Analysis
- max time kernel
150s - max time network
118s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
20/06/2024, 23:33
Behavioral task
behavioral1
Sample
1ddaa34d8f9537ef16d415cef40251fc0132d174cfda5ac71fc8b9ae8efa6bc5_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 1ddaa34d8f9537ef16d415cef40251fc0132d174cfda5ac71fc8b9ae8efa6bc5_NeikiAnalytics.exe
- Size 90KB
- Sample240620-3jwtvssekf
- SHA256 1ddaa34d8f9537ef16d415cef40251fc0132d174cfda5ac71fc8b9ae8efa6bc5
- MD5 193ddb600f678a6d7610100fd8a54e40
- SHA1 a810beacbe2b9ac6fe159e034bddabfa6a9dee51
- SHA512 665507cad77971bdb934546e5fb86eb14181c9fbae7e81e458bf542ddb9405f09b6d6006789a067f9e1ceeae36fe141fc59ee0e1954bd26eae95b5c874406d3e
- SSDEEP 1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8mVeygryFU2li0gx4EBbhnyLFW+h:chOmTsF93UYfwC6GIoutieyhC2lbgGiW
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/3048-12-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2200-9-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2532-29-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2648-37-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2548-48-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2988-51-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2460-67-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2712-70-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2512-86-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2156-95-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2488-104-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2696-112-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2892-122-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1832-139-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1900-147-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1900-148-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1060-158-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2320-182-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1392-208-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1664-243-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1376-261-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1500-279-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2968-318-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1728-320-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2568-333-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2732-335-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2748-353-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2392-426-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1256-441-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1444-459-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2300-472-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1252-570-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1532-585-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1532-584-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2992-600-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2628-682-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2192-700-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1392-796-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/572-834-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1376-841-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2748-927-0x00000000001B0000-0x00000000001E6000-memory.dmp family_blackmoon behavioral1/memory/2748-975-0x00000000001B0000-0x00000000001E6000-memory.dmp family_blackmoon behavioral1/memory/1840-974-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1768-1031-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3048 pdppd.exe 2532 3ffflrx.exe 2648 pdjjj.exe 2548 pvjjj.exe 2988 1frxlrl.exe 2460 nbhttn.exe 2712 vpvpp.exe 2512 5jpvp.exe 2156 xxlfrfr.exe 2488 nhnnbb.exe 2696 dppdv.exe 2892 ddjjp.exe 2400 7fxxxfl.exe 1832 tnbtbh.exe 1900 1htthn.exe 1060 ddvpp.exe 556 rfxxlfl.exe 1448 9frfrrx.exe 2320 hbntbt.exe 2536 tnbhhh.exe 2796 pjjvv.exe 1392 vjppv.exe 592 llxfffl.exe 1332 rrrxlrx.exe 1500 3bnntn.exe 844 7bnhtt.exe 1664 pdddp.exe 1044 1xlrllr.exe 1376 nnbbnb.exe 2260 bnhnbt.exe 792 dpvvv.exe 2340 dpvjd.exe 876 fxffrlr.exe 2064 htbtbt.exe 2520 9bttbt.exe 2968 3djdd.exe 1728 jvppp.exe 2568 rfrfflf.exe 2732 xxrxxlf.exe 2564 5hntth.exe 2748 ntntnb.exe 2660 pdpvp.exe 2888 3xffxxr.exe 2740 7xrrfff.exe 2492 rffrffl.exe 2904 ntnnth.exe 2560 vppjv.exe 1840 1jjpv.exe 2672 lxlffff.exe 2756 7fxflll.exe 2704 lxflrxf.exe 1036 7htntn.exe 2392 nhnhnb.exe 2476 vjjvd.exe 1832 fflrxff.exe 1256 fxlxxlf.exe 1768 hbnhbb.exe 1444 ddjpd.exe 1660 rxlrxfl.exe 308 xrxxrrx.exe 2300 thhhbt.exe 2624 5thbbn.exe 1160 pjvjj.exe 2796 xlfflrf.exe -
resource yara_rule behavioral1/memory/2200-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000b000000015ca5-8.dat upx behavioral1/memory/3048-12-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2200-9-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0033000000015cec-19.dat upx behavioral1/memory/2532-20-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2532-29-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015f1b-27.dat upx behavioral1/memory/2648-37-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015f9e-38.dat upx behavioral1/memory/2548-42-0x0000000000440000-0x0000000000476000-memory.dmp upx behavioral1/files/0x0007000000016056-46.dat upx behavioral1/memory/2548-48-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2988-51-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00070000000160f8-57.dat upx behavioral1/memory/2460-58-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2460-67-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000016411-68.dat upx behavioral1/memory/2712-70-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000016cf5-76.dat upx behavioral1/memory/2512-77-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016cfe-84.dat upx behavioral1/memory/2512-86-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d06-94.dat upx behavioral1/memory/2156-95-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d0e-102.dat upx behavioral1/memory/2488-104-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d17-113.dat upx behavioral1/memory/2696-112-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2892-122-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d1f-120.dat upx behavioral1/files/0x0006000000016d27-129.dat upx behavioral1/files/0x0006000000016d3b-137.dat upx behavioral1/memory/1832-139-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1900-147-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d40-149.dat upx behavioral1/memory/1060-158-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d44-155.dat upx behavioral1/files/0x0006000000016d4b-166.dat upx behavioral1/files/0x0006000000016d67-173.dat upx behavioral1/files/0x0006000000016f82-183.dat upx behavioral1/memory/2320-182-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000017060-190.dat upx behavioral1/files/0x0006000000017185-199.dat upx behavioral1/files/0x0006000000017384-206.dat upx behavioral1/memory/1392-208-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000017387-217.dat upx behavioral1/files/0x0006000000017458-224.dat upx behavioral1/files/0x0006000000017465-233.dat upx behavioral1/files/0x0006000000017474-241.dat upx behavioral1/memory/1664-243-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0009000000018648-250.dat upx behavioral1/files/0x0031000000018649-258.dat upx behavioral1/memory/1376-261-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000500000001865b-267.dat upx behavioral1/files/0x0005000000018664-276.dat upx behavioral1/files/0x00050000000186c4-284.dat upx behavioral1/memory/876-292-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2064-299-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1728-320-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2568-326-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2732-335-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2748-353-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2392-426-0x0000000000400000-0x0000000000436000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2200 wrote to memory of 3048 2200 1ddaa34d8f9537ef16d415cef40251fc0132d174cfda5ac71fc8b9ae8efa6bc5_NeikiAnalytics.exe 28 PID 2200 wrote to memory of 3048 2200 1ddaa34d8f9537ef16d415cef40251fc0132d174cfda5ac71fc8b9ae8efa6bc5_NeikiAnalytics.exe 28 PID 2200 wrote to memory of 3048 2200 1ddaa34d8f9537ef16d415cef40251fc0132d174cfda5ac71fc8b9ae8efa6bc5_NeikiAnalytics.exe 28 PID 2200 wrote to memory of 3048 2200 1ddaa34d8f9537ef16d415cef40251fc0132d174cfda5ac71fc8b9ae8efa6bc5_NeikiAnalytics.exe 28 PID 3048 wrote to memory of 2532 3048 pdppd.exe 29 PID 3048 wrote to memory of 2532 3048 pdppd.exe 29 PID 3048 wrote to memory of 2532 3048 pdppd.exe 29 PID 3048 wrote to memory of 2532 3048 pdppd.exe 29 PID 2532 wrote to memory of 2648 2532 3ffflrx.exe 30 PID 2532 wrote to memory of 2648 2532 3ffflrx.exe 30 PID 2532 wrote to memory of 2648 2532 3ffflrx.exe 30 PID 2532 wrote to memory of 2648 2532 3ffflrx.exe 30 PID 2648 wrote to memory of 2548 2648 pdjjj.exe 31 PID 2648 wrote to memory of 2548 2648 pdjjj.exe 31 PID 2648 wrote to memory of 2548 2648 pdjjj.exe 31 PID 2648 wrote to memory of 2548 2648 pdjjj.exe 31 PID 2548 wrote to memory of 2988 2548 pvjjj.exe 32 PID 2548 wrote to memory of 2988 2548 pvjjj.exe 32 PID 2548 wrote to memory of 2988 2548 pvjjj.exe 32 PID 2548 wrote to memory of 2988 2548 pvjjj.exe 32 PID 2988 wrote to memory of 2460 2988 1frxlrl.exe 33 PID 2988 wrote to memory of 2460 2988 1frxlrl.exe 33 PID 2988 wrote to memory of 2460 2988 1frxlrl.exe 33 PID 2988 wrote to memory of 2460 2988 1frxlrl.exe 33 PID 2460 wrote to memory of 2712 2460 nbhttn.exe 34 PID 2460 wrote to memory of 2712 2460 nbhttn.exe 34 PID 2460 wrote to memory of 2712 2460 nbhttn.exe 34 PID 2460 wrote to memory of 2712 2460 nbhttn.exe 34 PID 2712 wrote to memory of 2512 2712 vpvpp.exe 35 PID 2712 wrote to memory of 2512 2712 vpvpp.exe 35 PID 2712 wrote to memory of 2512 2712 vpvpp.exe 35 PID 2712 wrote to memory of 2512 2712 vpvpp.exe 35 PID 2512 wrote to memory of 2156 2512 5jpvp.exe 36 PID 2512 wrote to memory of 2156 2512 5jpvp.exe 36 PID 2512 wrote to memory of 2156 2512 5jpvp.exe 36 PID 2512 wrote to memory of 2156 2512 5jpvp.exe 36 PID 2156 wrote to memory of 2488 2156 xxlfrfr.exe 37 PID 2156 wrote to memory of 2488 2156 xxlfrfr.exe 37 PID 2156 wrote to memory of 2488 2156 xxlfrfr.exe 37 PID 2156 wrote to memory of 2488 2156 xxlfrfr.exe 37 PID 2488 wrote to memory of 2696 2488 nhnnbb.exe 38 PID 2488 wrote to memory of 2696 2488 nhnnbb.exe 38 PID 2488 wrote to memory of 2696 2488 nhnnbb.exe 38 PID 2488 wrote to memory of 2696 2488 nhnnbb.exe 38 PID 2696 wrote to memory of 2892 2696 dppdv.exe 39 PID 2696 wrote to memory of 2892 2696 dppdv.exe 39 PID 2696 wrote to memory of 2892 2696 dppdv.exe 39 PID 2696 wrote to memory of 2892 2696 dppdv.exe 39 PID 2892 wrote to memory of 2400 2892 ddjjp.exe 40 PID 2892 wrote to memory of 2400 2892 ddjjp.exe 40 PID 2892 wrote to memory of 2400 2892 ddjjp.exe 40 PID 2892 wrote to memory of 2400 2892 ddjjp.exe 40 PID 2400 wrote to memory of 1832 2400 7fxxxfl.exe 41 PID 2400 wrote to memory of 1832 2400 7fxxxfl.exe 41 PID 2400 wrote to memory of 1832 2400 7fxxxfl.exe 41 PID 2400 wrote to memory of 1832 2400 7fxxxfl.exe 41 PID 1832 wrote to memory of 1900 1832 tnbtbh.exe 42 PID 1832 wrote to memory of 1900 1832 tnbtbh.exe 42 PID 1832 wrote to memory of 1900 1832 tnbtbh.exe 42 PID 1832 wrote to memory of 1900 1832 tnbtbh.exe 42 PID 1900 wrote to memory of 1060 1900 1htthn.exe 43 PID 1900 wrote to memory of 1060 1900 1htthn.exe 43 PID 1900 wrote to memory of 1060 1900 1htthn.exe 43 PID 1900 wrote to memory of 1060 1900 1htthn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ddaa34d8f9537ef16d415cef40251fc0132d174cfda5ac71fc8b9ae8efa6bc5_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1ddaa34d8f9537ef16d415cef40251fc0132d174cfda5ac71fc8b9ae8efa6bc5_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\pdppd.exec:\pdppd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\3ffflrx.exec:\3ffflrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\pdjjj.exec:\pdjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\pvjjj.exec:\pvjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\1frxlrl.exec:\1frxlrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\nbhttn.exec:\nbhttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\vpvpp.exec:\vpvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\5jpvp.exec:\5jpvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\xxlfrfr.exec:\xxlfrfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\nhnnbb.exec:\nhnnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\dppdv.exec:\dppdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\ddjjp.exec:\ddjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\7fxxxfl.exec:\7fxxxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\tnbtbh.exec:\tnbtbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\1htthn.exec:\1htthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\ddvpp.exec:\ddvpp.exe17⤵
- Executes dropped EXE
PID:1060 -
\??\c:\rfxxlfl.exec:\rfxxlfl.exe18⤵
- Executes dropped EXE
PID:556 -
\??\c:\9frfrrx.exec:\9frfrrx.exe19⤵
- Executes dropped EXE
PID:1448 -
\??\c:\hbntbt.exec:\hbntbt.exe20⤵
- Executes dropped EXE
PID:2320 -
\??\c:\tnbhhh.exec:\tnbhhh.exe21⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pjjvv.exec:\pjjvv.exe22⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vjppv.exec:\vjppv.exe23⤵
- Executes dropped EXE
PID:1392 -
\??\c:\llxfffl.exec:\llxfffl.exe24⤵
- Executes dropped EXE
PID:592 -
\??\c:\rrrxlrx.exec:\rrrxlrx.exe25⤵
- Executes dropped EXE
PID:1332 -
\??\c:\3bnntn.exec:\3bnntn.exe26⤵
- Executes dropped EXE
PID:1500 -
\??\c:\7bnhtt.exec:\7bnhtt.exe27⤵
- Executes dropped EXE
PID:844 -
\??\c:\pdddp.exec:\pdddp.exe28⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1xlrllr.exec:\1xlrllr.exe29⤵
- Executes dropped EXE
PID:1044 -
\??\c:\nnbbnb.exec:\nnbbnb.exe30⤵
- Executes dropped EXE
PID:1376 -
\??\c:\bnhnbt.exec:\bnhnbt.exe31⤵
- Executes dropped EXE
PID:2260 -
\??\c:\dpvvv.exec:\dpvvv.exe32⤵
- Executes dropped EXE
PID:792 -
\??\c:\dpvjd.exec:\dpvjd.exe33⤵
- Executes dropped EXE
PID:2340 -
\??\c:\fxffrlr.exec:\fxffrlr.exe34⤵
- Executes dropped EXE
PID:876 -
\??\c:\htbtbt.exec:\htbtbt.exe35⤵
- Executes dropped EXE
PID:2064 -
\??\c:\9bttbt.exec:\9bttbt.exe36⤵
- Executes dropped EXE
PID:2520 -
\??\c:\3djdd.exec:\3djdd.exe37⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jvppp.exec:\jvppp.exe38⤵
- Executes dropped EXE
PID:1728 -
\??\c:\rfrfflf.exec:\rfrfflf.exe39⤵
- Executes dropped EXE
PID:2568 -
\??\c:\xxrxxlf.exec:\xxrxxlf.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\5hntth.exec:\5hntth.exe41⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ntntnb.exec:\ntntnb.exe42⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pdpvp.exec:\pdpvp.exe43⤵
- Executes dropped EXE
PID:2660 -
\??\c:\3xffxxr.exec:\3xffxxr.exe44⤵
- Executes dropped EXE
PID:2888 -
\??\c:\7xrrfff.exec:\7xrrfff.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rffrffl.exec:\rffrffl.exe46⤵
- Executes dropped EXE
PID:2492 -
\??\c:\ntnnth.exec:\ntnnth.exe47⤵
- Executes dropped EXE
PID:2904 -
\??\c:\vppjv.exec:\vppjv.exe48⤵
- Executes dropped EXE
PID:2560 -
\??\c:\1jjpv.exec:\1jjpv.exe49⤵
- Executes dropped EXE
PID:1840 -
\??\c:\lxlffff.exec:\lxlffff.exe50⤵
- Executes dropped EXE
PID:2672 -
\??\c:\7fxflll.exec:\7fxflll.exe51⤵
- Executes dropped EXE
PID:2756 -
\??\c:\lxflrxf.exec:\lxflrxf.exe52⤵
- Executes dropped EXE
PID:2704 -
\??\c:\7htntn.exec:\7htntn.exe53⤵
- Executes dropped EXE
PID:1036 -
\??\c:\nhnhnb.exec:\nhnhnb.exe54⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vjjvd.exec:\vjjvd.exe55⤵
- Executes dropped EXE
PID:2476 -
\??\c:\fflrxff.exec:\fflrxff.exe56⤵
- Executes dropped EXE
PID:1832 -
\??\c:\fxlxxlf.exec:\fxlxxlf.exe57⤵
- Executes dropped EXE
PID:1256 -
\??\c:\hbnhbb.exec:\hbnhbb.exe58⤵
- Executes dropped EXE
PID:1768 -
\??\c:\ddjpd.exec:\ddjpd.exe59⤵
- Executes dropped EXE
PID:1444 -
\??\c:\rxlrxfl.exec:\rxlrxfl.exe60⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xrxxrrx.exec:\xrxxrrx.exe61⤵
- Executes dropped EXE
PID:308 -
\??\c:\thhhbt.exec:\thhhbt.exe62⤵
- Executes dropped EXE
PID:2300 -
\??\c:\5thbbn.exec:\5thbbn.exe63⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pjvjj.exec:\pjvjj.exe64⤵
- Executes dropped EXE
PID:1160 -
\??\c:\xlfflrf.exec:\xlfflrf.exe65⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xlxrflr.exec:\xlxrflr.exe66⤵PID:2276
-
\??\c:\rflxlff.exec:\rflxlff.exe67⤵PID:112
-
\??\c:\tnttbh.exec:\tnttbh.exe68⤵PID:1116
-
\??\c:\9hbhnt.exec:\9hbhnt.exe69⤵PID:2784
-
\??\c:\vpdpj.exec:\vpdpj.exe70⤵PID:1580
-
\??\c:\7djjp.exec:\7djjp.exe71⤵PID:1180
-
\??\c:\7rfxxrr.exec:\7rfxxrr.exe72⤵PID:280
-
\??\c:\rflrllr.exec:\rflrllr.exe73⤵PID:1752
-
\??\c:\3ttbhh.exec:\3ttbhh.exe74⤵PID:1044
-
\??\c:\bbbhbb.exec:\bbbhbb.exe75⤵PID:704
-
\??\c:\3jdvv.exec:\3jdvv.exe76⤵PID:2172
-
\??\c:\jvpdp.exec:\jvpdp.exe77⤵PID:1252
-
\??\c:\lfllfrx.exec:\lfllfrx.exe78⤵PID:2004
-
\??\c:\frffrxr.exec:\frffrxr.exe79⤵PID:1532
-
\??\c:\hnntbn.exec:\hnntbn.exe80⤵PID:1304
-
\??\c:\bntbht.exec:\bntbht.exe81⤵PID:3068
-
\??\c:\vjvvd.exec:\vjvvd.exe82⤵PID:2992
-
\??\c:\7pddp.exec:\7pddp.exe83⤵PID:2968
-
\??\c:\xllrffl.exec:\xllrffl.exe84⤵PID:2912
-
\??\c:\btbbhh.exec:\btbbhh.exe85⤵PID:2568
-
\??\c:\nhbhhn.exec:\nhbhhn.exe86⤵PID:2732
-
\??\c:\jvddv.exec:\jvddv.exe87⤵PID:2728
-
\??\c:\pjvvd.exec:\pjvvd.exe88⤵PID:2472
-
\??\c:\pjvdj.exec:\pjvdj.exe89⤵PID:2988
-
\??\c:\llxlrxx.exec:\llxlrxx.exe90⤵PID:2500
-
\??\c:\frlxrll.exec:\frlxrll.exe91⤵PID:2468
-
\??\c:\htbtht.exec:\htbtht.exe92⤵PID:2608
-
\??\c:\9bbbtn.exec:\9bbbtn.exe93⤵PID:2220
-
\??\c:\pjvpj.exec:\pjvpj.exe94⤵PID:1896
-
\??\c:\dvjdd.exec:\dvjdd.exe95⤵PID:2628
-
\??\c:\lxxxllx.exec:\lxxxllx.exe96⤵PID:2772
-
\??\c:\xlxxxfx.exec:\xlxxxfx.exe97⤵PID:2192
-
\??\c:\7ntbnn.exec:\7ntbnn.exe98⤵PID:2704
-
\??\c:\hbbbhh.exec:\hbbbhh.exe99⤵PID:1672
-
\??\c:\dvpjp.exec:\dvpjp.exe100⤵PID:1684
-
\??\c:\lrflfxx.exec:\lrflfxx.exe101⤵PID:2476
-
\??\c:\rlfrrlr.exec:\rlfrrlr.exe102⤵PID:1832
-
\??\c:\5htbhn.exec:\5htbhn.exe103⤵PID:780
-
\??\c:\thttbn.exec:\thttbn.exe104⤵PID:1768
-
\??\c:\nttnhb.exec:\nttnhb.exe105⤵PID:1608
-
\??\c:\dpvdd.exec:\dpvdd.exe106⤵PID:1660
-
\??\c:\dpdjd.exec:\dpdjd.exe107⤵PID:1448
-
\??\c:\rfxxffl.exec:\rfxxffl.exe108⤵PID:2316
-
\??\c:\xlrxfff.exec:\xlrxfff.exe109⤵PID:2416
-
\??\c:\nhhntn.exec:\nhhntn.exe110⤵PID:2656
-
\??\c:\1dvdd.exec:\1dvdd.exe111⤵PID:336
-
\??\c:\jjdjj.exec:\jjdjj.exe112⤵PID:1392
-
\??\c:\5xlfrxl.exec:\5xlfrxl.exe113⤵PID:1336
-
\??\c:\1rllfff.exec:\1rllfff.exe114⤵PID:1116
-
\??\c:\tbhhhh.exec:\tbhhhh.exe115⤵PID:844
-
\??\c:\5bnhhh.exec:\5bnhhh.exe116⤵PID:1356
-
\??\c:\jdpdd.exec:\jdpdd.exe117⤵PID:2100
-
\??\c:\xlfllrl.exec:\xlfllrl.exe118⤵PID:1952
-
\??\c:\llflrxf.exec:\llflrxf.exe119⤵PID:572
-
\??\c:\nhbnth.exec:\nhbnth.exe120⤵PID:1376
-
\??\c:\nbtnnh.exec:\nbtnnh.exe121⤵PID:1980
-
\??\c:\pvvvv.exec:\pvvvv.exe122⤵PID:1776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-