Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 04:43
Behavioral task
behavioral1
Sample
650a30a1bfa12db10a811ca8edd1a810_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
650a30a1bfa12db10a811ca8edd1a810_NeikiAnalytics.exe
-
Size
185KB
-
MD5
650a30a1bfa12db10a811ca8edd1a810
-
SHA1
68c76ea52e040d14095483e4c0eee6a4c46f5176
-
SHA256
ea537a64ada8b3bb44bbed45d74ec94c961bf3cfd48520baa779f5ffdbc0609a
-
SHA512
6bc67fbedd9b07303b5356dd292b324dfdf820abe49dcb1e501fbb1c2cb1e35e8a0aba06915802111f904a65e9a9a361fc0942391271a4dcda68f9fbaba74cf5
-
SSDEEP
3072:3hOmTsF93UYfwC6GIoutw8YcvrqrE66kropO6BWlPFH4tw1D43eMc:3cm4FmowdHoSzhraHcpOFltH4twl43vc
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2208-8-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1660-11-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2856-20-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1116-36-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2676-44-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2476-53-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2732-62-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2784-72-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2540-91-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/3000-128-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1668-137-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2224-293-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1740-419-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1792-435-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2564-466-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2528-433-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2848-399-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2776-387-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1976-366-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2620-351-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2196-272-0x00000000002A0000-0x00000000002D2000-memory.dmp family_blackmoon behavioral1/memory/612-250-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/532-233-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1748-165-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1732-148-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2852-119-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2836-103-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2072-100-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2356-541-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1504-561-0x00000000002B0000-0x00000000002E2000-memory.dmp family_blackmoon behavioral1/memory/2272-580-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2580-641-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1816-660-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1732-717-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1252-868-0x00000000001B0000-0x00000000001E2000-memory.dmp family_blackmoon behavioral1/memory/312-995-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/532-1068-0x0000000000220000-0x0000000000252000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1660 jpvdj.exe 2856 lfxrffl.exe 1116 fxfllrx.exe 2676 hbnbnt.exe 2476 vppvd.exe 2732 xrrrrrf.exe 2784 xrfrxlr.exe 2640 bhnhnn.exe 2540 3nntbb.exe 2072 vdjdp.exe 2836 lfrffll.exe 2852 bthnnt.exe 3000 nhbnbh.exe 1668 pjvdd.exe 1876 fxrrxfl.exe 1732 xrlxxlx.exe 1748 bntnbh.exe 1560 thttnh.exe 628 pdjjj.exe 2032 rfffflx.exe 2880 3rllrrx.exe 2292 9hbttb.exe 700 vdjpj.exe 720 vjpjv.exe 532 rxlfffl.exe 1564 fxrxlrr.exe 612 1hbhbb.exe 1032 dpvdj.exe 1160 1djpd.exe 2196 rlxxlfr.exe 2020 nnntht.exe 2224 htntbb.exe 2220 dvppp.exe 844 frffrxx.exe 1580 nhtttn.exe 2252 pvdvd.exe 2856 lxrffll.exe 2268 lxxffff.exe 2140 9hnhhh.exe 2676 1thhth.exe 2684 dddpd.exe 2620 jdvdp.exe 2628 xrxxfxf.exe 1976 frfllfl.exe 2992 bhnthb.exe 2736 tnbnbh.exe 2776 5jvpd.exe 2848 7lxffrr.exe 2500 7flrrxf.exe 772 tnbntt.exe 1644 1thbbn.exe 1740 jddvp.exe 2528 jpvjp.exe 1792 ffxlrxl.exe 1748 ffrfffx.exe 1232 btthth.exe 2052 pjjvd.exe 2564 vvjvp.exe 1268 xxlrxlx.exe 2880 xfxrffr.exe 324 nhnthn.exe 1492 tnntbn.exe 2412 vpdjv.exe 1760 ppjjj.exe -
resource yara_rule behavioral1/memory/2208-0-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x000b000000014323-5.dat upx behavioral1/memory/2208-8-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1660-11-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0035000000014588-17.dat upx behavioral1/memory/2856-20-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x000700000001480e-25.dat upx behavioral1/memory/1116-27-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1116-36-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x00070000000149e1-35.dat upx behavioral1/memory/2676-44-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0007000000014b10-43.dat upx behavioral1/memory/2476-53-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0007000000014b36-54.dat upx behavioral1/files/0x0009000000014dae-64.dat upx behavioral1/memory/2784-63-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2732-62-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0007000000015c85-74.dat upx behavioral1/memory/2640-73-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2784-72-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015c93-83.dat upx behavioral1/memory/2540-91-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015c9c-90.dat upx behavioral1/files/0x0006000000015cb0-101.dat upx behavioral1/files/0x0006000000015cbd-111.dat upx behavioral1/memory/3000-128-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1668-137-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015cf5-147.dat upx behavioral1/files/0x0006000000015d0c-157.dat upx behavioral1/files/0x0006000000015d44-175.dat upx behavioral1/files/0x0006000000015e09-191.dat upx behavioral1/memory/2880-192-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015e6d-202.dat upx behavioral1/files/0x0006000000015f3c-208.dat upx behavioral1/files/0x0006000000015fa7-218.dat upx behavioral1/files/0x00060000000161b3-235.dat upx behavioral1/files/0x0006000000016476-253.dat upx behavioral1/files/0x00060000000165f0-268.dat upx behavioral1/memory/2220-294-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2224-293-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000016a6f-286.dat upx behavioral1/memory/844-301-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2848-392-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1740-419-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1792-435-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1820-509-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1524-522-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2564-466-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2528-433-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1644-412-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2848-399-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2776-387-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1976-366-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2620-351-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2268-332-0x0000000000220000-0x0000000000252000-memory.dmp upx behavioral1/files/0x0006000000016813-278.dat upx behavioral1/memory/2196-272-0x00000000002A0000-0x00000000002D2000-memory.dmp upx behavioral1/files/0x000600000001654a-261.dat upx behavioral1/memory/1032-252-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/612-250-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x00060000000162c9-243.dat upx behavioral1/memory/532-233-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x00060000000160cc-226.dat upx behavioral1/memory/2292-201-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2208 wrote to memory of 1660 2208 650a30a1bfa12db10a811ca8edd1a810_NeikiAnalytics.exe 28 PID 2208 wrote to memory of 1660 2208 650a30a1bfa12db10a811ca8edd1a810_NeikiAnalytics.exe 28 PID 2208 wrote to memory of 1660 2208 650a30a1bfa12db10a811ca8edd1a810_NeikiAnalytics.exe 28 PID 2208 wrote to memory of 1660 2208 650a30a1bfa12db10a811ca8edd1a810_NeikiAnalytics.exe 28 PID 1660 wrote to memory of 2856 1660 jpvdj.exe 64 PID 1660 wrote to memory of 2856 1660 jpvdj.exe 64 PID 1660 wrote to memory of 2856 1660 jpvdj.exe 64 PID 1660 wrote to memory of 2856 1660 jpvdj.exe 64 PID 2856 wrote to memory of 1116 2856 lfxrffl.exe 30 PID 2856 wrote to memory of 1116 2856 lfxrffl.exe 30 PID 2856 wrote to memory of 1116 2856 lfxrffl.exe 30 PID 2856 wrote to memory of 1116 2856 lfxrffl.exe 30 PID 1116 wrote to memory of 2676 1116 fxfllrx.exe 67 PID 1116 wrote to memory of 2676 1116 fxfllrx.exe 67 PID 1116 wrote to memory of 2676 1116 fxfllrx.exe 67 PID 1116 wrote to memory of 2676 1116 fxfllrx.exe 67 PID 2676 wrote to memory of 2476 2676 hbnbnt.exe 32 PID 2676 wrote to memory of 2476 2676 hbnbnt.exe 32 PID 2676 wrote to memory of 2476 2676 hbnbnt.exe 32 PID 2676 wrote to memory of 2476 2676 hbnbnt.exe 32 PID 2476 wrote to memory of 2732 2476 vppvd.exe 33 PID 2476 wrote to memory of 2732 2476 vppvd.exe 33 PID 2476 wrote to memory of 2732 2476 vppvd.exe 33 PID 2476 wrote to memory of 2732 2476 vppvd.exe 33 PID 2732 wrote to memory of 2784 2732 xrrrrrf.exe 34 PID 2732 wrote to memory of 2784 2732 xrrrrrf.exe 34 PID 2732 wrote to memory of 2784 2732 xrrrrrf.exe 34 PID 2732 wrote to memory of 2784 2732 xrrrrrf.exe 34 PID 2784 wrote to memory of 2640 2784 xrfrxlr.exe 35 PID 2784 wrote to memory of 2640 2784 xrfrxlr.exe 35 PID 2784 wrote to memory of 2640 2784 xrfrxlr.exe 35 PID 2784 wrote to memory of 2640 2784 xrfrxlr.exe 35 PID 2640 wrote to memory of 2540 2640 bhnhnn.exe 36 PID 2640 wrote to memory of 2540 2640 bhnhnn.exe 36 PID 2640 wrote to memory of 2540 2640 bhnhnn.exe 36 PID 2640 wrote to memory of 2540 2640 bhnhnn.exe 36 PID 2540 wrote to memory of 2072 2540 3nntbb.exe 37 PID 2540 wrote to memory of 2072 2540 3nntbb.exe 37 PID 2540 wrote to memory of 2072 2540 3nntbb.exe 37 PID 2540 wrote to memory of 2072 2540 3nntbb.exe 37 PID 2072 wrote to memory of 2836 2072 vdjdp.exe 38 PID 2072 wrote to memory of 2836 2072 vdjdp.exe 38 PID 2072 wrote to memory of 2836 2072 vdjdp.exe 38 PID 2072 wrote to memory of 2836 2072 vdjdp.exe 38 PID 2836 wrote to memory of 2852 2836 lfrffll.exe 39 PID 2836 wrote to memory of 2852 2836 lfrffll.exe 39 PID 2836 wrote to memory of 2852 2836 lfrffll.exe 39 PID 2836 wrote to memory of 2852 2836 lfrffll.exe 39 PID 2852 wrote to memory of 3000 2852 bthnnt.exe 40 PID 2852 wrote to memory of 3000 2852 bthnnt.exe 40 PID 2852 wrote to memory of 3000 2852 bthnnt.exe 40 PID 2852 wrote to memory of 3000 2852 bthnnt.exe 40 PID 3000 wrote to memory of 1668 3000 nhbnbh.exe 41 PID 3000 wrote to memory of 1668 3000 nhbnbh.exe 41 PID 3000 wrote to memory of 1668 3000 nhbnbh.exe 41 PID 3000 wrote to memory of 1668 3000 nhbnbh.exe 41 PID 1668 wrote to memory of 1876 1668 pjvdd.exe 42 PID 1668 wrote to memory of 1876 1668 pjvdd.exe 42 PID 1668 wrote to memory of 1876 1668 pjvdd.exe 42 PID 1668 wrote to memory of 1876 1668 pjvdd.exe 42 PID 1876 wrote to memory of 1732 1876 fxrrxfl.exe 43 PID 1876 wrote to memory of 1732 1876 fxrrxfl.exe 43 PID 1876 wrote to memory of 1732 1876 fxrrxfl.exe 43 PID 1876 wrote to memory of 1732 1876 fxrrxfl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\650a30a1bfa12db10a811ca8edd1a810_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\650a30a1bfa12db10a811ca8edd1a810_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\jpvdj.exec:\jpvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\lfxrffl.exec:\lfxrffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\fxfllrx.exec:\fxfllrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\hbnbnt.exec:\hbnbnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\vppvd.exec:\vppvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\xrrrrrf.exec:\xrrrrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\xrfrxlr.exec:\xrfrxlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\bhnhnn.exec:\bhnhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\3nntbb.exec:\3nntbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\vdjdp.exec:\vdjdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\lfrffll.exec:\lfrffll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\bthnnt.exec:\bthnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\nhbnbh.exec:\nhbnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\pjvdd.exec:\pjvdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\fxrrxfl.exec:\fxrrxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\xrlxxlx.exec:\xrlxxlx.exe17⤵
- Executes dropped EXE
PID:1732 -
\??\c:\bntnbh.exec:\bntnbh.exe18⤵
- Executes dropped EXE
PID:1748 -
\??\c:\thttnh.exec:\thttnh.exe19⤵
- Executes dropped EXE
PID:1560 -
\??\c:\pdjjj.exec:\pdjjj.exe20⤵
- Executes dropped EXE
PID:628 -
\??\c:\rfffflx.exec:\rfffflx.exe21⤵
- Executes dropped EXE
PID:2032 -
\??\c:\3rllrrx.exec:\3rllrrx.exe22⤵
- Executes dropped EXE
PID:2880 -
\??\c:\9hbttb.exec:\9hbttb.exe23⤵
- Executes dropped EXE
PID:2292 -
\??\c:\vdjpj.exec:\vdjpj.exe24⤵
- Executes dropped EXE
PID:700 -
\??\c:\vjpjv.exec:\vjpjv.exe25⤵
- Executes dropped EXE
PID:720 -
\??\c:\rxlfffl.exec:\rxlfffl.exe26⤵
- Executes dropped EXE
PID:532 -
\??\c:\fxrxlrr.exec:\fxrxlrr.exe27⤵
- Executes dropped EXE
PID:1564 -
\??\c:\1hbhbb.exec:\1hbhbb.exe28⤵
- Executes dropped EXE
PID:612 -
\??\c:\dpvdj.exec:\dpvdj.exe29⤵
- Executes dropped EXE
PID:1032 -
\??\c:\1djpd.exec:\1djpd.exe30⤵
- Executes dropped EXE
PID:1160 -
\??\c:\rlxxlfr.exec:\rlxxlfr.exe31⤵
- Executes dropped EXE
PID:2196 -
\??\c:\nnntht.exec:\nnntht.exe32⤵
- Executes dropped EXE
PID:2020 -
\??\c:\htntbb.exec:\htntbb.exe33⤵
- Executes dropped EXE
PID:2224 -
\??\c:\dvppp.exec:\dvppp.exe34⤵
- Executes dropped EXE
PID:2220 -
\??\c:\frffrxx.exec:\frffrxx.exe35⤵
- Executes dropped EXE
PID:844 -
\??\c:\nhtttn.exec:\nhtttn.exe36⤵
- Executes dropped EXE
PID:1580 -
\??\c:\pvdvd.exec:\pvdvd.exe37⤵
- Executes dropped EXE
PID:2252 -
\??\c:\lxrffll.exec:\lxrffll.exe38⤵
- Executes dropped EXE
PID:2856 -
\??\c:\lxxffff.exec:\lxxffff.exe39⤵
- Executes dropped EXE
PID:2268 -
\??\c:\9hnhhh.exec:\9hnhhh.exe40⤵
- Executes dropped EXE
PID:2140 -
\??\c:\1thhth.exec:\1thhth.exe41⤵
- Executes dropped EXE
PID:2676 -
\??\c:\dddpd.exec:\dddpd.exe42⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jdvdp.exec:\jdvdp.exe43⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xrxxfxf.exec:\xrxxfxf.exe44⤵
- Executes dropped EXE
PID:2628 -
\??\c:\frfllfl.exec:\frfllfl.exe45⤵
- Executes dropped EXE
PID:1976 -
\??\c:\bhnthb.exec:\bhnthb.exe46⤵
- Executes dropped EXE
PID:2992 -
\??\c:\tnbnbh.exec:\tnbnbh.exe47⤵
- Executes dropped EXE
PID:2736 -
\??\c:\5jvpd.exec:\5jvpd.exe48⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7lxffrr.exec:\7lxffrr.exe49⤵
- Executes dropped EXE
PID:2848 -
\??\c:\7flrrxf.exec:\7flrrxf.exe50⤵
- Executes dropped EXE
PID:2500 -
\??\c:\tnbntt.exec:\tnbntt.exe51⤵
- Executes dropped EXE
PID:772 -
\??\c:\1thbbn.exec:\1thbbn.exe52⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jddvp.exec:\jddvp.exe53⤵
- Executes dropped EXE
PID:1740 -
\??\c:\jpvjp.exec:\jpvjp.exe54⤵
- Executes dropped EXE
PID:2528 -
\??\c:\ffxlrxl.exec:\ffxlrxl.exe55⤵
- Executes dropped EXE
PID:1792 -
\??\c:\ffrfffx.exec:\ffrfffx.exe56⤵
- Executes dropped EXE
PID:1748 -
\??\c:\btthth.exec:\btthth.exe57⤵
- Executes dropped EXE
PID:1232 -
\??\c:\pjjvd.exec:\pjjvd.exe58⤵
- Executes dropped EXE
PID:2052 -
\??\c:\vvjvp.exec:\vvjvp.exe59⤵
- Executes dropped EXE
PID:2564 -
\??\c:\xxlrxlx.exec:\xxlrxlx.exe60⤵
- Executes dropped EXE
PID:1268 -
\??\c:\xfxrffr.exec:\xfxrffr.exe61⤵
- Executes dropped EXE
PID:2880 -
\??\c:\nhnthn.exec:\nhnthn.exe62⤵
- Executes dropped EXE
PID:324 -
\??\c:\tnntbn.exec:\tnntbn.exe63⤵
- Executes dropped EXE
PID:1492 -
\??\c:\vpdjv.exec:\vpdjv.exe64⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ppjjj.exec:\ppjjj.exe65⤵
- Executes dropped EXE
PID:1760 -
\??\c:\1jjvj.exec:\1jjvj.exe66⤵PID:2536
-
\??\c:\9xxxllf.exec:\9xxxllf.exe67⤵PID:1820
-
\??\c:\llllrlr.exec:\llllrlr.exe68⤵PID:392
-
\??\c:\1tbbhh.exec:\1tbbhh.exe69⤵PID:1524
-
\??\c:\hhbnnt.exec:\hhbnnt.exe70⤵PID:1252
-
\??\c:\ppvdv.exec:\ppvdv.exe71⤵PID:1696
-
\??\c:\lxxxrlr.exec:\lxxxrlr.exe72⤵PID:2356
-
\??\c:\5ntbhb.exec:\5ntbhb.exe73⤵PID:1648
-
\??\c:\vpddj.exec:\vpddj.exe74⤵PID:1504
-
\??\c:\xxllrrx.exec:\xxllrrx.exe75⤵PID:1756
-
\??\c:\bththh.exec:\bththh.exe76⤵PID:1308
-
\??\c:\btbhbb.exec:\btbhbb.exe77⤵PID:2216
-
\??\c:\3dvvd.exec:\3dvvd.exe78⤵PID:2272
-
\??\c:\3xllffr.exec:\3xllffr.exe79⤵PID:1744
-
\??\c:\btntbh.exec:\btntbh.exe80⤵PID:2612
-
\??\c:\djjpv.exec:\djjpv.exe81⤵PID:2668
-
\??\c:\lfrfffl.exec:\lfrfffl.exe82⤵PID:2696
-
\??\c:\htbbnt.exec:\htbbnt.exe83⤵PID:2884
-
\??\c:\djjjd.exec:\djjjd.exe84⤵PID:1752
-
\??\c:\rxllflr.exec:\rxllflr.exe85⤵PID:2756
-
\??\c:\pvpjd.exec:\pvpjd.exe86⤵PID:3020
-
\??\c:\fxxfrrl.exec:\fxxfrrl.exe87⤵PID:2580
-
\??\c:\nbbhhh.exec:\nbbhhh.exe88⤵PID:2784
-
\??\c:\bnnnnh.exec:\bnnnnh.exe89⤵PID:2640
-
\??\c:\pjvvj.exec:\pjvvj.exe90⤵PID:1816
-
\??\c:\vpddd.exec:\vpddd.exe91⤵PID:2988
-
\??\c:\1xfrrfr.exec:\1xfrrfr.exe92⤵PID:2524
-
\??\c:\lfxflff.exec:\lfxflff.exe93⤵PID:2968
-
\??\c:\1btbnt.exec:\1btbnt.exe94⤵PID:2716
-
\??\c:\bthhtt.exec:\bthhtt.exe95⤵PID:1788
-
\??\c:\pjdpj.exec:\pjdpj.exe96⤵PID:380
-
\??\c:\dvdpd.exec:\dvdpd.exe97⤵PID:1432
-
\??\c:\lflrffr.exec:\lflrffr.exe98⤵PID:1740
-
\??\c:\thnnbt.exec:\thnnbt.exe99⤵PID:2528
-
\??\c:\hbtbnn.exec:\hbtbnn.exe100⤵PID:1732
-
\??\c:\dpdjj.exec:\dpdjj.exe101⤵PID:2168
-
\??\c:\dvjpd.exec:\dvjpd.exe102⤵PID:2056
-
\??\c:\xrrflrl.exec:\xrrflrl.exe103⤵PID:2892
-
\??\c:\5frxlrf.exec:\5frxlrf.exe104⤵PID:2564
-
\??\c:\3hnhnt.exec:\3hnhnt.exe105⤵PID:1964
-
\??\c:\9dvpv.exec:\9dvpv.exe106⤵PID:2240
-
\??\c:\jpdjp.exec:\jpdjp.exe107⤵PID:112
-
\??\c:\rrxrrlf.exec:\rrxrrlf.exe108⤵PID:700
-
\??\c:\lxlrffl.exec:\lxlrffl.exe109⤵PID:592
-
\??\c:\hbnbnt.exec:\hbnbnt.exe110⤵PID:2508
-
\??\c:\bhnthh.exec:\bhnthh.exe111⤵PID:1924
-
\??\c:\3ppvv.exec:\3ppvv.exe112⤵PID:1036
-
\??\c:\xrrxrrf.exec:\xrrxrrf.exe113⤵PID:612
-
\??\c:\ffffrxf.exec:\ffffrxf.exe114⤵PID:2044
-
\??\c:\5llrxfr.exec:\5llrxfr.exe115⤵PID:1292
-
\??\c:\1hthnh.exec:\1hthnh.exe116⤵PID:572
-
\??\c:\1vvjv.exec:\1vvjv.exe117⤵PID:2176
-
\??\c:\jdjdj.exec:\jdjdj.exe118⤵PID:884
-
\??\c:\llxlxfr.exec:\llxlxfr.exe119⤵PID:2020
-
\??\c:\bbbhbh.exec:\bbbhbh.exe120⤵PID:1824
-
\??\c:\bbbnbh.exec:\bbbnbh.exe121⤵PID:1716
-
\??\c:\jjpjv.exec:\jjpjv.exe122⤵PID:1692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-