Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:47
Behavioral task
behavioral1
Sample
70fbe59a653dcffcad8052f4a051ec10_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
70fbe59a653dcffcad8052f4a051ec10_NeikiAnalytics.exe
-
Size
273KB
-
MD5
70fbe59a653dcffcad8052f4a051ec10
-
SHA1
15e809bc74e33ee50bfbd97043736c33da77f755
-
SHA256
d35c84f1e32571521e67ac8a89a79726d57679f30f85456584b51bb617b0c699
-
SHA512
c84cd46d2fe6d45d9c3df3695311539099b6e8a23e9c2953a37cf706d12bfad06ce2cd724fb99f0e370605e977b1c2f90157026544cfeed53c8bbf1c0b0f7865
-
SSDEEP
6144:Ycm4FmowdHoSgWrXF5lpKGYV0aTk/BO0XJm4UEPOshN/xdKnvP48bmo:e4wFHoSgWjdpKGATTk/jYIOWN/KnnPT
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
Processes:
resource yara_rule behavioral1/memory/2976-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1776-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1336-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1844-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/820-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1668-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/344-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/844-243-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/844-242-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1044-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/912-257-0x0000000001B50000-0x0000000001B77000-memory.dmp family_blackmoon behavioral1/memory/640-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1980-624-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-835-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1796-866-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-983-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/448-1054-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/672-6344-0x0000000077930000-0x0000000077A2A000-memory.dmp family_blackmoon behavioral1/memory/672-6901-0x0000000077930000-0x0000000077A2A000-memory.dmp family_blackmoon behavioral1/memory/672-15416-0x0000000077810000-0x000000007792F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jddjp.exerrfrlrl.exebtbnht.exefrxxxrr.exerxrllfx.exehbbntn.exe9jpdp.exerllflfx.exe5vdjd.exexffxxff.exenttbth.exefxrfxxr.exehbnbht.exepjddj.exe1nbhnb.exe5xrxlxl.exejjvpd.exeffrxlrf.exe9bthhb.exejpvjd.exeddvvp.exetbnbbn.exefllfrxx.exebthtnb.exejpvjv.exe5btnnb.exerfffrxx.exetbttbh.exejjdvp.exehbbhtb.exe1fxlfrl.exe3pjpv.exe3lrlfrf.exe9bbbnb.exedvjvd.exerfxxxfl.exe1bthtt.exebbtnbn.exe5ddpv.exefxflfll.exebtnntb.exenthnnb.exe3jddj.exe9ffxlxl.exetbttnh.exebbhhbt.exe7pddj.exerrrxlrx.exenhtbnt.exebbbhtb.exepddjj.exe3llxrfr.exettthhn.exe7httbh.exevdpvv.exepjjpd.exe5llflfr.exennhnhh.exe7dpvd.exejjjpj.exe5xrxlxf.exefxxfrxl.exentthhh.exejdvdd.exepid process 2200 jddjp.exe 1776 rrfrlrl.exe 2352 btbnht.exe 2752 frxxxrr.exe 2692 rxrllfx.exe 2724 hbbntn.exe 2560 9jpdp.exe 2672 rllflfx.exe 2528 5vdjd.exe 2656 xffxxff.exe 1336 nttbth.exe 2772 fxrfxxr.exe 2884 hbnbht.exe 3032 pjddj.exe 2180 1nbhnb.exe 1932 5xrxlxl.exe 1844 jjvpd.exe 1260 ffrxlrf.exe 2624 9bthhb.exe 764 jpvjd.exe 820 ddvvp.exe 2632 tbnbbn.exe 2928 fllfrxx.exe 2408 bthtnb.exe 1732 jpvjv.exe 1668 5btnnb.exe 848 rfffrxx.exe 1820 tbttbh.exe 344 jjdvp.exe 844 hbbhtb.exe 1044 1fxlfrl.exe 912 3pjpv.exe 640 3lrlfrf.exe 2268 9bbbnb.exe 2844 dvjvd.exe 2324 rfxxxfl.exe 884 1bthtt.exe 1700 bbtnbn.exe 2196 5ddpv.exe 1616 fxflfll.exe 1592 btnntb.exe 2432 nthnnb.exe 2644 3jddj.exe 2684 9ffxlxl.exe 2792 tbttnh.exe 2748 bbhhbt.exe 2764 7pddj.exe 2696 rrrxlrx.exe 2708 nhtbnt.exe 2576 bbbhtb.exe 2548 pddjj.exe 2596 3llxrfr.exe 2528 ttthhn.exe 1288 7httbh.exe 2096 vdpvv.exe 2720 pjjpd.exe 2880 5llflfr.exe 2980 nnhnhh.exe 3040 7dpvd.exe 1828 jjjpj.exe 2416 5xrxlxf.exe 1132 fxxfrxl.exe 1036 ntthhh.exe 1992 jdvdd.exe -
Processes:
resource yara_rule behavioral1/memory/2976-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2976-3-0x00000000002C0000-0x00000000002E7000-memory.dmp upx C:\jddjp.exe upx behavioral1/memory/2976-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2200-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrfrlrl.exe upx behavioral1/memory/1776-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btbnht.exe upx behavioral1/memory/2352-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frxxxrr.exe upx behavioral1/memory/2352-33-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxrllfx.exe upx behavioral1/memory/2752-42-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbbntn.exe upx behavioral1/memory/2692-49-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9jpdp.exe upx C:\rllflfx.exe upx C:\5vdjd.exe upx behavioral1/memory/2672-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xffxxff.exe upx behavioral1/memory/2656-87-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nttbth.exe upx C:\fxrfxxr.exe upx behavioral1/memory/1336-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-103-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbnbht.exe upx behavioral1/memory/2884-110-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjddj.exe upx behavioral1/memory/3032-118-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/3032-121-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1nbhnb.exe upx behavioral1/memory/2180-128-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5xrxlxl.exe upx C:\jjvpd.exe upx behavioral1/memory/1932-137-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffrxlrf.exe upx behavioral1/memory/1844-144-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9bthhb.exe upx C:\jpvjd.exe upx C:\ddvvp.exe upx C:\tbnbbn.exe upx behavioral1/memory/820-174-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fllfrxx.exe upx C:\bthtnb.exe upx behavioral1/memory/2928-185-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\jpvjv.exe upx C:\5btnnb.exe upx C:\rfffrxx.exe upx behavioral1/memory/1668-210-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbttbh.exe upx behavioral1/memory/1820-225-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjdvp.exe upx C:\hbbhtb.exe upx behavioral1/memory/344-234-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1fxlfrl.exe upx behavioral1/memory/1044-245-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3pjpv.exe upx behavioral1/memory/1044-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/640-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1592-308-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2792-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-368-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
70fbe59a653dcffcad8052f4a051ec10_NeikiAnalytics.exejddjp.exerrfrlrl.exebtbnht.exefrxxxrr.exerxrllfx.exehbbntn.exe9jpdp.exerllflfx.exe5vdjd.exexffxxff.exenttbth.exefxrfxxr.exehbnbht.exepjddj.exe1nbhnb.exedescription pid process target process PID 2976 wrote to memory of 2200 2976 70fbe59a653dcffcad8052f4a051ec10_NeikiAnalytics.exe jddjp.exe PID 2976 wrote to memory of 2200 2976 70fbe59a653dcffcad8052f4a051ec10_NeikiAnalytics.exe jddjp.exe PID 2976 wrote to memory of 2200 2976 70fbe59a653dcffcad8052f4a051ec10_NeikiAnalytics.exe jddjp.exe PID 2976 wrote to memory of 2200 2976 70fbe59a653dcffcad8052f4a051ec10_NeikiAnalytics.exe jddjp.exe PID 2200 wrote to memory of 1776 2200 jddjp.exe rrfrlrl.exe PID 2200 wrote to memory of 1776 2200 jddjp.exe rrfrlrl.exe PID 2200 wrote to memory of 1776 2200 jddjp.exe rrfrlrl.exe PID 2200 wrote to memory of 1776 2200 jddjp.exe rrfrlrl.exe PID 1776 wrote to memory of 2352 1776 rrfrlrl.exe btbnht.exe PID 1776 wrote to memory of 2352 1776 rrfrlrl.exe btbnht.exe PID 1776 wrote to memory of 2352 1776 rrfrlrl.exe btbnht.exe PID 1776 wrote to memory of 2352 1776 rrfrlrl.exe btbnht.exe PID 2352 wrote to memory of 2752 2352 btbnht.exe frxxxrr.exe PID 2352 wrote to memory of 2752 2352 btbnht.exe frxxxrr.exe PID 2352 wrote to memory of 2752 2352 btbnht.exe frxxxrr.exe PID 2352 wrote to memory of 2752 2352 btbnht.exe frxxxrr.exe PID 2752 wrote to memory of 2692 2752 frxxxrr.exe rxrllfx.exe PID 2752 wrote to memory of 2692 2752 frxxxrr.exe rxrllfx.exe PID 2752 wrote to memory of 2692 2752 frxxxrr.exe rxrllfx.exe PID 2752 wrote to memory of 2692 2752 frxxxrr.exe rxrllfx.exe PID 2692 wrote to memory of 2724 2692 rxrllfx.exe hbbntn.exe PID 2692 wrote to memory of 2724 2692 rxrllfx.exe hbbntn.exe PID 2692 wrote to memory of 2724 2692 rxrllfx.exe hbbntn.exe PID 2692 wrote to memory of 2724 2692 rxrllfx.exe hbbntn.exe PID 2724 wrote to memory of 2560 2724 hbbntn.exe 9jpdp.exe PID 2724 wrote to memory of 2560 2724 hbbntn.exe 9jpdp.exe PID 2724 wrote to memory of 2560 2724 hbbntn.exe 9jpdp.exe PID 2724 wrote to memory of 2560 2724 hbbntn.exe 9jpdp.exe PID 2560 wrote to memory of 2672 2560 9jpdp.exe rllflfx.exe PID 2560 wrote to memory of 2672 2560 9jpdp.exe rllflfx.exe PID 2560 wrote to memory of 2672 2560 9jpdp.exe rllflfx.exe PID 2560 wrote to memory of 2672 2560 9jpdp.exe rllflfx.exe PID 2672 wrote to memory of 2528 2672 rllflfx.exe 5vdjd.exe PID 2672 wrote to memory of 2528 2672 rllflfx.exe 5vdjd.exe PID 2672 wrote to memory of 2528 2672 rllflfx.exe 5vdjd.exe PID 2672 wrote to memory of 2528 2672 rllflfx.exe 5vdjd.exe PID 2528 wrote to memory of 2656 2528 5vdjd.exe xffxxff.exe PID 2528 wrote to memory of 2656 2528 5vdjd.exe xffxxff.exe PID 2528 wrote to memory of 2656 2528 5vdjd.exe xffxxff.exe PID 2528 wrote to memory of 2656 2528 5vdjd.exe xffxxff.exe PID 2656 wrote to memory of 1336 2656 xffxxff.exe nttbth.exe PID 2656 wrote to memory of 1336 2656 xffxxff.exe nttbth.exe PID 2656 wrote to memory of 1336 2656 xffxxff.exe nttbth.exe PID 2656 wrote to memory of 1336 2656 xffxxff.exe nttbth.exe PID 1336 wrote to memory of 2772 1336 nttbth.exe fxrfxxr.exe PID 1336 wrote to memory of 2772 1336 nttbth.exe fxrfxxr.exe PID 1336 wrote to memory of 2772 1336 nttbth.exe fxrfxxr.exe PID 1336 wrote to memory of 2772 1336 nttbth.exe fxrfxxr.exe PID 2772 wrote to memory of 2884 2772 fxrfxxr.exe hbnbht.exe PID 2772 wrote to memory of 2884 2772 fxrfxxr.exe hbnbht.exe PID 2772 wrote to memory of 2884 2772 fxrfxxr.exe hbnbht.exe PID 2772 wrote to memory of 2884 2772 fxrfxxr.exe hbnbht.exe PID 2884 wrote to memory of 3032 2884 hbnbht.exe pjddj.exe PID 2884 wrote to memory of 3032 2884 hbnbht.exe pjddj.exe PID 2884 wrote to memory of 3032 2884 hbnbht.exe pjddj.exe PID 2884 wrote to memory of 3032 2884 hbnbht.exe pjddj.exe PID 3032 wrote to memory of 2180 3032 pjddj.exe 1nbhnb.exe PID 3032 wrote to memory of 2180 3032 pjddj.exe 1nbhnb.exe PID 3032 wrote to memory of 2180 3032 pjddj.exe 1nbhnb.exe PID 3032 wrote to memory of 2180 3032 pjddj.exe 1nbhnb.exe PID 2180 wrote to memory of 1932 2180 1nbhnb.exe 5xrxlxl.exe PID 2180 wrote to memory of 1932 2180 1nbhnb.exe 5xrxlxl.exe PID 2180 wrote to memory of 1932 2180 1nbhnb.exe 5xrxlxl.exe PID 2180 wrote to memory of 1932 2180 1nbhnb.exe 5xrxlxl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70fbe59a653dcffcad8052f4a051ec10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\70fbe59a653dcffcad8052f4a051ec10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\jddjp.exec:\jddjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\rrfrlrl.exec:\rrfrlrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\btbnht.exec:\btbnht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\frxxxrr.exec:\frxxxrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\rxrllfx.exec:\rxrllfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\hbbntn.exec:\hbbntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\9jpdp.exec:\9jpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\rllflfx.exec:\rllflfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\5vdjd.exec:\5vdjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\xffxxff.exec:\xffxxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\nttbth.exec:\nttbth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\fxrfxxr.exec:\fxrfxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\hbnbht.exec:\hbnbht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\pjddj.exec:\pjddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\1nbhnb.exec:\1nbhnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\5xrxlxl.exec:\5xrxlxl.exe17⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jjvpd.exec:\jjvpd.exe18⤵
- Executes dropped EXE
PID:1844 -
\??\c:\ffrxlrf.exec:\ffrxlrf.exe19⤵
- Executes dropped EXE
PID:1260 -
\??\c:\9bthhb.exec:\9bthhb.exe20⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jpvjd.exec:\jpvjd.exe21⤵
- Executes dropped EXE
PID:764 -
\??\c:\ddvvp.exec:\ddvvp.exe22⤵
- Executes dropped EXE
PID:820 -
\??\c:\tbnbbn.exec:\tbnbbn.exe23⤵
- Executes dropped EXE
PID:2632 -
\??\c:\fllfrxx.exec:\fllfrxx.exe24⤵
- Executes dropped EXE
PID:2928 -
\??\c:\bthtnb.exec:\bthtnb.exe25⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jpvjv.exec:\jpvjv.exe26⤵
- Executes dropped EXE
PID:1732 -
\??\c:\5btnnb.exec:\5btnnb.exe27⤵
- Executes dropped EXE
PID:1668 -
\??\c:\rfffrxx.exec:\rfffrxx.exe28⤵
- Executes dropped EXE
PID:848 -
\??\c:\tbttbh.exec:\tbttbh.exe29⤵
- Executes dropped EXE
PID:1820 -
\??\c:\jjdvp.exec:\jjdvp.exe30⤵
- Executes dropped EXE
PID:344 -
\??\c:\hbbhtb.exec:\hbbhtb.exe31⤵
- Executes dropped EXE
PID:844 -
\??\c:\1fxlfrl.exec:\1fxlfrl.exe32⤵
- Executes dropped EXE
PID:1044 -
\??\c:\3pjpv.exec:\3pjpv.exe33⤵
- Executes dropped EXE
PID:912 -
\??\c:\3lrlfrf.exec:\3lrlfrf.exe34⤵
- Executes dropped EXE
PID:640 -
\??\c:\9bbbnb.exec:\9bbbnb.exe35⤵
- Executes dropped EXE
PID:2268 -
\??\c:\dvjvd.exec:\dvjvd.exe36⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rfxxxfl.exec:\rfxxxfl.exe37⤵
- Executes dropped EXE
PID:2324 -
\??\c:\1bthtt.exec:\1bthtt.exe38⤵
- Executes dropped EXE
PID:884 -
\??\c:\bbtnbn.exec:\bbtnbn.exe39⤵
- Executes dropped EXE
PID:1700 -
\??\c:\5ddpv.exec:\5ddpv.exe40⤵
- Executes dropped EXE
PID:2196 -
\??\c:\fxflfll.exec:\fxflfll.exe41⤵
- Executes dropped EXE
PID:1616 -
\??\c:\btnntb.exec:\btnntb.exe42⤵
- Executes dropped EXE
PID:1592 -
\??\c:\nthnnb.exec:\nthnnb.exe43⤵
- Executes dropped EXE
PID:2432 -
\??\c:\3jddj.exec:\3jddj.exe44⤵
- Executes dropped EXE
PID:2644 -
\??\c:\9ffxlxl.exec:\9ffxlxl.exe45⤵
- Executes dropped EXE
PID:2684 -
\??\c:\tbttnh.exec:\tbttnh.exe46⤵
- Executes dropped EXE
PID:2792 -
\??\c:\bbhhbt.exec:\bbhhbt.exe47⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7pddj.exec:\7pddj.exe48⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rrrxlrx.exec:\rrrxlrx.exe49⤵
- Executes dropped EXE
PID:2696 -
\??\c:\nhtbnt.exec:\nhtbnt.exe50⤵
- Executes dropped EXE
PID:2708 -
\??\c:\bbbhtb.exec:\bbbhtb.exe51⤵
- Executes dropped EXE
PID:2576 -
\??\c:\pddjj.exec:\pddjj.exe52⤵
- Executes dropped EXE
PID:2548 -
\??\c:\3llxrfr.exec:\3llxrfr.exe53⤵
- Executes dropped EXE
PID:2596 -
\??\c:\ttthhn.exec:\ttthhn.exe54⤵
- Executes dropped EXE
PID:2528 -
\??\c:\7httbh.exec:\7httbh.exe55⤵
- Executes dropped EXE
PID:1288 -
\??\c:\vdpvv.exec:\vdpvv.exe56⤵
- Executes dropped EXE
PID:2096 -
\??\c:\pjjpd.exec:\pjjpd.exe57⤵
- Executes dropped EXE
PID:2720 -
\??\c:\5llflfr.exec:\5llflfr.exe58⤵
- Executes dropped EXE
PID:2880 -
\??\c:\nnhnhh.exec:\nnhnhh.exe59⤵
- Executes dropped EXE
PID:2980 -
\??\c:\7dpvd.exec:\7dpvd.exe60⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jjjpj.exec:\jjjpj.exe61⤵
- Executes dropped EXE
PID:1828 -
\??\c:\5xrxlxf.exec:\5xrxlxf.exe62⤵
- Executes dropped EXE
PID:2416 -
\??\c:\fxxfrxl.exec:\fxxfrxl.exe63⤵
- Executes dropped EXE
PID:1132 -
\??\c:\ntthhh.exec:\ntthhh.exe64⤵
- Executes dropped EXE
PID:1036 -
\??\c:\jdvdd.exec:\jdvdd.exe65⤵
- Executes dropped EXE
PID:1992 -
\??\c:\lfrrfxl.exec:\lfrrfxl.exe66⤵PID:1296
-
\??\c:\5llxxff.exec:\5llxxff.exe67⤵PID:2624
-
\??\c:\btttbt.exec:\btttbt.exe68⤵PID:768
-
\??\c:\tnhbhh.exec:\tnhbhh.exe69⤵PID:2112
-
\??\c:\flxfrxf.exec:\flxfrxf.exe70⤵PID:2300
-
\??\c:\7ffxrlf.exec:\7ffxrlf.exe71⤵PID:2120
-
\??\c:\tnbbtb.exec:\tnbbtb.exe72⤵PID:2928
-
\??\c:\rllfrll.exec:\rllfrll.exe73⤵PID:2408
-
\??\c:\rfrfxlx.exec:\rfrfxlx.exe74⤵PID:2996
-
\??\c:\1nbhth.exec:\1nbhth.exe75⤵PID:1764
-
\??\c:\vvpdp.exec:\vvpdp.exe76⤵PID:2156
-
\??\c:\dpddj.exec:\dpddj.exe77⤵PID:1908
-
\??\c:\ffxrfrf.exec:\ffxrfrf.exe78⤵PID:1804
-
\??\c:\bbtbhn.exec:\bbtbhn.exe79⤵PID:1692
-
\??\c:\jpvpp.exec:\jpvpp.exe80⤵PID:1400
-
\??\c:\vjjdv.exec:\vjjdv.exe81⤵PID:2000
-
\??\c:\5fxrllf.exec:\5fxrllf.exe82⤵PID:1544
-
\??\c:\9bhtnt.exec:\9bhtnt.exe83⤵PID:940
-
\??\c:\djdvj.exec:\djdvj.exe84⤵PID:2060
-
\??\c:\vjpdd.exec:\vjpdd.exe85⤵PID:2264
-
\??\c:\lrxrlxl.exec:\lrxrlxl.exe86⤵PID:1972
-
\??\c:\bhnnhb.exec:\bhnnhb.exe87⤵PID:2252
-
\??\c:\vpppv.exec:\vpppv.exe88⤵PID:2460
-
\??\c:\1jddj.exec:\1jddj.exe89⤵PID:2052
-
\??\c:\lfrfrxl.exec:\lfrfrxl.exe90⤵PID:1624
-
\??\c:\nhtbtb.exec:\nhtbtb.exe91⤵PID:1588
-
\??\c:\1vvjv.exec:\1vvjv.exe92⤵PID:1612
-
\??\c:\9djjj.exec:\9djjj.exe93⤵PID:2128
-
\??\c:\llllrlf.exec:\llllrlf.exe94⤵PID:1796
-
\??\c:\nnnnbb.exec:\nnnnbb.exe95⤵PID:2900
-
\??\c:\vvpdp.exec:\vvpdp.exe96⤵PID:2744
-
\??\c:\jvjdj.exec:\jvjdj.exe97⤵PID:2916
-
\??\c:\7llxllx.exec:\7llxllx.exe98⤵PID:2664
-
\??\c:\nnbhth.exec:\nnbhth.exe99⤵PID:2668
-
\??\c:\tbhbhb.exec:\tbhbhb.exe100⤵PID:2892
-
\??\c:\vpdjp.exec:\vpdjp.exe101⤵PID:1980
-
\??\c:\ffrrfrl.exec:\ffrrfrl.exe102⤵PID:2536
-
\??\c:\hntnbh.exec:\hntnbh.exe103⤵PID:3008
-
\??\c:\jpjvd.exec:\jpjvd.exe104⤵PID:2596
-
\??\c:\llxflfx.exec:\llxflfx.exe105⤵PID:2528
-
\??\c:\5hhbtt.exec:\5hhbtt.exe106⤵PID:1288
-
\??\c:\nbhnht.exec:\nbhnht.exe107⤵PID:1336
-
\??\c:\vdjjp.exec:\vdjjp.exe108⤵PID:2968
-
\??\c:\xlrrlxr.exec:\xlrrlxr.exe109⤵PID:3004
-
\??\c:\tbhhbh.exec:\tbhhbh.exe110⤵PID:2980
-
\??\c:\djdvj.exec:\djdvj.exe111⤵PID:3032
-
\??\c:\dvvvp.exec:\dvvvp.exe112⤵PID:1808
-
\??\c:\tbhthn.exec:\tbhthn.exe113⤵PID:1800
-
\??\c:\vvjvj.exec:\vvjvj.exe114⤵PID:2024
-
\??\c:\rrfrfrf.exec:\rrfrfrf.exe115⤵PID:2520
-
\??\c:\ffxffff.exec:\ffxffff.exe116⤵PID:1792
-
\??\c:\htbttt.exec:\htbttt.exe117⤵PID:1860
-
\??\c:\jdvdv.exec:\jdvdv.exe118⤵PID:548
-
\??\c:\dpvjd.exec:\dpvjd.exe119⤵PID:812
-
\??\c:\xrlxlrf.exec:\xrlxlrf.exe120⤵PID:2168
-
\??\c:\tnnnhn.exec:\tnnnhn.exe121⤵PID:2088
-
\??\c:\bntntn.exec:\bntntn.exe122⤵PID:2280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-