Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 01:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4b94ba8aa80f0d2f319098dc0a3ec970_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4b94ba8aa80f0d2f319098dc0a3ec970_NeikiAnalytics.exe
-
Size
277KB
-
MD5
4b94ba8aa80f0d2f319098dc0a3ec970
-
SHA1
cc387a62374c6aa9bf42869b9934662b917720ad
-
SHA256
ced3f7480324116317b57e0ab8dc0db3836a69a6227932fa6693836c49c2ac0e
-
SHA512
6304617db62a78e2d50e966c916b057b2733dccefec9991b5caf72840f8169ed502f699725e0a9d20cc2239be52d1b0787c4940ff0dd10aadd3d3f8057a799d0
-
SSDEEP
6144:n3C9BRIG0asYFm71m8+GdkB9yMu7VvemN:n3C9uYA71kSMuP
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/4076-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xxffllr.exe08624.exenntnnt.exeppppp.exe80000.exedvdvp.exebhbbtt.exe1rrlffr.exetnthbn.exeflffllr.exelrxfffr.exe868600.exe1dpjj.exe662600.exerlrlrrl.exem2082.exe24060.exexrrfrfr.exe4068228.exe42660.exebhtntt.exeddpjd.exes2864.exedpvpv.exee80206.exe7nhhhn.exe62886.exerfrxxrr.exevjdjp.exeu086000.exettbthn.exe4404866.exe062266.exe7xxrxxr.exehbhhbb.exefflfffr.exe006000.exe6248840.exebthbnn.exeddpjp.exe9vjjp.exethtbhh.exe062680.exe6624844.exe1rxlllx.exexflfxrl.exe9xlrrff.exe024884.exe6624684.exexfrrfxf.exebnhhbt.exe208626.exebhhhbt.exe640040.exe80222.exe9tbbhh.exefxxxxxr.exebbnhtn.exe4402288.exe1lffxxr.exexrlfffl.exexrxfffx.exe44666.exe9vdpj.exepid process 2448 xxffllr.exe 4428 08624.exe 1916 nntnnt.exe 1696 ppppp.exe 3200 80000.exe 4212 dvdvp.exe 4552 bhbbtt.exe 2328 1rrlffr.exe 1068 tnthbn.exe 1608 flffllr.exe 3096 lrxfffr.exe 3236 868600.exe 4004 1dpjj.exe 1984 662600.exe 3916 rlrlrrl.exe 4468 m2082.exe 1660 24060.exe 1628 xrrfrfr.exe 404 4068228.exe 1852 42660.exe 1508 bhtntt.exe 1952 ddpjd.exe 4652 s2864.exe 2288 dpvpv.exe 3952 e80206.exe 3648 7nhhhn.exe 4596 62886.exe 3440 rfrxxrr.exe 4908 vjdjp.exe 4824 u086000.exe 2304 ttbthn.exe 2320 4404866.exe 4636 062266.exe 2772 7xxrxxr.exe 1932 hbhhbb.exe 2688 fflfffr.exe 3116 006000.exe 224 6248840.exe 1164 bthbnn.exe 3712 ddpjp.exe 1728 9vjjp.exe 4184 thtbhh.exe 3200 062680.exe 4212 6624844.exe 2668 1rxlllx.exe 1472 xflfxrl.exe 116 9xlrrff.exe 2328 024884.exe 5080 6624684.exe 4928 xfrrfxf.exe 4536 bnhhbt.exe 4576 208626.exe 3796 bhhhbt.exe 884 640040.exe 1116 80222.exe 1312 9tbbhh.exe 2112 fxxxxxr.exe 4404 bbnhtn.exe 540 4402288.exe 3976 1lffxxr.exe 2316 xrlfffl.exe 436 xrxfffx.exe 4080 44666.exe 1852 9vdpj.exe -
Processes:
resource yara_rule behavioral2/memory/4076-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-11-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4b94ba8aa80f0d2f319098dc0a3ec970_NeikiAnalytics.exexxffllr.exe08624.exenntnnt.exeppppp.exe80000.exedvdvp.exebhbbtt.exe1rrlffr.exetnthbn.exeflffllr.exelrxfffr.exe868600.exe1dpjj.exe662600.exerlrlrrl.exem2082.exe24060.exexrrfrfr.exe4068228.exe42660.exebhtntt.exedescription pid process target process PID 4076 wrote to memory of 2448 4076 4b94ba8aa80f0d2f319098dc0a3ec970_NeikiAnalytics.exe xxffllr.exe PID 4076 wrote to memory of 2448 4076 4b94ba8aa80f0d2f319098dc0a3ec970_NeikiAnalytics.exe xxffllr.exe PID 4076 wrote to memory of 2448 4076 4b94ba8aa80f0d2f319098dc0a3ec970_NeikiAnalytics.exe xxffllr.exe PID 2448 wrote to memory of 4428 2448 xxffllr.exe 08624.exe PID 2448 wrote to memory of 4428 2448 xxffllr.exe 08624.exe PID 2448 wrote to memory of 4428 2448 xxffllr.exe 08624.exe PID 4428 wrote to memory of 1916 4428 08624.exe nntnnt.exe PID 4428 wrote to memory of 1916 4428 08624.exe nntnnt.exe PID 4428 wrote to memory of 1916 4428 08624.exe nntnnt.exe PID 1916 wrote to memory of 1696 1916 nntnnt.exe ppppp.exe PID 1916 wrote to memory of 1696 1916 nntnnt.exe ppppp.exe PID 1916 wrote to memory of 1696 1916 nntnnt.exe ppppp.exe PID 1696 wrote to memory of 3200 1696 ppppp.exe 80000.exe PID 1696 wrote to memory of 3200 1696 ppppp.exe 80000.exe PID 1696 wrote to memory of 3200 1696 ppppp.exe 80000.exe PID 3200 wrote to memory of 4212 3200 80000.exe dvdvp.exe PID 3200 wrote to memory of 4212 3200 80000.exe dvdvp.exe PID 3200 wrote to memory of 4212 3200 80000.exe dvdvp.exe PID 4212 wrote to memory of 4552 4212 dvdvp.exe bhbbtt.exe PID 4212 wrote to memory of 4552 4212 dvdvp.exe bhbbtt.exe PID 4212 wrote to memory of 4552 4212 dvdvp.exe bhbbtt.exe PID 4552 wrote to memory of 2328 4552 bhbbtt.exe 1rrlffr.exe PID 4552 wrote to memory of 2328 4552 bhbbtt.exe 1rrlffr.exe PID 4552 wrote to memory of 2328 4552 bhbbtt.exe 1rrlffr.exe PID 2328 wrote to memory of 1068 2328 1rrlffr.exe tnthbn.exe PID 2328 wrote to memory of 1068 2328 1rrlffr.exe tnthbn.exe PID 2328 wrote to memory of 1068 2328 1rrlffr.exe tnthbn.exe PID 1068 wrote to memory of 1608 1068 tnthbn.exe flffllr.exe PID 1068 wrote to memory of 1608 1068 tnthbn.exe flffllr.exe PID 1068 wrote to memory of 1608 1068 tnthbn.exe flffllr.exe PID 1608 wrote to memory of 3096 1608 flffllr.exe vpddj.exe PID 1608 wrote to memory of 3096 1608 flffllr.exe vpddj.exe PID 1608 wrote to memory of 3096 1608 flffllr.exe vpddj.exe PID 3096 wrote to memory of 3236 3096 lrxfffr.exe 868600.exe PID 3096 wrote to memory of 3236 3096 lrxfffr.exe 868600.exe PID 3096 wrote to memory of 3236 3096 lrxfffr.exe 868600.exe PID 3236 wrote to memory of 4004 3236 868600.exe 1dpjj.exe PID 3236 wrote to memory of 4004 3236 868600.exe 1dpjj.exe PID 3236 wrote to memory of 4004 3236 868600.exe 1dpjj.exe PID 4004 wrote to memory of 1984 4004 1dpjj.exe 662600.exe PID 4004 wrote to memory of 1984 4004 1dpjj.exe 662600.exe PID 4004 wrote to memory of 1984 4004 1dpjj.exe 662600.exe PID 1984 wrote to memory of 3916 1984 662600.exe rlrlrrl.exe PID 1984 wrote to memory of 3916 1984 662600.exe rlrlrrl.exe PID 1984 wrote to memory of 3916 1984 662600.exe rlrlrrl.exe PID 3916 wrote to memory of 4468 3916 rlrlrrl.exe m2082.exe PID 3916 wrote to memory of 4468 3916 rlrlrrl.exe m2082.exe PID 3916 wrote to memory of 4468 3916 rlrlrrl.exe m2082.exe PID 4468 wrote to memory of 1660 4468 m2082.exe 24060.exe PID 4468 wrote to memory of 1660 4468 m2082.exe 24060.exe PID 4468 wrote to memory of 1660 4468 m2082.exe 24060.exe PID 1660 wrote to memory of 1628 1660 24060.exe xrrfrfr.exe PID 1660 wrote to memory of 1628 1660 24060.exe xrrfrfr.exe PID 1660 wrote to memory of 1628 1660 24060.exe xrrfrfr.exe PID 1628 wrote to memory of 404 1628 xrrfrfr.exe 480288.exe PID 1628 wrote to memory of 404 1628 xrrfrfr.exe 480288.exe PID 1628 wrote to memory of 404 1628 xrrfrfr.exe 480288.exe PID 404 wrote to memory of 1852 404 4068228.exe 42660.exe PID 404 wrote to memory of 1852 404 4068228.exe 42660.exe PID 404 wrote to memory of 1852 404 4068228.exe 42660.exe PID 1852 wrote to memory of 1508 1852 42660.exe bhtntt.exe PID 1852 wrote to memory of 1508 1852 42660.exe bhtntt.exe PID 1852 wrote to memory of 1508 1852 42660.exe bhtntt.exe PID 1508 wrote to memory of 1952 1508 bhtntt.exe vppdv.exe
Processes
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\4b94ba8aa80f0d2f319098dc0a3ec970_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4b94ba8aa80f0d2f319098dc0a3ec970_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\xxffllr.exec:\xxffllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\08624.exec:\08624.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\nntnnt.exec:\nntnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\ppppp.exec:\ppppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\80000.exec:\80000.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\dvdvp.exec:\dvdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\bhbbtt.exec:\bhbbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\1rrlffr.exec:\1rrlffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\tnthbn.exec:\tnthbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\flffllr.exec:\flffllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\lrxfffr.exec:\lrxfffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\868600.exec:\868600.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\1dpjj.exec:\1dpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\662600.exec:\662600.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\rlrlrrl.exec:\rlrlrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\m2082.exec:\m2082.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\24060.exec:\24060.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\xrrfrfr.exec:\xrrfrfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\4068228.exec:\4068228.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\42660.exec:\42660.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\bhtntt.exec:\bhtntt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\ddpjd.exec:\ddpjd.exe23⤵
- Executes dropped EXE
PID:1952 -
\??\c:\s2864.exec:\s2864.exe24⤵
- Executes dropped EXE
PID:4652 -
\??\c:\dpvpv.exec:\dpvpv.exe25⤵
- Executes dropped EXE
PID:2288 -
\??\c:\e80206.exec:\e80206.exe26⤵
- Executes dropped EXE
PID:3952 -
\??\c:\7nhhhn.exec:\7nhhhn.exe27⤵
- Executes dropped EXE
PID:3648 -
\??\c:\62886.exec:\62886.exe28⤵
- Executes dropped EXE
PID:4596 -
\??\c:\rfrxxrr.exec:\rfrxxrr.exe29⤵
- Executes dropped EXE
PID:3440 -
\??\c:\vjdjp.exec:\vjdjp.exe30⤵
- Executes dropped EXE
PID:4908 -
\??\c:\u086000.exec:\u086000.exe31⤵
- Executes dropped EXE
PID:4824 -
\??\c:\ttbthn.exec:\ttbthn.exe32⤵
- Executes dropped EXE
PID:2304 -
\??\c:\4404866.exec:\4404866.exe33⤵
- Executes dropped EXE
PID:2320 -
\??\c:\062266.exec:\062266.exe34⤵
- Executes dropped EXE
PID:4636 -
\??\c:\7xxrxxr.exec:\7xxrxxr.exe35⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hbhhbb.exec:\hbhhbb.exe36⤵
- Executes dropped EXE
PID:1932 -
\??\c:\fflfffr.exec:\fflfffr.exe37⤵
- Executes dropped EXE
PID:2688 -
\??\c:\006000.exec:\006000.exe38⤵
- Executes dropped EXE
PID:3116 -
\??\c:\6248840.exec:\6248840.exe39⤵
- Executes dropped EXE
PID:224 -
\??\c:\bthbnn.exec:\bthbnn.exe40⤵
- Executes dropped EXE
PID:1164 -
\??\c:\ddpjp.exec:\ddpjp.exe41⤵
- Executes dropped EXE
PID:3712 -
\??\c:\9vjjp.exec:\9vjjp.exe42⤵
- Executes dropped EXE
PID:1728 -
\??\c:\thtbhh.exec:\thtbhh.exe43⤵
- Executes dropped EXE
PID:4184 -
\??\c:\062680.exec:\062680.exe44⤵
- Executes dropped EXE
PID:3200 -
\??\c:\6624844.exec:\6624844.exe45⤵
- Executes dropped EXE
PID:4212 -
\??\c:\1rxlllx.exec:\1rxlllx.exe46⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xflfxrl.exec:\xflfxrl.exe47⤵
- Executes dropped EXE
PID:1472 -
\??\c:\9xlrrff.exec:\9xlrrff.exe48⤵
- Executes dropped EXE
PID:116 -
\??\c:\024884.exec:\024884.exe49⤵
- Executes dropped EXE
PID:2328 -
\??\c:\6624684.exec:\6624684.exe50⤵
- Executes dropped EXE
PID:5080 -
\??\c:\xfrrfxf.exec:\xfrrfxf.exe51⤵
- Executes dropped EXE
PID:4928 -
\??\c:\bnhhbt.exec:\bnhhbt.exe52⤵
- Executes dropped EXE
PID:4536 -
\??\c:\208626.exec:\208626.exe53⤵
- Executes dropped EXE
PID:4576 -
\??\c:\bhhhbt.exec:\bhhhbt.exe54⤵
- Executes dropped EXE
PID:3796 -
\??\c:\640040.exec:\640040.exe55⤵
- Executes dropped EXE
PID:884 -
\??\c:\80222.exec:\80222.exe56⤵
- Executes dropped EXE
PID:1116 -
\??\c:\9tbbhh.exec:\9tbbhh.exe57⤵
- Executes dropped EXE
PID:1312 -
\??\c:\fxxxxxr.exec:\fxxxxxr.exe58⤵
- Executes dropped EXE
PID:2112 -
\??\c:\bbnhtn.exec:\bbnhtn.exe59⤵
- Executes dropped EXE
PID:4404 -
\??\c:\4402288.exec:\4402288.exe60⤵
- Executes dropped EXE
PID:540 -
\??\c:\1lffxxr.exec:\1lffxxr.exe61⤵
- Executes dropped EXE
PID:3976 -
\??\c:\xrlfffl.exec:\xrlfffl.exe62⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xrxfffx.exec:\xrxfffx.exe63⤵
- Executes dropped EXE
PID:436 -
\??\c:\44666.exec:\44666.exe64⤵
- Executes dropped EXE
PID:4080 -
\??\c:\9vdpj.exec:\9vdpj.exe65⤵
- Executes dropped EXE
PID:1852 -
\??\c:\ppvjd.exec:\ppvjd.exe66⤵PID:4580
-
\??\c:\bhttbn.exec:\bhttbn.exe67⤵PID:3340
-
\??\c:\c808226.exec:\c808226.exe68⤵PID:3904
-
\??\c:\084848.exec:\084848.exe69⤵PID:1924
-
\??\c:\06644.exec:\06644.exe70⤵PID:1964
-
\??\c:\02226.exec:\02226.exe71⤵PID:2292
-
\??\c:\llxlxfx.exec:\llxlxfx.exe72⤵PID:4516
-
\??\c:\6660264.exec:\6660264.exe73⤵PID:708
-
\??\c:\u026040.exec:\u026040.exe74⤵PID:1012
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe75⤵PID:2376
-
\??\c:\vpddv.exec:\vpddv.exe76⤵PID:3056
-
\??\c:\08088.exec:\08088.exe77⤵PID:920
-
\??\c:\s6200.exec:\s6200.exe78⤵PID:2120
-
\??\c:\7flfxlr.exec:\7flfxlr.exe79⤵PID:4064
-
\??\c:\06004.exec:\06004.exe80⤵PID:2968
-
\??\c:\820400.exec:\820400.exe81⤵PID:1572
-
\??\c:\nnttbt.exec:\nnttbt.exe82⤵PID:4336
-
\??\c:\2266004.exec:\2266004.exe83⤵PID:2308
-
\??\c:\pjvpj.exec:\pjvpj.exe84⤵PID:2704
-
\??\c:\nthhhh.exec:\nthhhh.exe85⤵PID:264
-
\??\c:\3dppj.exec:\3dppj.exe86⤵PID:320
-
\??\c:\rxfllff.exec:\rxfllff.exe87⤵PID:2812
-
\??\c:\20082.exec:\20082.exe88⤵PID:5048
-
\??\c:\606088.exec:\606088.exe89⤵PID:4392
-
\??\c:\2822602.exec:\2822602.exe90⤵PID:1728
-
\??\c:\jjddv.exec:\jjddv.exe91⤵PID:888
-
\??\c:\lflfxxr.exec:\lflfxxr.exe92⤵PID:1200
-
\??\c:\jpppd.exec:\jpppd.exe93⤵PID:4212
-
\??\c:\826482.exec:\826482.exe94⤵PID:4768
-
\??\c:\844284.exec:\844284.exe95⤵PID:3508
-
\??\c:\8840646.exec:\8840646.exe96⤵PID:5016
-
\??\c:\jvvjp.exec:\jvvjp.exe97⤵PID:3344
-
\??\c:\84602.exec:\84602.exe98⤵PID:4116
-
\??\c:\jjppj.exec:\jjppj.exe99⤵PID:5108
-
\??\c:\40260.exec:\40260.exe100⤵PID:2716
-
\??\c:\020248.exec:\020248.exe101⤵PID:4920
-
\??\c:\86626.exec:\86626.exe102⤵PID:3128
-
\??\c:\dpdjj.exec:\dpdjj.exe103⤵PID:884
-
\??\c:\2280244.exec:\2280244.exe104⤵PID:1904
-
\??\c:\422026.exec:\422026.exe105⤵PID:3112
-
\??\c:\rrrffxr.exec:\rrrffxr.exe106⤵PID:4848
-
\??\c:\k02022.exec:\k02022.exe107⤵PID:1660
-
\??\c:\bnnbhb.exec:\bnnbhb.exe108⤵PID:3640
-
\??\c:\86444.exec:\86444.exe109⤵PID:3064
-
\??\c:\jdjpj.exec:\jdjpj.exe110⤵PID:3448
-
\??\c:\628000.exec:\628000.exe111⤵PID:2632
-
\??\c:\3lfxxrl.exec:\3lfxxrl.exe112⤵PID:1424
-
\??\c:\24628.exec:\24628.exe113⤵PID:1036
-
\??\c:\frxrxxx.exec:\frxrxxx.exe114⤵PID:2540
-
\??\c:\6800444.exec:\6800444.exe115⤵PID:3080
-
\??\c:\66226.exec:\66226.exe116⤵PID:4072
-
\??\c:\864024.exec:\864024.exe117⤵PID:3296
-
\??\c:\rfrfxxr.exec:\rfrfxxr.exe118⤵PID:4752
-
\??\c:\82040.exec:\82040.exe119⤵PID:2776
-
\??\c:\2684008.exec:\2684008.exe120⤵PID:4516
-
\??\c:\88480.exec:\88480.exe121⤵PID:708
-
\??\c:\htbnnh.exec:\htbnnh.exe122⤵PID:380
-
\??\c:\g0804.exec:\g0804.exe123⤵PID:2376
-
\??\c:\9llfffr.exec:\9llfffr.exe124⤵PID:836
-
\??\c:\vvpvd.exec:\vvpvd.exe125⤵PID:4476
-
\??\c:\228440.exec:\228440.exe126⤵PID:4084
-
\??\c:\4006482.exec:\4006482.exe127⤵PID:4064
-
\??\c:\8266024.exec:\8266024.exe128⤵PID:4340
-
\??\c:\flllffx.exec:\flllffx.exe129⤵PID:3360
-
\??\c:\2848284.exec:\2848284.exe130⤵PID:2240
-
\??\c:\a6486.exec:\a6486.exe131⤵PID:2308
-
\??\c:\006480.exec:\006480.exe132⤵PID:2704
-
\??\c:\xrrrllf.exec:\xrrrllf.exe133⤵PID:264
-
\??\c:\lfrlrlf.exec:\lfrlrlf.exe134⤵PID:4664
-
\??\c:\hhnbnh.exec:\hhnbnh.exe135⤵PID:4696
-
\??\c:\484288.exec:\484288.exe136⤵PID:1220
-
\??\c:\frfffrr.exec:\frfffrr.exe137⤵PID:4184
-
\??\c:\4488682.exec:\4488682.exe138⤵PID:888
-
\??\c:\llrllrx.exec:\llrllrx.exe139⤵PID:1428
-
\??\c:\jjpdv.exec:\jjpdv.exe140⤵PID:2756
-
\??\c:\28822.exec:\28822.exe141⤵PID:3508
-
\??\c:\hnttnt.exec:\hnttnt.exe142⤵PID:3544
-
\??\c:\2206266.exec:\2206266.exe143⤵PID:1056
-
\??\c:\7xxxrrl.exec:\7xxxrrl.exe144⤵PID:3888
-
\??\c:\jdpjp.exec:\jdpjp.exe145⤵PID:3796
-
\??\c:\jdddp.exec:\jdddp.exe146⤵PID:1872
-
\??\c:\djjdd.exec:\djjdd.exe147⤵PID:4328
-
\??\c:\c808484.exec:\c808484.exe148⤵PID:2096
-
\??\c:\0620482.exec:\0620482.exe149⤵PID:2996
-
\??\c:\88668.exec:\88668.exe150⤵PID:3608
-
\??\c:\9lfxffl.exec:\9lfxffl.exe151⤵PID:4488
-
\??\c:\nbttbt.exec:\nbttbt.exe152⤵PID:1660
-
\??\c:\fxlfrff.exec:\fxlfrff.exe153⤵PID:3640
-
\??\c:\lflfxff.exec:\lflfxff.exe154⤵PID:4100
-
\??\c:\xfllflr.exec:\xfllflr.exe155⤵PID:3448
-
\??\c:\628260.exec:\628260.exe156⤵PID:780
-
\??\c:\64482.exec:\64482.exe157⤵PID:1036
-
\??\c:\28482.exec:\28482.exe158⤵PID:2540
-
\??\c:\dvpjd.exec:\dvpjd.exe159⤵PID:1924
-
\??\c:\w02600.exec:\w02600.exe160⤵PID:4120
-
\??\c:\2262284.exec:\2262284.exe161⤵PID:3296
-
\??\c:\tbnhbn.exec:\tbnhbn.exe162⤵PID:4508
-
\??\c:\0660660.exec:\0660660.exe163⤵PID:3456
-
\??\c:\86822.exec:\86822.exe164⤵PID:5064
-
\??\c:\xlxxxrx.exec:\xlxxxrx.exe165⤵PID:5060
-
\??\c:\7lflfxf.exec:\7lflfxf.exe166⤵PID:2376
-
\??\c:\lxllfxl.exec:\lxllfxl.exe167⤵PID:2120
-
\??\c:\fllxlfr.exec:\fllxlfr.exe168⤵PID:1676
-
\??\c:\jjjdv.exec:\jjjdv.exe169⤵PID:772
-
\??\c:\80886.exec:\80886.exe170⤵PID:5084
-
\??\c:\668682.exec:\668682.exe171⤵PID:1932
-
\??\c:\ntbhbt.exec:\ntbhbt.exe172⤵PID:3100
-
\??\c:\040060.exec:\040060.exe173⤵PID:2408
-
\??\c:\5vdvj.exec:\5vdvj.exe174⤵PID:264
-
\??\c:\0884080.exec:\0884080.exe175⤵PID:5048
-
\??\c:\htthnt.exec:\htthnt.exe176⤵PID:1816
-
\??\c:\662666.exec:\662666.exe177⤵PID:2116
-
\??\c:\5dvpj.exec:\5dvpj.exe178⤵PID:2420
-
\??\c:\nhhtbb.exec:\nhhtbb.exe179⤵PID:4812
-
\??\c:\284888.exec:\284888.exe180⤵PID:688
-
\??\c:\240088.exec:\240088.exe181⤵PID:2964
-
\??\c:\9flfrrl.exec:\9flfrrl.exe182⤵PID:2616
-
\??\c:\440042.exec:\440042.exe183⤵PID:3480
-
\??\c:\lllfxxr.exec:\lllfxxr.exe184⤵PID:4104
-
\??\c:\4004826.exec:\4004826.exe185⤵PID:3112
-
\??\c:\pdjvj.exec:\pdjvj.exe186⤵PID:4352
-
\??\c:\pjvjd.exec:\pjvjd.exe187⤵PID:788
-
\??\c:\w84262.exec:\w84262.exe188⤵PID:1996
-
\??\c:\402608.exec:\402608.exe189⤵PID:3064
-
\??\c:\vvppv.exec:\vvppv.exe190⤵PID:4876
-
\??\c:\pvpdv.exec:\pvpdv.exe191⤵PID:2632
-
\??\c:\9fflflx.exec:\9fflflx.exe192⤵PID:2144
-
\??\c:\7ffxrrf.exec:\7ffxrrf.exe193⤵PID:4492
-
\??\c:\3hnnht.exec:\3hnnht.exe194⤵PID:3080
-
\??\c:\44620.exec:\44620.exe195⤵PID:1584
-
\??\c:\5jjvj.exec:\5jjvj.exe196⤵PID:1924
-
\??\c:\3ddpj.exec:\3ddpj.exe197⤵PID:3328
-
\??\c:\a4604.exec:\a4604.exe198⤵PID:2336
-
\??\c:\lllxxxr.exec:\lllxxxr.exe199⤵PID:4120
-
\??\c:\jvjvp.exec:\jvjvp.exe200⤵PID:3296
-
\??\c:\660048.exec:\660048.exe201⤵PID:4508
-
\??\c:\bbhbnn.exec:\bbhbnn.exe202⤵PID:3456
-
\??\c:\22826.exec:\22826.exe203⤵PID:3960
-
\??\c:\288428.exec:\288428.exe204⤵PID:2916
-
\??\c:\tthhtb.exec:\tthhtb.exe205⤵PID:3756
-
\??\c:\a4626.exec:\a4626.exe206⤵PID:4764
-
\??\c:\4268226.exec:\4268226.exe207⤵PID:4132
-
\??\c:\8422600.exec:\8422600.exe208⤵PID:4340
-
\??\c:\bthnhb.exec:\bthnhb.exe209⤵PID:4332
-
\??\c:\3lrrllf.exec:\3lrrllf.exe210⤵PID:4980
-
\??\c:\q60840.exec:\q60840.exe211⤵PID:4940
-
\??\c:\082644.exec:\082644.exe212⤵PID:4428
-
\??\c:\1jjdj.exec:\1jjdj.exe213⤵PID:4436
-
\??\c:\xffrllf.exec:\xffrllf.exe214⤵PID:3500
-
\??\c:\880600.exec:\880600.exe215⤵PID:2068
-
\??\c:\1pppv.exec:\1pppv.exe216⤵PID:1428
-
\??\c:\448622.exec:\448622.exe217⤵PID:5096
-
\??\c:\llrlfxr.exec:\llrlfxr.exe218⤵PID:2428
-
\??\c:\pvppp.exec:\pvppp.exe219⤵PID:688
-
\??\c:\6668242.exec:\6668242.exe220⤵PID:3820
-
\??\c:\m0600.exec:\m0600.exe221⤵PID:4776
-
\??\c:\062482.exec:\062482.exe222⤵PID:3480
-
\??\c:\lrfxfxr.exec:\lrfxfxr.exe223⤵PID:1904
-
\??\c:\c640046.exec:\c640046.exe224⤵PID:3112
-
\??\c:\28622.exec:\28622.exe225⤵PID:4740
-
\??\c:\g4082.exec:\g4082.exe226⤵PID:788
-
\??\c:\480288.exec:\480288.exe227⤵PID:404
-
\??\c:\bbbnbt.exec:\bbbnbt.exe228⤵PID:2316
-
\??\c:\frrfxrf.exec:\frrfxrf.exe229⤵PID:4876
-
\??\c:\i682048.exec:\i682048.exe230⤵PID:4504
-
\??\c:\244824.exec:\244824.exe231⤵PID:3532
-
\??\c:\62846.exec:\62846.exe232⤵PID:1880
-
\??\c:\804246.exec:\804246.exe233⤵PID:4072
-
\??\c:\2840628.exec:\2840628.exe234⤵PID:3240
-
\??\c:\tthhnn.exec:\tthhnn.exe235⤵PID:1924
-
\??\c:\fxxxxff.exec:\fxxxxff.exe236⤵PID:2760
-
\??\c:\8288662.exec:\8288662.exe237⤵PID:3580
-
\??\c:\k20840.exec:\k20840.exe238⤵PID:2000
-
\??\c:\0462600.exec:\0462600.exe239⤵PID:4896
-
\??\c:\rxxxxfx.exec:\rxxxxfx.exe240⤵PID:4516
-
\??\c:\btbbtn.exec:\btbbtn.exe241⤵PID:3780
-
\??\c:\9lrllll.exec:\9lrllll.exe242⤵PID:5060