Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 00:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3b75e875cc5b090a0033d134d6fe3b30_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3b75e875cc5b090a0033d134d6fe3b30_NeikiAnalytics.exe
-
Size
480KB
-
MD5
3b75e875cc5b090a0033d134d6fe3b30
-
SHA1
2df9085823f6eb84f48a80601f3b35ae41ffabe7
-
SHA256
e30e1e3a03fadd3485afa4d5e172bcbbd4cd4a01753670e0fdf09f685e7c4ef4
-
SHA512
a7fecc6c6049878591fca5b5b10bacf22ecf0bdc1028a6601848aa238068a79405ae7ccac5b0abe93962915227d4c5e708e2f76c7fa96d33b5f5a80be2dee737
-
SSDEEP
12288:n3C9uDVw6326pKZ9asZqoZHz+evcn0Meh2Fez1:Su326p0aroZt0s1
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2084-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1136-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1356-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1868-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/988-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1892-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7bntbh.exettnbhn.exepvvjd.exe5thhnn.exefxfrrll.exelllxlrf.exefxllxfr.exerrlrlxl.exe3pdpd.exerrlxlxl.exexrlrfxf.exe9hhhtn.exelflfxrl.exe7nnbhh.exerlxlrfr.exefffxrlr.exepjdpd.exennhnhh.exejdvvd.exenhbhth.exe1fxrxfr.exeppvdj.exefxrrffr.exedppjj.exelfxfxfr.exepvjpj.exexxrxlxr.exettnthn.exefxrxlrf.exejvpjv.exe1lllxxr.exe3ththn.exevdvjd.exe9xrxlxl.exehhhtbb.exe9ppdp.exefxrrfll.exe1rflflf.exe7bnhhh.exedvpdj.exexxrxfrf.exettnthh.exevvppd.exevvpvj.exefflrllx.exehnbtnn.exe7vppj.exe5djpd.exellflxlx.exetbbnbb.exejdpdv.exevvjjp.exefrlxffr.exebbnnbh.exe7tnbhn.exe7jjpj.exerlrxlrr.exennhbbh.exettnhnb.exe3vpjj.exerffffxf.exenhtbnt.exehnhnbh.exevvjjd.exepid process 2084 7bntbh.exe 2740 ttnbhn.exe 2668 pvvjd.exe 2880 5thhnn.exe 2780 fxfrrll.exe 2844 lllxlrf.exe 2640 fxllxfr.exe 2592 rrlrlxl.exe 2400 3pdpd.exe 1136 rrlxlxl.exe 2820 xrlrfxf.exe 2956 9hhhtn.exe 1724 lflfxrl.exe 1624 7nnbhh.exe 2200 rlxlrfr.exe 1356 fffxrlr.exe 1868 pjdpd.exe 1192 nnhnhh.exe 2836 jdvvd.exe 320 nhbhth.exe 988 1fxrxfr.exe 1092 ppvdj.exe 1080 fxrrffr.exe 444 dppjj.exe 2252 lfxfxfr.exe 1560 pvjpj.exe 1892 xxrxlxr.exe 2932 ttnthn.exe 2044 fxrxlrf.exe 2024 jvpjv.exe 2172 1lllxxr.exe 1496 3ththn.exe 3000 vdvjd.exe 2360 9xrxlxl.exe 1704 hhhtbb.exe 2228 9ppdp.exe 844 fxrrfll.exe 3036 1rflflf.exe 2684 7bnhhh.exe 2660 dvpdj.exe 2748 xxrxfrf.exe 2644 ttnthh.exe 2696 vvppd.exe 2544 vvpvj.exe 2540 fflrllx.exe 2984 hnbtnn.exe 1960 7vppj.exe 2812 5djpd.exe 2840 llflxlx.exe 2332 tbbnbb.exe 1888 jdpdv.exe 1728 vvjjp.exe 2420 frlxffr.exe 836 bbnnbh.exe 1668 7tnbhn.exe 1356 7jjpj.exe 2216 rlrxlrr.exe 2012 nnhbbh.exe 2112 ttnhnb.exe 672 3vpjj.exe 320 rffffxf.exe 2856 nhtbnt.exe 1884 hnhnbh.exe 1984 vvjjd.exe -
Processes:
resource yara_rule behavioral1/memory/2028-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1136-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1356-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/988-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3b75e875cc5b090a0033d134d6fe3b30_NeikiAnalytics.exe7bntbh.exettnbhn.exepvvjd.exe5thhnn.exefxfrrll.exelllxlrf.exefxllxfr.exerrlrlxl.exe3pdpd.exerrlxlxl.exexrlrfxf.exe9hhhtn.exelflfxrl.exe7nnbhh.exerlxlrfr.exedescription pid process target process PID 2028 wrote to memory of 2084 2028 3b75e875cc5b090a0033d134d6fe3b30_NeikiAnalytics.exe 7bntbh.exe PID 2028 wrote to memory of 2084 2028 3b75e875cc5b090a0033d134d6fe3b30_NeikiAnalytics.exe 7bntbh.exe PID 2028 wrote to memory of 2084 2028 3b75e875cc5b090a0033d134d6fe3b30_NeikiAnalytics.exe 7bntbh.exe PID 2028 wrote to memory of 2084 2028 3b75e875cc5b090a0033d134d6fe3b30_NeikiAnalytics.exe 7bntbh.exe PID 2084 wrote to memory of 2740 2084 7bntbh.exe ttnbhn.exe PID 2084 wrote to memory of 2740 2084 7bntbh.exe ttnbhn.exe PID 2084 wrote to memory of 2740 2084 7bntbh.exe ttnbhn.exe PID 2084 wrote to memory of 2740 2084 7bntbh.exe ttnbhn.exe PID 2740 wrote to memory of 2668 2740 ttnbhn.exe pvvjd.exe PID 2740 wrote to memory of 2668 2740 ttnbhn.exe pvvjd.exe PID 2740 wrote to memory of 2668 2740 ttnbhn.exe pvvjd.exe PID 2740 wrote to memory of 2668 2740 ttnbhn.exe pvvjd.exe PID 2668 wrote to memory of 2880 2668 pvvjd.exe 5thhnn.exe PID 2668 wrote to memory of 2880 2668 pvvjd.exe 5thhnn.exe PID 2668 wrote to memory of 2880 2668 pvvjd.exe 5thhnn.exe PID 2668 wrote to memory of 2880 2668 pvvjd.exe 5thhnn.exe PID 2880 wrote to memory of 2780 2880 5thhnn.exe fxfrrll.exe PID 2880 wrote to memory of 2780 2880 5thhnn.exe fxfrrll.exe PID 2880 wrote to memory of 2780 2880 5thhnn.exe fxfrrll.exe PID 2880 wrote to memory of 2780 2880 5thhnn.exe fxfrrll.exe PID 2780 wrote to memory of 2844 2780 fxfrrll.exe lllxlrf.exe PID 2780 wrote to memory of 2844 2780 fxfrrll.exe lllxlrf.exe PID 2780 wrote to memory of 2844 2780 fxfrrll.exe lllxlrf.exe PID 2780 wrote to memory of 2844 2780 fxfrrll.exe lllxlrf.exe PID 2844 wrote to memory of 2640 2844 lllxlrf.exe fxllxfr.exe PID 2844 wrote to memory of 2640 2844 lllxlrf.exe fxllxfr.exe PID 2844 wrote to memory of 2640 2844 lllxlrf.exe fxllxfr.exe PID 2844 wrote to memory of 2640 2844 lllxlrf.exe fxllxfr.exe PID 2640 wrote to memory of 2592 2640 fxllxfr.exe rrlrlxl.exe PID 2640 wrote to memory of 2592 2640 fxllxfr.exe rrlrlxl.exe PID 2640 wrote to memory of 2592 2640 fxllxfr.exe rrlrlxl.exe PID 2640 wrote to memory of 2592 2640 fxllxfr.exe rrlrlxl.exe PID 2592 wrote to memory of 2400 2592 rrlrlxl.exe 3pdpd.exe PID 2592 wrote to memory of 2400 2592 rrlrlxl.exe 3pdpd.exe PID 2592 wrote to memory of 2400 2592 rrlrlxl.exe 3pdpd.exe PID 2592 wrote to memory of 2400 2592 rrlrlxl.exe 3pdpd.exe PID 2400 wrote to memory of 1136 2400 3pdpd.exe rrlxlxl.exe PID 2400 wrote to memory of 1136 2400 3pdpd.exe rrlxlxl.exe PID 2400 wrote to memory of 1136 2400 3pdpd.exe rrlxlxl.exe PID 2400 wrote to memory of 1136 2400 3pdpd.exe rrlxlxl.exe PID 1136 wrote to memory of 2820 1136 rrlxlxl.exe xrlrfxf.exe PID 1136 wrote to memory of 2820 1136 rrlxlxl.exe xrlrfxf.exe PID 1136 wrote to memory of 2820 1136 rrlxlxl.exe xrlrfxf.exe PID 1136 wrote to memory of 2820 1136 rrlxlxl.exe xrlrfxf.exe PID 2820 wrote to memory of 2956 2820 xrlrfxf.exe 9hhhtn.exe PID 2820 wrote to memory of 2956 2820 xrlrfxf.exe 9hhhtn.exe PID 2820 wrote to memory of 2956 2820 xrlrfxf.exe 9hhhtn.exe PID 2820 wrote to memory of 2956 2820 xrlrfxf.exe 9hhhtn.exe PID 2956 wrote to memory of 1724 2956 9hhhtn.exe lflfxrl.exe PID 2956 wrote to memory of 1724 2956 9hhhtn.exe lflfxrl.exe PID 2956 wrote to memory of 1724 2956 9hhhtn.exe lflfxrl.exe PID 2956 wrote to memory of 1724 2956 9hhhtn.exe lflfxrl.exe PID 1724 wrote to memory of 1624 1724 lflfxrl.exe 7nnbhh.exe PID 1724 wrote to memory of 1624 1724 lflfxrl.exe 7nnbhh.exe PID 1724 wrote to memory of 1624 1724 lflfxrl.exe 7nnbhh.exe PID 1724 wrote to memory of 1624 1724 lflfxrl.exe 7nnbhh.exe PID 1624 wrote to memory of 2200 1624 7nnbhh.exe rlxlrfr.exe PID 1624 wrote to memory of 2200 1624 7nnbhh.exe rlxlrfr.exe PID 1624 wrote to memory of 2200 1624 7nnbhh.exe rlxlrfr.exe PID 1624 wrote to memory of 2200 1624 7nnbhh.exe rlxlrfr.exe PID 2200 wrote to memory of 1356 2200 rlxlrfr.exe fffxrlr.exe PID 2200 wrote to memory of 1356 2200 rlxlrfr.exe fffxrlr.exe PID 2200 wrote to memory of 1356 2200 rlxlrfr.exe fffxrlr.exe PID 2200 wrote to memory of 1356 2200 rlxlrfr.exe fffxrlr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b75e875cc5b090a0033d134d6fe3b30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3b75e875cc5b090a0033d134d6fe3b30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\7bntbh.exec:\7bntbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\ttnbhn.exec:\ttnbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\pvvjd.exec:\pvvjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\5thhnn.exec:\5thhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\fxfrrll.exec:\fxfrrll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\lllxlrf.exec:\lllxlrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\fxllxfr.exec:\fxllxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\rrlrlxl.exec:\rrlrlxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\3pdpd.exec:\3pdpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\rrlxlxl.exec:\rrlxlxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\xrlrfxf.exec:\xrlrfxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\9hhhtn.exec:\9hhhtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\lflfxrl.exec:\lflfxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\7nnbhh.exec:\7nnbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\rlxlrfr.exec:\rlxlrfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\fffxrlr.exec:\fffxrlr.exe17⤵
- Executes dropped EXE
PID:1356 -
\??\c:\pjdpd.exec:\pjdpd.exe18⤵
- Executes dropped EXE
PID:1868 -
\??\c:\nnhnhh.exec:\nnhnhh.exe19⤵
- Executes dropped EXE
PID:1192 -
\??\c:\jdvvd.exec:\jdvvd.exe20⤵
- Executes dropped EXE
PID:2836 -
\??\c:\nhbhth.exec:\nhbhth.exe21⤵
- Executes dropped EXE
PID:320 -
\??\c:\1fxrxfr.exec:\1fxrxfr.exe22⤵
- Executes dropped EXE
PID:988 -
\??\c:\ppvdj.exec:\ppvdj.exe23⤵
- Executes dropped EXE
PID:1092 -
\??\c:\fxrrffr.exec:\fxrrffr.exe24⤵
- Executes dropped EXE
PID:1080 -
\??\c:\dppjj.exec:\dppjj.exe25⤵
- Executes dropped EXE
PID:444 -
\??\c:\lfxfxfr.exec:\lfxfxfr.exe26⤵
- Executes dropped EXE
PID:2252 -
\??\c:\pvjpj.exec:\pvjpj.exe27⤵
- Executes dropped EXE
PID:1560 -
\??\c:\xxrxlxr.exec:\xxrxlxr.exe28⤵
- Executes dropped EXE
PID:1892 -
\??\c:\ttnthn.exec:\ttnthn.exe29⤵
- Executes dropped EXE
PID:2932 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe30⤵
- Executes dropped EXE
PID:2044 -
\??\c:\jvpjv.exec:\jvpjv.exe31⤵
- Executes dropped EXE
PID:2024 -
\??\c:\1lllxxr.exec:\1lllxxr.exe32⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3ththn.exec:\3ththn.exe33⤵
- Executes dropped EXE
PID:1496 -
\??\c:\vdvjd.exec:\vdvjd.exe34⤵
- Executes dropped EXE
PID:3000 -
\??\c:\9xrxlxl.exec:\9xrxlxl.exe35⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hhhtbb.exec:\hhhtbb.exe36⤵
- Executes dropped EXE
PID:1704 -
\??\c:\9ppdp.exec:\9ppdp.exe37⤵
- Executes dropped EXE
PID:2228 -
\??\c:\fxrrfll.exec:\fxrrfll.exe38⤵
- Executes dropped EXE
PID:844 -
\??\c:\1rflflf.exec:\1rflflf.exe39⤵
- Executes dropped EXE
PID:3036 -
\??\c:\7bnhhh.exec:\7bnhhh.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\dvpdj.exec:\dvpdj.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\xxrxfrf.exec:\xxrxfrf.exe42⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ttnthh.exec:\ttnthh.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vvppd.exec:\vvppd.exe44⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vvpvj.exec:\vvpvj.exe45⤵
- Executes dropped EXE
PID:2544 -
\??\c:\fflrllx.exec:\fflrllx.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hnbtnn.exec:\hnbtnn.exe47⤵
- Executes dropped EXE
PID:2984 -
\??\c:\7vppj.exec:\7vppj.exe48⤵
- Executes dropped EXE
PID:1960 -
\??\c:\5djpd.exec:\5djpd.exe49⤵
- Executes dropped EXE
PID:2812 -
\??\c:\llflxlx.exec:\llflxlx.exe50⤵
- Executes dropped EXE
PID:2840 -
\??\c:\tbbnbb.exec:\tbbnbb.exe51⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jdpdv.exec:\jdpdv.exe52⤵
- Executes dropped EXE
PID:1888 -
\??\c:\vvjjp.exec:\vvjjp.exe53⤵
- Executes dropped EXE
PID:1728 -
\??\c:\frlxffr.exec:\frlxffr.exe54⤵
- Executes dropped EXE
PID:2420 -
\??\c:\bbnnbh.exec:\bbnnbh.exe55⤵
- Executes dropped EXE
PID:836 -
\??\c:\7tnbhn.exec:\7tnbhn.exe56⤵
- Executes dropped EXE
PID:1668 -
\??\c:\7jjpj.exec:\7jjpj.exe57⤵
- Executes dropped EXE
PID:1356 -
\??\c:\rlrxlrr.exec:\rlrxlrr.exe58⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nnhbbh.exec:\nnhbbh.exe59⤵
- Executes dropped EXE
PID:2012 -
\??\c:\ttnhnb.exec:\ttnhnb.exe60⤵
- Executes dropped EXE
PID:2112 -
\??\c:\3vpjj.exec:\3vpjj.exe61⤵
- Executes dropped EXE
PID:672 -
\??\c:\rffffxf.exec:\rffffxf.exe62⤵
- Executes dropped EXE
PID:320 -
\??\c:\nhtbnt.exec:\nhtbnt.exe63⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hnhnbh.exec:\hnhnbh.exe64⤵
- Executes dropped EXE
PID:1884 -
\??\c:\vvjjd.exec:\vvjjd.exe65⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe66⤵PID:2896
-
\??\c:\ntnthh.exec:\ntnthh.exe67⤵PID:1860
-
\??\c:\bbnnbh.exec:\bbnnbh.exe68⤵PID:2384
-
\??\c:\7jjjp.exec:\7jjjp.exe69⤵PID:608
-
\??\c:\rrllxfr.exec:\rrllxfr.exe70⤵PID:2264
-
\??\c:\xxrlxfr.exec:\xxrlxfr.exe71⤵PID:852
-
\??\c:\9bnthh.exec:\9bnthh.exe72⤵PID:2920
-
\??\c:\dpjjv.exec:\dpjjv.exe73⤵PID:2108
-
\??\c:\rlxxlrf.exec:\rlxxlrf.exe74⤵PID:2024
-
\??\c:\rrlxllx.exec:\rrlxllx.exe75⤵PID:888
-
\??\c:\ttnbtt.exec:\ttnbtt.exe76⤵PID:3012
-
\??\c:\ppjvp.exec:\ppjvp.exe77⤵PID:1228
-
\??\c:\fffrlrl.exec:\fffrlrl.exe78⤵PID:1592
-
\??\c:\1lxfrxl.exec:\1lxfrxl.exe79⤵PID:2016
-
\??\c:\bthhth.exec:\bthhth.exe80⤵PID:2084
-
\??\c:\djjvj.exec:\djjvj.exe81⤵PID:2860
-
\??\c:\xrllrxf.exec:\xrllrxf.exe82⤵PID:2760
-
\??\c:\lrfllrf.exec:\lrfllrf.exe83⤵PID:2668
-
\??\c:\tthnbh.exec:\tthnbh.exe84⤵PID:2776
-
\??\c:\vpjvd.exec:\vpjvd.exe85⤵PID:2708
-
\??\c:\lllfrxr.exec:\lllfrxr.exe86⤵PID:2664
-
\??\c:\xxrrxxl.exec:\xxrrxxl.exe87⤵PID:2532
-
\??\c:\bhhhtt.exec:\bhhhtt.exe88⤵PID:2648
-
\??\c:\vvpvj.exec:\vvpvj.exe89⤵PID:3004
-
\??\c:\rlflxfr.exec:\rlflxfr.exe90⤵PID:1836
-
\??\c:\1xrlrrl.exec:\1xrlrrl.exe91⤵PID:2980
-
\??\c:\hhbhnn.exec:\hhbhnn.exe92⤵PID:1416
-
\??\c:\1pjpd.exec:\1pjpd.exe93⤵PID:2744
-
\??\c:\3pvpv.exec:\3pvpv.exe94⤵PID:1580
-
\??\c:\fxxrflx.exec:\fxxrflx.exe95⤵PID:1896
-
\??\c:\3hbbnh.exec:\3hbbnh.exe96⤵PID:288
-
\??\c:\5jdpp.exec:\5jdpp.exe97⤵PID:296
-
\??\c:\7pvvd.exec:\7pvvd.exe98⤵PID:1568
-
\??\c:\lxxxflx.exec:\lxxxflx.exe99⤵PID:1628
-
\??\c:\tnbhbh.exec:\tnbhbh.exe100⤵PID:1488
-
\??\c:\ppdpd.exec:\ppdpd.exe101⤵PID:628
-
\??\c:\dvjjv.exec:\dvjjv.exe102⤵PID:1192
-
\??\c:\flfrlrf.exec:\flfrlrf.exe103⤵PID:2836
-
\??\c:\bthntb.exec:\bthntb.exe104⤵PID:796
-
\??\c:\tbnthn.exec:\tbnthn.exe105⤵PID:584
-
\??\c:\jdvjv.exec:\jdvjv.exe106⤵PID:652
-
\??\c:\rrllxxf.exec:\rrllxxf.exe107⤵PID:576
-
\??\c:\3ffrffr.exec:\3ffrffr.exe108⤵PID:1760
-
\??\c:\tttbtb.exec:\tttbtb.exe109⤵PID:2256
-
\??\c:\vpddp.exec:\vpddp.exe110⤵PID:1372
-
\??\c:\7dvdp.exec:\7dvdp.exe111⤵PID:1340
-
\??\c:\rrxrxrx.exec:\rrxrxrx.exe112⤵PID:3028
-
\??\c:\pdvvd.exec:\pdvvd.exe113⤵PID:1816
-
\??\c:\7djjj.exec:\7djjj.exe114⤵PID:768
-
\??\c:\rlfflrl.exec:\rlfflrl.exe115⤵PID:852
-
\??\c:\bbbhtt.exec:\bbbhtt.exe116⤵PID:2488
-
\??\c:\tbbnnh.exec:\tbbnnh.exe117⤵PID:2408
-
\??\c:\vpjpd.exec:\vpjpd.exe118⤵PID:1792
-
\??\c:\fxfflfr.exec:\fxfflfr.exe119⤵PID:1752
-
\??\c:\xrllxfl.exec:\xrllxfl.exe120⤵PID:2064
-
\??\c:\htbbtb.exec:\htbbtb.exe121⤵PID:2612
-
\??\c:\dpdjj.exec:\dpdjj.exe122⤵PID:1592
-
\??\c:\5xllffl.exec:\5xllffl.exe123⤵PID:2228
-
\??\c:\lxxxflr.exec:\lxxxflr.exe124⤵PID:2724
-
\??\c:\nnhnbh.exec:\nnhnbh.exe125⤵PID:2656
-
\??\c:\vpddj.exec:\vpddj.exe126⤵PID:2684
-
\??\c:\vdpvj.exec:\vdpvj.exe127⤵PID:2788
-
\??\c:\xrllxxl.exec:\xrllxxl.exe128⤵PID:2748
-
\??\c:\hnbbbh.exec:\hnbbbh.exe129⤵PID:2644
-
\??\c:\tnhhtb.exec:\tnhhtb.exe130⤵PID:2604
-
\??\c:\pjvdv.exec:\pjvdv.exe131⤵PID:2964
-
\??\c:\rxlrxxf.exec:\rxlrxxf.exe132⤵PID:2540
-
\??\c:\9rfxflr.exec:\9rfxflr.exe133⤵PID:2984
-
\??\c:\5htbhn.exec:\5htbhn.exe134⤵PID:2816
-
\??\c:\dpdpj.exec:\dpdpj.exe135⤵PID:2952
-
\??\c:\vvdjv.exec:\vvdjv.exe136⤵PID:2020
-
\??\c:\lfxfrfx.exec:\lfxfrfx.exe137⤵PID:1788
-
\??\c:\thnbbn.exec:\thnbbn.exe138⤵PID:1724
-
\??\c:\bbhtbh.exec:\bbhtbh.exe139⤵PID:1624
-
\??\c:\pjvvj.exec:\pjvvj.exe140⤵PID:2404
-
\??\c:\5xlrlrf.exec:\5xlrlrf.exe141⤵PID:1616
-
\??\c:\xrllxfl.exec:\xrllxfl.exe142⤵PID:2192
-
\??\c:\hbtbtn.exec:\hbtbtn.exe143⤵PID:848
-
\??\c:\nhbhtn.exec:\nhbhtn.exe144⤵PID:2216
-
\??\c:\pjvvj.exec:\pjvvj.exe145⤵PID:2908
-
\??\c:\lflrffx.exec:\lflrffx.exe146⤵PID:484
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe147⤵PID:1476
-
\??\c:\1nnntb.exec:\1nnntb.exe148⤵PID:1128
-
\??\c:\1vddd.exec:\1vddd.exe149⤵PID:1800
-
\??\c:\5xxxllr.exec:\5xxxllr.exe150⤵PID:1080
-
\??\c:\rlffllx.exec:\rlffllx.exe151⤵PID:1984
-
\??\c:\nhhhtb.exec:\nhhhtb.exe152⤵PID:764
-
\??\c:\nhthtt.exec:\nhthtt.exe153⤵PID:1860
-
\??\c:\jdpdv.exec:\jdpdv.exe154⤵PID:2916
-
\??\c:\7rffrrx.exec:\7rffrrx.exe155⤵PID:1892
-
\??\c:\fxlxffr.exec:\fxlxffr.exe156⤵PID:2340
-
\??\c:\nbbttn.exec:\nbbttn.exe157⤵PID:568
-
\??\c:\5dvdj.exec:\5dvdj.exe158⤵PID:2924
-
\??\c:\rfflllx.exec:\rfflllx.exe159⤵PID:284
-
\??\c:\lfxfrrl.exec:\lfxfrrl.exe160⤵PID:2272
-
\??\c:\hhhtnb.exec:\hhhtnb.exe161⤵PID:1784
-
\??\c:\ddpdp.exec:\ddpdp.exe162⤵PID:2212
-
\??\c:\ddjjj.exec:\ddjjj.exe163⤵PID:2028
-
\??\c:\lrllrfr.exec:\lrllrfr.exe164⤵PID:1588
-
\??\c:\1rrfrxf.exec:\1rrfrxf.exe165⤵PID:1556
-
\??\c:\nhthnt.exec:\nhthnt.exe166⤵PID:2016
-
\??\c:\7dvdp.exec:\7dvdp.exe167⤵PID:2712
-
\??\c:\xxrrffx.exec:\xxrrffx.exe168⤵PID:2136
-
\??\c:\lfxlrxl.exec:\lfxlrxl.exe169⤵PID:2536
-
\??\c:\hhtnhn.exec:\hhtnhn.exe170⤵PID:2668
-
\??\c:\1pjvj.exec:\1pjvj.exe171⤵PID:2776
-
\??\c:\pvppd.exec:\pvppd.exe172⤵PID:2208
-
\??\c:\lrrxrxl.exec:\lrrxrxl.exe173⤵PID:2664
-
\??\c:\nhbnbh.exec:\nhbnbh.exe174⤵PID:2548
-
\??\c:\vpjpd.exec:\vpjpd.exe175⤵PID:2592
-
\??\c:\vdvjv.exec:\vdvjv.exe176⤵PID:1420
-
\??\c:\lfxxllx.exec:\lfxxllx.exe177⤵PID:548
-
\??\c:\bhhnhn.exec:\bhhnhn.exe178⤵PID:2784
-
\??\c:\btnbht.exec:\btnbht.exe179⤵PID:2164
-
\??\c:\jjdjd.exec:\jjdjd.exe180⤵PID:1948
-
\??\c:\ffxflrf.exec:\ffxflrf.exe181⤵PID:2972
-
\??\c:\xrlfrxf.exec:\xrlfrxf.exe182⤵PID:1700
-
\??\c:\3bttbb.exec:\3bttbb.exe183⤵PID:2416
-
\??\c:\ppjjv.exec:\ppjjv.exe184⤵PID:1608
-
\??\c:\dvpvp.exec:\dvpvp.exe185⤵PID:1572
-
\??\c:\xxrlrxf.exec:\xxrlrxf.exe186⤵PID:1432
-
\??\c:\3bbnhn.exec:\3bbnhn.exe187⤵PID:2900
-
\??\c:\hhhtth.exec:\hhhtth.exe188⤵PID:2388
-
\??\c:\3ppdp.exec:\3ppdp.exe189⤵PID:2112
-
\??\c:\9fxfrxf.exec:\9fxfrxf.exe190⤵PID:912
-
\??\c:\nhbhnn.exec:\nhbhnn.exe191⤵PID:1748
-
\??\c:\1nhnbb.exec:\1nhnbb.exe192⤵PID:1152
-
\??\c:\1pjpv.exec:\1pjpv.exe193⤵PID:1084
-
\??\c:\1lrrffl.exec:\1lrrffl.exe194⤵PID:1732
-
\??\c:\lrrxlrf.exec:\lrrxlrf.exe195⤵PID:1368
-
\??\c:\hhnthn.exec:\hhnthn.exe196⤵PID:2256
-
\??\c:\pjvvj.exec:\pjvvj.exe197⤵PID:2252
-
\??\c:\3lflrxl.exec:\3lflrxl.exe198⤵PID:608
-
\??\c:\3frflrx.exec:\3frflrx.exe199⤵PID:696
-
\??\c:\bbtthb.exec:\bbtthb.exe200⤵PID:1776
-
\??\c:\jpjjp.exec:\jpjjp.exe201⤵PID:1636
-
\??\c:\ppdjv.exec:\ppdjv.exe202⤵PID:2320
-
\??\c:\fxrxflx.exec:\fxrxflx.exe203⤵PID:1320
-
\??\c:\3frfflr.exec:\3frfflr.exe204⤵PID:2172
-
\??\c:\bnbnhn.exec:\bnbnhn.exe205⤵PID:888
-
\??\c:\pvdpp.exec:\pvdpp.exe206⤵PID:3000
-
\??\c:\1pjvj.exec:\1pjvj.exe207⤵PID:3032
-
\??\c:\9lrxflr.exec:\9lrxflr.exe208⤵PID:2132
-
\??\c:\nntbnb.exec:\nntbnb.exe209⤵PID:2804
-
\??\c:\5nbbhn.exec:\5nbbhn.exe210⤵PID:844
-
\??\c:\dddjv.exec:\dddjv.exe211⤵PID:3036
-
\??\c:\lfxrffx.exec:\lfxrffx.exe212⤵PID:2876
-
\??\c:\lxxrxrx.exec:\lxxrxrx.exe213⤵PID:2872
-
\??\c:\bnttbn.exec:\bnttbn.exe214⤵PID:2248
-
\??\c:\1djdp.exec:\1djdp.exe215⤵PID:2708
-
\??\c:\llxxxrx.exec:\llxxxrx.exe216⤵PID:2772
-
\??\c:\tnhnbb.exec:\tnhnbb.exe217⤵PID:2640
-
\??\c:\nnnttb.exec:\nnnttb.exe218⤵PID:2104
-
\??\c:\vpjjp.exec:\vpjjp.exe219⤵PID:2960
-
\??\c:\rrlrxff.exec:\rrlrxff.exe220⤵PID:2588
-
\??\c:\ththtt.exec:\ththtt.exe221⤵PID:2352
-
\??\c:\btnthn.exec:\btnthn.exe222⤵PID:2820
-
\??\c:\vpvdp.exec:\vpvdp.exe223⤵PID:2332
-
\??\c:\xxxlrxr.exec:\xxxlrxr.exe224⤵PID:1944
-
\??\c:\hhbnbh.exec:\hhbnbh.exe225⤵PID:1672
-
\??\c:\nhthnt.exec:\nhthnt.exe226⤵PID:288
-
\??\c:\1pddj.exec:\1pddj.exe227⤵PID:2200
-
\??\c:\xxxflxl.exec:\xxxflxl.exe228⤵PID:1392
-
\??\c:\5fflxlr.exec:\5fflxlr.exe229⤵PID:2356
-
\??\c:\ttntbb.exec:\ttntbb.exe230⤵PID:2052
-
\??\c:\jdvdj.exec:\jdvdj.exe231⤵PID:2512
-
\??\c:\ppjvj.exec:\ppjvj.exe232⤵PID:760
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe233⤵PID:672
-
\??\c:\1bbtnn.exec:\1bbtnn.exe234⤵PID:1880
-
\??\c:\5bnntt.exec:\5bnntt.exe235⤵PID:2424
-
\??\c:\pjdjp.exec:\pjdjp.exe236⤵PID:408
-
\??\c:\fxxfxfr.exec:\fxxfxfr.exe237⤵PID:3052
-
\??\c:\3xfffxf.exec:\3xfffxf.exe238⤵PID:1760
-
\??\c:\btnbnn.exec:\btnbnn.exe239⤵PID:2056
-
\??\c:\5pvdd.exec:\5pvdd.exe240⤵PID:1560
-
\??\c:\1jvdv.exec:\1jvdv.exe241⤵PID:1740
-
\??\c:\lxllxxf.exec:\lxllxxf.exe242⤵PID:2264