Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 21:56
Behavioral task
behavioral1
Sample
45ad003da58b4f8ecd9d574443dce020_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
45ad003da58b4f8ecd9d574443dce020_NeikiAnalytics.exe
-
Size
233KB
-
MD5
45ad003da58b4f8ecd9d574443dce020
-
SHA1
79feaf9f95cd5f35bc5e6378445f9db73154edf5
-
SHA256
4e8bf1c7e1ec9cbf4ab3fc8ad5d508ead2bfd791a797e33ba9372dc34b5bc8c9
-
SHA512
0c325c4ea53f063ab08ae5d06a0475a95c4d44d896980ff197a75b9ae12bfc9d0f49045a750553c7f683c6be6ddf636bf7d9c831b6686251e0ccf2c8685db387
-
SSDEEP
6144:kcm4FmowdHoSSGpJw4PqhraHcpOmFTHDGYhEf5X2a9E:y4wFHoSSGpJwGeeFmFTNAp2AE
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
Processes:
resource yara_rule behavioral1/memory/2228-8-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/776-11-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/3048-29-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/3056-39-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2284-50-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2652-48-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2720-60-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2724-74-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2444-84-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2608-92-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2220-102-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2796-113-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/548-130-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/908-139-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1784-141-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1532-151-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/552-175-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2904-207-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2104-226-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1796-223-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1772-243-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/280-275-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2056-290-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1724-297-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/3068-330-0x0000000000220000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/3068-331-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2436-385-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1756-437-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1532-457-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2988-476-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2920-567-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1208-636-0x00000000003C0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/2820-701-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2948-740-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1976-777-0x0000000000220000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/684-791-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tnbbbn.exelfxflrf.exetthnhh.exeddvjv.exe5xlffxx.exetnbhbb.exevpvdp.exedddvv.exexrflxxf.exetnhntb.exejdvdd.exexrxrxlr.exe9frlrrf.exebththn.exerrfxrxr.exexffxfrx.exehbthtb.exevpvdd.exexrlrxrr.exehbntbn.exe7pjjp.exe5jdpj.exexrlxxfl.exenhhhhn.exejdjpd.exetbhtbn.exejpjdd.exe7fxrffr.exehtttbn.exevdpvj.exe5xlrxlx.exe7nhhnt.exejdjjv.exe5dvjj.exefrxrfxx.exenntbtt.exevvvpj.exerxllrll.exehbtbhb.exenbbbbt.exejvdjv.exexrfxxfl.exefxfllxf.exehntttn.exejdvjv.exexxxflrf.exehtbtbt.exetbnthb.exeppjdd.exe5lrlrff.exe5lxxffx.exebhhhtn.exevvpdv.exeppdjv.exelrxxfxf.exebttbhn.exepvdvd.exevvpvj.exelfrxlrf.exe7llrflx.exebtthnb.exe7pvjv.exexrfrrrr.exetnnnbt.exepid process 776 tnbbbn.exe 3048 lfxflrf.exe 3056 tthnhh.exe 2652 ddvjv.exe 2284 5xlffxx.exe 2720 tnbhbb.exe 2724 vpvdp.exe 2444 dddvv.exe 2608 xrflxxf.exe 2220 tnhntb.exe 2752 jdvdd.exe 2796 xrxrxlr.exe 548 9frlrrf.exe 908 bththn.exe 1784 rrfxrxr.exe 1532 xffxfrx.exe 2708 hbthtb.exe 1356 vpvdd.exe 552 xrlrxrr.exe 2984 hbntbn.exe 2232 7pjjp.exe 2904 5jdpj.exe 540 xrlxxfl.exe 1796 nhhhhn.exe 2104 jdjpd.exe 2020 tbhtbn.exe 1772 jpjdd.exe 1060 7fxrffr.exe 1788 htttbn.exe 280 vdpvj.exe 1980 5xlrxlx.exe 2056 7nhhnt.exe 1724 jdjjv.exe 2396 5dvjj.exe 2740 frxrfxx.exe 1604 nntbtt.exe 2156 vvvpj.exe 3068 rxllrll.exe 3040 hbtbhb.exe 2580 nbbbbt.exe 2592 jvdjv.exe 3052 xrfxxfl.exe 2284 fxfllxf.exe 2660 hntttn.exe 2724 jdvjv.exe 2472 xxxflrf.exe 2436 htbtbt.exe 2064 tbnthb.exe 2792 ppjdd.exe 2804 5lrlrff.exe 1528 5lxxffx.exe 2864 bhhhtn.exe 1836 vvpdv.exe 1756 ppdjv.exe 1640 lrxxfxf.exe 2184 bttbhn.exe 1532 pvdvd.exe 2528 vvpvj.exe 1392 lfrxlrf.exe 2536 7llrflx.exe 2988 btthnb.exe 2900 7pvjv.exe 2424 xrfrrrr.exe 2908 tnnnbt.exe -
Processes:
resource yara_rule behavioral1/memory/2228-0-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2228-8-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\tnbbbn.exe upx behavioral1/memory/776-11-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/776-14-0x0000000000220000-0x0000000000257000-memory.dmp upx C:\lfxflrf.exe upx behavioral1/memory/3048-20-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\tthnhh.exe upx behavioral1/memory/3048-29-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/3056-30-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\ddvjv.exe upx behavioral1/memory/3056-39-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\5xlffxx.exe upx behavioral1/memory/2284-50-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2652-48-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\tnbhbb.exe upx behavioral1/memory/2720-60-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\vpvdp.exe upx C:\dddvv.exe upx behavioral1/memory/2724-74-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\xrflxxf.exe upx behavioral1/memory/2444-84-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2608-92-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\tnhntb.exe upx C:\jdvdd.exe upx behavioral1/memory/2220-102-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\xrxrxlr.exe upx behavioral1/memory/2796-113-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2752-106-0x0000000000250000-0x0000000000287000-memory.dmp upx C:\9frlrrf.exe upx behavioral1/memory/548-122-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\bththn.exe upx behavioral1/memory/548-130-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\rrfxrxr.exe upx behavioral1/memory/908-139-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/1784-141-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/1532-151-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\xffxfrx.exe upx C:\hbthtb.exe upx C:\vpvdd.exe upx C:\xrlrxrr.exe upx behavioral1/memory/552-175-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\hbntbn.exe upx C:\7pjjp.exe upx C:\5jdpj.exe upx C:\xrlxxfl.exe upx behavioral1/memory/2904-207-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\nhhhhn.exe upx \??\c:\jdjpd.exe upx behavioral1/memory/2104-226-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/1796-223-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\tbhtbn.exe upx C:\jpjdd.exe upx behavioral1/memory/1772-243-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\7fxrffr.exe upx C:\htttbn.exe upx C:\vdpvj.exe upx C:\5xlrxlx.exe upx behavioral1/memory/280-275-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\7nhhnt.exe upx behavioral1/memory/2056-290-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/1724-297-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2740-304-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2156-317-0x0000000000400000-0x0000000000437000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
45ad003da58b4f8ecd9d574443dce020_NeikiAnalytics.exetnbbbn.exelfxflrf.exetthnhh.exeddvjv.exe5xlffxx.exetnbhbb.exevpvdp.exedddvv.exexrflxxf.exetnhntb.exejdvdd.exexrxrxlr.exe9frlrrf.exebththn.exerrfxrxr.exedescription pid process target process PID 2228 wrote to memory of 776 2228 45ad003da58b4f8ecd9d574443dce020_NeikiAnalytics.exe tnbbbn.exe PID 2228 wrote to memory of 776 2228 45ad003da58b4f8ecd9d574443dce020_NeikiAnalytics.exe tnbbbn.exe PID 2228 wrote to memory of 776 2228 45ad003da58b4f8ecd9d574443dce020_NeikiAnalytics.exe tnbbbn.exe PID 2228 wrote to memory of 776 2228 45ad003da58b4f8ecd9d574443dce020_NeikiAnalytics.exe tnbbbn.exe PID 776 wrote to memory of 3048 776 tnbbbn.exe lfxflrf.exe PID 776 wrote to memory of 3048 776 tnbbbn.exe lfxflrf.exe PID 776 wrote to memory of 3048 776 tnbbbn.exe lfxflrf.exe PID 776 wrote to memory of 3048 776 tnbbbn.exe lfxflrf.exe PID 3048 wrote to memory of 3056 3048 lfxflrf.exe tthnhh.exe PID 3048 wrote to memory of 3056 3048 lfxflrf.exe tthnhh.exe PID 3048 wrote to memory of 3056 3048 lfxflrf.exe tthnhh.exe PID 3048 wrote to memory of 3056 3048 lfxflrf.exe tthnhh.exe PID 3056 wrote to memory of 2652 3056 tthnhh.exe ddvjv.exe PID 3056 wrote to memory of 2652 3056 tthnhh.exe ddvjv.exe PID 3056 wrote to memory of 2652 3056 tthnhh.exe ddvjv.exe PID 3056 wrote to memory of 2652 3056 tthnhh.exe ddvjv.exe PID 2652 wrote to memory of 2284 2652 ddvjv.exe 5xlffxx.exe PID 2652 wrote to memory of 2284 2652 ddvjv.exe 5xlffxx.exe PID 2652 wrote to memory of 2284 2652 ddvjv.exe 5xlffxx.exe PID 2652 wrote to memory of 2284 2652 ddvjv.exe 5xlffxx.exe PID 2284 wrote to memory of 2720 2284 5xlffxx.exe tnbhbb.exe PID 2284 wrote to memory of 2720 2284 5xlffxx.exe tnbhbb.exe PID 2284 wrote to memory of 2720 2284 5xlffxx.exe tnbhbb.exe PID 2284 wrote to memory of 2720 2284 5xlffxx.exe tnbhbb.exe PID 2720 wrote to memory of 2724 2720 tnbhbb.exe vpvdp.exe PID 2720 wrote to memory of 2724 2720 tnbhbb.exe vpvdp.exe PID 2720 wrote to memory of 2724 2720 tnbhbb.exe vpvdp.exe PID 2720 wrote to memory of 2724 2720 tnbhbb.exe vpvdp.exe PID 2724 wrote to memory of 2444 2724 vpvdp.exe dddvv.exe PID 2724 wrote to memory of 2444 2724 vpvdp.exe dddvv.exe PID 2724 wrote to memory of 2444 2724 vpvdp.exe dddvv.exe PID 2724 wrote to memory of 2444 2724 vpvdp.exe dddvv.exe PID 2444 wrote to memory of 2608 2444 dddvv.exe xrflxxf.exe PID 2444 wrote to memory of 2608 2444 dddvv.exe xrflxxf.exe PID 2444 wrote to memory of 2608 2444 dddvv.exe xrflxxf.exe PID 2444 wrote to memory of 2608 2444 dddvv.exe xrflxxf.exe PID 2608 wrote to memory of 2220 2608 xrflxxf.exe tnhntb.exe PID 2608 wrote to memory of 2220 2608 xrflxxf.exe tnhntb.exe PID 2608 wrote to memory of 2220 2608 xrflxxf.exe tnhntb.exe PID 2608 wrote to memory of 2220 2608 xrflxxf.exe tnhntb.exe PID 2220 wrote to memory of 2752 2220 tnhntb.exe jdvdd.exe PID 2220 wrote to memory of 2752 2220 tnhntb.exe jdvdd.exe PID 2220 wrote to memory of 2752 2220 tnhntb.exe jdvdd.exe PID 2220 wrote to memory of 2752 2220 tnhntb.exe jdvdd.exe PID 2752 wrote to memory of 2796 2752 jdvdd.exe xrxrxlr.exe PID 2752 wrote to memory of 2796 2752 jdvdd.exe xrxrxlr.exe PID 2752 wrote to memory of 2796 2752 jdvdd.exe xrxrxlr.exe PID 2752 wrote to memory of 2796 2752 jdvdd.exe xrxrxlr.exe PID 2796 wrote to memory of 548 2796 xrxrxlr.exe 9frlrrf.exe PID 2796 wrote to memory of 548 2796 xrxrxlr.exe 9frlrrf.exe PID 2796 wrote to memory of 548 2796 xrxrxlr.exe 9frlrrf.exe PID 2796 wrote to memory of 548 2796 xrxrxlr.exe 9frlrrf.exe PID 548 wrote to memory of 908 548 9frlrrf.exe bththn.exe PID 548 wrote to memory of 908 548 9frlrrf.exe bththn.exe PID 548 wrote to memory of 908 548 9frlrrf.exe bththn.exe PID 548 wrote to memory of 908 548 9frlrrf.exe bththn.exe PID 908 wrote to memory of 1784 908 bththn.exe rrfxrxr.exe PID 908 wrote to memory of 1784 908 bththn.exe rrfxrxr.exe PID 908 wrote to memory of 1784 908 bththn.exe rrfxrxr.exe PID 908 wrote to memory of 1784 908 bththn.exe rrfxrxr.exe PID 1784 wrote to memory of 1532 1784 rrfxrxr.exe xffxfrx.exe PID 1784 wrote to memory of 1532 1784 rrfxrxr.exe xffxfrx.exe PID 1784 wrote to memory of 1532 1784 rrfxrxr.exe xffxfrx.exe PID 1784 wrote to memory of 1532 1784 rrfxrxr.exe xffxfrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45ad003da58b4f8ecd9d574443dce020_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\45ad003da58b4f8ecd9d574443dce020_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\tnbbbn.exec:\tnbbbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\lfxflrf.exec:\lfxflrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\tthnhh.exec:\tthnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\ddvjv.exec:\ddvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\5xlffxx.exec:\5xlffxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\tnbhbb.exec:\tnbhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\vpvdp.exec:\vpvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\dddvv.exec:\dddvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\xrflxxf.exec:\xrflxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\tnhntb.exec:\tnhntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\jdvdd.exec:\jdvdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\xrxrxlr.exec:\xrxrxlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\9frlrrf.exec:\9frlrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\bththn.exec:\bththn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\rrfxrxr.exec:\rrfxrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\xffxfrx.exec:\xffxfrx.exe17⤵
- Executes dropped EXE
PID:1532 -
\??\c:\hbthtb.exec:\hbthtb.exe18⤵
- Executes dropped EXE
PID:2708 -
\??\c:\vpvdd.exec:\vpvdd.exe19⤵
- Executes dropped EXE
PID:1356 -
\??\c:\xrlrxrr.exec:\xrlrxrr.exe20⤵
- Executes dropped EXE
PID:552 -
\??\c:\hbntbn.exec:\hbntbn.exe21⤵
- Executes dropped EXE
PID:2984 -
\??\c:\7pjjp.exec:\7pjjp.exe22⤵
- Executes dropped EXE
PID:2232 -
\??\c:\5jdpj.exec:\5jdpj.exe23⤵
- Executes dropped EXE
PID:2904 -
\??\c:\xrlxxfl.exec:\xrlxxfl.exe24⤵
- Executes dropped EXE
PID:540 -
\??\c:\nhhhhn.exec:\nhhhhn.exe25⤵
- Executes dropped EXE
PID:1796 -
\??\c:\jdjpd.exec:\jdjpd.exe26⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tbhtbn.exec:\tbhtbn.exe27⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jpjdd.exec:\jpjdd.exe28⤵
- Executes dropped EXE
PID:1772 -
\??\c:\7fxrffr.exec:\7fxrffr.exe29⤵
- Executes dropped EXE
PID:1060 -
\??\c:\htttbn.exec:\htttbn.exe30⤵
- Executes dropped EXE
PID:1788 -
\??\c:\vdpvj.exec:\vdpvj.exe31⤵
- Executes dropped EXE
PID:280 -
\??\c:\5xlrxlx.exec:\5xlrxlx.exe32⤵
- Executes dropped EXE
PID:1980 -
\??\c:\7nhhnt.exec:\7nhhnt.exe33⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jdjjv.exec:\jdjjv.exe34⤵
- Executes dropped EXE
PID:1724 -
\??\c:\5dvjj.exec:\5dvjj.exe35⤵
- Executes dropped EXE
PID:2396 -
\??\c:\frxrfxx.exec:\frxrfxx.exe36⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nntbtt.exec:\nntbtt.exe37⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vvvpj.exec:\vvvpj.exe38⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rxllrll.exec:\rxllrll.exe39⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hbtbhb.exec:\hbtbhb.exe40⤵
- Executes dropped EXE
PID:3040 -
\??\c:\nbbbbt.exec:\nbbbbt.exe41⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jvdjv.exec:\jvdjv.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xrfxxfl.exec:\xrfxxfl.exe43⤵
- Executes dropped EXE
PID:3052 -
\??\c:\fxfllxf.exec:\fxfllxf.exe44⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hntttn.exec:\hntttn.exe45⤵
- Executes dropped EXE
PID:2660 -
\??\c:\jdvjv.exec:\jdvjv.exe46⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xxxflrf.exec:\xxxflrf.exe47⤵
- Executes dropped EXE
PID:2472 -
\??\c:\htbtbt.exec:\htbtbt.exe48⤵
- Executes dropped EXE
PID:2436 -
\??\c:\tbnthb.exec:\tbnthb.exe49⤵
- Executes dropped EXE
PID:2064 -
\??\c:\ppjdd.exec:\ppjdd.exe50⤵
- Executes dropped EXE
PID:2792 -
\??\c:\5lrlrff.exec:\5lrlrff.exe51⤵
- Executes dropped EXE
PID:2804 -
\??\c:\5lxxffx.exec:\5lxxffx.exe52⤵
- Executes dropped EXE
PID:1528 -
\??\c:\bhhhtn.exec:\bhhhtn.exe53⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vvpdv.exec:\vvpdv.exe54⤵
- Executes dropped EXE
PID:1836 -
\??\c:\ppdjv.exec:\ppdjv.exe55⤵
- Executes dropped EXE
PID:1756 -
\??\c:\lrxxfxf.exec:\lrxxfxf.exe56⤵
- Executes dropped EXE
PID:1640 -
\??\c:\bttbhn.exec:\bttbhn.exe57⤵
- Executes dropped EXE
PID:2184 -
\??\c:\pvdvd.exec:\pvdvd.exe58⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vvpvj.exec:\vvpvj.exe59⤵
- Executes dropped EXE
PID:2528 -
\??\c:\lfrxlrf.exec:\lfrxlrf.exe60⤵
- Executes dropped EXE
PID:1392 -
\??\c:\7llrflx.exec:\7llrflx.exe61⤵
- Executes dropped EXE
PID:2536 -
\??\c:\btthnb.exec:\btthnb.exe62⤵
- Executes dropped EXE
PID:2988 -
\??\c:\7pvjv.exec:\7pvjv.exe63⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xrfrrrr.exec:\xrfrrrr.exe64⤵
- Executes dropped EXE
PID:2424 -
\??\c:\tnnnbt.exec:\tnnnbt.exe65⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bthbbb.exec:\bthbbb.exe66⤵PID:564
-
\??\c:\7vddd.exec:\7vddd.exe67⤵PID:584
-
\??\c:\ppddd.exec:\ppddd.exe68⤵PID:1860
-
\??\c:\xrflffx.exec:\xrflffx.exe69⤵PID:2132
-
\??\c:\hbntnh.exec:\hbntnh.exe70⤵PID:2092
-
\??\c:\9hthnt.exec:\9hthnt.exe71⤵PID:1556
-
\??\c:\jpjpv.exec:\jpjpv.exe72⤵PID:1868
-
\??\c:\frrllxl.exec:\frrllxl.exe73⤵PID:1228
-
\??\c:\3bnhhh.exec:\3bnhhh.exe74⤵PID:1624
-
\??\c:\bthbbb.exec:\bthbbb.exe75⤵PID:944
-
\??\c:\3pdpp.exec:\3pdpp.exe76⤵PID:2920
-
\??\c:\xrrxflr.exec:\xrrxflr.exe77⤵PID:2380
-
\??\c:\lrfllrr.exec:\lrfllrr.exe78⤵PID:2936
-
\??\c:\hthbnt.exec:\hthbnt.exe79⤵PID:2056
-
\??\c:\pjjjv.exec:\pjjjv.exe80⤵PID:3020
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe81⤵PID:2396
-
\??\c:\rlrxlxr.exec:\rlrxlxr.exe82⤵PID:2740
-
\??\c:\3hbhhh.exec:\3hbhhh.exe83⤵PID:1720
-
\??\c:\1jvdd.exec:\1jvdd.exe84⤵PID:2028
-
\??\c:\vppvd.exec:\vppvd.exe85⤵PID:3048
-
\??\c:\9rllrrx.exec:\9rllrrx.exe86⤵PID:2640
-
\??\c:\fxllrrx.exec:\fxllrrx.exe87⤵PID:1208
-
\??\c:\tbhbbb.exec:\tbhbbb.exe88⤵PID:2664
-
\??\c:\jjppj.exec:\jjppj.exe89⤵PID:2768
-
\??\c:\9lfxxfl.exec:\9lfxxfl.exe90⤵PID:2464
-
\??\c:\frlxlrf.exec:\frlxlrf.exe91⤵PID:2576
-
\??\c:\1hhbbb.exec:\1hhbbb.exe92⤵PID:2476
-
\??\c:\tnhthn.exec:\tnhthn.exe93⤵PID:2504
-
\??\c:\9djpp.exec:\9djpp.exe94⤵PID:2516
-
\??\c:\rfrfxfr.exec:\rfrfxfr.exe95⤵PID:2172
-
\??\c:\lrfxlxl.exec:\lrfxlxl.exe96⤵PID:2704
-
\??\c:\bbbbnn.exec:\bbbbnn.exe97⤵PID:2820
-
\??\c:\dvjjd.exec:\dvjjd.exe98⤵PID:1552
-
\??\c:\fxxrfff.exec:\fxxrfff.exe99⤵PID:1668
-
\??\c:\bnbhbt.exec:\bnbhbt.exe100⤵PID:1040
-
\??\c:\thtttb.exec:\thtttb.exe101⤵PID:672
-
\??\c:\vvppd.exec:\vvppd.exe102⤵PID:2328
-
\??\c:\lrrfrfx.exec:\lrrfrfx.exe103⤵PID:1644
-
\??\c:\flxrllr.exec:\flxrllr.exe104⤵PID:2948
-
\??\c:\bnnttt.exec:\bnnttt.exe105⤵PID:1416
-
\??\c:\5vvjp.exec:\5vvjp.exe106⤵PID:1300
-
\??\c:\xxxrrfx.exec:\xxxrrfx.exe107⤵PID:1244
-
\??\c:\rxlfffl.exec:\rxlfffl.exe108⤵PID:1192
-
\??\c:\hbhbht.exec:\hbhbht.exe109⤵PID:1976
-
\??\c:\ppvjv.exec:\ppvjv.exe110⤵PID:2300
-
\??\c:\dppvp.exec:\dppvp.exe111⤵PID:684
-
\??\c:\xxlxrrx.exec:\xxlxrrx.exe112⤵PID:2908
-
\??\c:\nhhhnn.exec:\nhhhnn.exe113⤵PID:2120
-
\??\c:\dvjvd.exec:\dvjvd.exe114⤵PID:2016
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe115⤵PID:2100
-
\??\c:\flflrrx.exec:\flflrrx.exe116⤵PID:1340
-
\??\c:\1tbbnt.exec:\1tbbnt.exe117⤵PID:964
-
\??\c:\bntnbb.exec:\bntnbb.exe118⤵PID:1332
-
\??\c:\vvppv.exec:\vvppv.exe119⤵PID:1060
-
\??\c:\lrlfffl.exec:\lrlfffl.exe120⤵PID:968
-
\??\c:\xlxlrlr.exec:\xlxlrlr.exe121⤵PID:2084
-
\??\c:\nhnntt.exec:\nhnntt.exe122⤵PID:2052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-