Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
26/06/2024, 01:07
Behavioral task
behavioral1
Sample
315e96e31d8f2d862cf48ab48d178b7388f32b6006441fdeb068151b3bbed595_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
315e96e31d8f2d862cf48ab48d178b7388f32b6006441fdeb068151b3bbed595_NeikiAnalytics.exe
-
Size
104KB
-
MD5
b41211257f9a9e5844f9ed83a446cd50
-
SHA1
5a35698461e9b25e323707754bb9bba3baa9066f
-
SHA256
315e96e31d8f2d862cf48ab48d178b7388f32b6006441fdeb068151b3bbed595
-
SHA512
6d9c44219a4d4a4df0a0cf65fa3f74be80b68988996345e228f844f91736d5f438fb648a537ec78f71c7b73f9837f36f2cb022485ddb44d27c5422c9e5b63bf6
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFbUZJjw5Ivov1d3ZdpQm6hRw:9hOmTsF93UYfwC6GIoutz5yLpRDN6hRw
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2208-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/764-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1620-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1944-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/632-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/820-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/772-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1336-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/916-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1504-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-329-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2860-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1284-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/588-789-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-827-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3012-892-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-899-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-960-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2208 nnnthn.exe 2356 vpppj.exe 2524 pdppd.exe 2580 hhtbhb.exe 2584 vpddd.exe 1620 pdjjj.exe 2456 lffxlxr.exe 2604 nbbbtn.exe 2508 vpjdj.exe 1936 1vjpp.exe 2716 7xlfllr.exe 2940 thhhtn.exe 1944 bnnhbb.exe 1632 7dpdp.exe 1908 rllxlrf.exe 1628 9nbbbb.exe 2760 nbtbnt.exe 908 ddddp.exe 632 9rllfrx.exe 820 ffrxxlr.exe 2064 nnhhtb.exe 2664 bnttbh.exe 2212 1ddvp.exe 772 lrxlrfx.exe 816 nnhhnn.exe 2112 pjvdj.exe 1336 9lxxllx.exe 1328 fxllrxf.exe 916 9htbnt.exe 1696 thhhbt.exe 2912 dvpjv.exe 1504 lffxlxx.exe 2396 7bbbnn.exe 1648 httbbt.exe 2192 9djvj.exe 2352 vjvpp.exe 2708 lxrxlxf.exe 2536 ffrlxxf.exe 2628 htnhht.exe 2868 tnnthh.exe 2860 pdjpp.exe 2468 1djpp.exe 2688 rrllrfr.exe 1044 7rfxrrx.exe 2444 btbhtb.exe 1688 3tbbnt.exe 2960 vpjdp.exe 1564 dvjjd.exe 2836 rrrrxrl.exe 3040 thhhtb.exe 2532 btbhnh.exe 1636 7pdpv.exe 1036 xlrrxrr.exe 2768 rffffxf.exe 1652 btbhbb.exe 2732 9htnbb.exe 2772 djdjv.exe 1004 5lxfflr.exe 1192 7llxlrr.exe 1284 fxlfffl.exe 2248 bnbbbt.exe 2216 httbbb.exe 2888 7vpvd.exe 1396 vvjvd.exe -
resource yara_rule behavioral1/memory/764-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000013417-5.dat upx behavioral1/memory/2208-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/764-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0034000000013a53-18.dat upx behavioral1/memory/2356-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014183-26.dat upx behavioral1/memory/2524-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001418c-37.dat upx behavioral1/memory/2524-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2580-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014251-44.dat upx behavioral1/memory/2580-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2584-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001431b-56.dat upx behavioral1/memory/2584-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1620-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000014367-64.dat upx behavioral1/memory/1620-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2456-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014a60-75.dat upx behavioral1/memory/2604-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014b1c-83.dat upx behavioral1/memory/2604-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014bd7-94.dat upx behavioral1/memory/2508-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1936-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014c2d-101.dat upx behavioral1/files/0x0006000000014f57-111.dat upx behavioral1/files/0x000600000001507a-117.dat upx behavioral1/memory/2940-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1944-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015083-129.dat upx behavioral1/memory/1944-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1632-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000150d9-136.dat upx behavioral1/memory/1908-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000153ee-147.dat upx behavioral1/memory/1628-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001565a-155.dat upx behavioral1/memory/1628-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015662-164.dat upx behavioral1/files/0x00060000000158d9-173.dat upx behavioral1/files/0x0006000000015ae3-183.dat upx behavioral1/memory/632-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015b50-190.dat upx behavioral1/memory/820-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2064-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015b85-200.dat upx behavioral1/files/0x0006000000015c9a-208.dat upx behavioral1/files/0x0006000000015ca8-217.dat upx behavioral1/memory/772-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cb1-224.dat upx behavioral1/files/0x0006000000015cc5-234.dat upx behavioral1/memory/2112-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cd2-243.dat upx behavioral1/memory/1336-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015ce3-252.dat upx behavioral1/files/0x0006000000015cee-260.dat upx behavioral1/memory/916-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cf8-270.dat upx behavioral1/memory/916-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1696-278-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 764 wrote to memory of 2208 764 315e96e31d8f2d862cf48ab48d178b7388f32b6006441fdeb068151b3bbed595_NeikiAnalytics.exe 28 PID 764 wrote to memory of 2208 764 315e96e31d8f2d862cf48ab48d178b7388f32b6006441fdeb068151b3bbed595_NeikiAnalytics.exe 28 PID 764 wrote to memory of 2208 764 315e96e31d8f2d862cf48ab48d178b7388f32b6006441fdeb068151b3bbed595_NeikiAnalytics.exe 28 PID 764 wrote to memory of 2208 764 315e96e31d8f2d862cf48ab48d178b7388f32b6006441fdeb068151b3bbed595_NeikiAnalytics.exe 28 PID 2208 wrote to memory of 2356 2208 nnnthn.exe 29 PID 2208 wrote to memory of 2356 2208 nnnthn.exe 29 PID 2208 wrote to memory of 2356 2208 nnnthn.exe 29 PID 2208 wrote to memory of 2356 2208 nnnthn.exe 29 PID 2356 wrote to memory of 2524 2356 vpppj.exe 30 PID 2356 wrote to memory of 2524 2356 vpppj.exe 30 PID 2356 wrote to memory of 2524 2356 vpppj.exe 30 PID 2356 wrote to memory of 2524 2356 vpppj.exe 30 PID 2524 wrote to memory of 2580 2524 pdppd.exe 31 PID 2524 wrote to memory of 2580 2524 pdppd.exe 31 PID 2524 wrote to memory of 2580 2524 pdppd.exe 31 PID 2524 wrote to memory of 2580 2524 pdppd.exe 31 PID 2580 wrote to memory of 2584 2580 hhtbhb.exe 32 PID 2580 wrote to memory of 2584 2580 hhtbhb.exe 32 PID 2580 wrote to memory of 2584 2580 hhtbhb.exe 32 PID 2580 wrote to memory of 2584 2580 hhtbhb.exe 32 PID 2584 wrote to memory of 1620 2584 vpddd.exe 33 PID 2584 wrote to memory of 1620 2584 vpddd.exe 33 PID 2584 wrote to memory of 1620 2584 vpddd.exe 33 PID 2584 wrote to memory of 1620 2584 vpddd.exe 33 PID 1620 wrote to memory of 2456 1620 pdjjj.exe 34 PID 1620 wrote to memory of 2456 1620 pdjjj.exe 34 PID 1620 wrote to memory of 2456 1620 pdjjj.exe 34 PID 1620 wrote to memory of 2456 1620 pdjjj.exe 34 PID 2456 wrote to memory of 2604 2456 lffxlxr.exe 35 PID 2456 wrote to memory of 2604 2456 lffxlxr.exe 35 PID 2456 wrote to memory of 2604 2456 lffxlxr.exe 35 PID 2456 wrote to memory of 2604 2456 lffxlxr.exe 35 PID 2604 wrote to memory of 2508 2604 nbbbtn.exe 36 PID 2604 wrote to memory of 2508 2604 nbbbtn.exe 36 PID 2604 wrote to memory of 2508 2604 nbbbtn.exe 36 PID 2604 wrote to memory of 2508 2604 nbbbtn.exe 36 PID 2508 wrote to memory of 1936 2508 vpjdj.exe 37 PID 2508 wrote to memory of 1936 2508 vpjdj.exe 37 PID 2508 wrote to memory of 1936 2508 vpjdj.exe 37 PID 2508 wrote to memory of 1936 2508 vpjdj.exe 37 PID 1936 wrote to memory of 2716 1936 1vjpp.exe 38 PID 1936 wrote to memory of 2716 1936 1vjpp.exe 38 PID 1936 wrote to memory of 2716 1936 1vjpp.exe 38 PID 1936 wrote to memory of 2716 1936 1vjpp.exe 38 PID 2716 wrote to memory of 2940 2716 7xlfllr.exe 39 PID 2716 wrote to memory of 2940 2716 7xlfllr.exe 39 PID 2716 wrote to memory of 2940 2716 7xlfllr.exe 39 PID 2716 wrote to memory of 2940 2716 7xlfllr.exe 39 PID 2940 wrote to memory of 1944 2940 thhhtn.exe 40 PID 2940 wrote to memory of 1944 2940 thhhtn.exe 40 PID 2940 wrote to memory of 1944 2940 thhhtn.exe 40 PID 2940 wrote to memory of 1944 2940 thhhtn.exe 40 PID 1944 wrote to memory of 1632 1944 bnnhbb.exe 41 PID 1944 wrote to memory of 1632 1944 bnnhbb.exe 41 PID 1944 wrote to memory of 1632 1944 bnnhbb.exe 41 PID 1944 wrote to memory of 1632 1944 bnnhbb.exe 41 PID 1632 wrote to memory of 1908 1632 7dpdp.exe 42 PID 1632 wrote to memory of 1908 1632 7dpdp.exe 42 PID 1632 wrote to memory of 1908 1632 7dpdp.exe 42 PID 1632 wrote to memory of 1908 1632 7dpdp.exe 42 PID 1908 wrote to memory of 1628 1908 rllxlrf.exe 43 PID 1908 wrote to memory of 1628 1908 rllxlrf.exe 43 PID 1908 wrote to memory of 1628 1908 rllxlrf.exe 43 PID 1908 wrote to memory of 1628 1908 rllxlrf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\315e96e31d8f2d862cf48ab48d178b7388f32b6006441fdeb068151b3bbed595_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\315e96e31d8f2d862cf48ab48d178b7388f32b6006441fdeb068151b3bbed595_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\nnnthn.exec:\nnnthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\vpppj.exec:\vpppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\pdppd.exec:\pdppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\hhtbhb.exec:\hhtbhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\vpddd.exec:\vpddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\pdjjj.exec:\pdjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\lffxlxr.exec:\lffxlxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\nbbbtn.exec:\nbbbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\vpjdj.exec:\vpjdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\1vjpp.exec:\1vjpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\7xlfllr.exec:\7xlfllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\thhhtn.exec:\thhhtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\bnnhbb.exec:\bnnhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\7dpdp.exec:\7dpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\rllxlrf.exec:\rllxlrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\9nbbbb.exec:\9nbbbb.exe17⤵
- Executes dropped EXE
PID:1628 -
\??\c:\nbtbnt.exec:\nbtbnt.exe18⤵
- Executes dropped EXE
PID:2760 -
\??\c:\ddddp.exec:\ddddp.exe19⤵
- Executes dropped EXE
PID:908 -
\??\c:\9rllfrx.exec:\9rllfrx.exe20⤵
- Executes dropped EXE
PID:632 -
\??\c:\ffrxxlr.exec:\ffrxxlr.exe21⤵
- Executes dropped EXE
PID:820 -
\??\c:\nnhhtb.exec:\nnhhtb.exe22⤵
- Executes dropped EXE
PID:2064 -
\??\c:\bnttbh.exec:\bnttbh.exe23⤵
- Executes dropped EXE
PID:2664 -
\??\c:\1ddvp.exec:\1ddvp.exe24⤵
- Executes dropped EXE
PID:2212 -
\??\c:\lrxlrfx.exec:\lrxlrfx.exe25⤵
- Executes dropped EXE
PID:772 -
\??\c:\nnhhnn.exec:\nnhhnn.exe26⤵
- Executes dropped EXE
PID:816 -
\??\c:\pjvdj.exec:\pjvdj.exe27⤵
- Executes dropped EXE
PID:2112 -
\??\c:\9lxxllx.exec:\9lxxllx.exe28⤵
- Executes dropped EXE
PID:1336 -
\??\c:\fxllrxf.exec:\fxllrxf.exe29⤵
- Executes dropped EXE
PID:1328 -
\??\c:\9htbnt.exec:\9htbnt.exe30⤵
- Executes dropped EXE
PID:916 -
\??\c:\thhhbt.exec:\thhhbt.exe31⤵
- Executes dropped EXE
PID:1696 -
\??\c:\dvpjv.exec:\dvpjv.exe32⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lffxlxx.exec:\lffxlxx.exe33⤵
- Executes dropped EXE
PID:1504 -
\??\c:\7bbbnn.exec:\7bbbnn.exe34⤵
- Executes dropped EXE
PID:2396 -
\??\c:\httbbt.exec:\httbbt.exe35⤵
- Executes dropped EXE
PID:1648 -
\??\c:\9djvj.exec:\9djvj.exe36⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vjvpp.exec:\vjvpp.exe37⤵
- Executes dropped EXE
PID:2352 -
\??\c:\lxrxlxf.exec:\lxrxlxf.exe38⤵
- Executes dropped EXE
PID:2708 -
\??\c:\ffrlxxf.exec:\ffrlxxf.exe39⤵
- Executes dropped EXE
PID:2536 -
\??\c:\htnhht.exec:\htnhht.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\tnnthh.exec:\tnnthh.exe41⤵
- Executes dropped EXE
PID:2868 -
\??\c:\pdjpp.exec:\pdjpp.exe42⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1djpp.exec:\1djpp.exe43⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rrllrfr.exec:\rrllrfr.exe44⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7rfxrrx.exec:\7rfxrrx.exe45⤵
- Executes dropped EXE
PID:1044 -
\??\c:\btbhtb.exec:\btbhtb.exe46⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3tbbnt.exec:\3tbbnt.exe47⤵
- Executes dropped EXE
PID:1688 -
\??\c:\vpjdp.exec:\vpjdp.exe48⤵
- Executes dropped EXE
PID:2960 -
\??\c:\dvjjd.exec:\dvjjd.exe49⤵
- Executes dropped EXE
PID:1564 -
\??\c:\rrrrxrl.exec:\rrrrxrl.exe50⤵
- Executes dropped EXE
PID:2836 -
\??\c:\thhhtb.exec:\thhhtb.exe51⤵
- Executes dropped EXE
PID:3040 -
\??\c:\btbhnh.exec:\btbhnh.exe52⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7pdpv.exec:\7pdpv.exe53⤵
- Executes dropped EXE
PID:1636 -
\??\c:\xlrrxrr.exec:\xlrrxrr.exe54⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rffffxf.exec:\rffffxf.exe55⤵
- Executes dropped EXE
PID:2768 -
\??\c:\btbhbb.exec:\btbhbb.exe56⤵
- Executes dropped EXE
PID:1652 -
\??\c:\9htnbb.exec:\9htnbb.exe57⤵
- Executes dropped EXE
PID:2732 -
\??\c:\djdjv.exec:\djdjv.exe58⤵
- Executes dropped EXE
PID:2772 -
\??\c:\5lxfflr.exec:\5lxfflr.exe59⤵
- Executes dropped EXE
PID:1004 -
\??\c:\7llxlrr.exec:\7llxlrr.exe60⤵
- Executes dropped EXE
PID:1192 -
\??\c:\fxlfffl.exec:\fxlfffl.exe61⤵
- Executes dropped EXE
PID:1284 -
\??\c:\bnbbbt.exec:\bnbbbt.exe62⤵
- Executes dropped EXE
PID:2248 -
\??\c:\httbbb.exec:\httbbb.exe63⤵
- Executes dropped EXE
PID:2216 -
\??\c:\7vpvd.exec:\7vpvd.exe64⤵
- Executes dropped EXE
PID:2888 -
\??\c:\vvjvd.exec:\vvjvd.exe65⤵
- Executes dropped EXE
PID:1396 -
\??\c:\5fxxfxf.exec:\5fxxfxf.exe66⤵PID:480
-
\??\c:\7xrrfrx.exec:\7xrrfrx.exe67⤵PID:1484
-
\??\c:\xlflxlx.exec:\xlflxlx.exe68⤵PID:1856
-
\??\c:\bhthhh.exec:\bhthhh.exe69⤵PID:288
-
\??\c:\nhhntn.exec:\nhhntn.exe70⤵PID:1056
-
\??\c:\vjpvv.exec:\vjpvv.exe71⤵PID:612
-
\??\c:\3jvvp.exec:\3jvvp.exe72⤵PID:1276
-
\??\c:\9rlrrrf.exec:\9rlrrrf.exe73⤵PID:2100
-
\??\c:\lfxxfxx.exec:\lfxxfxx.exe74⤵PID:1736
-
\??\c:\nhtthn.exec:\nhtthn.exe75⤵PID:792
-
\??\c:\9htbhn.exec:\9htbhn.exe76⤵PID:2336
-
\??\c:\vpvdv.exec:\vpvdv.exe77⤵PID:2912
-
\??\c:\3jvjj.exec:\3jvjj.exe78⤵PID:2896
-
\??\c:\lxrxllr.exec:\lxrxllr.exe79⤵PID:2176
-
\??\c:\rlrxrrx.exec:\rlrxrrx.exe80⤵PID:1604
-
\??\c:\tnnthn.exec:\tnnthn.exe81⤵PID:2208
-
\??\c:\1tnttt.exec:\1tnttt.exe82⤵PID:2364
-
\??\c:\djpdd.exec:\djpdd.exe83⤵PID:2352
-
\??\c:\rfllffx.exec:\rfllffx.exe84⤵PID:1144
-
\??\c:\lfxffff.exec:\lfxffff.exe85⤵PID:2536
-
\??\c:\frfrxfr.exec:\frfrxfr.exe86⤵PID:2700
-
\??\c:\hbhbhb.exec:\hbhbhb.exe87⤵PID:2868
-
\??\c:\tnthhb.exec:\tnthhb.exe88⤵PID:2748
-
\??\c:\pjvpd.exec:\pjvpd.exe89⤵PID:2556
-
\??\c:\pdjjv.exec:\pdjjv.exe90⤵PID:2688
-
\??\c:\5rlrrll.exec:\5rlrrll.exe91⤵PID:1044
-
\??\c:\7xflllx.exec:\7xflllx.exe92⤵PID:2944
-
\??\c:\rrxxxxf.exec:\rrxxxxf.exe93⤵PID:1684
-
\??\c:\nhnhnh.exec:\nhnhnh.exe94⤵PID:1600
-
\??\c:\hhnhtb.exec:\hhnhtb.exe95⤵PID:2832
-
\??\c:\vjjvd.exec:\vjjvd.exe96⤵PID:1392
-
\??\c:\ppdpp.exec:\ppdpp.exe97⤵PID:2720
-
\??\c:\fxfllff.exec:\fxfllff.exe98⤵PID:1912
-
\??\c:\3rllrrr.exec:\3rllrrr.exe99⤵PID:2324
-
\??\c:\nththh.exec:\nththh.exe100⤵PID:1528
-
\??\c:\nhbnnn.exec:\nhbnnn.exe101⤵PID:1432
-
\??\c:\pjppd.exec:\pjppd.exe102⤵PID:2752
-
\??\c:\jvddp.exec:\jvddp.exe103⤵PID:2780
-
\??\c:\pdjpv.exec:\pdjpv.exe104⤵PID:1312
-
\??\c:\xrxfrxf.exec:\xrxfrxf.exe105⤵PID:1204
-
\??\c:\hbbbtn.exec:\hbbbtn.exe106⤵PID:1904
-
\??\c:\3tbhhn.exec:\3tbhhn.exe107⤵PID:1692
-
\??\c:\1hhbht.exec:\1hhbht.exe108⤵PID:2272
-
\??\c:\djdpp.exec:\djdpp.exe109⤵PID:2064
-
\??\c:\pjdvp.exec:\pjdvp.exe110⤵PID:2876
-
\??\c:\5fxxfxx.exec:\5fxxfxx.exe111⤵PID:1252
-
\??\c:\ffxxrrl.exec:\ffxxrrl.exe112⤵PID:588
-
\??\c:\tbnnnh.exec:\tbnnnh.exe113⤵PID:1488
-
\??\c:\btttnn.exec:\btttnn.exe114⤵PID:692
-
\??\c:\djvvd.exec:\djvvd.exe115⤵PID:816
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe116⤵PID:1352
-
\??\c:\xrffrlr.exec:\xrffrlr.exe117⤵PID:2608
-
\??\c:\bbthhb.exec:\bbthhb.exe118⤵PID:1276
-
\??\c:\tbthht.exec:\tbthht.exe119⤵PID:2100
-
\??\c:\dvpdv.exec:\dvpdv.exe120⤵PID:552
-
\??\c:\vppvp.exec:\vppvp.exe121⤵PID:1776
-
\??\c:\llfrxfx.exec:\llfrxfx.exe122⤵PID:1664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-