
6144:4cm7ImGddXvJuzyy/SfVFKpU/sien7NuOpo0HmtDKe0wKyKqiOfm8RCfDK4TrHHO:+7TcBuGy/Sa+/sie0OpncKe/KFBOfmzm
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1312-8-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1732-12-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2540-27-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2660-37-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2456-48-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2620-66-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2748-63-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2468-81-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2872-84-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2676-101-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1032-99-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2860-118-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1684-135-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2020-143-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/868-153-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/772-163-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2100-182-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1784-180-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1160-208-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1796-223-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/3048-240-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/640-265-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1768-291-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/376-304-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1648-317-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2084-331-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2388-362-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2248-370-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2372-433-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1828-441-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2104-448-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/496-468-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2916-661-0x0000000000230000-0x000000000025D000-memory.dmp family_blackmoon behavioral1/memory/1968-715-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/1720-897-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2540-928-0x0000000000430000-0x000000000045D000-memory.dmp family_blackmoon behavioral1/memory/2756-949-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2536-982-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2536-989-0x0000000000250000-0x000000000027D000-memory.dmp family_blackmoon behavioral1/memory/2364-1009-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1696-1048-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1792-1142-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/2884-1205-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2260-1305-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1732 vpdjv.exe 2540 rrfrxfr.exe 2660 dvdjv.exe 2552 5pdpd.exe 2456 3tnttb.exe 2748 pjdpp.exe 2620 lffrxlr.exe 2468 nhhhnh.exe 2872 vdjdd.exe 1032 rxlfxfr.exe 2676 hbtbnn.exe 2860 jvvvj.exe 2340 3bnnbh.exe 1684 pvdvd.exe 2020 lflllrf.exe 868 bhtnhn.exe 772 jpvpp.exe 1776 lxflxxx.exe 1784 dpjpd.exe 2100 1fflxxf.exe 760 ppjpj.exe 596 ddpvv.exe 1160 hhtbnn.exe 1796 9htbht.exe 448 lxxrllx.exe 3048 bbhhnt.exe 1876 pvdjd.exe 1108 nbnbht.exe 640 vvpjp.exe 960 xllfrrf.exe 1036 tnbhhh.exe 1768 pjppv.exe 1172 xrlxrlx.exe 376 nhbbhn.exe 2780 1tnbht.exe 1648 pjvpd.exe 2772 lxlffll.exe 2084 nntthh.exe 2576 bbbhtb.exe 2716 ppdpd.exe 2660 rfxrfxf.exe 2644 hbtbnn.exe 2388 tnbhnt.exe 2472 pjvpd.exe 2248 xxrrrxf.exe 2500 tthtth.exe 2688 bnnhnh.exe 2920 5pdjp.exe 1444 xrffrrx.exe 1032 rlflfll.exe 2880 5ntntt.exe 2260 jjppv.exe 2140 jjvpd.exe 2372 ffrrxfr.exe 1828 bbhhnt.exe 1508 btnthh.exe 2104 dddpv.exe 2256 9frxxlx.exe 496 lfrrflr.exe 1644 hbntbh.exe 1984 pjvvj.exe 484 1jjvj.exe 2100 xxllrrf.exe 704 5xllxxl.exe -
resource yara_rule behavioral1/memory/1312-0-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1312-8-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1732-12-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2540-27-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2660-29-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2660-37-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2456-48-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2620-66-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2748-63-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2468-81-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2872-84-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2676-101-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1032-99-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2860-118-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1684-135-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2020-143-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/772-154-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/868-153-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/772-163-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2100-182-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1784-180-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/596-198-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1160-208-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1796-223-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/3048-240-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/640-265-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1768-291-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/376-304-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1648-317-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2084-324-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2084-331-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2388-362-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2472-363-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2248-370-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1032-401-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2372-433-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1828-434-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1828-441-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2104-448-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2256-455-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/496-468-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1644-469-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1404-531-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1920-681-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2676-700-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1968-707-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1804-729-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1692-822-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1044-835-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2980-854-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2980-861-0x0000000000220000-0x000000000024D000-memory.dmp upx behavioral1/memory/1660-883-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2228-890-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1720-897-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2640-910-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2756-949-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2536-982-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1396-996-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2364-1009-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1728-1041-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1696-1048-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1500-1073-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1668-1080-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2416-1155-0x0000000000400000-0x000000000042D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1312 wrote to memory of 1732 1312 24237c1bd743aa179b0c88080e8862c0_NeikiAnalytics.exe 28 PID 1312 wrote to memory of 1732 1312 24237c1bd743aa179b0c88080e8862c0_NeikiAnalytics.exe 28 PID 1312 wrote to memory of 1732 1312 24237c1bd743aa179b0c88080e8862c0_NeikiAnalytics.exe 28 PID 1312 wrote to memory of 1732 1312 24237c1bd743aa179b0c88080e8862c0_NeikiAnalytics.exe 28 PID 1732 wrote to memory of 2540 1732 vpdjv.exe 29 PID 1732 wrote to memory of 2540 1732 vpdjv.exe 29 PID 1732 wrote to memory of 2540 1732 vpdjv.exe 29 PID 1732 wrote to memory of 2540 1732 vpdjv.exe 29 PID 2540 wrote to memory of 2660 2540 rrfrxfr.exe 30 PID 2540 wrote to memory of 2660 2540 rrfrxfr.exe 30 PID 2540 wrote to memory of 2660 2540 rrfrxfr.exe 30 PID 2540 wrote to memory of 2660 2540 rrfrxfr.exe 30 PID 2660 wrote to memory of 2552 2660 dvdjv.exe 31 PID 2660 wrote to memory of 2552 2660 dvdjv.exe 31 PID 2660 wrote to memory of 2552 2660 dvdjv.exe 31 PID 2660 wrote to memory of 2552 2660 dvdjv.exe 31 PID 2552 wrote to memory of 2456 2552 5pdpd.exe 32 PID 2552 wrote to memory of 2456 2552 5pdpd.exe 32 PID 2552 wrote to memory of 2456 2552 5pdpd.exe 32 PID 2552 wrote to memory of 2456 2552 5pdpd.exe 32 PID 2456 wrote to memory of 2748 2456 3tnttb.exe 33 PID 2456 wrote to memory of 2748 2456 3tnttb.exe 33 PID 2456 wrote to memory of 2748 2456 3tnttb.exe 33 PID 2456 wrote to memory of 2748 2456 3tnttb.exe 33 PID 2748 wrote to memory of 2620 2748 pjdpp.exe 34 PID 2748 wrote to memory of 2620 2748 pjdpp.exe 34 PID 2748 wrote to memory of 2620 2748 pjdpp.exe 34 PID 2748 wrote to memory of 2620 2748 pjdpp.exe 34 PID 2620 wrote to memory of 2468 2620 lffrxlr.exe 35 PID 2620 wrote to memory of 2468 2620 lffrxlr.exe 35 PID 2620 wrote to memory of 2468 2620 lffrxlr.exe 35 PID 2620 wrote to memory of 2468 2620 lffrxlr.exe 35 PID 2468 wrote to memory of 2872 2468 nhhhnh.exe 36 PID 2468 wrote to memory of 2872 2468 nhhhnh.exe 36 PID 2468 wrote to memory of 2872 2468 nhhhnh.exe 36 PID 2468 wrote to memory of 2872 2468 nhhhnh.exe 36 PID 2872 wrote to memory of 1032 2872 vdjdd.exe 37 PID 2872 wrote to memory of 1032 2872 vdjdd.exe 37 PID 2872 wrote to memory of 1032 2872 vdjdd.exe 37 PID 2872 wrote to memory of 1032 2872 vdjdd.exe 37 PID 1032 wrote to memory of 2676 1032 rxlfxfr.exe 38 PID 1032 wrote to memory of 2676 1032 rxlfxfr.exe 38 PID 1032 wrote to memory of 2676 1032 rxlfxfr.exe 38 PID 1032 wrote to memory of 2676 1032 rxlfxfr.exe 38 PID 2676 wrote to memory of 2860 2676 hbtbnn.exe 39 PID 2676 wrote to memory of 2860 2676 hbtbnn.exe 39 PID 2676 wrote to memory of 2860 2676 hbtbnn.exe 39 PID 2676 wrote to memory of 2860 2676 hbtbnn.exe 39 PID 2860 wrote to memory of 2340 2860 jvvvj.exe 40 PID 2860 wrote to memory of 2340 2860 jvvvj.exe 40 PID 2860 wrote to memory of 2340 2860 jvvvj.exe 40 PID 2860 wrote to memory of 2340 2860 jvvvj.exe 40 PID 2340 wrote to memory of 1684 2340 3bnnbh.exe 41 PID 2340 wrote to memory of 1684 2340 3bnnbh.exe 41 PID 2340 wrote to memory of 1684 2340 3bnnbh.exe 41 PID 2340 wrote to memory of 1684 2340 3bnnbh.exe 41 PID 1684 wrote to memory of 2020 1684 pvdvd.exe 42 PID 1684 wrote to memory of 2020 1684 pvdvd.exe 42 PID 1684 wrote to memory of 2020 1684 pvdvd.exe 42 PID 1684 wrote to memory of 2020 1684 pvdvd.exe 42 PID 2020 wrote to memory of 868 2020 lflllrf.exe 43 PID 2020 wrote to memory of 868 2020 lflllrf.exe 43 PID 2020 wrote to memory of 868 2020 lflllrf.exe 43 PID 2020 wrote to memory of 868 2020 lflllrf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\24237c1bd743aa179b0c88080e8862c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\24237c1bd743aa179b0c88080e8862c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\vpdjv.exec:\vpdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\rrfrxfr.exec:\rrfrxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\dvdjv.exec:\dvdjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\5pdpd.exec:\5pdpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\3tnttb.exec:\3tnttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\pjdpp.exec:\pjdpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\lffrxlr.exec:\lffrxlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\nhhhnh.exec:\nhhhnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\vdjdd.exec:\vdjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\rxlfxfr.exec:\rxlfxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\hbtbnn.exec:\hbtbnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\jvvvj.exec:\jvvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\3bnnbh.exec:\3bnnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\pvdvd.exec:\pvdvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\lflllrf.exec:\lflllrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\bhtnhn.exec:\bhtnhn.exe17⤵
- Executes dropped EXE
PID:868 -
\??\c:\jpvpp.exec:\jpvpp.exe18⤵
- Executes dropped EXE
PID:772 -
\??\c:\lxflxxx.exec:\lxflxxx.exe19⤵
- Executes dropped EXE
PID:1776 -
\??\c:\dpjpd.exec:\dpjpd.exe20⤵
- Executes dropped EXE
PID:1784 -
\??\c:\1fflxxf.exec:\1fflxxf.exe21⤵
- Executes dropped EXE
PID:2100 -
\??\c:\ppjpj.exec:\ppjpj.exe22⤵
- Executes dropped EXE
PID:760 -
\??\c:\ddpvv.exec:\ddpvv.exe23⤵
- Executes dropped EXE
PID:596 -
\??\c:\hhtbnn.exec:\hhtbnn.exe24⤵
- Executes dropped EXE
PID:1160 -
\??\c:\9htbht.exec:\9htbht.exe25⤵
- Executes dropped EXE
PID:1796 -
\??\c:\lxxrllx.exec:\lxxrllx.exe26⤵
- Executes dropped EXE
PID:448 -
\??\c:\bbhhnt.exec:\bbhhnt.exe27⤵
- Executes dropped EXE
PID:3048 -
\??\c:\pvdjd.exec:\pvdjd.exe28⤵
- Executes dropped EXE
PID:1876 -
\??\c:\nbnbht.exec:\nbnbht.exe29⤵
- Executes dropped EXE
PID:1108 -
\??\c:\vvpjp.exec:\vvpjp.exe30⤵
- Executes dropped EXE
PID:640 -
\??\c:\xllfrrf.exec:\xllfrrf.exe31⤵
- Executes dropped EXE
PID:960 -
\??\c:\tnbhhh.exec:\tnbhhh.exe32⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pjppv.exec:\pjppv.exe33⤵
- Executes dropped EXE
PID:1768 -
\??\c:\xrlxrlx.exec:\xrlxrlx.exe34⤵
- Executes dropped EXE
PID:1172 -
\??\c:\nhbbhn.exec:\nhbbhn.exe35⤵
- Executes dropped EXE
PID:376 -
\??\c:\1tnbht.exec:\1tnbht.exe36⤵
- Executes dropped EXE
PID:2780 -
\??\c:\pjvpd.exec:\pjvpd.exe37⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lxlffll.exec:\lxlffll.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\nntthh.exec:\nntthh.exe39⤵
- Executes dropped EXE
PID:2084 -
\??\c:\bbbhtb.exec:\bbbhtb.exe40⤵
- Executes dropped EXE
PID:2576 -
\??\c:\ppdpd.exec:\ppdpd.exe41⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rfxrfxf.exec:\rfxrfxf.exe42⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hbtbnn.exec:\hbtbnn.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\tnbhnt.exec:\tnbhnt.exe44⤵
- Executes dropped EXE
PID:2388 -
\??\c:\pjvpd.exec:\pjvpd.exe45⤵
- Executes dropped EXE
PID:2472 -
\??\c:\xxrrrxf.exec:\xxrrrxf.exe46⤵
- Executes dropped EXE
PID:2248 -
\??\c:\tthtth.exec:\tthtth.exe47⤵
- Executes dropped EXE
PID:2500 -
\??\c:\bnnhnh.exec:\bnnhnh.exe48⤵
- Executes dropped EXE
PID:2688 -
\??\c:\5pdjp.exec:\5pdjp.exe49⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xrffrrx.exec:\xrffrrx.exe50⤵
- Executes dropped EXE
PID:1444 -
\??\c:\rlflfll.exec:\rlflfll.exe51⤵
- Executes dropped EXE
PID:1032 -
\??\c:\5ntntt.exec:\5ntntt.exe52⤵
- Executes dropped EXE
PID:2880 -
\??\c:\jjppv.exec:\jjppv.exe53⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jjvpd.exec:\jjvpd.exe54⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ffrrxfr.exec:\ffrrxfr.exe55⤵
- Executes dropped EXE
PID:2372 -
\??\c:\bbhhnt.exec:\bbhhnt.exe56⤵
- Executes dropped EXE
PID:1828 -
\??\c:\btnthh.exec:\btnthh.exe57⤵
- Executes dropped EXE
PID:1508 -
\??\c:\dddpv.exec:\dddpv.exe58⤵
- Executes dropped EXE
PID:2104 -
\??\c:\9frxxlx.exec:\9frxxlx.exe59⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lfrrflr.exec:\lfrrflr.exe60⤵
- Executes dropped EXE
PID:496 -
\??\c:\hbntbh.exec:\hbntbh.exe61⤵
- Executes dropped EXE
PID:1644 -
\??\c:\pjvvj.exec:\pjvvj.exe62⤵
- Executes dropped EXE
PID:1984 -
\??\c:\1jjvj.exec:\1jjvj.exe63⤵
- Executes dropped EXE
PID:484 -
\??\c:\xxllrrf.exec:\xxllrrf.exe64⤵
- Executes dropped EXE
PID:2100 -
\??\c:\5xllxxl.exec:\5xllxxl.exe65⤵
- Executes dropped EXE
PID:704 -
\??\c:\bthntb.exec:\bthntb.exe66⤵PID:588
-
\??\c:\jjdjv.exec:\jjdjv.exe67⤵PID:1004
-
\??\c:\lfrrllr.exec:\lfrrllr.exe68⤵PID:2424
-
\??\c:\3xllxxf.exec:\3xllxxf.exe69⤵PID:1796
-
\??\c:\btbbnt.exec:\btbbnt.exe70⤵PID:1140
-
\??\c:\pjpjj.exec:\pjpjj.exe71⤵PID:1404
-
\??\c:\vdvvd.exec:\vdvvd.exe72⤵PID:1712
-
\??\c:\rrlxfrl.exec:\rrlxfrl.exe73⤵PID:1876
-
\??\c:\1bhnhn.exec:\1bhnhn.exe74⤵PID:1000
-
\??\c:\tnhntt.exec:\tnhntt.exe75⤵PID:2980
-
\??\c:\dvjpd.exec:\dvjpd.exe76⤵PID:3004
-
\??\c:\1rxfflr.exec:\1rxfflr.exe77⤵PID:1532
-
\??\c:\bhnhbb.exec:\bhnhbb.exe78⤵PID:1440
-
\??\c:\vpjjp.exec:\vpjjp.exe79⤵PID:2996
-
\??\c:\jdppv.exec:\jdppv.exe80⤵PID:2160
-
\??\c:\5rffllf.exec:\5rffllf.exe81⤵PID:1640
-
\??\c:\ffrflfl.exec:\ffrflfl.exe82⤵PID:2028
-
\??\c:\tnttbt.exec:\tnttbt.exe83⤵PID:2776
-
\??\c:\jjjvj.exec:\jjjvj.exe84⤵PID:1820
-
\??\c:\djppv.exec:\djppv.exe85⤵PID:2944
-
\??\c:\lflfrxr.exec:\lflfrxr.exe86⤵PID:2964
-
\??\c:\ttnthb.exec:\ttnthb.exe87⤵PID:2712
-
\??\c:\vpdjd.exec:\vpdjd.exe88⤵PID:2696
-
\??\c:\5jppp.exec:\5jppp.exe89⤵PID:2956
-
\??\c:\llfxfrl.exec:\llfxfrl.exe90⤵PID:2476
-
\??\c:\fxfxxrx.exec:\fxfxxrx.exe91⤵PID:2916
-
\??\c:\nnhbbh.exec:\nnhbbh.exe92⤵PID:2472
-
\??\c:\bbtbnt.exec:\bbtbnt.exe93⤵PID:2520
-
\??\c:\ddvvd.exec:\ddvvd.exe94⤵PID:3064
-
\??\c:\lflfllx.exec:\lflfllx.exe95⤵PID:1920
-
\??\c:\7tnthn.exec:\7tnthn.exe96⤵PID:2516
-
\??\c:\pjvjp.exec:\pjvjp.exe97⤵PID:2768
-
\??\c:\jjdpp.exec:\jjdpp.exe98⤵PID:2676
-
\??\c:\xfrrrxl.exec:\xfrrrxl.exe99⤵PID:1968
-
\??\c:\5bthnb.exec:\5bthnb.exe100⤵PID:2004
-
\??\c:\bbhbbn.exec:\bbhbbn.exe101⤵PID:2140
-
\??\c:\ddvvd.exec:\ddvvd.exe102⤵PID:1804
-
\??\c:\xrxrrll.exec:\xrxrrll.exe103⤵PID:2336
-
\??\c:\xrlxlrx.exec:\xrlxlrx.exe104⤵PID:1336
-
\??\c:\1thnbb.exec:\1thnbb.exe105⤵PID:2104
-
\??\c:\bntnbt.exec:\bntnbt.exe106⤵PID:2348
-
\??\c:\pppjp.exec:\pppjp.exe107⤵PID:2244
-
\??\c:\3xlrxrx.exec:\3xlrxrx.exe108⤵PID:344
-
\??\c:\5fxrfxl.exec:\5fxrfxl.exe109⤵PID:1984
-
\??\c:\ththtt.exec:\ththtt.exe110⤵PID:808
-
\??\c:\ttnbbb.exec:\ttnbbb.exe111⤵PID:2100
-
\??\c:\dvdvd.exec:\dvdvd.exe112⤵PID:848
-
\??\c:\fxrrxfr.exec:\fxrrxfr.exe113⤵PID:620
-
\??\c:\lrrrlfx.exec:\lrrrlfx.exe114⤵PID:796
-
\??\c:\nhttnn.exec:\nhttnn.exe115⤵PID:2164
-
\??\c:\jdvdp.exec:\jdvdp.exe116⤵PID:1796
-
\??\c:\jddvp.exec:\jddvp.exe117⤵PID:1692
-
\??\c:\1xxxrrf.exec:\1xxxrrf.exe118⤵PID:1404
-
\??\c:\tnbhhh.exec:\tnbhhh.exe119⤵PID:1044
-
\??\c:\5nbhnb.exec:\5nbhnb.exe120⤵PID:1964
-
\??\c:\7vpvv.exec:\7vpvv.exe121⤵PID:640
-
\??\c:\vpddd.exec:\vpddd.exe122⤵PID:2980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-