Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 08:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90_NeikiAnalytics.exe
-
Size
86KB
-
MD5
7d1f0e06c1b71bac91561d9efa5a3980
-
SHA1
b9588ba49d8ccdeaea719e8b77aaddeae7fb7f62
-
SHA256
2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90
-
SHA512
767739ef150c987ffcd4e381f7c958557b2da27392f2a6a5fea432348548f341749010faac597b2031ad0aea72cb5df23c9830e822ae0b040d95ab0b14231d4c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MlYqn+jMp9jXXR:ymb3NkkiQ3mdBjFo73tvn+Yp9jnR
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2096-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-65-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-85-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
9nbbht.exevvdjd.exevpvpv.exe7xlflff.exehbttnt.exepdjdj.exejvvdj.exelrfxxfl.exehbnnbh.exehbhbtb.exejdddd.exejdppd.exeffxxflx.exelxlllfr.exe5nntbh.exedvvjv.exepdvpj.exefrrrllf.exexxxrlxl.exebtttht.exe9vjjp.exe9rxlfrr.exelffrlxx.exehnhnth.exe9jddp.exepjpvp.exefrfrxff.exetntttt.exevpvdj.exejvvvv.exellrllrr.exelrlxfff.exebnbhtt.exedvpdp.exefrrrfxf.exe3lrxfxf.exe3bnnnt.exe9bnhnt.exepvjvj.exe1jvdj.exe9xlxffr.exexlrrfll.exe7bbhtt.exe7nbnbh.exe1dpvv.exepjppp.exelflrxrf.exexrfrrxf.exettnbnb.exe9hhbhb.exejdvvj.exepjjvv.exe5xrxxlf.exelfllrrl.exenhbhnb.exebhhthb.exejdpdj.exedpjdj.exexrffxlr.exefxllrxf.exe5htntb.exehhbnbn.exepdjvd.exejdpvd.exepid process 2368 9nbbht.exe 3028 vvdjd.exe 2636 vpvpv.exe 2560 7xlflff.exe 2668 hbttnt.exe 2680 pdjdj.exe 2448 jvvdj.exe 2900 lrfxxfl.exe 2864 hbnnbh.exe 2408 hbhbtb.exe 2524 jdddd.exe 1964 jdppd.exe 2332 ffxxflx.exe 1952 lxlllfr.exe 1652 5nntbh.exe 2168 dvvjv.exe 2192 pdvpj.exe 1432 frrrllf.exe 2068 xxxrlxl.exe 2412 btttht.exe 2688 9vjjp.exe 540 9rxlfrr.exe 1476 lffrlxx.exe 608 hnhnth.exe 2400 9jddp.exe 1032 pjpvp.exe 2976 frfrxff.exe 2896 tntttt.exe 2308 vpvdj.exe 2816 jvvvv.exe 2292 llrllrr.exe 1996 lrlxfff.exe 2256 bnbhtt.exe 2544 dvpdp.exe 2676 frrrfxf.exe 2528 3lrxfxf.exe 2776 3bnnnt.exe 2660 9bnhnt.exe 2468 pvjvj.exe 2488 1jvdj.exe 2480 9xlxffr.exe 2512 xlrrfll.exe 2500 7bbhtt.exe 2604 7nbnbh.exe 1416 1dpvv.exe 1744 pjppp.exe 2348 lflrxrf.exe 2748 xrfrrxf.exe 1944 ttnbnb.exe 276 9hhbhb.exe 800 jdvvj.exe 1896 pjjvv.exe 1940 5xrxxlf.exe 1588 lfllrrl.exe 1152 nhbhnb.exe 1432 bhhthb.exe 2612 jdpdj.exe 2024 dpjdj.exe 2112 xrffxlr.exe 808 fxllrxf.exe 672 5htntb.exe 580 hhbnbn.exe 2404 pdjvd.exe 1988 jdpvd.exe -
Processes:
resource yara_rule behavioral1/memory/2096-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90_NeikiAnalytics.exe9nbbht.exevvdjd.exevpvpv.exe7xlflff.exehbttnt.exepdjdj.exejvvdj.exelrfxxfl.exehbnnbh.exehbhbtb.exejdddd.exejdppd.exeffxxflx.exelxlllfr.exe5nntbh.exedescription pid process target process PID 2096 wrote to memory of 2368 2096 2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90_NeikiAnalytics.exe 9nbbht.exe PID 2096 wrote to memory of 2368 2096 2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90_NeikiAnalytics.exe 9nbbht.exe PID 2096 wrote to memory of 2368 2096 2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90_NeikiAnalytics.exe 9nbbht.exe PID 2096 wrote to memory of 2368 2096 2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90_NeikiAnalytics.exe 9nbbht.exe PID 2368 wrote to memory of 3028 2368 9nbbht.exe vvdjd.exe PID 2368 wrote to memory of 3028 2368 9nbbht.exe vvdjd.exe PID 2368 wrote to memory of 3028 2368 9nbbht.exe vvdjd.exe PID 2368 wrote to memory of 3028 2368 9nbbht.exe vvdjd.exe PID 3028 wrote to memory of 2636 3028 vvdjd.exe vpvpv.exe PID 3028 wrote to memory of 2636 3028 vvdjd.exe vpvpv.exe PID 3028 wrote to memory of 2636 3028 vvdjd.exe vpvpv.exe PID 3028 wrote to memory of 2636 3028 vvdjd.exe vpvpv.exe PID 2636 wrote to memory of 2560 2636 vpvpv.exe 7xlflff.exe PID 2636 wrote to memory of 2560 2636 vpvpv.exe 7xlflff.exe PID 2636 wrote to memory of 2560 2636 vpvpv.exe 7xlflff.exe PID 2636 wrote to memory of 2560 2636 vpvpv.exe 7xlflff.exe PID 2560 wrote to memory of 2668 2560 7xlflff.exe hbttnt.exe PID 2560 wrote to memory of 2668 2560 7xlflff.exe hbttnt.exe PID 2560 wrote to memory of 2668 2560 7xlflff.exe hbttnt.exe PID 2560 wrote to memory of 2668 2560 7xlflff.exe hbttnt.exe PID 2668 wrote to memory of 2680 2668 hbttnt.exe pdjdj.exe PID 2668 wrote to memory of 2680 2668 hbttnt.exe pdjdj.exe PID 2668 wrote to memory of 2680 2668 hbttnt.exe pdjdj.exe PID 2668 wrote to memory of 2680 2668 hbttnt.exe pdjdj.exe PID 2680 wrote to memory of 2448 2680 pdjdj.exe jvvdj.exe PID 2680 wrote to memory of 2448 2680 pdjdj.exe jvvdj.exe PID 2680 wrote to memory of 2448 2680 pdjdj.exe jvvdj.exe PID 2680 wrote to memory of 2448 2680 pdjdj.exe jvvdj.exe PID 2448 wrote to memory of 2900 2448 jvvdj.exe lrfxxfl.exe PID 2448 wrote to memory of 2900 2448 jvvdj.exe lrfxxfl.exe PID 2448 wrote to memory of 2900 2448 jvvdj.exe lrfxxfl.exe PID 2448 wrote to memory of 2900 2448 jvvdj.exe lrfxxfl.exe PID 2900 wrote to memory of 2864 2900 lrfxxfl.exe hbnnbh.exe PID 2900 wrote to memory of 2864 2900 lrfxxfl.exe hbnnbh.exe PID 2900 wrote to memory of 2864 2900 lrfxxfl.exe hbnnbh.exe PID 2900 wrote to memory of 2864 2900 lrfxxfl.exe hbnnbh.exe PID 2864 wrote to memory of 2408 2864 hbnnbh.exe hbhbtb.exe PID 2864 wrote to memory of 2408 2864 hbnnbh.exe hbhbtb.exe PID 2864 wrote to memory of 2408 2864 hbnnbh.exe hbhbtb.exe PID 2864 wrote to memory of 2408 2864 hbnnbh.exe hbhbtb.exe PID 2408 wrote to memory of 2524 2408 hbhbtb.exe jdddd.exe PID 2408 wrote to memory of 2524 2408 hbhbtb.exe jdddd.exe PID 2408 wrote to memory of 2524 2408 hbhbtb.exe jdddd.exe PID 2408 wrote to memory of 2524 2408 hbhbtb.exe jdddd.exe PID 2524 wrote to memory of 1964 2524 jdddd.exe jdppd.exe PID 2524 wrote to memory of 1964 2524 jdddd.exe jdppd.exe PID 2524 wrote to memory of 1964 2524 jdddd.exe jdppd.exe PID 2524 wrote to memory of 1964 2524 jdddd.exe jdppd.exe PID 1964 wrote to memory of 2332 1964 jdppd.exe ffxxflx.exe PID 1964 wrote to memory of 2332 1964 jdppd.exe ffxxflx.exe PID 1964 wrote to memory of 2332 1964 jdppd.exe ffxxflx.exe PID 1964 wrote to memory of 2332 1964 jdppd.exe ffxxflx.exe PID 2332 wrote to memory of 1952 2332 ffxxflx.exe lxlllfr.exe PID 2332 wrote to memory of 1952 2332 ffxxflx.exe lxlllfr.exe PID 2332 wrote to memory of 1952 2332 ffxxflx.exe lxlllfr.exe PID 2332 wrote to memory of 1952 2332 ffxxflx.exe lxlllfr.exe PID 1952 wrote to memory of 1652 1952 lxlllfr.exe 5nntbh.exe PID 1952 wrote to memory of 1652 1952 lxlllfr.exe 5nntbh.exe PID 1952 wrote to memory of 1652 1952 lxlllfr.exe 5nntbh.exe PID 1952 wrote to memory of 1652 1952 lxlllfr.exe 5nntbh.exe PID 1652 wrote to memory of 2168 1652 5nntbh.exe dvvjv.exe PID 1652 wrote to memory of 2168 1652 5nntbh.exe dvvjv.exe PID 1652 wrote to memory of 2168 1652 5nntbh.exe dvvjv.exe PID 1652 wrote to memory of 2168 1652 5nntbh.exe dvvjv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\9nbbht.exec:\9nbbht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\vvdjd.exec:\vvdjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\vpvpv.exec:\vpvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\7xlflff.exec:\7xlflff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\hbttnt.exec:\hbttnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\pdjdj.exec:\pdjdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\jvvdj.exec:\jvvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\lrfxxfl.exec:\lrfxxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\hbnnbh.exec:\hbnnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\hbhbtb.exec:\hbhbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\jdddd.exec:\jdddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\jdppd.exec:\jdppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\ffxxflx.exec:\ffxxflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\lxlllfr.exec:\lxlllfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\5nntbh.exec:\5nntbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\dvvjv.exec:\dvvjv.exe17⤵
- Executes dropped EXE
PID:2168 -
\??\c:\pdvpj.exec:\pdvpj.exe18⤵
- Executes dropped EXE
PID:2192 -
\??\c:\frrrllf.exec:\frrrllf.exe19⤵
- Executes dropped EXE
PID:1432 -
\??\c:\xxxrlxl.exec:\xxxrlxl.exe20⤵
- Executes dropped EXE
PID:2068 -
\??\c:\btttht.exec:\btttht.exe21⤵
- Executes dropped EXE
PID:2412 -
\??\c:\9vjjp.exec:\9vjjp.exe22⤵
- Executes dropped EXE
PID:2688 -
\??\c:\9rxlfrr.exec:\9rxlfrr.exe23⤵
- Executes dropped EXE
PID:540 -
\??\c:\lffrlxx.exec:\lffrlxx.exe24⤵
- Executes dropped EXE
PID:1476 -
\??\c:\hnhnth.exec:\hnhnth.exe25⤵
- Executes dropped EXE
PID:608 -
\??\c:\9jddp.exec:\9jddp.exe26⤵
- Executes dropped EXE
PID:2400 -
\??\c:\pjpvp.exec:\pjpvp.exe27⤵
- Executes dropped EXE
PID:1032 -
\??\c:\frfrxff.exec:\frfrxff.exe28⤵
- Executes dropped EXE
PID:2976 -
\??\c:\tntttt.exec:\tntttt.exe29⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vpvdj.exec:\vpvdj.exe30⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jvvvv.exec:\jvvvv.exe31⤵
- Executes dropped EXE
PID:2816 -
\??\c:\llrllrr.exec:\llrllrr.exe32⤵
- Executes dropped EXE
PID:2292 -
\??\c:\lrlxfff.exec:\lrlxfff.exe33⤵
- Executes dropped EXE
PID:1996 -
\??\c:\bnbhtt.exec:\bnbhtt.exe34⤵
- Executes dropped EXE
PID:2256 -
\??\c:\dvpdp.exec:\dvpdp.exe35⤵
- Executes dropped EXE
PID:2544 -
\??\c:\frrrfxf.exec:\frrrfxf.exe36⤵
- Executes dropped EXE
PID:2676 -
\??\c:\3lrxfxf.exec:\3lrxfxf.exe37⤵
- Executes dropped EXE
PID:2528 -
\??\c:\3bnnnt.exec:\3bnnnt.exe38⤵
- Executes dropped EXE
PID:2776 -
\??\c:\9bnhnt.exec:\9bnhnt.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pvjvj.exec:\pvjvj.exe40⤵
- Executes dropped EXE
PID:2468 -
\??\c:\1jvdj.exec:\1jvdj.exe41⤵
- Executes dropped EXE
PID:2488 -
\??\c:\9xlxffr.exec:\9xlxffr.exe42⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xlrrfll.exec:\xlrrfll.exe43⤵
- Executes dropped EXE
PID:2512 -
\??\c:\7bbhtt.exec:\7bbhtt.exe44⤵
- Executes dropped EXE
PID:2500 -
\??\c:\7nbnbh.exec:\7nbnbh.exe45⤵
- Executes dropped EXE
PID:2604 -
\??\c:\1dpvv.exec:\1dpvv.exe46⤵
- Executes dropped EXE
PID:1416 -
\??\c:\pjppp.exec:\pjppp.exe47⤵
- Executes dropped EXE
PID:1744 -
\??\c:\lflrxrf.exec:\lflrxrf.exe48⤵
- Executes dropped EXE
PID:2348 -
\??\c:\xrfrrxf.exec:\xrfrrxf.exe49⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ttnbnb.exec:\ttnbnb.exe50⤵
- Executes dropped EXE
PID:1944 -
\??\c:\9hhbhb.exec:\9hhbhb.exe51⤵
- Executes dropped EXE
PID:276 -
\??\c:\jdvvj.exec:\jdvvj.exe52⤵
- Executes dropped EXE
PID:800 -
\??\c:\pjjvv.exec:\pjjvv.exe53⤵
- Executes dropped EXE
PID:1896 -
\??\c:\5xrxxlf.exec:\5xrxxlf.exe54⤵
- Executes dropped EXE
PID:1940 -
\??\c:\lfllrrl.exec:\lfllrrl.exe55⤵
- Executes dropped EXE
PID:1588 -
\??\c:\nhbhnb.exec:\nhbhnb.exe56⤵
- Executes dropped EXE
PID:1152 -
\??\c:\bhhthb.exec:\bhhthb.exe57⤵
- Executes dropped EXE
PID:1432 -
\??\c:\jdpdj.exec:\jdpdj.exe58⤵
- Executes dropped EXE
PID:2612 -
\??\c:\dpjdj.exec:\dpjdj.exe59⤵
- Executes dropped EXE
PID:2024 -
\??\c:\xrffxlr.exec:\xrffxlr.exe60⤵
- Executes dropped EXE
PID:2112 -
\??\c:\fxllrxf.exec:\fxllrxf.exe61⤵
- Executes dropped EXE
PID:808 -
\??\c:\5htntb.exec:\5htntb.exe62⤵
- Executes dropped EXE
PID:672 -
\??\c:\hhbnbn.exec:\hhbnbn.exe63⤵
- Executes dropped EXE
PID:580 -
\??\c:\pdjvd.exec:\pdjvd.exe64⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jdpvd.exec:\jdpvd.exe65⤵
- Executes dropped EXE
PID:1988 -
\??\c:\1rrlrrx.exec:\1rrlrrx.exe66⤵PID:3012
-
\??\c:\htnhbb.exec:\htnhbb.exe67⤵PID:1032
-
\??\c:\hnthhh.exec:\hnthhh.exe68⤵PID:592
-
\??\c:\pdpjp.exec:\pdpjp.exe69⤵PID:3060
-
\??\c:\pddjj.exec:\pddjj.exe70⤵PID:1776
-
\??\c:\frfffrr.exec:\frfffrr.exe71⤵PID:1496
-
\??\c:\xlrrrll.exec:\xlrrrll.exe72⤵PID:1316
-
\??\c:\thttbb.exec:\thttbb.exe73⤵PID:2908
-
\??\c:\thnnnh.exec:\thnnnh.exe74⤵PID:1808
-
\??\c:\pjddp.exec:\pjddp.exe75⤵PID:1280
-
\??\c:\1vpjp.exec:\1vpjp.exe76⤵PID:2640
-
\??\c:\xrffrrx.exec:\xrffrrx.exe77⤵PID:2544
-
\??\c:\ffxflrr.exec:\ffxflrr.exe78⤵PID:2840
-
\??\c:\hbttbt.exec:\hbttbt.exe79⤵PID:2704
-
\??\c:\btntnb.exec:\btntnb.exe80⤵PID:2776
-
\??\c:\dpvdp.exec:\dpvdp.exe81⤵PID:2660
-
\??\c:\9dpvv.exec:\9dpvv.exe82⤵PID:2468
-
\??\c:\3fxxllr.exec:\3fxxllr.exe83⤵PID:2488
-
\??\c:\9rflffl.exec:\9rflffl.exe84⤵PID:2848
-
\??\c:\tnnntn.exec:\tnnntn.exe85⤵PID:2512
-
\??\c:\1bnbbb.exec:\1bnbbb.exe86⤵PID:2500
-
\??\c:\jvvjd.exec:\jvvjd.exe87⤵PID:2604
-
\??\c:\vvpdp.exec:\vvpdp.exe88⤵PID:2700
-
\??\c:\5lxxxrl.exec:\5lxxxrl.exe89⤵PID:1744
-
\??\c:\1lxlrfr.exec:\1lxlrfr.exe90⤵PID:2348
-
\??\c:\1bnhbn.exec:\1bnhbn.exe91⤵PID:2748
-
\??\c:\htnhhh.exec:\htnhhh.exe92⤵PID:1000
-
\??\c:\9vdjj.exec:\9vdjj.exe93⤵PID:276
-
\??\c:\xlrlfrl.exec:\xlrlfrl.exe94⤵PID:1652
-
\??\c:\lrrrfrl.exec:\lrrrfrl.exe95⤵PID:1896
-
\??\c:\hthbbt.exec:\hthbbt.exe96⤵PID:1940
-
\??\c:\httthh.exec:\httthh.exe97⤵PID:1588
-
\??\c:\dvjpp.exec:\dvjpp.exe98⤵PID:1756
-
\??\c:\vjvpj.exec:\vjvpj.exe99⤵PID:1432
-
\??\c:\flfxxrr.exec:\flfxxrr.exe100⤵PID:2180
-
\??\c:\frfxffl.exec:\frfxffl.exe101⤵PID:2024
-
\??\c:\bttbth.exec:\bttbth.exe102⤵PID:2112
-
\??\c:\hbnnth.exec:\hbnnth.exe103⤵PID:808
-
\??\c:\vpvvd.exec:\vpvvd.exe104⤵PID:672
-
\??\c:\vjvpp.exec:\vjvpp.exe105⤵PID:580
-
\??\c:\pjjdv.exec:\pjjdv.exe106⤵PID:2404
-
\??\c:\xlrllfl.exec:\xlrllfl.exe107⤵PID:1988
-
\??\c:\lxrxxxx.exec:\lxrxxxx.exe108⤵PID:1036
-
\??\c:\htbthb.exec:\htbthb.exe109⤵PID:896
-
\??\c:\jpvpj.exec:\jpvpj.exe110⤵PID:2828
-
\??\c:\9jpdd.exec:\9jpdd.exe111⤵PID:2240
-
\??\c:\vjvdj.exec:\vjvdj.exe112⤵PID:1776
-
\??\c:\rfrlrlr.exec:\rfrlrlr.exe113⤵PID:1496
-
\??\c:\3xlrllr.exec:\3xlrllr.exe114⤵PID:2292
-
\??\c:\hntnnh.exec:\hntnnh.exe115⤵PID:1996
-
\??\c:\btnhbn.exec:\btnhbn.exe116⤵PID:1720
-
\??\c:\jvvjj.exec:\jvvjj.exe117⤵PID:2988
-
\??\c:\xrxflrr.exec:\xrxflrr.exe118⤵PID:2592
-
\??\c:\flxllfl.exec:\flxllfl.exe119⤵PID:2636
-
\??\c:\thnbbh.exec:\thnbbh.exe120⤵PID:2540
-
\??\c:\httbbt.exec:\httbbt.exe121⤵PID:2752
-
\??\c:\bnhtnh.exec:\bnhtnh.exe122⤵PID:2548
-
\??\c:\9rxxffl.exec:\9rxxffl.exe123⤵PID:2464
-
\??\c:\rflllff.exec:\rflllff.exe124⤵PID:2508
-
\??\c:\hthhhb.exec:\hthhhb.exe125⤵PID:1232
-
\??\c:\nbnbtn.exec:\nbnbtn.exe126⤵PID:888
-
\??\c:\pddvv.exec:\pddvv.exe127⤵PID:2252
-
\??\c:\pjdvv.exec:\pjdvv.exe128⤵PID:2720
-
\??\c:\rfxlfff.exec:\rfxlfff.exe129⤵PID:2524
-
\??\c:\rlxfxrr.exec:\rlxfxrr.exe130⤵PID:2504
-
\??\c:\fxllrrx.exec:\fxllrrx.exe131⤵PID:1344
-
\??\c:\hbhbhn.exec:\hbhbhn.exe132⤵PID:2352
-
\??\c:\thnntb.exec:\thnntb.exe133⤵PID:1612
-
\??\c:\pjpvj.exec:\pjpvj.exe134⤵PID:1640
-
\??\c:\pdpdj.exec:\pdpdj.exe135⤵PID:1656
-
\??\c:\5rxxxrx.exec:\5rxxxrx.exe136⤵PID:2324
-
\??\c:\frrllff.exec:\frrllff.exe137⤵PID:856
-
\??\c:\hhbbbn.exec:\hhbbbn.exe138⤵PID:3056
-
\??\c:\5tbnnh.exec:\5tbnnh.exe139⤵PID:1248
-
\??\c:\pdjvv.exec:\pdjvv.exe140⤵PID:1740
-
\??\c:\1vjdd.exec:\1vjdd.exe141⤵PID:2412
-
\??\c:\lfrxxff.exec:\lfrxxff.exe142⤵PID:564
-
\??\c:\rffxxlr.exec:\rffxxlr.exe143⤵PID:1008
-
\??\c:\lxllxxf.exec:\lxllxxf.exe144⤵PID:2992
-
\??\c:\7hhhbt.exec:\7hhhbt.exe145⤵PID:1852
-
\??\c:\bnnhnb.exec:\bnnhnb.exe146⤵PID:908
-
\??\c:\pjpvj.exec:\pjpvj.exe147⤵PID:3036
-
\??\c:\7xffrlr.exec:\7xffrlr.exe148⤵PID:832
-
\??\c:\frlllll.exec:\frlllll.exe149⤵PID:1236
-
\??\c:\5xxfflr.exec:\5xxfflr.exe150⤵PID:2820
-
\??\c:\3hbtbn.exec:\3hbtbn.exe151⤵PID:1204
-
\??\c:\1tnnbh.exec:\1tnnbh.exe152⤵PID:2148
-
\??\c:\vjvdd.exec:\vjvdd.exe153⤵PID:1252
-
\??\c:\jvdvp.exec:\jvdvp.exe154⤵PID:1100
-
\??\c:\fxlrxxr.exec:\fxlrxxr.exe155⤵PID:1928
-
\??\c:\lrxrrll.exec:\lrxrrll.exe156⤵PID:1600
-
\??\c:\htbbhh.exec:\htbbhh.exe157⤵PID:2256
-
\??\c:\thnhbt.exec:\thnhbt.exe158⤵PID:2628
-
\??\c:\hnbnnh.exec:\hnbnnh.exe159⤵PID:1856
-
\??\c:\vvpvj.exec:\vvpvj.exe160⤵PID:1112
-
\??\c:\3ppjj.exec:\3ppjj.exe161⤵PID:2528
-
\??\c:\9xlrxfl.exec:\9xlrxfl.exe162⤵PID:2776
-
\??\c:\rlrxfff.exec:\rlrxfff.exe163⤵PID:2752
-
\??\c:\3fxrrrx.exec:\3fxrrrx.exe164⤵PID:2680
-
\??\c:\1bttth.exec:\1bttth.exe165⤵PID:2188
-
\??\c:\htnbhh.exec:\htnbhh.exe166⤵PID:1748
-
\??\c:\thttbt.exec:\thttbt.exe167⤵PID:768
-
\??\c:\pdvpp.exec:\pdvpp.exe168⤵PID:2500
-
\??\c:\dvvpp.exec:\dvvpp.exe169⤵PID:2740
-
\??\c:\xrfxxlr.exec:\xrfxxlr.exe170⤵PID:1540
-
\??\c:\lxxrxxx.exec:\lxxrxxx.exe171⤵PID:2344
-
\??\c:\nhnhnh.exec:\nhnhnh.exe172⤵PID:2208
-
\??\c:\bhbtnb.exec:\bhbtnb.exe173⤵PID:2356
-
\??\c:\vdppp.exec:\vdppp.exe174⤵PID:2044
-
\??\c:\7dpjp.exec:\7dpjp.exe175⤵PID:1936
-
\??\c:\xrllllr.exec:\xrllllr.exe176⤵PID:1564
-
\??\c:\lfrrfxx.exec:\lfrrfxx.exe177⤵PID:1904
-
\??\c:\flfrlll.exec:\flfrlll.exe178⤵PID:1524
-
\??\c:\hnnntn.exec:\hnnntn.exe179⤵PID:1588
-
\??\c:\bttnhb.exec:\bttnhb.exe180⤵PID:1756
-
\??\c:\3jjjj.exec:\3jjjj.exe181⤵PID:1432
-
\??\c:\pdpdd.exec:\pdpdd.exe182⤵PID:2180
-
\??\c:\xlllllr.exec:\xlllllr.exe183⤵PID:384
-
\??\c:\lxflrll.exec:\lxflrll.exe184⤵PID:2112
-
\??\c:\3bnttt.exec:\3bnttt.exe185⤵PID:808
-
\??\c:\hhnnbb.exec:\hhnnbb.exe186⤵PID:672
-
\??\c:\5vdvp.exec:\5vdvp.exe187⤵PID:1124
-
\??\c:\5vjdj.exec:\5vjdj.exe188⤵PID:2404
-
\??\c:\lrrrrff.exec:\lrrrrff.exe189⤵PID:1816
-
\??\c:\xffffxx.exec:\xffffxx.exe190⤵PID:2876
-
\??\c:\nhbbhb.exec:\nhbbhb.exe191⤵PID:1032
-
\??\c:\1hnbbb.exec:\1hnbbb.exe192⤵PID:2308
-
\??\c:\jdjpv.exec:\jdjpv.exe193⤵PID:872
-
\??\c:\9dddv.exec:\9dddv.exe194⤵PID:1776
-
\??\c:\7rfffxx.exec:\7rfffxx.exe195⤵PID:1496
-
\??\c:\flrllff.exec:\flrllff.exe196⤵PID:2292
-
\??\c:\tbhhhh.exec:\tbhhhh.exe197⤵PID:2624
-
\??\c:\nbhhnn.exec:\nbhhnn.exe198⤵PID:2940
-
\??\c:\7vjjp.exec:\7vjjp.exe199⤵PID:2588
-
\??\c:\9djdd.exec:\9djdd.exe200⤵PID:2280
-
\??\c:\llxrxrl.exec:\llxrxrl.exe201⤵PID:2948
-
\??\c:\xrffllf.exec:\xrffllf.exe202⤵PID:2596
-
\??\c:\nhttbh.exec:\nhttbh.exe203⤵PID:2668
-
\??\c:\thnbnn.exec:\thnbnn.exe204⤵PID:2548
-
\??\c:\1tbtnb.exec:\1tbtnb.exe205⤵PID:2600
-
\??\c:\9jjpv.exec:\9jjpv.exe206⤵PID:2428
-
\??\c:\jdvpj.exec:\jdvpj.exe207⤵PID:1712
-
\??\c:\xllrffr.exec:\xllrffr.exe208⤵PID:1300
-
\??\c:\nthbbb.exec:\nthbbb.exe209⤵PID:1548
-
\??\c:\pjvdd.exec:\pjvdd.exe210⤵PID:2732
-
\??\c:\jpdvv.exec:\jpdvv.exe211⤵PID:2524
-
\??\c:\jvjjd.exec:\jvjjd.exe212⤵PID:2728
-
\??\c:\rllxlxr.exec:\rllxlxr.exe213⤵PID:2472
-
\??\c:\tbhhhn.exec:\tbhhhn.exe214⤵PID:312
-
\??\c:\bhnhhb.exec:\bhnhhb.exe215⤵PID:1612
-
\??\c:\3nthtt.exec:\3nthtt.exe216⤵PID:1652
-
\??\c:\vpdpp.exec:\vpdpp.exe217⤵PID:2316
-
\??\c:\pdpjj.exec:\pdpjj.exe218⤵PID:2324
-
\??\c:\lxrlfxx.exec:\lxrlfxx.exe219⤵PID:1388
-
\??\c:\rflrrlr.exec:\rflrrlr.exe220⤵PID:1424
-
\??\c:\nhhbhb.exec:\nhhbhb.exe221⤵PID:2792
-
\??\c:\hbnbhh.exec:\hbnbhh.exe222⤵PID:2080
-
\??\c:\nhnhhb.exec:\nhnhhb.exe223⤵PID:2412
-
\??\c:\5pddj.exec:\5pddj.exe224⤵PID:1048
-
\??\c:\vjddj.exec:\vjddj.exe225⤵PID:1468
-
\??\c:\frxxlfx.exec:\frxxlfx.exe226⤵PID:1848
-
\??\c:\frlrxxx.exec:\frlrxxx.exe227⤵PID:1852
-
\??\c:\9thbnh.exec:\9thbnh.exe228⤵PID:1128
-
\??\c:\nhhhbb.exec:\nhhhbb.exe229⤵PID:3036
-
\??\c:\5pjjj.exec:\5pjjj.exe230⤵PID:2972
-
\??\c:\jvddd.exec:\jvddd.exe231⤵PID:2888
-
\??\c:\rlxfxff.exec:\rlxfxff.exe232⤵PID:2808
-
\??\c:\rrrxrfl.exec:\rrrxrfl.exe233⤵PID:1204
-
\??\c:\httbnn.exec:\httbnn.exe234⤵PID:2008
-
\??\c:\htbtbt.exec:\htbtbt.exe235⤵PID:1252
-
\??\c:\pjvpv.exec:\pjvpv.exe236⤵PID:2924
-
\??\c:\dpvdj.exec:\dpvdj.exe237⤵PID:1928
-
\??\c:\rxlffxl.exec:\rxlffxl.exe238⤵PID:1600
-
\??\c:\rxxflff.exec:\rxxflff.exe239⤵PID:2256
-
\??\c:\nbtntb.exec:\nbtntb.exe240⤵PID:2592
-
\??\c:\httbbb.exec:\httbbb.exe241⤵PID:1856
-
\??\c:\pjpvj.exec:\pjpvj.exe242⤵PID:2684