Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:37
Behavioral task
behavioral1
Sample
d8cd9bbc9a907ed2293eafc6fafd3960_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d8cd9bbc9a907ed2293eafc6fafd3960_NeikiAnalytics.exe
-
Size
401KB
-
MD5
d8cd9bbc9a907ed2293eafc6fafd3960
-
SHA1
f3e987bcba0917f75fac286c26af12c8c7dd33c8
-
SHA256
68087093d2010d18fe23d1ad209f95da65512e0364262e1d1c7348992a1863b1
-
SHA512
f725118a7da738b758991df15ba4ecaaf68fc51e013ec4feefc05649da8e6ad2aefc074cf8112cbf106ef65294817dc7861457a61103f5c40a8bd80bf3590962
-
SSDEEP
6144:kcm4FmowdHoSph3Ymu8wdHoSM05d34iWRbzami3r:y4wFHoS3zuxHoSTd34iWRhib
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
Processes:
resource yara_rule behavioral1/memory/1684-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1388-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-39-0x0000000000320000-0x0000000000347000-memory.dmp family_blackmoon behavioral1/memory/2748-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-101-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1748-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-125-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2828-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2244-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-182-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/844-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1844-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/444-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1244-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2332-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-388-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1748-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/324-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/844-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-480-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-527-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2124-618-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-625-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-682-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-701-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/884-838-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/376-853-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/884-887-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2636-905-0x0000000000340000-0x0000000000367000-memory.dmp family_blackmoon behavioral1/memory/2580-958-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2444-969-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/316-1019-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ffrfllx.exelxrrffr.exelfrxxfr.exenbthtt.exelfflrfr.exenhhhbn.exe9lrrxlr.exelfflfrf.exefxxrxlx.exeppjpd.exevpddj.exebhhnht.exe5jddj.exepjjpd.exe7ppdp.exe7tbnhh.exejvjjv.exentthhn.exenhbhhn.exerlflxlx.exe1bbnbh.exelrfllrf.exehhbtnt.exepppdv.exexfflrfl.exennbbnn.exerrflflx.exe9hhhbh.exedvpjd.exenhthbb.exe7jdjv.exe5bbhnn.exevpjpv.exexxxllrf.exe7rxxxxf.exe1bhnbh.exepjvdj.exe5xrlllr.exe3nthbh.exenbtnhb.exeddvvd.exelfrxflx.exerfxfffr.exenhnntt.exennhttt.exeppjpv.exellflxlx.exe1bnhnh.exenhtbhh.exedvvdp.exefxlxflx.exe7rflrrx.exennhbhh.exevjpdp.exe7dvvj.exefrlrxxf.exebtbbbh.exebnthnh.exe5jjdp.exe5rfrxxf.exe1lflllr.exe9hnhbb.exevjvvd.exevppdj.exepid process 1388 ffrfllx.exe 2340 lxrrffr.exe 2360 lfrxxfr.exe 2748 nbthtt.exe 2940 lfflrfr.exe 2624 nhhhbn.exe 2880 9lrrxlr.exe 2560 lfflfrf.exe 2580 fxxrxlx.exe 2444 ppjpd.exe 1748 vpddj.exe 2828 bhhnht.exe 1296 5jddj.exe 1260 pjjpd.exe 2212 7ppdp.exe 2244 7tbnhh.exe 748 jvjjv.exe 844 ntthhn.exe 1100 nhbhhn.exe 2964 rlflxlx.exe 1844 1bbnbh.exe 2780 lrfllrf.exe 444 hhbtnt.exe 2348 pppdv.exe 1520 xfflrfl.exe 1396 nnbbnn.exe 1788 rrflflx.exe 900 9hhhbh.exe 1712 dvpjd.exe 2304 nhthbb.exe 1324 7jdjv.exe 1504 5bbhnn.exe 1580 vpjpv.exe 1244 xxxllrf.exe 2136 7rxxxxf.exe 2332 1bhnbh.exe 2652 pjvdj.exe 2128 5xrlllr.exe 2660 3nthbh.exe 2656 nbtnhb.exe 2724 ddvvd.exe 2644 lfrxflx.exe 2528 rfxfffr.exe 2524 nhnntt.exe 2440 nnhttt.exe 2384 ppjpv.exe 2044 llflxlx.exe 1032 1bnhnh.exe 1748 nhtbhh.exe 2856 dvvdp.exe 2020 fxlxflx.exe 324 7rflrrx.exe 620 nnhbhh.exe 2216 vjpdp.exe 1000 7dvvj.exe 1156 frlrxxf.exe 756 btbbbh.exe 844 bnthnh.exe 112 5jjdp.exe 1100 5rfrxxf.exe 2456 1lflllr.exe 824 9hnhbb.exe 2780 vjvvd.exe 2028 vppdj.exe -
Processes:
resource yara_rule behavioral1/memory/1684-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffrfllx.exe upx behavioral1/memory/1388-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1684-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2340-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1388-23-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lxrrffr.exe upx C:\lfrxxfr.exe upx behavioral1/memory/2360-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2360-37-0x0000000000320000-0x0000000000347000-memory.dmp upx \??\c:\nbthtt.exe upx behavioral1/memory/2748-43-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfflrfr.exe upx C:\nhhhbn.exe upx C:\9lrrxlr.exe upx behavioral1/memory/2880-67-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfflfrf.exe upx behavioral1/memory/2560-77-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxxrxlx.exe upx behavioral1/memory/2560-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2580-87-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppjpd.exe upx behavioral1/memory/2444-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2580-96-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpddj.exe upx C:\bhhnht.exe upx behavioral1/memory/2828-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1748-115-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5jddj.exe upx behavioral1/memory/2828-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1296-127-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjjpd.exe upx C:\7ppdp.exe upx C:\7tbnhh.exe upx behavioral1/memory/2244-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2212-152-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvjjv.exe upx behavioral1/memory/2244-162-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ntthhn.exe upx behavioral1/memory/844-172-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbhhn.exe upx behavioral1/memory/844-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1100-190-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rlflxlx.exe upx C:\1bbnbh.exe upx behavioral1/memory/1844-207-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lrfllrf.exe upx C:\hhbtnt.exe upx behavioral1/memory/444-218-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pppdv.exe upx \??\c:\xfflrfl.exe upx \??\c:\nnbbnn.exe upx \??\c:\rrflflx.exe upx behavioral1/memory/1788-253-0x00000000003C0000-0x00000000003E7000-memory.dmp upx C:\9hhhbh.exe upx behavioral1/memory/900-259-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvpjd.exe upx C:\nhthbb.exe upx behavioral1/memory/2304-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1712-277-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7jdjv.exe upx behavioral1/memory/2304-286-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5bbhnn.exe upx behavioral1/memory/1244-309-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d8cd9bbc9a907ed2293eafc6fafd3960_NeikiAnalytics.exeffrfllx.exelxrrffr.exelfrxxfr.exenbthtt.exelfflrfr.exenhhhbn.exe9lrrxlr.exelfflfrf.exefxxrxlx.exeppjpd.exevpddj.exebhhnht.exe5jddj.exepjjpd.exe7ppdp.exedescription pid process target process PID 1684 wrote to memory of 1388 1684 d8cd9bbc9a907ed2293eafc6fafd3960_NeikiAnalytics.exe ffrfllx.exe PID 1684 wrote to memory of 1388 1684 d8cd9bbc9a907ed2293eafc6fafd3960_NeikiAnalytics.exe ffrfllx.exe PID 1684 wrote to memory of 1388 1684 d8cd9bbc9a907ed2293eafc6fafd3960_NeikiAnalytics.exe ffrfllx.exe PID 1684 wrote to memory of 1388 1684 d8cd9bbc9a907ed2293eafc6fafd3960_NeikiAnalytics.exe ffrfllx.exe PID 1388 wrote to memory of 2340 1388 ffrfllx.exe lxrrffr.exe PID 1388 wrote to memory of 2340 1388 ffrfllx.exe lxrrffr.exe PID 1388 wrote to memory of 2340 1388 ffrfllx.exe lxrrffr.exe PID 1388 wrote to memory of 2340 1388 ffrfllx.exe lxrrffr.exe PID 2340 wrote to memory of 2360 2340 lxrrffr.exe lfrxxfr.exe PID 2340 wrote to memory of 2360 2340 lxrrffr.exe lfrxxfr.exe PID 2340 wrote to memory of 2360 2340 lxrrffr.exe lfrxxfr.exe PID 2340 wrote to memory of 2360 2340 lxrrffr.exe lfrxxfr.exe PID 2360 wrote to memory of 2748 2360 lfrxxfr.exe nbthtt.exe PID 2360 wrote to memory of 2748 2360 lfrxxfr.exe nbthtt.exe PID 2360 wrote to memory of 2748 2360 lfrxxfr.exe nbthtt.exe PID 2360 wrote to memory of 2748 2360 lfrxxfr.exe nbthtt.exe PID 2748 wrote to memory of 2940 2748 nbthtt.exe lfflrfr.exe PID 2748 wrote to memory of 2940 2748 nbthtt.exe lfflrfr.exe PID 2748 wrote to memory of 2940 2748 nbthtt.exe lfflrfr.exe PID 2748 wrote to memory of 2940 2748 nbthtt.exe lfflrfr.exe PID 2940 wrote to memory of 2624 2940 lfflrfr.exe nhhhbn.exe PID 2940 wrote to memory of 2624 2940 lfflrfr.exe nhhhbn.exe PID 2940 wrote to memory of 2624 2940 lfflrfr.exe nhhhbn.exe PID 2940 wrote to memory of 2624 2940 lfflrfr.exe nhhhbn.exe PID 2624 wrote to memory of 2880 2624 nhhhbn.exe 9lrrxlr.exe PID 2624 wrote to memory of 2880 2624 nhhhbn.exe 9lrrxlr.exe PID 2624 wrote to memory of 2880 2624 nhhhbn.exe 9lrrxlr.exe PID 2624 wrote to memory of 2880 2624 nhhhbn.exe 9lrrxlr.exe PID 2880 wrote to memory of 2560 2880 9lrrxlr.exe lfflfrf.exe PID 2880 wrote to memory of 2560 2880 9lrrxlr.exe lfflfrf.exe PID 2880 wrote to memory of 2560 2880 9lrrxlr.exe lfflfrf.exe PID 2880 wrote to memory of 2560 2880 9lrrxlr.exe lfflfrf.exe PID 2560 wrote to memory of 2580 2560 lfflfrf.exe fxxrxlx.exe PID 2560 wrote to memory of 2580 2560 lfflfrf.exe fxxrxlx.exe PID 2560 wrote to memory of 2580 2560 lfflfrf.exe fxxrxlx.exe PID 2560 wrote to memory of 2580 2560 lfflfrf.exe fxxrxlx.exe PID 2580 wrote to memory of 2444 2580 fxxrxlx.exe ppjpd.exe PID 2580 wrote to memory of 2444 2580 fxxrxlx.exe ppjpd.exe PID 2580 wrote to memory of 2444 2580 fxxrxlx.exe ppjpd.exe PID 2580 wrote to memory of 2444 2580 fxxrxlx.exe ppjpd.exe PID 2444 wrote to memory of 1748 2444 ppjpd.exe vpddj.exe PID 2444 wrote to memory of 1748 2444 ppjpd.exe vpddj.exe PID 2444 wrote to memory of 1748 2444 ppjpd.exe vpddj.exe PID 2444 wrote to memory of 1748 2444 ppjpd.exe vpddj.exe PID 1748 wrote to memory of 2828 1748 vpddj.exe bhhnht.exe PID 1748 wrote to memory of 2828 1748 vpddj.exe bhhnht.exe PID 1748 wrote to memory of 2828 1748 vpddj.exe bhhnht.exe PID 1748 wrote to memory of 2828 1748 vpddj.exe bhhnht.exe PID 2828 wrote to memory of 1296 2828 bhhnht.exe 5jddj.exe PID 2828 wrote to memory of 1296 2828 bhhnht.exe 5jddj.exe PID 2828 wrote to memory of 1296 2828 bhhnht.exe 5jddj.exe PID 2828 wrote to memory of 1296 2828 bhhnht.exe 5jddj.exe PID 1296 wrote to memory of 1260 1296 5jddj.exe pjjpd.exe PID 1296 wrote to memory of 1260 1296 5jddj.exe pjjpd.exe PID 1296 wrote to memory of 1260 1296 5jddj.exe pjjpd.exe PID 1296 wrote to memory of 1260 1296 5jddj.exe pjjpd.exe PID 1260 wrote to memory of 2212 1260 pjjpd.exe 7ppdp.exe PID 1260 wrote to memory of 2212 1260 pjjpd.exe 7ppdp.exe PID 1260 wrote to memory of 2212 1260 pjjpd.exe 7ppdp.exe PID 1260 wrote to memory of 2212 1260 pjjpd.exe 7ppdp.exe PID 2212 wrote to memory of 2244 2212 7ppdp.exe 7tbnhh.exe PID 2212 wrote to memory of 2244 2212 7ppdp.exe 7tbnhh.exe PID 2212 wrote to memory of 2244 2212 7ppdp.exe 7tbnhh.exe PID 2212 wrote to memory of 2244 2212 7ppdp.exe 7tbnhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8cd9bbc9a907ed2293eafc6fafd3960_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d8cd9bbc9a907ed2293eafc6fafd3960_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\ffrfllx.exec:\ffrfllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\lxrrffr.exec:\lxrrffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\lfrxxfr.exec:\lfrxxfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\nbthtt.exec:\nbthtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\lfflrfr.exec:\lfflrfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\nhhhbn.exec:\nhhhbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\9lrrxlr.exec:\9lrrxlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\lfflfrf.exec:\lfflfrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\fxxrxlx.exec:\fxxrxlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\ppjpd.exec:\ppjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\vpddj.exec:\vpddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\bhhnht.exec:\bhhnht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\5jddj.exec:\5jddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\pjjpd.exec:\pjjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\7ppdp.exec:\7ppdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\7tbnhh.exec:\7tbnhh.exe17⤵
- Executes dropped EXE
PID:2244 -
\??\c:\jvjjv.exec:\jvjjv.exe18⤵
- Executes dropped EXE
PID:748 -
\??\c:\ntthhn.exec:\ntthhn.exe19⤵
- Executes dropped EXE
PID:844 -
\??\c:\nhbhhn.exec:\nhbhhn.exe20⤵
- Executes dropped EXE
PID:1100 -
\??\c:\rlflxlx.exec:\rlflxlx.exe21⤵
- Executes dropped EXE
PID:2964 -
\??\c:\1bbnbh.exec:\1bbnbh.exe22⤵
- Executes dropped EXE
PID:1844 -
\??\c:\lrfllrf.exec:\lrfllrf.exe23⤵
- Executes dropped EXE
PID:2780 -
\??\c:\hhbtnt.exec:\hhbtnt.exe24⤵
- Executes dropped EXE
PID:444 -
\??\c:\pppdv.exec:\pppdv.exe25⤵
- Executes dropped EXE
PID:2348 -
\??\c:\xfflrfl.exec:\xfflrfl.exe26⤵
- Executes dropped EXE
PID:1520 -
\??\c:\nnbbnn.exec:\nnbbnn.exe27⤵
- Executes dropped EXE
PID:1396 -
\??\c:\rrflflx.exec:\rrflflx.exe28⤵
- Executes dropped EXE
PID:1788 -
\??\c:\9hhhbh.exec:\9hhhbh.exe29⤵
- Executes dropped EXE
PID:900 -
\??\c:\dvpjd.exec:\dvpjd.exe30⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nhthbb.exec:\nhthbb.exe31⤵
- Executes dropped EXE
PID:2304 -
\??\c:\7jdjv.exec:\7jdjv.exe32⤵
- Executes dropped EXE
PID:1324 -
\??\c:\5bbhnn.exec:\5bbhnn.exe33⤵
- Executes dropped EXE
PID:1504 -
\??\c:\vpjpv.exec:\vpjpv.exe34⤵
- Executes dropped EXE
PID:1580 -
\??\c:\xxxllrf.exec:\xxxllrf.exe35⤵
- Executes dropped EXE
PID:1244 -
\??\c:\7rxxxxf.exec:\7rxxxxf.exe36⤵
- Executes dropped EXE
PID:2136 -
\??\c:\1bhnbh.exec:\1bhnbh.exe37⤵
- Executes dropped EXE
PID:2332 -
\??\c:\pjvdj.exec:\pjvdj.exe38⤵
- Executes dropped EXE
PID:2652 -
\??\c:\5xrlllr.exec:\5xrlllr.exe39⤵
- Executes dropped EXE
PID:2128 -
\??\c:\3nthbh.exec:\3nthbh.exe40⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nbtnhb.exec:\nbtnhb.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ddvvd.exec:\ddvvd.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lfrxflx.exec:\lfrxflx.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rfxfffr.exec:\rfxfffr.exe44⤵
- Executes dropped EXE
PID:2528 -
\??\c:\nhnntt.exec:\nhnntt.exe45⤵
- Executes dropped EXE
PID:2524 -
\??\c:\nnhttt.exec:\nnhttt.exe46⤵
- Executes dropped EXE
PID:2440 -
\??\c:\ppjpv.exec:\ppjpv.exe47⤵
- Executes dropped EXE
PID:2384 -
\??\c:\llflxlx.exec:\llflxlx.exe48⤵
- Executes dropped EXE
PID:2044 -
\??\c:\1bnhnh.exec:\1bnhnh.exe49⤵
- Executes dropped EXE
PID:1032 -
\??\c:\nhtbhh.exec:\nhtbhh.exe50⤵
- Executes dropped EXE
PID:1748 -
\??\c:\dvvdp.exec:\dvvdp.exe51⤵
- Executes dropped EXE
PID:2856 -
\??\c:\fxlxflx.exec:\fxlxflx.exe52⤵
- Executes dropped EXE
PID:2020 -
\??\c:\7rflrrx.exec:\7rflrrx.exe53⤵
- Executes dropped EXE
PID:324 -
\??\c:\nnhbhh.exec:\nnhbhh.exe54⤵
- Executes dropped EXE
PID:620 -
\??\c:\vjpdp.exec:\vjpdp.exe55⤵
- Executes dropped EXE
PID:2216 -
\??\c:\7dvvj.exec:\7dvvj.exe56⤵
- Executes dropped EXE
PID:1000 -
\??\c:\frlrxxf.exec:\frlrxxf.exe57⤵
- Executes dropped EXE
PID:1156 -
\??\c:\btbbbh.exec:\btbbbh.exe58⤵
- Executes dropped EXE
PID:756 -
\??\c:\bnthnh.exec:\bnthnh.exe59⤵
- Executes dropped EXE
PID:844 -
\??\c:\5jjdp.exec:\5jjdp.exe60⤵
- Executes dropped EXE
PID:112 -
\??\c:\5rfrxxf.exec:\5rfrxxf.exe61⤵
- Executes dropped EXE
PID:1100 -
\??\c:\1lflllr.exec:\1lflllr.exe62⤵
- Executes dropped EXE
PID:2456 -
\??\c:\9hnhbb.exec:\9hnhbb.exe63⤵
- Executes dropped EXE
PID:824 -
\??\c:\vjvvd.exec:\vjvvd.exe64⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vppdj.exec:\vppdj.exe65⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rfxffxf.exec:\rfxffxf.exe66⤵PID:1120
-
\??\c:\tnhntt.exec:\tnhntt.exe67⤵PID:1524
-
\??\c:\jppvp.exec:\jppvp.exe68⤵PID:236
-
\??\c:\1vjjp.exec:\1vjjp.exe69⤵PID:1772
-
\??\c:\fffrflf.exec:\fffrflf.exe70⤵PID:1908
-
\??\c:\7hthth.exec:\7hthth.exe71⤵PID:1916
-
\??\c:\nthhbb.exec:\nthhbb.exe72⤵PID:2024
-
\??\c:\3vvjp.exec:\3vvjp.exe73⤵PID:1948
-
\??\c:\rlfxfrf.exec:\rlfxfrf.exe74⤵PID:1992
-
\??\c:\hhnbth.exec:\hhnbth.exe75⤵PID:2412
-
\??\c:\3nntbh.exec:\3nntbh.exe76⤵PID:1324
-
\??\c:\9dvpv.exec:\9dvpv.exe77⤵PID:1588
-
\??\c:\lxrfffr.exec:\lxrfffr.exe78⤵PID:1580
-
\??\c:\xxlrxff.exec:\xxlrxff.exe79⤵PID:1244
-
\??\c:\htttbh.exec:\htttbh.exe80⤵PID:2600
-
\??\c:\7nbhnt.exec:\7nbhnt.exe81⤵PID:3068
-
\??\c:\dvppv.exec:\dvppv.exe82⤵PID:2124
-
\??\c:\5frfrxl.exec:\5frfrxl.exe83⤵PID:2748
-
\??\c:\1ffxfrf.exec:\1ffxfrf.exe84⤵PID:2632
-
\??\c:\3bhntt.exec:\3bhntt.exe85⤵PID:2264
-
\??\c:\vpdjp.exec:\vpdjp.exe86⤵PID:2772
-
\??\c:\jddjp.exec:\jddjp.exe87⤵PID:2672
-
\??\c:\xxlllfr.exec:\xxlllfr.exe88⤵PID:2880
-
\??\c:\nbbhtb.exec:\nbbhtb.exe89⤵PID:2536
-
\??\c:\httnbh.exec:\httnbh.exe90⤵PID:2584
-
\??\c:\jdpvj.exec:\jdpvj.exe91⤵PID:3028
-
\??\c:\7jjpv.exec:\7jjpv.exe92⤵PID:2276
-
\??\c:\fxrxxxf.exec:\fxrxxxf.exe93⤵PID:2716
-
\??\c:\tbnnnh.exec:\tbnnnh.exe94⤵PID:1696
-
\??\c:\3ddvp.exec:\3ddvp.exe95⤵PID:2756
-
\??\c:\jdvjv.exec:\jdvjv.exe96⤵PID:1744
-
\??\c:\ffxrfrr.exec:\ffxrfrr.exe97⤵PID:2036
-
\??\c:\7lxrxrx.exec:\7lxrxrx.exe98⤵PID:2232
-
\??\c:\thbbbh.exec:\thbbbh.exe99⤵PID:2212
-
\??\c:\pvvpp.exec:\pvvpp.exe100⤵PID:316
-
\??\c:\jdvjd.exec:\jdvjd.exe101⤵PID:1476
-
\??\c:\xffxxxf.exec:\xffxxxf.exe102⤵PID:788
-
\??\c:\hhhnnt.exec:\hhhnnt.exe103⤵PID:1980
-
\??\c:\btnbtt.exec:\btnbtt.exe104⤵PID:1724
-
\??\c:\vpddj.exec:\vpddj.exe105⤵PID:112
-
\??\c:\xxrfxrf.exec:\xxrfxrf.exe106⤵PID:1100
-
\??\c:\rlflxxl.exec:\rlflxxl.exe107⤵PID:1792
-
\??\c:\hthbhb.exec:\hthbhb.exe108⤵PID:1844
-
\??\c:\jjvdv.exec:\jjvdv.exe109⤵PID:408
-
\??\c:\dvjpd.exec:\dvjpd.exe110⤵PID:2028
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe111⤵PID:444
-
\??\c:\3htbhh.exec:\3htbhh.exe112⤵PID:2336
-
\??\c:\tnbbhh.exec:\tnbbhh.exe113⤵PID:1396
-
\??\c:\7dvjp.exec:\7dvjp.exe114⤵PID:1776
-
\??\c:\lrxlxlx.exec:\lrxlxlx.exe115⤵PID:2860
-
\??\c:\9xrflfr.exec:\9xrflfr.exe116⤵PID:1532
-
\??\c:\hbbttt.exec:\hbbttt.exe117⤵PID:884
-
\??\c:\7vvvj.exec:\7vvvj.exe118⤵PID:376
-
\??\c:\lfxflrf.exec:\lfxflrf.exe119⤵PID:832
-
\??\c:\bbtnnn.exec:\bbtnnn.exe120⤵PID:2412
-
\??\c:\pppdp.exec:\pppdp.exe121⤵PID:1324
-
\??\c:\dddjv.exec:\dddjv.exe122⤵PID:1588
-
\??\c:\1rlxlrx.exec:\1rlxlrx.exe123⤵PID:1580
-
\??\c:\3ttbhh.exec:\3ttbhh.exe124⤵PID:2924
-
\??\c:\bnnhtb.exec:\bnnhtb.exe125⤵PID:2648
-
\??\c:\ffxrfll.exec:\ffxrfll.exe126⤵PID:2636
-
\??\c:\hbnthn.exec:\hbnthn.exe127⤵PID:2736
-
\??\c:\ppdjp.exec:\ppdjp.exe128⤵PID:2748
-
\??\c:\xrrrfrf.exec:\xrrrfrf.exe129⤵PID:2668
-
\??\c:\nbhnnt.exec:\nbhnnt.exe130⤵PID:2264
-
\??\c:\9vpdj.exec:\9vpdj.exe131⤵PID:2620
-
\??\c:\jdvdj.exec:\jdvdj.exe132⤵PID:2644
-
\??\c:\rllrflx.exec:\rllrflx.exe133⤵PID:2528
-
\??\c:\tnthbb.exec:\tnthbb.exe134⤵PID:2524
-
\??\c:\thbbbb.exec:\thbbbb.exe135⤵PID:2580
-
\??\c:\dvjdp.exec:\dvjdp.exe136⤵PID:2384
-
\??\c:\7xxffrl.exec:\7xxffrl.exe137⤵PID:2444
-
\??\c:\xrflxlr.exec:\xrflxlr.exe138⤵PID:2836
-
\??\c:\tnhthn.exec:\tnhthn.exe139⤵PID:1696
-
\??\c:\dvjjp.exec:\dvjjp.exe140⤵PID:1820
-
\??\c:\dddpp.exec:\dddpp.exe141⤵PID:1296
-
\??\c:\xffxxlr.exec:\xffxxlr.exe142⤵PID:2036
-
\??\c:\hhbnhn.exec:\hhbnhn.exe143⤵PID:3056
-
\??\c:\tnhntt.exec:\tnhntt.exe144⤵PID:264
-
\??\c:\vdvvv.exec:\vdvvv.exe145⤵PID:316
-
\??\c:\5xfrxlr.exec:\5xfrxlr.exe146⤵PID:1140
-
\??\c:\xrlxffr.exec:\xrlxffr.exe147⤵PID:1660
-
\??\c:\nthhhb.exec:\nthhhb.exe148⤵PID:2952
-
\??\c:\3nbbhh.exec:\3nbbhh.exe149⤵PID:1724
-
\??\c:\9vvdj.exec:\9vvdj.exe150⤵PID:1808
-
\??\c:\xxxfrrx.exec:\xxxfrrx.exe151⤵PID:2456
-
\??\c:\fxrlrxr.exec:\fxrlrxr.exe152⤵PID:2188
-
\??\c:\bnnhbn.exec:\bnnhbn.exe153⤵PID:1844
-
\??\c:\vvpdp.exec:\vvpdp.exe154⤵PID:2000
-
\??\c:\jdvdp.exec:\jdvdp.exe155⤵PID:1784
-
\??\c:\7xxxllx.exec:\7xxxllx.exe156⤵PID:1524
-
\??\c:\9xrxlrx.exec:\9xrxlrx.exe157⤵PID:2336
-
\??\c:\bbthnn.exec:\bbthnn.exe158⤵PID:1508
-
\??\c:\vppdj.exec:\vppdj.exe159⤵PID:1776
-
\??\c:\vvdpd.exec:\vvdpd.exe160⤵PID:2860
-
\??\c:\5llflrf.exec:\5llflrf.exe161⤵PID:1972
-
\??\c:\btthnn.exec:\btthnn.exe162⤵PID:2368
-
\??\c:\thbbhn.exec:\thbbhn.exe163⤵PID:880
-
\??\c:\7dvpv.exec:\7dvpv.exe164⤵PID:2980
-
\??\c:\fxlfffl.exec:\fxlfffl.exe165⤵PID:2056
-
\??\c:\xrrxflr.exec:\xrrxflr.exe166⤵PID:1284
-
\??\c:\hhbhtb.exec:\hhbhtb.exe167⤵PID:1996
-
\??\c:\pdpjj.exec:\pdpjj.exe168⤵PID:836
-
\??\c:\lflrxfr.exec:\lflrxfr.exe169⤵PID:2364
-
\??\c:\7frxllr.exec:\7frxllr.exe170⤵PID:2732
-
\??\c:\nttnnn.exec:\nttnnn.exe171⤵PID:2948
-
\??\c:\3pvjp.exec:\3pvjp.exe172⤵PID:2708
-
\??\c:\5lxrxxl.exec:\5lxrxxl.exe173⤵PID:2712
-
\??\c:\9xflffr.exec:\9xflffr.exe174⤵PID:1636
-
\??\c:\5thbtn.exec:\5thbtn.exe175⤵PID:3036
-
\??\c:\vvvdj.exec:\vvvdj.exe176⤵PID:2268
-
\??\c:\pjvvd.exec:\pjvvd.exe177⤵PID:2504
-
\??\c:\xlffllx.exec:\xlffllx.exe178⤵PID:2804
-
\??\c:\hbttht.exec:\hbttht.exe179⤵PID:3012
-
\??\c:\pjvpd.exec:\pjvpd.exe180⤵PID:2440
-
\??\c:\vpdvd.exec:\vpdvd.exe181⤵PID:2596
-
\??\c:\rrllxfr.exec:\rrllxfr.exe182⤵PID:2568
-
\??\c:\5bnntn.exec:\5bnntn.exe183⤵PID:3028
-
\??\c:\3nbttb.exec:\3nbttb.exe184⤵PID:1968
-
\??\c:\7pjdd.exec:\7pjdd.exe185⤵PID:2032
-
\??\c:\xlffrrf.exec:\xlffrrf.exe186⤵PID:1708
-
\??\c:\xfxxrrr.exec:\xfxxrrr.exe187⤵PID:324
-
\??\c:\nttnbt.exec:\nttnbt.exe188⤵PID:2220
-
\??\c:\vpppv.exec:\vpppv.exe189⤵PID:2404
-
\??\c:\9vpdp.exec:\9vpdp.exe190⤵PID:3056
-
\??\c:\1lrxffr.exec:\1lrxffr.exe191⤵PID:2212
-
\??\c:\3ttbnb.exec:\3ttbnb.exe192⤵PID:2832
-
\??\c:\1hhtbh.exec:\1hhtbh.exe193⤵PID:760
-
\??\c:\jddvd.exec:\jddvd.exe194⤵PID:1664
-
\??\c:\3lflrxl.exec:\3lflrxl.exe195⤵PID:1848
-
\??\c:\tnntbh.exec:\tnntbh.exe196⤵PID:708
-
\??\c:\hhbhtb.exec:\hhbhtb.exe197⤵PID:2192
-
\??\c:\jpvdp.exec:\jpvdp.exe198⤵PID:1768
-
\??\c:\xxxfxlx.exec:\xxxfxlx.exe199⤵PID:2352
-
\??\c:\rllxxfr.exec:\rllxxfr.exe200⤵PID:2324
-
\??\c:\tbhbbn.exec:\tbhbbn.exe201⤵PID:2460
-
\??\c:\ppjpj.exec:\ppjpj.exe202⤵PID:2028
-
\??\c:\dvpvv.exec:\dvpvv.exe203⤵PID:236
-
\??\c:\rlfrfxl.exec:\rlfrfxl.exe204⤵PID:1676
-
\??\c:\nhhbhn.exec:\nhhbhn.exe205⤵PID:2152
-
\??\c:\nhbntb.exec:\nhbntb.exe206⤵PID:692
-
\??\c:\vpjpj.exec:\vpjpj.exe207⤵PID:2072
-
\??\c:\fffllrf.exec:\fffllrf.exe208⤵PID:884
-
\??\c:\btnntb.exec:\btnntb.exe209⤵PID:2052
-
\??\c:\3bhnhb.exec:\3bhnhb.exe210⤵PID:2088
-
\??\c:\vpdvd.exec:\vpdvd.exe211⤵PID:2972
-
\??\c:\rrrrflf.exec:\rrrrflf.exe212⤵PID:1584
-
\??\c:\xxxlxfr.exec:\xxxlxfr.exe213⤵PID:1688
-
\??\c:\nhthnn.exec:\nhthnn.exe214⤵PID:2260
-
\??\c:\vvvpv.exec:\vvvpv.exe215⤵PID:1244
-
\??\c:\dppvd.exec:\dppvd.exe216⤵PID:2740
-
\??\c:\9ffxflf.exec:\9ffxflf.exe217⤵PID:2332
-
\??\c:\rlllxfr.exec:\rlllxfr.exe218⤵PID:2128
-
\??\c:\3bttbb.exec:\3bttbb.exe219⤵PID:2124
-
\??\c:\jjdjv.exec:\jjdjv.exe220⤵PID:380
-
\??\c:\jddpd.exec:\jddpd.exe221⤵PID:2692
-
\??\c:\rrrfrrl.exec:\rrrfrrl.exe222⤵PID:2724
-
\??\c:\nhhnth.exec:\nhhnth.exe223⤵PID:2868
-
\??\c:\bbbhtb.exec:\bbbhtb.exe224⤵PID:2620
-
\??\c:\vpjvd.exec:\vpjvd.exe225⤵PID:2672
-
\??\c:\xrffrxl.exec:\xrffrxl.exe226⤵PID:2528
-
\??\c:\3xrfrxr.exec:\3xrfrxr.exe227⤵PID:2524
-
\??\c:\nnbtht.exec:\nnbtht.exe228⤵PID:2580
-
\??\c:\dvpvj.exec:\dvpvj.exe229⤵PID:2852
-
\??\c:\pvvdd.exec:\pvvdd.exe230⤵PID:2716
-
\??\c:\rxrffxr.exec:\rxrffxr.exe231⤵PID:2168
-
\??\c:\bbbnnn.exec:\bbbnnn.exe232⤵PID:2236
-
\??\c:\vpvdp.exec:\vpvdp.exe233⤵PID:568
-
\??\c:\dvdpv.exec:\dvdpv.exe234⤵PID:1596
-
\??\c:\lfxfflf.exec:\lfxfflf.exe235⤵PID:664
-
\??\c:\htnhtt.exec:\htnhtt.exe236⤵PID:776
-
\??\c:\nttthn.exec:\nttthn.exe237⤵PID:680
-
\??\c:\5vvdp.exec:\5vvdp.exe238⤵PID:976
-
\??\c:\vpddj.exec:\vpddj.exe239⤵PID:2608
-
\??\c:\3flrrxf.exec:\3flrrxf.exe240⤵PID:1472
-
\??\c:\btntbb.exec:\btntbb.exe241⤵PID:2372
-
\??\c:\hhhtnt.exec:\hhhtnt.exe242⤵PID:2432