Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
30/06/2024, 21:47
Behavioral task
behavioral1
Sample
1c8b1690cf1b4ce4004e120f8f634507d7cdde0e33e5c22072c207c8dc191b54_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
1c8b1690cf1b4ce4004e120f8f634507d7cdde0e33e5c22072c207c8dc191b54_NeikiAnalytics.exe
-
Size
234KB
-
MD5
6186641f31b66060ed80257a9e30ec90
-
SHA1
e53f3be89641de8cacf5f27e05e7899e4775be11
-
SHA256
1c8b1690cf1b4ce4004e120f8f634507d7cdde0e33e5c22072c207c8dc191b54
-
SHA512
ca33f9a18c3bc47e6158d6233192b930d01e60201aac229f44fc4ac22e204ddc5efc75071be859e0001254b3b549e24282730a97d1e54496009cc8bd88b682da
-
SSDEEP
6144:kcm4FmowdHoSSGpJw4PqhraHcpOmFTHDGYhEf5X2aD:y4wFHoSSGpJwGeeFmFTNAp2+
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2960-1-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2200-17-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2724-27-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2076-37-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2692-45-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/3004-53-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1992-63-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2808-72-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2620-81-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2524-90-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2092-99-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2744-107-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2816-116-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/3064-125-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2100-134-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1196-152-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2432-169-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2632-179-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/696-188-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1856-205-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2412-220-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/312-264-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1520-289-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1712-302-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2460-381-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2524-394-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1428-422-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1432-429-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1272-436-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2748-455-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2068-469-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/668-488-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/284-514-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2440-660-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2504-704-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2368-831-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2832-881-0x0000000000220000-0x0000000000257000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2200 5vjvp.exe 2724 lffllfr.exe 2076 jvdpd.exe 2692 5lfrfrx.exe 3004 tbttbb.exe 1992 3pppp.exe 2808 xrlxlxf.exe 2620 hnhbtt.exe 2524 vdpvv.exe 2092 lrfxffl.exe 2744 tttbnt.exe 2816 jvvvj.exe 3064 rlxfxlr.exe 2100 hnbnnh.exe 1552 pjdpd.exe 308 xxrxflr.exe 1196 3hthnb.exe 2432 dpjjp.exe 1448 rlffrfx.exe 2632 thbnbt.exe 696 jdpjp.exe 712 xxxlrxl.exe 1856 hhbnhb.exe 2412 vpjjj.exe 452 xxxfrxr.exe 2004 nnbhtt.exe 1568 ppjdv.exe 1636 7jpdp.exe 312 xrfrrrr.exe 2016 bbtbnn.exe 2188 ddpvj.exe 2848 flrrrll.exe 1520 bbbnth.exe 1712 jvpvd.exe 2040 lxrxxrx.exe 1248 ttthhn.exe 1724 ttnthn.exe 2540 ppjpp.exe 2168 rlflflf.exe 2672 xlrfrrx.exe 2652 bbbnbn.exe 2676 1vvjj.exe 2608 7lrrxfl.exe 2968 lrrfrfx.exe 2560 7hbhbt.exe 2460 jpjvv.exe 2928 pjdjp.exe 2524 rxxrxlf.exe 2760 tbhbbn.exe 2784 ttbttb.exe 2900 dpjdj.exe 1428 rrrffrr.exe 2044 xrffffl.exe 1432 tbnhht.exe 1272 pvpdv.exe 2396 ffxfllx.exe 2748 nhbhbb.exe 2780 9bbhht.exe 1532 vdddv.exe 2068 lrxrxxx.exe 2544 nhnbth.exe 656 nhbhbh.exe 668 vdppj.exe 3024 fxrrllx.exe -
resource yara_rule behavioral1/memory/2960-1-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x000d000000014713-5.dat upx behavioral1/memory/2200-8-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x002e000000014c2d-19.dat upx behavioral1/memory/2724-18-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2200-17-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x00080000000153ee-25.dat upx behavioral1/memory/2724-27-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2076-28-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x000700000001565a-36.dat upx behavioral1/memory/2076-37-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2692-45-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0007000000015662-44.dat upx behavioral1/files/0x00070000000158d9-54.dat upx behavioral1/memory/3004-53-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0007000000015ae3-60.dat upx behavioral1/memory/1992-63-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0009000000015c9a-70.dat upx behavioral1/memory/2808-72-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0007000000015d85-79.dat upx behavioral1/memory/2620-81-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000015d9c-91.dat upx behavioral1/memory/2524-90-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000015f23-97.dat upx behavioral1/memory/2092-99-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000015fa6-108.dat upx behavioral1/memory/2744-107-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016013-115.dat upx behavioral1/memory/2816-116-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016122-123.dat upx behavioral1/memory/3064-125-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x00060000000161ee-131.dat upx behavioral1/memory/2100-134-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x00060000000163eb-141.dat upx behavioral1/files/0x00060000000164ec-149.dat upx behavioral1/memory/1196-152-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016575-159.dat upx behavioral1/memory/2432-160-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x00060000000167bf-167.dat upx behavioral1/memory/2432-169-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016a28-177.dat upx behavioral1/memory/2632-179-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016c1f-186.dat upx behavioral1/memory/696-188-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016c30-195.dat upx behavioral1/files/0x002e000000014f57-203.dat upx behavioral1/memory/1856-205-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016c38-212.dat upx behavioral1/memory/2412-220-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016c84-221.dat upx behavioral1/files/0x0006000000016cb5-229.dat upx behavioral1/files/0x0006000000016ce0-236.dat upx behavioral1/memory/1636-246-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016ced-245.dat upx behavioral1/memory/312-256-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016cf3-255.dat upx behavioral1/memory/312-264-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000016cfd-263.dat upx behavioral1/files/0x0006000000016d06-272.dat upx behavioral1/files/0x0006000000016d10-280.dat upx behavioral1/memory/2848-281-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/1520-289-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/1712-302-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/1248-309-0x0000000000400000-0x0000000000437000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2200 2960 1c8b1690cf1b4ce4004e120f8f634507d7cdde0e33e5c22072c207c8dc191b54_NeikiAnalytics.exe 28 PID 2960 wrote to memory of 2200 2960 1c8b1690cf1b4ce4004e120f8f634507d7cdde0e33e5c22072c207c8dc191b54_NeikiAnalytics.exe 28 PID 2960 wrote to memory of 2200 2960 1c8b1690cf1b4ce4004e120f8f634507d7cdde0e33e5c22072c207c8dc191b54_NeikiAnalytics.exe 28 PID 2960 wrote to memory of 2200 2960 1c8b1690cf1b4ce4004e120f8f634507d7cdde0e33e5c22072c207c8dc191b54_NeikiAnalytics.exe 28 PID 2200 wrote to memory of 2724 2200 5vjvp.exe 29 PID 2200 wrote to memory of 2724 2200 5vjvp.exe 29 PID 2200 wrote to memory of 2724 2200 5vjvp.exe 29 PID 2200 wrote to memory of 2724 2200 5vjvp.exe 29 PID 2724 wrote to memory of 2076 2724 lffllfr.exe 30 PID 2724 wrote to memory of 2076 2724 lffllfr.exe 30 PID 2724 wrote to memory of 2076 2724 lffllfr.exe 30 PID 2724 wrote to memory of 2076 2724 lffllfr.exe 30 PID 2076 wrote to memory of 2692 2076 jvdpd.exe 31 PID 2076 wrote to memory of 2692 2076 jvdpd.exe 31 PID 2076 wrote to memory of 2692 2076 jvdpd.exe 31 PID 2076 wrote to memory of 2692 2076 jvdpd.exe 31 PID 2692 wrote to memory of 3004 2692 5lfrfrx.exe 32 PID 2692 wrote to memory of 3004 2692 5lfrfrx.exe 32 PID 2692 wrote to memory of 3004 2692 5lfrfrx.exe 32 PID 2692 wrote to memory of 3004 2692 5lfrfrx.exe 32 PID 3004 wrote to memory of 1992 3004 tbttbb.exe 33 PID 3004 wrote to memory of 1992 3004 tbttbb.exe 33 PID 3004 wrote to memory of 1992 3004 tbttbb.exe 33 PID 3004 wrote to memory of 1992 3004 tbttbb.exe 33 PID 1992 wrote to memory of 2808 1992 3pppp.exe 34 PID 1992 wrote to memory of 2808 1992 3pppp.exe 34 PID 1992 wrote to memory of 2808 1992 3pppp.exe 34 PID 1992 wrote to memory of 2808 1992 3pppp.exe 34 PID 2808 wrote to memory of 2620 2808 xrlxlxf.exe 35 PID 2808 wrote to memory of 2620 2808 xrlxlxf.exe 35 PID 2808 wrote to memory of 2620 2808 xrlxlxf.exe 35 PID 2808 wrote to memory of 2620 2808 xrlxlxf.exe 35 PID 2620 wrote to memory of 2524 2620 hnhbtt.exe 36 PID 2620 wrote to memory of 2524 2620 hnhbtt.exe 36 PID 2620 wrote to memory of 2524 2620 hnhbtt.exe 36 PID 2620 wrote to memory of 2524 2620 hnhbtt.exe 36 PID 2524 wrote to memory of 2092 2524 vdpvv.exe 37 PID 2524 wrote to memory of 2092 2524 vdpvv.exe 37 PID 2524 wrote to memory of 2092 2524 vdpvv.exe 37 PID 2524 wrote to memory of 2092 2524 vdpvv.exe 37 PID 2092 wrote to memory of 2744 2092 lrfxffl.exe 38 PID 2092 wrote to memory of 2744 2092 lrfxffl.exe 38 PID 2092 wrote to memory of 2744 2092 lrfxffl.exe 38 PID 2092 wrote to memory of 2744 2092 lrfxffl.exe 38 PID 2744 wrote to memory of 2816 2744 tttbnt.exe 39 PID 2744 wrote to memory of 2816 2744 tttbnt.exe 39 PID 2744 wrote to memory of 2816 2744 tttbnt.exe 39 PID 2744 wrote to memory of 2816 2744 tttbnt.exe 39 PID 2816 wrote to memory of 3064 2816 jvvvj.exe 40 PID 2816 wrote to memory of 3064 2816 jvvvj.exe 40 PID 2816 wrote to memory of 3064 2816 jvvvj.exe 40 PID 2816 wrote to memory of 3064 2816 jvvvj.exe 40 PID 3064 wrote to memory of 2100 3064 rlxfxlr.exe 41 PID 3064 wrote to memory of 2100 3064 rlxfxlr.exe 41 PID 3064 wrote to memory of 2100 3064 rlxfxlr.exe 41 PID 3064 wrote to memory of 2100 3064 rlxfxlr.exe 41 PID 2100 wrote to memory of 1552 2100 hnbnnh.exe 42 PID 2100 wrote to memory of 1552 2100 hnbnnh.exe 42 PID 2100 wrote to memory of 1552 2100 hnbnnh.exe 42 PID 2100 wrote to memory of 1552 2100 hnbnnh.exe 42 PID 1552 wrote to memory of 308 1552 pjdpd.exe 43 PID 1552 wrote to memory of 308 1552 pjdpd.exe 43 PID 1552 wrote to memory of 308 1552 pjdpd.exe 43 PID 1552 wrote to memory of 308 1552 pjdpd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c8b1690cf1b4ce4004e120f8f634507d7cdde0e33e5c22072c207c8dc191b54_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1c8b1690cf1b4ce4004e120f8f634507d7cdde0e33e5c22072c207c8dc191b54_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\5vjvp.exec:\5vjvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\lffllfr.exec:\lffllfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\jvdpd.exec:\jvdpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\5lfrfrx.exec:\5lfrfrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\tbttbb.exec:\tbttbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\3pppp.exec:\3pppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\xrlxlxf.exec:\xrlxlxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\hnhbtt.exec:\hnhbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\vdpvv.exec:\vdpvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\lrfxffl.exec:\lrfxffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\tttbnt.exec:\tttbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\jvvvj.exec:\jvvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\rlxfxlr.exec:\rlxfxlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\hnbnnh.exec:\hnbnnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\pjdpd.exec:\pjdpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\xxrxflr.exec:\xxrxflr.exe17⤵
- Executes dropped EXE
PID:308 -
\??\c:\3hthnb.exec:\3hthnb.exe18⤵
- Executes dropped EXE
PID:1196 -
\??\c:\dpjjp.exec:\dpjjp.exe19⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rlffrfx.exec:\rlffrfx.exe20⤵
- Executes dropped EXE
PID:1448 -
\??\c:\thbnbt.exec:\thbnbt.exe21⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jdpjp.exec:\jdpjp.exe22⤵
- Executes dropped EXE
PID:696 -
\??\c:\xxxlrxl.exec:\xxxlrxl.exe23⤵
- Executes dropped EXE
PID:712 -
\??\c:\hhbnhb.exec:\hhbnhb.exe24⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vpjjj.exec:\vpjjj.exe25⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xxxfrxr.exec:\xxxfrxr.exe26⤵
- Executes dropped EXE
PID:452 -
\??\c:\nnbhtt.exec:\nnbhtt.exe27⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ppjdv.exec:\ppjdv.exe28⤵
- Executes dropped EXE
PID:1568 -
\??\c:\7jpdp.exec:\7jpdp.exe29⤵
- Executes dropped EXE
PID:1636 -
\??\c:\xrfrrrr.exec:\xrfrrrr.exe30⤵
- Executes dropped EXE
PID:312 -
\??\c:\bbtbnn.exec:\bbtbnn.exe31⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ddpvj.exec:\ddpvj.exe32⤵
- Executes dropped EXE
PID:2188 -
\??\c:\flrrrll.exec:\flrrrll.exe33⤵
- Executes dropped EXE
PID:2848 -
\??\c:\bbbnth.exec:\bbbnth.exe34⤵
- Executes dropped EXE
PID:1520 -
\??\c:\jvpvd.exec:\jvpvd.exe35⤵
- Executes dropped EXE
PID:1712 -
\??\c:\lxrxxrx.exec:\lxrxxrx.exe36⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ttthhn.exec:\ttthhn.exe37⤵
- Executes dropped EXE
PID:1248 -
\??\c:\ttnthn.exec:\ttnthn.exe38⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ppjpp.exec:\ppjpp.exe39⤵
- Executes dropped EXE
PID:2540 -
\??\c:\rlflflf.exec:\rlflflf.exe40⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xlrfrrx.exec:\xlrfrrx.exe41⤵
- Executes dropped EXE
PID:2672 -
\??\c:\bbbnbn.exec:\bbbnbn.exe42⤵
- Executes dropped EXE
PID:2652 -
\??\c:\1vvjj.exec:\1vvjj.exe43⤵
- Executes dropped EXE
PID:2676 -
\??\c:\7lrrxfl.exec:\7lrrxfl.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\lrrfrfx.exec:\lrrfrfx.exe45⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7hbhbt.exec:\7hbhbt.exe46⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jpjvv.exec:\jpjvv.exe47⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pjdjp.exec:\pjdjp.exe48⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rxxrxlf.exec:\rxxrxlf.exe49⤵
- Executes dropped EXE
PID:2524 -
\??\c:\tbhbbn.exec:\tbhbbn.exe50⤵
- Executes dropped EXE
PID:2760 -
\??\c:\ttbttb.exec:\ttbttb.exe51⤵
- Executes dropped EXE
PID:2784 -
\??\c:\dpjdj.exec:\dpjdj.exe52⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rrrffrr.exec:\rrrffrr.exe53⤵
- Executes dropped EXE
PID:1428 -
\??\c:\xrffffl.exec:\xrffffl.exe54⤵
- Executes dropped EXE
PID:2044 -
\??\c:\tbnhht.exec:\tbnhht.exe55⤵
- Executes dropped EXE
PID:1432 -
\??\c:\pvpdv.exec:\pvpdv.exe56⤵
- Executes dropped EXE
PID:1272 -
\??\c:\ffxfllx.exec:\ffxfllx.exe57⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nhbhbb.exec:\nhbhbb.exe58⤵
- Executes dropped EXE
PID:2748 -
\??\c:\9bbhht.exec:\9bbhht.exe59⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vdddv.exec:\vdddv.exe60⤵
- Executes dropped EXE
PID:1532 -
\??\c:\lrxrxxx.exec:\lrxrxxx.exe61⤵
- Executes dropped EXE
PID:2068 -
\??\c:\nhnbth.exec:\nhnbth.exe62⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nhbhbh.exec:\nhbhbh.exe63⤵
- Executes dropped EXE
PID:656 -
\??\c:\vdppj.exec:\vdppj.exe64⤵
- Executes dropped EXE
PID:668 -
\??\c:\fxrrllx.exec:\fxrrllx.exe65⤵
- Executes dropped EXE
PID:3024 -
\??\c:\llxxlrr.exec:\llxxlrr.exe66⤵PID:544
-
\??\c:\ttntnt.exec:\ttntnt.exe67⤵PID:284
-
\??\c:\dvdjd.exec:\dvdjd.exe68⤵PID:2412
-
\??\c:\vjjjd.exec:\vjjjd.exe69⤵PID:1744
-
\??\c:\lflxrrf.exec:\lflxrrf.exe70⤵PID:1544
-
\??\c:\bbtbtb.exec:\bbtbtb.exe71⤵PID:868
-
\??\c:\tbtttt.exec:\tbtttt.exe72⤵PID:1252
-
\??\c:\pjvdp.exec:\pjvdp.exe73⤵PID:1308
-
\??\c:\7xrrfll.exec:\7xrrfll.exe74⤵PID:912
-
\??\c:\hhhtbt.exec:\hhhtbt.exe75⤵PID:2160
-
\??\c:\nhthtb.exec:\nhthtb.exe76⤵PID:1692
-
\??\c:\vdvdj.exec:\vdvdj.exe77⤵PID:1156
-
\??\c:\fffxflr.exec:\fffxflr.exe78⤵PID:1796
-
\??\c:\xxfxrlx.exec:\xxfxrlx.exe79⤵PID:1520
-
\??\c:\thhnbb.exec:\thhnbb.exe80⤵PID:3000
-
\??\c:\9tnnbh.exec:\9tnnbh.exe81⤵PID:2372
-
\??\c:\frlrxxl.exec:\frlrxxl.exe82⤵PID:1588
-
\??\c:\xflrrrl.exec:\xflrrrl.exe83⤵PID:2880
-
\??\c:\hbhhtn.exec:\hbhhtn.exe84⤵PID:2112
-
\??\c:\jppjj.exec:\jppjj.exe85⤵PID:2660
-
\??\c:\xrlllxr.exec:\xrlllxr.exe86⤵PID:2552
-
\??\c:\3xrfxfl.exec:\3xrfxfl.exe87⤵PID:2684
-
\??\c:\ntbbnn.exec:\ntbbnn.exe88⤵PID:2840
-
\??\c:\vdjdp.exec:\vdjdp.exe89⤵PID:2708
-
\??\c:\rrxlrll.exec:\rrxlrll.exe90⤵PID:2680
-
\??\c:\7nnhnh.exec:\7nnhnh.exe91⤵PID:2440
-
\??\c:\vjdjj.exec:\vjdjj.exe92⤵PID:2444
-
\??\c:\pjdjp.exec:\pjdjp.exe93⤵PID:1728
-
\??\c:\rlflxlx.exec:\rlflxlx.exe94⤵PID:2924
-
\??\c:\xflxxxf.exec:\xflxxxf.exe95⤵PID:2624
-
\??\c:\tnntbh.exec:\tnntbh.exe96⤵PID:2740
-
\??\c:\vvpvj.exec:\vvpvj.exe97⤵PID:2792
-
\??\c:\pjjvd.exec:\pjjvd.exe98⤵PID:2504
-
\??\c:\xxrxrrf.exec:\xxrxrrf.exe99⤵PID:1928
-
\??\c:\hbntbn.exec:\hbntbn.exe100⤵PID:1924
-
\??\c:\bbthnh.exec:\bbthnh.exe101⤵PID:1552
-
\??\c:\dddpj.exec:\dddpj.exe102⤵PID:624
-
\??\c:\lrrllfx.exec:\lrrllfx.exe103⤵PID:2396
-
\??\c:\thbnht.exec:\thbnht.exe104⤵PID:876
-
\??\c:\pvvdp.exec:\pvvdp.exe105⤵PID:2780
-
\??\c:\vpjvv.exec:\vpjvv.exe106⤵PID:1448
-
\??\c:\rxrlrxf.exec:\rxrlrxf.exe107⤵PID:1988
-
\??\c:\5nntnb.exec:\5nntnb.exe108⤵PID:772
-
\??\c:\hhttbn.exec:\hhttbn.exe109⤵PID:552
-
\??\c:\ddvjj.exec:\ddvjj.exe110⤵PID:668
-
\??\c:\llxfxlr.exec:\llxfxlr.exe111⤵PID:3044
-
\??\c:\3xxlflx.exec:\3xxlflx.exe112⤵PID:544
-
\??\c:\5bbnnb.exec:\5bbnnb.exe113⤵PID:1296
-
\??\c:\5ddjj.exec:\5ddjj.exe114⤵PID:2196
-
\??\c:\5ppvd.exec:\5ppvd.exe115⤵PID:1392
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe116⤵PID:2004
-
\??\c:\xfxrrff.exec:\xfxrrff.exe117⤵PID:1660
-
\??\c:\nhbbhn.exec:\nhbbhn.exe118⤵PID:2368
-
\??\c:\jjdjd.exec:\jjdjd.exe119⤵PID:904
-
\??\c:\dvvjv.exec:\dvvjv.exe120⤵PID:2532
-
\??\c:\llfrfrl.exec:\llfrfrl.exe121⤵PID:1676
-
\??\c:\ntnbbn.exec:\ntnbbn.exe122⤵PID:1672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-