Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 01:40
Behavioral task
behavioral1
Sample
28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe
-
Size
82KB
-
MD5
28dafbfb70746a46d5c57b7b03416ed0
-
SHA1
388896c5a9a354c074f6bccaf549387ba8bc62cd
-
SHA256
fe3ed9ef1414624e5972a1e302523b7d0623b5a254d139013ec29ac06aaeb618
-
SHA512
137627af8eea2d016e63bcf132426281b31414a35adfd9c307e9db8e941d654c4000131d3b4dcd878f318321c6214a6a45130af7c5366022d3e6a83f66fe25cd
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6TQpCi1PC:zhOmTsF93UYfwC6GIoutiTU2HVS64NC
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2388-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1256-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1676-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1544-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/924-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-333-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/320-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1292-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/704-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/536-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/328-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1956-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1904-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-421-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1632-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1224-532-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-548-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2224-565-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1596-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1236-841-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-887-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-1083-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1132-1100-0x00000000775F0000-0x000000007770F000-memory.dmp family_blackmoon behavioral1/memory/2308-1245-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1132-9853-0x00000000775F0000-0x000000007770F000-memory.dmp family_blackmoon behavioral1/memory/1132-12559-0x00000000775F0000-0x000000007770F000-memory.dmp family_blackmoon behavioral1/memory/1132-19638-0x00000000775F0000-0x000000007770F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1256 vdjpv.exe 2752 xrrrrrf.exe 2124 hbntnn.exe 2688 ppjpv.exe 2472 9jpvj.exe 2720 xrrxlxl.exe 2100 fffrrfl.exe 2464 1bnbnt.exe 2540 bbbnht.exe 2264 dvpvj.exe 1956 vdvjd.exe 2700 ffxfxff.exe 2828 xxxffrf.exe 1464 hhthhh.exe 328 hhbntb.exe 1676 dvjdj.exe 1600 dvjjv.exe 2784 xrrfrrl.exe 352 xrxlrlx.exe 1544 hbthht.exe 1780 7hhtth.exe 2280 vpdpj.exe 2448 vpjdj.exe 2116 ddvjv.exe 536 5rllfrx.exe 1344 bbbhtb.exe 844 hthhbb.exe 2272 ntttbh.exe 1792 9jjvv.exe 704 llfrfrf.exe 1032 xrllrrf.exe 1332 9fxlxfr.exe 924 ttthnh.exe 1996 jdddd.exe 988 5ppvd.exe 2192 pjppj.exe 2028 xxrlxxl.exe 348 1rrfllx.exe 1292 nhhbbb.exe 2420 nnnbht.exe 3036 vvvdp.exe 2360 pjvdv.exe 2648 xflrxfl.exe 2572 xrlrflr.exe 2616 7lllfxf.exe 2688 hbthnn.exe 320 bbhtnt.exe 3000 1jvjd.exe 2476 vpdjj.exe 2876 lrxrxfl.exe 2260 rfrfxxx.exe 2732 9hbhnn.exe 2264 nnbhnn.exe 2816 nbttbh.exe 2820 dvjpd.exe 2944 7dvjp.exe 1708 rlffllr.exe 1904 llfxrfl.exe 2776 btnnth.exe 1732 1hhntt.exe 1660 pjdpd.exe 1632 rrfffrf.exe 2784 thnbtn.exe 1208 vpddd.exe -
resource yara_rule behavioral1/memory/2388-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000014323-7.dat upx behavioral1/memory/2388-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1256-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0038000000014502-15.dat upx behavioral1/memory/2752-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2124-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000014702-25.dat upx behavioral1/memory/2752-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2688-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2124-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001480e-32.dat upx behavioral1/files/0x00070000000149e1-41.dat upx behavioral1/files/0x0007000000014b10-51.dat upx behavioral1/memory/2472-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014b36-59.dat upx behavioral1/memory/2100-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000014dae-65.dat upx behavioral1/memory/2720-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2464-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c9c-81.dat upx behavioral1/files/0x0006000000015cb0-88.dat upx behavioral1/files/0x0006000000015cbd-97.dat upx behavioral1/files/0x0006000000015cce-105.dat upx behavioral1/memory/2828-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2700-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cd9-114.dat upx behavioral1/files/0x0006000000015cf5-130.dat upx behavioral1/memory/1676-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d0c-137.dat upx behavioral1/files/0x0006000000015d44-153.dat upx behavioral1/memory/1544-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015f3c-183.dat upx behavioral1/files/0x00060000000160cc-198.dat upx behavioral1/files/0x0006000000016476-220.dat upx behavioral1/memory/1792-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016a6f-250.dat upx behavioral1/memory/924-258-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3036-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2360-311-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3000-340-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2732-361-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/320-339-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2648-317-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1292-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1332-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016813-244.dat upx behavioral1/memory/704-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000165f0-236.dat upx behavioral1/files/0x000600000001654a-228.dat upx behavioral1/files/0x00060000000162c9-214.dat upx behavioral1/files/0x00060000000161b3-207.dat upx behavioral1/memory/536-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015fa7-192.dat upx behavioral1/memory/2116-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2448-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015e6d-176.dat upx behavioral1/files/0x0006000000015e09-169.dat upx behavioral1/files/0x0006000000015d4c-161.dat upx behavioral1/memory/2784-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d24-146.dat upx behavioral1/memory/328-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015ce3-123.dat upx behavioral1/memory/1464-120-0x00000000002A0000-0x00000000002C7000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 1256 2388 28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe 28 PID 2388 wrote to memory of 1256 2388 28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe 28 PID 2388 wrote to memory of 1256 2388 28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe 28 PID 2388 wrote to memory of 1256 2388 28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe 28 PID 1256 wrote to memory of 2752 1256 vdjpv.exe 29 PID 1256 wrote to memory of 2752 1256 vdjpv.exe 29 PID 1256 wrote to memory of 2752 1256 vdjpv.exe 29 PID 1256 wrote to memory of 2752 1256 vdjpv.exe 29 PID 2752 wrote to memory of 2124 2752 xrrrrrf.exe 30 PID 2752 wrote to memory of 2124 2752 xrrrrrf.exe 30 PID 2752 wrote to memory of 2124 2752 xrrrrrf.exe 30 PID 2752 wrote to memory of 2124 2752 xrrrrrf.exe 30 PID 2124 wrote to memory of 2688 2124 hbntnn.exe 73 PID 2124 wrote to memory of 2688 2124 hbntnn.exe 73 PID 2124 wrote to memory of 2688 2124 hbntnn.exe 73 PID 2124 wrote to memory of 2688 2124 hbntnn.exe 73 PID 2688 wrote to memory of 2472 2688 ppjpv.exe 32 PID 2688 wrote to memory of 2472 2688 ppjpv.exe 32 PID 2688 wrote to memory of 2472 2688 ppjpv.exe 32 PID 2688 wrote to memory of 2472 2688 ppjpv.exe 32 PID 2472 wrote to memory of 2720 2472 9jpvj.exe 33 PID 2472 wrote to memory of 2720 2472 9jpvj.exe 33 PID 2472 wrote to memory of 2720 2472 9jpvj.exe 33 PID 2472 wrote to memory of 2720 2472 9jpvj.exe 33 PID 2720 wrote to memory of 2100 2720 xrrxlxl.exe 34 PID 2720 wrote to memory of 2100 2720 xrrxlxl.exe 34 PID 2720 wrote to memory of 2100 2720 xrrxlxl.exe 34 PID 2720 wrote to memory of 2100 2720 xrrxlxl.exe 34 PID 2100 wrote to memory of 2464 2100 fffrrfl.exe 35 PID 2100 wrote to memory of 2464 2100 fffrrfl.exe 35 PID 2100 wrote to memory of 2464 2100 fffrrfl.exe 35 PID 2100 wrote to memory of 2464 2100 fffrrfl.exe 35 PID 2464 wrote to memory of 2540 2464 1bnbnt.exe 36 PID 2464 wrote to memory of 2540 2464 1bnbnt.exe 36 PID 2464 wrote to memory of 2540 2464 1bnbnt.exe 36 PID 2464 wrote to memory of 2540 2464 1bnbnt.exe 36 PID 2540 wrote to memory of 2264 2540 bbbnht.exe 37 PID 2540 wrote to memory of 2264 2540 bbbnht.exe 37 PID 2540 wrote to memory of 2264 2540 bbbnht.exe 37 PID 2540 wrote to memory of 2264 2540 bbbnht.exe 37 PID 2264 wrote to memory of 1956 2264 dvpvj.exe 38 PID 2264 wrote to memory of 1956 2264 dvpvj.exe 38 PID 2264 wrote to memory of 1956 2264 dvpvj.exe 38 PID 2264 wrote to memory of 1956 2264 dvpvj.exe 38 PID 1956 wrote to memory of 2700 1956 vdvjd.exe 39 PID 1956 wrote to memory of 2700 1956 vdvjd.exe 39 PID 1956 wrote to memory of 2700 1956 vdvjd.exe 39 PID 1956 wrote to memory of 2700 1956 vdvjd.exe 39 PID 2700 wrote to memory of 2828 2700 ffxfxff.exe 40 PID 2700 wrote to memory of 2828 2700 ffxfxff.exe 40 PID 2700 wrote to memory of 2828 2700 ffxfxff.exe 40 PID 2700 wrote to memory of 2828 2700 ffxfxff.exe 40 PID 2828 wrote to memory of 1464 2828 xxxffrf.exe 41 PID 2828 wrote to memory of 1464 2828 xxxffrf.exe 41 PID 2828 wrote to memory of 1464 2828 xxxffrf.exe 41 PID 2828 wrote to memory of 1464 2828 xxxffrf.exe 41 PID 1464 wrote to memory of 328 1464 hhthhh.exe 42 PID 1464 wrote to memory of 328 1464 hhthhh.exe 42 PID 1464 wrote to memory of 328 1464 hhthhh.exe 42 PID 1464 wrote to memory of 328 1464 hhthhh.exe 42 PID 328 wrote to memory of 1676 328 hhbntb.exe 43 PID 328 wrote to memory of 1676 328 hhbntb.exe 43 PID 328 wrote to memory of 1676 328 hhbntb.exe 43 PID 328 wrote to memory of 1676 328 hhbntb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\vdjpv.exec:\vdjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\xrrrrrf.exec:\xrrrrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\hbntnn.exec:\hbntnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\ppjpv.exec:\ppjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\9jpvj.exec:\9jpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\xrrxlxl.exec:\xrrxlxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\fffrrfl.exec:\fffrrfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\1bnbnt.exec:\1bnbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\bbbnht.exec:\bbbnht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\dvpvj.exec:\dvpvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\vdvjd.exec:\vdvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\ffxfxff.exec:\ffxfxff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\xxxffrf.exec:\xxxffrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\hhthhh.exec:\hhthhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\hhbntb.exec:\hhbntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:328 -
\??\c:\dvjdj.exec:\dvjdj.exe17⤵
- Executes dropped EXE
PID:1676 -
\??\c:\dvjjv.exec:\dvjjv.exe18⤵
- Executes dropped EXE
PID:1600 -
\??\c:\xrrfrrl.exec:\xrrfrrl.exe19⤵
- Executes dropped EXE
PID:2784 -
\??\c:\xrxlrlx.exec:\xrxlrlx.exe20⤵
- Executes dropped EXE
PID:352 -
\??\c:\hbthht.exec:\hbthht.exe21⤵
- Executes dropped EXE
PID:1544 -
\??\c:\7hhtth.exec:\7hhtth.exe22⤵
- Executes dropped EXE
PID:1780 -
\??\c:\vpdpj.exec:\vpdpj.exe23⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vpjdj.exec:\vpjdj.exe24⤵
- Executes dropped EXE
PID:2448 -
\??\c:\ddvjv.exec:\ddvjv.exe25⤵
- Executes dropped EXE
PID:2116 -
\??\c:\5rllfrx.exec:\5rllfrx.exe26⤵
- Executes dropped EXE
PID:536 -
\??\c:\bbbhtb.exec:\bbbhtb.exe27⤵
- Executes dropped EXE
PID:1344 -
\??\c:\hthhbb.exec:\hthhbb.exe28⤵
- Executes dropped EXE
PID:844 -
\??\c:\ntttbh.exec:\ntttbh.exe29⤵
- Executes dropped EXE
PID:2272 -
\??\c:\9jjvv.exec:\9jjvv.exe30⤵
- Executes dropped EXE
PID:1792 -
\??\c:\llfrfrf.exec:\llfrfrf.exe31⤵
- Executes dropped EXE
PID:704 -
\??\c:\xrllrrf.exec:\xrllrrf.exe32⤵
- Executes dropped EXE
PID:1032 -
\??\c:\9fxlxfr.exec:\9fxlxfr.exe33⤵
- Executes dropped EXE
PID:1332 -
\??\c:\ttthnh.exec:\ttthnh.exe34⤵
- Executes dropped EXE
PID:924 -
\??\c:\jdddd.exec:\jdddd.exe35⤵
- Executes dropped EXE
PID:1996 -
\??\c:\5ppvd.exec:\5ppvd.exe36⤵
- Executes dropped EXE
PID:988 -
\??\c:\pjppj.exec:\pjppj.exe37⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xxrlxxl.exec:\xxrlxxl.exe38⤵
- Executes dropped EXE
PID:2028 -
\??\c:\1rrfllx.exec:\1rrfllx.exe39⤵
- Executes dropped EXE
PID:348 -
\??\c:\nhhbbb.exec:\nhhbbb.exe40⤵
- Executes dropped EXE
PID:1292 -
\??\c:\nnnbht.exec:\nnnbht.exe41⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vvvdp.exec:\vvvdp.exe42⤵
- Executes dropped EXE
PID:3036 -
\??\c:\pjvdv.exec:\pjvdv.exe43⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xflrxfl.exec:\xflrxfl.exe44⤵
- Executes dropped EXE
PID:2648 -
\??\c:\xrlrflr.exec:\xrlrflr.exe45⤵
- Executes dropped EXE
PID:2572 -
\??\c:\7lllfxf.exec:\7lllfxf.exe46⤵
- Executes dropped EXE
PID:2616 -
\??\c:\hbthnn.exec:\hbthnn.exe47⤵
- Executes dropped EXE
PID:2688 -
\??\c:\bbhtnt.exec:\bbhtnt.exe48⤵
- Executes dropped EXE
PID:320 -
\??\c:\1jvjd.exec:\1jvjd.exe49⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vpdjj.exec:\vpdjj.exe50⤵
- Executes dropped EXE
PID:2476 -
\??\c:\lrxrxfl.exec:\lrxrxfl.exe51⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rfrfxxx.exec:\rfrfxxx.exe52⤵
- Executes dropped EXE
PID:2260 -
\??\c:\9hbhnn.exec:\9hbhnn.exe53⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nnbhnn.exec:\nnbhnn.exe54⤵
- Executes dropped EXE
PID:2264 -
\??\c:\nbttbh.exec:\nbttbh.exe55⤵
- Executes dropped EXE
PID:2816 -
\??\c:\dvjpd.exec:\dvjpd.exe56⤵
- Executes dropped EXE
PID:2820 -
\??\c:\7dvjp.exec:\7dvjp.exe57⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rlffllr.exec:\rlffllr.exe58⤵
- Executes dropped EXE
PID:1708 -
\??\c:\llfxrfl.exec:\llfxrfl.exe59⤵
- Executes dropped EXE
PID:1904 -
\??\c:\btnnth.exec:\btnnth.exe60⤵
- Executes dropped EXE
PID:2776 -
\??\c:\1hhntt.exec:\1hhntt.exe61⤵
- Executes dropped EXE
PID:1732 -
\??\c:\pjdpd.exec:\pjdpd.exe62⤵
- Executes dropped EXE
PID:1660 -
\??\c:\rrfffrf.exec:\rrfffrf.exe63⤵
- Executes dropped EXE
PID:1632 -
\??\c:\thnbtn.exec:\thnbtn.exe64⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vpddd.exec:\vpddd.exe65⤵
- Executes dropped EXE
PID:1208 -
\??\c:\flllrlx.exec:\flllrlx.exe66⤵PID:1704
-
\??\c:\3bntnt.exec:\3bntnt.exe67⤵PID:2312
-
\??\c:\1djjv.exec:\1djjv.exe68⤵PID:2356
-
\??\c:\ppjpv.exec:\ppjpv.exe69⤵PID:2196
-
\??\c:\xxrfxfr.exec:\xxrfxfr.exe70⤵PID:2716
-
\??\c:\rllxxxf.exec:\rllxxxf.exe71⤵PID:604
-
\??\c:\7nttnt.exec:\7nttnt.exe72⤵PID:784
-
\??\c:\5dddd.exec:\5dddd.exe73⤵PID:1524
-
\??\c:\frfflll.exec:\frfflll.exe74⤵PID:1344
-
\??\c:\thnttn.exec:\thnttn.exe75⤵PID:844
-
\??\c:\pvvpd.exec:\pvvpd.exe76⤵PID:1456
-
\??\c:\lxfxllf.exec:\lxfxllf.exe77⤵PID:2272
-
\??\c:\nnthbn.exec:\nnthbn.exe78⤵PID:1424
-
\??\c:\7dvdj.exec:\7dvdj.exe79⤵PID:1728
-
\??\c:\lrxrrrf.exec:\lrxrrrf.exe80⤵PID:1836
-
\??\c:\rfllrxx.exec:\rfllrxx.exe81⤵PID:1068
-
\??\c:\hbthnh.exec:\hbthnh.exe82⤵PID:1332
-
\??\c:\7nnthh.exec:\7nnthh.exe83⤵PID:1044
-
\??\c:\3dppp.exec:\3dppp.exe84⤵PID:856
-
\??\c:\pjvdj.exec:\pjvdj.exe85⤵PID:1224
-
\??\c:\1vpdd.exec:\1vpdd.exe86⤵PID:1320
-
\??\c:\xrffxrx.exec:\xrffxrx.exe87⤵PID:1720
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe88⤵PID:2016
-
\??\c:\bthnhb.exec:\bthnhb.exe89⤵PID:308
-
\??\c:\jvddj.exec:\jvddj.exe90⤵PID:2224
-
\??\c:\dvpjv.exec:\dvpjv.exe91⤵PID:1292
-
\??\c:\vjpvd.exec:\vjpvd.exe92⤵PID:1596
-
\??\c:\frxxlll.exec:\frxxlll.exe93⤵PID:1420
-
\??\c:\xrflxrf.exec:\xrflxrf.exe94⤵PID:3056
-
\??\c:\9thbhb.exec:\9thbhb.exe95⤵PID:2648
-
\??\c:\hbhthh.exec:\hbhthh.exe96⤵PID:2736
-
\??\c:\vjvpp.exec:\vjvpp.exe97⤵PID:2596
-
\??\c:\pvdjd.exec:\pvdjd.exe98⤵PID:2136
-
\??\c:\pjvpp.exec:\pjvpp.exe99⤵PID:2644
-
\??\c:\fxrrxxx.exec:\fxrrxxx.exe100⤵PID:2488
-
\??\c:\xrfrxxx.exec:\xrfrxxx.exe101⤵PID:2468
-
\??\c:\nbhbbb.exec:\nbhbbb.exe102⤵PID:2380
-
\??\c:\hthttn.exec:\hthttn.exe103⤵PID:2540
-
\??\c:\1btttt.exec:\1btttt.exe104⤵PID:2576
-
\??\c:\ppvdv.exec:\ppvdv.exe105⤵PID:2568
-
\??\c:\pjvdj.exec:\pjvdj.exe106⤵PID:1956
-
\??\c:\jjvvd.exec:\jjvvd.exe107⤵PID:2700
-
\??\c:\lrrxrlr.exec:\lrrxrlr.exe108⤵PID:2932
-
\??\c:\fxxxffr.exec:\fxxxffr.exe109⤵PID:2516
-
\??\c:\7tnbhh.exec:\7tnbhh.exe110⤵PID:1708
-
\??\c:\btbnnn.exec:\btbnnn.exe111⤵PID:2344
-
\??\c:\htbnnn.exec:\htbnnn.exe112⤵PID:1676
-
\??\c:\jpddd.exec:\jpddd.exe113⤵PID:1640
-
\??\c:\dpdvp.exec:\dpdvp.exe114⤵PID:1964
-
\??\c:\lxllrrr.exec:\lxllrrr.exe115⤵PID:1632
-
\??\c:\1flrfff.exec:\1flrfff.exe116⤵PID:352
-
\??\c:\lfxfrfx.exec:\lfxfrfx.exe117⤵PID:1552
-
\??\c:\nnbhnn.exec:\nnbhnn.exe118⤵PID:1944
-
\??\c:\nnntbn.exec:\nnntbn.exe119⤵PID:2892
-
\??\c:\dpdjp.exec:\dpdjp.exe120⤵PID:2804
-
\??\c:\9dppp.exec:\9dppp.exe121⤵PID:2448
-
\??\c:\5fxflrl.exec:\5fxflrl.exe122⤵PID:2524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-