Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 18:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28190e947371b4d5b0dfc7b9a940b450_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
28190e947371b4d5b0dfc7b9a940b450_NeikiAnalytics.exe
-
Size
67KB
-
MD5
28190e947371b4d5b0dfc7b9a940b450
-
SHA1
3e8e784d64d9feeec15a2886fe0f471a500fd640
-
SHA256
69edf348ae7d0252801019b857788cd210460b5df2b496f03f672cfbd4d84cb6
-
SHA512
30eeb398954c2797a3650eb7c311f8b5aad073ae43f5dff99e045b3bdbed5be27115ecc6e9a550feed1fa04a21d50ea6f51d4c4b57dba2cddd248634c7808371
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfsIQ7:ymb3NkkiQ3mdBjFI4VAIQ7
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral1/memory/1968-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/108-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-81-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1464-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/740-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-2020-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-2068-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
btnntn.exebtbbnn.exefrllrxx.exetnbhtb.exejdvvd.exejdpvj.exexrrrxxf.exe1bhtbh.exejdpdp.exejjvdj.exelfxfrxl.exexxxxlxl.exehnbnhh.exepjpdd.exerlfrxfl.exe3xrrffr.exenhnbnt.exethtbnt.exevpjpv.exexrflxfr.exerfrxrrx.exe1bthbb.exeppppd.exexfrlfxf.exehbnbhh.exennbbtn.exepjvpj.exefffrfrf.exexrxfxrx.exe5tnntt.exedvpdv.exedpdvd.exerrrrfxl.exebbhhtb.exe9nnhnb.exevjvdj.exejjvjj.exexxfxrfx.exelrrlffl.exe3nhnht.exetnhhtt.exedvppv.exejppdv.exefxrxflr.exellllffr.exe1tnbnn.exe7jjjv.exe9jjvd.exe3ffflrx.exe1rlrllx.exe3bhbtb.exevpjvd.exerlxflrf.exe7lllxfl.exenhnthn.exe1hbhnb.exe1pppd.exerllrfrx.exe3fflrxf.exehhhnhn.exebnbbbh.exevdjvd.exexlfllrx.exeflllrff.exepid process 1968 btnntn.exe 3060 btbbnn.exe 2672 frllrxx.exe 2472 tnbhtb.exe 2652 jdvvd.exe 2508 jdpvj.exe 2484 xrrrxxf.exe 2896 1bhtbh.exe 2164 jdpdp.exe 2352 jjvdj.exe 1464 lfxfrxl.exe 2748 xxxxlxl.exe 1624 hnbnhh.exe 1572 pjpdd.exe 1556 rlfrxfl.exe 1680 3xrrffr.exe 1160 nhnbnt.exe 2780 thtbnt.exe 2788 vpjpv.exe 2408 xrflxfr.exe 2340 rfrxrrx.exe 740 1bthbb.exe 1576 ppppd.exe 1792 xfrlfxf.exe 3024 hbnbhh.exe 2064 nnbbtn.exe 900 pjvpj.exe 700 fffrfrf.exe 1868 xrxfxrx.exe 1724 5tnntt.exe 2960 dvpdv.exe 1688 dpdvd.exe 1976 rrrrfxl.exe 2272 bbhhtb.exe 2132 9nnhnb.exe 2052 vjvdj.exe 2688 jjvjj.exe 2680 xxfxrfx.exe 2596 lrrlffl.exe 2332 3nhnht.exe 2652 tnhhtt.exe 2460 dvppv.exe 2536 jppdv.exe 2988 fxrxflr.exe 372 llllffr.exe 2164 1tnbnn.exe 1468 7jjjv.exe 1276 9jjvd.exe 2440 3ffflrx.exe 1236 1rlrllx.exe 1620 3bhbtb.exe 2392 vpjvd.exe 1896 rlxflrf.exe 2564 7lllxfl.exe 1272 nhnthn.exe 3012 1hbhnb.exe 2792 1pppd.exe 1936 rllrfrx.exe 1848 3fflrxf.exe 672 hhhnhn.exe 2560 bnbbbh.exe 2348 vdjvd.exe 2760 xlfllrx.exe 912 flllrff.exe -
Processes:
resource yara_rule behavioral1/memory/1968-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/108-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1464-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/740-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-2068-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
28190e947371b4d5b0dfc7b9a940b450_NeikiAnalytics.exebtnntn.exebtbbnn.exefrllrxx.exetnbhtb.exejdvvd.exejdpvj.exexrrrxxf.exe1bhtbh.exejdpdp.exejjvdj.exelfxfrxl.exexxxxlxl.exehnbnhh.exepjpdd.exerlfrxfl.exedescription pid process target process PID 108 wrote to memory of 1968 108 28190e947371b4d5b0dfc7b9a940b450_NeikiAnalytics.exe btnntn.exe PID 108 wrote to memory of 1968 108 28190e947371b4d5b0dfc7b9a940b450_NeikiAnalytics.exe btnntn.exe PID 108 wrote to memory of 1968 108 28190e947371b4d5b0dfc7b9a940b450_NeikiAnalytics.exe btnntn.exe PID 108 wrote to memory of 1968 108 28190e947371b4d5b0dfc7b9a940b450_NeikiAnalytics.exe btnntn.exe PID 1968 wrote to memory of 3060 1968 btnntn.exe btbbnn.exe PID 1968 wrote to memory of 3060 1968 btnntn.exe btbbnn.exe PID 1968 wrote to memory of 3060 1968 btnntn.exe btbbnn.exe PID 1968 wrote to memory of 3060 1968 btnntn.exe btbbnn.exe PID 3060 wrote to memory of 2672 3060 btbbnn.exe frllrxx.exe PID 3060 wrote to memory of 2672 3060 btbbnn.exe frllrxx.exe PID 3060 wrote to memory of 2672 3060 btbbnn.exe frllrxx.exe PID 3060 wrote to memory of 2672 3060 btbbnn.exe frllrxx.exe PID 2672 wrote to memory of 2472 2672 frllrxx.exe tnbhtb.exe PID 2672 wrote to memory of 2472 2672 frllrxx.exe tnbhtb.exe PID 2672 wrote to memory of 2472 2672 frllrxx.exe tnbhtb.exe PID 2672 wrote to memory of 2472 2672 frllrxx.exe tnbhtb.exe PID 2472 wrote to memory of 2652 2472 tnbhtb.exe jdvvd.exe PID 2472 wrote to memory of 2652 2472 tnbhtb.exe jdvvd.exe PID 2472 wrote to memory of 2652 2472 tnbhtb.exe jdvvd.exe PID 2472 wrote to memory of 2652 2472 tnbhtb.exe jdvvd.exe PID 2652 wrote to memory of 2508 2652 jdvvd.exe jdpvj.exe PID 2652 wrote to memory of 2508 2652 jdvvd.exe jdpvj.exe PID 2652 wrote to memory of 2508 2652 jdvvd.exe jdpvj.exe PID 2652 wrote to memory of 2508 2652 jdvvd.exe jdpvj.exe PID 2508 wrote to memory of 2484 2508 jdpvj.exe xrrrxxf.exe PID 2508 wrote to memory of 2484 2508 jdpvj.exe xrrrxxf.exe PID 2508 wrote to memory of 2484 2508 jdpvj.exe xrrrxxf.exe PID 2508 wrote to memory of 2484 2508 jdpvj.exe xrrrxxf.exe PID 2484 wrote to memory of 2896 2484 xrrrxxf.exe 1bhtbh.exe PID 2484 wrote to memory of 2896 2484 xrrrxxf.exe 1bhtbh.exe PID 2484 wrote to memory of 2896 2484 xrrrxxf.exe 1bhtbh.exe PID 2484 wrote to memory of 2896 2484 xrrrxxf.exe 1bhtbh.exe PID 2896 wrote to memory of 2164 2896 1bhtbh.exe jdpdp.exe PID 2896 wrote to memory of 2164 2896 1bhtbh.exe jdpdp.exe PID 2896 wrote to memory of 2164 2896 1bhtbh.exe jdpdp.exe PID 2896 wrote to memory of 2164 2896 1bhtbh.exe jdpdp.exe PID 2164 wrote to memory of 2352 2164 jdpdp.exe jjvdj.exe PID 2164 wrote to memory of 2352 2164 jdpdp.exe jjvdj.exe PID 2164 wrote to memory of 2352 2164 jdpdp.exe jjvdj.exe PID 2164 wrote to memory of 2352 2164 jdpdp.exe jjvdj.exe PID 2352 wrote to memory of 1464 2352 jjvdj.exe lfxfrxl.exe PID 2352 wrote to memory of 1464 2352 jjvdj.exe lfxfrxl.exe PID 2352 wrote to memory of 1464 2352 jjvdj.exe lfxfrxl.exe PID 2352 wrote to memory of 1464 2352 jjvdj.exe lfxfrxl.exe PID 1464 wrote to memory of 2748 1464 lfxfrxl.exe xxxxlxl.exe PID 1464 wrote to memory of 2748 1464 lfxfrxl.exe xxxxlxl.exe PID 1464 wrote to memory of 2748 1464 lfxfrxl.exe xxxxlxl.exe PID 1464 wrote to memory of 2748 1464 lfxfrxl.exe xxxxlxl.exe PID 2748 wrote to memory of 1624 2748 xxxxlxl.exe hnbnhh.exe PID 2748 wrote to memory of 1624 2748 xxxxlxl.exe hnbnhh.exe PID 2748 wrote to memory of 1624 2748 xxxxlxl.exe hnbnhh.exe PID 2748 wrote to memory of 1624 2748 xxxxlxl.exe hnbnhh.exe PID 1624 wrote to memory of 1572 1624 hnbnhh.exe pjpdd.exe PID 1624 wrote to memory of 1572 1624 hnbnhh.exe pjpdd.exe PID 1624 wrote to memory of 1572 1624 hnbnhh.exe pjpdd.exe PID 1624 wrote to memory of 1572 1624 hnbnhh.exe pjpdd.exe PID 1572 wrote to memory of 1556 1572 pjpdd.exe rlfrxfl.exe PID 1572 wrote to memory of 1556 1572 pjpdd.exe rlfrxfl.exe PID 1572 wrote to memory of 1556 1572 pjpdd.exe rlfrxfl.exe PID 1572 wrote to memory of 1556 1572 pjpdd.exe rlfrxfl.exe PID 1556 wrote to memory of 1680 1556 rlfrxfl.exe 3xrrffr.exe PID 1556 wrote to memory of 1680 1556 rlfrxfl.exe 3xrrffr.exe PID 1556 wrote to memory of 1680 1556 rlfrxfl.exe 3xrrffr.exe PID 1556 wrote to memory of 1680 1556 rlfrxfl.exe 3xrrffr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28190e947371b4d5b0dfc7b9a940b450_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\28190e947371b4d5b0dfc7b9a940b450_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\btnntn.exec:\btnntn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\btbbnn.exec:\btbbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\frllrxx.exec:\frllrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\tnbhtb.exec:\tnbhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\jdvvd.exec:\jdvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\jdpvj.exec:\jdpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\xrrrxxf.exec:\xrrrxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\1bhtbh.exec:\1bhtbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\jdpdp.exec:\jdpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\jjvdj.exec:\jjvdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\xxxxlxl.exec:\xxxxlxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\hnbnhh.exec:\hnbnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\pjpdd.exec:\pjpdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\rlfrxfl.exec:\rlfrxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\3xrrffr.exec:\3xrrffr.exe17⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nhnbnt.exec:\nhnbnt.exe18⤵
- Executes dropped EXE
PID:1160 -
\??\c:\thtbnt.exec:\thtbnt.exe19⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vpjpv.exec:\vpjpv.exe20⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xrflxfr.exec:\xrflxfr.exe21⤵
- Executes dropped EXE
PID:2408 -
\??\c:\rfrxrrx.exec:\rfrxrrx.exe22⤵
- Executes dropped EXE
PID:2340 -
\??\c:\1bthbb.exec:\1bthbb.exe23⤵
- Executes dropped EXE
PID:740 -
\??\c:\ppppd.exec:\ppppd.exe24⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xfrlfxf.exec:\xfrlfxf.exe25⤵
- Executes dropped EXE
PID:1792 -
\??\c:\hbnbhh.exec:\hbnbhh.exe26⤵
- Executes dropped EXE
PID:3024 -
\??\c:\nnbbtn.exec:\nnbbtn.exe27⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pjvpj.exec:\pjvpj.exe28⤵
- Executes dropped EXE
PID:900 -
\??\c:\fffrfrf.exec:\fffrfrf.exe29⤵
- Executes dropped EXE
PID:700 -
\??\c:\xrxfxrx.exec:\xrxfxrx.exe30⤵
- Executes dropped EXE
PID:1868 -
\??\c:\5tnntt.exec:\5tnntt.exe31⤵
- Executes dropped EXE
PID:1724 -
\??\c:\dvpdv.exec:\dvpdv.exe32⤵
- Executes dropped EXE
PID:2960 -
\??\c:\dpdvd.exec:\dpdvd.exe33⤵
- Executes dropped EXE
PID:1688 -
\??\c:\rrrrfxl.exec:\rrrrfxl.exe34⤵
- Executes dropped EXE
PID:1976 -
\??\c:\bbhhtb.exec:\bbhhtb.exe35⤵
- Executes dropped EXE
PID:2272 -
\??\c:\9nnhnb.exec:\9nnhnb.exe36⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vjvdj.exec:\vjvdj.exe37⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jjvjj.exec:\jjvjj.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\xxfxrfx.exec:\xxfxrfx.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\lrrlffl.exec:\lrrlffl.exe40⤵
- Executes dropped EXE
PID:2596 -
\??\c:\3nhnht.exec:\3nhnht.exe41⤵
- Executes dropped EXE
PID:2332 -
\??\c:\tnhhtt.exec:\tnhhtt.exe42⤵
- Executes dropped EXE
PID:2652 -
\??\c:\dvppv.exec:\dvppv.exe43⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jppdv.exec:\jppdv.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\fxrxflr.exec:\fxrxflr.exe45⤵
- Executes dropped EXE
PID:2988 -
\??\c:\llllffr.exec:\llllffr.exe46⤵
- Executes dropped EXE
PID:372 -
\??\c:\1tnbnn.exec:\1tnbnn.exe47⤵
- Executes dropped EXE
PID:2164 -
\??\c:\7jjjv.exec:\7jjjv.exe48⤵
- Executes dropped EXE
PID:1468 -
\??\c:\9jjvd.exec:\9jjvd.exe49⤵
- Executes dropped EXE
PID:1276 -
\??\c:\3ffflrx.exec:\3ffflrx.exe50⤵
- Executes dropped EXE
PID:2440 -
\??\c:\1rlrllx.exec:\1rlrllx.exe51⤵
- Executes dropped EXE
PID:1236 -
\??\c:\3bhbtb.exec:\3bhbtb.exe52⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vpjvd.exec:\vpjvd.exe53⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rlxflrf.exec:\rlxflrf.exe54⤵
- Executes dropped EXE
PID:1896 -
\??\c:\7lllxfl.exec:\7lllxfl.exe55⤵
- Executes dropped EXE
PID:2564 -
\??\c:\nhnthn.exec:\nhnthn.exe56⤵
- Executes dropped EXE
PID:1272 -
\??\c:\1hbhnb.exec:\1hbhnb.exe57⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1pppd.exec:\1pppd.exe58⤵
- Executes dropped EXE
PID:2792 -
\??\c:\rllrfrx.exec:\rllrfrx.exe59⤵
- Executes dropped EXE
PID:1936 -
\??\c:\3fflrxf.exec:\3fflrxf.exe60⤵
- Executes dropped EXE
PID:1848 -
\??\c:\hhhnhn.exec:\hhhnhn.exe61⤵
- Executes dropped EXE
PID:672 -
\??\c:\bnbbbh.exec:\bnbbbh.exe62⤵
- Executes dropped EXE
PID:2560 -
\??\c:\vdjvd.exec:\vdjvd.exe63⤵
- Executes dropped EXE
PID:2348 -
\??\c:\xlfllrx.exec:\xlfllrx.exe64⤵
- Executes dropped EXE
PID:2760 -
\??\c:\flllrff.exec:\flllrff.exe65⤵
- Executes dropped EXE
PID:912 -
\??\c:\tbnhhb.exec:\tbnhhb.exe66⤵PID:2532
-
\??\c:\jdjdj.exec:\jdjdj.exe67⤵PID:2984
-
\??\c:\jddjp.exec:\jddjp.exe68⤵PID:316
-
\??\c:\rlrxflr.exec:\rlrxflr.exe69⤵PID:2320
-
\??\c:\lfffllf.exec:\lfffllf.exe70⤵PID:2820
-
\??\c:\hbhhnn.exec:\hbhhnn.exe71⤵PID:1796
-
\??\c:\hbhnbn.exec:\hbhnbn.exe72⤵PID:2924
-
\??\c:\jvvdd.exec:\jvvdd.exe73⤵PID:1960
-
\??\c:\1frxxfl.exec:\1frxxfl.exe74⤵PID:3052
-
\??\c:\7rrrflf.exec:\7rrrflf.exe75⤵PID:108
-
\??\c:\hnhntb.exec:\hnhntb.exe76⤵PID:2072
-
\??\c:\nnnnhn.exec:\nnnnhn.exe77⤵PID:2572
-
\??\c:\vpdpv.exec:\vpdpv.exe78⤵PID:2068
-
\??\c:\frfrrxf.exec:\frfrrxf.exe79⤵PID:2620
-
\??\c:\ffrrffx.exec:\ffrrffx.exe80⤵PID:2664
-
\??\c:\btbbnt.exec:\btbbnt.exe81⤵PID:2580
-
\??\c:\3hhntb.exec:\3hhntb.exe82⤵PID:2500
-
\??\c:\7vddd.exec:\7vddd.exe83⤵PID:2684
-
\??\c:\5lrrxxf.exec:\5lrrxxf.exe84⤵PID:2464
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe85⤵PID:2528
-
\??\c:\hhbnth.exec:\hhbnth.exe86⤵PID:660
-
\??\c:\thhbhb.exec:\thhbhb.exe87⤵PID:2252
-
\??\c:\1dpvj.exec:\1dpvj.exe88⤵PID:1684
-
\??\c:\1vpdp.exec:\1vpdp.exe89⤵PID:1500
-
\??\c:\fxlrxfx.exec:\fxlrxfx.exe90⤵PID:852
-
\??\c:\llxxlrx.exec:\llxxlrx.exe91⤵PID:2752
-
\??\c:\tnhtnt.exec:\tnhtnt.exe92⤵PID:1716
-
\??\c:\jvpdp.exec:\jvpdp.exe93⤵PID:1756
-
\??\c:\ppjjd.exec:\ppjjd.exe94⤵PID:2180
-
\??\c:\3rrlrxl.exec:\3rrlrxl.exe95⤵PID:1664
-
\??\c:\nbtbhn.exec:\nbtbhn.exe96⤵PID:1904
-
\??\c:\hnbnbn.exec:\hnbnbn.exe97⤵PID:1284
-
\??\c:\7pddj.exec:\7pddj.exe98⤵PID:888
-
\??\c:\jjdjv.exec:\jjdjv.exe99⤵PID:2912
-
\??\c:\flfxlfx.exec:\flfxlfx.exe100⤵PID:2780
-
\??\c:\5xflfrx.exec:\5xflfrx.exe101⤵PID:1204
-
\??\c:\tbnhhb.exec:\tbnhhb.exe102⤵PID:2408
-
\??\c:\jddjj.exec:\jddjj.exe103⤵PID:320
-
\??\c:\jdpvd.exec:\jdpvd.exe104⤵PID:580
-
\??\c:\rlxxflf.exec:\rlxxflf.exe105⤵PID:276
-
\??\c:\fxflflx.exec:\fxflflx.exe106⤵PID:932
-
\??\c:\nnntnt.exec:\nnntnt.exe107⤵PID:2020
-
\??\c:\ttnnhh.exec:\ttnnhh.exe108⤵PID:3068
-
\??\c:\dvvpp.exec:\dvvpp.exe109⤵PID:764
-
\??\c:\ppjpj.exec:\ppjpj.exe110⤵PID:612
-
\??\c:\rfxrffr.exec:\rfxrffr.exe111⤵PID:1484
-
\??\c:\xxllrrx.exec:\xxllrrx.exe112⤵PID:736
-
\??\c:\9nhbnt.exec:\9nhbnt.exe113⤵PID:2092
-
\??\c:\bhnhnh.exec:\bhnhnh.exe114⤵PID:1856
-
\??\c:\7vpdd.exec:\7vpdd.exe115⤵PID:880
-
\??\c:\pjdjj.exec:\pjdjj.exe116⤵PID:2084
-
\??\c:\xfllflx.exec:\xfllflx.exe117⤵PID:2936
-
\??\c:\thnhbb.exec:\thnhbb.exe118⤵PID:108
-
\??\c:\9nbbbn.exec:\9nbbbn.exe119⤵PID:2644
-
\??\c:\9vpvd.exec:\9vpvd.exe120⤵PID:2608
-
\??\c:\pdvvj.exec:\pdvvj.exe121⤵PID:3060
-
\??\c:\llxflxf.exec:\llxflxf.exe122⤵PID:2688
-
\??\c:\bhtntn.exec:\bhtntn.exe123⤵PID:2672
-
\??\c:\nhnnbb.exec:\nhnnbb.exe124⤵PID:2552
-
\??\c:\jdvvd.exec:\jdvvd.exe125⤵PID:2332
-
\??\c:\vvpjv.exec:\vvpjv.exe126⤵PID:2684
-
\??\c:\xflxfrl.exec:\xflxfrl.exe127⤵PID:2888
-
\??\c:\htnhbn.exec:\htnhbn.exe128⤵PID:1996
-
\??\c:\ntnthn.exec:\ntnthn.exe129⤵PID:2900
-
\??\c:\3vpdp.exec:\3vpdp.exe130⤵PID:1376
-
\??\c:\lfllxfx.exec:\lfllxfx.exe131⤵PID:2356
-
\??\c:\5llfflr.exec:\5llfflr.exe132⤵PID:996
-
\??\c:\tnhntb.exec:\tnhntb.exe133⤵PID:1612
-
\??\c:\tnhnbh.exec:\tnhnbh.exe134⤵PID:1580
-
\??\c:\pjdjv.exec:\pjdjv.exe135⤵PID:1236
-
\??\c:\ddvjp.exec:\ddvjp.exe136⤵PID:1572
-
\??\c:\lfflrxl.exec:\lfflrxl.exe137⤵PID:1888
-
\??\c:\ffxxflr.exec:\ffxxflr.exe138⤵PID:1328
-
\??\c:\7tbtth.exec:\7tbtth.exe139⤵PID:1028
-
\??\c:\hbhntb.exec:\hbhntb.exe140⤵PID:1272
-
\??\c:\jjvdv.exec:\jjvdv.exe141⤵PID:1208
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe142⤵PID:2788
-
\??\c:\1fxlxfl.exec:\1fxlxfl.exe143⤵PID:1972
-
\??\c:\bbthnt.exec:\bbthnt.exe144⤵PID:1964
-
\??\c:\tthntt.exec:\tthntt.exe145⤵PID:1064
-
\??\c:\dpvvd.exec:\dpvvd.exe146⤵PID:740
-
\??\c:\vpjvv.exec:\vpjvv.exe147⤵PID:596
-
\??\c:\rlflxlf.exec:\rlflxlf.exe148⤵PID:1712
-
\??\c:\tnnbbh.exec:\tnnbbh.exe149⤵PID:3024
-
\??\c:\bnhttn.exec:\bnhttn.exe150⤵PID:336
-
\??\c:\vpvdj.exec:\vpvdj.exe151⤵PID:944
-
\??\c:\5dpdj.exec:\5dpdj.exe152⤵PID:316
-
\??\c:\5llfxfx.exec:\5llfxfx.exe153⤵PID:3000
-
\??\c:\9bttnn.exec:\9bttnn.exe154⤵PID:1952
-
\??\c:\hhnthn.exec:\hhnthn.exe155⤵PID:2848
-
\??\c:\dvddd.exec:\dvddd.exe156⤵PID:2924
-
\??\c:\vvppv.exec:\vvppv.exe157⤵PID:2928
-
\??\c:\lxrlrrl.exec:\lxrlrrl.exe158⤵PID:1440
-
\??\c:\3ffxfxx.exec:\3ffxfxx.exe159⤵PID:2220
-
\??\c:\7hhbnt.exec:\7hhbnt.exe160⤵PID:1672
-
\??\c:\tnbhnh.exec:\tnbhnh.exe161⤵PID:1660
-
\??\c:\jjdpd.exec:\jjdpd.exe162⤵PID:2660
-
\??\c:\rxrflrl.exec:\rxrflrl.exe163⤵PID:2588
-
\??\c:\xxfrfrf.exec:\xxfrfrf.exe164⤵PID:2728
-
\??\c:\nhthnn.exec:\nhthnn.exe165⤵PID:2704
-
\??\c:\btbnbt.exec:\btbnbt.exe166⤵PID:2520
-
\??\c:\7jvdp.exec:\7jvdp.exe167⤵PID:2496
-
\??\c:\rxxrlxr.exec:\rxxrlxr.exe168⤵PID:2188
-
\??\c:\3rllllx.exec:\3rllllx.exe169⤵PID:1988
-
\??\c:\hbhhtt.exec:\hbhhtt.exe170⤵PID:2896
-
\??\c:\hbtntn.exec:\hbtntn.exe171⤵PID:2192
-
\??\c:\1vdjv.exec:\1vdjv.exe172⤵PID:1696
-
\??\c:\vvjvd.exec:\vvjvd.exe173⤵PID:1900
-
\??\c:\fxrrffl.exec:\fxrrffl.exe174⤵PID:852
-
\??\c:\1flfxfx.exec:\1flfxfx.exe175⤵PID:1436
-
\??\c:\ntnhhb.exec:\ntnhhb.exe176⤵PID:2148
-
\??\c:\dvpvd.exec:\dvpvd.exe177⤵PID:1800
-
\??\c:\ppppj.exec:\ppppj.exe178⤵PID:1556
-
\??\c:\rlflxfr.exec:\rlflxfr.exe179⤵PID:2640
-
\??\c:\rllrffr.exec:\rllrffr.exe180⤵PID:2756
-
\??\c:\jjvvp.exec:\jjvvp.exe181⤵PID:2908
-
\??\c:\7ppjp.exec:\7ppjp.exe182⤵PID:2768
-
\??\c:\flfrrfx.exec:\flfrrfx.exe183⤵PID:2772
-
\??\c:\lfxlffx.exec:\lfxlffx.exe184⤵PID:2764
-
\??\c:\tthhtb.exec:\tthhtb.exe185⤵PID:776
-
\??\c:\ntnnbb.exec:\ntnnbb.exe186⤵PID:704
-
\??\c:\ddvjv.exec:\ddvjv.exe187⤵PID:2560
-
\??\c:\ffxxfxr.exec:\ffxxfxr.exe188⤵PID:608
-
\??\c:\hbtnbh.exec:\hbtnbh.exe189⤵PID:3044
-
\??\c:\pjvdp.exec:\pjvdp.exe190⤵PID:352
-
\??\c:\jjpvd.exec:\jjpvd.exe191⤵PID:1512
-
\??\c:\xxlllfx.exec:\xxlllfx.exe192⤵PID:2868
-
\??\c:\5llflrx.exec:\5llflrx.exe193⤵PID:900
-
\??\c:\htnbbb.exec:\htnbbb.exe194⤵PID:700
-
\??\c:\hhbhbb.exec:\hhbhbb.exe195⤵PID:3028
-
\??\c:\vpdjv.exec:\vpdjv.exe196⤵PID:1984
-
\??\c:\dvpvv.exec:\dvpvv.exe197⤵PID:3056
-
\??\c:\fxrxxxf.exec:\fxrxxxf.exe198⤵PID:1960
-
\??\c:\9xrlxrx.exec:\9xrlxrx.exe199⤵PID:1688
-
\??\c:\tnhnnn.exec:\tnhnnn.exe200⤵PID:2344
-
\??\c:\1bbtbb.exec:\1bbtbb.exe201⤵PID:2072
-
\??\c:\ppjdp.exec:\ppjdp.exe202⤵PID:2568
-
\??\c:\pdddj.exec:\pdddj.exe203⤵PID:3008
-
\??\c:\rrrxfrl.exec:\rrrxfrl.exe204⤵PID:2668
-
\??\c:\xrlrrfx.exec:\xrlrrfx.exe205⤵PID:2724
-
\??\c:\btnthn.exec:\btnthn.exe206⤵PID:2720
-
\??\c:\hbnbbn.exec:\hbnbbn.exe207⤵PID:2712
-
\??\c:\djppv.exec:\djppv.exe208⤵PID:2652
-
\??\c:\ppjpp.exec:\ppjpp.exe209⤵PID:2696
-
\??\c:\3rxffll.exec:\3rxffll.exe210⤵PID:2516
-
\??\c:\9lfflrf.exec:\9lfflrf.exe211⤵PID:660
-
\??\c:\bhnttn.exec:\bhnttn.exe212⤵PID:2184
-
\??\c:\7tthbh.exec:\7tthbh.exe213⤵PID:1456
-
\??\c:\ppdpp.exec:\ppdpp.exe214⤵PID:1500
-
\??\c:\ppvvj.exec:\ppvvj.exe215⤵PID:1884
-
\??\c:\fxxxlxf.exec:\fxxxlxf.exe216⤵PID:2748
-
\??\c:\bbbnbh.exec:\bbbnbh.exe217⤵PID:2384
-
\??\c:\tbbhbh.exec:\tbbhbh.exe218⤵PID:1624
-
\??\c:\dvppv.exec:\dvppv.exe219⤵PID:2180
-
\??\c:\3xrxffl.exec:\3xrxffl.exe220⤵PID:1252
-
\??\c:\rlllrlx.exec:\rlllrlx.exe221⤵PID:1904
-
\??\c:\bthntn.exec:\bthntn.exe222⤵PID:1284
-
\??\c:\bbnnnb.exec:\bbnnnb.exe223⤵PID:2504
-
\??\c:\dvjpv.exec:\dvjpv.exe224⤵PID:2792
-
\??\c:\pdpjp.exec:\pdpjp.exe225⤵PID:2228
-
\??\c:\5fxflfr.exec:\5fxflfr.exe226⤵PID:2880
-
\??\c:\7lfxxrf.exec:\7lfxxrf.exe227⤵PID:2428
-
\??\c:\bthntt.exec:\bthntt.exe228⤵PID:576
-
\??\c:\djppp.exec:\djppp.exe229⤵PID:320
-
\??\c:\vjdjv.exec:\vjdjv.exe230⤵PID:1416
-
\??\c:\fxllxff.exec:\fxllxff.exe231⤵PID:2288
-
\??\c:\rlflxfr.exec:\rlflxfr.exe232⤵PID:912
-
\??\c:\bnthhn.exec:\bnthhn.exe233⤵PID:800
-
\??\c:\nhhbbb.exec:\nhhbbb.exe234⤵PID:1640
-
\??\c:\vpddp.exec:\vpddp.exe235⤵PID:764
-
\??\c:\pvpvj.exec:\pvpvj.exe236⤵PID:2060
-
\??\c:\llxrfll.exec:\llxrfll.exe237⤵PID:1484
-
\??\c:\hhttnb.exec:\hhttnb.exe238⤵PID:988
-
\??\c:\nhbntb.exec:\nhbntb.exe239⤵PID:2092
-
\??\c:\1djpd.exec:\1djpd.exe240⤵PID:1724
-
\??\c:\9ddpj.exec:\9ddpj.exe241⤵PID:3052
-
\??\c:\rlxrxxl.exec:\rlxrxxl.exe242⤵PID:2920