Analysis
-
max time kernel
47s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 20:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
472af602d931481ceca262d84d4c3610_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
472af602d931481ceca262d84d4c3610_NeikiAnalytics.exe
-
Size
66KB
-
MD5
472af602d931481ceca262d84d4c3610
-
SHA1
37bde34c39af7c0f436e59c3c6953408c9688af5
-
SHA256
5cbe46049fb7d70918fa26d200510da339fc2023784b7086a69f012609b204b7
-
SHA512
14c1159e4e8bf2e49da58aff7d67157fb126bbaea0fe4fa373262b5e1680f01546102b678fd4e4ae1154948e2e2ac4c3a833697120ef3b7c6ac93677b7185c2f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUPqrDZl:ymb3NkkiQ3mdBjF0yUmH
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2448-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/752-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-2016-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1416-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1052-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/668-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1260-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1360-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-86-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-76-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1pdvd.exejvdjv.exe9vjvj.exellfrlrf.exebthnbh.exethbhtt.exevpjpj.exedvppd.exe9dpvd.exexrffrrf.exexrlrflx.exelfrxlfr.exenhbhtt.exepjvvj.exe3jdjv.exedvpjp.exelfrxxff.exe7xlxrxl.exehbthth.exe3nbhbb.exebbtbhh.exevvvvd.exejdvjp.exexxrfrxl.exe1ffrxlx.exe7rrxrxf.exennnnbh.exehbthnb.exevpjpj.exeppjpj.exelfllxrf.exerlflrrr.exeffrlrxl.exetnbhnb.exe5hbhhn.exehhhhtb.exeddpdp.exejjvdv.exe9ppdd.exe9fxfffr.exexxrrffr.exerlfrxrf.exe7hbnbt.exehtnthh.exehhhnbh.exevjdjd.exe3vpvj.exerflrffl.exefxrfrxr.exe9xflxfr.exebbtbht.exe3htbbn.exe5jpjp.exepvddp.exedjpdv.exepjvjv.exe9xrxffl.exellxrlrx.exexrffxfr.exehnthtt.exe1hhnhn.exe5tnhnt.exedvjvp.exe1dvvj.exepid process 1920 1pdvd.exe 2340 jvdjv.exe 2620 9vjvj.exe 2404 llfrlrf.exe 2500 bthnbh.exe 2512 thbhtt.exe 2448 vpjpj.exe 3068 dvppd.exe 2660 9dpvd.exe 2636 xrffrrf.exe 352 xrlrflx.exe 1360 lfrxlfr.exe 1736 nhbhtt.exe 1260 pjvvj.exe 2788 3jdjv.exe 2180 dvpjp.exe 2012 lfrxxff.exe 752 7xlxrxl.exe 1988 hbthth.exe 1628 3nbhbb.exe 668 bbtbhh.exe 1052 vvvvd.exe 544 jdvjp.exe 1188 xxrfrxl.exe 1908 1ffrxlx.exe 844 7rrxrxf.exe 2160 nnnnbh.exe 2484 hbthnb.exe 2988 vpjpj.exe 1416 ppjpj.exe 2912 lfllxrf.exe 1920 rlflrrr.exe 1508 ffrlrxl.exe 2552 tnbhnb.exe 2516 5hbhhn.exe 2928 hhhhtb.exe 2728 ddpdp.exe 2512 jjvdv.exe 2900 9ppdd.exe 2576 9fxfffr.exe 2672 xxrrffr.exe 2756 rlfrxrf.exe 2956 7hbnbt.exe 1584 htnthh.exe 1360 hhhnbh.exe 2312 vjdjd.exe 872 3vpvj.exe 2168 rflrffl.exe 2736 fxrfrxr.exe 1668 9xflxfr.exe 2436 bbtbht.exe 752 3htbbn.exe 2220 5jpjp.exe 1556 pvddp.exe 488 djpdv.exe 688 pjvjv.exe 588 9xrxffl.exe 1140 llxrlrx.exe 2880 xrffxfr.exe 2216 hnthtt.exe 472 1hhnhn.exe 2844 5tnhnt.exe 2064 dvjvp.exe 1176 1dvvj.exe -
Processes:
resource yara_rule behavioral1/memory/2448-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/752-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-2016-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1416-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1052-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1260-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
472af602d931481ceca262d84d4c3610_NeikiAnalytics.exe1pdvd.exejvdjv.exe9vjvj.exellfrlrf.exebthnbh.exethbhtt.exevpjpj.exedvppd.exe9dpvd.exexrffrrf.exexrlrflx.exelfrxlfr.exenhbhtt.exepjvvj.exe3jdjv.exedescription pid process target process PID 2872 wrote to memory of 1920 2872 472af602d931481ceca262d84d4c3610_NeikiAnalytics.exe 1pdvd.exe PID 2872 wrote to memory of 1920 2872 472af602d931481ceca262d84d4c3610_NeikiAnalytics.exe 1pdvd.exe PID 2872 wrote to memory of 1920 2872 472af602d931481ceca262d84d4c3610_NeikiAnalytics.exe 1pdvd.exe PID 2872 wrote to memory of 1920 2872 472af602d931481ceca262d84d4c3610_NeikiAnalytics.exe 1pdvd.exe PID 1920 wrote to memory of 2340 1920 1pdvd.exe jvdjv.exe PID 1920 wrote to memory of 2340 1920 1pdvd.exe jvdjv.exe PID 1920 wrote to memory of 2340 1920 1pdvd.exe jvdjv.exe PID 1920 wrote to memory of 2340 1920 1pdvd.exe jvdjv.exe PID 2340 wrote to memory of 2620 2340 jvdjv.exe 9vjvj.exe PID 2340 wrote to memory of 2620 2340 jvdjv.exe 9vjvj.exe PID 2340 wrote to memory of 2620 2340 jvdjv.exe 9vjvj.exe PID 2340 wrote to memory of 2620 2340 jvdjv.exe 9vjvj.exe PID 2620 wrote to memory of 2404 2620 9vjvj.exe llfrlrf.exe PID 2620 wrote to memory of 2404 2620 9vjvj.exe llfrlrf.exe PID 2620 wrote to memory of 2404 2620 9vjvj.exe llfrlrf.exe PID 2620 wrote to memory of 2404 2620 9vjvj.exe llfrlrf.exe PID 2404 wrote to memory of 2500 2404 llfrlrf.exe bthnbh.exe PID 2404 wrote to memory of 2500 2404 llfrlrf.exe bthnbh.exe PID 2404 wrote to memory of 2500 2404 llfrlrf.exe bthnbh.exe PID 2404 wrote to memory of 2500 2404 llfrlrf.exe bthnbh.exe PID 2500 wrote to memory of 2512 2500 bthnbh.exe jjvdv.exe PID 2500 wrote to memory of 2512 2500 bthnbh.exe jjvdv.exe PID 2500 wrote to memory of 2512 2500 bthnbh.exe jjvdv.exe PID 2500 wrote to memory of 2512 2500 bthnbh.exe jjvdv.exe PID 2512 wrote to memory of 2448 2512 thbhtt.exe vpjpj.exe PID 2512 wrote to memory of 2448 2512 thbhtt.exe vpjpj.exe PID 2512 wrote to memory of 2448 2512 thbhtt.exe vpjpj.exe PID 2512 wrote to memory of 2448 2512 thbhtt.exe vpjpj.exe PID 2448 wrote to memory of 3068 2448 vpjpj.exe dvppd.exe PID 2448 wrote to memory of 3068 2448 vpjpj.exe dvppd.exe PID 2448 wrote to memory of 3068 2448 vpjpj.exe dvppd.exe PID 2448 wrote to memory of 3068 2448 vpjpj.exe dvppd.exe PID 3068 wrote to memory of 2660 3068 dvppd.exe 9dpvd.exe PID 3068 wrote to memory of 2660 3068 dvppd.exe 9dpvd.exe PID 3068 wrote to memory of 2660 3068 dvppd.exe 9dpvd.exe PID 3068 wrote to memory of 2660 3068 dvppd.exe 9dpvd.exe PID 2660 wrote to memory of 2636 2660 9dpvd.exe xrffrrf.exe PID 2660 wrote to memory of 2636 2660 9dpvd.exe xrffrrf.exe PID 2660 wrote to memory of 2636 2660 9dpvd.exe xrffrrf.exe PID 2660 wrote to memory of 2636 2660 9dpvd.exe xrffrrf.exe PID 2636 wrote to memory of 352 2636 xrffrrf.exe xrlrflx.exe PID 2636 wrote to memory of 352 2636 xrffrrf.exe xrlrflx.exe PID 2636 wrote to memory of 352 2636 xrffrrf.exe xrlrflx.exe PID 2636 wrote to memory of 352 2636 xrffrrf.exe xrlrflx.exe PID 352 wrote to memory of 1360 352 xrlrflx.exe lfrxlfr.exe PID 352 wrote to memory of 1360 352 xrlrflx.exe lfrxlfr.exe PID 352 wrote to memory of 1360 352 xrlrflx.exe lfrxlfr.exe PID 352 wrote to memory of 1360 352 xrlrflx.exe lfrxlfr.exe PID 1360 wrote to memory of 1736 1360 lfrxlfr.exe nhbhtt.exe PID 1360 wrote to memory of 1736 1360 lfrxlfr.exe nhbhtt.exe PID 1360 wrote to memory of 1736 1360 lfrxlfr.exe nhbhtt.exe PID 1360 wrote to memory of 1736 1360 lfrxlfr.exe nhbhtt.exe PID 1736 wrote to memory of 1260 1736 nhbhtt.exe pjvvj.exe PID 1736 wrote to memory of 1260 1736 nhbhtt.exe pjvvj.exe PID 1736 wrote to memory of 1260 1736 nhbhtt.exe pjvvj.exe PID 1736 wrote to memory of 1260 1736 nhbhtt.exe pjvvj.exe PID 1260 wrote to memory of 2788 1260 pjvvj.exe 3jdjv.exe PID 1260 wrote to memory of 2788 1260 pjvvj.exe 3jdjv.exe PID 1260 wrote to memory of 2788 1260 pjvvj.exe 3jdjv.exe PID 1260 wrote to memory of 2788 1260 pjvvj.exe 3jdjv.exe PID 2788 wrote to memory of 2180 2788 3jdjv.exe dvpjp.exe PID 2788 wrote to memory of 2180 2788 3jdjv.exe dvpjp.exe PID 2788 wrote to memory of 2180 2788 3jdjv.exe dvpjp.exe PID 2788 wrote to memory of 2180 2788 3jdjv.exe dvpjp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\472af602d931481ceca262d84d4c3610_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\472af602d931481ceca262d84d4c3610_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\1pdvd.exec:\1pdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\jvdjv.exec:\jvdjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\9vjvj.exec:\9vjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\llfrlrf.exec:\llfrlrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\bthnbh.exec:\bthnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\thbhtt.exec:\thbhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\vpjpj.exec:\vpjpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\dvppd.exec:\dvppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\9dpvd.exec:\9dpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\xrffrrf.exec:\xrffrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\xrlrflx.exec:\xrlrflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\lfrxlfr.exec:\lfrxlfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\nhbhtt.exec:\nhbhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\pjvvj.exec:\pjvvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\3jdjv.exec:\3jdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\dvpjp.exec:\dvpjp.exe17⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lfrxxff.exec:\lfrxxff.exe18⤵
- Executes dropped EXE
PID:2012 -
\??\c:\7xlxrxl.exec:\7xlxrxl.exe19⤵
- Executes dropped EXE
PID:752 -
\??\c:\hbthth.exec:\hbthth.exe20⤵
- Executes dropped EXE
PID:1988 -
\??\c:\3nbhbb.exec:\3nbhbb.exe21⤵
- Executes dropped EXE
PID:1628 -
\??\c:\bbtbhh.exec:\bbtbhh.exe22⤵
- Executes dropped EXE
PID:668 -
\??\c:\vvvvd.exec:\vvvvd.exe23⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jdvjp.exec:\jdvjp.exe24⤵
- Executes dropped EXE
PID:544 -
\??\c:\xxrfrxl.exec:\xxrfrxl.exe25⤵
- Executes dropped EXE
PID:1188 -
\??\c:\1ffrxlx.exec:\1ffrxlx.exe26⤵
- Executes dropped EXE
PID:1908 -
\??\c:\7rrxrxf.exec:\7rrxrxf.exe27⤵
- Executes dropped EXE
PID:844 -
\??\c:\nnnnbh.exec:\nnnnbh.exe28⤵
- Executes dropped EXE
PID:2160 -
\??\c:\hbthnb.exec:\hbthnb.exe29⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vpjpj.exec:\vpjpj.exe30⤵
- Executes dropped EXE
PID:2988 -
\??\c:\ppjpj.exec:\ppjpj.exe31⤵
- Executes dropped EXE
PID:1416 -
\??\c:\lfllxrf.exec:\lfllxrf.exe32⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rlflrrr.exec:\rlflrrr.exe33⤵
- Executes dropped EXE
PID:1920 -
\??\c:\ffrlrxl.exec:\ffrlrxl.exe34⤵
- Executes dropped EXE
PID:1508 -
\??\c:\tnbhnb.exec:\tnbhnb.exe35⤵
- Executes dropped EXE
PID:2552 -
\??\c:\5hbhhn.exec:\5hbhhn.exe36⤵
- Executes dropped EXE
PID:2516 -
\??\c:\hhhhtb.exec:\hhhhtb.exe37⤵
- Executes dropped EXE
PID:2928 -
\??\c:\ddpdp.exec:\ddpdp.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\jjvdv.exec:\jjvdv.exe39⤵
- Executes dropped EXE
PID:2512 -
\??\c:\9ppdd.exec:\9ppdd.exe40⤵
- Executes dropped EXE
PID:2900 -
\??\c:\9fxfffr.exec:\9fxfffr.exe41⤵
- Executes dropped EXE
PID:2576 -
\??\c:\xxrrffr.exec:\xxrrffr.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rlfrxrf.exec:\rlfrxrf.exe43⤵
- Executes dropped EXE
PID:2756 -
\??\c:\7hbnbt.exec:\7hbnbt.exe44⤵
- Executes dropped EXE
PID:2956 -
\??\c:\htnthh.exec:\htnthh.exe45⤵
- Executes dropped EXE
PID:1584 -
\??\c:\hhhnbh.exec:\hhhnbh.exe46⤵
- Executes dropped EXE
PID:1360 -
\??\c:\vjdjd.exec:\vjdjd.exe47⤵
- Executes dropped EXE
PID:2312 -
\??\c:\3vpvj.exec:\3vpvj.exe48⤵
- Executes dropped EXE
PID:872 -
\??\c:\rflrffl.exec:\rflrffl.exe49⤵
- Executes dropped EXE
PID:2168 -
\??\c:\fxrfrxr.exec:\fxrfrxr.exe50⤵
- Executes dropped EXE
PID:2736 -
\??\c:\9xflxfr.exec:\9xflxfr.exe51⤵
- Executes dropped EXE
PID:1668 -
\??\c:\bbtbht.exec:\bbtbht.exe52⤵
- Executes dropped EXE
PID:2436 -
\??\c:\3htbbn.exec:\3htbbn.exe53⤵
- Executes dropped EXE
PID:752 -
\??\c:\5jpjp.exec:\5jpjp.exe54⤵
- Executes dropped EXE
PID:2220 -
\??\c:\pvddp.exec:\pvddp.exe55⤵
- Executes dropped EXE
PID:1556 -
\??\c:\djpdv.exec:\djpdv.exe56⤵
- Executes dropped EXE
PID:488 -
\??\c:\pjvjv.exec:\pjvjv.exe57⤵
- Executes dropped EXE
PID:688 -
\??\c:\9xrxffl.exec:\9xrxffl.exe58⤵
- Executes dropped EXE
PID:588 -
\??\c:\llxrlrx.exec:\llxrlrx.exe59⤵
- Executes dropped EXE
PID:1140 -
\??\c:\xrffxfr.exec:\xrffxfr.exe60⤵
- Executes dropped EXE
PID:2880 -
\??\c:\hnthtt.exec:\hnthtt.exe61⤵
- Executes dropped EXE
PID:2216 -
\??\c:\1hhnhn.exec:\1hhnhn.exe62⤵
- Executes dropped EXE
PID:472 -
\??\c:\5tnhnt.exec:\5tnhnt.exe63⤵
- Executes dropped EXE
PID:2844 -
\??\c:\dvjvp.exec:\dvjvp.exe64⤵
- Executes dropped EXE
PID:2064 -
\??\c:\1dvvj.exec:\1dvvj.exe65⤵
- Executes dropped EXE
PID:1176 -
\??\c:\llllxxl.exec:\llllxxl.exe66⤵PID:1184
-
\??\c:\7llrffr.exec:\7llrffr.exe67⤵PID:1532
-
\??\c:\fxrxlrx.exec:\fxrxlrx.exe68⤵PID:1420
-
\??\c:\nnbnth.exec:\nnbnth.exe69⤵PID:2872
-
\??\c:\tnhtnt.exec:\tnhtnt.exe70⤵PID:1516
-
\??\c:\nhnhbb.exec:\nhnhbb.exe71⤵PID:1484
-
\??\c:\pjvdj.exec:\pjvdj.exe72⤵PID:2820
-
\??\c:\1pjjp.exec:\1pjjp.exe73⤵PID:2424
-
\??\c:\ddvvj.exec:\ddvvj.exe74⤵PID:2908
-
\??\c:\xrrlxxl.exec:\xrrlxxl.exe75⤵PID:2400
-
\??\c:\ffrfffr.exec:\ffrfffr.exe76⤵PID:3024
-
\??\c:\7rrlxrx.exec:\7rrlxrx.exe77⤵PID:1780
-
\??\c:\ththtt.exec:\ththtt.exe78⤵PID:1440
-
\??\c:\nbnhbn.exec:\nbnhbn.exe79⤵PID:2676
-
\??\c:\htbthn.exec:\htbthn.exe80⤵PID:868
-
\??\c:\nbhhtb.exec:\nbhhtb.exe81⤵PID:2152
-
\??\c:\pjvdj.exec:\pjvdj.exe82⤵PID:2636
-
\??\c:\vjpvj.exec:\vjpvj.exe83⤵PID:1300
-
\??\c:\xxlrrxl.exec:\xxlrrxl.exe84⤵PID:1948
-
\??\c:\5frrlll.exec:\5frrlll.exe85⤵PID:356
-
\??\c:\fxlrffx.exec:\fxlrffx.exe86⤵PID:1640
-
\??\c:\tbnnht.exec:\tbnnht.exe87⤵PID:2132
-
\??\c:\9hthnt.exec:\9hthnt.exe88⤵PID:2020
-
\??\c:\bbnbnb.exec:\bbnbnb.exe89⤵PID:2876
-
\??\c:\vpvvp.exec:\vpvvp.exe90⤵PID:2496
-
\??\c:\ddpvj.exec:\ddpvj.exe91⤵PID:2012
-
\??\c:\vvpdj.exec:\vvpdj.exe92⤵PID:1760
-
\??\c:\9jdvv.exec:\9jdvv.exe93⤵PID:1924
-
\??\c:\5xrxlrf.exec:\5xrxlrf.exe94⤵PID:1692
-
\??\c:\lflxllr.exec:\lflxllr.exe95⤵PID:1628
-
\??\c:\fxlxlrf.exec:\fxlxlrf.exe96⤵PID:896
-
\??\c:\hbtntb.exec:\hbtntb.exe97⤵PID:2372
-
\??\c:\nnbhtn.exec:\nnbhtn.exe98⤵PID:348
-
\??\c:\tnbbnt.exec:\tnbbnt.exe99⤵PID:612
-
\??\c:\btntbh.exec:\btntbh.exe100⤵PID:696
-
\??\c:\dvjdj.exec:\dvjdj.exe101⤵PID:880
-
\??\c:\jjjpp.exec:\jjjpp.exe102⤵PID:2836
-
\??\c:\pdvjp.exec:\pdvjp.exe103⤵PID:472
-
\??\c:\9xlfllr.exec:\9xlfllr.exe104⤵PID:2164
-
\??\c:\rlxrflx.exec:\rlxrflx.exe105⤵PID:1900
-
\??\c:\ttntnn.exec:\ttntnn.exe106⤵PID:1876
-
\??\c:\bthbtn.exec:\bthbtn.exe107⤵PID:972
-
\??\c:\3hbhtb.exec:\3hbhtb.exe108⤵PID:2920
-
\??\c:\vvvdj.exec:\vvvdj.exe109⤵PID:2544
-
\??\c:\vpjjd.exec:\vpjjd.exe110⤵PID:2624
-
\??\c:\9jvjj.exec:\9jvjj.exe111⤵PID:2548
-
\??\c:\pjvvd.exec:\pjvvd.exe112⤵PID:2620
-
\??\c:\7frrrxl.exec:\7frrrxl.exe113⤵PID:2696
-
\??\c:\pppvp.exec:\pppvp.exe114⤵PID:2440
-
\??\c:\vpjvp.exec:\vpjvp.exe115⤵PID:2928
-
\??\c:\ddvdj.exec:\ddvdj.exe116⤵PID:2476
-
\??\c:\rlfxrfx.exec:\rlfxrfx.exe117⤵PID:1664
-
\??\c:\rlxrlrl.exec:\rlxrlrl.exe118⤵PID:2816
-
\??\c:\5rlfllr.exec:\5rlfllr.exe119⤵PID:1440
-
\??\c:\tbtthb.exec:\tbtthb.exe120⤵PID:2772
-
\??\c:\7nnnnt.exec:\7nnnnt.exe121⤵PID:2744
-
\??\c:\hbtnhn.exec:\hbtnhn.exe122⤵PID:108
-
\??\c:\5nnttb.exec:\5nnttb.exe123⤵PID:2752
-
\??\c:\dvdjv.exec:\dvdjv.exe124⤵PID:804
-
\??\c:\vppjj.exec:\vppjj.exe125⤵PID:980
-
\??\c:\3dpjp.exec:\3dpjp.exe126⤵PID:2684
-
\??\c:\lxfflrf.exec:\lxfflrf.exe127⤵PID:2456
-
\??\c:\lrxxfxf.exec:\lrxxfxf.exe128⤵PID:2312
-
\??\c:\xxfllfl.exec:\xxfllfl.exe129⤵PID:2356
-
\??\c:\nhhtnn.exec:\nhhtnn.exe130⤵PID:2168
-
\??\c:\nnbbht.exec:\nnbbht.exe131⤵PID:2028
-
\??\c:\ntntnb.exec:\ntntnb.exe132⤵PID:2468
-
\??\c:\vvpdj.exec:\vvpdj.exe133⤵PID:1932
-
\??\c:\dvdpv.exec:\dvdpv.exe134⤵PID:2060
-
\??\c:\dpjvd.exec:\dpjvd.exe135⤵PID:2280
-
\??\c:\jdddv.exec:\jdddv.exe136⤵PID:1548
-
\??\c:\fxrxxfr.exec:\fxrxxfr.exe137⤵PID:1748
-
\??\c:\9xffrrr.exec:\9xffrrr.exe138⤵PID:840
-
\??\c:\fxxlrxr.exec:\fxxlrxr.exe139⤵PID:2092
-
\??\c:\hhtthn.exec:\hhtthn.exe140⤵PID:908
-
\??\c:\nhbhhh.exec:\nhbhhh.exe141⤵PID:2200
-
\??\c:\nhthtb.exec:\nhthtb.exe142⤵PID:3048
-
\??\c:\dvjjp.exec:\dvjjp.exe143⤵PID:3036
-
\??\c:\vpddp.exec:\vpddp.exe144⤵PID:1704
-
\??\c:\pjvdd.exec:\pjvdd.exe145⤵PID:288
-
\??\c:\fxllrxf.exec:\fxllrxf.exe146⤵PID:2484
-
\??\c:\ffxlfll.exec:\ffxlfll.exe147⤵PID:1888
-
\??\c:\xxlxflr.exec:\xxlxflr.exe148⤵PID:1268
-
\??\c:\hhbhbh.exec:\hhbhbh.exe149⤵PID:2148
-
\??\c:\hbthtb.exec:\hbthtb.exe150⤵PID:2508
-
\??\c:\hbnhnn.exec:\hbnhnn.exe151⤵PID:2332
-
\??\c:\pjvdp.exec:\pjvdp.exe152⤵PID:2548
-
\??\c:\ddjdd.exec:\ddjdd.exe153⤵PID:1912
-
\??\c:\dvvjp.exec:\dvvjp.exe154⤵PID:2664
-
\??\c:\pjpvp.exec:\pjpvp.exe155⤵PID:2472
-
\??\c:\9xxlxfl.exec:\9xxlxfl.exe156⤵PID:2500
-
\??\c:\llrfrrr.exec:\llrfrrr.exe157⤵PID:2512
-
\??\c:\rlxxflx.exec:\rlxxflx.exe158⤵PID:2932
-
\??\c:\btbbbb.exec:\btbbbb.exe159⤵PID:2740
-
\??\c:\nnhthn.exec:\nnhthn.exe160⤵PID:2904
-
\??\c:\tnnbhn.exec:\tnnbhn.exe161⤵PID:1252
-
\??\c:\vdjjv.exec:\vdjjv.exe162⤵PID:2756
-
\??\c:\5jdpd.exec:\5jdpd.exe163⤵PID:2688
-
\??\c:\frfflrr.exec:\frfflrr.exe164⤵PID:328
-
\??\c:\xxfllfx.exec:\xxfllfx.exe165⤵PID:2808
-
\??\c:\rxrrlxl.exec:\rxrrlxl.exe166⤵PID:2604
-
\??\c:\xxfxlff.exec:\xxfxlff.exe167⤵PID:1880
-
\??\c:\tntnbn.exec:\tntnbn.exe168⤵PID:1192
-
\??\c:\ttnnnt.exec:\ttnnnt.exe169⤵PID:2180
-
\??\c:\3jvpj.exec:\3jvpj.exe170⤵PID:3040
-
\??\c:\pddpv.exec:\pddpv.exe171⤵PID:2204
-
\??\c:\dvpvp.exec:\dvpvp.exe172⤵PID:2436
-
\??\c:\lxrlfrx.exec:\lxrlfrx.exe173⤵PID:1760
-
\??\c:\7fxlxfl.exec:\7fxlxfl.exe174⤵PID:336
-
\??\c:\lfrxrrf.exec:\lfrxrrf.exe175⤵PID:1544
-
\??\c:\1hbnnt.exec:\1hbnnt.exe176⤵PID:1628
-
\??\c:\nhbhnn.exec:\nhbhnn.exe177⤵PID:564
-
\??\c:\hbttnn.exec:\hbttnn.exe178⤵PID:1052
-
\??\c:\9vjpp.exec:\9vjpp.exe179⤵PID:2768
-
\??\c:\vdjjv.exec:\vdjjv.exe180⤵PID:1832
-
\??\c:\jjdjv.exec:\jjdjv.exe181⤵PID:1352
-
\??\c:\3xlxrxl.exec:\3xlxrxl.exe182⤵PID:844
-
\??\c:\rfrfffr.exec:\rfrfffr.exe183⤵PID:1608
-
\??\c:\1thnbn.exec:\1thnbn.exe184⤵PID:1896
-
\??\c:\nhnbbh.exec:\nhnbbh.exe185⤵PID:1404
-
\??\c:\9nhbbb.exec:\9nhbbb.exe186⤵PID:2988
-
\??\c:\ddjvp.exec:\ddjvp.exe187⤵PID:1876
-
\??\c:\jjvvj.exec:\jjvvj.exe188⤵PID:3016
-
\??\c:\vjvpd.exec:\vjvpd.exe189⤵PID:2952
-
\??\c:\5llxlll.exec:\5llxlll.exe190⤵PID:1620
-
\??\c:\xxlrflx.exec:\xxlrflx.exe191⤵PID:2532
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe192⤵PID:2072
-
\??\c:\5hthhh.exec:\5hthhh.exe193⤵PID:2404
-
\??\c:\1tnbbt.exec:\1tnbbt.exe194⤵PID:2696
-
\??\c:\1tnthn.exec:\1tnthn.exe195⤵PID:2564
-
\??\c:\5pddv.exec:\5pddv.exe196⤵PID:2416
-
\??\c:\dpppv.exec:\dpppv.exe197⤵PID:2476
-
\??\c:\dvjjd.exec:\dvjjd.exe198⤵PID:1664
-
\??\c:\frxrxxx.exec:\frxrxxx.exe199⤵PID:2816
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe200⤵PID:1440
-
\??\c:\lxrxlrl.exec:\lxrxlrl.exe201⤵PID:2616
-
\??\c:\xlxfrxr.exec:\xlxfrxr.exe202⤵PID:2744
-
\??\c:\bttnbt.exec:\bttnbt.exe203⤵PID:108
-
\??\c:\nhbhnh.exec:\nhbhnh.exe204⤵PID:2752
-
\??\c:\nbhtth.exec:\nbhtth.exe205⤵PID:2068
-
\??\c:\jdvvj.exec:\jdvvj.exe206⤵PID:980
-
\??\c:\djvpj.exec:\djvpj.exe207⤵PID:2684
-
\??\c:\ddvjv.exec:\ddvjv.exe208⤵PID:2456
-
\??\c:\lxfflll.exec:\lxfflll.exe209⤵PID:2312
-
\??\c:\rlxfxfr.exec:\rlxfxfr.exe210⤵PID:2356
-
\??\c:\rlxflrx.exec:\rlxflrx.exe211⤵PID:2168
-
\??\c:\nnbtnh.exec:\nnbtnh.exe212⤵PID:2496
-
\??\c:\nttbhn.exec:\nttbhn.exe213⤵PID:2468
-
\??\c:\bthnth.exec:\bthnth.exe214⤵PID:1932
-
\??\c:\bbntbn.exec:\bbntbn.exe215⤵PID:2608
-
\??\c:\ppvdv.exec:\ppvdv.exe216⤵PID:2280
-
\??\c:\5pddj.exec:\5pddj.exe217⤵PID:1564
-
\??\c:\ppppd.exec:\ppppd.exe218⤵PID:1748
-
\??\c:\xxlrlrr.exec:\xxlrlrr.exe219⤵PID:840
-
\??\c:\rlrxfrf.exec:\rlrxfrf.exe220⤵PID:2092
-
\??\c:\xrffxrf.exec:\xrffxrf.exe221⤵PID:908
-
\??\c:\btbnbh.exec:\btbnbh.exe222⤵PID:2200
-
\??\c:\3hbthh.exec:\3hbthh.exe223⤵PID:2480
-
\??\c:\7bthbn.exec:\7bthbn.exe224⤵PID:3036
-
\??\c:\nhnnbt.exec:\nhnnbt.exe225⤵PID:1704
-
\??\c:\pjdpv.exec:\pjdpv.exe226⤵PID:1404
-
\??\c:\jddvv.exec:\jddvv.exe227⤵PID:1900
-
\??\c:\7dpvv.exec:\7dpvv.exe228⤵PID:1888
-
\??\c:\1rlxrfl.exec:\1rlxrfl.exe229⤵PID:1268
-
\??\c:\fxlrlrf.exec:\fxlrlrf.exe230⤵PID:2148
-
\??\c:\1xrflxf.exec:\1xrflxf.exe231⤵PID:2508
-
\??\c:\7rffrxl.exec:\7rffrxl.exe232⤵PID:2332
-
\??\c:\1htnnt.exec:\1htnnt.exe233⤵PID:2556
-
\??\c:\1nhnbh.exec:\1nhnbh.exe234⤵PID:1912
-
\??\c:\htnnth.exec:\htnnth.exe235⤵PID:2664
-
\??\c:\dvpjv.exec:\dvpjv.exe236⤵PID:2472
-
\??\c:\3ppdj.exec:\3ppdj.exe237⤵PID:1588
-
\??\c:\vvppd.exec:\vvppd.exe238⤵PID:2512
-
\??\c:\frlfxxx.exec:\frlfxxx.exe239⤵PID:2932
-
\??\c:\lllxrxx.exec:\lllxrxx.exe240⤵PID:2740
-
\??\c:\xxxrxrf.exec:\xxxrxrf.exe241⤵PID:2904
-
\??\c:\5bbhtb.exec:\5bbhtb.exe242⤵PID:1252