Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 01:56
Behavioral task
behavioral1
Sample
4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe
-
Size
254KB
-
MD5
4cc21ab451f8f8ba1862e95f3977c0e0
-
SHA1
33da8a716a5756c789e17595065f20ee30b236b0
-
SHA256
1f04d652f7389508674478ae21ebbbec3edc2081d328903f1c1bbfcb9cba3c62
-
SHA512
602e42d43df03cf77a19a4bfe2209b91bd2310654196d22b4433d72411f1f8d667b4073c5236dee00dd5ca3b8266da379141ae705b8aaf5ffa23ad9ff0545714
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpolTjZXvEQo9dfrS:y4wFHoS3eFaKHpKT9XvEhdfrS
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
Processes:
resource yara_rule behavioral1/memory/2916-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-105-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2840-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1032-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1320-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1212-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-213-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2072-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/836-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1860-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1504-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/692-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-353-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2472-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/952-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/376-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-581-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-669-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-719-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/536-738-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/568-757-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-913-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2524-954-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1072-1088-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1072-1120-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2156-1178-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2856-1211-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2156-1218-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frlrxxf.exexxxllrl.exehbnnhn.exejjjvp.exebbhbbh.exeddjvj.exebhhhtn.exedvjpv.exexlxfllf.exevvppd.exefrrfrlr.exenthbhb.exe1vddd.exe7fflrlr.exenhbbth.exedvjpd.exelllrfrf.exeddpdv.exeflfxxlf.exennbttt.exejdvvj.exennhthb.exefxxrxfr.exerfxllfr.exenbbtbn.exedddjv.exelxrlrrf.exepdpdv.exeflrlrfr.exejdppv.exefrrxffx.exepjdjp.exentnnth.exevvpvd.exellxxxxx.exejvjjv.exejppdd.exe7xrxffl.exethtbbb.exejjdpd.exe3vdvd.exelrxffxf.exebbtnhn.exe5dpvv.exedjpdv.exeffrlrfx.exentnbbn.exedjvpp.exe1jvjd.exefrlrxxl.exehbhbht.exedjpjj.exevjvvv.exeffrllfx.exenhthth.exedjjvv.exexlxxfxx.exe3xxlxfx.exe7nthbb.exe1ppjd.exefflxxff.exenntthb.exenttbhb.exevpvdv.exepid process 2976 frlrxxf.exe 2304 xxxllrl.exe 2616 hbnnhn.exe 2864 jjjvp.exe 2852 bbhbbh.exe 2496 ddjvj.exe 2580 bhhhtn.exe 2512 dvjpv.exe 2940 xlxfllf.exe 2004 vvppd.exe 2652 frrfrlr.exe 2840 nthbhb.exe 1032 1vddd.exe 1252 7fflrlr.exe 1692 nhbbth.exe 1320 dvjpd.exe 672 lllrfrf.exe 816 ddpdv.exe 1912 flfxxlf.exe 1472 nnbttt.exe 760 jdvvj.exe 1212 nnhthb.exe 1936 fxxrxfr.exe 2252 rfxllfr.exe 2072 nbbtbn.exe 836 dddjv.exe 1860 lxrlrrf.exe 1116 pdpdv.exe 1980 flrlrfr.exe 1504 jdppv.exe 2848 frrxffx.exe 2408 pjdjp.exe 1368 ntnnth.exe 692 vvpvd.exe 2376 llxxxxx.exe 1548 jvjjv.exe 2976 jppdd.exe 2688 7xrxffl.exe 2616 thtbbb.exe 2752 jjdpd.exe 2576 3vdvd.exe 2476 lrxffxf.exe 2704 bbtnhn.exe 2472 5dpvv.exe 2588 djpdv.exe 2388 ffrlrfx.exe 2024 ntnbbn.exe 2792 djvpp.exe 2004 1jvjd.exe 1800 frlrxxl.exe 2804 hbhbht.exe 2796 djpjj.exe 1636 vjvvv.exe 1440 ffrllfx.exe 1864 nhthth.exe 2028 djjvv.exe 1320 xlxxfxx.exe 776 3xxlxfx.exe 1064 7nthbb.exe 952 1ppjd.exe 1808 fflxxff.exe 376 nntthb.exe 764 nttbhb.exe 272 vpvdv.exe -
Processes:
resource yara_rule behavioral1/memory/2916-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frlrxxf.exe upx behavioral1/memory/2976-12-0x00000000002A0000-0x00000000002C7000-memory.dmp upx behavioral1/memory/2976-10-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxxllrl.exe upx behavioral1/memory/2304-18-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hbnnhn.exe upx behavioral1/memory/2616-36-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjjvp.exe upx \??\c:\bbhbbh.exe upx \??\c:\ddjvj.exe upx behavioral1/memory/2496-65-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bhhhtn.exe upx behavioral1/memory/2580-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvjpv.exe upx behavioral1/memory/2512-83-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlxfllf.exe upx behavioral1/memory/2512-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2852-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2940-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvppd.exe upx C:\frrfrlr.exe upx behavioral1/memory/2864-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2652-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2304-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-112-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nthbhb.exe upx C:\1vddd.exe upx behavioral1/memory/1032-128-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7fflrlr.exe upx C:\nhbbth.exe upx \??\c:\dvjpd.exe upx C:\lllrfrf.exe upx behavioral1/memory/1320-152-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddpdv.exe upx C:\flfxxlf.exe upx \??\c:\nnbttt.exe upx behavioral1/memory/1472-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1912-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/760-188-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdvvj.exe upx C:\nnhthb.exe upx behavioral1/memory/1212-198-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxxrxfr.exe upx \??\c:\rfxllfr.exe upx C:\nbbtbn.exe upx behavioral1/memory/2072-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/836-234-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dddjv.exe upx C:\lxrlrrf.exe upx \??\c:\pdpdv.exe upx C:\flrlrfr.exe upx behavioral1/memory/1860-249-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdppv.exe upx behavioral1/memory/1504-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1504-275-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frrxffx.exe upx C:\pjdjp.exe upx behavioral1/memory/2848-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2408-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/692-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1548-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2976-326-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exefrlrxxf.exexxxllrl.exehbnnhn.exejjjvp.exebbhbbh.exeddjvj.exebhhhtn.exedvjpv.exexlxfllf.exevvppd.exefrrfrlr.exenthbhb.exe1vddd.exe7fflrlr.exenhbbth.exedescription pid process target process PID 2916 wrote to memory of 2976 2916 4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe frlrxxf.exe PID 2916 wrote to memory of 2976 2916 4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe frlrxxf.exe PID 2916 wrote to memory of 2976 2916 4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe frlrxxf.exe PID 2916 wrote to memory of 2976 2916 4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe frlrxxf.exe PID 2976 wrote to memory of 2304 2976 frlrxxf.exe xxxllrl.exe PID 2976 wrote to memory of 2304 2976 frlrxxf.exe xxxllrl.exe PID 2976 wrote to memory of 2304 2976 frlrxxf.exe xxxllrl.exe PID 2976 wrote to memory of 2304 2976 frlrxxf.exe xxxllrl.exe PID 2304 wrote to memory of 2616 2304 xxxllrl.exe hbnnhn.exe PID 2304 wrote to memory of 2616 2304 xxxllrl.exe hbnnhn.exe PID 2304 wrote to memory of 2616 2304 xxxllrl.exe hbnnhn.exe PID 2304 wrote to memory of 2616 2304 xxxllrl.exe hbnnhn.exe PID 2616 wrote to memory of 2864 2616 hbnnhn.exe jjjvp.exe PID 2616 wrote to memory of 2864 2616 hbnnhn.exe jjjvp.exe PID 2616 wrote to memory of 2864 2616 hbnnhn.exe jjjvp.exe PID 2616 wrote to memory of 2864 2616 hbnnhn.exe jjjvp.exe PID 2864 wrote to memory of 2852 2864 jjjvp.exe bbhbbh.exe PID 2864 wrote to memory of 2852 2864 jjjvp.exe bbhbbh.exe PID 2864 wrote to memory of 2852 2864 jjjvp.exe bbhbbh.exe PID 2864 wrote to memory of 2852 2864 jjjvp.exe bbhbbh.exe PID 2852 wrote to memory of 2496 2852 bbhbbh.exe ddjvj.exe PID 2852 wrote to memory of 2496 2852 bbhbbh.exe ddjvj.exe PID 2852 wrote to memory of 2496 2852 bbhbbh.exe ddjvj.exe PID 2852 wrote to memory of 2496 2852 bbhbbh.exe ddjvj.exe PID 2496 wrote to memory of 2580 2496 ddjvj.exe bhhhtn.exe PID 2496 wrote to memory of 2580 2496 ddjvj.exe bhhhtn.exe PID 2496 wrote to memory of 2580 2496 ddjvj.exe bhhhtn.exe PID 2496 wrote to memory of 2580 2496 ddjvj.exe bhhhtn.exe PID 2580 wrote to memory of 2512 2580 bhhhtn.exe dvjpv.exe PID 2580 wrote to memory of 2512 2580 bhhhtn.exe dvjpv.exe PID 2580 wrote to memory of 2512 2580 bhhhtn.exe dvjpv.exe PID 2580 wrote to memory of 2512 2580 bhhhtn.exe dvjpv.exe PID 2512 wrote to memory of 2940 2512 dvjpv.exe xlxfllf.exe PID 2512 wrote to memory of 2940 2512 dvjpv.exe xlxfllf.exe PID 2512 wrote to memory of 2940 2512 dvjpv.exe xlxfllf.exe PID 2512 wrote to memory of 2940 2512 dvjpv.exe xlxfllf.exe PID 2940 wrote to memory of 2004 2940 xlxfllf.exe vvppd.exe PID 2940 wrote to memory of 2004 2940 xlxfllf.exe vvppd.exe PID 2940 wrote to memory of 2004 2940 xlxfllf.exe vvppd.exe PID 2940 wrote to memory of 2004 2940 xlxfllf.exe vvppd.exe PID 2004 wrote to memory of 2652 2004 vvppd.exe frrfrlr.exe PID 2004 wrote to memory of 2652 2004 vvppd.exe frrfrlr.exe PID 2004 wrote to memory of 2652 2004 vvppd.exe frrfrlr.exe PID 2004 wrote to memory of 2652 2004 vvppd.exe frrfrlr.exe PID 2652 wrote to memory of 2840 2652 frrfrlr.exe nthbhb.exe PID 2652 wrote to memory of 2840 2652 frrfrlr.exe nthbhb.exe PID 2652 wrote to memory of 2840 2652 frrfrlr.exe nthbhb.exe PID 2652 wrote to memory of 2840 2652 frrfrlr.exe nthbhb.exe PID 2840 wrote to memory of 1032 2840 nthbhb.exe 1vddd.exe PID 2840 wrote to memory of 1032 2840 nthbhb.exe 1vddd.exe PID 2840 wrote to memory of 1032 2840 nthbhb.exe 1vddd.exe PID 2840 wrote to memory of 1032 2840 nthbhb.exe 1vddd.exe PID 1032 wrote to memory of 1252 1032 1vddd.exe 7fflrlr.exe PID 1032 wrote to memory of 1252 1032 1vddd.exe 7fflrlr.exe PID 1032 wrote to memory of 1252 1032 1vddd.exe 7fflrlr.exe PID 1032 wrote to memory of 1252 1032 1vddd.exe 7fflrlr.exe PID 1252 wrote to memory of 1692 1252 7fflrlr.exe nhbbth.exe PID 1252 wrote to memory of 1692 1252 7fflrlr.exe nhbbth.exe PID 1252 wrote to memory of 1692 1252 7fflrlr.exe nhbbth.exe PID 1252 wrote to memory of 1692 1252 7fflrlr.exe nhbbth.exe PID 1692 wrote to memory of 1320 1692 nhbbth.exe dvjpd.exe PID 1692 wrote to memory of 1320 1692 nhbbth.exe dvjpd.exe PID 1692 wrote to memory of 1320 1692 nhbbth.exe dvjpd.exe PID 1692 wrote to memory of 1320 1692 nhbbth.exe dvjpd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\frlrxxf.exec:\frlrxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\xxxllrl.exec:\xxxllrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\hbnnhn.exec:\hbnnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jjjvp.exec:\jjjvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\bbhbbh.exec:\bbhbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\ddjvj.exec:\ddjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\bhhhtn.exec:\bhhhtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\dvjpv.exec:\dvjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\xlxfllf.exec:\xlxfllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\vvppd.exec:\vvppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\frrfrlr.exec:\frrfrlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\nthbhb.exec:\nthbhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\1vddd.exec:\1vddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\7fflrlr.exec:\7fflrlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\nhbbth.exec:\nhbbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\dvjpd.exec:\dvjpd.exe17⤵
- Executes dropped EXE
PID:1320 -
\??\c:\lllrfrf.exec:\lllrfrf.exe18⤵
- Executes dropped EXE
PID:672 -
\??\c:\ddpdv.exec:\ddpdv.exe19⤵
- Executes dropped EXE
PID:816 -
\??\c:\flfxxlf.exec:\flfxxlf.exe20⤵
- Executes dropped EXE
PID:1912 -
\??\c:\nnbttt.exec:\nnbttt.exe21⤵
- Executes dropped EXE
PID:1472 -
\??\c:\jdvvj.exec:\jdvvj.exe22⤵
- Executes dropped EXE
PID:760 -
\??\c:\nnhthb.exec:\nnhthb.exe23⤵
- Executes dropped EXE
PID:1212 -
\??\c:\fxxrxfr.exec:\fxxrxfr.exe24⤵
- Executes dropped EXE
PID:1936 -
\??\c:\rfxllfr.exec:\rfxllfr.exe25⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nbbtbn.exec:\nbbtbn.exe26⤵
- Executes dropped EXE
PID:2072 -
\??\c:\dddjv.exec:\dddjv.exe27⤵
- Executes dropped EXE
PID:836 -
\??\c:\lxrlrrf.exec:\lxrlrrf.exe28⤵
- Executes dropped EXE
PID:1860 -
\??\c:\pdpdv.exec:\pdpdv.exe29⤵
- Executes dropped EXE
PID:1116 -
\??\c:\flrlrfr.exec:\flrlrfr.exe30⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jdppv.exec:\jdppv.exe31⤵
- Executes dropped EXE
PID:1504 -
\??\c:\frrxffx.exec:\frrxffx.exe32⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pjdjp.exec:\pjdjp.exe33⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ntnnth.exec:\ntnnth.exe34⤵
- Executes dropped EXE
PID:1368 -
\??\c:\vvpvd.exec:\vvpvd.exe35⤵
- Executes dropped EXE
PID:692 -
\??\c:\llxxxxx.exec:\llxxxxx.exe36⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jvjjv.exec:\jvjjv.exe37⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jppdd.exec:\jppdd.exe38⤵
- Executes dropped EXE
PID:2976 -
\??\c:\7xrxffl.exec:\7xrxffl.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\thtbbb.exec:\thtbbb.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jjdpd.exec:\jjdpd.exe41⤵
- Executes dropped EXE
PID:2752 -
\??\c:\3vdvd.exec:\3vdvd.exe42⤵
- Executes dropped EXE
PID:2576 -
\??\c:\lrxffxf.exec:\lrxffxf.exe43⤵
- Executes dropped EXE
PID:2476 -
\??\c:\bbtnhn.exec:\bbtnhn.exe44⤵
- Executes dropped EXE
PID:2704 -
\??\c:\5dpvv.exec:\5dpvv.exe45⤵
- Executes dropped EXE
PID:2472 -
\??\c:\djpdv.exec:\djpdv.exe46⤵
- Executes dropped EXE
PID:2588 -
\??\c:\ffrlrfx.exec:\ffrlrfx.exe47⤵
- Executes dropped EXE
PID:2388 -
\??\c:\ntnbbn.exec:\ntnbbn.exe48⤵
- Executes dropped EXE
PID:2024 -
\??\c:\djvpp.exec:\djvpp.exe49⤵
- Executes dropped EXE
PID:2792 -
\??\c:\1jvjd.exec:\1jvjd.exe50⤵
- Executes dropped EXE
PID:2004 -
\??\c:\frlrxxl.exec:\frlrxxl.exe51⤵
- Executes dropped EXE
PID:1800 -
\??\c:\hbhbht.exec:\hbhbht.exe52⤵
- Executes dropped EXE
PID:2804 -
\??\c:\djpjj.exec:\djpjj.exe53⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vjvvv.exec:\vjvvv.exe54⤵
- Executes dropped EXE
PID:1636 -
\??\c:\ffrllfx.exec:\ffrllfx.exe55⤵
- Executes dropped EXE
PID:1440 -
\??\c:\nhthth.exec:\nhthth.exe56⤵
- Executes dropped EXE
PID:1864 -
\??\c:\djjvv.exec:\djjvv.exe57⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xlxxfxx.exec:\xlxxfxx.exe58⤵
- Executes dropped EXE
PID:1320 -
\??\c:\3xxlxfx.exec:\3xxlxfx.exe59⤵
- Executes dropped EXE
PID:776 -
\??\c:\7nthbb.exec:\7nthbb.exe60⤵
- Executes dropped EXE
PID:1064 -
\??\c:\1ppjd.exec:\1ppjd.exe61⤵
- Executes dropped EXE
PID:952 -
\??\c:\fflxxff.exec:\fflxxff.exe62⤵
- Executes dropped EXE
PID:1808 -
\??\c:\nntthb.exec:\nntthb.exe63⤵
- Executes dropped EXE
PID:376 -
\??\c:\nttbhb.exec:\nttbhb.exe64⤵
- Executes dropped EXE
PID:764 -
\??\c:\vpvdv.exec:\vpvdv.exe65⤵
- Executes dropped EXE
PID:272 -
\??\c:\xxfrfxf.exec:\xxfrfxf.exe66⤵PID:1212
-
\??\c:\hnhbth.exec:\hnhbth.exe67⤵PID:2248
-
\??\c:\3bnhnh.exec:\3bnhnh.exe68⤵PID:2868
-
\??\c:\jpvpp.exec:\jpvpp.exe69⤵PID:2052
-
\??\c:\flrllfl.exec:\flrllfl.exe70⤵PID:2276
-
\??\c:\rrxflxl.exec:\rrxflxl.exe71⤵PID:1568
-
\??\c:\bnbbtn.exec:\bnbbtn.exe72⤵PID:1776
-
\??\c:\5jddp.exec:\5jddp.exe73⤵PID:1860
-
\??\c:\xflffxx.exec:\xflffxx.exe74⤵PID:2392
-
\??\c:\nnnbnb.exec:\nnnbnb.exe75⤵PID:1500
-
\??\c:\dvvpp.exec:\dvvpp.exe76⤵PID:1260
-
\??\c:\rxfrflf.exec:\rxfrflf.exe77⤵PID:2428
-
\??\c:\xfrrxfl.exec:\xfrrxfl.exe78⤵PID:2044
-
\??\c:\ttnhth.exec:\ttnhth.exe79⤵PID:1744
-
\??\c:\1ppdv.exec:\1ppdv.exe80⤵PID:1788
-
\??\c:\rrlrfxr.exec:\rrlrfxr.exe81⤵PID:2972
-
\??\c:\ntnnbb.exec:\ntnnbb.exe82⤵PID:1576
-
\??\c:\jjjdv.exec:\jjjdv.exe83⤵PID:2716
-
\??\c:\3pvpd.exec:\3pvpd.exe84⤵PID:2304
-
\??\c:\7xrxrxf.exec:\7xrxrxf.exe85⤵PID:2672
-
\??\c:\nnhbnt.exec:\nnhbnt.exe86⤵PID:2612
-
\??\c:\bbthbn.exec:\bbthbn.exe87⤵PID:2668
-
\??\c:\jppjd.exec:\jppjd.exe88⤵PID:2232
-
\??\c:\ffflrrx.exec:\ffflrrx.exe89⤵PID:2980
-
\??\c:\lrlrlrf.exec:\lrlrlrf.exe90⤵PID:2524
-
\??\c:\hbthnt.exec:\hbthnt.exe91⤵PID:2700
-
\??\c:\vpvjj.exec:\vpvjj.exe92⤵PID:2244
-
\??\c:\7rlxffr.exec:\7rlxffr.exe93⤵PID:2588
-
\??\c:\5nhnht.exec:\5nhnht.exe94⤵PID:2536
-
\??\c:\nhbnhh.exec:\nhbnhh.exe95⤵PID:2488
-
\??\c:\9pjdd.exec:\9pjdd.exe96⤵PID:2780
-
\??\c:\3lxfrxr.exec:\3lxfrxr.exe97⤵PID:2652
-
\??\c:\ttthth.exec:\ttthth.exe98⤵PID:2008
-
\??\c:\3tnthn.exec:\3tnthn.exe99⤵PID:2804
-
\??\c:\vpddp.exec:\vpddp.exe100⤵PID:2032
-
\??\c:\rrlxrrl.exec:\rrlxrrl.exe101⤵PID:1624
-
\??\c:\bbbnhh.exec:\bbbnhh.exe102⤵PID:2208
-
\??\c:\7htbnt.exec:\7htbnt.exe103⤵PID:2184
-
\??\c:\ppdvp.exec:\ppdvp.exe104⤵PID:536
-
\??\c:\llflrrx.exec:\llflrrx.exe105⤵PID:636
-
\??\c:\3ttnbn.exec:\3ttnbn.exe106⤵PID:1336
-
\??\c:\bbtbbh.exec:\bbtbbh.exe107⤵PID:568
-
\??\c:\jvvvd.exec:\jvvvd.exe108⤵PID:804
-
\??\c:\lxfrxll.exec:\lxfrxll.exe109⤵PID:112
-
\??\c:\9bbnth.exec:\9bbnth.exe110⤵PID:2268
-
\??\c:\9jpjv.exec:\9jpjv.exe111⤵PID:2112
-
\??\c:\3lxrxff.exec:\3lxrxff.exe112⤵PID:2448
-
\??\c:\bbttbn.exec:\bbttbn.exe113⤵PID:2656
-
\??\c:\rxlrxrr.exec:\rxlrxrr.exe114⤵PID:1144
-
\??\c:\ththhb.exec:\ththhb.exe115⤵PID:3068
-
\??\c:\nbnbhb.exec:\nbnbhb.exe116⤵PID:1924
-
\??\c:\ddpdv.exec:\ddpdv.exe117⤵PID:1656
-
\??\c:\lxxflfl.exec:\lxxflfl.exe118⤵PID:1984
-
\??\c:\fxfxxxl.exec:\fxfxxxl.exe119⤵PID:2332
-
\??\c:\bnbbth.exec:\bnbbth.exe120⤵PID:2000
-
\??\c:\jdvdd.exec:\jdvdd.exe121⤵PID:1020
-
\??\c:\5jdpj.exec:\5jdpj.exe122⤵PID:1504
-
\??\c:\7xrflrl.exec:\7xrflrl.exe123⤵PID:2068
-
\??\c:\tnhhnt.exec:\tnhhnt.exe124⤵PID:1552
-
\??\c:\pdpvd.exec:\pdpvd.exe125⤵PID:2336
-
\??\c:\1rfxllr.exec:\1rfxllr.exe126⤵PID:1368
-
\??\c:\xrxrffx.exec:\xrxrffx.exe127⤵PID:2920
-
\??\c:\3bbbbn.exec:\3bbbbn.exe128⤵PID:1700
-
\??\c:\pdvpj.exec:\pdvpj.exe129⤵PID:2560
-
\??\c:\jdjvj.exec:\jdjvj.exe130⤵PID:2844
-
\??\c:\3lfxxxf.exec:\3lfxxxf.exe131⤵PID:3064
-
\??\c:\xxlxxrl.exec:\xxlxxrl.exe132⤵PID:2648
-
\??\c:\bnnbtn.exec:\bnnbtn.exe133⤵PID:2668
-
\??\c:\pppvj.exec:\pppvj.exe134⤵PID:2684
-
\??\c:\xrlrflx.exec:\xrlrflx.exe135⤵PID:2980
-
\??\c:\xxxlxfr.exec:\xxxlxfr.exe136⤵PID:2524
-
\??\c:\rllrlfl.exec:\rllrlfl.exe137⤵PID:2520
-
\??\c:\bnbttb.exec:\bnbttb.exe138⤵PID:2400
-
\??\c:\pvpjv.exec:\pvpjv.exe139⤵PID:2984
-
\??\c:\3vvjv.exec:\3vvjv.exe140⤵PID:2772
-
\??\c:\xxlffrr.exec:\xxlffrr.exe141⤵PID:2832
-
\??\c:\1tbnnb.exec:\1tbnnb.exe142⤵PID:2836
-
\??\c:\jpdjd.exec:\jpdjd.exe143⤵PID:2148
-
\??\c:\xflxlxr.exec:\xflxlxr.exe144⤵PID:1268
-
\??\c:\hbnbtt.exec:\hbnbtt.exe145⤵PID:1236
-
\??\c:\hntbbb.exec:\hntbbb.exe146⤵PID:2032
-
\??\c:\rxllfrr.exec:\rxllfrr.exe147⤵PID:1692
-
\??\c:\rflxxrl.exec:\rflxxrl.exe148⤵PID:1872
-
\??\c:\bbbhtb.exec:\bbbhtb.exe149⤵PID:572
-
\??\c:\hhttbh.exec:\hhttbh.exe150⤵PID:776
-
\??\c:\jvvjd.exec:\jvvjd.exe151⤵PID:1476
-
\??\c:\lrlflfl.exec:\lrlflfl.exe152⤵PID:1120
-
\??\c:\5nhhnn.exec:\5nhhnn.exe153⤵PID:2508
-
\??\c:\dddpp.exec:\dddpp.exe154⤵PID:1768
-
\??\c:\dppvv.exec:\dppvv.exe155⤵PID:3040
-
\??\c:\rxxrflf.exec:\rxxrflf.exe156⤵PID:760
-
\??\c:\bnntnt.exec:\bnntnt.exe157⤵PID:1072
-
\??\c:\1btbhn.exec:\1btbhn.exe158⤵PID:2248
-
\??\c:\ddvjp.exec:\ddvjp.exe159⤵PID:1488
-
\??\c:\rrlrfrf.exec:\rrlrfrf.exe160⤵PID:1780
-
\??\c:\9rlxfrf.exec:\9rlxfrf.exe161⤵PID:2224
-
\??\c:\thhnnh.exec:\thhnnh.exe162⤵PID:1348
-
\??\c:\jjdjj.exec:\jjdjj.exe163⤵PID:2096
-
\??\c:\ppjpj.exec:\ppjpj.exe164⤵PID:1356
-
\??\c:\xxxllxr.exec:\xxxllxr.exe165⤵PID:1860
-
\??\c:\nnhhtb.exec:\nnhhtb.exe166⤵PID:1600
-
\??\c:\bbbhht.exec:\bbbhht.exe167⤵PID:700
-
\??\c:\5jjvd.exec:\5jjvd.exe168⤵PID:2328
-
\??\c:\lffflfr.exec:\lffflfr.exe169⤵PID:852
-
\??\c:\9fffllx.exec:\9fffllx.exe170⤵PID:2324
-
\??\c:\3hthbn.exec:\3hthbn.exe171⤵PID:2156
-
\??\c:\ntthbn.exec:\ntthbn.exe172⤵PID:1940
-
\??\c:\pjvvp.exec:\pjvvp.exe173⤵PID:2080
-
\??\c:\xfrlrll.exec:\xfrlrll.exe174⤵PID:3028
-
\??\c:\hnnhht.exec:\hnnhht.exe175⤵PID:3004
-
\??\c:\tnbhnt.exec:\tnbhnt.exe176⤵PID:2856
-
\??\c:\vpjvp.exec:\vpjvp.exe177⤵PID:3008
-
\??\c:\llrxlrl.exec:\llrxlrl.exe178⤵PID:2660
-
\??\c:\bbtthn.exec:\bbtthn.exe179⤵PID:2504
-
\??\c:\hthbhb.exec:\hthbhb.exe180⤵PID:2476
-
\??\c:\jjjdv.exec:\jjjdv.exe181⤵PID:2516
-
\??\c:\9fflxfl.exec:\9fflxfl.exe182⤵PID:2532
-
\??\c:\hhtnhh.exec:\hhtnhh.exe183⤵PID:2640
-
\??\c:\9tbtnb.exec:\9tbtnb.exe184⤵PID:2136
-
\??\c:\vvpdd.exec:\vvpdd.exe185⤵PID:2756
-
\??\c:\vpjpj.exec:\vpjpj.exe186⤵PID:2764
-
\??\c:\xlrllfx.exec:\xlrllfx.exe187⤵PID:2004
-
\??\c:\bhhbnb.exec:\bhhbnb.exe188⤵PID:1296
-
\??\c:\pvvvp.exec:\pvvvp.exe189⤵PID:2812
-
\??\c:\vppjp.exec:\vppjp.exe190⤵PID:1036
-
\??\c:\rllxlxl.exec:\rllxlxl.exe191⤵PID:2796
-
\??\c:\rlxffxl.exec:\rlxffxl.exe192⤵PID:2012
-
\??\c:\hbtbhn.exec:\hbtbhn.exe193⤵PID:1592
-
\??\c:\ddvvd.exec:\ddvvd.exe194⤵PID:792
-
\??\c:\lrfrlxl.exec:\lrfrlxl.exe195⤵PID:1320
-
\??\c:\xrfxfrx.exec:\xrfxfrx.exe196⤵PID:816
-
\??\c:\hbnntt.exec:\hbnntt.exe197⤵PID:1044
-
\??\c:\3hhbbb.exec:\3hhbbb.exe198⤵PID:2964
-
\??\c:\7pjpp.exec:\7pjpp.exe199⤵PID:796
-
\??\c:\llfflff.exec:\llfflff.exe200⤵PID:1524
-
\??\c:\lxrlrlr.exec:\lxrlrlr.exe201⤵PID:1508
-
\??\c:\nhtbhb.exec:\nhtbhb.exe202⤵PID:2884
-
\??\c:\3pjpd.exec:\3pjpd.exe203⤵PID:2776
-
\??\c:\djppp.exec:\djppp.exe204⤵PID:2252
-
\??\c:\rrlxlrx.exec:\rrlxlrx.exe205⤵PID:1856
-
\??\c:\bnbbhh.exec:\bnbbhh.exe206⤵PID:1488
-
\??\c:\nnbnbh.exec:\nnbnbh.exe207⤵PID:2052
-
\??\c:\1dpdj.exec:\1dpdj.exe208⤵PID:2224
-
\??\c:\1xlxrfx.exec:\1xlxrfx.exe209⤵PID:1348
-
\??\c:\rflrlxx.exec:\rflrlxx.exe210⤵PID:1688
-
\??\c:\5nntbh.exec:\5nntbh.exe211⤵PID:964
-
\??\c:\3btntt.exec:\3btntt.exe212⤵PID:2128
-
\??\c:\jjjvj.exec:\jjjvj.exe213⤵PID:2084
-
\??\c:\5vppd.exec:\5vppd.exe214⤵PID:1260
-
\??\c:\7flfxlx.exec:\7flfxlx.exe215⤵PID:2108
-
\??\c:\3bbhbn.exec:\3bbhbn.exe216⤵PID:2848
-
\??\c:\ttnbht.exec:\ttnbht.exe217⤵PID:2044
-
\??\c:\1vjdd.exec:\1vjdd.exe218⤵PID:2916
-
\??\c:\rrfxllf.exec:\rrfxllf.exe219⤵PID:2992
-
\??\c:\fffxrfx.exec:\fffxrfx.exe220⤵PID:3032
-
\??\c:\7btntb.exec:\7btntb.exe221⤵PID:1700
-
\??\c:\ddjpd.exec:\ddjpd.exe222⤵PID:2740
-
\??\c:\jjpvv.exec:\jjpvv.exe223⤵PID:2844
-
\??\c:\5ffflrr.exec:\5ffflrr.exe224⤵PID:3064
-
\??\c:\xrfrlxf.exec:\xrfrlxf.exe225⤵PID:2692
-
\??\c:\nhbhnn.exec:\nhbhnn.exe226⤵PID:2660
-
\??\c:\vvjpj.exec:\vvjpj.exe227⤵PID:2680
-
\??\c:\djpjd.exec:\djpjd.exe228⤵PID:2040
-
\??\c:\rlflxlx.exec:\rlflxlx.exe229⤵PID:2704
-
\??\c:\ttbttb.exec:\ttbttb.exe230⤵PID:2636
-
\??\c:\hbthnb.exec:\hbthnb.exe231⤵PID:468
-
\??\c:\jdjjp.exec:\jdjjp.exe232⤵PID:1288
-
\??\c:\xrrxrfr.exec:\xrrxrfr.exe233⤵PID:2480
-
\??\c:\xfrrlfl.exec:\xfrrlfl.exe234⤵PID:1644
-
\??\c:\3nnttb.exec:\3nnttb.exe235⤵PID:1800
-
\??\c:\bthnbh.exec:\bthnbh.exe236⤵PID:2840
-
\??\c:\1vdjj.exec:\1vdjj.exe237⤵PID:2568
-
\??\c:\lfrfrfr.exec:\lfrfrfr.exe238⤵PID:1636
-
\??\c:\llfflff.exec:\llfflff.exe239⤵PID:1816
-
\??\c:\tnthtb.exec:\tnthtb.exe240⤵PID:2032
-
\??\c:\jjdpj.exec:\jjdpj.exe241⤵PID:332
-
\??\c:\jdvpp.exec:\jdvpp.exe242⤵PID:688