Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 02:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
53e0190a2bb775d745fe02f51afac8a0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
53e0190a2bb775d745fe02f51afac8a0_NeikiAnalytics.exe
-
Size
229KB
-
MD5
53e0190a2bb775d745fe02f51afac8a0
-
SHA1
95c8391c6f361b833a396814846e9cc60362c868
-
SHA256
4d9d166acaa6093ac49df76ed04d040660bb93bc32c751405aa7985e250d8dfd
-
SHA512
327894717faaccf3a7c9209ec44037a10805ca9d25bcff1d553d8d16830dd31ef51e9614437b1ae5b634ab6c246262e5d87c55d47875ce5dfc38e4f677d31e2d
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31z8mF7C/:n3C9BRo7MlrWKo+lfFe/
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral1/memory/2116-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-86-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1052-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/288-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/560-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/960-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5vvjp.exehnnbht.exexxrfrxl.exenbnnnn.exerlxrxxl.exehbnthh.exedvjvd.exeflxfrrr.exe1bnbht.exevvdpd.exe3xffrxr.exehhntht.exevvpvj.exexfxlrll.exetththn.exexrflrxl.exehntnnb.exepvvpp.exerlxflrf.exe5ttntt.exeddddv.exerfrflfl.exehhntbb.exejvdjj.exerxlflxf.exetnhtbn.exelffflxx.exetnnbbn.exedjdpp.exe1rlrfrf.exehhbhth.exejjdjp.exehhnbht.exe1nhbhn.exepjvpj.exerrfrflx.exe1xrrfrx.exetnbnbh.exepjvvv.exeppvdp.exelllrfff.exerfxlrxl.exebthnbh.exebbthbh.exejdvvv.exerlrfrxx.exe5nhntt.exethhnhn.exejjjpd.exerxlllfl.exelfxfxxr.exehhhtht.exe3dvjd.exe1dpvd.exerlxxfxx.exerlfrxlx.exehbtbtb.exejdvjd.exelfxxfrf.exerlxlxfr.exetthhbb.exebtbhtb.exe7pddd.exejjppp.exepid process 2436 5vvjp.exe 2312 hnnbht.exe 2720 xxrfrxl.exe 2776 nbnnnn.exe 2548 rlxrxxl.exe 2732 hbnthh.exe 2544 dvjvd.exe 3024 flxfrrr.exe 2032 1bnbht.exe 2860 vvdpd.exe 2884 3xffrxr.exe 1052 hhntht.exe 2036 vvpvj.exe 1688 xfxlrll.exe 288 tththn.exe 2600 xrflrxl.exe 308 hntnnb.exe 560 pvvpp.exe 1568 rlxflrf.exe 1264 5ttntt.exe 2692 ddddv.exe 2236 rfrflfl.exe 960 hhntbb.exe 1744 jvdjj.exe 1692 rxlflxf.exe 1596 tnhtbn.exe 2100 lffflxx.exe 900 tnnbbn.exe 3008 djdpp.exe 2348 1rlrfrf.exe 1768 hhbhth.exe 2136 jjdjp.exe 1524 hhnbht.exe 2176 1nhbhn.exe 2392 pjvpj.exe 1252 rrfrflx.exe 2312 1xrrfrx.exe 2660 tnbnbh.exe 2288 pjvvv.exe 2792 ppvdp.exe 2648 lllrfff.exe 2512 rfxlrxl.exe 2220 bthnbh.exe 2544 bbthbh.exe 2016 jdvvv.exe 2824 rlrfrxx.exe 2772 5nhntt.exe 2860 thhnhn.exe 1500 jjjpd.exe 1664 rxlllfl.exe 2044 lfxfxxr.exe 1700 hhhtht.exe 756 3dvjd.exe 2572 1dpvd.exe 524 rlxxfxx.exe 316 rlfrxlx.exe 2208 hbtbtb.exe 1116 jdvjd.exe 1568 lfxxfrf.exe 2960 rlxlxfr.exe 1176 tthhbb.exe 2072 btbhtb.exe 1092 7pddd.exe 1312 jjppp.exe -
Processes:
resource yara_rule behavioral1/memory/2116-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1052-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/288-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/560-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1264-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/960-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
53e0190a2bb775d745fe02f51afac8a0_NeikiAnalytics.exe5vvjp.exehnnbht.exexxrfrxl.exenbnnnn.exerlxrxxl.exehbnthh.exedvjvd.exeflxfrrr.exe1bnbht.exevvdpd.exe3xffrxr.exehhntht.exevvpvj.exexfxlrll.exetththn.exedescription pid process target process PID 2116 wrote to memory of 2436 2116 53e0190a2bb775d745fe02f51afac8a0_NeikiAnalytics.exe 5vvjp.exe PID 2116 wrote to memory of 2436 2116 53e0190a2bb775d745fe02f51afac8a0_NeikiAnalytics.exe 5vvjp.exe PID 2116 wrote to memory of 2436 2116 53e0190a2bb775d745fe02f51afac8a0_NeikiAnalytics.exe 5vvjp.exe PID 2116 wrote to memory of 2436 2116 53e0190a2bb775d745fe02f51afac8a0_NeikiAnalytics.exe 5vvjp.exe PID 2436 wrote to memory of 2312 2436 5vvjp.exe hnnbht.exe PID 2436 wrote to memory of 2312 2436 5vvjp.exe hnnbht.exe PID 2436 wrote to memory of 2312 2436 5vvjp.exe hnnbht.exe PID 2436 wrote to memory of 2312 2436 5vvjp.exe hnnbht.exe PID 2312 wrote to memory of 2720 2312 hnnbht.exe xxrfrxl.exe PID 2312 wrote to memory of 2720 2312 hnnbht.exe xxrfrxl.exe PID 2312 wrote to memory of 2720 2312 hnnbht.exe xxrfrxl.exe PID 2312 wrote to memory of 2720 2312 hnnbht.exe xxrfrxl.exe PID 2720 wrote to memory of 2776 2720 xxrfrxl.exe nbnnnn.exe PID 2720 wrote to memory of 2776 2720 xxrfrxl.exe nbnnnn.exe PID 2720 wrote to memory of 2776 2720 xxrfrxl.exe nbnnnn.exe PID 2720 wrote to memory of 2776 2720 xxrfrxl.exe nbnnnn.exe PID 2776 wrote to memory of 2548 2776 nbnnnn.exe rlxrxxl.exe PID 2776 wrote to memory of 2548 2776 nbnnnn.exe rlxrxxl.exe PID 2776 wrote to memory of 2548 2776 nbnnnn.exe rlxrxxl.exe PID 2776 wrote to memory of 2548 2776 nbnnnn.exe rlxrxxl.exe PID 2548 wrote to memory of 2732 2548 rlxrxxl.exe hbnthh.exe PID 2548 wrote to memory of 2732 2548 rlxrxxl.exe hbnthh.exe PID 2548 wrote to memory of 2732 2548 rlxrxxl.exe hbnthh.exe PID 2548 wrote to memory of 2732 2548 rlxrxxl.exe hbnthh.exe PID 2732 wrote to memory of 2544 2732 hbnthh.exe dvjvd.exe PID 2732 wrote to memory of 2544 2732 hbnthh.exe dvjvd.exe PID 2732 wrote to memory of 2544 2732 hbnthh.exe dvjvd.exe PID 2732 wrote to memory of 2544 2732 hbnthh.exe dvjvd.exe PID 2544 wrote to memory of 3024 2544 dvjvd.exe flxfrrr.exe PID 2544 wrote to memory of 3024 2544 dvjvd.exe flxfrrr.exe PID 2544 wrote to memory of 3024 2544 dvjvd.exe flxfrrr.exe PID 2544 wrote to memory of 3024 2544 dvjvd.exe flxfrrr.exe PID 3024 wrote to memory of 2032 3024 flxfrrr.exe 1bnbht.exe PID 3024 wrote to memory of 2032 3024 flxfrrr.exe 1bnbht.exe PID 3024 wrote to memory of 2032 3024 flxfrrr.exe 1bnbht.exe PID 3024 wrote to memory of 2032 3024 flxfrrr.exe 1bnbht.exe PID 2032 wrote to memory of 2860 2032 1bnbht.exe vvdpd.exe PID 2032 wrote to memory of 2860 2032 1bnbht.exe vvdpd.exe PID 2032 wrote to memory of 2860 2032 1bnbht.exe vvdpd.exe PID 2032 wrote to memory of 2860 2032 1bnbht.exe vvdpd.exe PID 2860 wrote to memory of 2884 2860 vvdpd.exe 3xffrxr.exe PID 2860 wrote to memory of 2884 2860 vvdpd.exe 3xffrxr.exe PID 2860 wrote to memory of 2884 2860 vvdpd.exe 3xffrxr.exe PID 2860 wrote to memory of 2884 2860 vvdpd.exe 3xffrxr.exe PID 2884 wrote to memory of 1052 2884 3xffrxr.exe hhntht.exe PID 2884 wrote to memory of 1052 2884 3xffrxr.exe hhntht.exe PID 2884 wrote to memory of 1052 2884 3xffrxr.exe hhntht.exe PID 2884 wrote to memory of 1052 2884 3xffrxr.exe hhntht.exe PID 1052 wrote to memory of 2036 1052 hhntht.exe vvpvj.exe PID 1052 wrote to memory of 2036 1052 hhntht.exe vvpvj.exe PID 1052 wrote to memory of 2036 1052 hhntht.exe vvpvj.exe PID 1052 wrote to memory of 2036 1052 hhntht.exe vvpvj.exe PID 2036 wrote to memory of 1688 2036 vvpvj.exe xfxlrll.exe PID 2036 wrote to memory of 1688 2036 vvpvj.exe xfxlrll.exe PID 2036 wrote to memory of 1688 2036 vvpvj.exe xfxlrll.exe PID 2036 wrote to memory of 1688 2036 vvpvj.exe xfxlrll.exe PID 1688 wrote to memory of 288 1688 xfxlrll.exe tththn.exe PID 1688 wrote to memory of 288 1688 xfxlrll.exe tththn.exe PID 1688 wrote to memory of 288 1688 xfxlrll.exe tththn.exe PID 1688 wrote to memory of 288 1688 xfxlrll.exe tththn.exe PID 288 wrote to memory of 2600 288 tththn.exe xrflrxl.exe PID 288 wrote to memory of 2600 288 tththn.exe xrflrxl.exe PID 288 wrote to memory of 2600 288 tththn.exe xrflrxl.exe PID 288 wrote to memory of 2600 288 tththn.exe xrflrxl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53e0190a2bb775d745fe02f51afac8a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\53e0190a2bb775d745fe02f51afac8a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\5vvjp.exec:\5vvjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\hnnbht.exec:\hnnbht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\xxrfrxl.exec:\xxrfrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\nbnnnn.exec:\nbnnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\rlxrxxl.exec:\rlxrxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\hbnthh.exec:\hbnthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\dvjvd.exec:\dvjvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\flxfrrr.exec:\flxfrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\1bnbht.exec:\1bnbht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\vvdpd.exec:\vvdpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\3xffrxr.exec:\3xffrxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\hhntht.exec:\hhntht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\vvpvj.exec:\vvpvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\xfxlrll.exec:\xfxlrll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\tththn.exec:\tththn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:288 -
\??\c:\xrflrxl.exec:\xrflrxl.exe17⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hntnnb.exec:\hntnnb.exe18⤵
- Executes dropped EXE
PID:308 -
\??\c:\pvvpp.exec:\pvvpp.exe19⤵
- Executes dropped EXE
PID:560 -
\??\c:\rlxflrf.exec:\rlxflrf.exe20⤵
- Executes dropped EXE
PID:1568 -
\??\c:\5ttntt.exec:\5ttntt.exe21⤵
- Executes dropped EXE
PID:1264 -
\??\c:\ddddv.exec:\ddddv.exe22⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rfrflfl.exec:\rfrflfl.exe23⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hhntbb.exec:\hhntbb.exe24⤵
- Executes dropped EXE
PID:960 -
\??\c:\jvdjj.exec:\jvdjj.exe25⤵
- Executes dropped EXE
PID:1744 -
\??\c:\rxlflxf.exec:\rxlflxf.exe26⤵
- Executes dropped EXE
PID:1692 -
\??\c:\tnhtbn.exec:\tnhtbn.exe27⤵
- Executes dropped EXE
PID:1596 -
\??\c:\lffflxx.exec:\lffflxx.exe28⤵
- Executes dropped EXE
PID:2100 -
\??\c:\tnnbbn.exec:\tnnbbn.exe29⤵
- Executes dropped EXE
PID:900 -
\??\c:\djdpp.exec:\djdpp.exe30⤵
- Executes dropped EXE
PID:3008 -
\??\c:\1rlrfrf.exec:\1rlrfrf.exe31⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hhbhth.exec:\hhbhth.exe32⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jjdjp.exec:\jjdjp.exe33⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hhnbht.exec:\hhnbht.exe34⤵
- Executes dropped EXE
PID:1524 -
\??\c:\1nhbhn.exec:\1nhbhn.exe35⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pjvpj.exec:\pjvpj.exe36⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rrfrflx.exec:\rrfrflx.exe37⤵
- Executes dropped EXE
PID:1252 -
\??\c:\1xrrfrx.exec:\1xrrfrx.exe38⤵
- Executes dropped EXE
PID:2312 -
\??\c:\tnbnbh.exec:\tnbnbh.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pjvvv.exec:\pjvvv.exe40⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ppvdp.exec:\ppvdp.exe41⤵
- Executes dropped EXE
PID:2792 -
\??\c:\lllrfff.exec:\lllrfff.exe42⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rfxlrxl.exec:\rfxlrxl.exe43⤵
- Executes dropped EXE
PID:2512 -
\??\c:\bthnbh.exec:\bthnbh.exe44⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bbthbh.exec:\bbthbh.exe45⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jdvvv.exec:\jdvvv.exe46⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rlrfrxx.exec:\rlrfrxx.exe47⤵
- Executes dropped EXE
PID:2824 -
\??\c:\5nhntt.exec:\5nhntt.exe48⤵
- Executes dropped EXE
PID:2772 -
\??\c:\thhnhn.exec:\thhnhn.exe49⤵
- Executes dropped EXE
PID:2860 -
\??\c:\jjjpd.exec:\jjjpd.exe50⤵
- Executes dropped EXE
PID:1500 -
\??\c:\rxlllfl.exec:\rxlllfl.exe51⤵
- Executes dropped EXE
PID:1664 -
\??\c:\lfxfxxr.exec:\lfxfxxr.exe52⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hhhtht.exec:\hhhtht.exe53⤵
- Executes dropped EXE
PID:1700 -
\??\c:\3dvjd.exec:\3dvjd.exe54⤵
- Executes dropped EXE
PID:756 -
\??\c:\1dpvd.exec:\1dpvd.exe55⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rlxxfxx.exec:\rlxxfxx.exe56⤵
- Executes dropped EXE
PID:524 -
\??\c:\rlfrxlx.exec:\rlfrxlx.exe57⤵
- Executes dropped EXE
PID:316 -
\??\c:\hbtbtb.exec:\hbtbtb.exe58⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jdvjd.exec:\jdvjd.exe59⤵
- Executes dropped EXE
PID:1116 -
\??\c:\lfxxfrf.exec:\lfxxfrf.exe60⤵
- Executes dropped EXE
PID:1568 -
\??\c:\rlxlxfr.exec:\rlxlxfr.exe61⤵
- Executes dropped EXE
PID:2960 -
\??\c:\tthhbb.exec:\tthhbb.exe62⤵
- Executes dropped EXE
PID:1176 -
\??\c:\btbhtb.exec:\btbhtb.exe63⤵
- Executes dropped EXE
PID:2072 -
\??\c:\7pddd.exec:\7pddd.exe64⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jjppp.exec:\jjppp.exe65⤵
- Executes dropped EXE
PID:1312 -
\??\c:\fxllxxl.exec:\fxllxxl.exe66⤵PID:3068
-
\??\c:\tnhntt.exec:\tnhntt.exe67⤵PID:764
-
\??\c:\1jvdp.exec:\1jvdp.exe68⤵PID:944
-
\??\c:\7pjvd.exec:\7pjvd.exe69⤵PID:1716
-
\??\c:\rfrllfl.exec:\rfrllfl.exe70⤵PID:2316
-
\??\c:\btbnbn.exec:\btbnbn.exe71⤵PID:1848
-
\??\c:\tnnbbb.exec:\tnnbbb.exe72⤵PID:1488
-
\??\c:\vvpvd.exec:\vvpvd.exe73⤵PID:2596
-
\??\c:\rrfrxlx.exec:\rrfrxlx.exe74⤵PID:1832
-
\??\c:\tnhtbh.exec:\tnhtbh.exe75⤵PID:2004
-
\??\c:\vpvjj.exec:\vpvjj.exe76⤵PID:1548
-
\??\c:\ppvdp.exec:\ppvdp.exe77⤵PID:1576
-
\??\c:\ffxxlrx.exec:\ffxxlrx.exe78⤵PID:2928
-
\??\c:\llxxflf.exec:\llxxflf.exe79⤵PID:2656
-
\??\c:\bhthhb.exec:\bhthhb.exe80⤵PID:2736
-
\??\c:\vpddv.exec:\vpddv.exe81⤵PID:2664
-
\??\c:\jdvdv.exec:\jdvdv.exe82⤵PID:2704
-
\??\c:\1rrxrfr.exec:\1rrxrfr.exe83⤵PID:1392
-
\??\c:\btnhbb.exec:\btnhbb.exe84⤵PID:3048
-
\??\c:\ddjvd.exec:\ddjvd.exe85⤵PID:2744
-
\??\c:\ddpjp.exec:\ddpjp.exe86⤵PID:2624
-
\??\c:\rlrllxl.exec:\rlrllxl.exe87⤵PID:3052
-
\??\c:\nnnhtb.exec:\nnnhtb.exe88⤵PID:2212
-
\??\c:\7ntbnb.exec:\7ntbnb.exe89⤵PID:2852
-
\??\c:\vpddj.exec:\vpddj.exe90⤵PID:2880
-
\??\c:\rllxrxr.exec:\rllxrxr.exe91⤵PID:2900
-
\??\c:\fxxlxfr.exec:\fxxlxfr.exe92⤵PID:3012
-
\??\c:\ttbntb.exec:\ttbntb.exe93⤵PID:1900
-
\??\c:\djjjv.exec:\djjjv.exe94⤵PID:1896
-
\??\c:\7dppp.exec:\7dppp.exe95⤵PID:392
-
\??\c:\3frrxxl.exec:\3frrxxl.exe96⤵PID:1688
-
\??\c:\xflxrll.exec:\xflxrll.exe97⤵PID:2788
-
\??\c:\hhhntb.exec:\hhhntb.exe98⤵PID:480
-
\??\c:\jppvp.exec:\jppvp.exe99⤵PID:1652
-
\??\c:\ddpdp.exec:\ddpdp.exe100⤵PID:1552
-
\??\c:\lrllllx.exec:\lrllllx.exe101⤵PID:1760
-
\??\c:\tthntb.exec:\tthntb.exe102⤵PID:2084
-
\??\c:\1hhntb.exec:\1hhntb.exe103⤵PID:700
-
\??\c:\vpppj.exec:\vpppj.exe104⤵PID:2184
-
\??\c:\xrlfxxl.exec:\xrlfxxl.exe105⤵PID:2052
-
\??\c:\1fxlxfr.exec:\1fxlxfr.exe106⤵PID:2236
-
\??\c:\bbnbnt.exec:\bbnbnt.exe107⤵PID:636
-
\??\c:\vpddp.exec:\vpddp.exe108⤵PID:1516
-
\??\c:\dddjd.exec:\dddjd.exe109⤵PID:2460
-
\??\c:\3rlrrlf.exec:\3rlrrlf.exe110⤵PID:1740
-
\??\c:\tbnbhh.exec:\tbnbhh.exe111⤵PID:1596
-
\??\c:\bbtbhh.exec:\bbtbhh.exe112⤵PID:1720
-
\??\c:\vvpvd.exec:\vvpvd.exe113⤵PID:2988
-
\??\c:\ffxlrxf.exec:\ffxlrxf.exe114⤵PID:2452
-
\??\c:\lxxfxll.exec:\lxxfxll.exe115⤵PID:624
-
\??\c:\nhhtbn.exec:\nhhtbn.exe116⤵PID:868
-
\??\c:\tbbnhn.exec:\tbbnhn.exe117⤵PID:876
-
\??\c:\jdjpd.exec:\jdjpd.exe118⤵PID:2264
-
\??\c:\lfrlrlr.exec:\lfrlrlr.exe119⤵PID:1580
-
\??\c:\btnnhh.exec:\btnnhh.exe120⤵PID:2160
-
\??\c:\bbtbnn.exec:\bbtbnn.exe121⤵PID:2804
-
\??\c:\vpjjv.exec:\vpjjv.exe122⤵PID:2656
-
\??\c:\7lrflxl.exec:\7lrflxl.exe123⤵PID:2364
-
\??\c:\lrlfrfr.exec:\lrlfrfr.exe124⤵PID:2944
-
\??\c:\tnbnhn.exec:\tnbnhn.exe125⤵PID:2704
-
\??\c:\5vvvd.exec:\5vvvd.exe126⤵PID:2896
-
\??\c:\9vjpd.exec:\9vjpd.exe127⤵PID:3048
-
\??\c:\7rxfrlx.exec:\7rxfrlx.exe128⤵PID:2680
-
\??\c:\nnnhth.exec:\nnnhth.exe129⤵PID:2732
-
\??\c:\nbhbhb.exec:\nbhbhb.exe130⤵PID:2560
-
\??\c:\pvjjp.exec:\pvjjp.exe131⤵PID:2212
-
\??\c:\3jdpj.exec:\3jdpj.exe132⤵PID:2768
-
\??\c:\rlfflrf.exec:\rlfflrf.exe133⤵PID:2880
-
\??\c:\ttnbnt.exec:\ttnbnt.exe134⤵PID:2872
-
\??\c:\pjdjv.exec:\pjdjv.exe135⤵PID:2484
-
\??\c:\7frrffl.exec:\7frrffl.exe136⤵PID:1664
-
\??\c:\frxrrrr.exec:\frxrrrr.exe137⤵PID:1668
-
\??\c:\pjpvd.exec:\pjpvd.exe138⤵PID:1700
-
\??\c:\pjddp.exec:\pjddp.exe139⤵PID:760
-
\??\c:\3fxxffx.exec:\3fxxffx.exe140⤵PID:2780
-
\??\c:\bthtnt.exec:\bthtnt.exe141⤵PID:1064
-
\??\c:\dvjpv.exec:\dvjpv.exe142⤵PID:1652
-
\??\c:\jjjvj.exec:\jjjvj.exe143⤵PID:2208
-
\??\c:\btnnbh.exec:\btnnbh.exe144⤵PID:1760
-
\??\c:\ddvdd.exec:\ddvdd.exe145⤵PID:2372
-
\??\c:\jjdjv.exec:\jjdjv.exe146⤵PID:700
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe147⤵PID:2068
-
\??\c:\btnttn.exec:\btnttn.exe148⤵PID:2052
-
\??\c:\hhtntb.exec:\hhtntb.exe149⤵PID:1756
-
\??\c:\3jdjp.exec:\3jdjp.exe150⤵PID:444
-
\??\c:\vvvpd.exec:\vvvpd.exe151⤵PID:1516
-
\??\c:\frlllxl.exec:\frlllxl.exe152⤵PID:1636
-
\??\c:\tthbbb.exec:\tthbbb.exe153⤵PID:2468
-
\??\c:\vdjvv.exec:\vdjvv.exe154⤵PID:1596
-
\??\c:\pjdjp.exec:\pjdjp.exe155⤵PID:2108
-
\??\c:\ffrxrxl.exec:\ffrxrxl.exe156⤵PID:3056
-
\??\c:\tnhnbh.exec:\tnhnbh.exe157⤵PID:556
-
\??\c:\vjvvv.exec:\vjvvv.exe158⤵PID:624
-
\??\c:\ppjpp.exec:\ppjpp.exe159⤵PID:1676
-
\??\c:\frfrrfx.exec:\frfrrfx.exe160⤵PID:1768
-
\??\c:\xxrrflr.exec:\xxrrflr.exe161⤵PID:2264
-
\??\c:\9btbbb.exec:\9btbbb.exe162⤵PID:1580
-
\??\c:\9pddj.exec:\9pddj.exe163⤵PID:1576
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe164⤵PID:2804
-
\??\c:\flxflrf.exec:\flxflrf.exe165⤵PID:2748
-
\??\c:\hbbhht.exec:\hbbhht.exe166⤵PID:2736
-
\??\c:\nhbhth.exec:\nhbhth.exe167⤵PID:2944
-
\??\c:\vvpvj.exec:\vvpvj.exe168⤵PID:2704
-
\??\c:\7rfxrlf.exec:\7rfxrlf.exe169⤵PID:2528
-
\??\c:\fxrffxf.exec:\fxrffxf.exe170⤵PID:2516
-
\??\c:\tnhtbh.exec:\tnhtbh.exe171⤵PID:2220
-
\??\c:\tnbhtt.exec:\tnbhtt.exe172⤵PID:2544
-
\??\c:\djvvd.exec:\djvvd.exe173⤵PID:2848
-
\??\c:\rlflffl.exec:\rlflffl.exe174⤵PID:2876
-
\??\c:\fxlrlfr.exec:\fxlrlfr.exe175⤵PID:1224
-
\??\c:\1hhnbh.exec:\1hhnbh.exe176⤵PID:2908
-
\??\c:\jdpdp.exec:\jdpdp.exe177⤵PID:1052
-
\??\c:\pjdpv.exec:\pjdpv.exe178⤵PID:2484
-
\??\c:\xllxxrr.exec:\xllxxrr.exe179⤵PID:2040
-
\??\c:\bhnttt.exec:\bhnttt.exe180⤵PID:1996
-
\??\c:\bbhntn.exec:\bbhntn.exe181⤵PID:1700
-
\??\c:\vdvdp.exec:\vdvdp.exe182⤵PID:2572
-
\??\c:\jdpjv.exec:\jdpjv.exe183⤵PID:2780
-
\??\c:\llfrlfx.exec:\llfrlfx.exe184⤵PID:1428
-
\??\c:\tbhthb.exec:\tbhthb.exe185⤵PID:1784
-
\??\c:\nttbbt.exec:\nttbbt.exe186⤵PID:2608
-
\??\c:\ddpjp.exec:\ddpjp.exe187⤵PID:2208
-
\??\c:\rlxflxl.exec:\rlxflxl.exe188⤵PID:1264
-
\??\c:\bnbtnh.exec:\bnbtnh.exe189⤵PID:2104
-
\??\c:\hhttnt.exec:\hhttnt.exe190⤵PID:1480
-
\??\c:\ddvdp.exec:\ddvdp.exe191⤵PID:2144
-
\??\c:\vdpjd.exec:\vdpjd.exe192⤵PID:960
-
\??\c:\flxfflf.exec:\flxfflf.exe193⤵PID:1312
-
\??\c:\nnnnbb.exec:\nnnnbb.exe194⤵PID:1940
-
\??\c:\btnbth.exec:\btnbth.exe195⤵PID:2952
-
\??\c:\jjddp.exec:\jjddp.exe196⤵PID:692
-
\??\c:\fffxflx.exec:\fffxflx.exe197⤵PID:688
-
\??\c:\7rflfrx.exec:\7rflfrx.exe198⤵PID:2316
-
\??\c:\9bthtb.exec:\9bthtb.exe199⤵PID:1848
-
\??\c:\hhbbnt.exec:\hhbbnt.exe200⤵PID:1488
-
\??\c:\9pvjv.exec:\9pvjv.exe201⤵PID:1868
-
\??\c:\xrrrfll.exec:\xrrrfll.exe202⤵PID:2228
-
\??\c:\lrxrrll.exec:\lrxrrll.exe203⤵PID:1684
-
\??\c:\hhbtbn.exec:\hhbtbn.exe204⤵PID:1524
-
\??\c:\ddjvd.exec:\ddjvd.exe205⤵PID:2652
-
\??\c:\pjdpv.exec:\pjdpv.exe206⤵PID:2716
-
\??\c:\xrllrxf.exec:\xrllrxf.exe207⤵PID:1252
-
\??\c:\nhtbnn.exec:\nhtbnn.exe208⤵PID:2644
-
\??\c:\ppvvd.exec:\ppvvd.exe209⤵PID:2748
-
\??\c:\3vppv.exec:\3vppv.exe210⤵PID:2536
-
\??\c:\lfrxxxf.exec:\lfrxxxf.exe211⤵PID:2548
-
\??\c:\5rlrfll.exec:\5rlrfll.exe212⤵PID:2524
-
\??\c:\bnhhtb.exec:\bnhhtb.exe213⤵PID:2676
-
\??\c:\3vpvj.exec:\3vpvj.exe214⤵PID:2232
-
\??\c:\jdjjp.exec:\jdjjp.exe215⤵PID:3032
-
\??\c:\xflrxxx.exec:\xflrxxx.exe216⤵PID:2840
-
\??\c:\bbnbth.exec:\bbnbth.exe217⤵PID:2888
-
\??\c:\nhthht.exec:\nhthht.exe218⤵PID:2924
-
\??\c:\jjjvd.exec:\jjjvd.exe219⤵PID:1780
-
\??\c:\ffxlffr.exec:\ffxlffr.exe220⤵PID:2000
-
\??\c:\xrrlfrf.exec:\xrrlfrf.exe221⤵PID:2036
-
\??\c:\bttnbb.exec:\bttnbb.exe222⤵PID:2396
-
\??\c:\nthbbn.exec:\nthbbn.exe223⤵PID:392
-
\??\c:\pjvvj.exec:\pjvvj.exe224⤵PID:772
-
\??\c:\9ppvp.exec:\9ppvp.exe225⤵PID:376
-
\??\c:\frxlxrx.exec:\frxlxrx.exe226⤵PID:1648
-
\??\c:\bbhhnn.exec:\bbhhnn.exe227⤵PID:1672
-
\??\c:\nttbnn.exec:\nttbnn.exe228⤵PID:2252
-
\??\c:\7dddv.exec:\7dddv.exe229⤵PID:560
-
\??\c:\fflxfrr.exec:\fflxfrr.exe230⤵PID:2284
-
\??\c:\bbthnt.exec:\bbthnt.exe231⤵PID:2060
-
\??\c:\bbnbtb.exec:\bbnbtb.exe232⤵PID:1264
-
\??\c:\vdvpd.exec:\vdvpd.exe233⤵PID:1872
-
\??\c:\llxfrrl.exec:\llxfrrl.exe234⤵PID:2072
-
\??\c:\lfrxfrl.exec:\lfrxfrl.exe235⤵PID:3000
-
\??\c:\ntbthn.exec:\ntbthn.exe236⤵PID:940
-
\??\c:\jjvdv.exec:\jjvdv.exe237⤵PID:1140
-
\??\c:\djpdv.exec:\djpdv.exe238⤵PID:1124
-
\??\c:\9xrfrlr.exec:\9xrfrlr.exe239⤵PID:1716
-
\??\c:\rxrrxrf.exec:\rxrrxrf.exe240⤵PID:2100
-
\??\c:\3bbtnt.exec:\3bbtnt.exe241⤵PID:2192
-
\??\c:\9vdjd.exec:\9vdjd.exe242⤵PID:1364