Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 18:00
Behavioral task
behavioral1
Sample
23f52dcc90e7712a02cb0e32750113d0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
23f52dcc90e7712a02cb0e32750113d0_NeikiAnalytics.exe
-
Size
92KB
-
MD5
23f52dcc90e7712a02cb0e32750113d0
-
SHA1
75fec052ae079e02ed43876cdb47926009638f62
-
SHA256
bd6d781cb6cab75d16c779609ead98735c18845a21b0ebd8be73163d175c1b58
-
SHA512
003e9327793dfc5b843b3962286ec095266906828b382b2513779953e164986ccf296460232d4f41c4e36db1c1c7aeb50d4f6256345848eb997f3f9b75874ca0
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWprCI:8hOmTsF93UYfwC6GIout0fmCiiiXA6mD
Malware Config
Signatures
-
Detect Blackmoon payload 46 IoCs
Processes:
resource yara_rule behavioral1/memory/2916-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1496-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1156-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1176-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1940-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2252-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1604-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1368-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/816-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1852-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/568-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-275-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2316-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/644-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-628-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-640-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-662-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/876-694-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1364-707-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1756-752-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-1085-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-1129-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2640-1203-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2060-13374-0x0000000077780000-0x000000007789F000-memory.dmp family_blackmoon behavioral1/memory/2060-25517-0x0000000077780000-0x000000007789F000-memory.dmp family_blackmoon behavioral1/memory/2060-29861-0x0000000077780000-0x000000007789F000-memory.dmp family_blackmoon behavioral1/memory/2060-33645-0x0000000077780000-0x000000007789F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dddvp.exebbnthb.exeppdvj.exexxlllxr.exetbnntt.exebbnbnn.exevdjpv.exerlfxlrl.exetnhthn.exettbthb.exepvdvd.exerrrxrrf.exe9rllflr.exe1hbhtb.exeppjdp.exepjjpp.exeffxrlfr.exehhnhnh.exe3tnbnt.exeddppd.exedvpvj.exefflfffl.exe5nbhhn.exepjvjp.exe3rrxffl.exennhhtb.exetttnnb.exe9pjpd.exerrrxrrl.exe9hbbnn.exe9thhtb.exepppvd.exelrrlxrl.exe5xxrxxl.exe7bthbh.exebbnbnb.exejjdvj.exejjpvd.exellflxfr.exe3flflff.exennthth.exebtntbh.exejdvdj.exejvpvj.exe5rrxxfr.exerrrfrfr.exetnbthn.exebbntnb.exevvdpv.exevvvdv.exeffrxflf.exennthnn.exebtnnbh.exepjjdj.exe5pvvd.exerxfrflx.exe3ffxlrf.exenbttnb.exe3ppdp.exeppjpp.exexllllxf.exerllrxxl.exefrxfrlr.exebbnthn.exepid process 2928 dddvp.exe 3048 bbnthb.exe 2620 ppdvj.exe 2544 xxlllxr.exe 2536 tbnntt.exe 2776 bbnbnn.exe 2592 vdjpv.exe 2432 rlfxlrl.exe 2880 tnhthn.exe 2892 ttbthb.exe 2684 pvdvd.exe 2716 rrrxrrf.exe 2752 9rllflr.exe 1496 1hbhtb.exe 1764 ppjdp.exe 1752 pjjpp.exe 2384 ffxrlfr.exe 1460 hhnhnh.exe 1156 3tnbnt.exe 1176 ddppd.exe 1688 dvpvj.exe 2236 fflfffl.exe 1940 5nbhhn.exe 2252 pjvjp.exe 1116 3rrxffl.exe 2220 nnhhtb.exe 1920 tttnnb.exe 3028 9pjpd.exe 1604 rrrxrrl.exe 1368 9hbbnn.exe 816 9thhtb.exe 2092 pppvd.exe 1852 lrrlxrl.exe 568 5xxrxxl.exe 2088 7bthbh.exe 908 bbnbnb.exe 2856 jjdvj.exe 1748 jjpvd.exe 2316 llflxfr.exe 1644 3flflff.exe 1932 nnthth.exe 2980 btntbh.exe 2688 jdvdj.exe 2660 jvpvj.exe 2988 5rrxxfr.exe 2652 rrrfrfr.exe 2444 tnbthn.exe 2556 bbntnb.exe 2440 vvdpv.exe 2420 vvvdv.exe 2464 ffrxflf.exe 712 nnthnn.exe 2668 btnnbh.exe 2116 pjjdj.exe 2712 5pvvd.exe 2716 rxfrflx.exe 848 3ffxlrf.exe 1244 nbttnb.exe 644 3ppdp.exe 1436 ppjpp.exe 2124 xllllxf.exe 1252 rllrxxl.exe 1152 frxfrlr.exe 1460 bbnthn.exe -
Processes:
resource yara_rule behavioral1/memory/2916-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2916-3-0x00000000003A0000-0x00000000003C7000-memory.dmp upx behavioral1/memory/2916-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dddvp.exe upx C:\bbnthb.exe upx behavioral1/memory/2928-16-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppdvj.exe upx behavioral1/memory/3048-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2620-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxlllxr.exe upx C:\tbnntt.exe upx behavioral1/memory/2544-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2536-43-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbnbnn.exe upx C:\vdjpv.exe upx behavioral1/memory/2776-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2592-64-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlfxlrl.exe upx C:\tnhthn.exe upx behavioral1/memory/2880-74-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttbthb.exe upx C:\pvdvd.exe upx behavioral1/memory/2684-93-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrrxrrf.exe upx \??\c:\9rllflr.exe upx behavioral1/memory/2716-102-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1hbhtb.exe upx behavioral1/memory/1496-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1496-118-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppjdp.exe upx behavioral1/memory/1764-120-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjjpp.exe upx C:\ffxrlfr.exe upx C:\hhnhnh.exe upx C:\3tnbnt.exe upx behavioral1/memory/1156-149-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddppd.exe upx behavioral1/memory/1176-156-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvpvj.exe upx behavioral1/memory/1176-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1688-165-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fflfffl.exe upx behavioral1/memory/2236-173-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5nbhhn.exe upx behavioral1/memory/1940-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1940-188-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjvjp.exe upx behavioral1/memory/2252-196-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3rrxffl.exe upx behavioral1/memory/1116-198-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnhhtb.exe upx behavioral1/memory/2220-212-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tttnnb.exe upx behavioral1/memory/1920-216-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9pjpd.exe upx behavioral1/memory/3028-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3028-229-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrrxrrl.exe upx behavioral1/memory/1604-238-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9hbbnn.exe upx behavioral1/memory/1368-239-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9thhtb.exe upx behavioral1/memory/816-247-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pppvd.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
23f52dcc90e7712a02cb0e32750113d0_NeikiAnalytics.exedddvp.exebbnthb.exeppdvj.exexxlllxr.exetbnntt.exebbnbnn.exevdjpv.exerlfxlrl.exetnhthn.exettbthb.exepvdvd.exerrrxrrf.exe9rllflr.exe1hbhtb.exeppjdp.exedescription pid process target process PID 2916 wrote to memory of 2928 2916 23f52dcc90e7712a02cb0e32750113d0_NeikiAnalytics.exe dddvp.exe PID 2916 wrote to memory of 2928 2916 23f52dcc90e7712a02cb0e32750113d0_NeikiAnalytics.exe dddvp.exe PID 2916 wrote to memory of 2928 2916 23f52dcc90e7712a02cb0e32750113d0_NeikiAnalytics.exe dddvp.exe PID 2916 wrote to memory of 2928 2916 23f52dcc90e7712a02cb0e32750113d0_NeikiAnalytics.exe dddvp.exe PID 2928 wrote to memory of 3048 2928 dddvp.exe bbnthb.exe PID 2928 wrote to memory of 3048 2928 dddvp.exe bbnthb.exe PID 2928 wrote to memory of 3048 2928 dddvp.exe bbnthb.exe PID 2928 wrote to memory of 3048 2928 dddvp.exe bbnthb.exe PID 3048 wrote to memory of 2620 3048 bbnthb.exe ppdvj.exe PID 3048 wrote to memory of 2620 3048 bbnthb.exe ppdvj.exe PID 3048 wrote to memory of 2620 3048 bbnthb.exe ppdvj.exe PID 3048 wrote to memory of 2620 3048 bbnthb.exe ppdvj.exe PID 2620 wrote to memory of 2544 2620 ppdvj.exe xxlllxr.exe PID 2620 wrote to memory of 2544 2620 ppdvj.exe xxlllxr.exe PID 2620 wrote to memory of 2544 2620 ppdvj.exe xxlllxr.exe PID 2620 wrote to memory of 2544 2620 ppdvj.exe xxlllxr.exe PID 2544 wrote to memory of 2536 2544 xxlllxr.exe tbnntt.exe PID 2544 wrote to memory of 2536 2544 xxlllxr.exe tbnntt.exe PID 2544 wrote to memory of 2536 2544 xxlllxr.exe tbnntt.exe PID 2544 wrote to memory of 2536 2544 xxlllxr.exe tbnntt.exe PID 2536 wrote to memory of 2776 2536 tbnntt.exe bbnbnn.exe PID 2536 wrote to memory of 2776 2536 tbnntt.exe bbnbnn.exe PID 2536 wrote to memory of 2776 2536 tbnntt.exe bbnbnn.exe PID 2536 wrote to memory of 2776 2536 tbnntt.exe bbnbnn.exe PID 2776 wrote to memory of 2592 2776 bbnbnn.exe vdjpv.exe PID 2776 wrote to memory of 2592 2776 bbnbnn.exe vdjpv.exe PID 2776 wrote to memory of 2592 2776 bbnbnn.exe vdjpv.exe PID 2776 wrote to memory of 2592 2776 bbnbnn.exe vdjpv.exe PID 2592 wrote to memory of 2432 2592 vdjpv.exe rlfxlrl.exe PID 2592 wrote to memory of 2432 2592 vdjpv.exe rlfxlrl.exe PID 2592 wrote to memory of 2432 2592 vdjpv.exe rlfxlrl.exe PID 2592 wrote to memory of 2432 2592 vdjpv.exe rlfxlrl.exe PID 2432 wrote to memory of 2880 2432 rlfxlrl.exe tnhthn.exe PID 2432 wrote to memory of 2880 2432 rlfxlrl.exe tnhthn.exe PID 2432 wrote to memory of 2880 2432 rlfxlrl.exe tnhthn.exe PID 2432 wrote to memory of 2880 2432 rlfxlrl.exe tnhthn.exe PID 2880 wrote to memory of 2892 2880 tnhthn.exe ttbthb.exe PID 2880 wrote to memory of 2892 2880 tnhthn.exe ttbthb.exe PID 2880 wrote to memory of 2892 2880 tnhthn.exe ttbthb.exe PID 2880 wrote to memory of 2892 2880 tnhthn.exe ttbthb.exe PID 2892 wrote to memory of 2684 2892 ttbthb.exe pvdvd.exe PID 2892 wrote to memory of 2684 2892 ttbthb.exe pvdvd.exe PID 2892 wrote to memory of 2684 2892 ttbthb.exe pvdvd.exe PID 2892 wrote to memory of 2684 2892 ttbthb.exe pvdvd.exe PID 2684 wrote to memory of 2716 2684 pvdvd.exe rrrxrrf.exe PID 2684 wrote to memory of 2716 2684 pvdvd.exe rrrxrrf.exe PID 2684 wrote to memory of 2716 2684 pvdvd.exe rrrxrrf.exe PID 2684 wrote to memory of 2716 2684 pvdvd.exe rrrxrrf.exe PID 2716 wrote to memory of 2752 2716 rrrxrrf.exe 9rllflr.exe PID 2716 wrote to memory of 2752 2716 rrrxrrf.exe 9rllflr.exe PID 2716 wrote to memory of 2752 2716 rrrxrrf.exe 9rllflr.exe PID 2716 wrote to memory of 2752 2716 rrrxrrf.exe 9rllflr.exe PID 2752 wrote to memory of 1496 2752 9rllflr.exe 1hbhtb.exe PID 2752 wrote to memory of 1496 2752 9rllflr.exe 1hbhtb.exe PID 2752 wrote to memory of 1496 2752 9rllflr.exe 1hbhtb.exe PID 2752 wrote to memory of 1496 2752 9rllflr.exe 1hbhtb.exe PID 1496 wrote to memory of 1764 1496 1hbhtb.exe ppjdp.exe PID 1496 wrote to memory of 1764 1496 1hbhtb.exe ppjdp.exe PID 1496 wrote to memory of 1764 1496 1hbhtb.exe ppjdp.exe PID 1496 wrote to memory of 1764 1496 1hbhtb.exe ppjdp.exe PID 1764 wrote to memory of 1752 1764 ppjdp.exe pjjpp.exe PID 1764 wrote to memory of 1752 1764 ppjdp.exe pjjpp.exe PID 1764 wrote to memory of 1752 1764 ppjdp.exe pjjpp.exe PID 1764 wrote to memory of 1752 1764 ppjdp.exe pjjpp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23f52dcc90e7712a02cb0e32750113d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\23f52dcc90e7712a02cb0e32750113d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\dddvp.exec:\dddvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\bbnthb.exec:\bbnthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\ppdvj.exec:\ppdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xxlllxr.exec:\xxlllxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\tbnntt.exec:\tbnntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\bbnbnn.exec:\bbnbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\vdjpv.exec:\vdjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rlfxlrl.exec:\rlfxlrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\tnhthn.exec:\tnhthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\ttbthb.exec:\ttbthb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\pvdvd.exec:\pvdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\rrrxrrf.exec:\rrrxrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\9rllflr.exec:\9rllflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\1hbhtb.exec:\1hbhtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\ppjdp.exec:\ppjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\pjjpp.exec:\pjjpp.exe17⤵
- Executes dropped EXE
PID:1752 -
\??\c:\ffxrlfr.exec:\ffxrlfr.exe18⤵
- Executes dropped EXE
PID:2384 -
\??\c:\hhnhnh.exec:\hhnhnh.exe19⤵
- Executes dropped EXE
PID:1460 -
\??\c:\3tnbnt.exec:\3tnbnt.exe20⤵
- Executes dropped EXE
PID:1156 -
\??\c:\ddppd.exec:\ddppd.exe21⤵
- Executes dropped EXE
PID:1176 -
\??\c:\dvpvj.exec:\dvpvj.exe22⤵
- Executes dropped EXE
PID:1688 -
\??\c:\fflfffl.exec:\fflfffl.exe23⤵
- Executes dropped EXE
PID:2236 -
\??\c:\5nbhhn.exec:\5nbhhn.exe24⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pjvjp.exec:\pjvjp.exe25⤵
- Executes dropped EXE
PID:2252 -
\??\c:\3rrxffl.exec:\3rrxffl.exe26⤵
- Executes dropped EXE
PID:1116 -
\??\c:\nnhhtb.exec:\nnhhtb.exe27⤵
- Executes dropped EXE
PID:2220 -
\??\c:\tttnnb.exec:\tttnnb.exe28⤵
- Executes dropped EXE
PID:1920 -
\??\c:\9pjpd.exec:\9pjpd.exe29⤵
- Executes dropped EXE
PID:3028 -
\??\c:\rrrxrrl.exec:\rrrxrrl.exe30⤵
- Executes dropped EXE
PID:1604 -
\??\c:\9hbbnn.exec:\9hbbnn.exe31⤵
- Executes dropped EXE
PID:1368 -
\??\c:\9thhtb.exec:\9thhtb.exe32⤵
- Executes dropped EXE
PID:816 -
\??\c:\pppvd.exec:\pppvd.exe33⤵
- Executes dropped EXE
PID:2092 -
\??\c:\lrrlxrl.exec:\lrrlxrl.exe34⤵
- Executes dropped EXE
PID:1852 -
\??\c:\5xxrxxl.exec:\5xxrxxl.exe35⤵
- Executes dropped EXE
PID:568 -
\??\c:\7bthbh.exec:\7bthbh.exe36⤵
- Executes dropped EXE
PID:2088 -
\??\c:\bbnbnb.exec:\bbnbnb.exe37⤵
- Executes dropped EXE
PID:908 -
\??\c:\jjdvj.exec:\jjdvj.exe38⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jjpvd.exec:\jjpvd.exe39⤵
- Executes dropped EXE
PID:1748 -
\??\c:\llflxfr.exec:\llflxfr.exe40⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3flflff.exec:\3flflff.exe41⤵
- Executes dropped EXE
PID:1644 -
\??\c:\nnthth.exec:\nnthth.exe42⤵
- Executes dropped EXE
PID:1932 -
\??\c:\btntbh.exec:\btntbh.exe43⤵
- Executes dropped EXE
PID:2980 -
\??\c:\jdvdj.exec:\jdvdj.exe44⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jvpvj.exec:\jvpvj.exe45⤵
- Executes dropped EXE
PID:2660 -
\??\c:\5rrxxfr.exec:\5rrxxfr.exe46⤵
- Executes dropped EXE
PID:2988 -
\??\c:\rrrfrfr.exec:\rrrfrfr.exe47⤵
- Executes dropped EXE
PID:2652 -
\??\c:\tnbthn.exec:\tnbthn.exe48⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bbntnb.exec:\bbntnb.exe49⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vvdpv.exec:\vvdpv.exe50⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vvvdv.exec:\vvvdv.exe51⤵
- Executes dropped EXE
PID:2420 -
\??\c:\ffrxflf.exec:\ffrxflf.exe52⤵
- Executes dropped EXE
PID:2464 -
\??\c:\nnthnn.exec:\nnthnn.exe53⤵
- Executes dropped EXE
PID:712 -
\??\c:\btnnbh.exec:\btnnbh.exe54⤵
- Executes dropped EXE
PID:2668 -
\??\c:\pjjdj.exec:\pjjdj.exe55⤵
- Executes dropped EXE
PID:2116 -
\??\c:\5pvvd.exec:\5pvvd.exe56⤵
- Executes dropped EXE
PID:2712 -
\??\c:\rxfrflx.exec:\rxfrflx.exe57⤵
- Executes dropped EXE
PID:2716 -
\??\c:\3ffxlrf.exec:\3ffxlrf.exe58⤵
- Executes dropped EXE
PID:848 -
\??\c:\nbttnb.exec:\nbttnb.exe59⤵
- Executes dropped EXE
PID:1244 -
\??\c:\3ppdp.exec:\3ppdp.exe60⤵
- Executes dropped EXE
PID:644 -
\??\c:\ppjpp.exec:\ppjpp.exe61⤵
- Executes dropped EXE
PID:1436 -
\??\c:\xllllxf.exec:\xllllxf.exe62⤵
- Executes dropped EXE
PID:2124 -
\??\c:\rllrxxl.exec:\rllrxxl.exe63⤵
- Executes dropped EXE
PID:1252 -
\??\c:\frxfrlr.exec:\frxfrlr.exe64⤵
- Executes dropped EXE
PID:1152 -
\??\c:\bbnthn.exec:\bbnthn.exe65⤵
- Executes dropped EXE
PID:1460 -
\??\c:\vjvvp.exec:\vjvvp.exe66⤵PID:1156
-
\??\c:\vdjdv.exec:\vdjdv.exe67⤵PID:2032
-
\??\c:\1rxxrll.exec:\1rxxrll.exe68⤵PID:2024
-
\??\c:\xrxxffr.exec:\xrxxffr.exe69⤵PID:1728
-
\??\c:\9nbbbt.exec:\9nbbbt.exe70⤵PID:1628
-
\??\c:\vpjpj.exec:\vpjpj.exe71⤵PID:2404
-
\??\c:\jvjpv.exec:\jvjpv.exe72⤵PID:2216
-
\??\c:\xxrfllr.exec:\xxrfllr.exe73⤵PID:1756
-
\??\c:\xrlxlrf.exec:\xrlxlrf.exe74⤵PID:1804
-
\??\c:\nnntth.exec:\nnntth.exe75⤵PID:1964
-
\??\c:\ttthtb.exec:\ttthtb.exe76⤵PID:792
-
\??\c:\vvvdv.exec:\vvvdv.exe77⤵PID:408
-
\??\c:\lffrxrf.exec:\lffrxrf.exe78⤵PID:496
-
\??\c:\xrxlrrr.exec:\xrxlrrr.exe79⤵PID:3028
-
\??\c:\bttnnn.exec:\bttnnn.exe80⤵PID:376
-
\??\c:\dpvvp.exec:\dpvvp.exe81⤵PID:976
-
\??\c:\1jvdj.exec:\1jvdj.exe82⤵PID:1020
-
\??\c:\rfxfrxr.exec:\rfxfrxr.exe83⤵PID:2108
-
\??\c:\llrxrff.exec:\llrxrff.exe84⤵PID:1060
-
\??\c:\hnnhht.exec:\hnnhht.exe85⤵PID:1712
-
\??\c:\vpppv.exec:\vpppv.exe86⤵PID:1652
-
\??\c:\vjpjj.exec:\vjpjj.exe87⤵PID:568
-
\??\c:\lfxxxrx.exec:\lfxxxrx.exe88⤵PID:2088
-
\??\c:\frfflrx.exec:\frfflrx.exe89⤵PID:1224
-
\??\c:\hbtbbh.exec:\hbtbbh.exe90⤵PID:1796
-
\??\c:\ntttbn.exec:\ntttbn.exe91⤵PID:2080
-
\??\c:\vpdvd.exec:\vpdvd.exe92⤵PID:2908
-
\??\c:\7vpvd.exec:\7vpvd.exe93⤵PID:1644
-
\??\c:\rxrxffl.exec:\rxrxffl.exe94⤵PID:2616
-
\??\c:\lrxffrl.exec:\lrxffrl.exe95⤵PID:2628
-
\??\c:\nhnnnn.exec:\nhnnnn.exe96⤵PID:2688
-
\??\c:\nnnbbn.exec:\nnnbbn.exe97⤵PID:2660
-
\??\c:\vpjpj.exec:\vpjpj.exe98⤵PID:2988
-
\??\c:\jvvpv.exec:\jvvpv.exe99⤵PID:2508
-
\??\c:\1xfxrrr.exec:\1xfxrrr.exe100⤵PID:2456
-
\??\c:\xlrrrfl.exec:\xlrrrfl.exe101⤵PID:2448
-
\??\c:\bnttbt.exec:\bnttbt.exe102⤵PID:2584
-
\??\c:\jvvdv.exec:\jvvdv.exe103⤵PID:2420
-
\??\c:\jvjjp.exec:\jvjjp.exe104⤵PID:2972
-
\??\c:\9xlllff.exec:\9xlllff.exe105⤵PID:712
-
\??\c:\9lxxrlx.exec:\9lxxrlx.exe106⤵PID:1592
-
\??\c:\1nhbnn.exec:\1nhbnn.exe107⤵PID:2780
-
\??\c:\9hhhtb.exec:\9hhhtb.exe108⤵PID:2792
-
\??\c:\pppvp.exec:\pppvp.exe109⤵PID:1044
-
\??\c:\dvdjd.exec:\dvdjd.exe110⤵PID:1580
-
\??\c:\xffxffx.exec:\xffxffx.exe111⤵PID:1588
-
\??\c:\bthhhh.exec:\bthhhh.exe112⤵PID:2312
-
\??\c:\btbbhh.exec:\btbbhh.exe113⤵PID:1584
-
\??\c:\vpvvp.exec:\vpvvp.exe114⤵PID:876
-
\??\c:\jpddd.exec:\jpddd.exe115⤵PID:2164
-
\??\c:\fxrxllr.exec:\fxrxllr.exe116⤵PID:1364
-
\??\c:\fxrffrf.exec:\fxrffrf.exe117⤵PID:852
-
\??\c:\hbhnhh.exec:\hbhnhh.exe118⤵PID:1156
-
\??\c:\vjdjv.exec:\vjdjv.exe119⤵PID:2208
-
\??\c:\9fxlrlr.exec:\9fxlrlr.exe120⤵PID:1908
-
\??\c:\frlxrfx.exec:\frlxrfx.exe121⤵PID:2828
-
\??\c:\9lflllr.exec:\9lflllr.exe122⤵PID:2400
-
\??\c:\hbtnnt.exec:\hbtnnt.exe123⤵PID:2404
-
\??\c:\9jpdd.exec:\9jpdd.exe124⤵PID:1972
-
\??\c:\jvjpd.exec:\jvjpd.exe125⤵PID:1756
-
\??\c:\1ffxlxl.exec:\1ffxlxl.exe126⤵PID:240
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe127⤵PID:1964
-
\??\c:\bthnhh.exec:\bthnhh.exe128⤵PID:3040
-
\??\c:\3hnnhb.exec:\3hnnhb.exe129⤵PID:1696
-
\??\c:\vjppp.exec:\vjppp.exe130⤵PID:272
-
\??\c:\vpddj.exec:\vpddj.exe131⤵PID:3028
-
\??\c:\5jjjp.exec:\5jjjp.exe132⤵PID:376
-
\??\c:\3flrxlx.exec:\3flrxlx.exe133⤵PID:1320
-
\??\c:\rrxrffl.exec:\rrxrffl.exe134⤵PID:960
-
\??\c:\hthbtb.exec:\hthbtb.exe135⤵PID:2012
-
\??\c:\ppddj.exec:\ppddj.exe136⤵PID:1820
-
\??\c:\vpddj.exec:\vpddj.exe137⤵PID:1740
-
\??\c:\xxxrrrf.exec:\xxxrrrf.exe138⤵PID:2008
-
\??\c:\1rlfffl.exec:\1rlfffl.exe139⤵PID:996
-
\??\c:\nhtbtt.exec:\nhtbtt.exe140⤵PID:1444
-
\??\c:\btbnbh.exec:\btbnbh.exe141⤵PID:2324
-
\??\c:\3hbbnt.exec:\3hbbnt.exe142⤵PID:2740
-
\??\c:\ddvvj.exec:\ddvvj.exe143⤵PID:2916
-
\??\c:\dpjdj.exec:\dpjdj.exe144⤵PID:2368
-
\??\c:\7fxlxfl.exec:\7fxlxfl.exe145⤵PID:2928
-
\??\c:\hbttnn.exec:\hbttnn.exe146⤵PID:2560
-
\??\c:\tthntt.exec:\tthntt.exe147⤵PID:2612
-
\??\c:\7ppjj.exec:\7ppjj.exe148⤵PID:2700
-
\??\c:\7vvdp.exec:\7vvdp.exe149⤵PID:2576
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe150⤵PID:1452
-
\??\c:\llrrfrx.exec:\llrrfrx.exe151⤵PID:2672
-
\??\c:\btnhnn.exec:\btnhnn.exe152⤵PID:2168
-
\??\c:\5tttbh.exec:\5tttbh.exe153⤵PID:2484
-
\??\c:\ppdvd.exec:\ppdvd.exe154⤵PID:2436
-
\??\c:\pjvvj.exec:\pjvvj.exe155⤵PID:2936
-
\??\c:\xffrfll.exec:\xffrfll.exe156⤵PID:2052
-
\??\c:\lfxlffl.exec:\lfxlffl.exe157⤵PID:2972
-
\??\c:\1tbbhh.exec:\1tbbhh.exe158⤵PID:2520
-
\??\c:\dvpvj.exec:\dvpvj.exe159⤵PID:2768
-
\??\c:\jdddd.exec:\jdddd.exe160⤵PID:2780
-
\??\c:\xxlrfxr.exec:\xxlrfxr.exe161⤵PID:848
-
\??\c:\9xfrfff.exec:\9xfrfff.exe162⤵PID:776
-
\??\c:\nbtbhh.exec:\nbtbhh.exe163⤵PID:1580
-
\??\c:\nhhbhn.exec:\nhhbhn.exe164⤵PID:1496
-
\??\c:\vpjjp.exec:\vpjjp.exe165⤵PID:2312
-
\??\c:\3xxxlrl.exec:\3xxxlrl.exe166⤵PID:556
-
\??\c:\xlxxxxx.exec:\xlxxxxx.exe167⤵PID:1192
-
\??\c:\hbthtb.exec:\hbthtb.exe168⤵PID:2384
-
\??\c:\bnnbth.exec:\bnnbth.exe169⤵PID:2036
-
\??\c:\djvdp.exec:\djvdp.exe170⤵PID:2068
-
\??\c:\rlxrlrf.exec:\rlxrlrf.exe171⤵PID:2084
-
\??\c:\lrxffrr.exec:\lrxffrr.exe172⤵PID:1924
-
\??\c:\htbhhh.exec:\htbhhh.exe173⤵PID:1980
-
\??\c:\hhtbnt.exec:\hhtbnt.exe174⤵PID:1940
-
\??\c:\pjvvj.exec:\pjvvj.exe175⤵PID:2400
-
\??\c:\rlrrxll.exec:\rlrrxll.exe176⤵PID:2404
-
\??\c:\xrflffr.exec:\xrflffr.exe177⤵PID:1992
-
\??\c:\nhtbth.exec:\nhtbth.exe178⤵PID:448
-
\??\c:\ttbbbn.exec:\ttbbbn.exe179⤵PID:1136
-
\??\c:\pjddd.exec:\pjddd.exe180⤵PID:1920
-
\??\c:\flxlfrf.exec:\flxlfrf.exe181⤵PID:3040
-
\??\c:\9frxfrf.exec:\9frxfrf.exe182⤵PID:1280
-
\??\c:\bbtbnt.exec:\bbtbnt.exe183⤵PID:2932
-
\??\c:\tnhhtt.exec:\tnhhtt.exe184⤵PID:1816
-
\??\c:\jvvpj.exec:\jvvpj.exe185⤵PID:280
-
\??\c:\ffxrxlr.exec:\ffxrxlr.exe186⤵PID:1900
-
\??\c:\1hnnnt.exec:\1hnnnt.exe187⤵PID:1896
-
\??\c:\ddpjp.exec:\ddpjp.exe188⤵PID:1864
-
\??\c:\lfrxrfx.exec:\lfrxrfx.exe189⤵PID:1740
-
\??\c:\xffrllx.exec:\xffrllx.exe190⤵PID:2008
-
\??\c:\nhbbht.exec:\nhbbht.exe191⤵PID:1440
-
\??\c:\nnbtht.exec:\nnbtht.exe192⤵PID:1224
-
\??\c:\jdvpv.exec:\jdvpv.exe193⤵PID:1796
-
\??\c:\1flrffr.exec:\1flrffr.exe194⤵PID:1748
-
\??\c:\rflfffx.exec:\rflfffx.exe195⤵PID:2800
-
\??\c:\3tnbnb.exec:\3tnbnb.exe196⤵PID:2524
-
\??\c:\tbhhtn.exec:\tbhhtn.exe197⤵PID:2928
-
\??\c:\vjvjp.exec:\vjvjp.exe198⤵PID:2552
-
\??\c:\dvvpp.exec:\dvvpp.exe199⤵PID:2528
-
\??\c:\ffflrff.exec:\ffflrff.exe200⤵PID:2808
-
\??\c:\frllrrf.exec:\frllrrf.exe201⤵PID:2988
-
\??\c:\tnbbht.exec:\tnbbht.exe202⤵PID:1452
-
\??\c:\pdjjj.exec:\pdjjj.exe203⤵PID:2456
-
\??\c:\dddjd.exec:\dddjd.exe204⤵PID:2556
-
\??\c:\lllrlxr.exec:\lllrlxr.exe205⤵PID:2584
-
\??\c:\lrrlxlx.exec:\lrrlxlx.exe206⤵PID:2436
-
\??\c:\ntnhhn.exec:\ntnhhn.exe207⤵PID:352
-
\??\c:\1tttnh.exec:\1tttnh.exe208⤵PID:2052
-
\??\c:\ddpvd.exec:\ddpvd.exe209⤵PID:2732
-
\??\c:\dddvv.exec:\dddvv.exe210⤵PID:2640
-
\??\c:\fxfrrlr.exec:\fxfrrlr.exe211⤵PID:2724
-
\??\c:\rrrlxlr.exec:\rrrlxlr.exe212⤵PID:2792
-
\??\c:\3nnntb.exec:\3nnntb.exe213⤵PID:1608
-
\??\c:\9hbhtb.exec:\9hbhtb.exe214⤵PID:1564
-
\??\c:\vjvdj.exec:\vjvdj.exe215⤵PID:1752
-
\??\c:\lfflrxl.exec:\lfflrxl.exe216⤵PID:1560
-
\??\c:\frlxffr.exec:\frlxffr.exe217⤵PID:2488
-
\??\c:\5bbhnn.exec:\5bbhnn.exe218⤵PID:1240
-
\??\c:\hhbhnt.exec:\hhbhnt.exe219⤵PID:1380
-
\??\c:\9jjjj.exec:\9jjjj.exe220⤵PID:3068
-
\??\c:\vpvdp.exec:\vpvdp.exe221⤵PID:2224
-
\??\c:\rrlxllx.exec:\rrlxllx.exe222⤵PID:2024
-
\??\c:\1rlfrrr.exec:\1rlfrrr.exe223⤵PID:1668
-
\??\c:\btnbhn.exec:\btnbhn.exe224⤵PID:1924
-
\??\c:\9bttbb.exec:\9bttbb.exe225⤵PID:2828
-
\??\c:\dvjpj.exec:\dvjpj.exe226⤵PID:2236
-
\??\c:\rfrrrxl.exec:\rfrrrxl.exe227⤵PID:528
-
\??\c:\lxxfrff.exec:\lxxfrff.exe228⤵PID:2096
-
\??\c:\hhnnnh.exec:\hhnnnh.exe229⤵PID:1952
-
\??\c:\btbthh.exec:\btbthh.exe230⤵PID:3004
-
\??\c:\pjppj.exec:\pjppj.exe231⤵PID:992
-
\??\c:\djjpj.exec:\djjpj.exe232⤵PID:1920
-
\??\c:\rfxlllx.exec:\rfxlllx.exe233⤵PID:1928
-
\??\c:\rlrfrfr.exec:\rlrfrfr.exe234⤵PID:1304
-
\??\c:\hthhnn.exec:\hthhnn.exe235⤵PID:2848
-
\??\c:\btthbh.exec:\btthbh.exe236⤵PID:652
-
\??\c:\dddjv.exec:\dddjv.exe237⤵PID:816
-
\??\c:\7dddj.exec:\7dddj.exe238⤵PID:2092
-
\??\c:\rrfrrll.exec:\rrfrrll.exe239⤵PID:804
-
\??\c:\hnbtht.exec:\hnbtht.exe240⤵PID:2356
-
\??\c:\nththt.exec:\nththt.exe241⤵PID:1484
-
\??\c:\ntbthn.exec:\ntbthn.exe242⤵PID:668