Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 21:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
43629623efe92c0af6c7440c82e9e1b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
43629623efe92c0af6c7440c82e9e1b0_NeikiAnalytics.exe
-
Size
205KB
-
MD5
43629623efe92c0af6c7440c82e9e1b0
-
SHA1
5ab42d91da21d73ffaf812abe992cd51749c04f9
-
SHA256
6f11a944221dd1fc5ffd594ef497c152442d1523b0fa04ba3dd844bc1f742eb7
-
SHA512
aaad671cfd648906c51840dad0e7e25f0fbef008bbf9feabc444e24da7df2b1dd55d44f29a86f61b5c8899ded6c39b76bf14a8ff044ceab01eeb9508a1a96375
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+C2HVM1p6TQpCihu:PhOm2sI93UufdC67ciJTU2HVS64hu
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
Processes:
resource yara_rule behavioral1/memory/2836-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1128-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/308-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/556-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1292-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1320-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/620-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-310-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2580-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-389-0x00000000002B0000-0x00000000002D9000-memory.dmp family_blackmoon behavioral1/memory/2416-393-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-418-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-500-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-588-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-601-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2152-608-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-622-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2604-686-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2064-751-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-762-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-911-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2708-912-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jdpdp.exexxrxfrf.exevpjjv.exejjddp.exexxflxfl.exehbntnn.exe9vpvv.exerrlrxxl.exehthbhh.exe5pdvd.exelxlllll.exenbnbht.exepjpjp.exedvddp.exenbnbhh.exenhbhbb.exe3jppj.exelxffffl.exenbbtbb.exeppdjv.exe7frxlxf.exenhbbnt.exedpdpp.exerfxxxrx.exehtbbtt.exetnbbhh.exerllflrr.exe9rxxfxf.exejpvvp.exepjvvv.exefxlrllx.exenhthtn.exepjdpv.exedvjdj.exexlrrrrx.exehhbbhn.exehbttnn.exejdvdj.exevvdjv.exexrllrxf.exebhnbhb.exenhtbhh.exepppjp.exe1pvdj.exerfffllx.exehbnthh.exehhthnt.exejdddj.exefxrlxlx.exexrflrxf.exenbnthn.exehttbhh.exejdppj.exeflrrxxx.exethtnnn.exe5hbhbt.exehtbnnh.exedpppd.exerllrxxf.exentbhhn.exe9tbbhh.exedvjpv.exedpjjd.exexrffrxf.exepid process 2836 jdpdp.exe 2664 xxrxfrf.exe 2584 vpjjv.exe 2792 jjddp.exe 2784 xxflxfl.exe 2744 hbntnn.exe 2488 9vpvv.exe 2456 rrlrxxl.exe 2872 hthbhh.exe 308 5pdvd.exe 2632 lxlllll.exe 2764 nbnbht.exe 2204 pjpjp.exe 1968 dvddp.exe 556 nbnbhh.exe 1292 nhbhbb.exe 2400 3jppj.exe 856 lxffffl.exe 1320 nbbtbb.exe 2264 ppdjv.exe 2532 7frxlxf.exe 2052 nhbbnt.exe 484 dpdpp.exe 892 rfxxxrx.exe 2540 htbbtt.exe 1512 tnbbhh.exe 620 rllflrr.exe 1960 9rxxfxf.exe 3040 jpvvp.exe 2024 pjvvv.exe 2140 fxlrllx.exe 896 nhthtn.exe 1724 pjdpv.exe 2832 dvjdj.exe 2840 xlrrrrx.exe 2836 hhbbhn.exe 2580 hbttnn.exe 2648 jdvdj.exe 1152 vvdjv.exe 2572 xrllrxf.exe 2448 bhnbhb.exe 2348 nhtbhh.exe 2744 pppjp.exe 2612 1pvdj.exe 2516 rfffllx.exe 2608 hbnthh.exe 2416 hhthnt.exe 2724 jdddj.exe 2860 fxrlxlx.exe 1820 xrflrxf.exe 1696 nbnthn.exe 1948 httbhh.exe 1872 jdppj.exe 2188 flrrxxx.exe 2208 thtnnn.exe 1636 5hbhbt.exe 1516 htbnnh.exe 1524 dpppd.exe 1300 rllrxxf.exe 2244 ntbhhn.exe 2272 9tbbhh.exe 2124 dvjpv.exe 2816 dpjjd.exe 580 xrffrxf.exe -
Processes:
resource yara_rule behavioral1/memory/1128-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1128-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/308-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/556-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1292-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1320-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/620-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-323-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-349-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-371-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-389-0x00000000002B0000-0x00000000002D9000-memory.dmp upx behavioral1/memory/2416-393-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-411-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-418-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-493-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-500-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-588-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-608-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-623-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/636-738-0x00000000001B0000-0x00000000001D9000-memory.dmp upx behavioral1/memory/2064-751-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-762-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-794-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-813-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-856-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-879-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-886-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-912-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-919-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-933-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-973-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-1017-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
43629623efe92c0af6c7440c82e9e1b0_NeikiAnalytics.exejdpdp.exexxrxfrf.exevpjjv.exejjddp.exexxflxfl.exehbntnn.exe9vpvv.exerrlrxxl.exehthbhh.exe5pdvd.exelxlllll.exenbnbht.exepjpjp.exedvddp.exenbnbhh.exedescription pid process target process PID 1128 wrote to memory of 2836 1128 43629623efe92c0af6c7440c82e9e1b0_NeikiAnalytics.exe jdpdp.exe PID 1128 wrote to memory of 2836 1128 43629623efe92c0af6c7440c82e9e1b0_NeikiAnalytics.exe jdpdp.exe PID 1128 wrote to memory of 2836 1128 43629623efe92c0af6c7440c82e9e1b0_NeikiAnalytics.exe jdpdp.exe PID 1128 wrote to memory of 2836 1128 43629623efe92c0af6c7440c82e9e1b0_NeikiAnalytics.exe jdpdp.exe PID 2836 wrote to memory of 2664 2836 jdpdp.exe xxrxfrf.exe PID 2836 wrote to memory of 2664 2836 jdpdp.exe xxrxfrf.exe PID 2836 wrote to memory of 2664 2836 jdpdp.exe xxrxfrf.exe PID 2836 wrote to memory of 2664 2836 jdpdp.exe xxrxfrf.exe PID 2664 wrote to memory of 2584 2664 xxrxfrf.exe vpjjv.exe PID 2664 wrote to memory of 2584 2664 xxrxfrf.exe vpjjv.exe PID 2664 wrote to memory of 2584 2664 xxrxfrf.exe vpjjv.exe PID 2664 wrote to memory of 2584 2664 xxrxfrf.exe vpjjv.exe PID 2584 wrote to memory of 2792 2584 vpjjv.exe jjddp.exe PID 2584 wrote to memory of 2792 2584 vpjjv.exe jjddp.exe PID 2584 wrote to memory of 2792 2584 vpjjv.exe jjddp.exe PID 2584 wrote to memory of 2792 2584 vpjjv.exe jjddp.exe PID 2792 wrote to memory of 2784 2792 jjddp.exe xxflxfl.exe PID 2792 wrote to memory of 2784 2792 jjddp.exe xxflxfl.exe PID 2792 wrote to memory of 2784 2792 jjddp.exe xxflxfl.exe PID 2792 wrote to memory of 2784 2792 jjddp.exe xxflxfl.exe PID 2784 wrote to memory of 2744 2784 xxflxfl.exe hbntnn.exe PID 2784 wrote to memory of 2744 2784 xxflxfl.exe hbntnn.exe PID 2784 wrote to memory of 2744 2784 xxflxfl.exe hbntnn.exe PID 2784 wrote to memory of 2744 2784 xxflxfl.exe hbntnn.exe PID 2744 wrote to memory of 2488 2744 hbntnn.exe 9vpvv.exe PID 2744 wrote to memory of 2488 2744 hbntnn.exe 9vpvv.exe PID 2744 wrote to memory of 2488 2744 hbntnn.exe 9vpvv.exe PID 2744 wrote to memory of 2488 2744 hbntnn.exe 9vpvv.exe PID 2488 wrote to memory of 2456 2488 9vpvv.exe rrlrxxl.exe PID 2488 wrote to memory of 2456 2488 9vpvv.exe rrlrxxl.exe PID 2488 wrote to memory of 2456 2488 9vpvv.exe rrlrxxl.exe PID 2488 wrote to memory of 2456 2488 9vpvv.exe rrlrxxl.exe PID 2456 wrote to memory of 2872 2456 rrlrxxl.exe hthbhh.exe PID 2456 wrote to memory of 2872 2456 rrlrxxl.exe hthbhh.exe PID 2456 wrote to memory of 2872 2456 rrlrxxl.exe hthbhh.exe PID 2456 wrote to memory of 2872 2456 rrlrxxl.exe hthbhh.exe PID 2872 wrote to memory of 308 2872 hthbhh.exe 5pdvd.exe PID 2872 wrote to memory of 308 2872 hthbhh.exe 5pdvd.exe PID 2872 wrote to memory of 308 2872 hthbhh.exe 5pdvd.exe PID 2872 wrote to memory of 308 2872 hthbhh.exe 5pdvd.exe PID 308 wrote to memory of 2632 308 5pdvd.exe lxlllll.exe PID 308 wrote to memory of 2632 308 5pdvd.exe lxlllll.exe PID 308 wrote to memory of 2632 308 5pdvd.exe lxlllll.exe PID 308 wrote to memory of 2632 308 5pdvd.exe lxlllll.exe PID 2632 wrote to memory of 2764 2632 lxlllll.exe nbnbht.exe PID 2632 wrote to memory of 2764 2632 lxlllll.exe nbnbht.exe PID 2632 wrote to memory of 2764 2632 lxlllll.exe nbnbht.exe PID 2632 wrote to memory of 2764 2632 lxlllll.exe nbnbht.exe PID 2764 wrote to memory of 2204 2764 nbnbht.exe pjpjp.exe PID 2764 wrote to memory of 2204 2764 nbnbht.exe pjpjp.exe PID 2764 wrote to memory of 2204 2764 nbnbht.exe pjpjp.exe PID 2764 wrote to memory of 2204 2764 nbnbht.exe pjpjp.exe PID 2204 wrote to memory of 1968 2204 pjpjp.exe dvddp.exe PID 2204 wrote to memory of 1968 2204 pjpjp.exe dvddp.exe PID 2204 wrote to memory of 1968 2204 pjpjp.exe dvddp.exe PID 2204 wrote to memory of 1968 2204 pjpjp.exe dvddp.exe PID 1968 wrote to memory of 556 1968 dvddp.exe nbnbhh.exe PID 1968 wrote to memory of 556 1968 dvddp.exe nbnbhh.exe PID 1968 wrote to memory of 556 1968 dvddp.exe nbnbhh.exe PID 1968 wrote to memory of 556 1968 dvddp.exe nbnbhh.exe PID 556 wrote to memory of 1292 556 nbnbhh.exe nhbhbb.exe PID 556 wrote to memory of 1292 556 nbnbhh.exe nhbhbb.exe PID 556 wrote to memory of 1292 556 nbnbhh.exe nhbhbb.exe PID 556 wrote to memory of 1292 556 nbnbhh.exe nhbhbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\43629623efe92c0af6c7440c82e9e1b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\43629623efe92c0af6c7440c82e9e1b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\jdpdp.exec:\jdpdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\xxrxfrf.exec:\xxrxfrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\vpjjv.exec:\vpjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\jjddp.exec:\jjddp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\xxflxfl.exec:\xxflxfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\hbntnn.exec:\hbntnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\9vpvv.exec:\9vpvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rrlrxxl.exec:\rrlrxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\hthbhh.exec:\hthbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\5pdvd.exec:\5pdvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\lxlllll.exec:\lxlllll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\nbnbht.exec:\nbnbht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\pjpjp.exec:\pjpjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\dvddp.exec:\dvddp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\nbnbhh.exec:\nbnbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\nhbhbb.exec:\nhbhbb.exe17⤵
- Executes dropped EXE
PID:1292 -
\??\c:\3jppj.exec:\3jppj.exe18⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lxffffl.exec:\lxffffl.exe19⤵
- Executes dropped EXE
PID:856 -
\??\c:\nbbtbb.exec:\nbbtbb.exe20⤵
- Executes dropped EXE
PID:1320 -
\??\c:\ppdjv.exec:\ppdjv.exe21⤵
- Executes dropped EXE
PID:2264 -
\??\c:\7frxlxf.exec:\7frxlxf.exe22⤵
- Executes dropped EXE
PID:2532 -
\??\c:\nhbbnt.exec:\nhbbnt.exe23⤵
- Executes dropped EXE
PID:2052 -
\??\c:\dpdpp.exec:\dpdpp.exe24⤵
- Executes dropped EXE
PID:484 -
\??\c:\rfxxxrx.exec:\rfxxxrx.exe25⤵
- Executes dropped EXE
PID:892 -
\??\c:\htbbtt.exec:\htbbtt.exe26⤵
- Executes dropped EXE
PID:2540 -
\??\c:\tnbbhh.exec:\tnbbhh.exe27⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rllflrr.exec:\rllflrr.exe28⤵
- Executes dropped EXE
PID:620 -
\??\c:\9rxxfxf.exec:\9rxxfxf.exe29⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jpvvp.exec:\jpvvp.exe30⤵
- Executes dropped EXE
PID:3040 -
\??\c:\pjvvv.exec:\pjvvv.exe31⤵
- Executes dropped EXE
PID:2024 -
\??\c:\fxlrllx.exec:\fxlrllx.exe32⤵
- Executes dropped EXE
PID:2140 -
\??\c:\nhthtn.exec:\nhthtn.exe33⤵
- Executes dropped EXE
PID:896 -
\??\c:\pjdpv.exec:\pjdpv.exe34⤵
- Executes dropped EXE
PID:1724 -
\??\c:\dvjdj.exec:\dvjdj.exe35⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xlrrrrx.exec:\xlrrrrx.exe36⤵
- Executes dropped EXE
PID:2840 -
\??\c:\hhbbhn.exec:\hhbbhn.exe37⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hbttnn.exec:\hbttnn.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jdvdj.exec:\jdvdj.exe39⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vvdjv.exec:\vvdjv.exe40⤵
- Executes dropped EXE
PID:1152 -
\??\c:\xrllrxf.exec:\xrllrxf.exe41⤵
- Executes dropped EXE
PID:2572 -
\??\c:\bhnbhb.exec:\bhnbhb.exe42⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nhtbhh.exec:\nhtbhh.exe43⤵
- Executes dropped EXE
PID:2348 -
\??\c:\pppjp.exec:\pppjp.exe44⤵
- Executes dropped EXE
PID:2744 -
\??\c:\1pvdj.exec:\1pvdj.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rfffllx.exec:\rfffllx.exe46⤵
- Executes dropped EXE
PID:2516 -
\??\c:\hbnthh.exec:\hbnthh.exe47⤵
- Executes dropped EXE
PID:2608 -
\??\c:\hhthnt.exec:\hhthnt.exe48⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jdddj.exec:\jdddj.exe49⤵
- Executes dropped EXE
PID:2724 -
\??\c:\fxrlxlx.exec:\fxrlxlx.exe50⤵
- Executes dropped EXE
PID:2860 -
\??\c:\xrflrxf.exec:\xrflrxf.exe51⤵
- Executes dropped EXE
PID:1820 -
\??\c:\nbnthn.exec:\nbnthn.exe52⤵
- Executes dropped EXE
PID:1696 -
\??\c:\httbhh.exec:\httbhh.exe53⤵
- Executes dropped EXE
PID:1948 -
\??\c:\jdppj.exec:\jdppj.exe54⤵
- Executes dropped EXE
PID:1872 -
\??\c:\flrrxxx.exec:\flrrxxx.exe55⤵
- Executes dropped EXE
PID:2188 -
\??\c:\thtnnn.exec:\thtnnn.exe56⤵
- Executes dropped EXE
PID:2208 -
\??\c:\5hbhbt.exec:\5hbhbt.exe57⤵
- Executes dropped EXE
PID:1636 -
\??\c:\htbnnh.exec:\htbnnh.exe58⤵
- Executes dropped EXE
PID:1516 -
\??\c:\dpppd.exec:\dpppd.exe59⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rllrxxf.exec:\rllrxxf.exe60⤵
- Executes dropped EXE
PID:1300 -
\??\c:\ntbhhn.exec:\ntbhhn.exe61⤵
- Executes dropped EXE
PID:2244 -
\??\c:\9tbbhh.exec:\9tbbhh.exe62⤵
- Executes dropped EXE
PID:2272 -
\??\c:\dvjpv.exec:\dvjpv.exe63⤵
- Executes dropped EXE
PID:2124 -
\??\c:\dpjjd.exec:\dpjjd.exe64⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xrffrxf.exec:\xrffrxf.exe65⤵
- Executes dropped EXE
PID:580 -
\??\c:\tbnnhh.exec:\tbnnhh.exe66⤵PID:756
-
\??\c:\5nhnnn.exec:\5nhnnn.exe67⤵PID:1868
-
\??\c:\pjdjd.exec:\pjdjd.exe68⤵PID:3036
-
\??\c:\fxflllr.exec:\fxflllr.exe69⤵PID:1360
-
\??\c:\frxrfxf.exec:\frxrfxf.exe70⤵PID:544
-
\??\c:\tntbbb.exec:\tntbbb.exe71⤵PID:1372
-
\??\c:\tnbhhh.exec:\tnbhhh.exe72⤵PID:1648
-
\??\c:\jjdjp.exec:\jjdjp.exe73⤵PID:1888
-
\??\c:\3jjvp.exec:\3jjvp.exe74⤵PID:564
-
\??\c:\xrxfrrf.exec:\xrxfrrf.exe75⤵PID:2780
-
\??\c:\9tnntn.exec:\9tnntn.exe76⤵PID:1500
-
\??\c:\nbhhnn.exec:\nbhhnn.exe77⤵PID:3016
-
\??\c:\dpdjv.exec:\dpdjv.exe78⤵PID:2008
-
\??\c:\jdpvv.exec:\jdpvv.exe79⤵PID:1724
-
\??\c:\xlfrrlf.exec:\xlfrrlf.exe80⤵PID:2344
-
\??\c:\hthbhb.exec:\hthbhb.exe81⤵PID:2152
-
\??\c:\7btbbb.exec:\7btbbb.exe82⤵PID:860
-
\??\c:\5pjjd.exec:\5pjjd.exe83⤵PID:2592
-
\??\c:\xllllrr.exec:\xllllrr.exe84⤵PID:2652
-
\??\c:\bnbtbt.exec:\bnbtbt.exe85⤵PID:2600
-
\??\c:\hthnnh.exec:\hthnnh.exe86⤵PID:2716
-
\??\c:\vpddv.exec:\vpddv.exe87⤵PID:2604
-
\??\c:\frllrrx.exec:\frllrrx.exe88⤵PID:2712
-
\??\c:\lxffflx.exec:\lxffflx.exe89⤵PID:2700
-
\??\c:\htbbtn.exec:\htbbtn.exe90⤵PID:2612
-
\??\c:\nhthhh.exec:\nhthhh.exe91⤵PID:2516
-
\??\c:\vjjjp.exec:\vjjjp.exe92⤵PID:2404
-
\??\c:\fxrrlfl.exec:\fxrrlfl.exe93⤵PID:2880
-
\??\c:\lffrrrx.exec:\lffrrrx.exe94⤵PID:2740
-
\??\c:\tbnbbt.exec:\tbnbbt.exe95⤵PID:2888
-
\??\c:\bbtbnn.exec:\bbtbnn.exe96⤵PID:1824
-
\??\c:\ddjpp.exec:\ddjpp.exe97⤵PID:1956
-
\??\c:\lrxxrff.exec:\lrxxrff.exe98⤵PID:1964
-
\??\c:\5lflxrl.exec:\5lflxrl.exe99⤵PID:2192
-
\??\c:\hbhhbt.exec:\hbhhbt.exe100⤵PID:1764
-
\??\c:\dvppd.exec:\dvppd.exe101⤵PID:2164
-
\??\c:\jvjpv.exec:\jvjpv.exe102⤵PID:636
-
\??\c:\rfllllr.exec:\rfllllr.exe103⤵PID:1876
-
\??\c:\nttbtb.exec:\nttbtb.exe104⤵PID:2064
-
\??\c:\7nhhtb.exec:\7nhhtb.exe105⤵PID:2056
-
\??\c:\jdvvv.exec:\jdvvv.exe106⤵PID:1936
-
\??\c:\5rllrrl.exec:\5rllrrl.exe107⤵PID:2752
-
\??\c:\llrfrxx.exec:\llrfrxx.exe108⤵PID:2060
-
\??\c:\5tnnbt.exec:\5tnnbt.exe109⤵PID:2816
-
\??\c:\nbbbht.exec:\nbbbht.exe110⤵PID:1480
-
\??\c:\ppppd.exec:\ppppd.exe111⤵PID:1752
-
\??\c:\xlrrrrx.exec:\xlrrrrx.exe112⤵PID:1676
-
\??\c:\5xllffl.exec:\5xllffl.exe113⤵PID:956
-
\??\c:\nhnthb.exec:\nhnthb.exe114⤵PID:1284
-
\??\c:\jdvvp.exec:\jdvvp.exe115⤵PID:960
-
\??\c:\djdpp.exec:\djdpp.exe116⤵PID:596
-
\??\c:\3flxxrf.exec:\3flxxrf.exe117⤵PID:1056
-
\??\c:\5rlllrf.exec:\5rlllrf.exe118⤵PID:292
-
\??\c:\bthnbb.exec:\bthnbb.exe119⤵PID:1796
-
\??\c:\hhttbn.exec:\hhttbn.exe120⤵PID:3064
-
\??\c:\pjdjp.exec:\pjdjp.exe121⤵PID:3012
-
\??\c:\xrffxxx.exec:\xrffxxx.exe122⤵PID:3016
-
\??\c:\rlxfllr.exec:\rlxfllr.exe123⤵PID:1880
-
\??\c:\bthhnt.exec:\bthhnt.exe124⤵PID:2932
-
\??\c:\7bbthh.exec:\7bbthh.exe125⤵PID:1608
-
\??\c:\vvjpj.exec:\vvjpj.exe126⤵PID:2956
-
\??\c:\dvjjj.exec:\dvjjj.exe127⤵PID:2588
-
\??\c:\lxrrxrr.exec:\lxrrxrr.exe128⤵PID:2660
-
\??\c:\tbhhnh.exec:\tbhhnh.exe129⤵PID:2792
-
\??\c:\nbhhhh.exec:\nbhhhh.exe130⤵PID:2708
-
\??\c:\1nbbbb.exec:\1nbbbb.exe131⤵PID:2448
-
\??\c:\jdvvv.exec:\jdvvv.exe132⤵PID:2672
-
\??\c:\xxllrrx.exec:\xxllrrx.exe133⤵PID:2508
-
\??\c:\bthtbh.exec:\bthtbh.exe134⤵PID:2520
-
\??\c:\hbbhhh.exec:\hbbhhh.exe135⤵PID:3032
-
\??\c:\9dpvv.exec:\9dpvv.exe136⤵PID:2516
-
\??\c:\rfllffl.exec:\rfllffl.exe137⤵PID:2404
-
\??\c:\7frrrrx.exec:\7frrrrx.exe138⤵PID:2416
-
\??\c:\3hhhtn.exec:\3hhhtn.exe139⤵PID:2760
-
\??\c:\nbnnnn.exec:\nbnnnn.exe140⤵PID:1820
-
\??\c:\jdpvv.exec:\jdpvv.exe141⤵PID:380
-
\??\c:\jvvvd.exec:\jvvvd.exe142⤵PID:2324
-
\??\c:\xrflrxr.exec:\xrflrxr.exe143⤵PID:304
-
\??\c:\bnnbnt.exec:\bnnbnt.exe144⤵PID:2184
-
\??\c:\bthhnn.exec:\bthhnn.exe145⤵PID:1592
-
\??\c:\5pppp.exec:\5pppp.exe146⤵PID:2260
-
\??\c:\jvdvd.exec:\jvdvd.exe147⤵PID:636
-
\??\c:\fxrlrxl.exec:\fxrlrxl.exe148⤵PID:1388
-
\??\c:\bthtbb.exec:\bthtbb.exe149⤵PID:2064
-
\??\c:\btbtbt.exec:\btbtbt.exe150⤵PID:1232
-
\??\c:\jdvvj.exec:\jdvvj.exe151⤵PID:2424
-
\??\c:\dvvpd.exec:\dvvpd.exe152⤵PID:2036
-
\??\c:\xrxfllx.exec:\xrxfllx.exe153⤵PID:2808
-
\??\c:\5rxrrrx.exec:\5rxrrrx.exe154⤵PID:1472
-
\??\c:\nnttbb.exec:\nnttbb.exe155⤵PID:1652
-
\??\c:\3bnnbb.exec:\3bnnbb.exe156⤵PID:1752
-
\??\c:\pjpjp.exec:\pjpjp.exe157⤵PID:348
-
\??\c:\3fllfxf.exec:\3fllfxf.exe158⤵PID:2992
-
\??\c:\fxrflrf.exec:\fxrflrf.exe159⤵PID:1788
-
\??\c:\thhntb.exec:\thhntb.exe160⤵PID:2288
-
\??\c:\1hthnt.exec:\1hthnt.exe161⤵PID:596
-
\??\c:\dpvjj.exec:\dpvjj.exe162⤵PID:1056
-
\??\c:\1ttthb.exec:\1ttthb.exe163⤵PID:564
-
\??\c:\tnbnht.exec:\tnbnht.exe164⤵PID:1708
-
\??\c:\7pddd.exec:\7pddd.exe165⤵PID:2528
-
\??\c:\ffxrxlr.exec:\ffxrxlr.exe166⤵PID:1716
-
\??\c:\htbhhh.exec:\htbhhh.exe167⤵PID:2008
-
\??\c:\hbntbb.exec:\hbntbb.exe168⤵PID:2536
-
\??\c:\vpdjj.exec:\vpdjj.exe169⤵PID:1724
-
\??\c:\vjvdd.exec:\vjvdd.exe170⤵PID:2908
-
\??\c:\rlfrxxf.exec:\rlfrxxf.exe171⤵PID:2684
-
\??\c:\rrflllr.exec:\rrflllr.exe172⤵PID:2548
-
\??\c:\hbthth.exec:\hbthth.exe173⤵PID:2572
-
\??\c:\3ttthn.exec:\3ttthn.exe174⤵PID:2708
-
\??\c:\vpddp.exec:\vpddp.exe175⤵PID:2668
-
\??\c:\3xxlllr.exec:\3xxlllr.exe176⤵PID:2488
-
\??\c:\7rfllfl.exec:\7rfllfl.exe177⤵PID:2864
-
\??\c:\7ntbbn.exec:\7ntbbn.exe178⤵PID:1196
-
\??\c:\5tthhn.exec:\5tthhn.exe179⤵PID:1428
-
\??\c:\thtbhh.exec:\thtbhh.exe180⤵PID:2512
-
\??\c:\jvvdj.exec:\jvvdj.exe181⤵PID:2616
-
\??\c:\9xrrrll.exec:\9xrrrll.exe182⤵PID:2724
-
\??\c:\1rrxlxx.exec:\1rrxlxx.exe183⤵PID:1588
-
\??\c:\tnbhnt.exec:\tnbhnt.exe184⤵PID:2972
-
\??\c:\tnhhtt.exec:\tnhhtt.exe185⤵PID:1820
-
\??\c:\pdvdj.exec:\pdvdj.exe186⤵PID:380
-
\??\c:\ppjpd.exec:\ppjpd.exe187⤵PID:1964
-
\??\c:\rllrrrl.exec:\rllrrrl.exe188⤵PID:304
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe189⤵PID:2184
-
\??\c:\nbtbhn.exec:\nbtbhn.exe190⤵PID:1592
-
\??\c:\nhnnbb.exec:\nhnnbb.exe191⤵PID:1768
-
\??\c:\5tnhnt.exec:\5tnhnt.exe192⤵PID:636
-
\??\c:\vjvvv.exec:\vjvvv.exe193⤵PID:1876
-
\??\c:\5vvvd.exec:\5vvvd.exe194⤵PID:2256
-
\??\c:\9ffrxfl.exec:\9ffrxfl.exe195⤵PID:2272
-
\??\c:\xlxfllx.exec:\xlxfllx.exe196⤵PID:2812
-
\??\c:\hhtbnn.exec:\hhtbnn.exe197⤵PID:536
-
\??\c:\dvddd.exec:\dvddd.exe198⤵PID:2052
-
\??\c:\vpdjj.exec:\vpdjj.exe199⤵PID:892
-
\??\c:\9xffrxl.exec:\9xffrxl.exe200⤵PID:1488
-
\??\c:\fxrxffr.exec:\fxrxffr.exe201⤵PID:1048
-
\??\c:\hbbntn.exec:\hbbntn.exe202⤵PID:1892
-
\??\c:\hhtntn.exec:\hhtntn.exe203⤵PID:764
-
\??\c:\jvddv.exec:\jvddv.exe204⤵PID:1036
-
\??\c:\dvddp.exec:\dvddp.exe205⤵PID:620
-
\??\c:\3lxrrlx.exec:\3lxrrlx.exe206⤵PID:1648
-
\??\c:\fxllllr.exec:\fxllllr.exe207⤵PID:792
-
\??\c:\nnbnht.exec:\nnbnht.exe208⤵PID:2140
-
\??\c:\tntthh.exec:\tntthh.exe209⤵PID:1500
-
\??\c:\vpjdp.exec:\vpjdp.exe210⤵PID:2200
-
\??\c:\7pvpv.exec:\7pvpv.exe211⤵PID:1600
-
\??\c:\fflrfrx.exec:\fflrfrx.exe212⤵PID:2528
-
\??\c:\tnttbh.exec:\tnttbh.exe213⤵PID:1716
-
\??\c:\1thhnt.exec:\1thhnt.exe214⤵PID:2008
-
\??\c:\pjdjv.exec:\pjdjv.exe215⤵PID:2536
-
\??\c:\pjdvd.exec:\pjdvd.exe216⤵PID:1608
-
\??\c:\rlxxllf.exec:\rlxxllf.exe217⤵PID:2692
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe218⤵PID:2696
-
\??\c:\nbntnt.exec:\nbntnt.exe219⤵PID:2660
-
\??\c:\nnhttt.exec:\nnhttt.exe220⤵PID:2596
-
\??\c:\vpjvd.exec:\vpjvd.exe221⤵PID:2476
-
\??\c:\vpvpv.exec:\vpvpv.exe222⤵PID:2176
-
\??\c:\3frxflr.exec:\3frxflr.exe223⤵PID:2560
-
\??\c:\rrflrxl.exec:\rrflrxl.exe224⤵PID:2700
-
\??\c:\bthhtt.exec:\bthhtt.exe225⤵PID:2892
-
\??\c:\hbbhtb.exec:\hbbhtb.exe226⤵PID:2360
-
\??\c:\dvvdd.exec:\dvvdd.exe227⤵PID:2516
-
\??\c:\3jdjp.exec:\3jdjp.exe228⤵PID:2632
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe229⤵PID:2880
-
\??\c:\rlrxlrx.exec:\rlrxlrx.exe230⤵PID:2680
-
\??\c:\tnbnnn.exec:\tnbnnn.exe231⤵PID:1824
-
\??\c:\dpdjp.exec:\dpdjp.exe232⤵PID:1956
-
\??\c:\jvjdj.exec:\jvjdj.exe233⤵PID:1948
-
\??\c:\frfxfff.exec:\frfxfff.exe234⤵PID:2192
-
\??\c:\5lffrxl.exec:\5lffrxl.exe235⤵PID:2080
-
\??\c:\tnbbhh.exec:\tnbbhh.exe236⤵PID:768
-
\??\c:\tnbnnb.exec:\tnbnnb.exe237⤵PID:1636
-
\??\c:\pjddj.exec:\pjddj.exe238⤵PID:856
-
\??\c:\pjvpv.exec:\pjvpv.exe239⤵PID:2076
-
\??\c:\rflllll.exec:\rflllll.exe240⤵PID:2420
-
\??\c:\rlxrxfl.exec:\rlxrxfl.exe241⤵PID:2064
-