Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 16:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb833b3481847e95f66a71155d545730_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
eb833b3481847e95f66a71155d545730_NeikiAnalytics.exe
-
Size
134KB
-
MD5
eb833b3481847e95f66a71155d545730
-
SHA1
7fc950b61b01d8eed5d35ebd033606c36de7c6a3
-
SHA256
84701badbf9a215e83e9ae4f58a57226b8fc4183c7588b0ea9f555f5fe2d8ee5
-
SHA512
b6aad174676d42da09f50aa389e591186b11396e6524a5aa78515ae19b09e5ae9c314d2f0e1796b0e7e0ad9fa4e90ded252bbdfb38f920d15081b1d566093754
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHVpx+dGorX:n3C9BRW0j/1px+dGo
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral1/memory/992-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/852-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1832-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/660-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/988-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/340-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/552-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
htthhh.exevvjvj.exefxrlrrx.exenhntbb.exe3lllrrr.exenhbbhn.exepjpvj.exe3pjpp.exelxrrlfl.exenbtbbb.exedpjpv.exevjppp.exexrrrrlr.exehtbbbb.exepdpvj.exejvvdp.exexrllrlx.exe1hnhtb.exebnhtbb.exedvddj.exerlxxflx.exelxlfllx.exehtbhnt.exe5jvdj.exe9rllrrf.exexrfflrf.exerlllllr.exe7jjdd.exerlxxfrf.exehhhthn.exebttnnn.exejjvvv.exelfrflrx.exelflrrrf.exerllfllx.exehhnbhn.exebbthnn.exejdvvj.exedvpdd.exexxlfllr.exerrffrrr.exe5hbhhh.exetnbhtt.exejdvdv.exejvjpv.exerlxxlfr.exe7lxlrxl.exehbntbb.exebbnbnt.exe1thhnh.exe3vdjv.exepjddp.exerllrxlr.exe9lxrfxf.exehbhbhh.exetnhtnn.exevjvdp.exeddpjp.exelfrxxrx.exefxffrrf.exe3tnnht.exebnbbnn.exevpjpd.exe3jdjd.exepid process 2064 htthhh.exe 2724 vvjvj.exe 1604 fxrlrrx.exe 2684 nhntbb.exe 3056 3lllrrr.exe 2744 nhbbhn.exe 2584 pjpvj.exe 2472 3pjpp.exe 2932 lxrrlfl.exe 2588 nbtbbb.exe 2632 dpjpv.exe 2640 vjppp.exe 1536 xrrrrlr.exe 1812 htbbbb.exe 1764 pdpvj.exe 2912 jvvdp.exe 852 xrllrlx.exe 2028 1hnhtb.exe 2880 bnhtbb.exe 1832 dvddj.exe 1996 rlxxflx.exe 660 lxlfllx.exe 1556 htbhnt.exe 2944 5jvdj.exe 3036 9rllrrf.exe 988 xrfflrf.exe 340 rlllllr.exe 552 7jjdd.exe 1908 rlxxfrf.exe 2980 hhhthn.exe 2228 bttnnn.exe 2148 jjvvv.exe 2312 lfrflrx.exe 1508 lflrrrf.exe 1940 rllfllx.exe 2344 hhnbhn.exe 2556 bbthnn.exe 1604 jdvvj.exe 2536 dvpdd.exe 2684 xxlfllr.exe 2648 rrffrrr.exe 2448 5hbhhh.exe 2420 tnbhtt.exe 2404 jdvdv.exe 2928 jvjpv.exe 1520 rlxxlfr.exe 2652 7lxlrxl.exe 2772 hbntbb.exe 2748 bbnbnt.exe 1484 1thhnh.exe 1628 3vdjv.exe 1432 pjddp.exe 308 rllrxlr.exe 2060 9lxrfxf.exe 1560 hbhbhh.exe 1200 tnhtnn.exe 1668 vjvdp.exe 2948 ddpjp.exe 2956 lfrxxrx.exe 1920 fxffrrf.exe 528 3tnnht.exe 1392 bnbbnn.exe 1848 vpjpd.exe 808 3jdjd.exe -
Processes:
resource yara_rule behavioral1/memory/992-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/992-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/852-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/660-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/988-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/340-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/552-273-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
eb833b3481847e95f66a71155d545730_NeikiAnalytics.exehtthhh.exevvjvj.exefxrlrrx.exenhntbb.exe3lllrrr.exenhbbhn.exepjpvj.exe3pjpp.exelxrrlfl.exenbtbbb.exedpjpv.exevjppp.exexrrrrlr.exehtbbbb.exepdpvj.exedescription pid process target process PID 992 wrote to memory of 2064 992 eb833b3481847e95f66a71155d545730_NeikiAnalytics.exe htthhh.exe PID 992 wrote to memory of 2064 992 eb833b3481847e95f66a71155d545730_NeikiAnalytics.exe htthhh.exe PID 992 wrote to memory of 2064 992 eb833b3481847e95f66a71155d545730_NeikiAnalytics.exe htthhh.exe PID 992 wrote to memory of 2064 992 eb833b3481847e95f66a71155d545730_NeikiAnalytics.exe htthhh.exe PID 2064 wrote to memory of 2724 2064 htthhh.exe vvjvj.exe PID 2064 wrote to memory of 2724 2064 htthhh.exe vvjvj.exe PID 2064 wrote to memory of 2724 2064 htthhh.exe vvjvj.exe PID 2064 wrote to memory of 2724 2064 htthhh.exe vvjvj.exe PID 2724 wrote to memory of 1604 2724 vvjvj.exe fxrlrrx.exe PID 2724 wrote to memory of 1604 2724 vvjvj.exe fxrlrrx.exe PID 2724 wrote to memory of 1604 2724 vvjvj.exe fxrlrrx.exe PID 2724 wrote to memory of 1604 2724 vvjvj.exe fxrlrrx.exe PID 1604 wrote to memory of 2684 1604 fxrlrrx.exe nhntbb.exe PID 1604 wrote to memory of 2684 1604 fxrlrrx.exe nhntbb.exe PID 1604 wrote to memory of 2684 1604 fxrlrrx.exe nhntbb.exe PID 1604 wrote to memory of 2684 1604 fxrlrrx.exe nhntbb.exe PID 2684 wrote to memory of 3056 2684 nhntbb.exe 3lllrrr.exe PID 2684 wrote to memory of 3056 2684 nhntbb.exe 3lllrrr.exe PID 2684 wrote to memory of 3056 2684 nhntbb.exe 3lllrrr.exe PID 2684 wrote to memory of 3056 2684 nhntbb.exe 3lllrrr.exe PID 3056 wrote to memory of 2744 3056 3lllrrr.exe nhbbhn.exe PID 3056 wrote to memory of 2744 3056 3lllrrr.exe nhbbhn.exe PID 3056 wrote to memory of 2744 3056 3lllrrr.exe nhbbhn.exe PID 3056 wrote to memory of 2744 3056 3lllrrr.exe nhbbhn.exe PID 2744 wrote to memory of 2584 2744 nhbbhn.exe pjpvj.exe PID 2744 wrote to memory of 2584 2744 nhbbhn.exe pjpvj.exe PID 2744 wrote to memory of 2584 2744 nhbbhn.exe pjpvj.exe PID 2744 wrote to memory of 2584 2744 nhbbhn.exe pjpvj.exe PID 2584 wrote to memory of 2472 2584 pjpvj.exe 3pjpp.exe PID 2584 wrote to memory of 2472 2584 pjpvj.exe 3pjpp.exe PID 2584 wrote to memory of 2472 2584 pjpvj.exe 3pjpp.exe PID 2584 wrote to memory of 2472 2584 pjpvj.exe 3pjpp.exe PID 2472 wrote to memory of 2932 2472 3pjpp.exe lxrrlfl.exe PID 2472 wrote to memory of 2932 2472 3pjpp.exe lxrrlfl.exe PID 2472 wrote to memory of 2932 2472 3pjpp.exe lxrrlfl.exe PID 2472 wrote to memory of 2932 2472 3pjpp.exe lxrrlfl.exe PID 2932 wrote to memory of 2588 2932 lxrrlfl.exe nbtbbb.exe PID 2932 wrote to memory of 2588 2932 lxrrlfl.exe nbtbbb.exe PID 2932 wrote to memory of 2588 2932 lxrrlfl.exe nbtbbb.exe PID 2932 wrote to memory of 2588 2932 lxrrlfl.exe nbtbbb.exe PID 2588 wrote to memory of 2632 2588 nbtbbb.exe dpjpv.exe PID 2588 wrote to memory of 2632 2588 nbtbbb.exe dpjpv.exe PID 2588 wrote to memory of 2632 2588 nbtbbb.exe dpjpv.exe PID 2588 wrote to memory of 2632 2588 nbtbbb.exe dpjpv.exe PID 2632 wrote to memory of 2640 2632 dpjpv.exe vjppp.exe PID 2632 wrote to memory of 2640 2632 dpjpv.exe vjppp.exe PID 2632 wrote to memory of 2640 2632 dpjpv.exe vjppp.exe PID 2632 wrote to memory of 2640 2632 dpjpv.exe vjppp.exe PID 2640 wrote to memory of 1536 2640 vjppp.exe xrrrrlr.exe PID 2640 wrote to memory of 1536 2640 vjppp.exe xrrrrlr.exe PID 2640 wrote to memory of 1536 2640 vjppp.exe xrrrrlr.exe PID 2640 wrote to memory of 1536 2640 vjppp.exe xrrrrlr.exe PID 1536 wrote to memory of 1812 1536 xrrrrlr.exe htbbbb.exe PID 1536 wrote to memory of 1812 1536 xrrrrlr.exe htbbbb.exe PID 1536 wrote to memory of 1812 1536 xrrrrlr.exe htbbbb.exe PID 1536 wrote to memory of 1812 1536 xrrrrlr.exe htbbbb.exe PID 1812 wrote to memory of 1764 1812 htbbbb.exe pdpvj.exe PID 1812 wrote to memory of 1764 1812 htbbbb.exe pdpvj.exe PID 1812 wrote to memory of 1764 1812 htbbbb.exe pdpvj.exe PID 1812 wrote to memory of 1764 1812 htbbbb.exe pdpvj.exe PID 1764 wrote to memory of 2912 1764 pdpvj.exe jvvdp.exe PID 1764 wrote to memory of 2912 1764 pdpvj.exe jvvdp.exe PID 1764 wrote to memory of 2912 1764 pdpvj.exe jvvdp.exe PID 1764 wrote to memory of 2912 1764 pdpvj.exe jvvdp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb833b3481847e95f66a71155d545730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\eb833b3481847e95f66a71155d545730_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\htthhh.exec:\htthhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\vvjvj.exec:\vvjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\fxrlrrx.exec:\fxrlrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\nhntbb.exec:\nhntbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\3lllrrr.exec:\3lllrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\nhbbhn.exec:\nhbbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\pjpvj.exec:\pjpvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\3pjpp.exec:\3pjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\lxrrlfl.exec:\lxrrlfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\nbtbbb.exec:\nbtbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\dpjpv.exec:\dpjpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\vjppp.exec:\vjppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\xrrrrlr.exec:\xrrrrlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\htbbbb.exec:\htbbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\pdpvj.exec:\pdpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\jvvdp.exec:\jvvdp.exe17⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xrllrlx.exec:\xrllrlx.exe18⤵
- Executes dropped EXE
PID:852 -
\??\c:\1hnhtb.exec:\1hnhtb.exe19⤵
- Executes dropped EXE
PID:2028 -
\??\c:\bnhtbb.exec:\bnhtbb.exe20⤵
- Executes dropped EXE
PID:2880 -
\??\c:\dvddj.exec:\dvddj.exe21⤵
- Executes dropped EXE
PID:1832 -
\??\c:\rlxxflx.exec:\rlxxflx.exe22⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lxlfllx.exec:\lxlfllx.exe23⤵
- Executes dropped EXE
PID:660 -
\??\c:\htbhnt.exec:\htbhnt.exe24⤵
- Executes dropped EXE
PID:1556 -
\??\c:\5jvdj.exec:\5jvdj.exe25⤵
- Executes dropped EXE
PID:2944 -
\??\c:\9rllrrf.exec:\9rllrrf.exe26⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xrfflrf.exec:\xrfflrf.exe27⤵
- Executes dropped EXE
PID:988 -
\??\c:\rlllllr.exec:\rlllllr.exe28⤵
- Executes dropped EXE
PID:340 -
\??\c:\7jjdd.exec:\7jjdd.exe29⤵
- Executes dropped EXE
PID:552 -
\??\c:\rlxxfrf.exec:\rlxxfrf.exe30⤵
- Executes dropped EXE
PID:1908 -
\??\c:\hhhthn.exec:\hhhthn.exe31⤵
- Executes dropped EXE
PID:2980 -
\??\c:\bttnnn.exec:\bttnnn.exe32⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jjvvv.exec:\jjvvv.exe33⤵
- Executes dropped EXE
PID:2148 -
\??\c:\lfrflrx.exec:\lfrflrx.exe34⤵
- Executes dropped EXE
PID:2312 -
\??\c:\lflrrrf.exec:\lflrrrf.exe35⤵
- Executes dropped EXE
PID:1508 -
\??\c:\rllfllx.exec:\rllfllx.exe36⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hhnbhn.exec:\hhnbhn.exe37⤵
- Executes dropped EXE
PID:2344 -
\??\c:\bbthnn.exec:\bbthnn.exe38⤵
- Executes dropped EXE
PID:2556 -
\??\c:\jdvvj.exec:\jdvvj.exe39⤵
- Executes dropped EXE
PID:1604 -
\??\c:\dvpdd.exec:\dvpdd.exe40⤵
- Executes dropped EXE
PID:2536 -
\??\c:\xxlfllr.exec:\xxlfllr.exe41⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rrffrrr.exec:\rrffrrr.exe42⤵
- Executes dropped EXE
PID:2648 -
\??\c:\5hbhhh.exec:\5hbhhh.exe43⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tnbhtt.exec:\tnbhtt.exe44⤵
- Executes dropped EXE
PID:2420 -
\??\c:\jdvdv.exec:\jdvdv.exe45⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jvjpv.exec:\jvjpv.exe46⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rlxxlfr.exec:\rlxxlfr.exe47⤵
- Executes dropped EXE
PID:1520 -
\??\c:\7lxlrxl.exec:\7lxlrxl.exe48⤵
- Executes dropped EXE
PID:2652 -
\??\c:\hbntbb.exec:\hbntbb.exe49⤵
- Executes dropped EXE
PID:2772 -
\??\c:\bbnbnt.exec:\bbnbnt.exe50⤵
- Executes dropped EXE
PID:2748 -
\??\c:\1thhnh.exec:\1thhnh.exe51⤵
- Executes dropped EXE
PID:1484 -
\??\c:\3vdjv.exec:\3vdjv.exe52⤵
- Executes dropped EXE
PID:1628 -
\??\c:\pjddp.exec:\pjddp.exe53⤵
- Executes dropped EXE
PID:1432 -
\??\c:\rllrxlr.exec:\rllrxlr.exe54⤵
- Executes dropped EXE
PID:308 -
\??\c:\9lxrfxf.exec:\9lxrfxf.exe55⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hbhbhh.exec:\hbhbhh.exe56⤵
- Executes dropped EXE
PID:1560 -
\??\c:\tnhtnn.exec:\tnhtnn.exe57⤵
- Executes dropped EXE
PID:1200 -
\??\c:\vjvdp.exec:\vjvdp.exe58⤵
- Executes dropped EXE
PID:1668 -
\??\c:\ddpjp.exec:\ddpjp.exe59⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lfrxxrx.exec:\lfrxxrx.exe60⤵
- Executes dropped EXE
PID:2956 -
\??\c:\fxffrrf.exec:\fxffrrf.exe61⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3tnnht.exec:\3tnnht.exe62⤵
- Executes dropped EXE
PID:528 -
\??\c:\bnbbnn.exec:\bnbbnn.exe63⤵
- Executes dropped EXE
PID:1392 -
\??\c:\vpjpd.exec:\vpjpd.exe64⤵
- Executes dropped EXE
PID:1848 -
\??\c:\3jdjd.exec:\3jdjd.exe65⤵
- Executes dropped EXE
PID:808 -
\??\c:\fxlllrx.exec:\fxlllrx.exe66⤵PID:1700
-
\??\c:\xlrrxrf.exec:\xlrrxrf.exe67⤵PID:3036
-
\??\c:\1ttnbb.exec:\1ttnbb.exe68⤵PID:1032
-
\??\c:\5nnnnh.exec:\5nnnnh.exe69⤵PID:680
-
\??\c:\jvppp.exec:\jvppp.exe70⤵PID:2988
-
\??\c:\9vpvd.exec:\9vpvd.exe71⤵PID:1980
-
\??\c:\dpdvv.exec:\dpdvv.exe72⤵PID:352
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe73⤵PID:596
-
\??\c:\ffllrxf.exec:\ffllrxf.exe74⤵PID:1412
-
\??\c:\tnbbnh.exec:\tnbbnh.exe75⤵PID:1632
-
\??\c:\hbnnnh.exec:\hbnnnh.exe76⤵PID:2868
-
\??\c:\1jdpp.exec:\1jdpp.exe77⤵PID:2320
-
\??\c:\7vpjp.exec:\7vpjp.exe78⤵PID:1516
-
\??\c:\rlxflfl.exec:\rlxflfl.exe79⤵PID:1940
-
\??\c:\xrxffrf.exec:\xrxffrf.exe80⤵PID:2520
-
\??\c:\3htthh.exec:\3htthh.exe81⤵PID:2556
-
\??\c:\hbnbhn.exec:\hbnbhn.exe82⤵PID:2680
-
\??\c:\jdvjp.exec:\jdvjp.exe83⤵PID:2536
-
\??\c:\pddvp.exec:\pddvp.exe84⤵PID:2820
-
\??\c:\lxrxffx.exec:\lxrxffx.exe85⤵PID:2648
-
\??\c:\7xlrxfx.exec:\7xlrxfx.exe86⤵PID:2692
-
\??\c:\tnthnt.exec:\tnthnt.exe87⤵PID:2400
-
\??\c:\pvvpj.exec:\pvvpj.exe88⤵PID:2584
-
\??\c:\vjvdp.exec:\vjvdp.exe89⤵PID:2620
-
\??\c:\ffrlrfl.exec:\ffrlrfl.exe90⤵PID:1544
-
\??\c:\xxlxflx.exec:\xxlxflx.exe91⤵PID:2652
-
\??\c:\bhbbhh.exec:\bhbbhh.exe92⤵PID:2772
-
\??\c:\hhbthb.exec:\hhbthb.exe93⤵PID:2632
-
\??\c:\tnhtnt.exec:\tnhtnt.exe94⤵PID:1820
-
\??\c:\5jjpd.exec:\5jjpd.exe95⤵PID:1828
-
\??\c:\llrxflx.exec:\llrxflx.exe96⤵PID:1356
-
\??\c:\9lflxxl.exec:\9lflxxl.exe97⤵PID:616
-
\??\c:\bbnhtb.exec:\bbnhtb.exe98⤵PID:1764
-
\??\c:\htnhnt.exec:\htnhnt.exe99⤵PID:852
-
\??\c:\vpjpv.exec:\vpjpv.exe100⤵PID:2024
-
\??\c:\ddvpv.exec:\ddvpv.exe101⤵PID:2900
-
\??\c:\lxlllrr.exec:\lxlllrr.exe102⤵PID:2940
-
\??\c:\7frxllr.exec:\7frxllr.exe103⤵PID:2956
-
\??\c:\nhbntt.exec:\nhbntt.exe104⤵PID:1832
-
\??\c:\nhbhnb.exec:\nhbhnb.exe105⤵PID:528
-
\??\c:\jjvdd.exec:\jjvdd.exe106⤵PID:1852
-
\??\c:\jdjdd.exec:\jdjdd.exe107⤵PID:1704
-
\??\c:\xxlflxl.exec:\xxlflxl.exe108⤵PID:1136
-
\??\c:\3nbnnn.exec:\3nbnnn.exe109⤵PID:1700
-
\??\c:\nbhtbt.exec:\nbhtbt.exe110⤵PID:2288
-
\??\c:\vvjvv.exec:\vvjvv.exe111⤵PID:1032
-
\??\c:\ppvpp.exec:\ppvpp.exe112⤵PID:1132
-
\??\c:\llffrrf.exec:\llffrrf.exe113⤵PID:2988
-
\??\c:\1xrxflx.exec:\1xrxflx.exe114⤵PID:1964
-
\??\c:\nnhtbn.exec:\nnhtbn.exe115⤵PID:352
-
\??\c:\5nhthh.exec:\5nhthh.exe116⤵PID:1540
-
\??\c:\vvjjv.exec:\vvjjv.exe117⤵PID:1412
-
\??\c:\3xxxrrl.exec:\3xxxrrl.exe118⤵PID:1640
-
\??\c:\lfrrffl.exec:\lfrrffl.exe119⤵PID:2868
-
\??\c:\hbhhhh.exec:\hbhhhh.exe120⤵PID:2312
-
\??\c:\hbbbhh.exec:\hbbbhh.exe121⤵PID:2052
-
\??\c:\jjdjv.exec:\jjdjv.exe122⤵PID:2500
-
\??\c:\jdpvd.exec:\jdpvd.exe123⤵PID:2344
-
\??\c:\xrffrrf.exec:\xrffrrf.exe124⤵PID:2700
-
\??\c:\fxlxlrf.exec:\fxlxlrf.exe125⤵PID:2680
-
\??\c:\5bnntt.exec:\5bnntt.exe126⤵PID:2716
-
\??\c:\nbnthh.exec:\nbnthh.exe127⤵PID:2820
-
\??\c:\vppdj.exec:\vppdj.exe128⤵PID:2524
-
\??\c:\vpddp.exec:\vpddp.exe129⤵PID:2448
-
\??\c:\xxlfrfr.exec:\xxlfrfr.exe130⤵PID:2480
-
\??\c:\llxflrx.exec:\llxflrx.exe131⤵PID:2584
-
\??\c:\9hnhhh.exec:\9hnhhh.exe132⤵PID:2620
-
\??\c:\hthhnt.exec:\hthhnt.exe133⤵PID:2732
-
\??\c:\1jvpp.exec:\1jvpp.exe134⤵PID:2788
-
\??\c:\djpvv.exec:\djpvv.exe135⤵PID:2904
-
\??\c:\xfxlrrx.exec:\xfxlrrx.exe136⤵PID:2748
-
\??\c:\tntnbb.exec:\tntnbb.exe137⤵PID:1820
-
\??\c:\3djpv.exec:\3djpv.exe138⤵PID:1628
-
\??\c:\pjddp.exec:\pjddp.exe139⤵PID:1356
-
\??\c:\lxfffxx.exec:\lxfffxx.exe140⤵PID:308
-
\??\c:\xrxfflr.exec:\xrxfflr.exe141⤵PID:1764
-
\??\c:\1hthhn.exec:\1hthhn.exe142⤵PID:2264
-
\??\c:\5bnthh.exec:\5bnthh.exe143⤵PID:2024
-
\??\c:\ppjvd.exec:\ppjvd.exe144⤵PID:2968
-
\??\c:\ddddp.exec:\ddddp.exe145⤵PID:2940
-
\??\c:\xrlxllx.exec:\xrlxllx.exe146⤵PID:1992
-
\??\c:\xxlrllx.exec:\xxlrllx.exe147⤵PID:1920
-
\??\c:\7tbbhn.exec:\7tbbhn.exe148⤵PID:264
-
\??\c:\thtbhh.exec:\thtbhh.exe149⤵PID:1852
-
\??\c:\hnbbbh.exec:\hnbbbh.exe150⤵PID:1168
-
\??\c:\5ppjp.exec:\5ppjp.exe151⤵PID:808
-
\??\c:\xrllllr.exec:\xrllllr.exe152⤵PID:756
-
\??\c:\frlffll.exec:\frlffll.exe153⤵PID:2288
-
\??\c:\bbnthh.exec:\bbnthh.exe154⤵PID:1272
-
\??\c:\hhtthh.exec:\hhtthh.exe155⤵PID:780
-
\??\c:\jppdv.exec:\jppdv.exe156⤵PID:552
-
\??\c:\9jjvp.exec:\9jjvp.exe157⤵PID:1964
-
\??\c:\lfrxxff.exec:\lfrxxff.exe158⤵PID:532
-
\??\c:\1flrrrr.exec:\1flrrrr.exe159⤵PID:2132
-
\??\c:\tthtbn.exec:\tthtbn.exe160⤵PID:1688
-
\??\c:\7vjpd.exec:\7vjpd.exe161⤵PID:1640
-
\??\c:\7ddjv.exec:\7ddjv.exe162⤵PID:1608
-
\??\c:\jjppv.exec:\jjppv.exe163⤵PID:1516
-
\??\c:\lfffrxf.exec:\lfffrxf.exe164⤵PID:2188
-
\??\c:\rlxllrf.exec:\rlxllrf.exe165⤵PID:2564
-
\??\c:\hbbttt.exec:\hbbttt.exe166⤵PID:2520
-
\??\c:\thtntn.exec:\thtntn.exe167⤵PID:2700
-
\??\c:\pjvdv.exec:\pjvdv.exe168⤵PID:2528
-
\??\c:\dvjvd.exec:\dvjvd.exe169⤵PID:2716
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe170⤵PID:2460
-
\??\c:\xrfrfrx.exec:\xrfrfrx.exe171⤵PID:2524
-
\??\c:\3nhhhb.exec:\3nhhhb.exe172⤵PID:2692
-
\??\c:\dpvvd.exec:\dpvvd.exe173⤵PID:2480
-
\??\c:\pjvvd.exec:\pjvvd.exe174⤵PID:1572
-
\??\c:\pdjdd.exec:\pdjdd.exe175⤵PID:2756
-
\??\c:\frfxfxx.exec:\frfxfxx.exe176⤵PID:2068
-
\??\c:\1lxfxfl.exec:\1lxfxfl.exe177⤵PID:2652
-
\??\c:\bntttn.exec:\bntttn.exe178⤵PID:1528
-
\??\c:\nhtbhb.exec:\nhtbhb.exe179⤵PID:2632
-
\??\c:\ppjdp.exec:\ppjdp.exe180⤵PID:1812
-
\??\c:\dvjjv.exec:\dvjjv.exe181⤵PID:1628
-
\??\c:\5lfrxxf.exec:\5lfrxxf.exe182⤵PID:2512
-
\??\c:\rrlrxrf.exec:\rrlrxrf.exe183⤵PID:1176
-
\??\c:\btbhnn.exec:\btbhnn.exe184⤵PID:1764
-
\??\c:\nbbnth.exec:\nbbnth.exe185⤵PID:1200
-
\??\c:\jdpdj.exec:\jdpdj.exe186⤵PID:1340
-
\??\c:\dvpvp.exec:\dvpvp.exe187⤵PID:2900
-
\??\c:\1rxfllx.exec:\1rxfllx.exe188⤵PID:2940
-
\??\c:\fxrrfxf.exec:\fxrrfxf.exe189⤵PID:624
-
\??\c:\3hbntb.exec:\3hbntb.exe190⤵PID:1832
-
\??\c:\5btbhh.exec:\5btbhh.exe191⤵PID:264
-
\??\c:\vppvj.exec:\vppvj.exe192⤵PID:1596
-
\??\c:\jdjvv.exec:\jdjvv.exe193⤵PID:1168
-
\??\c:\llxxfrx.exec:\llxxfrx.exe194⤵PID:1136
-
\??\c:\9rfflff.exec:\9rfflff.exe195⤵PID:756
-
\??\c:\ttnbnn.exec:\ttnbnn.exe196⤵PID:324
-
\??\c:\9bbthh.exec:\9bbthh.exe197⤵PID:2080
-
\??\c:\1vppp.exec:\1vppp.exe198⤵PID:2004
-
\??\c:\xrfxllx.exec:\xrfxllx.exe199⤵PID:1980
-
\??\c:\xrxfflr.exec:\xrxfflr.exe200⤵PID:1964
-
\??\c:\ffxfllx.exec:\ffxfllx.exe201⤵PID:884
-
\??\c:\nntbbb.exec:\nntbbb.exe202⤵PID:1540
-
\??\c:\hbhntb.exec:\hbhntb.exe203⤵PID:1412
-
\??\c:\pdvvj.exec:\pdvvj.exe204⤵PID:1640
-
\??\c:\vppdj.exec:\vppdj.exe205⤵PID:2320
-
\??\c:\xrllxrf.exec:\xrllxrf.exe206⤵PID:2552
-
\??\c:\9ntbhh.exec:\9ntbhh.exe207⤵PID:2188
-
\??\c:\vvjpv.exec:\vvjpv.exe208⤵PID:2564
-
\??\c:\ffrfrxl.exec:\ffrfrxl.exe209⤵PID:2520
-
\??\c:\1lxxxxf.exec:\1lxxxxf.exe210⤵PID:2700
-
\??\c:\hhbnbb.exec:\hhbnbb.exe211⤵PID:2696
-
\??\c:\1nbttn.exec:\1nbttn.exe212⤵PID:2716
-
\??\c:\9vjpv.exec:\9vjpv.exe213⤵PID:2460
-
\??\c:\1jdvv.exec:\1jdvv.exe214⤵PID:1904
-
\??\c:\fxlxlrf.exec:\fxlxlrf.exe215⤵PID:2928
-
\??\c:\1fxflfr.exec:\1fxflfr.exe216⤵PID:2480
-
\??\c:\5nbtbh.exec:\5nbtbh.exe217⤵PID:2588
-
\??\c:\hbtbtb.exec:\hbtbtb.exe218⤵PID:2776
-
\??\c:\pdpjp.exec:\pdpjp.exe219⤵PID:1836
-
\??\c:\dvpvp.exec:\dvpvp.exe220⤵PID:2652
-
\??\c:\3frrrrx.exec:\3frrrrx.exe221⤵PID:304
-
\??\c:\3xrflxf.exec:\3xrflxf.exe222⤵PID:2632
-
\??\c:\nhhhhh.exec:\nhhhhh.exe223⤵PID:2464
-
\??\c:\hbtnhh.exec:\hbtnhh.exe224⤵PID:1500
-
\??\c:\jdjvj.exec:\jdjvj.exe225⤵PID:616
-
\??\c:\vvpvd.exec:\vvpvd.exe226⤵PID:1176
-
\??\c:\fxllxrx.exec:\fxllxrx.exe227⤵PID:2152
-
\??\c:\lfflllx.exec:\lfflllx.exe228⤵PID:1200
-
\??\c:\5bnnth.exec:\5bnnth.exe229⤵PID:2000
-
\??\c:\btbtbb.exec:\btbtbb.exe230⤵PID:2504
-
\??\c:\pjvdd.exec:\pjvdd.exe231⤵PID:2956
-
\??\c:\dvdjj.exec:\dvdjj.exe232⤵PID:624
-
\??\c:\llffrrf.exec:\llffrrf.exe233⤵PID:2208
-
\??\c:\lfrxrrf.exec:\lfrxrrf.exe234⤵PID:264
-
\??\c:\3bthbh.exec:\3bthbh.exe235⤵PID:940
-
\??\c:\bthtbh.exec:\bthtbh.exe236⤵PID:1168
-
\??\c:\1dppv.exec:\1dppv.exe237⤵PID:2260
-
\??\c:\ddpvv.exec:\ddpvv.exe238⤵PID:2996
-
\??\c:\rlfxffr.exec:\rlfxffr.exe239⤵PID:1656
-
\??\c:\fxrfffl.exec:\fxrfffl.exe240⤵PID:824
-
\??\c:\9hbhtt.exec:\9hbhtt.exe241⤵PID:2980
-
\??\c:\nhtthh.exec:\nhtthh.exe242⤵PID:1952