Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 18:00
Behavioral task
behavioral1
Sample
23f48615b9bf1c093d1b316bf6804020_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
23f48615b9bf1c093d1b316bf6804020_NeikiAnalytics.exe
-
Size
339KB
-
MD5
23f48615b9bf1c093d1b316bf6804020
-
SHA1
9c08afd2d257abe65a9bf87bd213cc9480b8ddcd
-
SHA256
940e2ac56b52b74870b773340cfc49479952feda5b2efda9bb66db9f3e4eb6bf
-
SHA512
32e5b4460626324d8e4f2a81645ecef052b9348ffab46e5ce5eb615e0aae52fc8b3ee529eee19285a4554a63990c5e26988891b28eb2674be5b2fb943e98bea7
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBHNgu5ex1B2OkEv0KvmhNiI:9cm4FmowdHoS4BtguSPKyHI
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
Processes:
resource yara_rule behavioral1/memory/2444-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/288-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1220-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-122-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1340-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/280-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1048-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1252-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-332-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2680-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-339-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1628-421-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1628-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1980-449-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/352-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/380-476-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1768-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-637-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-684-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2824-708-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1476-795-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-809-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-872-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-936-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2520-957-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1996-985-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2824-996-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1596-1052-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-1078-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-1165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1444-1265-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dvvvp.exexfflrxl.exe9hntnt.exe9llllxr.exe9nbhbb.exe1ddpj.exelfrlfxr.exe5tthtb.exelllxfxf.exennthhn.exeffxlxfl.exe1tnhnt.exevvvjd.exerlxfxxr.exejdvdd.exerlxfrfr.exe5nbbhh.exexrlrlxx.exenhbhnb.exe1vjpd.exetnbhht.exejdjdp.exeffxlfrl.exebthnth.exe7xrfxfl.exetnhnth.exevppdj.exe7tnbth.exepjvdj.exexxfrfxr.exe9bhtbh.exe1dvvd.exefrlllff.exe3hntnh.exepvvdj.exe7rlxrlf.exehhnnbt.exejdvvd.exepppvj.exe3xxlxlf.exenhttbb.exepdpdv.exefxxlxfl.exetthtnt.exefxfrlfl.exehnbbbt.exevvjvd.exe7dppp.exexlrlrll.exenttthn.exe1ppdj.exexlxlxll.exehtthbh.exevjvjv.exerrfrrll.exe1xxfxrl.exehnbhth.exejpdpp.exefflfrrf.exetnbntt.exejpjpd.exexxxfxfl.exenhtbtt.exebhthhn.exepid process 288 dvvvp.exe 2836 xfflrxl.exe 2776 9hntnt.exe 1964 9llllxr.exe 2772 9nbhbb.exe 2768 1ddpj.exe 2700 lfrlfxr.exe 2540 5tthtb.exe 2988 lllxfxf.exe 2996 nnthhn.exe 3036 ffxlxfl.exe 1220 1tnhnt.exe 2868 vvvjd.exe 1916 rlxfxxr.exe 892 jdvdd.exe 2864 rlxfrfr.exe 3008 5nbbhh.exe 1580 xrlrlxx.exe 548 nhbhnb.exe 2108 1vjpd.exe 772 tnbhht.exe 1480 jdjdp.exe 1476 ffxlfrl.exe 1340 bthnth.exe 880 7xrfxfl.exe 2384 tnhnth.exe 1544 vppdj.exe 280 7tnbth.exe 2000 pjvdj.exe 1864 xxfrfxr.exe 692 9bhtbh.exe 1700 1dvvd.exe 1856 frlllff.exe 888 3hntnh.exe 1048 pvvdj.exe 2444 7rlxrlf.exe 2788 hhnnbt.exe 1252 jdvvd.exe 2800 pppvj.exe 2680 3xxlxlf.exe 2672 nhttbb.exe 2644 pdpdv.exe 1868 fxxlxfl.exe 2664 tthtnt.exe 2696 fxfrlfl.exe 2536 hnbbbt.exe 2348 vvjvd.exe 2988 7dppp.exe 3020 xlrlrll.exe 2284 nttthn.exe 2092 1ppdj.exe 2064 xlxlxll.exe 1628 htthbh.exe 808 vjvjv.exe 1152 rrfrrll.exe 2828 1xxfxrl.exe 1980 hnbhth.exe 1944 jpdpp.exe 352 fflfrrf.exe 1596 tnbntt.exe 380 jpjpd.exe 2108 xxxfxfl.exe 772 nhtbtt.exe 1640 bhthhn.exe -
Processes:
resource yara_rule behavioral1/memory/2444-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvvvp.exe upx behavioral1/memory/2444-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/288-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xfflrxl.exe upx behavioral1/memory/2776-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9hntnt.exe upx C:\9llllxr.exe upx behavioral1/memory/2776-34-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9nbhbb.exe upx behavioral1/memory/2772-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1964-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-57-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1ddpj.exe upx C:\lfrlfxr.exe upx behavioral1/memory/2700-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5tthtb.exe upx C:\lllxfxf.exe upx behavioral1/memory/2540-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2988-90-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnthhn.exe upx C:\ffxlxfl.exe upx behavioral1/memory/2996-99-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1tnhnt.exe upx behavioral1/memory/3036-107-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvvjd.exe upx behavioral1/memory/1220-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2868-120-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlxfxxr.exe upx C:\jdvdd.exe upx C:\rlxfrfr.exe upx C:\5nbbhh.exe upx C:\xrlrlxx.exe upx C:\nhbhnb.exe upx C:\1vjpd.exe upx C:\tnbhht.exe upx C:\jdjdp.exe upx C:\ffxlfrl.exe upx C:\bthnth.exe upx behavioral1/memory/1340-216-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7xrfxfl.exe upx C:\tnhnth.exe upx C:\vppdj.exe upx C:\7tnbth.exe upx C:\pjvdj.exe upx behavioral1/memory/280-249-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxfrfxr.exe upx C:\9bhtbh.exe upx C:\1dvvd.exe upx behavioral1/memory/1700-276-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1700-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/888-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1048-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1048-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2444-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1252-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-332-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2680-340-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-348-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1628-426-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1152-433-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2828-446-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/352-467-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
23f48615b9bf1c093d1b316bf6804020_NeikiAnalytics.exedvvvp.exexfflrxl.exe9hntnt.exe9llllxr.exe9nbhbb.exe1ddpj.exelfrlfxr.exe5tthtb.exelllxfxf.exennthhn.exeffxlxfl.exe1tnhnt.exevvvjd.exerlxfxxr.exejdvdd.exedescription pid process target process PID 2444 wrote to memory of 288 2444 23f48615b9bf1c093d1b316bf6804020_NeikiAnalytics.exe dvvvp.exe PID 2444 wrote to memory of 288 2444 23f48615b9bf1c093d1b316bf6804020_NeikiAnalytics.exe dvvvp.exe PID 2444 wrote to memory of 288 2444 23f48615b9bf1c093d1b316bf6804020_NeikiAnalytics.exe dvvvp.exe PID 2444 wrote to memory of 288 2444 23f48615b9bf1c093d1b316bf6804020_NeikiAnalytics.exe dvvvp.exe PID 288 wrote to memory of 2836 288 dvvvp.exe xfflrxl.exe PID 288 wrote to memory of 2836 288 dvvvp.exe xfflrxl.exe PID 288 wrote to memory of 2836 288 dvvvp.exe xfflrxl.exe PID 288 wrote to memory of 2836 288 dvvvp.exe xfflrxl.exe PID 2836 wrote to memory of 2776 2836 xfflrxl.exe 9hntnt.exe PID 2836 wrote to memory of 2776 2836 xfflrxl.exe 9hntnt.exe PID 2836 wrote to memory of 2776 2836 xfflrxl.exe 9hntnt.exe PID 2836 wrote to memory of 2776 2836 xfflrxl.exe 9hntnt.exe PID 2776 wrote to memory of 1964 2776 9hntnt.exe 9llllxr.exe PID 2776 wrote to memory of 1964 2776 9hntnt.exe 9llllxr.exe PID 2776 wrote to memory of 1964 2776 9hntnt.exe 9llllxr.exe PID 2776 wrote to memory of 1964 2776 9hntnt.exe 9llllxr.exe PID 1964 wrote to memory of 2772 1964 9llllxr.exe 9nbhbb.exe PID 1964 wrote to memory of 2772 1964 9llllxr.exe 9nbhbb.exe PID 1964 wrote to memory of 2772 1964 9llllxr.exe 9nbhbb.exe PID 1964 wrote to memory of 2772 1964 9llllxr.exe 9nbhbb.exe PID 2772 wrote to memory of 2768 2772 9nbhbb.exe 1ddpj.exe PID 2772 wrote to memory of 2768 2772 9nbhbb.exe 1ddpj.exe PID 2772 wrote to memory of 2768 2772 9nbhbb.exe 1ddpj.exe PID 2772 wrote to memory of 2768 2772 9nbhbb.exe 1ddpj.exe PID 2768 wrote to memory of 2700 2768 1ddpj.exe lfrlfxr.exe PID 2768 wrote to memory of 2700 2768 1ddpj.exe lfrlfxr.exe PID 2768 wrote to memory of 2700 2768 1ddpj.exe lfrlfxr.exe PID 2768 wrote to memory of 2700 2768 1ddpj.exe lfrlfxr.exe PID 2700 wrote to memory of 2540 2700 lfrlfxr.exe 5tthtb.exe PID 2700 wrote to memory of 2540 2700 lfrlfxr.exe 5tthtb.exe PID 2700 wrote to memory of 2540 2700 lfrlfxr.exe 5tthtb.exe PID 2700 wrote to memory of 2540 2700 lfrlfxr.exe 5tthtb.exe PID 2540 wrote to memory of 2988 2540 5tthtb.exe lllxfxf.exe PID 2540 wrote to memory of 2988 2540 5tthtb.exe lllxfxf.exe PID 2540 wrote to memory of 2988 2540 5tthtb.exe lllxfxf.exe PID 2540 wrote to memory of 2988 2540 5tthtb.exe lllxfxf.exe PID 2988 wrote to memory of 2996 2988 lllxfxf.exe nnthhn.exe PID 2988 wrote to memory of 2996 2988 lllxfxf.exe nnthhn.exe PID 2988 wrote to memory of 2996 2988 lllxfxf.exe nnthhn.exe PID 2988 wrote to memory of 2996 2988 lllxfxf.exe nnthhn.exe PID 2996 wrote to memory of 3036 2996 nnthhn.exe ffxlxfl.exe PID 2996 wrote to memory of 3036 2996 nnthhn.exe ffxlxfl.exe PID 2996 wrote to memory of 3036 2996 nnthhn.exe ffxlxfl.exe PID 2996 wrote to memory of 3036 2996 nnthhn.exe ffxlxfl.exe PID 3036 wrote to memory of 1220 3036 ffxlxfl.exe 1tnhnt.exe PID 3036 wrote to memory of 1220 3036 ffxlxfl.exe 1tnhnt.exe PID 3036 wrote to memory of 1220 3036 ffxlxfl.exe 1tnhnt.exe PID 3036 wrote to memory of 1220 3036 ffxlxfl.exe 1tnhnt.exe PID 1220 wrote to memory of 2868 1220 1tnhnt.exe vvvjd.exe PID 1220 wrote to memory of 2868 1220 1tnhnt.exe vvvjd.exe PID 1220 wrote to memory of 2868 1220 1tnhnt.exe vvvjd.exe PID 1220 wrote to memory of 2868 1220 1tnhnt.exe vvvjd.exe PID 2868 wrote to memory of 1916 2868 vvvjd.exe rlxfxxr.exe PID 2868 wrote to memory of 1916 2868 vvvjd.exe rlxfxxr.exe PID 2868 wrote to memory of 1916 2868 vvvjd.exe rlxfxxr.exe PID 2868 wrote to memory of 1916 2868 vvvjd.exe rlxfxxr.exe PID 1916 wrote to memory of 892 1916 rlxfxxr.exe jdvdd.exe PID 1916 wrote to memory of 892 1916 rlxfxxr.exe jdvdd.exe PID 1916 wrote to memory of 892 1916 rlxfxxr.exe jdvdd.exe PID 1916 wrote to memory of 892 1916 rlxfxxr.exe jdvdd.exe PID 892 wrote to memory of 2864 892 jdvdd.exe rlxfrfr.exe PID 892 wrote to memory of 2864 892 jdvdd.exe rlxfrfr.exe PID 892 wrote to memory of 2864 892 jdvdd.exe rlxfrfr.exe PID 892 wrote to memory of 2864 892 jdvdd.exe rlxfrfr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23f48615b9bf1c093d1b316bf6804020_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\23f48615b9bf1c093d1b316bf6804020_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\dvvvp.exec:\dvvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:288 -
\??\c:\xfflrxl.exec:\xfflrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\9hntnt.exec:\9hntnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\9llllxr.exec:\9llllxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\9nbhbb.exec:\9nbhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\1ddpj.exec:\1ddpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\lfrlfxr.exec:\lfrlfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\5tthtb.exec:\5tthtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\lllxfxf.exec:\lllxfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\nnthhn.exec:\nnthhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\ffxlxfl.exec:\ffxlxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\1tnhnt.exec:\1tnhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\vvvjd.exec:\vvvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\rlxfxxr.exec:\rlxfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\jdvdd.exec:\jdvdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\rlxfrfr.exec:\rlxfrfr.exe17⤵
- Executes dropped EXE
PID:2864 -
\??\c:\5nbbhh.exec:\5nbbhh.exe18⤵
- Executes dropped EXE
PID:3008 -
\??\c:\xrlrlxx.exec:\xrlrlxx.exe19⤵
- Executes dropped EXE
PID:1580 -
\??\c:\nhbhnb.exec:\nhbhnb.exe20⤵
- Executes dropped EXE
PID:548 -
\??\c:\1vjpd.exec:\1vjpd.exe21⤵
- Executes dropped EXE
PID:2108 -
\??\c:\tnbhht.exec:\tnbhht.exe22⤵
- Executes dropped EXE
PID:772 -
\??\c:\jdjdp.exec:\jdjdp.exe23⤵
- Executes dropped EXE
PID:1480 -
\??\c:\ffxlfrl.exec:\ffxlfrl.exe24⤵
- Executes dropped EXE
PID:1476 -
\??\c:\bthnth.exec:\bthnth.exe25⤵
- Executes dropped EXE
PID:1340 -
\??\c:\7xrfxfl.exec:\7xrfxfl.exe26⤵
- Executes dropped EXE
PID:880 -
\??\c:\tnhnth.exec:\tnhnth.exe27⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vppdj.exec:\vppdj.exe28⤵
- Executes dropped EXE
PID:1544 -
\??\c:\7tnbth.exec:\7tnbth.exe29⤵
- Executes dropped EXE
PID:280 -
\??\c:\pjvdj.exec:\pjvdj.exe30⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xxfrfxr.exec:\xxfrfxr.exe31⤵
- Executes dropped EXE
PID:1864 -
\??\c:\9bhtbh.exec:\9bhtbh.exe32⤵
- Executes dropped EXE
PID:692 -
\??\c:\1dvvd.exec:\1dvvd.exe33⤵
- Executes dropped EXE
PID:1700 -
\??\c:\frlllff.exec:\frlllff.exe34⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3hntnh.exec:\3hntnh.exe35⤵
- Executes dropped EXE
PID:888 -
\??\c:\pvvdj.exec:\pvvdj.exe36⤵
- Executes dropped EXE
PID:1048 -
\??\c:\7rlxrlf.exec:\7rlxrlf.exe37⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hhnnbt.exec:\hhnnbt.exe38⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jdvvd.exec:\jdvvd.exe39⤵
- Executes dropped EXE
PID:1252 -
\??\c:\pppvj.exec:\pppvj.exe40⤵
- Executes dropped EXE
PID:2800 -
\??\c:\3xxlxlf.exec:\3xxlxlf.exe41⤵
- Executes dropped EXE
PID:2680 -
\??\c:\nhttbb.exec:\nhttbb.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\pdpdv.exec:\pdpdv.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\fxxlxfl.exec:\fxxlxfl.exe44⤵
- Executes dropped EXE
PID:1868 -
\??\c:\tthtnt.exec:\tthtnt.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\fxfrlfl.exec:\fxfrlfl.exe46⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hnbbbt.exec:\hnbbbt.exe47⤵
- Executes dropped EXE
PID:2536 -
\??\c:\vvjvd.exec:\vvjvd.exe48⤵
- Executes dropped EXE
PID:2348 -
\??\c:\7dppp.exec:\7dppp.exe49⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xlrlrll.exec:\xlrlrll.exe50⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nttthn.exec:\nttthn.exe51⤵
- Executes dropped EXE
PID:2284 -
\??\c:\1ppdj.exec:\1ppdj.exe52⤵
- Executes dropped EXE
PID:2092 -
\??\c:\xlxlxll.exec:\xlxlxll.exe53⤵
- Executes dropped EXE
PID:2064 -
\??\c:\htthbh.exec:\htthbh.exe54⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vjvjv.exec:\vjvjv.exe55⤵
- Executes dropped EXE
PID:808 -
\??\c:\rrfrrll.exec:\rrfrrll.exe56⤵
- Executes dropped EXE
PID:1152 -
\??\c:\1xxfxrl.exec:\1xxfxrl.exe57⤵
- Executes dropped EXE
PID:2828 -
\??\c:\hnbhth.exec:\hnbhth.exe58⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jpdpp.exec:\jpdpp.exe59⤵
- Executes dropped EXE
PID:1944 -
\??\c:\fflfrrf.exec:\fflfrrf.exe60⤵
- Executes dropped EXE
PID:352 -
\??\c:\tnbntt.exec:\tnbntt.exe61⤵
- Executes dropped EXE
PID:1596 -
\??\c:\jpjpd.exec:\jpjpd.exe62⤵
- Executes dropped EXE
PID:380 -
\??\c:\xxxfxfl.exec:\xxxfxfl.exe63⤵
- Executes dropped EXE
PID:2108 -
\??\c:\nhtbtt.exec:\nhtbtt.exe64⤵
- Executes dropped EXE
PID:772 -
\??\c:\bhthhn.exec:\bhthhn.exe65⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pjjvp.exec:\pjjvp.exe66⤵PID:1992
-
\??\c:\lllrlrl.exec:\lllrlrl.exe67⤵PID:1768
-
\??\c:\hbntbb.exec:\hbntbb.exe68⤵PID:828
-
\??\c:\tthhhh.exec:\tthhhh.exe69⤵PID:880
-
\??\c:\vvvvd.exec:\vvvvd.exe70⤵PID:2236
-
\??\c:\xrffrxf.exec:\xrffrxf.exe71⤵PID:1780
-
\??\c:\frllrrx.exec:\frllrrx.exe72⤵PID:744
-
\??\c:\tnhnhn.exec:\tnhnhn.exe73⤵PID:1880
-
\??\c:\vpjjp.exec:\vpjjp.exe74⤵PID:940
-
\??\c:\9xlrlrl.exec:\9xlrlrl.exe75⤵PID:1864
-
\??\c:\htthhn.exec:\htthhn.exe76⤵PID:2180
-
\??\c:\djpdd.exec:\djpdd.exe77⤵PID:2932
-
\??\c:\djvpp.exec:\djvpp.exe78⤵PID:2464
-
\??\c:\1flxrlr.exec:\1flxrlr.exe79⤵PID:2332
-
\??\c:\1hbhnn.exec:\1hbhnn.exe80⤵PID:2288
-
\??\c:\htnnnt.exec:\htnnnt.exe81⤵PID:3000
-
\??\c:\jdpvv.exec:\jdpvv.exe82⤵PID:2448
-
\??\c:\xlxfrrr.exec:\xlxfrrr.exe83⤵PID:1716
-
\??\c:\flflrxf.exec:\flflrxf.exe84⤵PID:2780
-
\??\c:\bbhtnb.exec:\bbhtnb.exe85⤵PID:2404
-
\??\c:\vjppv.exec:\vjppv.exe86⤵PID:2680
-
\??\c:\5rrrflx.exec:\5rrrflx.exe87⤵PID:2752
-
\??\c:\hbtbtb.exec:\hbtbtb.exe88⤵PID:2756
-
\??\c:\nbtbhn.exec:\nbtbhn.exe89⤵PID:2884
-
\??\c:\vvpjd.exec:\vvpjd.exe90⤵PID:2820
-
\??\c:\3rrrrlf.exec:\3rrrrlf.exe91⤵PID:2700
-
\??\c:\1tntbh.exec:\1tntbh.exe92⤵PID:2588
-
\??\c:\dvvpp.exec:\dvvpp.exe93⤵PID:2980
-
\??\c:\7vpdd.exec:\7vpdd.exe94⤵PID:3028
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe95⤵PID:1292
-
\??\c:\nnbtnn.exec:\nnbtnn.exe96⤵PID:2220
-
\??\c:\vpdpp.exec:\vpdpp.exe97⤵PID:2824
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe98⤵PID:1220
-
\??\c:\ffrxlrx.exec:\ffrxlrx.exe99⤵PID:804
-
\??\c:\9ntbnn.exec:\9ntbnn.exe100⤵PID:2736
-
\??\c:\btnbnt.exec:\btnbnt.exe101⤵PID:2732
-
\??\c:\pjvdj.exec:\pjvdj.exe102⤵PID:3032
-
\??\c:\lxrxffl.exec:\lxrxffl.exe103⤵PID:316
-
\??\c:\3rlrflf.exec:\3rlrflf.exe104⤵PID:3008
-
\??\c:\hbhhnn.exec:\hbhhnn.exe105⤵PID:1612
-
\??\c:\pjddp.exec:\pjddp.exe106⤵PID:1728
-
\??\c:\xxflfrr.exec:\xxflfrr.exe107⤵PID:320
-
\??\c:\xrflflr.exec:\xrflflr.exe108⤵PID:972
-
\??\c:\hnntnb.exec:\hnntnb.exe109⤵PID:608
-
\??\c:\7vvvv.exec:\7vvvv.exe110⤵PID:1988
-
\??\c:\1rfrlxr.exec:\1rfrlxr.exe111⤵PID:1476
-
\??\c:\9tnnbb.exec:\9tnnbb.exe112⤵PID:988
-
\??\c:\bbhhbn.exec:\bbhhbn.exe113⤵PID:2268
-
\??\c:\5jjjp.exec:\5jjjp.exe114⤵PID:2252
-
\??\c:\rflfxlx.exec:\rflfxlx.exe115⤵PID:2336
-
\??\c:\tnbtnt.exec:\tnbtnt.exe116⤵PID:1332
-
\??\c:\jdpdv.exec:\jdpdv.exe117⤵PID:1084
-
\??\c:\vpvdj.exec:\vpvdj.exe118⤵PID:3040
-
\??\c:\bhtnnh.exec:\bhtnnh.exe119⤵PID:1880
-
\??\c:\pjvjv.exec:\pjvjv.exe120⤵PID:1796
-
\??\c:\5xxxrrl.exec:\5xxxrrl.exe121⤵PID:1832
-
\??\c:\thtbnt.exec:\thtbnt.exe122⤵PID:2240
-
\??\c:\ddpvj.exec:\ddpvj.exe123⤵PID:2232
-
\??\c:\fxrlflr.exec:\fxrlflr.exe124⤵PID:1816
-
\??\c:\lllrfrl.exec:\lllrfrl.exe125⤵PID:2452
-
\??\c:\1ntbhn.exec:\1ntbhn.exe126⤵PID:2676
-
\??\c:\jdvvp.exec:\jdvvp.exe127⤵PID:1604
-
\??\c:\frrxflf.exec:\frrxflf.exe128⤵PID:2896
-
\??\c:\1nntnn.exec:\1nntnn.exe129⤵PID:2816
-
\??\c:\1djvj.exec:\1djvj.exe130⤵PID:2632
-
\??\c:\vvpvd.exec:\vvpvd.exe131⤵PID:2764
-
\??\c:\lfrxrlr.exec:\lfrxrlr.exe132⤵PID:2672
-
\??\c:\bnhtbb.exec:\bnhtbb.exe133⤵PID:2752
-
\??\c:\vpdpj.exec:\vpdpj.exe134⤵PID:2756
-
\??\c:\pdvvp.exec:\pdvvp.exe135⤵PID:2592
-
\??\c:\lfxflfr.exec:\lfxflfr.exe136⤵PID:2520
-
\??\c:\bbbbbn.exec:\bbbbbn.exe137⤵PID:1636
-
\??\c:\7vpdp.exec:\7vpdp.exe138⤵PID:552
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe139⤵PID:2996
-
\??\c:\frfxffl.exec:\frfxffl.exe140⤵PID:3036
-
\??\c:\7nhtbn.exec:\7nhtbn.exe141⤵PID:1996
-
\??\c:\jvpvv.exec:\jvpvv.exe142⤵PID:2220
-
\??\c:\ppdpp.exec:\ppdpp.exe143⤵PID:2824
-
\??\c:\llxxlrf.exec:\llxxlrf.exe144⤵PID:2512
-
\??\c:\hbtnbh.exec:\hbtnbh.exe145⤵PID:2628
-
\??\c:\nnttnt.exec:\nnttnt.exe146⤵PID:2736
-
\??\c:\pjdjv.exec:\pjdjv.exe147⤵PID:2964
-
\??\c:\xlffrlx.exec:\xlffrlx.exe148⤵PID:1688
-
\??\c:\rrxrfrf.exec:\rrxrfrf.exe149⤵PID:1944
-
\??\c:\bnbbhb.exec:\bnbbhb.exe150⤵PID:1820
-
\??\c:\ttnbbb.exec:\ttnbbb.exe151⤵PID:1596
-
\??\c:\dvppv.exec:\dvppv.exe152⤵PID:1180
-
\??\c:\fffxlrl.exec:\fffxlrl.exe153⤵PID:484
-
\??\c:\1hhtbh.exec:\1hhtbh.exe154⤵PID:580
-
\??\c:\tbthbn.exec:\tbthbn.exe155⤵PID:560
-
\??\c:\vpjpv.exec:\vpjpv.exe156⤵PID:1992
-
\??\c:\5fxlxlr.exec:\5fxlxlr.exe157⤵PID:1768
-
\??\c:\tnnthn.exec:\tnnthn.exe158⤵PID:988
-
\??\c:\3bbbnh.exec:\3bbbnh.exe159⤵PID:1800
-
\??\c:\vjvpv.exec:\vjvpv.exe160⤵PID:828
-
\??\c:\3rflxfl.exec:\3rflxfl.exe161⤵PID:612
-
\??\c:\rrlxrxf.exec:\rrlxrxf.exe162⤵PID:1092
-
\??\c:\hhbhtb.exec:\hhbhtb.exe163⤵PID:1312
-
\??\c:\pjvdp.exec:\pjvdp.exe164⤵PID:900
-
\??\c:\vpddp.exec:\vpddp.exe165⤵PID:692
-
\??\c:\flrrrrx.exec:\flrrrrx.exe166⤵PID:1036
-
\??\c:\3htbbb.exec:\3htbbb.exe167⤵PID:2952
-
\??\c:\7nhntt.exec:\7nhntt.exe168⤵PID:1832
-
\??\c:\vddpv.exec:\vddpv.exe169⤵PID:2216
-
\??\c:\llfxllx.exec:\llfxllx.exe170⤵PID:2232
-
\??\c:\3hthbb.exec:\3hthbb.exe171⤵PID:1664
-
\??\c:\tntbtt.exec:\tntbtt.exe172⤵PID:2608
-
\??\c:\dvppp.exec:\dvppp.exe173⤵PID:2676
-
\??\c:\fxflrxf.exec:\fxflrxf.exe174⤵PID:2656
-
\??\c:\lfflxlr.exec:\lfflxlr.exe175⤵PID:2836
-
\??\c:\ttnhtb.exec:\ttnhtb.exe176⤵PID:2120
-
\??\c:\tnhhbb.exec:\tnhhbb.exe177⤵PID:2276
-
\??\c:\jdppd.exec:\jdppd.exe178⤵PID:2772
-
\??\c:\fxllflr.exec:\fxllflr.exe179⤵PID:2672
-
\??\c:\lxllxfl.exec:\lxllxfl.exe180⤵PID:2644
-
\??\c:\bbbnbb.exec:\bbbnbb.exe181⤵PID:2524
-
\??\c:\1vvdp.exec:\1vvdp.exe182⤵PID:2600
-
\??\c:\dpjjv.exec:\dpjjv.exe183⤵PID:2696
-
\??\c:\3fxlrfx.exec:\3fxlrfx.exe184⤵PID:2348
-
\??\c:\hnnbbn.exec:\hnnbbn.exe185⤵PID:1444
-
\??\c:\hbnbnh.exec:\hbnbnh.exe186⤵PID:1896
-
\??\c:\pjjpd.exec:\pjjpd.exe187⤵PID:1844
-
\??\c:\lxllflr.exec:\lxllflr.exe188⤵PID:2256
-
\??\c:\bbhbtt.exec:\bbhbtt.exe189⤵PID:2004
-
\??\c:\pjpjp.exec:\pjpjp.exe190⤵PID:2064
-
\??\c:\djjpv.exec:\djjpv.exe191⤵PID:2616
-
\??\c:\xrffrlr.exec:\xrffrlr.exe192⤵PID:556
-
\??\c:\5nttbh.exec:\5nttbh.exe193⤵PID:2972
-
\??\c:\bthntb.exec:\bthntb.exe194⤵PID:1584
-
\??\c:\1pjpv.exec:\1pjpv.exe195⤵PID:1580
-
\??\c:\xffxxrx.exec:\xffxxrx.exe196⤵PID:2900
-
\??\c:\7fxxfrf.exec:\7fxxfrf.exe197⤵PID:1692
-
\??\c:\7hbhbn.exec:\7hbhbn.exe198⤵PID:812
-
\??\c:\pjdpv.exec:\pjdpv.exe199⤵PID:576
-
\??\c:\ddvjv.exec:\ddvjv.exe200⤵PID:1496
-
\??\c:\lrlffll.exec:\lrlffll.exe201⤵PID:1520
-
\??\c:\3nhhnn.exec:\3nhhnn.exe202⤵PID:1988
-
\??\c:\bbtbnt.exec:\bbtbnt.exe203⤵PID:1340
-
\??\c:\7vvpd.exec:\7vvpd.exe204⤵PID:2324
-
\??\c:\3jjpv.exec:\3jjpv.exe205⤵PID:2748
-
\??\c:\frxfxfl.exec:\frxfxfl.exe206⤵PID:2384
-
\??\c:\bbbtnb.exec:\bbbtnb.exe207⤵PID:1788
-
\??\c:\dvpdv.exec:\dvpdv.exe208⤵PID:1616
-
\??\c:\vvdpj.exec:\vvdpj.exe209⤵PID:280
-
\??\c:\tthtth.exec:\tthtth.exe210⤵PID:2000
-
\??\c:\nhbbth.exec:\nhbbth.exe211⤵PID:1824
-
\??\c:\vpddj.exec:\vpddj.exe212⤵PID:1836
-
\??\c:\jdjvp.exec:\jdjvp.exe213⤵PID:2468
-
\??\c:\5lrxrlr.exec:\5lrxrlr.exe214⤵PID:2180
-
\??\c:\nnhbnt.exec:\nnhbnt.exe215⤵PID:2160
-
\??\c:\nbnnbt.exec:\nbnnbt.exe216⤵PID:2172
-
\??\c:\ddjjv.exec:\ddjjv.exe217⤵PID:268
-
\??\c:\llfxrxr.exec:\llfxrxr.exe218⤵PID:288
-
\??\c:\9rrxllx.exec:\9rrxllx.exe219⤵PID:1572
-
\??\c:\tbnbbt.exec:\tbnbbt.exe220⤵PID:1604
-
\??\c:\vvpjp.exec:\vvpjp.exe221⤵PID:2776
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe222⤵PID:2684
-
\??\c:\lrllxlx.exec:\lrllxlx.exe223⤵PID:1416
-
\??\c:\hhtnbn.exec:\hhtnbn.exe224⤵PID:2680
-
\??\c:\ppjjv.exec:\ppjjv.exe225⤵PID:2548
-
\??\c:\1vpdj.exec:\1vpdj.exe226⤵PID:2560
-
\??\c:\rfrrrrl.exec:\rfrrrrl.exe227⤵PID:3060
-
\??\c:\7thbhn.exec:\7thbhn.exe228⤵PID:2556
-
\??\c:\jjjpj.exec:\jjjpj.exe229⤵PID:2540
-
\??\c:\vjpdd.exec:\vjpdd.exe230⤵PID:340
-
\??\c:\xxlrflx.exec:\xxlrflx.exe231⤵PID:3012
-
\??\c:\5ttbtt.exec:\5ttbtt.exe232⤵PID:3024
-
\??\c:\bbhtnh.exec:\bbhtnh.exe233⤵PID:2564
-
\??\c:\jjddd.exec:\jjddd.exe234⤵PID:1148
-
\??\c:\ffflxxl.exec:\ffflxxl.exe235⤵PID:308
-
\??\c:\tnbntt.exec:\tnbntt.exe236⤵PID:1552
-
\??\c:\5nbbbh.exec:\5nbbbh.exe237⤵PID:2004
-
\??\c:\ppjdj.exec:\ppjdj.exe238⤵PID:2584
-
\??\c:\5lrfrfr.exec:\5lrfrfr.exe239⤵PID:2616
-
\??\c:\rflxlll.exec:\rflxlll.exe240⤵PID:2968
-
\??\c:\hhbnnb.exec:\hhbnnb.exe241⤵PID:2960
-
\??\c:\vvvdj.exec:\vvvdj.exe242⤵PID:1688