Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 09:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e2895c70985014227442e07b453984f0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e2895c70985014227442e07b453984f0_NeikiAnalytics.exe
-
Size
59KB
-
MD5
e2895c70985014227442e07b453984f0
-
SHA1
18363bb7fbd4f98d95863d4d0be8ed509e130fb8
-
SHA256
5f98e5607f4cf379b59bfa2fd1100cba62c49cf0741668f75ea2e87e05b1caed
-
SHA512
f171e2067fc17111bd15e75399278ca2230f33b18cedb32229e8616106770a4e91eae3a45ff6d9afb60e1120b0a2bd1f3332c07f0c8ce53b73a28370bc170488
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsImsC:ymb3NkkiQ3mdBjFIsIFC
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral1/memory/2476-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-28-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-72-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pvvjd.exefxxlxlx.exerrrflxx.exe5ttnbh.exentnbnb.exe5jdvp.exevdjpv.exeffxllrl.exehhhhhh.exeddpvj.exevvddd.exerrxflff.exe3rrlrxl.exetnnbnb.exe1hbhnh.exevpjdp.exe5vjjp.exedpvvv.exe9xrxflx.exerrrrrlr.exetnhnbn.exe7bttbb.exeddpvd.exejjdpd.exexxrxflf.exexxrlllf.exebbtttb.exedjvjp.exerrrffrf.exexffffxf.exenntbhb.exenhbhbh.exevjvpp.exevvdpv.exerlfrrfx.exellrlffx.exennhttt.exe3thbnn.exepppdd.exejdppp.exerlfrxfl.exexfffxrx.exe7xlrxfr.exebhtnbt.exejjvdj.exedpdpd.exe7rrlrll.exerxfxxxr.exebhnbnh.exehbhtbh.exebbnhhb.exedjpjp.exepdpjv.exeflxrlfl.exexllrxfl.exe3ntbnn.exenbtbbn.exe9tthbb.exepdvpp.exejddjj.exedvvjj.exeffxxflx.exexrrlffl.exebbbthh.exepid process 3012 pvvjd.exe 2476 fxxlxlx.exe 2580 rrrflxx.exe 2528 5ttnbh.exe 2088 ntnbnb.exe 2520 5jdvp.exe 2384 vdjpv.exe 1720 ffxllrl.exe 1452 hhhhhh.exe 1500 ddpvj.exe 1612 vvddd.exe 2316 rrxflff.exe 1484 3rrlrxl.exe 856 tnnbnb.exe 2268 1hbhnh.exe 324 vpjdp.exe 1552 5vjjp.exe 2036 dpvvv.exe 2480 9xrxflx.exe 1416 rrrrrlr.exe 2344 tnhnbn.exe 2240 7bttbb.exe 1736 ddpvd.exe 2340 jjdpd.exe 1152 xxrxflf.exe 1004 xxrlllf.exe 2980 bbtttb.exe 1692 djvjp.exe 2740 rrrffrf.exe 1652 xffffxf.exe 2204 nntbhb.exe 2944 nhbhbh.exe 3020 vjvpp.exe 2572 vvdpv.exe 3036 rlfrrfx.exe 1532 llrlffx.exe 2672 nnhttt.exe 1648 3thbnn.exe 2488 pppdd.exe 2400 jdppp.exe 2384 rlfrxfl.exe 2000 xfffxrx.exe 2120 7xlrxfr.exe 2044 bhtnbt.exe 1012 jjvdj.exe 2356 dpdpd.exe 792 7rrlrll.exe 1256 rxfxxxr.exe 764 bhnbnh.exe 1660 hbhtbh.exe 788 bbnhhb.exe 2004 djpjp.exe 2692 pdpjv.exe 2800 flxrlfl.exe 2128 xllrxfl.exe 2272 3ntbnn.exe 2056 nbtbbn.exe 1892 9tthbb.exe 1776 pdvpp.exe 1124 jddjj.exe 2824 dvvjj.exe 1724 ffxxflx.exe 1152 xrrlffl.exe 940 bbbthh.exe -
Processes:
resource yara_rule behavioral1/memory/2476-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1612-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e2895c70985014227442e07b453984f0_NeikiAnalytics.exepvvjd.exefxxlxlx.exerrrflxx.exe5ttnbh.exentnbnb.exe5jdvp.exevdjpv.exeffxllrl.exehhhhhh.exeddpvj.exevvddd.exerrxflff.exe3rrlrxl.exetnnbnb.exe1hbhnh.exedescription pid process target process PID 2924 wrote to memory of 3012 2924 e2895c70985014227442e07b453984f0_NeikiAnalytics.exe pvvjd.exe PID 2924 wrote to memory of 3012 2924 e2895c70985014227442e07b453984f0_NeikiAnalytics.exe pvvjd.exe PID 2924 wrote to memory of 3012 2924 e2895c70985014227442e07b453984f0_NeikiAnalytics.exe pvvjd.exe PID 2924 wrote to memory of 3012 2924 e2895c70985014227442e07b453984f0_NeikiAnalytics.exe pvvjd.exe PID 3012 wrote to memory of 2476 3012 pvvjd.exe fxxlxlx.exe PID 3012 wrote to memory of 2476 3012 pvvjd.exe fxxlxlx.exe PID 3012 wrote to memory of 2476 3012 pvvjd.exe fxxlxlx.exe PID 3012 wrote to memory of 2476 3012 pvvjd.exe fxxlxlx.exe PID 2476 wrote to memory of 2580 2476 fxxlxlx.exe rrrflxx.exe PID 2476 wrote to memory of 2580 2476 fxxlxlx.exe rrrflxx.exe PID 2476 wrote to memory of 2580 2476 fxxlxlx.exe rrrflxx.exe PID 2476 wrote to memory of 2580 2476 fxxlxlx.exe rrrflxx.exe PID 2580 wrote to memory of 2528 2580 rrrflxx.exe 5ttnbh.exe PID 2580 wrote to memory of 2528 2580 rrrflxx.exe 5ttnbh.exe PID 2580 wrote to memory of 2528 2580 rrrflxx.exe 5ttnbh.exe PID 2580 wrote to memory of 2528 2580 rrrflxx.exe 5ttnbh.exe PID 2528 wrote to memory of 2088 2528 5ttnbh.exe ntnbnb.exe PID 2528 wrote to memory of 2088 2528 5ttnbh.exe ntnbnb.exe PID 2528 wrote to memory of 2088 2528 5ttnbh.exe ntnbnb.exe PID 2528 wrote to memory of 2088 2528 5ttnbh.exe ntnbnb.exe PID 2088 wrote to memory of 2520 2088 ntnbnb.exe jdjpd.exe PID 2088 wrote to memory of 2520 2088 ntnbnb.exe jdjpd.exe PID 2088 wrote to memory of 2520 2088 ntnbnb.exe jdjpd.exe PID 2088 wrote to memory of 2520 2088 ntnbnb.exe jdjpd.exe PID 2520 wrote to memory of 2384 2520 5jdvp.exe vdjpv.exe PID 2520 wrote to memory of 2384 2520 5jdvp.exe vdjpv.exe PID 2520 wrote to memory of 2384 2520 5jdvp.exe vdjpv.exe PID 2520 wrote to memory of 2384 2520 5jdvp.exe vdjpv.exe PID 2384 wrote to memory of 1720 2384 vdjpv.exe ffxllrl.exe PID 2384 wrote to memory of 1720 2384 vdjpv.exe ffxllrl.exe PID 2384 wrote to memory of 1720 2384 vdjpv.exe ffxllrl.exe PID 2384 wrote to memory of 1720 2384 vdjpv.exe ffxllrl.exe PID 1720 wrote to memory of 1452 1720 ffxllrl.exe hhhhhh.exe PID 1720 wrote to memory of 1452 1720 ffxllrl.exe hhhhhh.exe PID 1720 wrote to memory of 1452 1720 ffxllrl.exe hhhhhh.exe PID 1720 wrote to memory of 1452 1720 ffxllrl.exe hhhhhh.exe PID 1452 wrote to memory of 1500 1452 hhhhhh.exe ddpvj.exe PID 1452 wrote to memory of 1500 1452 hhhhhh.exe ddpvj.exe PID 1452 wrote to memory of 1500 1452 hhhhhh.exe ddpvj.exe PID 1452 wrote to memory of 1500 1452 hhhhhh.exe ddpvj.exe PID 1500 wrote to memory of 1612 1500 ddpvj.exe vvddd.exe PID 1500 wrote to memory of 1612 1500 ddpvj.exe vvddd.exe PID 1500 wrote to memory of 1612 1500 ddpvj.exe vvddd.exe PID 1500 wrote to memory of 1612 1500 ddpvj.exe vvddd.exe PID 1612 wrote to memory of 2316 1612 vvddd.exe rrxflff.exe PID 1612 wrote to memory of 2316 1612 vvddd.exe rrxflff.exe PID 1612 wrote to memory of 2316 1612 vvddd.exe rrxflff.exe PID 1612 wrote to memory of 2316 1612 vvddd.exe rrxflff.exe PID 2316 wrote to memory of 1484 2316 rrxflff.exe 3rrlrxl.exe PID 2316 wrote to memory of 1484 2316 rrxflff.exe 3rrlrxl.exe PID 2316 wrote to memory of 1484 2316 rrxflff.exe 3rrlrxl.exe PID 2316 wrote to memory of 1484 2316 rrxflff.exe 3rrlrxl.exe PID 1484 wrote to memory of 856 1484 3rrlrxl.exe tnnbnb.exe PID 1484 wrote to memory of 856 1484 3rrlrxl.exe tnnbnb.exe PID 1484 wrote to memory of 856 1484 3rrlrxl.exe tnnbnb.exe PID 1484 wrote to memory of 856 1484 3rrlrxl.exe tnnbnb.exe PID 856 wrote to memory of 2268 856 tnnbnb.exe 1hbhnh.exe PID 856 wrote to memory of 2268 856 tnnbnb.exe 1hbhnh.exe PID 856 wrote to memory of 2268 856 tnnbnb.exe 1hbhnh.exe PID 856 wrote to memory of 2268 856 tnnbnb.exe 1hbhnh.exe PID 2268 wrote to memory of 324 2268 1hbhnh.exe vpjdp.exe PID 2268 wrote to memory of 324 2268 1hbhnh.exe vpjdp.exe PID 2268 wrote to memory of 324 2268 1hbhnh.exe vpjdp.exe PID 2268 wrote to memory of 324 2268 1hbhnh.exe vpjdp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2895c70985014227442e07b453984f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e2895c70985014227442e07b453984f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\pvvjd.exec:\pvvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\fxxlxlx.exec:\fxxlxlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\rrrflxx.exec:\rrrflxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\5ttnbh.exec:\5ttnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\ntnbnb.exec:\ntnbnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\5jdvp.exec:\5jdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\vdjpv.exec:\vdjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\ffxllrl.exec:\ffxllrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\hhhhhh.exec:\hhhhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\ddpvj.exec:\ddpvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\vvddd.exec:\vvddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\rrxflff.exec:\rrxflff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\3rrlrxl.exec:\3rrlrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\tnnbnb.exec:\tnnbnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\1hbhnh.exec:\1hbhnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\vpjdp.exec:\vpjdp.exe17⤵
- Executes dropped EXE
PID:324 -
\??\c:\5vjjp.exec:\5vjjp.exe18⤵
- Executes dropped EXE
PID:1552 -
\??\c:\dpvvv.exec:\dpvvv.exe19⤵
- Executes dropped EXE
PID:2036 -
\??\c:\9xrxflx.exec:\9xrxflx.exe20⤵
- Executes dropped EXE
PID:2480 -
\??\c:\rrrrrlr.exec:\rrrrrlr.exe21⤵
- Executes dropped EXE
PID:1416 -
\??\c:\tnhnbn.exec:\tnhnbn.exe22⤵
- Executes dropped EXE
PID:2344 -
\??\c:\7bttbb.exec:\7bttbb.exe23⤵
- Executes dropped EXE
PID:2240 -
\??\c:\ddpvd.exec:\ddpvd.exe24⤵
- Executes dropped EXE
PID:1736 -
\??\c:\jjdpd.exec:\jjdpd.exe25⤵
- Executes dropped EXE
PID:2340 -
\??\c:\xxrxflf.exec:\xxrxflf.exe26⤵
- Executes dropped EXE
PID:1152 -
\??\c:\xxrlllf.exec:\xxrlllf.exe27⤵
- Executes dropped EXE
PID:1004 -
\??\c:\bbtttb.exec:\bbtttb.exe28⤵
- Executes dropped EXE
PID:2980 -
\??\c:\djvjp.exec:\djvjp.exe29⤵
- Executes dropped EXE
PID:1692 -
\??\c:\rrrffrf.exec:\rrrffrf.exe30⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xffffxf.exec:\xffffxf.exe31⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nntbhb.exec:\nntbhb.exe32⤵
- Executes dropped EXE
PID:2204 -
\??\c:\nhbhbh.exec:\nhbhbh.exe33⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vjvpp.exec:\vjvpp.exe34⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vvdpv.exec:\vvdpv.exe35⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rlfrrfx.exec:\rlfrrfx.exe36⤵
- Executes dropped EXE
PID:3036 -
\??\c:\llrlffx.exec:\llrlffx.exe37⤵
- Executes dropped EXE
PID:1532 -
\??\c:\nnhttt.exec:\nnhttt.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3thbnn.exec:\3thbnn.exe39⤵
- Executes dropped EXE
PID:1648 -
\??\c:\pppdd.exec:\pppdd.exe40⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jdppp.exec:\jdppp.exe41⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rlfrxfl.exec:\rlfrxfl.exe42⤵
- Executes dropped EXE
PID:2384 -
\??\c:\xfffxrx.exec:\xfffxrx.exe43⤵
- Executes dropped EXE
PID:2000 -
\??\c:\7xlrxfr.exec:\7xlrxfr.exe44⤵
- Executes dropped EXE
PID:2120 -
\??\c:\bhtnbt.exec:\bhtnbt.exe45⤵
- Executes dropped EXE
PID:2044 -
\??\c:\jjvdj.exec:\jjvdj.exe46⤵
- Executes dropped EXE
PID:1012 -
\??\c:\dpdpd.exec:\dpdpd.exe47⤵
- Executes dropped EXE
PID:2356 -
\??\c:\7rrlrll.exec:\7rrlrll.exe48⤵
- Executes dropped EXE
PID:792 -
\??\c:\rxfxxxr.exec:\rxfxxxr.exe49⤵
- Executes dropped EXE
PID:1256 -
\??\c:\bhnbnh.exec:\bhnbnh.exe50⤵
- Executes dropped EXE
PID:764 -
\??\c:\hbhtbh.exec:\hbhtbh.exe51⤵
- Executes dropped EXE
PID:1660 -
\??\c:\bbnhhb.exec:\bbnhhb.exe52⤵
- Executes dropped EXE
PID:788 -
\??\c:\djpjp.exec:\djpjp.exe53⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pdpjv.exec:\pdpjv.exe54⤵
- Executes dropped EXE
PID:2692 -
\??\c:\flxrlfl.exec:\flxrlfl.exe55⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xllrxfl.exec:\xllrxfl.exe56⤵
- Executes dropped EXE
PID:2128 -
\??\c:\3ntbnn.exec:\3ntbnn.exe57⤵
- Executes dropped EXE
PID:2272 -
\??\c:\nbtbbn.exec:\nbtbbn.exe58⤵
- Executes dropped EXE
PID:2056 -
\??\c:\9tthbb.exec:\9tthbb.exe59⤵
- Executes dropped EXE
PID:1892 -
\??\c:\pdvpp.exec:\pdvpp.exe60⤵
- Executes dropped EXE
PID:1776 -
\??\c:\jddjj.exec:\jddjj.exe61⤵
- Executes dropped EXE
PID:1124 -
\??\c:\dvvjj.exec:\dvvjj.exe62⤵
- Executes dropped EXE
PID:2824 -
\??\c:\ffxxflx.exec:\ffxxflx.exe63⤵
- Executes dropped EXE
PID:1724 -
\??\c:\xrrlffl.exec:\xrrlffl.exe64⤵
- Executes dropped EXE
PID:1152 -
\??\c:\bbbthh.exec:\bbbthh.exe65⤵
- Executes dropped EXE
PID:940 -
\??\c:\nbntbb.exec:\nbntbb.exe66⤵PID:700
-
\??\c:\3jvvd.exec:\3jvvd.exe67⤵PID:952
-
\??\c:\vvvjj.exec:\vvvjj.exe68⤵PID:876
-
\??\c:\frxxllf.exec:\frxxllf.exe69⤵PID:1700
-
\??\c:\7fxlxll.exec:\7fxlxll.exe70⤵PID:1128
-
\??\c:\7htbhn.exec:\7htbhn.exe71⤵PID:2872
-
\??\c:\tttttn.exec:\tttttn.exe72⤵PID:1428
-
\??\c:\vdjjj.exec:\vdjjj.exe73⤵PID:2148
-
\??\c:\5vvvj.exec:\5vvvj.exe74⤵PID:2972
-
\??\c:\pjvdj.exec:\pjvdj.exe75⤵PID:3012
-
\??\c:\7rllxxf.exec:\7rllxxf.exe76⤵PID:2572
-
\??\c:\rxfxxrr.exec:\rxfxxrr.exe77⤵PID:2516
-
\??\c:\xxrxxrr.exec:\xxrxxrr.exe78⤵PID:2660
-
\??\c:\xlllrxx.exec:\xlllrxx.exe79⤵PID:2508
-
\??\c:\9xflxxl.exec:\9xflxxl.exe80⤵PID:2656
-
\??\c:\jdjpd.exec:\jdjpd.exe81⤵PID:2520
-
\??\c:\thttbb.exec:\thttbb.exe82⤵PID:2488
-
\??\c:\jjjpp.exec:\jjjpp.exe83⤵PID:2400
-
\??\c:\pjjpd.exec:\pjjpd.exe84⤵PID:2384
-
\??\c:\9fxlllx.exec:\9fxlllx.exe85⤵PID:1512
-
\??\c:\fxffrrl.exec:\fxffrrl.exe86⤵PID:1264
-
\??\c:\hbtttb.exec:\hbtttb.exe87⤵PID:760
-
\??\c:\btbhtn.exec:\btbhtn.exe88⤵PID:1236
-
\??\c:\vdjdd.exec:\vdjdd.exe89⤵PID:1440
-
\??\c:\pdpvv.exec:\pdpvv.exe90⤵PID:2540
-
\??\c:\xxfxxff.exec:\xxfxxff.exe91⤵PID:1580
-
\??\c:\5llffxl.exec:\5llffxl.exe92⤵PID:856
-
\??\c:\5thnbh.exec:\5thnbh.exe93⤵PID:2268
-
\??\c:\htbttb.exec:\htbttb.exe94⤵PID:2016
-
\??\c:\dppjv.exec:\dppjv.exe95⤵PID:2664
-
\??\c:\9vddd.exec:\9vddd.exe96⤵PID:2852
-
\??\c:\lxfxfxr.exec:\lxfxfxr.exe97⤵PID:2732
-
\??\c:\xflflrr.exec:\xflflrr.exe98⤵PID:652
-
\??\c:\hnnbhh.exec:\hnnbhh.exe99⤵PID:1416
-
\??\c:\thbnbn.exec:\thbnbn.exe100⤵PID:1880
-
\??\c:\ttnbnh.exec:\ttnbnh.exe101⤵PID:1404
-
\??\c:\pvjvv.exec:\pvjvv.exe102⤵PID:1780
-
\??\c:\vvjjp.exec:\vvjjp.exe103⤵PID:2024
-
\??\c:\rfrfllx.exec:\rfrfllx.exe104⤵PID:2600
-
\??\c:\7xrxxlr.exec:\7xrxxlr.exe105⤵PID:1540
-
\??\c:\bhnbnb.exec:\bhnbnb.exe106⤵PID:2248
-
\??\c:\bntnnn.exec:\bntnnn.exe107⤵PID:2964
-
\??\c:\hbbbtn.exec:\hbbbtn.exe108⤵PID:2784
-
\??\c:\1vjjj.exec:\1vjjj.exe109⤵PID:2856
-
\??\c:\ddpvp.exec:\ddpvp.exe110⤵PID:1872
-
\??\c:\xrxrrrf.exec:\xrxrrrf.exe111⤵PID:328
-
\??\c:\lxxxflx.exec:\lxxxflx.exe112⤵PID:2156
-
\??\c:\nnhntn.exec:\nnhntn.exe113⤵PID:2924
-
\??\c:\tntntn.exec:\tntntn.exe114⤵PID:2140
-
\??\c:\hbnthn.exec:\hbnthn.exe115⤵PID:2928
-
\??\c:\jjjvp.exec:\jjjvp.exe116⤵PID:2532
-
\??\c:\1fxxflf.exec:\1fxxflf.exe117⤵PID:2636
-
\??\c:\ffxfxfr.exec:\ffxfxfr.exe118⤵PID:2576
-
\??\c:\thhtbb.exec:\thhtbb.exe119⤵PID:2684
-
\??\c:\thntbb.exec:\thntbb.exe120⤵PID:2696
-
\??\c:\7tnhnh.exec:\7tnhnh.exe121⤵PID:2508
-
\??\c:\1pdjp.exec:\1pdjp.exe122⤵PID:2556
-
\??\c:\jdvdj.exec:\jdvdj.exe123⤵PID:2820
-
\??\c:\vpdjv.exec:\vpdjv.exe124⤵PID:2828
-
\??\c:\rflfffl.exec:\rflfffl.exe125⤵PID:2996
-
\??\c:\xxxrfff.exec:\xxxrfff.exe126⤵PID:848
-
\??\c:\hnhbbh.exec:\hnhbbh.exe127⤵PID:2000
-
\??\c:\bttbhh.exec:\bttbhh.exe128⤵PID:2120
-
\??\c:\1ntbbb.exec:\1ntbbb.exe129⤵PID:2044
-
\??\c:\djvdp.exec:\djvdp.exe130⤵PID:1012
-
\??\c:\vvdpj.exec:\vvdpj.exe131⤵PID:1644
-
\??\c:\jjddv.exec:\jjddv.exe132⤵PID:2416
-
\??\c:\rfffrll.exec:\rfffrll.exe133⤵PID:1260
-
\??\c:\xlxfxxl.exec:\xlxfxxl.exe134⤵PID:2212
-
\??\c:\3lxxllf.exec:\3lxxllf.exe135⤵PID:768
-
\??\c:\nhtbhh.exec:\nhtbhh.exe136⤵PID:2292
-
\??\c:\nhnnhh.exec:\nhnnhh.exe137⤵PID:984
-
\??\c:\nhttbn.exec:\nhttbn.exe138⤵PID:2188
-
\??\c:\thbhnn.exec:\thbhnn.exe139⤵PID:2940
-
\??\c:\jdvjv.exec:\jdvjv.exe140⤵PID:584
-
\??\c:\3dpvj.exec:\3dpvj.exe141⤵PID:2232
-
\??\c:\9pjdj.exec:\9pjdj.exe142⤵PID:688
-
\??\c:\rrlfrfr.exec:\rrlfrfr.exe143⤵PID:2052
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe144⤵PID:1160
-
\??\c:\rxfllxl.exec:\rxfllxl.exe145⤵PID:2824
-
\??\c:\httbnh.exec:\httbnh.exe146⤵PID:1192
-
\??\c:\hhnnbt.exec:\hhnnbt.exe147⤵PID:2224
-
\??\c:\5btbbb.exec:\5btbbb.exe148⤵PID:2984
-
\??\c:\nhtbnn.exec:\nhtbnn.exe149⤵PID:700
-
\??\c:\vpjpd.exec:\vpjpd.exe150⤵PID:1888
-
\??\c:\vpdjp.exec:\vpdjp.exe151⤵PID:2812
-
\??\c:\dpdvd.exec:\dpdvd.exe152⤵PID:1728
-
\??\c:\rrlxxlr.exec:\rrlxxlr.exe153⤵PID:2152
-
\??\c:\1frlxfr.exec:\1frlxfr.exe154⤵PID:2060
-
\??\c:\3nhhtb.exec:\3nhhtb.exe155⤵PID:3028
-
\??\c:\htthtt.exec:\htthtt.exe156⤵PID:2860
-
\??\c:\pjdjp.exec:\pjdjp.exe157⤵PID:2148
-
\??\c:\dvddv.exec:\dvddv.exe158⤵PID:2632
-
\??\c:\jpjdv.exec:\jpjdv.exe159⤵PID:2580
-
\??\c:\frrxlxr.exec:\frrxlxr.exe160⤵PID:2788
-
\??\c:\xlrfrrf.exec:\xlrfrrf.exe161⤵PID:3008
-
\??\c:\frrxxrr.exec:\frrxxrr.exe162⤵PID:2436
-
\??\c:\nhnbtb.exec:\nhnbtb.exe163⤵PID:1648
-
\??\c:\5tnnbh.exec:\5tnnbh.exe164⤵PID:2380
-
\??\c:\bhnnbh.exec:\bhnnbh.exe165⤵PID:2760
-
\??\c:\jjjdj.exec:\jjjdj.exe166⤵PID:2500
-
\??\c:\jjvvd.exec:\jjvvd.exe167⤵PID:1276
-
\??\c:\5ddvj.exec:\5ddvj.exe168⤵PID:1452
-
\??\c:\rflfllr.exec:\rflfllr.exe169⤵PID:1500
-
\??\c:\xxrlxlr.exec:\xxrlxlr.exe170⤵PID:1744
-
\??\c:\xrlxlll.exec:\xrlxlll.exe171⤵PID:2648
-
\??\c:\tbnbht.exec:\tbnbht.exe172⤵PID:240
-
\??\c:\hbhthn.exec:\hbhthn.exe173⤵PID:2124
-
\??\c:\9thntb.exec:\9thntb.exe174⤵PID:112
-
\??\c:\9vpvd.exec:\9vpvd.exe175⤵PID:2880
-
\??\c:\jvjdp.exec:\jvjdp.exe176⤵PID:472
-
\??\c:\vpdpd.exec:\vpdpd.exe177⤵PID:628
-
\??\c:\lrrxxxx.exec:\lrrxxxx.exe178⤵PID:2712
-
\??\c:\xfxrxrx.exec:\xfxrxrx.exe179⤵PID:2816
-
\??\c:\rflffff.exec:\rflffff.exe180⤵PID:2480
-
\??\c:\3hbttt.exec:\3hbttt.exe181⤵PID:1408
-
\??\c:\nhnnbt.exec:\nhnnbt.exe182⤵PID:2612
-
\??\c:\5nbbhn.exec:\5nbbhn.exe183⤵PID:2992
-
\??\c:\vjdpv.exec:\vjdpv.exe184⤵PID:2240
-
\??\c:\vjppj.exec:\vjppj.exe185⤵PID:3048
-
\??\c:\3xxrrll.exec:\3xxrrll.exe186⤵PID:2340
-
\??\c:\frxrffr.exec:\frxrffr.exe187⤵PID:2216
-
\??\c:\7bhtnh.exec:\7bhtnh.exe188⤵PID:900
-
\??\c:\bhhtth.exec:\bhhtth.exe189⤵PID:1004
-
\??\c:\vvjpv.exec:\vvjpv.exe190⤵PID:1464
-
\??\c:\pvpdd.exec:\pvpdd.exe191⤵PID:3060
-
\??\c:\lxrxrlr.exec:\lxrxrlr.exe192⤵PID:1948
-
\??\c:\frlxllr.exec:\frlxllr.exe193⤵PID:560
-
\??\c:\1thnbb.exec:\1thnbb.exe194⤵PID:1432
-
\??\c:\5nbbhb.exec:\5nbbhb.exe195⤵PID:1064
-
\??\c:\tnhnbb.exec:\tnhnbb.exe196⤵PID:2792
-
\??\c:\pjppd.exec:\pjppd.exe197⤵PID:1952
-
\??\c:\pdvpj.exec:\pdvpj.exe198⤵PID:2972
-
\??\c:\lrxfflx.exec:\lrxfflx.exe199⤵PID:2928
-
\??\c:\7xfxrfr.exec:\7xfxrfr.exe200⤵PID:3020
-
\??\c:\xfrxxxx.exec:\xfrxxxx.exe201⤵PID:2464
-
\??\c:\nnttbt.exec:\nnttbt.exe202⤵PID:2568
-
\??\c:\thbhht.exec:\thbhht.exe203⤵PID:2700
-
\??\c:\pddpv.exec:\pddpv.exe204⤵PID:2892
-
\??\c:\pdjdp.exec:\pdjdp.exe205⤵PID:2548
-
\??\c:\pvjdj.exec:\pvjdj.exe206⤵PID:1900
-
\??\c:\xllrflx.exec:\xllrflx.exe207⤵PID:2616
-
\??\c:\tbhbth.exec:\tbhbth.exe208⤵PID:844
-
\??\c:\tbbnth.exec:\tbbnth.exe209⤵PID:2400
-
\??\c:\ppjdp.exec:\ppjdp.exe210⤵PID:2440
-
\??\c:\jddjv.exec:\jddjv.exe211⤵PID:2840
-
\??\c:\lxrxxrl.exec:\lxrxxrl.exe212⤵PID:2116
-
\??\c:\rlrflfx.exec:\rlrflfx.exe213⤵PID:1460
-
\??\c:\lfrrllr.exec:\lfrrllr.exe214⤵PID:2420
-
\??\c:\tbnhhh.exec:\tbnhhh.exe215⤵PID:2456
-
\??\c:\hbhhnn.exec:\hbhhnn.exe216⤵PID:384
-
\??\c:\9vddd.exec:\9vddd.exe217⤵PID:332
-
\??\c:\vpdjv.exec:\vpdjv.exe218⤵PID:324
-
\??\c:\rfffxxl.exec:\rfffxxl.exe219⤵PID:2608
-
\??\c:\xxrrlxx.exec:\xxrrlxx.exe220⤵PID:2712
-
\??\c:\nhtnnh.exec:\nhtnnh.exe221⤵PID:2816
-
\??\c:\nnbnbh.exec:\nnbnbh.exe222⤵PID:2480
-
\??\c:\xfrlfxf.exec:\xfrlfxf.exe223⤵PID:1408
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe224⤵PID:2612
-
\??\c:\3ntbnn.exec:\3ntbnn.exe225⤵PID:2992
-
\??\c:\7hnnnh.exec:\7hnnnh.exe226⤵PID:2240
-
\??\c:\5bbhbn.exec:\5bbhbn.exe227⤵PID:3048
-
\??\c:\dvjjd.exec:\dvjjd.exe228⤵PID:2340
-
\??\c:\vvdjj.exec:\vvdjj.exe229⤵PID:2216
-
\??\c:\lllrxlx.exec:\lllrxlx.exe230⤵PID:900
-
\??\c:\frrxlrx.exec:\frrxlrx.exe231⤵PID:1412
-
\??\c:\llxxffl.exec:\llxxffl.exe232⤵PID:1464
-
\??\c:\tnnhtt.exec:\tnnhtt.exe233⤵PID:3060
-
\??\c:\5btthb.exec:\5btthb.exe234⤵PID:1976
-
\??\c:\dvdjd.exec:\dvdjd.exe235⤵PID:560
-
\??\c:\pjvvj.exec:\pjvvj.exe236⤵PID:2144
-
\??\c:\pjpvd.exec:\pjpvd.exe237⤵PID:1064
-
\??\c:\xrffrrf.exec:\xrffrrf.exe238⤵PID:2524
-
\??\c:\rlxxfxl.exec:\rlxxfxl.exe239⤵PID:1952
-
\??\c:\7xlxlrf.exec:\7xlxlrf.exe240⤵PID:2972
-
\??\c:\vvdjd.exec:\vvdjd.exe241⤵PID:2928
-
\??\c:\vvvjj.exec:\vvvjj.exe242⤵PID:3020