Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 01:30
Behavioral task
behavioral1
Sample
44442751b625f50a02571456e7e25470_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
44442751b625f50a02571456e7e25470_NeikiAnalytics.exe
-
Size
402KB
-
MD5
44442751b625f50a02571456e7e25470
-
SHA1
c79a33735c71be77224ccafeab986e78503c12d9
-
SHA256
2e3a09c761a471dce2e51f26bdc5d14f332a0863fdf18678616994798ad77865
-
SHA512
8c067444247a4567d66a013e1332b22817f19cfc8928ee489492d5c4e6647e5920670884870c17b78c327ace05049015e667636616f42d832444b31fd5ce69e4
-
SSDEEP
6144:kcm4FmowdHoSph3Ymu8wdHoSM05d34iWRbzami3v:y4wFHoS3zuxHoSTd34iWRhif
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
Processes:
resource yara_rule behavioral1/memory/2860-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1260-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-321-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2968-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1584-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/488-471-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2964-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1432-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1944-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-598-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1340-780-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-1264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-478-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2396-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/928-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1228-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1568-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
llfrlxx.exe1vpvp.exebbthhn.exevdvdv.exe9flrfff.exe3tttbb.exepdjvv.exerxxfrxl.exennbbhh.exevddjd.exellxfrxl.exe1bbbhn.exe7htbhn.exevvjvj.exefxllflr.exethhhnn.exevpddj.exe5fllxrx.exelfrrxxl.exevpdjj.exelfrfrlf.exenhbbnn.exetnhttb.exedddvj.exexrfrxxl.exejjpjd.exefrllxff.exejpdjv.exeddpvv.exetnnbnn.exevvvdv.exerxxlfxl.exenhbhht.exejvpvd.exe9pjjd.exexlxfllr.exetnhnth.exepjjpv.exellxlffl.exetnhtbb.exejdppd.exelfrfrxl.exehhhttt.exenhtbhb.exejvjjj.exerlfrflr.exerlflrrf.exetthbhh.exejdvdv.exexrxfrrx.exehttnnn.exe7hnttt.exejdppv.exexrxlfxr.exehhhtth.exe9tnnbh.exepdpvv.exexfrlrff.exelrxfxll.exehhbhbb.exejdjpj.exe5rfflrf.exebtthbn.exevpjdj.exepid process 2456 llfrlxx.exe 2620 1vpvp.exe 2520 bbthhn.exe 2524 vdvdv.exe 2856 9flrfff.exe 2652 3tttbb.exe 2428 pdjvv.exe 2948 rxxfrxl.exe 2340 nnbbhh.exe 2572 vddjd.exe 2708 llxfrxl.exe 1664 1bbbhn.exe 2168 7htbhn.exe 1260 vvjvj.exe 1568 fxllflr.exe 1696 thhhnn.exe 1228 vpddj.exe 2024 5fllxrx.exe 2756 lfrrxxl.exe 2188 vpdjj.exe 1740 lfrfrlf.exe 688 nhbbnn.exe 1424 tnhttb.exe 856 dddvj.exe 1712 xrfrxxl.exe 1304 jjpjd.exe 2264 frllxff.exe 928 jpdjv.exe 1428 ddpvv.exe 1984 tnnbnn.exe 2812 vvvdv.exe 1008 rxxlfxl.exe 2768 nhbhht.exe 2860 jvpvd.exe 3008 9pjjd.exe 2632 xlxfllr.exe 2488 tnhnth.exe 2784 pjjpv.exe 2664 llxlffl.exe 2968 tnhtbb.exe 2616 jdppd.exe 2536 lfrfrxl.exe 2436 hhhttt.exe 1608 nhtbhb.exe 2680 jvjjj.exe 2612 rlfrflr.exe 2580 rlflrrf.exe 2396 tthbhh.exe 1584 jdvdv.exe 2168 xrxfrrx.exe 1572 httnnn.exe 1568 7hnttt.exe 2732 jdppv.exe 876 xrxlfxr.exe 2760 hhhtth.exe 1196 9tnnbh.exe 2344 pdpvv.exe 2188 xfrlrff.exe 488 lrxfxll.exe 2864 hhbhbb.exe 2092 jdjpj.exe 2964 5rfflrf.exe 1708 btthbn.exe 1576 vpjdj.exe -
Processes:
resource yara_rule behavioral1/memory/2860-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llfrlxx.exe upx behavioral1/memory/2456-8-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1vpvp.exe upx behavioral1/memory/2620-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2456-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2620-27-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbthhn.exe upx \??\c:\vdvdv.exe upx behavioral1/memory/2524-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2524-46-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9flrfff.exe upx C:\3tttbb.exe upx behavioral1/memory/2428-64-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdjvv.exe upx behavioral1/memory/2948-75-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vddjd.exe upx C:\1bbbhn.exe upx \??\c:\7htbhn.exe upx behavioral1/memory/1260-127-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vpddj.exe upx \??\c:\5fllxrx.exe upx \??\c:\lfrrxxl.exe upx behavioral1/memory/2188-180-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vpdjj.exe upx \??\c:\lfrfrlf.exe upx C:\tnhttb.exe upx behavioral1/memory/1568-212-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dddvj.exe upx \??\c:\xrfrxxl.exe upx \??\c:\jjpjd.exe upx \??\c:\frllxff.exe upx C:\jpdjv.exe upx behavioral1/memory/2264-246-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddpvv.exe upx C:\tnnbnn.exe upx behavioral1/memory/1984-273-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vvvdv.exe upx behavioral1/memory/2768-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3008-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2488-326-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2664-334-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2968-347-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1584-398-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1584-405-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2732-425-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2344-450-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2344-457-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2964-485-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1432-510-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/928-524-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1944-556-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2796-591-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2796-598-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2420-624-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2732-705-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1676-736-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1340-780-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2256-812-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/968-799-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2880-915-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-1001-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-837-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1428-1082-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
44442751b625f50a02571456e7e25470_NeikiAnalytics.exellfrlxx.exe1vpvp.exebbthhn.exevdvdv.exe9flrfff.exe3tttbb.exepdjvv.exerxxfrxl.exennbbhh.exevddjd.exellxfrxl.exe1bbbhn.exe7htbhn.exevvjvj.exefxllflr.exedescription pid process target process PID 2860 wrote to memory of 2456 2860 44442751b625f50a02571456e7e25470_NeikiAnalytics.exe llfrlxx.exe PID 2860 wrote to memory of 2456 2860 44442751b625f50a02571456e7e25470_NeikiAnalytics.exe llfrlxx.exe PID 2860 wrote to memory of 2456 2860 44442751b625f50a02571456e7e25470_NeikiAnalytics.exe llfrlxx.exe PID 2860 wrote to memory of 2456 2860 44442751b625f50a02571456e7e25470_NeikiAnalytics.exe llfrlxx.exe PID 2456 wrote to memory of 2620 2456 llfrlxx.exe 1vpvp.exe PID 2456 wrote to memory of 2620 2456 llfrlxx.exe 1vpvp.exe PID 2456 wrote to memory of 2620 2456 llfrlxx.exe 1vpvp.exe PID 2456 wrote to memory of 2620 2456 llfrlxx.exe 1vpvp.exe PID 2620 wrote to memory of 2520 2620 1vpvp.exe 3vppj.exe PID 2620 wrote to memory of 2520 2620 1vpvp.exe 3vppj.exe PID 2620 wrote to memory of 2520 2620 1vpvp.exe 3vppj.exe PID 2620 wrote to memory of 2520 2620 1vpvp.exe 3vppj.exe PID 2520 wrote to memory of 2524 2520 bbthhn.exe vdvdv.exe PID 2520 wrote to memory of 2524 2520 bbthhn.exe vdvdv.exe PID 2520 wrote to memory of 2524 2520 bbthhn.exe vdvdv.exe PID 2520 wrote to memory of 2524 2520 bbthhn.exe vdvdv.exe PID 2524 wrote to memory of 2856 2524 vdvdv.exe hnnhtb.exe PID 2524 wrote to memory of 2856 2524 vdvdv.exe hnnhtb.exe PID 2524 wrote to memory of 2856 2524 vdvdv.exe hnnhtb.exe PID 2524 wrote to memory of 2856 2524 vdvdv.exe hnnhtb.exe PID 2856 wrote to memory of 2652 2856 9flrfff.exe bthnbb.exe PID 2856 wrote to memory of 2652 2856 9flrfff.exe bthnbb.exe PID 2856 wrote to memory of 2652 2856 9flrfff.exe bthnbb.exe PID 2856 wrote to memory of 2652 2856 9flrfff.exe bthnbb.exe PID 2652 wrote to memory of 2428 2652 3tttbb.exe pdjvv.exe PID 2652 wrote to memory of 2428 2652 3tttbb.exe pdjvv.exe PID 2652 wrote to memory of 2428 2652 3tttbb.exe pdjvv.exe PID 2652 wrote to memory of 2428 2652 3tttbb.exe pdjvv.exe PID 2428 wrote to memory of 2948 2428 pdjvv.exe rxxfrxl.exe PID 2428 wrote to memory of 2948 2428 pdjvv.exe rxxfrxl.exe PID 2428 wrote to memory of 2948 2428 pdjvv.exe rxxfrxl.exe PID 2428 wrote to memory of 2948 2428 pdjvv.exe rxxfrxl.exe PID 2948 wrote to memory of 2340 2948 rxxfrxl.exe nnbbhh.exe PID 2948 wrote to memory of 2340 2948 rxxfrxl.exe nnbbhh.exe PID 2948 wrote to memory of 2340 2948 rxxfrxl.exe nnbbhh.exe PID 2948 wrote to memory of 2340 2948 rxxfrxl.exe nnbbhh.exe PID 2340 wrote to memory of 2572 2340 nnbbhh.exe vddjd.exe PID 2340 wrote to memory of 2572 2340 nnbbhh.exe vddjd.exe PID 2340 wrote to memory of 2572 2340 nnbbhh.exe vddjd.exe PID 2340 wrote to memory of 2572 2340 nnbbhh.exe vddjd.exe PID 2572 wrote to memory of 2708 2572 vddjd.exe llxfrxl.exe PID 2572 wrote to memory of 2708 2572 vddjd.exe llxfrxl.exe PID 2572 wrote to memory of 2708 2572 vddjd.exe llxfrxl.exe PID 2572 wrote to memory of 2708 2572 vddjd.exe llxfrxl.exe PID 2708 wrote to memory of 1664 2708 llxfrxl.exe 1bbbhn.exe PID 2708 wrote to memory of 1664 2708 llxfrxl.exe 1bbbhn.exe PID 2708 wrote to memory of 1664 2708 llxfrxl.exe 1bbbhn.exe PID 2708 wrote to memory of 1664 2708 llxfrxl.exe 1bbbhn.exe PID 1664 wrote to memory of 2168 1664 1bbbhn.exe 7htbhn.exe PID 1664 wrote to memory of 2168 1664 1bbbhn.exe 7htbhn.exe PID 1664 wrote to memory of 2168 1664 1bbbhn.exe 7htbhn.exe PID 1664 wrote to memory of 2168 1664 1bbbhn.exe 7htbhn.exe PID 2168 wrote to memory of 1260 2168 7htbhn.exe vvjvj.exe PID 2168 wrote to memory of 1260 2168 7htbhn.exe vvjvj.exe PID 2168 wrote to memory of 1260 2168 7htbhn.exe vvjvj.exe PID 2168 wrote to memory of 1260 2168 7htbhn.exe vvjvj.exe PID 1260 wrote to memory of 1568 1260 vvjvj.exe fxllflr.exe PID 1260 wrote to memory of 1568 1260 vvjvj.exe fxllflr.exe PID 1260 wrote to memory of 1568 1260 vvjvj.exe fxllflr.exe PID 1260 wrote to memory of 1568 1260 vvjvj.exe fxllflr.exe PID 1568 wrote to memory of 1696 1568 fxllflr.exe pdjpj.exe PID 1568 wrote to memory of 1696 1568 fxllflr.exe pdjpj.exe PID 1568 wrote to memory of 1696 1568 fxllflr.exe pdjpj.exe PID 1568 wrote to memory of 1696 1568 fxllflr.exe pdjpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44442751b625f50a02571456e7e25470_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\44442751b625f50a02571456e7e25470_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\llfrlxx.exec:\llfrlxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\1vpvp.exec:\1vpvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\bbthhn.exec:\bbthhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\vdvdv.exec:\vdvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\9flrfff.exec:\9flrfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\3tttbb.exec:\3tttbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\pdjvv.exec:\pdjvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\rxxfrxl.exec:\rxxfrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\nnbbhh.exec:\nnbbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\vddjd.exec:\vddjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\llxfrxl.exec:\llxfrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\1bbbhn.exec:\1bbbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\7htbhn.exec:\7htbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\vvjvj.exec:\vvjvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\fxllflr.exec:\fxllflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\thhhnn.exec:\thhhnn.exe17⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vpddj.exec:\vpddj.exe18⤵
- Executes dropped EXE
PID:1228 -
\??\c:\5fllxrx.exec:\5fllxrx.exe19⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe20⤵
- Executes dropped EXE
PID:2756 -
\??\c:\vpdjj.exec:\vpdjj.exe21⤵
- Executes dropped EXE
PID:2188 -
\??\c:\lfrfrlf.exec:\lfrfrlf.exe22⤵
- Executes dropped EXE
PID:1740 -
\??\c:\nhbbnn.exec:\nhbbnn.exe23⤵
- Executes dropped EXE
PID:688 -
\??\c:\tnhttb.exec:\tnhttb.exe24⤵
- Executes dropped EXE
PID:1424 -
\??\c:\dddvj.exec:\dddvj.exe25⤵
- Executes dropped EXE
PID:856 -
\??\c:\xrfrxxl.exec:\xrfrxxl.exe26⤵
- Executes dropped EXE
PID:1712 -
\??\c:\jjpjd.exec:\jjpjd.exe27⤵
- Executes dropped EXE
PID:1304 -
\??\c:\frllxff.exec:\frllxff.exe28⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jpdjv.exec:\jpdjv.exe29⤵
- Executes dropped EXE
PID:928 -
\??\c:\ddpvv.exec:\ddpvv.exe30⤵
- Executes dropped EXE
PID:1428 -
\??\c:\tnnbnn.exec:\tnnbnn.exe31⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vvvdv.exec:\vvvdv.exe32⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rxxlfxl.exec:\rxxlfxl.exe33⤵
- Executes dropped EXE
PID:1008 -
\??\c:\nhbhht.exec:\nhbhht.exe34⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jvpvd.exec:\jvpvd.exe35⤵
- Executes dropped EXE
PID:2860 -
\??\c:\9pjjd.exec:\9pjjd.exe36⤵
- Executes dropped EXE
PID:3008 -
\??\c:\xlxfllr.exec:\xlxfllr.exe37⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tnhnth.exec:\tnhnth.exe38⤵
- Executes dropped EXE
PID:2488 -
\??\c:\pjjpv.exec:\pjjpv.exe39⤵
- Executes dropped EXE
PID:2784 -
\??\c:\llxlffl.exec:\llxlffl.exe40⤵
- Executes dropped EXE
PID:2664 -
\??\c:\tnhtbb.exec:\tnhtbb.exe41⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jdppd.exec:\jdppd.exe42⤵
- Executes dropped EXE
PID:2616 -
\??\c:\lfrfrxl.exec:\lfrfrxl.exe43⤵
- Executes dropped EXE
PID:2536 -
\??\c:\hhhttt.exec:\hhhttt.exe44⤵
- Executes dropped EXE
PID:2436 -
\??\c:\nhtbhb.exec:\nhtbhb.exe45⤵
- Executes dropped EXE
PID:1608 -
\??\c:\jvjjj.exec:\jvjjj.exe46⤵
- Executes dropped EXE
PID:2680 -
\??\c:\rlfrflr.exec:\rlfrflr.exe47⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rlflrrf.exec:\rlflrrf.exe48⤵
- Executes dropped EXE
PID:2580 -
\??\c:\tthbhh.exec:\tthbhh.exe49⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jdvdv.exec:\jdvdv.exe50⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xrxfrrx.exec:\xrxfrrx.exe51⤵
- Executes dropped EXE
PID:2168 -
\??\c:\httnnn.exec:\httnnn.exe52⤵
- Executes dropped EXE
PID:1572 -
\??\c:\7hnttt.exec:\7hnttt.exe53⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jdppv.exec:\jdppv.exe54⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xrxlfxr.exec:\xrxlfxr.exe55⤵
- Executes dropped EXE
PID:876 -
\??\c:\hhhtth.exec:\hhhtth.exe56⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9tnnbh.exec:\9tnnbh.exe57⤵
- Executes dropped EXE
PID:1196 -
\??\c:\pdpvv.exec:\pdpvv.exe58⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xfrlrff.exec:\xfrlrff.exe59⤵
- Executes dropped EXE
PID:2188 -
\??\c:\lrxfxll.exec:\lrxfxll.exe60⤵
- Executes dropped EXE
PID:488 -
\??\c:\hhbhbb.exec:\hhbhbb.exe61⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jdjpj.exec:\jdjpj.exe62⤵
- Executes dropped EXE
PID:2092 -
\??\c:\5rfflrf.exec:\5rfflrf.exe63⤵
- Executes dropped EXE
PID:2964 -
\??\c:\btthbn.exec:\btthbn.exe64⤵
- Executes dropped EXE
PID:1708 -
\??\c:\vpjdj.exec:\vpjdj.exe65⤵
- Executes dropped EXE
PID:1576 -
\??\c:\lfrfxll.exec:\lfrfxll.exe66⤵PID:1432
-
\??\c:\nntnbh.exec:\nntnbh.exe67⤵PID:404
-
\??\c:\vpdvp.exec:\vpdvp.exe68⤵PID:1908
-
\??\c:\xxxfrxl.exec:\xxxfrxl.exe69⤵PID:928
-
\??\c:\nnbbtb.exec:\nnbbtb.exe70⤵PID:2068
-
\??\c:\nhbhtt.exec:\nhbhtt.exe71⤵PID:2012
-
\??\c:\jpdjp.exec:\jpdjp.exe72⤵PID:2992
-
\??\c:\rxrrffl.exec:\rxrrffl.exe73⤵PID:2812
-
\??\c:\ffxlxfl.exec:\ffxlxfl.exe74⤵PID:1944
-
\??\c:\nhbnbn.exec:\nhbnbn.exe75⤵PID:2120
-
\??\c:\9dppv.exec:\9dppv.exe76⤵PID:2860
-
\??\c:\xflxlxx.exec:\xflxlxx.exe77⤵PID:2640
-
\??\c:\frrlxfr.exec:\frrlxfr.exe78⤵PID:2788
-
\??\c:\hbntbb.exec:\hbntbb.exe79⤵PID:2796
-
\??\c:\3vppj.exec:\3vppj.exe80⤵PID:2520
-
\??\c:\vdpdv.exec:\vdpdv.exe81⤵PID:2228
-
\??\c:\xrfrrrx.exec:\xrfrrrx.exe82⤵PID:2388
-
\??\c:\btbhbh.exec:\btbhbh.exe83⤵PID:644
-
\??\c:\pdvjp.exec:\pdvjp.exe84⤵PID:2420
-
\??\c:\dvpvd.exec:\dvpvd.exe85⤵PID:1528
-
\??\c:\flrrrlr.exec:\flrrrlr.exe86⤵PID:2428
-
\??\c:\tnhhbh.exec:\tnhhbh.exe87⤵PID:2528
-
\??\c:\bhbnbh.exec:\bhbnbh.exe88⤵PID:2728
-
\??\c:\lrfrlxx.exec:\lrfrlxx.exe89⤵PID:1456
-
\??\c:\xflfrfx.exec:\xflfrfx.exe90⤵PID:1652
-
\??\c:\bthttb.exec:\bthttb.exe91⤵PID:1236
-
\??\c:\dvvdp.exec:\dvvdp.exe92⤵PID:2540
-
\??\c:\fffxffl.exec:\fffxffl.exe93⤵PID:344
-
\??\c:\flxrfxx.exec:\flxrfxx.exe94⤵PID:1544
-
\??\c:\7hhhth.exec:\7hhhth.exe95⤵PID:1384
-
\??\c:\ddpdp.exec:\ddpdp.exe96⤵PID:1568
-
\??\c:\5lfflrx.exec:\5lfflrx.exe97⤵PID:2732
-
\??\c:\fxrrffr.exec:\fxrrffr.exe98⤵PID:2088
-
\??\c:\7nbtht.exec:\7nbtht.exe99⤵PID:2760
-
\??\c:\vvdvp.exec:\vvdvp.exe100⤵PID:572
-
\??\c:\rffxlxf.exec:\rffxlxf.exe101⤵PID:2196
-
\??\c:\tnntbb.exec:\tnntbb.exe102⤵PID:1676
-
\??\c:\1httbh.exec:\1httbh.exe103⤵PID:828
-
\??\c:\jjpvj.exec:\jjpvj.exe104⤵PID:688
-
\??\c:\rxfxrfr.exec:\rxfxrfr.exe105⤵PID:2608
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe106⤵PID:856
-
\??\c:\nnbtbn.exec:\nnbtbn.exe107⤵PID:2204
-
\??\c:\bbbnht.exec:\bbbnht.exe108⤵PID:1624
-
\??\c:\ppjjd.exec:\ppjjd.exe109⤵PID:1340
-
\??\c:\vpdjj.exec:\vpdjj.exe110⤵PID:932
-
\??\c:\xxlrllx.exec:\xxlrllx.exe111⤵PID:1992
-
\??\c:\fffrxrf.exec:\fffrxrf.exe112⤵PID:968
-
\??\c:\nhbttb.exec:\nhbttb.exe113⤵PID:1580
-
\??\c:\vvjdv.exec:\vvjdv.exe114⤵PID:2256
-
\??\c:\dvvpj.exec:\dvvpj.exe115⤵PID:1848
-
\??\c:\rflflxl.exec:\rflflxl.exe116⤵PID:896
-
\??\c:\7ffrxlf.exec:\7ffrxlf.exe117⤵PID:2448
-
\??\c:\hbtbht.exec:\hbtbht.exe118⤵PID:2768
-
\??\c:\pjvdj.exec:\pjvdj.exe119⤵PID:2636
-
\??\c:\djjdd.exec:\djjdd.exe120⤵PID:2456
-
\??\c:\3lflrxf.exec:\3lflrxf.exe121⤵PID:2956
-
\??\c:\1xlrflr.exec:\1xlrflr.exe122⤵PID:2004
-
\??\c:\hbnthn.exec:\hbnthn.exe123⤵PID:2488
-
\??\c:\bbtbhn.exec:\bbtbhn.exe124⤵PID:2504
-
\??\c:\5rrxllx.exec:\5rrxllx.exe125⤵PID:2472
-
\??\c:\hnnhtb.exec:\hnnhtb.exe126⤵PID:2856
-
\??\c:\dvjpv.exec:\dvjpv.exe127⤵PID:2132
-
\??\c:\ffxrflf.exec:\ffxrflf.exe128⤵PID:2032
-
\??\c:\nnbtbb.exec:\nnbtbb.exe129⤵PID:2140
-
\??\c:\1jdjv.exec:\1jdjv.exe130⤵PID:2880
-
\??\c:\7lfxfxf.exec:\7lfxfxf.exe131⤵PID:2596
-
\??\c:\btthtb.exec:\btthtb.exe132⤵PID:1200
-
\??\c:\bbnhnn.exec:\bbnhnn.exe133⤵PID:2716
-
\??\c:\ddpjv.exec:\ddpjv.exe134⤵PID:2248
-
\??\c:\3pvdd.exec:\3pvdd.exe135⤵PID:2396
-
\??\c:\5llrlrl.exec:\5llrlrl.exe136⤵PID:1584
-
\??\c:\9fxlxxl.exec:\9fxlxxl.exe137⤵PID:1440
-
\??\c:\bbthht.exec:\bbthht.exe138⤵PID:332
-
\??\c:\pdjpj.exec:\pdjpj.exe139⤵PID:1696
-
\??\c:\vddpv.exec:\vddpv.exe140⤵PID:1248
-
\??\c:\rfrrxrx.exec:\rfrrxrx.exe141⤵PID:2980
-
\??\c:\nhbnth.exec:\nhbnth.exe142⤵PID:2736
-
\??\c:\nhtbnh.exec:\nhtbnh.exe143⤵PID:2088
-
\??\c:\vjvdd.exec:\vjvdd.exe144⤵PID:2760
-
\??\c:\rxrxlrf.exec:\rxrxlrf.exe145⤵PID:2344
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe146⤵PID:1740
-
\??\c:\bbthbn.exec:\bbthbn.exe147⤵PID:2804
-
\??\c:\nbnttb.exec:\nbnttb.exe148⤵PID:600
-
\??\c:\vppvv.exec:\vppvv.exe149⤵PID:596
-
\??\c:\vpjpd.exec:\vpjpd.exe150⤵PID:2608
-
\??\c:\3xrfrrf.exec:\3xrfrrf.exe151⤵PID:2316
-
\??\c:\lllxrxl.exec:\lllxrxl.exe152⤵PID:2204
-
\??\c:\nhttnt.exec:\nhttnt.exe153⤵PID:580
-
\??\c:\ddvjp.exec:\ddvjp.exe154⤵PID:1340
-
\??\c:\xrlxrxl.exec:\xrlxrxl.exe155⤵PID:1692
-
\??\c:\xlxflrf.exec:\xlxflrf.exe156⤵PID:1992
-
\??\c:\htthnb.exec:\htthnb.exe157⤵PID:1428
-
\??\c:\dppdj.exec:\dppdj.exe158⤵PID:1580
-
\??\c:\7xllrxl.exec:\7xllrxl.exe159⤵PID:276
-
\??\c:\xrxrxrr.exec:\xrxrxrr.exe160⤵PID:3068
-
\??\c:\1vvjv.exec:\1vvjv.exe161⤵PID:2692
-
\??\c:\9vdjd.exec:\9vdjd.exe162⤵PID:1540
-
\??\c:\lfffrrf.exec:\lfffrrf.exe163⤵PID:2120
-
\??\c:\5tntnn.exec:\5tntnn.exe164⤵PID:2668
-
\??\c:\hthhnn.exec:\hthhnn.exe165⤵PID:2860
-
\??\c:\pvdpp.exec:\pvdpp.exe166⤵PID:2628
-
\??\c:\5vppv.exec:\5vppv.exe167⤵PID:2672
-
\??\c:\xxrxrxl.exec:\xxrxrxl.exe168⤵PID:1536
-
\??\c:\hthhtb.exec:\hthhtb.exe169⤵PID:2360
-
\??\c:\9tntbh.exec:\9tntbh.exe170⤵PID:1672
-
\??\c:\pjpdp.exec:\pjpdp.exe171⤵PID:2660
-
\??\c:\rlllxxl.exec:\rlllxxl.exe172⤵PID:2376
-
\??\c:\9xllllr.exec:\9xllllr.exe173⤵PID:2312
-
\??\c:\tntntb.exec:\tntntb.exe174⤵PID:2884
-
\??\c:\7pdpd.exec:\7pdpd.exe175⤵PID:2432
-
\??\c:\3xxxffl.exec:\3xxxffl.exe176⤵PID:1252
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe177⤵PID:2528
-
\??\c:\nhhtht.exec:\nhhtht.exe178⤵PID:2968
-
\??\c:\pvvvp.exec:\pvvvp.exe179⤵PID:2900
-
\??\c:\9jdjd.exec:\9jdjd.exe180⤵PID:1664
-
\??\c:\xrlfllx.exec:\xrlfllx.exe181⤵PID:1604
-
\??\c:\rrrflxr.exec:\rrrflxr.exe182⤵PID:1372
-
\??\c:\bhbnhb.exec:\bhbnhb.exe183⤵PID:1572
-
\??\c:\ddvpd.exec:\ddvpd.exe184⤵PID:2340
-
\??\c:\pjjpd.exec:\pjjpd.exe185⤵PID:1700
-
\??\c:\rlrrxrl.exec:\rlrrxrl.exe186⤵PID:2772
-
\??\c:\fxrfllx.exec:\fxrfllx.exe187⤵PID:2732
-
\??\c:\1bttbb.exec:\1bttbb.exe188⤵PID:2544
-
\??\c:\9vvvj.exec:\9vvvj.exe189⤵PID:1640
-
\??\c:\vjvjd.exec:\vjvjd.exe190⤵PID:540
-
\??\c:\7xrflxx.exec:\7xrflxx.exe191⤵PID:1420
-
\??\c:\3frllfr.exec:\3frllfr.exe192⤵PID:488
-
\??\c:\ntnntn.exec:\ntnntn.exe193⤵PID:1424
-
\??\c:\jdppv.exec:\jdppv.exe194⤵PID:2092
-
\??\c:\vdvdd.exec:\vdvdd.exe195⤵PID:900
-
\??\c:\xrrxflx.exec:\xrrxflx.exe196⤵PID:856
-
\??\c:\tbttht.exec:\tbttht.exe197⤵PID:972
-
\??\c:\hthnhb.exec:\hthnhb.exe198⤵PID:1612
-
\??\c:\7dpvv.exec:\7dpvv.exe199⤵PID:1100
-
\??\c:\xffxfxr.exec:\xffxfxr.exe200⤵PID:2236
-
\??\c:\frlrxfr.exec:\frlrxfr.exe201⤵PID:932
-
\??\c:\hhtttb.exec:\hhtttb.exe202⤵PID:1992
-
\??\c:\ppjdp.exec:\ppjdp.exe203⤵PID:1860
-
\??\c:\1xrxfrl.exec:\1xrxfrl.exe204⤵PID:1004
-
\??\c:\rlflxfl.exec:\rlflxfl.exe205⤵PID:1724
-
\??\c:\hhbbnn.exec:\hhbbnn.exe206⤵PID:2992
-
\??\c:\htbnhh.exec:\htbnhh.exe207⤵PID:2076
-
\??\c:\dvpjp.exec:\dvpjp.exe208⤵PID:1540
-
\??\c:\vdppj.exec:\vdppj.exe209⤵PID:2120
-
\??\c:\lfxfxxl.exec:\lfxfxxl.exe210⤵PID:2668
-
\??\c:\tnnbth.exec:\tnnbth.exe211⤵PID:2860
-
\??\c:\5bhhhb.exec:\5bhhhb.exe212⤵PID:2628
-
\??\c:\jjdpv.exec:\jjdpv.exe213⤵PID:2480
-
\??\c:\9xrlxxr.exec:\9xrlxxr.exe214⤵PID:2364
-
\??\c:\5frflrr.exec:\5frflrr.exe215⤵PID:2416
-
\??\c:\nbtnht.exec:\nbtnht.exe216⤵PID:1672
-
\??\c:\7dvpd.exec:\7dvpd.exe217⤵PID:2660
-
\??\c:\jppjj.exec:\jppjj.exe218⤵PID:880
-
\??\c:\rlxlrxr.exec:\rlxlrxr.exe219⤵PID:2312
-
\??\c:\xrffrrx.exec:\xrffrrx.exe220⤵PID:2884
-
\??\c:\bthnbb.exec:\bthnbb.exe221⤵PID:2652
-
\??\c:\bthtbh.exec:\bthtbh.exe222⤵PID:2392
-
\??\c:\dddpd.exec:\dddpd.exe223⤵PID:2528
-
\??\c:\pjdjp.exec:\pjdjp.exe224⤵PID:2968
-
\??\c:\5llrxlr.exec:\5llrxlr.exe225⤵PID:2248
-
\??\c:\htbhth.exec:\htbhth.exe226⤵PID:1560
-
\??\c:\bhnhbn.exec:\bhnhbn.exe227⤵PID:1752
-
\??\c:\vjvdd.exec:\vjvdd.exe228⤵PID:1524
-
\??\c:\9pdjp.exec:\9pdjp.exe229⤵PID:2324
-
\??\c:\xrflxxl.exec:\xrflxxl.exe230⤵PID:2408
-
\??\c:\lxrxrrf.exec:\lxrxrrf.exe231⤵PID:1032
-
\??\c:\tbnhbt.exec:\tbnhbt.exe232⤵PID:1228
-
\??\c:\hhtthn.exec:\hhtthn.exe233⤵PID:1780
-
\??\c:\dvjpd.exec:\dvjpd.exe234⤵PID:2752
-
\??\c:\9lflxfl.exec:\9lflxfl.exe235⤵PID:1592
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe236⤵PID:1640
-
\??\c:\7bnttt.exec:\7bnttt.exe237⤵PID:540
-
\??\c:\ppjpj.exec:\ppjpj.exe238⤵PID:1064
-
\??\c:\ppjvj.exec:\ppjvj.exe239⤵PID:488
-
\??\c:\xxxlrxl.exec:\xxxlrxl.exe240⤵PID:2560
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe241⤵PID:2864
-
\??\c:\1htthn.exec:\1htthn.exe242⤵PID:2608