Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 16:55
Behavioral task
behavioral1
Sample
f954078d16c7c9d5202c175d7c95a4b0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
f954078d16c7c9d5202c175d7c95a4b0_NeikiAnalytics.exe
-
Size
541KB
-
MD5
f954078d16c7c9d5202c175d7c95a4b0
-
SHA1
f3b827fb32362a91627c9fb39d9570561f717db7
-
SHA256
06a7e3b380dca8b448f331b9fde0be6dd17f24f0af8ab00f3169c6069716995b
-
SHA512
437e380a5c85d927867c751d2169abe2e5022968f269e1876a00ddb668bbf5d955410eb3f1c21183f3e181fc80ee2e674b704ea7324e7a34e81dd4f098768bb9
-
SSDEEP
6144:Ucm4FmowdHoSEsIR7DsFhraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNDoDxm:i4wFHoSEsIR7seFaKHpv/VycgE81lg9
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/2904-8-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2128-20-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/352-30-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2640-42-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2952-39-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2564-51-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2592-69-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2456-71-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2448-87-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2876-104-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2648-115-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1820-140-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1036-138-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2416-199-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/540-210-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/584-226-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1480-228-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/964-245-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/3004-290-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/3004-298-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/3068-325-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2796-352-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2580-361-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2504-382-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1592-400-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2644-414-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2680-413-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2420-422-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1284-312-0x00000000002B0000-0x00000000002E5000-memory.dmp family_blackmoon behavioral1/memory/664-281-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1052-260-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1804-535-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1736-845-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2724-909-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2956-916-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1972-995-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/1800-1090-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ffxfxlr.exe3ddjv.exehbhnbh.exejjdpv.exeppvjp.exehthbht.exeppdjv.exelfflxxl.exepjjvp.exerffxlrx.exenhbhnb.exejddjv.exerllxlrr.exetbhttb.exevppdv.exe7llrffl.exepvdvd.exe1rrfxxf.exe9ntbtt.exe9jvjv.exetnnbnt.exeddjvp.exehbnbhn.exe1dpjv.exerrlrlrl.exehththh.exe1vjdd.exebhthnt.exe9xrxxxx.exerxrrrrf.exejddjv.exe5pjvv.exe3xlflxx.exebhbnhb.exe5jvdp.exexrlllrr.exe3xxlflf.exebbbnbn.exevpjpp.exepjjjj.exe1fxrrxl.exebthhnt.exevjjjd.exejdppv.exexrxrxlr.exerlrfrrf.exentbbnb.exevjddp.exevppvp.exerllllll.exethhnbt.exebnhntb.exe5vjpv.exejvvvp.exenhbbtb.exedvpvv.exe5xlllrr.exe7tbbnn.exejdvdj.exetnhntb.exebnntbb.exexrlrllr.exenhbbnb.exe7vjjv.exepid process 2128 ffxfxlr.exe 352 3ddjv.exe 2952 hbhnbh.exe 2640 jjdpv.exe 2564 ppvjp.exe 2592 hthbht.exe 2456 ppdjv.exe 2448 lfflxxl.exe 2864 pjjvp.exe 2876 rffxlrx.exe 2408 nhbhnb.exe 2648 jddjv.exe 1972 rllxlrr.exe 1036 tbhttb.exe 1820 vppdv.exe 304 7llrffl.exe 2008 pvdvd.exe 820 1rrfxxf.exe 1316 9ntbtt.exe 2296 9jvjv.exe 2416 tnnbnt.exe 2820 ddjvp.exe 540 hbnbhn.exe 584 1dpjv.exe 1480 rrlrlrl.exe 1544 hththh.exe 964 1vjdd.exe 1052 bhthnt.exe 1284 9xrxxxx.exe 2760 rxrrrrf.exe 664 jddjv.exe 3004 5pjvv.exe 772 3xlflxx.exe 1608 bhbnhb.exe 2964 5jvdp.exe 3068 xrlllrr.exe 2968 3xxlflf.exe 2116 bbbnbn.exe 2932 vpjpp.exe 2796 pjjjj.exe 2468 1fxrrxl.exe 2580 bthhnt.exe 2544 vjjjd.exe 2504 jdppv.exe 2436 xrxrxlr.exe 2732 rlrfrrf.exe 1592 ntbbnb.exe 2492 vjddp.exe 2680 vppvp.exe 2644 rllllll.exe 2420 thhnbt.exe 1756 bnhntb.exe 2256 5vjpv.exe 2252 jvvvp.exe 1032 nhbbtb.exe 2268 dvpvv.exe 2224 5xlllrr.exe 1320 7tbbnn.exe 2312 jdvdj.exe 2104 tnhntb.exe 1744 bnntbb.exe 2064 xrlrllr.exe 488 nhbbnb.exe 2112 7vjjv.exe -
Processes:
resource yara_rule behavioral1/memory/2904-0-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\ffxfxlr.exe upx behavioral1/memory/2128-10-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2904-8-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2128-14-0x0000000000370000-0x00000000003A5000-memory.dmp upx C:\3ddjv.exe upx behavioral1/memory/2128-20-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/352-21-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\hbhnbh.exe upx behavioral1/memory/2952-31-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/352-30-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2640-42-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\jjdpv.exe upx behavioral1/memory/2952-39-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2564-51-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\ppvjp.exe upx C:\hthbht.exe upx behavioral1/memory/2592-69-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2456-71-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\ppdjv.exe upx C:\lfflxxl.exe upx \??\c:\pjjvp.exe upx behavioral1/memory/2448-87-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\rffxlrx.exe upx behavioral1/memory/2876-104-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\nhbhnb.exe upx \??\c:\jddjv.exe upx behavioral1/memory/2648-115-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\rllxlrr.exe upx C:\tbhttb.exe upx C:\vppdv.exe upx C:\7llrffl.exe upx behavioral1/memory/1820-140-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1036-138-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\pvdvd.exe upx behavioral1/memory/820-165-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\1rrfxxf.exe upx \??\c:\9ntbtt.exe upx C:\9jvjv.exe upx \??\c:\tnnbnt.exe upx C:\ddjvp.exe upx behavioral1/memory/2416-199-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2416-192-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\hbnbhn.exe upx C:\1dpjv.exe upx behavioral1/memory/540-210-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\rrlrlrl.exe upx behavioral1/memory/584-226-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1480-228-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\hththh.exe upx \??\c:\1vjdd.exe upx behavioral1/memory/964-245-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\bhthnt.exe upx \??\c:\9xrxxxx.exe upx behavioral1/memory/2760-272-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/3004-290-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\5pjvv.exe upx behavioral1/memory/3004-298-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/3068-325-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2796-352-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2580-368-0x0000000000220000-0x0000000000255000-memory.dmp upx behavioral1/memory/2580-361-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2504-382-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1592-400-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f954078d16c7c9d5202c175d7c95a4b0_NeikiAnalytics.exeffxfxlr.exe3ddjv.exehbhnbh.exejjdpv.exeppvjp.exehthbht.exeppdjv.exelfflxxl.exepjjvp.exerffxlrx.exenhbhnb.exejddjv.exerllxlrr.exetbhttb.exevppdv.exedescription pid process target process PID 2904 wrote to memory of 2128 2904 f954078d16c7c9d5202c175d7c95a4b0_NeikiAnalytics.exe ffxfxlr.exe PID 2904 wrote to memory of 2128 2904 f954078d16c7c9d5202c175d7c95a4b0_NeikiAnalytics.exe ffxfxlr.exe PID 2904 wrote to memory of 2128 2904 f954078d16c7c9d5202c175d7c95a4b0_NeikiAnalytics.exe ffxfxlr.exe PID 2904 wrote to memory of 2128 2904 f954078d16c7c9d5202c175d7c95a4b0_NeikiAnalytics.exe ffxfxlr.exe PID 2128 wrote to memory of 352 2128 ffxfxlr.exe 3ddjv.exe PID 2128 wrote to memory of 352 2128 ffxfxlr.exe 3ddjv.exe PID 2128 wrote to memory of 352 2128 ffxfxlr.exe 3ddjv.exe PID 2128 wrote to memory of 352 2128 ffxfxlr.exe 3ddjv.exe PID 352 wrote to memory of 2952 352 3ddjv.exe hbhnbh.exe PID 352 wrote to memory of 2952 352 3ddjv.exe hbhnbh.exe PID 352 wrote to memory of 2952 352 3ddjv.exe hbhnbh.exe PID 352 wrote to memory of 2952 352 3ddjv.exe hbhnbh.exe PID 2952 wrote to memory of 2640 2952 hbhnbh.exe jjdpv.exe PID 2952 wrote to memory of 2640 2952 hbhnbh.exe jjdpv.exe PID 2952 wrote to memory of 2640 2952 hbhnbh.exe jjdpv.exe PID 2952 wrote to memory of 2640 2952 hbhnbh.exe jjdpv.exe PID 2640 wrote to memory of 2564 2640 jjdpv.exe ppvjp.exe PID 2640 wrote to memory of 2564 2640 jjdpv.exe ppvjp.exe PID 2640 wrote to memory of 2564 2640 jjdpv.exe ppvjp.exe PID 2640 wrote to memory of 2564 2640 jjdpv.exe ppvjp.exe PID 2564 wrote to memory of 2592 2564 ppvjp.exe hthbht.exe PID 2564 wrote to memory of 2592 2564 ppvjp.exe hthbht.exe PID 2564 wrote to memory of 2592 2564 ppvjp.exe hthbht.exe PID 2564 wrote to memory of 2592 2564 ppvjp.exe hthbht.exe PID 2592 wrote to memory of 2456 2592 hthbht.exe ppdjv.exe PID 2592 wrote to memory of 2456 2592 hthbht.exe ppdjv.exe PID 2592 wrote to memory of 2456 2592 hthbht.exe ppdjv.exe PID 2592 wrote to memory of 2456 2592 hthbht.exe ppdjv.exe PID 2456 wrote to memory of 2448 2456 ppdjv.exe lfflxxl.exe PID 2456 wrote to memory of 2448 2456 ppdjv.exe lfflxxl.exe PID 2456 wrote to memory of 2448 2456 ppdjv.exe lfflxxl.exe PID 2456 wrote to memory of 2448 2456 ppdjv.exe lfflxxl.exe PID 2448 wrote to memory of 2864 2448 lfflxxl.exe pjjvp.exe PID 2448 wrote to memory of 2864 2448 lfflxxl.exe pjjvp.exe PID 2448 wrote to memory of 2864 2448 lfflxxl.exe pjjvp.exe PID 2448 wrote to memory of 2864 2448 lfflxxl.exe pjjvp.exe PID 2864 wrote to memory of 2876 2864 pjjvp.exe rffxlrx.exe PID 2864 wrote to memory of 2876 2864 pjjvp.exe rffxlrx.exe PID 2864 wrote to memory of 2876 2864 pjjvp.exe rffxlrx.exe PID 2864 wrote to memory of 2876 2864 pjjvp.exe rffxlrx.exe PID 2876 wrote to memory of 2408 2876 rffxlrx.exe nhbhnb.exe PID 2876 wrote to memory of 2408 2876 rffxlrx.exe nhbhnb.exe PID 2876 wrote to memory of 2408 2876 rffxlrx.exe nhbhnb.exe PID 2876 wrote to memory of 2408 2876 rffxlrx.exe nhbhnb.exe PID 2408 wrote to memory of 2648 2408 nhbhnb.exe jddjv.exe PID 2408 wrote to memory of 2648 2408 nhbhnb.exe jddjv.exe PID 2408 wrote to memory of 2648 2408 nhbhnb.exe jddjv.exe PID 2408 wrote to memory of 2648 2408 nhbhnb.exe jddjv.exe PID 2648 wrote to memory of 1972 2648 jddjv.exe rllxlrr.exe PID 2648 wrote to memory of 1972 2648 jddjv.exe rllxlrr.exe PID 2648 wrote to memory of 1972 2648 jddjv.exe rllxlrr.exe PID 2648 wrote to memory of 1972 2648 jddjv.exe rllxlrr.exe PID 1972 wrote to memory of 1036 1972 rllxlrr.exe tbhttb.exe PID 1972 wrote to memory of 1036 1972 rllxlrr.exe tbhttb.exe PID 1972 wrote to memory of 1036 1972 rllxlrr.exe tbhttb.exe PID 1972 wrote to memory of 1036 1972 rllxlrr.exe tbhttb.exe PID 1036 wrote to memory of 1820 1036 tbhttb.exe vppdv.exe PID 1036 wrote to memory of 1820 1036 tbhttb.exe vppdv.exe PID 1036 wrote to memory of 1820 1036 tbhttb.exe vppdv.exe PID 1036 wrote to memory of 1820 1036 tbhttb.exe vppdv.exe PID 1820 wrote to memory of 304 1820 vppdv.exe 7llrffl.exe PID 1820 wrote to memory of 304 1820 vppdv.exe 7llrffl.exe PID 1820 wrote to memory of 304 1820 vppdv.exe 7llrffl.exe PID 1820 wrote to memory of 304 1820 vppdv.exe 7llrffl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f954078d16c7c9d5202c175d7c95a4b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f954078d16c7c9d5202c175d7c95a4b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\ffxfxlr.exec:\ffxfxlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\3ddjv.exec:\3ddjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\hbhnbh.exec:\hbhnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\jjdpv.exec:\jjdpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\ppvjp.exec:\ppvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\hthbht.exec:\hthbht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\ppdjv.exec:\ppdjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\lfflxxl.exec:\lfflxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\pjjvp.exec:\pjjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\rffxlrx.exec:\rffxlrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\nhbhnb.exec:\nhbhnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\jddjv.exec:\jddjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\rllxlrr.exec:\rllxlrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\tbhttb.exec:\tbhttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\vppdv.exec:\vppdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\7llrffl.exec:\7llrffl.exe17⤵
- Executes dropped EXE
PID:304 -
\??\c:\pvdvd.exec:\pvdvd.exe18⤵
- Executes dropped EXE
PID:2008 -
\??\c:\1rrfxxf.exec:\1rrfxxf.exe19⤵
- Executes dropped EXE
PID:820 -
\??\c:\9ntbtt.exec:\9ntbtt.exe20⤵
- Executes dropped EXE
PID:1316 -
\??\c:\9jvjv.exec:\9jvjv.exe21⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tnnbnt.exec:\tnnbnt.exe22⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ddjvp.exec:\ddjvp.exe23⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hbnbhn.exec:\hbnbhn.exe24⤵
- Executes dropped EXE
PID:540 -
\??\c:\1dpjv.exec:\1dpjv.exe25⤵
- Executes dropped EXE
PID:584 -
\??\c:\rrlrlrl.exec:\rrlrlrl.exe26⤵
- Executes dropped EXE
PID:1480 -
\??\c:\hththh.exec:\hththh.exe27⤵
- Executes dropped EXE
PID:1544 -
\??\c:\1vjdd.exec:\1vjdd.exe28⤵
- Executes dropped EXE
PID:964 -
\??\c:\bhthnt.exec:\bhthnt.exe29⤵
- Executes dropped EXE
PID:1052 -
\??\c:\9xrxxxx.exec:\9xrxxxx.exe30⤵
- Executes dropped EXE
PID:1284 -
\??\c:\rxrrrrf.exec:\rxrrrrf.exe31⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jddjv.exec:\jddjv.exe32⤵
- Executes dropped EXE
PID:664 -
\??\c:\5pjvv.exec:\5pjvv.exe33⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3xlflxx.exec:\3xlflxx.exe34⤵
- Executes dropped EXE
PID:772 -
\??\c:\bhbnhb.exec:\bhbnhb.exe35⤵
- Executes dropped EXE
PID:1608 -
\??\c:\5jvdp.exec:\5jvdp.exe36⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xrlllrr.exec:\xrlllrr.exe37⤵
- Executes dropped EXE
PID:3068 -
\??\c:\3xxlflf.exec:\3xxlflf.exe38⤵
- Executes dropped EXE
PID:2968 -
\??\c:\bbbnbn.exec:\bbbnbn.exe39⤵
- Executes dropped EXE
PID:2116 -
\??\c:\vpjpp.exec:\vpjpp.exe40⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pjjjj.exec:\pjjjj.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\1fxrrxl.exec:\1fxrrxl.exe42⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bthhnt.exec:\bthhnt.exe43⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vjjjd.exec:\vjjjd.exe44⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jdppv.exec:\jdppv.exe45⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xrxrxlr.exec:\xrxrxlr.exe46⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rlrfrrf.exec:\rlrfrrf.exe47⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ntbbnb.exec:\ntbbnb.exe48⤵
- Executes dropped EXE
PID:1592 -
\??\c:\vjddp.exec:\vjddp.exe49⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vppvp.exec:\vppvp.exe50⤵
- Executes dropped EXE
PID:2680 -
\??\c:\rllllll.exec:\rllllll.exe51⤵
- Executes dropped EXE
PID:2644 -
\??\c:\thhnbt.exec:\thhnbt.exe52⤵
- Executes dropped EXE
PID:2420 -
\??\c:\bnhntb.exec:\bnhntb.exe53⤵
- Executes dropped EXE
PID:1756 -
\??\c:\5vjpv.exec:\5vjpv.exe54⤵
- Executes dropped EXE
PID:2256 -
\??\c:\jvvvp.exec:\jvvvp.exe55⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nhbbtb.exec:\nhbbtb.exe56⤵
- Executes dropped EXE
PID:1032 -
\??\c:\dvpvv.exec:\dvpvv.exe57⤵
- Executes dropped EXE
PID:2268 -
\??\c:\5xlllrr.exec:\5xlllrr.exe58⤵
- Executes dropped EXE
PID:2224 -
\??\c:\7tbbnn.exec:\7tbbnn.exe59⤵
- Executes dropped EXE
PID:1320 -
\??\c:\jdvdj.exec:\jdvdj.exe60⤵
- Executes dropped EXE
PID:2312 -
\??\c:\tnhntb.exec:\tnhntb.exe61⤵
- Executes dropped EXE
PID:2104 -
\??\c:\bnntbb.exec:\bnntbb.exe62⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xrlrllr.exec:\xrlrllr.exe63⤵
- Executes dropped EXE
PID:2064 -
\??\c:\nhbbnb.exec:\nhbbnb.exe64⤵
- Executes dropped EXE
PID:488 -
\??\c:\7vjjv.exec:\7vjjv.exe65⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xlxxlrx.exec:\xlxxlrx.exe66⤵PID:1800
-
\??\c:\btnhtb.exec:\btnhtb.exe67⤵PID:1824
-
\??\c:\7dpjd.exec:\7dpjd.exe68⤵PID:2020
-
\??\c:\rlffllr.exec:\rlffllr.exe69⤵PID:1804
-
\??\c:\nbhbnt.exec:\nbhbnt.exe70⤵PID:2148
-
\??\c:\ttnthn.exec:\ttnthn.exe71⤵PID:2688
-
\??\c:\pjdjv.exec:\pjdjv.exe72⤵PID:940
-
\??\c:\rrffrfr.exec:\rrffrfr.exe73⤵PID:1736
-
\??\c:\fxrxrfl.exec:\fxrxrfl.exe74⤵PID:1952
-
\??\c:\nbnntt.exec:\nbnntt.exe75⤵PID:2832
-
\??\c:\9vjpp.exec:\9vjpp.exe76⤵PID:2280
-
\??\c:\pdjjj.exec:\pdjjj.exe77⤵PID:2892
-
\??\c:\5lxrxxr.exec:\5lxrxxr.exe78⤵PID:1612
-
\??\c:\3tbhhh.exec:\3tbhhh.exe79⤵PID:1984
-
\??\c:\jdjdp.exec:\jdjdp.exe80⤵PID:2128
-
\??\c:\ffffrrl.exec:\ffffrrl.exe81⤵PID:3068
-
\??\c:\5xrxlxf.exec:\5xrxlxf.exe82⤵PID:2000
-
\??\c:\3hhhnb.exec:\3hhhnb.exe83⤵PID:3052
-
\??\c:\jdpdj.exec:\jdpdj.exe84⤵PID:2536
-
\??\c:\xxxxllx.exec:\xxxxllx.exe85⤵PID:2716
-
\??\c:\xllrfxr.exec:\xllrfxr.exe86⤵PID:2620
-
\??\c:\btbnth.exec:\btbnth.exe87⤵PID:2556
-
\??\c:\pvjdv.exec:\pvjdv.exe88⤵PID:2764
-
\??\c:\dvpdp.exec:\dvpdp.exe89⤵PID:2444
-
\??\c:\lffxrfx.exec:\lffxrfx.exe90⤵PID:2432
-
\??\c:\bhhbth.exec:\bhhbth.exe91⤵PID:2448
-
\??\c:\jpdpd.exec:\jpdpd.exe92⤵PID:2436
-
\??\c:\jjjvp.exec:\jjjvp.exe93⤵PID:2732
-
\??\c:\llfxlrr.exec:\llfxlrr.exe94⤵PID:2308
-
\??\c:\hbttbh.exec:\hbttbh.exe95⤵PID:2492
-
\??\c:\jdppj.exec:\jdppj.exe96⤵PID:2692
-
\??\c:\lllfxlf.exec:\lllfxlf.exe97⤵PID:1044
-
\??\c:\lfxfllf.exec:\lfxfllf.exe98⤵PID:1836
-
\??\c:\btbnhn.exec:\btbnhn.exe99⤵PID:624
-
\??\c:\ddvjj.exec:\ddvjj.exe100⤵PID:776
-
\??\c:\jjpdp.exec:\jjpdp.exe101⤵PID:2848
-
\??\c:\xllxrrr.exec:\xllxrrr.exe102⤵PID:1656
-
\??\c:\nbhnht.exec:\nbhnht.exe103⤵PID:1932
-
\??\c:\5bnbbn.exec:\5bnbbn.exe104⤵PID:1252
-
\??\c:\1jpvp.exec:\1jpvp.exe105⤵PID:2300
-
\??\c:\fxxxrrf.exec:\fxxxrrf.exe106⤵PID:1320
-
\??\c:\1llrxxx.exec:\1llrxxx.exe107⤵PID:2316
-
\??\c:\hbbhhn.exec:\hbbhhn.exe108⤵PID:2668
-
\??\c:\jdjpv.exec:\jdjpv.exe109⤵PID:2080
-
\??\c:\vvppj.exec:\vvppj.exe110⤵PID:2412
-
\??\c:\rlflfxr.exec:\rlflfxr.exe111⤵PID:796
-
\??\c:\nnnhhb.exec:\nnnhhb.exe112⤵PID:1104
-
\??\c:\9pjpj.exec:\9pjpj.exe113⤵PID:1784
-
\??\c:\vvpvd.exec:\vvpvd.exe114⤵PID:1824
-
\??\c:\5xrxlfl.exec:\5xrxlfl.exe115⤵PID:1092
-
\??\c:\bttbtb.exec:\bttbtb.exe116⤵PID:1804
-
\??\c:\hbhtnn.exec:\hbhtnn.exe117⤵PID:1728
-
\??\c:\jjdpd.exec:\jjdpd.exe118⤵PID:2688
-
\??\c:\fffxrfr.exec:\fffxrfr.exe119⤵PID:1812
-
\??\c:\hbthnh.exec:\hbthnh.exe120⤵PID:1736
-
\??\c:\vvvpd.exec:\vvvpd.exe121⤵PID:1164
-
\??\c:\xrrrffl.exec:\xrrrffl.exe122⤵PID:3004
-
\??\c:\rrffrfr.exec:\rrffrfr.exe123⤵PID:1520
-
\??\c:\9ddpd.exec:\9ddpd.exe124⤵PID:1608
-
\??\c:\1vvjd.exec:\1vvjd.exe125⤵PID:2960
-
\??\c:\1rxfrfl.exec:\1rxfrfl.exe126⤵PID:2756
-
\??\c:\7ttbnb.exec:\7ttbnb.exe127⤵PID:2540
-
\??\c:\hnbhbn.exec:\hnbhbn.exe128⤵PID:1808
-
\??\c:\vvvdp.exec:\vvvdp.exe129⤵PID:2632
-
\??\c:\3rxlflf.exec:\3rxlflf.exe130⤵PID:2724
-
\??\c:\nhthth.exec:\nhthth.exe131⤵PID:2956
-
\??\c:\nnbhht.exec:\nnbhht.exe132⤵PID:2460
-
\??\c:\vpjpv.exec:\vpjpv.exe133⤵PID:2708
-
\??\c:\xllxlrr.exec:\xllxlrr.exe134⤵PID:2496
-
\??\c:\tnbhnn.exec:\tnbhnn.exe135⤵PID:1868
-
\??\c:\nnnbnt.exec:\nnnbnt.exe136⤵PID:3048
-
\??\c:\jdvjp.exec:\jdvjp.exe137⤵PID:2552
-
\??\c:\llfrfrf.exec:\llfrfrf.exe138⤵PID:2876
-
\??\c:\hhttbh.exec:\hhttbh.exe139⤵PID:636
-
\??\c:\7hbnbh.exec:\7hbnbh.exe140⤵PID:2408
-
\??\c:\7jvpd.exec:\7jvpd.exe141⤵PID:2492
-
\??\c:\rrlrllr.exec:\rrlrllr.exe142⤵PID:1972
-
\??\c:\bnhhnn.exec:\bnhhnn.exe143⤵PID:1624
-
\??\c:\jvjjj.exec:\jvjjj.exe144⤵PID:1756
-
\??\c:\vppvp.exec:\vppvp.exe145⤵PID:892
-
\??\c:\lfrxlrl.exec:\lfrxlrl.exe146⤵PID:2168
-
\??\c:\7thhht.exec:\7thhht.exe147⤵PID:1604
-
\??\c:\vjvdd.exec:\vjvdd.exe148⤵PID:876
-
\??\c:\7jdvd.exec:\7jdvd.exe149⤵PID:2224
-
\??\c:\9xllfrf.exec:\9xllfrf.exe150⤵PID:2056
-
\??\c:\hbbthn.exec:\hbbthn.exe151⤵PID:1308
-
\??\c:\jddjj.exec:\jddjj.exe152⤵PID:1448
-
\??\c:\vpjjv.exec:\vpjjv.exe153⤵PID:3036
-
\??\c:\rxrfxxf.exec:\rxrfxxf.exe154⤵PID:556
-
\??\c:\9ththn.exec:\9ththn.exe155⤵PID:708
-
\??\c:\7ppvd.exec:\7ppvd.exe156⤵PID:1060
-
\??\c:\jdppv.exec:\jdppv.exe157⤵PID:840
-
\??\c:\lfxfrfr.exec:\lfxfrfr.exe158⤵PID:1800
-
\??\c:\btttbh.exec:\btttbh.exe159⤵PID:1360
-
\??\c:\dpjpd.exec:\dpjpd.exe160⤵PID:3000
-
\??\c:\pdpvj.exec:\pdpvj.exe161⤵PID:1964
-
\??\c:\1rrlfff.exec:\1rrlfff.exe162⤵PID:2380
-
\??\c:\hbtbbt.exec:\hbtbbt.exe163⤵PID:2356
-
\??\c:\1bhthn.exec:\1bhthn.exe164⤵PID:2836
-
\??\c:\ddpvj.exec:\ddpvj.exe165⤵PID:992
-
\??\c:\1xrxllx.exec:\1xrxllx.exe166⤵PID:1304
-
\??\c:\nhnbnb.exec:\nhnbnb.exe167⤵PID:696
-
\??\c:\tttbnt.exec:\tttbnt.exe168⤵PID:1724
-
\??\c:\vvpvj.exec:\vvpvj.exe169⤵PID:2388
-
\??\c:\fxflrrl.exec:\fxflrrl.exe170⤵PID:2948
-
\??\c:\3btthn.exec:\3btthn.exe171⤵PID:1684
-
\??\c:\3hbhhh.exec:\3hbhhh.exe172⤵PID:1588
-
\??\c:\dvpvj.exec:\dvpvj.exe173⤵PID:2572
-
\??\c:\3xlfllr.exec:\3xlfllr.exe174⤵PID:2036
-
\??\c:\xrfflrr.exec:\xrfflrr.exe175⤵PID:1620
-
\??\c:\nhbnbh.exec:\nhbnbh.exe176⤵PID:2624
-
\??\c:\vvjvp.exec:\vvjvp.exe177⤵PID:2724
-
\??\c:\ffxfxfr.exec:\ffxfxfr.exe178⤵PID:2896
-
\??\c:\xxrxllr.exec:\xxrxllr.exe179⤵PID:2592
-
\??\c:\bnhhnn.exec:\bnhhnn.exe180⤵PID:2456
-
\??\c:\9jdpj.exec:\9jdpj.exe181⤵PID:2544
-
\??\c:\dvvjd.exec:\dvvjd.exe182⤵PID:2912
-
\??\c:\9frrxxf.exec:\9frrxxf.exe183⤵PID:2720
-
\??\c:\nhbnbb.exec:\nhbnbb.exe184⤵PID:548
-
\??\c:\ddvvj.exec:\ddvvj.exe185⤵PID:2344
-
\??\c:\9pjvd.exec:\9pjvd.exe186⤵PID:2672
-
\??\c:\9xrlrfl.exec:\9xrlrfl.exe187⤵PID:1536
-
\??\c:\ttnnbb.exec:\ttnnbb.exe188⤵PID:2520
-
\??\c:\5btttn.exec:\5btttn.exe189⤵PID:2492
-
\??\c:\vjpvv.exec:\vjpvv.exe190⤵PID:2684
-
\??\c:\frlxfrf.exec:\frlxfrf.exe191⤵PID:2420
-
\??\c:\rxlrxlx.exec:\rxlrxlx.exe192⤵PID:2676
-
\??\c:\nhbhbt.exec:\nhbhbt.exe193⤵PID:1928
-
\??\c:\ddddd.exec:\ddddd.exe194⤵PID:2328
-
\??\c:\9xxxflr.exec:\9xxxflr.exe195⤵PID:1400
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe196⤵PID:820
-
\??\c:\htbhnn.exec:\htbhnn.exe197⤵PID:2060
-
\??\c:\vpvdp.exec:\vpvdp.exe198⤵PID:2300
-
\??\c:\jjvvd.exec:\jjvvd.exe199⤵PID:2296
-
\??\c:\lfflfxf.exec:\lfflfxf.exe200⤵PID:2612
-
\??\c:\5ntbbn.exec:\5ntbbn.exe201⤵PID:1292
-
\??\c:\nnbnnt.exec:\nnbnnt.exe202⤵PID:2080
-
\??\c:\jddpv.exec:\jddpv.exe203⤵PID:540
-
\??\c:\9xrrrxl.exec:\9xrrrxl.exe204⤵PID:600
-
\??\c:\lffrflx.exec:\lffrflx.exe205⤵PID:1136
-
\??\c:\7thnnt.exec:\7thnnt.exe206⤵PID:1560
-
\??\c:\dvvpv.exec:\dvvpv.exe207⤵PID:1860
-
\??\c:\rllxffx.exec:\rllxffx.exe208⤵PID:1340
-
\??\c:\lfrrllr.exec:\lfrrllr.exe209⤵PID:3000
-
\??\c:\bhbbnh.exec:\bhbbnh.exe210⤵PID:1728
-
\??\c:\7vvjj.exec:\7vvjj.exe211⤵PID:2032
-
\??\c:\9fflxlf.exec:\9fflxlf.exe212⤵PID:472
-
\??\c:\xlflrxl.exec:\xlflrxl.exe213⤵PID:2760
-
\??\c:\btnnbh.exec:\btnnbh.exe214⤵PID:1992
-
\??\c:\ppppj.exec:\ppppj.exe215⤵PID:1512
-
\??\c:\1rrlxxf.exec:\1rrlxxf.exe216⤵PID:2940
-
\??\c:\7rrffff.exec:\7rrffff.exe217⤵PID:1724
-
\??\c:\bnbtbt.exec:\bnbtbt.exe218⤵PID:2388
-
\??\c:\5ntbnn.exec:\5ntbnn.exe219⤵PID:2964
-
\??\c:\3jppj.exec:\3jppj.exe220⤵PID:2128
-
\??\c:\xxfllrf.exec:\xxfllrf.exe221⤵PID:2756
-
\??\c:\xrlrflx.exec:\xrlrflx.exe222⤵PID:2000
-
\??\c:\tnhnth.exec:\tnhnth.exe223⤵PID:1396
-
\??\c:\pjppj.exec:\pjppj.exe224⤵PID:2740
-
\??\c:\lfrxrxl.exec:\lfrxrxl.exe225⤵PID:2632
-
\??\c:\ffflxrl.exec:\ffflxrl.exe226⤵PID:2440
-
\??\c:\3tbhbn.exec:\3tbhbn.exe227⤵PID:2336
-
\??\c:\dpvpp.exec:\dpvpp.exe228⤵PID:2592
-
\??\c:\dvpvp.exec:\dvpvp.exe229⤵PID:2772
-
\??\c:\rlxflrx.exec:\rlxflrx.exe230⤵PID:2636
-
\??\c:\bnnbth.exec:\bnnbth.exe231⤵PID:2448
-
\??\c:\pppdd.exec:\pppdd.exe232⤵PID:2720
-
\??\c:\dvpvj.exec:\dvpvj.exe233⤵PID:1532
-
\??\c:\5rflrxx.exec:\5rflrxx.exe234⤵PID:1708
-
\??\c:\nhhhnt.exec:\nhhhnt.exe235⤵PID:1196
-
\??\c:\bttbtt.exec:\bttbtt.exe236⤵PID:1536
-
\??\c:\jvpjj.exec:\jvpjj.exe237⤵PID:2484
-
\??\c:\fxlllxr.exec:\fxlllxr.exe238⤵PID:1036
-
\??\c:\lrrlfll.exec:\lrrlfll.exe239⤵PID:2228
-
\??\c:\9nhtnn.exec:\9nhtnn.exe240⤵PID:776
-
\??\c:\pdpjj.exec:\pdpjj.exe241⤵PID:892
-
\??\c:\3rrxlrr.exec:\3rrxlrr.exe242⤵PID:1928