Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 02:08
Behavioral task
behavioral1
Sample
5007621f22b924d5d3f3e30b82802a90_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5007621f22b924d5d3f3e30b82802a90_NeikiAnalytics.exe
-
Size
198KB
-
MD5
5007621f22b924d5d3f3e30b82802a90
-
SHA1
595291a701377288895ef9a9775940244bf7ab75
-
SHA256
6694dca32c848562263df584ce3fb502d9294b776db439ae7500c56042177bbc
-
SHA512
9e3cf394c47381007f4718f41f271780e1a98466494d68db035fa8fe1d2c9b8e23b925dafd73411e3fdf75f2bdec5bd1ca218812844bbaca3e315e7adbcbdd9a
-
SSDEEP
3072:xhOmTsF93UYfwC6GIout3WVi/8HCpi8rY9AABa1YRMxl1522cJ1uIo:xcm4FmowdHoS3WV28HCddWhRO1Lc9o
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/2960-9-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1624-13-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1796-36-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2424-28-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2744-47-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2668-50-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2908-65-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2556-74-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2804-84-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2608-92-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2824-103-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1844-151-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1260-159-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1460-169-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3044-177-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2112-187-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1732-213-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/784-222-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1108-226-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1552-242-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1996-258-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2260-275-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/296-296-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2976-304-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2744-355-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1980-376-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2508-414-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1712-435-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1508-524-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2616-556-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1700-589-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2828-683-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2828-691-0x0000000000250000-0x0000000000286000-memory.dmp family_blackmoon behavioral1/memory/3004-710-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1868-810-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1820-818-0x00000000002D0000-0x0000000000306000-memory.dmp family_blackmoon behavioral1/memory/2916-925-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2624-1024-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
9xrxlrf.exe5llfffl.exe5ffflrx.exehttbhn.exejvjjp.exellxfxfl.exeththhh.exe9jdpv.exefxffrll.exevpdjp.exe3xflllr.exerxfxfxr.exehbttbh.exejdvdv.exexrxflfr.exehthnth.exevvvpp.exelfrfxrf.exehbnntt.exedvddj.exe5rxrlxr.exenbtbnn.exedpddj.exefrrxxxl.exebtnnnt.exepdvjp.exepjppp.exefxfrflr.exepjvpj.exedjpvj.exenbttbh.exejdvdp.exepddpd.exelxrxxxf.exennnhbn.exepdpdj.exepjpjp.exelfflllx.exejdvdp.exe9vjvd.exexrxxffl.exe5thbnn.exedvpvj.exe1vjjj.exerfxxxlx.exenhtbhh.exe3pjdp.exevpdjv.exexxlfflr.exe1llfrrf.exe7nbhbb.exe7pjjv.exejdvpd.exe9ffxfxl.exebthbnn.exedppvj.exevpdjv.exelfxlflf.exe1hnnhh.exejddjv.exe9djpj.exe3llrxlx.exe3hhnbn.exebbbtbb.exepid process 1624 9xrxlrf.exe 2424 5llfffl.exe 1796 5ffflrx.exe 2744 httbhn.exe 2668 jvjjp.exe 2908 llxfxfl.exe 2556 ththhh.exe 2804 9jdpv.exe 2608 fxffrll.exe 1336 vpdjp.exe 2824 3xflllr.exe 2872 rxfxfxr.exe 3048 hbttbh.exe 1948 jdvdv.exe 1932 xrxflfr.exe 1844 hthnth.exe 1260 vvvpp.exe 1460 lfrfxrf.exe 3044 hbnntt.exe 2112 dvddj.exe 1636 5rxrlxr.exe 2280 nbtbnn.exe 1732 dpddj.exe 784 frrxxxl.exe 1108 btnnnt.exe 1820 pdvjp.exe 1552 pjppp.exe 780 fxfrflr.exe 1996 pjvpj.exe 876 djpvj.exe 2260 nbttbh.exe 2480 jdvdp.exe 296 pddpd.exe 1756 lxrxxxf.exe 2976 nnnhbn.exe 3068 pdpdj.exe 896 pjpjp.exe 2140 lfflllx.exe 2340 jdvdp.exe 2912 9vjvd.exe 2680 xrxxffl.exe 2744 5thbnn.exe 2724 dvpvj.exe 2892 1vjjj.exe 1980 rfxxxlx.exe 2544 nhtbhh.exe 2588 3pjdp.exe 2472 vpdjv.exe 2332 xxlfflr.exe 2868 1llfrrf.exe 2824 7nbhbb.exe 2508 7pjjv.exe 1976 jdvpd.exe 1712 9ffxfxl.exe 1680 bthbnn.exe 2024 dppvj.exe 2520 vpdjv.exe 1260 lfxlflf.exe 548 1hnnhh.exe 820 jddjv.exe 2632 9djpj.exe 2636 3llrxlx.exe 1636 3hhnbn.exe 2228 bbbtbb.exe -
Processes:
resource yara_rule behavioral1/memory/2960-0-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\9xrxlrf.exe upx behavioral1/memory/2960-9-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2424-19-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\5llfffl.exe upx behavioral1/memory/1624-13-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\5ffflrx.exe upx behavioral1/memory/2744-38-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\httbhn.exe upx behavioral1/memory/1796-36-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2424-28-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jvjjp.exe upx behavioral1/memory/2744-47-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2668-50-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\llxfxfl.exe upx C:\ththhh.exe upx behavioral1/memory/2908-65-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2804-75-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2556-74-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\9jdpv.exe upx C:\fxffrll.exe upx behavioral1/memory/2804-84-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vpdjp.exe upx behavioral1/memory/2608-92-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\3xflllr.exe upx behavioral1/memory/2824-103-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rxfxfxr.exe upx C:\hbttbh.exe upx C:\jdvdv.exe upx C:\xrxflfr.exe upx C:\hthnth.exe upx C:\vvvpp.exe upx behavioral1/memory/1844-151-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\lfrfxrf.exe upx behavioral1/memory/1260-159-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hbnntt.exe upx behavioral1/memory/1460-169-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dvddj.exe upx behavioral1/memory/3044-177-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2112-187-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\5rxrlxr.exe upx C:\nbtbnn.exe upx C:\dpddj.exe upx C:\frrxxxl.exe upx behavioral1/memory/1732-213-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\btnnnt.exe upx behavioral1/memory/784-222-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1108-226-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pdvjp.exe upx C:\pjppp.exe upx behavioral1/memory/1552-242-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fxfrflr.exe upx C:\pjvpj.exe upx behavioral1/memory/1996-258-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\djpvj.exe upx C:\nbttbh.exe upx behavioral1/memory/2260-275-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jdvdp.exe upx behavioral1/memory/296-290-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/296-296-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2976-304-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2680-341-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2744-348-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2724-356-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5007621f22b924d5d3f3e30b82802a90_NeikiAnalytics.exe9xrxlrf.exe5llfffl.exe5ffflrx.exehttbhn.exejvjjp.exellxfxfl.exeththhh.exe9jdpv.exefxffrll.exevpdjp.exe3xflllr.exerxfxfxr.exehbttbh.exejdvdv.exexrxflfr.exedescription pid process target process PID 2960 wrote to memory of 1624 2960 5007621f22b924d5d3f3e30b82802a90_NeikiAnalytics.exe 9xrxlrf.exe PID 2960 wrote to memory of 1624 2960 5007621f22b924d5d3f3e30b82802a90_NeikiAnalytics.exe 9xrxlrf.exe PID 2960 wrote to memory of 1624 2960 5007621f22b924d5d3f3e30b82802a90_NeikiAnalytics.exe 9xrxlrf.exe PID 2960 wrote to memory of 1624 2960 5007621f22b924d5d3f3e30b82802a90_NeikiAnalytics.exe 9xrxlrf.exe PID 1624 wrote to memory of 2424 1624 9xrxlrf.exe 5llfffl.exe PID 1624 wrote to memory of 2424 1624 9xrxlrf.exe 5llfffl.exe PID 1624 wrote to memory of 2424 1624 9xrxlrf.exe 5llfffl.exe PID 1624 wrote to memory of 2424 1624 9xrxlrf.exe 5llfffl.exe PID 2424 wrote to memory of 1796 2424 5llfffl.exe 5ffflrx.exe PID 2424 wrote to memory of 1796 2424 5llfffl.exe 5ffflrx.exe PID 2424 wrote to memory of 1796 2424 5llfffl.exe 5ffflrx.exe PID 2424 wrote to memory of 1796 2424 5llfffl.exe 5ffflrx.exe PID 1796 wrote to memory of 2744 1796 5ffflrx.exe httbhn.exe PID 1796 wrote to memory of 2744 1796 5ffflrx.exe httbhn.exe PID 1796 wrote to memory of 2744 1796 5ffflrx.exe httbhn.exe PID 1796 wrote to memory of 2744 1796 5ffflrx.exe httbhn.exe PID 2744 wrote to memory of 2668 2744 httbhn.exe jvjjp.exe PID 2744 wrote to memory of 2668 2744 httbhn.exe jvjjp.exe PID 2744 wrote to memory of 2668 2744 httbhn.exe jvjjp.exe PID 2744 wrote to memory of 2668 2744 httbhn.exe jvjjp.exe PID 2668 wrote to memory of 2908 2668 jvjjp.exe llxfxfl.exe PID 2668 wrote to memory of 2908 2668 jvjjp.exe llxfxfl.exe PID 2668 wrote to memory of 2908 2668 jvjjp.exe llxfxfl.exe PID 2668 wrote to memory of 2908 2668 jvjjp.exe llxfxfl.exe PID 2908 wrote to memory of 2556 2908 llxfxfl.exe ththhh.exe PID 2908 wrote to memory of 2556 2908 llxfxfl.exe ththhh.exe PID 2908 wrote to memory of 2556 2908 llxfxfl.exe ththhh.exe PID 2908 wrote to memory of 2556 2908 llxfxfl.exe ththhh.exe PID 2556 wrote to memory of 2804 2556 ththhh.exe 9jdpv.exe PID 2556 wrote to memory of 2804 2556 ththhh.exe 9jdpv.exe PID 2556 wrote to memory of 2804 2556 ththhh.exe 9jdpv.exe PID 2556 wrote to memory of 2804 2556 ththhh.exe 9jdpv.exe PID 2804 wrote to memory of 2608 2804 9jdpv.exe fxffrll.exe PID 2804 wrote to memory of 2608 2804 9jdpv.exe fxffrll.exe PID 2804 wrote to memory of 2608 2804 9jdpv.exe fxffrll.exe PID 2804 wrote to memory of 2608 2804 9jdpv.exe fxffrll.exe PID 2608 wrote to memory of 1336 2608 fxffrll.exe vpdjp.exe PID 2608 wrote to memory of 1336 2608 fxffrll.exe vpdjp.exe PID 2608 wrote to memory of 1336 2608 fxffrll.exe vpdjp.exe PID 2608 wrote to memory of 1336 2608 fxffrll.exe vpdjp.exe PID 1336 wrote to memory of 2824 1336 vpdjp.exe 3xflllr.exe PID 1336 wrote to memory of 2824 1336 vpdjp.exe 3xflllr.exe PID 1336 wrote to memory of 2824 1336 vpdjp.exe 3xflllr.exe PID 1336 wrote to memory of 2824 1336 vpdjp.exe 3xflllr.exe PID 2824 wrote to memory of 2872 2824 3xflllr.exe rxfxfxr.exe PID 2824 wrote to memory of 2872 2824 3xflllr.exe rxfxfxr.exe PID 2824 wrote to memory of 2872 2824 3xflllr.exe rxfxfxr.exe PID 2824 wrote to memory of 2872 2824 3xflllr.exe rxfxfxr.exe PID 2872 wrote to memory of 3048 2872 rxfxfxr.exe hbttbh.exe PID 2872 wrote to memory of 3048 2872 rxfxfxr.exe hbttbh.exe PID 2872 wrote to memory of 3048 2872 rxfxfxr.exe hbttbh.exe PID 2872 wrote to memory of 3048 2872 rxfxfxr.exe hbttbh.exe PID 3048 wrote to memory of 1948 3048 hbttbh.exe jdvdv.exe PID 3048 wrote to memory of 1948 3048 hbttbh.exe jdvdv.exe PID 3048 wrote to memory of 1948 3048 hbttbh.exe jdvdv.exe PID 3048 wrote to memory of 1948 3048 hbttbh.exe jdvdv.exe PID 1948 wrote to memory of 1932 1948 jdvdv.exe xrxflfr.exe PID 1948 wrote to memory of 1932 1948 jdvdv.exe xrxflfr.exe PID 1948 wrote to memory of 1932 1948 jdvdv.exe xrxflfr.exe PID 1948 wrote to memory of 1932 1948 jdvdv.exe xrxflfr.exe PID 1932 wrote to memory of 1844 1932 xrxflfr.exe hthnth.exe PID 1932 wrote to memory of 1844 1932 xrxflfr.exe hthnth.exe PID 1932 wrote to memory of 1844 1932 xrxflfr.exe hthnth.exe PID 1932 wrote to memory of 1844 1932 xrxflfr.exe hthnth.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5007621f22b924d5d3f3e30b82802a90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5007621f22b924d5d3f3e30b82802a90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\9xrxlrf.exec:\9xrxlrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\5llfffl.exec:\5llfffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\5ffflrx.exec:\5ffflrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\httbhn.exec:\httbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\jvjjp.exec:\jvjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\llxfxfl.exec:\llxfxfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\ththhh.exec:\ththhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\9jdpv.exec:\9jdpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\fxffrll.exec:\fxffrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\vpdjp.exec:\vpdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\3xflllr.exec:\3xflllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\rxfxfxr.exec:\rxfxfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\hbttbh.exec:\hbttbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\jdvdv.exec:\jdvdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\xrxflfr.exec:\xrxflfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\hthnth.exec:\hthnth.exe17⤵
- Executes dropped EXE
PID:1844 -
\??\c:\vvvpp.exec:\vvvpp.exe18⤵
- Executes dropped EXE
PID:1260 -
\??\c:\lfrfxrf.exec:\lfrfxrf.exe19⤵
- Executes dropped EXE
PID:1460 -
\??\c:\hbnntt.exec:\hbnntt.exe20⤵
- Executes dropped EXE
PID:3044 -
\??\c:\dvddj.exec:\dvddj.exe21⤵
- Executes dropped EXE
PID:2112 -
\??\c:\5rxrlxr.exec:\5rxrlxr.exe22⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nbtbnn.exec:\nbtbnn.exe23⤵
- Executes dropped EXE
PID:2280 -
\??\c:\dpddj.exec:\dpddj.exe24⤵
- Executes dropped EXE
PID:1732 -
\??\c:\frrxxxl.exec:\frrxxxl.exe25⤵
- Executes dropped EXE
PID:784 -
\??\c:\btnnnt.exec:\btnnnt.exe26⤵
- Executes dropped EXE
PID:1108 -
\??\c:\pdvjp.exec:\pdvjp.exe27⤵
- Executes dropped EXE
PID:1820 -
\??\c:\pjppp.exec:\pjppp.exe28⤵
- Executes dropped EXE
PID:1552 -
\??\c:\fxfrflr.exec:\fxfrflr.exe29⤵
- Executes dropped EXE
PID:780 -
\??\c:\pjvpj.exec:\pjvpj.exe30⤵
- Executes dropped EXE
PID:1996 -
\??\c:\djpvj.exec:\djpvj.exe31⤵
- Executes dropped EXE
PID:876 -
\??\c:\nbttbh.exec:\nbttbh.exe32⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jdvdp.exec:\jdvdp.exe33⤵
- Executes dropped EXE
PID:2480 -
\??\c:\pddpd.exec:\pddpd.exe34⤵
- Executes dropped EXE
PID:296 -
\??\c:\lxrxxxf.exec:\lxrxxxf.exe35⤵
- Executes dropped EXE
PID:1756 -
\??\c:\nnnhbn.exec:\nnnhbn.exe36⤵
- Executes dropped EXE
PID:2976 -
\??\c:\pdpdj.exec:\pdpdj.exe37⤵
- Executes dropped EXE
PID:3068 -
\??\c:\pjpjp.exec:\pjpjp.exe38⤵
- Executes dropped EXE
PID:896 -
\??\c:\lfflllx.exec:\lfflllx.exe39⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jdvdp.exec:\jdvdp.exe40⤵
- Executes dropped EXE
PID:2340 -
\??\c:\9vjvd.exec:\9vjvd.exe41⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xrxxffl.exec:\xrxxffl.exe42⤵
- Executes dropped EXE
PID:2680 -
\??\c:\5thbnn.exec:\5thbnn.exe43⤵
- Executes dropped EXE
PID:2744 -
\??\c:\dvpvj.exec:\dvpvj.exe44⤵
- Executes dropped EXE
PID:2724 -
\??\c:\1vjjj.exec:\1vjjj.exe45⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rfxxxlx.exec:\rfxxxlx.exe46⤵
- Executes dropped EXE
PID:1980 -
\??\c:\nhtbhh.exec:\nhtbhh.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\3pjdp.exec:\3pjdp.exe48⤵
- Executes dropped EXE
PID:2588 -
\??\c:\vpdjv.exec:\vpdjv.exe49⤵
- Executes dropped EXE
PID:2472 -
\??\c:\xxlfflr.exec:\xxlfflr.exe50⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1llfrrf.exec:\1llfrrf.exe51⤵
- Executes dropped EXE
PID:2868 -
\??\c:\7nbhbb.exec:\7nbhbb.exe52⤵
- Executes dropped EXE
PID:2824 -
\??\c:\7pjjv.exec:\7pjjv.exe53⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jdvpd.exec:\jdvpd.exe54⤵
- Executes dropped EXE
PID:1976 -
\??\c:\9ffxfxl.exec:\9ffxfxl.exe55⤵
- Executes dropped EXE
PID:1712 -
\??\c:\bthbnn.exec:\bthbnn.exe56⤵
- Executes dropped EXE
PID:1680 -
\??\c:\dppvj.exec:\dppvj.exe57⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vpdjv.exec:\vpdjv.exe58⤵
- Executes dropped EXE
PID:2520 -
\??\c:\lfxlflf.exec:\lfxlflf.exe59⤵
- Executes dropped EXE
PID:1260 -
\??\c:\1hnnhh.exec:\1hnnhh.exe60⤵
- Executes dropped EXE
PID:548 -
\??\c:\jddjv.exec:\jddjv.exe61⤵
- Executes dropped EXE
PID:820 -
\??\c:\9djpj.exec:\9djpj.exe62⤵
- Executes dropped EXE
PID:2632 -
\??\c:\3llrxlx.exec:\3llrxlx.exe63⤵
- Executes dropped EXE
PID:2636 -
\??\c:\3hhnbn.exec:\3hhnbn.exe64⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bbbtbb.exec:\bbbtbb.exe65⤵
- Executes dropped EXE
PID:2228 -
\??\c:\7vppv.exec:\7vppv.exe66⤵PID:684
-
\??\c:\rxllllr.exec:\rxllllr.exe67⤵PID:624
-
\??\c:\lxxxllx.exec:\lxxxllx.exe68⤵PID:1500
-
\??\c:\thbhth.exec:\thbhth.exe69⤵PID:1508
-
\??\c:\vvjdp.exec:\vvjdp.exe70⤵PID:1140
-
\??\c:\lfflfrx.exec:\lfflfrx.exe71⤵PID:1568
-
\??\c:\lrfxxll.exec:\lrfxxll.exe72⤵PID:1880
-
\??\c:\9nhnbt.exec:\9nhnbt.exe73⤵PID:2004
-
\??\c:\ddddd.exec:\ddddd.exe74⤵PID:2616
-
\??\c:\dddvd.exec:\dddvd.exe75⤵PID:2264
-
\??\c:\lllxlrf.exec:\lllxlrf.exe76⤵PID:2356
-
\??\c:\3lflxxf.exec:\3lflxxf.exe77⤵PID:2124
-
\??\c:\tnnhtn.exec:\tnnhtn.exe78⤵PID:1520
-
\??\c:\jjpvp.exec:\jjpvp.exe79⤵PID:284
-
\??\c:\pjjpd.exec:\pjjpd.exe80⤵PID:1700
-
\??\c:\3rrlxxl.exec:\3rrlxxl.exe81⤵PID:1616
-
\??\c:\hbnhhh.exec:\hbnhhh.exe82⤵PID:2976
-
\??\c:\jpvjd.exec:\jpvjd.exe83⤵PID:2240
-
\??\c:\vjvpp.exec:\vjvpp.exe84⤵PID:1776
-
\??\c:\xrxfrrl.exec:\xrxfrrl.exe85⤵PID:2352
-
\??\c:\bttbth.exec:\bttbth.exe86⤵PID:2756
-
\??\c:\5nhtnt.exec:\5nhtnt.exe87⤵PID:2740
-
\??\c:\vpdjp.exec:\vpdjp.exe88⤵PID:2696
-
\??\c:\rlfrlxf.exec:\rlfrlxf.exe89⤵PID:2668
-
\??\c:\nhtbht.exec:\nhtbht.exe90⤵PID:2908
-
\??\c:\9nhtnn.exec:\9nhtnn.exe91⤵PID:2892
-
\??\c:\ppjjp.exec:\ppjjp.exe92⤵PID:2548
-
\??\c:\ffrfrfx.exec:\ffrfrfx.exe93⤵PID:2584
-
\??\c:\7fxxffl.exec:\7fxxffl.exe94⤵PID:2608
-
\??\c:\tbthbn.exec:\tbthbn.exe95⤵PID:2828
-
\??\c:\vpdjv.exec:\vpdjv.exe96⤵PID:2888
-
\??\c:\lfrlrfl.exec:\lfrlrfl.exe97⤵PID:2968
-
\??\c:\5lrxffl.exec:\5lrxffl.exe98⤵PID:3004
-
\??\c:\nhthnb.exec:\nhthnb.exe99⤵PID:1808
-
\??\c:\pdvdd.exec:\pdvdd.exe100⤵PID:2416
-
\??\c:\xllrxlr.exec:\xllrxlr.exe101⤵PID:1720
-
\??\c:\rxllrrf.exec:\rxllrrf.exe102⤵PID:1844
-
\??\c:\3hbhnt.exec:\3hbhnt.exe103⤵PID:1944
-
\??\c:\9pddd.exec:\9pddd.exe104⤵PID:3052
-
\??\c:\jdvjv.exec:\jdvjv.exe105⤵PID:768
-
\??\c:\lxfxfff.exec:\lxfxfff.exe106⤵PID:1060
-
\??\c:\htnbnn.exec:\htnbnn.exe107⤵PID:820
-
\??\c:\3dvpd.exec:\3dvpd.exe108⤵PID:2120
-
\??\c:\vpjvv.exec:\vpjvv.exe109⤵PID:2636
-
\??\c:\1xllrlx.exec:\1xllrlx.exe110⤵PID:2280
-
\??\c:\9nnhhn.exec:\9nnhhn.exe111⤵PID:2072
-
\??\c:\3bbhhh.exec:\3bbhhh.exe112⤵PID:600
-
\??\c:\9jdvj.exec:\9jdvj.exe113⤵PID:1868
-
\??\c:\7lrrxff.exec:\7lrrxff.exe114⤵PID:1820
-
\??\c:\5tttbb.exec:\5tttbb.exe115⤵PID:1872
-
\??\c:\7pvdj.exec:\7pvdj.exe116⤵PID:1380
-
\??\c:\5rlfllr.exec:\5rlfllr.exe117⤵PID:1880
-
\??\c:\xlxfrrf.exec:\xlxfrrf.exe118⤵PID:1544
-
\??\c:\nnhhtb.exec:\nnhhtb.exe119⤵PID:1652
-
\??\c:\vjpjp.exec:\vjpjp.exe120⤵PID:940
-
\??\c:\5jjpp.exec:\5jjpp.exe121⤵PID:2260
-
\??\c:\rlflfxl.exec:\rlflfxl.exe122⤵PID:1252
-
\??\c:\bttbhn.exec:\bttbhn.exe123⤵PID:2044
-
\??\c:\hbhnbh.exec:\hbhnbh.exe124⤵PID:2972
-
\??\c:\jddjj.exec:\jddjj.exe125⤵PID:1736
-
\??\c:\rfxfffr.exec:\rfxfffr.exe126⤵PID:1592
-
\??\c:\frffllr.exec:\frffllr.exe127⤵PID:2200
-
\??\c:\hbhnth.exec:\hbhnth.exe128⤵PID:1768
-
\??\c:\dpjpv.exec:\dpjpv.exe129⤵PID:2136
-
\??\c:\rfflxlr.exec:\rfflxlr.exe130⤵PID:2800
-
\??\c:\fxxlflx.exec:\fxxlflx.exe131⤵PID:2916
-
\??\c:\hbnhth.exec:\hbnhth.exe132⤵PID:2680
-
\??\c:\3btthh.exec:\3btthh.exe133⤵PID:2732
-
\??\c:\pjppj.exec:\pjppj.exe134⤵PID:2572
-
\??\c:\1lllxlr.exec:\1lllxlr.exe135⤵PID:2708
-
\??\c:\nbnhnh.exec:\nbnhnh.exe136⤵PID:2596
-
\??\c:\tnhbhn.exec:\tnhbhn.exe137⤵PID:1704
-
\??\c:\vjpvd.exec:\vjpvd.exe138⤵PID:2612
-
\??\c:\7xxlxxr.exec:\7xxlxxr.exe139⤵PID:2472
-
\??\c:\nhtntn.exec:\nhtntn.exe140⤵PID:1572
-
\??\c:\jjjvp.exec:\jjjvp.exe141⤵PID:2712
-
\??\c:\dvpjd.exec:\dvpjd.exe142⤵PID:1676
-
\??\c:\rllfxlf.exec:\rllfxlf.exe143⤵PID:2508
-
\??\c:\xrxrxxx.exec:\xrxrxxx.exe144⤵PID:1948
-
\??\c:\hbtbnt.exec:\hbtbnt.exe145⤵PID:2328
-
\??\c:\9ddjd.exec:\9ddjd.exe146⤵PID:1316
-
\??\c:\pddjd.exec:\pddjd.exe147⤵PID:2624
-
\??\c:\rlrrxff.exec:\rlrrxff.exe148⤵PID:1036
-
\??\c:\fllllff.exec:\fllllff.exe149⤵PID:1460
-
\??\c:\nbbttb.exec:\nbbttb.exe150⤵PID:1772
-
\??\c:\vjvvp.exec:\vjvvp.exe151⤵PID:2168
-
\??\c:\pjjvd.exec:\pjjvd.exe152⤵PID:2928
-
\??\c:\xfrrrrx.exec:\xfrrrrx.exe153⤵PID:1160
-
\??\c:\lxllxfl.exec:\lxllxfl.exe154⤵PID:2120
-
\??\c:\nntbnn.exec:\nntbnn.exe155⤵PID:2636
-
\??\c:\jdpvd.exec:\jdpvd.exe156⤵PID:536
-
\??\c:\pjdpp.exec:\pjdpp.exe157⤵PID:1824
-
\??\c:\lfrxlxf.exec:\lfrxlxf.exe158⤵PID:684
-
\??\c:\xrxfllx.exec:\xrxfllx.exe159⤵PID:408
-
\??\c:\thhbbn.exec:\thhbbn.exe160⤵PID:1376
-
\??\c:\7vjvd.exec:\7vjvd.exe161⤵PID:2040
-
\??\c:\pjppv.exec:\pjppv.exe162⤵PID:2000
-
\??\c:\xrlrflx.exec:\xrlrflx.exe163⤵PID:1380
-
\??\c:\9lffxxf.exec:\9lffxxf.exe164⤵PID:1880
-
\??\c:\5hbtbn.exec:\5hbtbn.exe165⤵PID:640
-
\??\c:\tthhnb.exec:\tthhnb.exe166⤵PID:1652
-
\??\c:\3vppj.exec:\3vppj.exe167⤵PID:2356
-
\??\c:\fxrfffx.exec:\fxrfffx.exe168⤵PID:2260
-
\??\c:\fxrxrxf.exec:\fxrxrxf.exe169⤵PID:2296
-
\??\c:\9hthnt.exec:\9hthnt.exe170⤵PID:2044
-
\??\c:\7hbtbt.exec:\7hbtbt.exe171⤵PID:1588
-
\??\c:\pjpvd.exec:\pjpvd.exe172⤵PID:1608
-
\??\c:\rlrlrxf.exec:\rlrlrxf.exe173⤵PID:1592
-
\??\c:\5lfllrf.exec:\5lfllrf.exe174⤵PID:2976
-
\??\c:\nbnntt.exec:\nbnntt.exe175⤵PID:2432
-
\??\c:\hbnthh.exec:\hbnthh.exe176⤵PID:2352
-
\??\c:\1vdvv.exec:\1vdvv.exe177⤵PID:2756
-
\??\c:\jvjdj.exec:\jvjdj.exe178⤵PID:1540
-
\??\c:\1rlxflr.exec:\1rlxflr.exe179⤵PID:2236
-
\??\c:\rlffrlr.exec:\rlffrlr.exe180⤵PID:2652
-
\??\c:\3bbbhh.exec:\3bbbhh.exe181⤵PID:2860
-
\??\c:\1jdpv.exec:\1jdpv.exe182⤵PID:2564
-
\??\c:\3ddjv.exec:\3ddjv.exe183⤵PID:2552
-
\??\c:\ffrxrfl.exec:\ffrxrfl.exe184⤵PID:2580
-
\??\c:\xllrflr.exec:\xllrflr.exe185⤵PID:1704
-
\??\c:\tnttnn.exec:\tnttnn.exe186⤵PID:2612
-
\??\c:\jppdd.exec:\jppdd.exe187⤵PID:2840
-
\??\c:\pjjvd.exec:\pjjvd.exe188⤵PID:2872
-
\??\c:\frlxrrf.exec:\frlxrrf.exe189⤵PID:1244
-
\??\c:\fxxlfff.exec:\fxxlfff.exe190⤵PID:3020
-
\??\c:\bnthbb.exec:\bnthbb.exe191⤵PID:3004
-
\??\c:\jjjvv.exec:\jjjvv.exe192⤵PID:2172
-
\??\c:\dvddj.exec:\dvddj.exe193⤵PID:1948
-
\??\c:\lflrrxf.exec:\lflrrxf.exe194⤵PID:1132
-
\??\c:\5xrrlxf.exec:\5xrrlxf.exe195⤵PID:3036
-
\??\c:\3nbbbt.exec:\3nbbbt.exe196⤵PID:2024
-
\??\c:\hhhnbh.exec:\hhhnbh.exe197⤵PID:1324
-
\??\c:\vjvvj.exec:\vjvvj.exe198⤵PID:2108
-
\??\c:\3vvdp.exec:\3vvdp.exe199⤵PID:2300
-
\??\c:\rlfflxl.exec:\rlfflxl.exe200⤵PID:2632
-
\??\c:\9fllxfl.exec:\9fllxfl.exe201⤵PID:2212
-
\??\c:\hhbtnt.exec:\hhbtnt.exe202⤵PID:2936
-
\??\c:\dpvdd.exec:\dpvdd.exe203⤵PID:592
-
\??\c:\7vppd.exec:\7vppd.exe204⤵PID:712
-
\??\c:\ffffrxl.exec:\ffffrxl.exe205⤵PID:588
-
\??\c:\xrfrffx.exec:\xrfrffx.exe206⤵PID:1824
-
\??\c:\3thbtn.exec:\3thbtn.exe207⤵PID:1508
-
\??\c:\1htbtn.exec:\1htbtn.exe208⤵PID:408
-
\??\c:\ddvdj.exec:\ddvdj.exe209⤵PID:2220
-
\??\c:\rlfrflr.exec:\rlfrflr.exe210⤵PID:2040
-
\??\c:\xflllfl.exec:\xflllfl.exe211⤵PID:1988
-
\??\c:\nnnbbn.exec:\nnnbbn.exe212⤵PID:1380
-
\??\c:\bhbbnh.exec:\bhbbnh.exe213⤵PID:2616
-
\??\c:\7dvdp.exec:\7dvdp.exe214⤵PID:964
-
\??\c:\pjvjj.exec:\pjvjj.exe215⤵PID:1652
-
\??\c:\1xrrxfr.exec:\1xrrxfr.exe216⤵PID:2348
-
\??\c:\xxrfxfr.exec:\xxrfxfr.exe217⤵PID:2260
-
\??\c:\btnbtb.exec:\btnbtb.exe218⤵PID:2296
-
\??\c:\bnbbhn.exec:\bnbbhn.exe219⤵PID:2196
-
\??\c:\1pjjv.exec:\1pjjv.exe220⤵PID:1588
-
\??\c:\9rxrrxx.exec:\9rxrrxx.exe221⤵PID:1536
-
\??\c:\fxffrxf.exec:\fxffrxf.exe222⤵PID:1592
-
\??\c:\tnbbbb.exec:\tnbbbb.exe223⤵PID:2976
-
\??\c:\bthnth.exec:\bthnth.exe224⤵PID:2432
-
\??\c:\ddpjj.exec:\ddpjj.exe225⤵PID:2800
-
\??\c:\jdpvj.exec:\jdpvj.exe226⤵PID:2756
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe227⤵PID:2192
-
\??\c:\xrrrlxl.exec:\xrrrlxl.exe228⤵PID:2236
-
\??\c:\nnhthh.exec:\nnhthh.exe229⤵PID:2908
-
\??\c:\7jjpj.exec:\7jjpj.exe230⤵PID:2600
-
\??\c:\pdjjp.exec:\pdjjp.exe231⤵PID:2596
-
\??\c:\xrffxxl.exec:\xrffxxl.exe232⤵PID:2584
-
\??\c:\lflrflx.exec:\lflrflx.exe233⤵PID:2832
-
\??\c:\hnthbn.exec:\hnthbn.exe234⤵PID:1288
-
\??\c:\tnnbht.exec:\tnnbht.exe235⤵PID:3024
-
\??\c:\9vvvv.exec:\9vvvv.exe236⤵PID:2888
-
\??\c:\pjjdj.exec:\pjjdj.exe237⤵PID:2884
-
\??\c:\lfrfrrf.exec:\lfrfrrf.exe238⤵PID:2856
-
\??\c:\nhbhnt.exec:\nhbhnt.exe239⤵PID:3048
-
\??\c:\9nbhnb.exec:\9nbhnb.exe240⤵PID:2416
-
\??\c:\5dpvd.exec:\5dpvd.exe241⤵PID:1064
-
\??\c:\9dvjd.exec:\9dvjd.exe242⤵PID:1028