Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 15:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dfb7a7fa0e66ab11b997243f04a907c0_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
dfb7a7fa0e66ab11b997243f04a907c0_NeikiAnalytics.exe
-
Size
83KB
-
MD5
dfb7a7fa0e66ab11b997243f04a907c0
-
SHA1
5aa5ebf2d74892f135b48df022b6867e4c389118
-
SHA256
6b08410a148132d98a424c6b5668570c89c5ef79731fae23e39fa5cff422af20
-
SHA512
464049e17c792e107213030ea8cf3088dcec8181f311774ce080d2fa15f54ab84411de9903650096bc9210ebef2f92290fa602e9ec33814f67ca2ed64b65e891
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAXPfgr2hKmdbcPi2vK:ymb3NkkiQ3mdBjFo6Pfgy3dbc/K
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/4880-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2800-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1308-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
9nnbtt.exepjvvv.exerlrlxlx.exetnnnhb.exe5dvpp.exe9jjvj.exe1xrrflf.exebhbthb.exe5bhthb.exeddvjv.exe7llxrlx.exehnhbbt.exepvpdj.exevppjd.exerfxlxrf.exetttnnn.exepjdvd.exe1ddvj.exexfllrlf.exe3lfxrrf.exejvvjv.exevdvpv.exe3xxrxxl.exehhbtnh.exennhbnn.exejjdvp.exe7xlxffr.exehbtnbt.exehbbtnh.exedppvv.exexffrxxl.exexlfrfxl.exebhhhbb.exe3dpdj.exelffxlff.exexrfxxrr.exentbttn.exehtnhbt.exe9jdvj.exedjdvj.exe1rxlrlx.exerxxrffr.exe5nnhnh.exettthtt.exevjjdp.exe1jjdd.exelflxffr.exebntnnh.exedpvvv.exepdddv.exe7flxlfr.exelxrlxrf.exettttnh.exevpvpp.exepjvpd.exerlxxxxf.exerffflxr.exehbbbnn.exejvddv.exefxrrlll.exexxxrlff.exehthbtt.exenbhhbb.exedvdvp.exepid process 2280 9nnbtt.exe 116 pjvvv.exe 4124 rlrlxlx.exe 1000 tnnnhb.exe 5112 5dvpp.exe 4048 9jjvj.exe 3152 1xrrflf.exe 1984 bhbthb.exe 2340 5bhthb.exe 768 ddvjv.exe 4656 7llxrlx.exe 3648 hnhbbt.exe 816 pvpdj.exe 2800 vppjd.exe 1224 rfxlxrf.exe 5060 tttnnn.exe 3456 pjdvd.exe 3488 1ddvj.exe 1308 xfllrlf.exe 1852 3lfxrrf.exe 4316 jvvjv.exe 4424 vdvpv.exe 3664 3xxrxxl.exe 1296 hhbtnh.exe 1644 nnhbnn.exe 2200 jjdvp.exe 4960 7xlxffr.exe 2612 hbtnbt.exe 2040 hbbtnh.exe 3660 dppvv.exe 5044 xffrxxl.exe 4236 xlfrfxl.exe 2380 bhhhbb.exe 1200 3dpdj.exe 3320 lffxlff.exe 4680 xrfxxrr.exe 1416 ntbttn.exe 4304 htnhbt.exe 2604 9jdvj.exe 4880 djdvj.exe 2156 1rxlrlx.exe 116 rxxrffr.exe 2280 5nnhnh.exe 1464 ttthtt.exe 3512 vjjdp.exe 4592 1jjdd.exe 2092 lflxffr.exe 5004 bntnnh.exe 3984 dpvvv.exe 4976 pdddv.exe 2340 7flxlfr.exe 2544 lxrlxrf.exe 2072 ttttnh.exe 1620 vpvpp.exe 2764 pjvpd.exe 3680 rlxxxxf.exe 3372 rffflxr.exe 2136 hbbbnn.exe 4804 jvddv.exe 5060 fxrrlll.exe 4508 xxxrlff.exe 552 hthbtt.exe 4540 nbhhbb.exe 1272 dvdvp.exe -
Processes:
resource yara_rule behavioral2/memory/4880-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2800-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1308-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dfb7a7fa0e66ab11b997243f04a907c0_NeikiAnalytics.exe9nnbtt.exepjvvv.exerlrlxlx.exetnnnhb.exe5dvpp.exe9jjvj.exe1xrrflf.exebhbthb.exe5bhthb.exeddvjv.exe7llxrlx.exehnhbbt.exepvpdj.exevppjd.exerfxlxrf.exetttnnn.exepjdvd.exe1ddvj.exexfllrlf.exe3lfxrrf.exejvvjv.exedescription pid process target process PID 4880 wrote to memory of 2280 4880 dfb7a7fa0e66ab11b997243f04a907c0_NeikiAnalytics.exe 9nnbtt.exe PID 4880 wrote to memory of 2280 4880 dfb7a7fa0e66ab11b997243f04a907c0_NeikiAnalytics.exe 9nnbtt.exe PID 4880 wrote to memory of 2280 4880 dfb7a7fa0e66ab11b997243f04a907c0_NeikiAnalytics.exe 9nnbtt.exe PID 2280 wrote to memory of 116 2280 9nnbtt.exe pjvvv.exe PID 2280 wrote to memory of 116 2280 9nnbtt.exe pjvvv.exe PID 2280 wrote to memory of 116 2280 9nnbtt.exe pjvvv.exe PID 116 wrote to memory of 4124 116 pjvvv.exe rlrlxlx.exe PID 116 wrote to memory of 4124 116 pjvvv.exe rlrlxlx.exe PID 116 wrote to memory of 4124 116 pjvvv.exe rlrlxlx.exe PID 4124 wrote to memory of 1000 4124 rlrlxlx.exe tnnnhb.exe PID 4124 wrote to memory of 1000 4124 rlrlxlx.exe tnnnhb.exe PID 4124 wrote to memory of 1000 4124 rlrlxlx.exe tnnnhb.exe PID 1000 wrote to memory of 5112 1000 tnnnhb.exe 5dvpp.exe PID 1000 wrote to memory of 5112 1000 tnnnhb.exe 5dvpp.exe PID 1000 wrote to memory of 5112 1000 tnnnhb.exe 5dvpp.exe PID 5112 wrote to memory of 4048 5112 5dvpp.exe 9jjvj.exe PID 5112 wrote to memory of 4048 5112 5dvpp.exe 9jjvj.exe PID 5112 wrote to memory of 4048 5112 5dvpp.exe 9jjvj.exe PID 4048 wrote to memory of 3152 4048 9jjvj.exe 1xrrflf.exe PID 4048 wrote to memory of 3152 4048 9jjvj.exe 1xrrflf.exe PID 4048 wrote to memory of 3152 4048 9jjvj.exe 1xrrflf.exe PID 3152 wrote to memory of 1984 3152 1xrrflf.exe bhbthb.exe PID 3152 wrote to memory of 1984 3152 1xrrflf.exe bhbthb.exe PID 3152 wrote to memory of 1984 3152 1xrrflf.exe bhbthb.exe PID 1984 wrote to memory of 2340 1984 bhbthb.exe 5bhthb.exe PID 1984 wrote to memory of 2340 1984 bhbthb.exe 5bhthb.exe PID 1984 wrote to memory of 2340 1984 bhbthb.exe 5bhthb.exe PID 2340 wrote to memory of 768 2340 5bhthb.exe ddvjv.exe PID 2340 wrote to memory of 768 2340 5bhthb.exe ddvjv.exe PID 2340 wrote to memory of 768 2340 5bhthb.exe ddvjv.exe PID 768 wrote to memory of 4656 768 ddvjv.exe 7llxrlx.exe PID 768 wrote to memory of 4656 768 ddvjv.exe 7llxrlx.exe PID 768 wrote to memory of 4656 768 ddvjv.exe 7llxrlx.exe PID 4656 wrote to memory of 3648 4656 7llxrlx.exe hnhbbt.exe PID 4656 wrote to memory of 3648 4656 7llxrlx.exe hnhbbt.exe PID 4656 wrote to memory of 3648 4656 7llxrlx.exe hnhbbt.exe PID 3648 wrote to memory of 816 3648 hnhbbt.exe pvpdj.exe PID 3648 wrote to memory of 816 3648 hnhbbt.exe pvpdj.exe PID 3648 wrote to memory of 816 3648 hnhbbt.exe pvpdj.exe PID 816 wrote to memory of 2800 816 pvpdj.exe vppjd.exe PID 816 wrote to memory of 2800 816 pvpdj.exe vppjd.exe PID 816 wrote to memory of 2800 816 pvpdj.exe vppjd.exe PID 2800 wrote to memory of 1224 2800 vppjd.exe rfxlxrf.exe PID 2800 wrote to memory of 1224 2800 vppjd.exe rfxlxrf.exe PID 2800 wrote to memory of 1224 2800 vppjd.exe rfxlxrf.exe PID 1224 wrote to memory of 5060 1224 rfxlxrf.exe tttnnn.exe PID 1224 wrote to memory of 5060 1224 rfxlxrf.exe tttnnn.exe PID 1224 wrote to memory of 5060 1224 rfxlxrf.exe tttnnn.exe PID 5060 wrote to memory of 3456 5060 tttnnn.exe pjdvd.exe PID 5060 wrote to memory of 3456 5060 tttnnn.exe pjdvd.exe PID 5060 wrote to memory of 3456 5060 tttnnn.exe pjdvd.exe PID 3456 wrote to memory of 3488 3456 pjdvd.exe 1ddvj.exe PID 3456 wrote to memory of 3488 3456 pjdvd.exe 1ddvj.exe PID 3456 wrote to memory of 3488 3456 pjdvd.exe 1ddvj.exe PID 3488 wrote to memory of 1308 3488 1ddvj.exe xfllrlf.exe PID 3488 wrote to memory of 1308 3488 1ddvj.exe xfllrlf.exe PID 3488 wrote to memory of 1308 3488 1ddvj.exe xfllrlf.exe PID 1308 wrote to memory of 1852 1308 xfllrlf.exe 3lfxrrf.exe PID 1308 wrote to memory of 1852 1308 xfllrlf.exe 3lfxrrf.exe PID 1308 wrote to memory of 1852 1308 xfllrlf.exe 3lfxrrf.exe PID 1852 wrote to memory of 4316 1852 3lfxrrf.exe jvvjv.exe PID 1852 wrote to memory of 4316 1852 3lfxrrf.exe jvvjv.exe PID 1852 wrote to memory of 4316 1852 3lfxrrf.exe jvvjv.exe PID 4316 wrote to memory of 4424 4316 jvvjv.exe vdvpv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfb7a7fa0e66ab11b997243f04a907c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dfb7a7fa0e66ab11b997243f04a907c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\9nnbtt.exec:\9nnbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\pjvvv.exec:\pjvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\rlrlxlx.exec:\rlrlxlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\tnnnhb.exec:\tnnnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\5dvpp.exec:\5dvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\9jjvj.exec:\9jjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\1xrrflf.exec:\1xrrflf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\bhbthb.exec:\bhbthb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\5bhthb.exec:\5bhthb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\ddvjv.exec:\ddvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\7llxrlx.exec:\7llxrlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\hnhbbt.exec:\hnhbbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\pvpdj.exec:\pvpdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\vppjd.exec:\vppjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\rfxlxrf.exec:\rfxlxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\tttnnn.exec:\tttnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\pjdvd.exec:\pjdvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\1ddvj.exec:\1ddvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\xfllrlf.exec:\xfllrlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\3lfxrrf.exec:\3lfxrrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\jvvjv.exec:\jvvjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\vdvpv.exec:\vdvpv.exe23⤵
- Executes dropped EXE
PID:4424 -
\??\c:\3xxrxxl.exec:\3xxrxxl.exe24⤵
- Executes dropped EXE
PID:3664 -
\??\c:\hhbtnh.exec:\hhbtnh.exe25⤵
- Executes dropped EXE
PID:1296 -
\??\c:\nnhbnn.exec:\nnhbnn.exe26⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jjdvp.exec:\jjdvp.exe27⤵
- Executes dropped EXE
PID:2200 -
\??\c:\7xlxffr.exec:\7xlxffr.exe28⤵
- Executes dropped EXE
PID:4960 -
\??\c:\hbtnbt.exec:\hbtnbt.exe29⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hbbtnh.exec:\hbbtnh.exe30⤵
- Executes dropped EXE
PID:2040 -
\??\c:\dppvv.exec:\dppvv.exe31⤵
- Executes dropped EXE
PID:3660 -
\??\c:\xffrxxl.exec:\xffrxxl.exe32⤵
- Executes dropped EXE
PID:5044 -
\??\c:\xlfrfxl.exec:\xlfrfxl.exe33⤵
- Executes dropped EXE
PID:4236 -
\??\c:\bhhhbb.exec:\bhhhbb.exe34⤵
- Executes dropped EXE
PID:2380 -
\??\c:\3dpdj.exec:\3dpdj.exe35⤵
- Executes dropped EXE
PID:1200 -
\??\c:\lffxlff.exec:\lffxlff.exe36⤵
- Executes dropped EXE
PID:3320 -
\??\c:\xrfxxrr.exec:\xrfxxrr.exe37⤵
- Executes dropped EXE
PID:4680 -
\??\c:\ntbttn.exec:\ntbttn.exe38⤵
- Executes dropped EXE
PID:1416 -
\??\c:\htnhbt.exec:\htnhbt.exe39⤵
- Executes dropped EXE
PID:4304 -
\??\c:\9jdvj.exec:\9jdvj.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\djdvj.exec:\djdvj.exe41⤵
- Executes dropped EXE
PID:4880 -
\??\c:\1rxlrlx.exec:\1rxlrlx.exe42⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rxxrffr.exec:\rxxrffr.exe43⤵
- Executes dropped EXE
PID:116 -
\??\c:\5nnhnh.exec:\5nnhnh.exe44⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ttthtt.exec:\ttthtt.exe45⤵
- Executes dropped EXE
PID:1464 -
\??\c:\vjjdp.exec:\vjjdp.exe46⤵
- Executes dropped EXE
PID:3512 -
\??\c:\1jjdd.exec:\1jjdd.exe47⤵
- Executes dropped EXE
PID:4592 -
\??\c:\lflxffr.exec:\lflxffr.exe48⤵
- Executes dropped EXE
PID:2092 -
\??\c:\bntnnh.exec:\bntnnh.exe49⤵
- Executes dropped EXE
PID:5004 -
\??\c:\dpvvv.exec:\dpvvv.exe50⤵
- Executes dropped EXE
PID:3984 -
\??\c:\pdddv.exec:\pdddv.exe51⤵
- Executes dropped EXE
PID:4976 -
\??\c:\7flxlfr.exec:\7flxlfr.exe52⤵
- Executes dropped EXE
PID:2340 -
\??\c:\lxrlxrf.exec:\lxrlxrf.exe53⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ttttnh.exec:\ttttnh.exe54⤵
- Executes dropped EXE
PID:2072 -
\??\c:\vpvpp.exec:\vpvpp.exe55⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pjvpd.exec:\pjvpd.exe56⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe57⤵
- Executes dropped EXE
PID:3680 -
\??\c:\rffflxr.exec:\rffflxr.exe58⤵
- Executes dropped EXE
PID:3372 -
\??\c:\hbbbnn.exec:\hbbbnn.exe59⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jvddv.exec:\jvddv.exe60⤵
- Executes dropped EXE
PID:4804 -
\??\c:\fxrrlll.exec:\fxrrlll.exe61⤵
- Executes dropped EXE
PID:5060 -
\??\c:\xxxrlff.exec:\xxxrlff.exe62⤵
- Executes dropped EXE
PID:4508 -
\??\c:\hthbtt.exec:\hthbtt.exe63⤵
- Executes dropped EXE
PID:552 -
\??\c:\nbhhbb.exec:\nbhhbb.exe64⤵
- Executes dropped EXE
PID:4540 -
\??\c:\dvdvp.exec:\dvdvp.exe65⤵
- Executes dropped EXE
PID:1272 -
\??\c:\dvppd.exec:\dvppd.exe66⤵PID:1852
-
\??\c:\xlrlxxx.exec:\xlrlxxx.exe67⤵PID:4316
-
\??\c:\hntnhb.exec:\hntnhb.exe68⤵PID:3624
-
\??\c:\hnnnhh.exec:\hnnnhh.exe69⤵PID:2296
-
\??\c:\3pvvv.exec:\3pvvv.exe70⤵PID:4372
-
\??\c:\xxffrlx.exec:\xxffrlx.exe71⤵PID:3732
-
\??\c:\3bhbbt.exec:\3bhbbt.exe72⤵PID:1296
-
\??\c:\nbhbbb.exec:\nbhbbb.exe73⤵PID:5096
-
\??\c:\dvvpj.exec:\dvvpj.exe74⤵PID:8
-
\??\c:\fxxrxfl.exec:\fxxrxfl.exe75⤵PID:4984
-
\??\c:\bbnhnh.exec:\bbnhnh.exe76⤵PID:4960
-
\??\c:\5vvvj.exec:\5vvvj.exe77⤵PID:3540
-
\??\c:\5ppjv.exec:\5ppjv.exe78⤵PID:4876
-
\??\c:\fxxrrll.exec:\fxxrrll.exe79⤵PID:3076
-
\??\c:\pjppp.exec:\pjppp.exe80⤵PID:2532
-
\??\c:\vvvpd.exec:\vvvpd.exe81⤵PID:5108
-
\??\c:\7rfffll.exec:\7rfffll.exe82⤵PID:4400
-
\??\c:\nntnhh.exec:\nntnhh.exe83⤵PID:4536
-
\??\c:\7nnhhh.exec:\7nnhhh.exe84⤵PID:616
-
\??\c:\vvdpj.exec:\vvdpj.exe85⤵PID:1572
-
\??\c:\lrxxfll.exec:\lrxxfll.exe86⤵PID:4676
-
\??\c:\nhbnhb.exec:\nhbnhb.exe87⤵PID:1828
-
\??\c:\ddjpj.exec:\ddjpj.exe88⤵PID:4512
-
\??\c:\pdjvp.exec:\pdjvp.exe89⤵PID:208
-
\??\c:\9rxlrlr.exec:\9rxlrlr.exe90⤵PID:100
-
\??\c:\3rxrlxr.exec:\3rxrlxr.exe91⤵PID:4384
-
\??\c:\bnnbtn.exec:\bnnbtn.exe92⤵PID:2344
-
\??\c:\7bbtbb.exec:\7bbtbb.exe93⤵PID:944
-
\??\c:\vdjdp.exec:\vdjdp.exe94⤵PID:4672
-
\??\c:\hbbbth.exec:\hbbbth.exe95⤵PID:3196
-
\??\c:\dvppd.exec:\dvppd.exe96⤵PID:4268
-
\??\c:\rfflxxl.exec:\rfflxxl.exe97⤵PID:4144
-
\??\c:\nhnttt.exec:\nhnttt.exe98⤵PID:1688
-
\??\c:\1btnbb.exec:\1btnbb.exe99⤵PID:812
-
\??\c:\jvvvp.exec:\jvvvp.exe100⤵PID:2512
-
\??\c:\dppdp.exec:\dppdp.exe101⤵PID:5072
-
\??\c:\fxlffff.exec:\fxlffff.exe102⤵PID:2008
-
\??\c:\tbtbnn.exec:\tbtbnn.exe103⤵PID:5088
-
\??\c:\bhnhhh.exec:\bhnhhh.exe104⤵PID:4928
-
\??\c:\9ddvj.exec:\9ddvj.exe105⤵PID:1616
-
\??\c:\pvppv.exec:\pvppv.exe106⤵PID:4964
-
\??\c:\frxrxrx.exec:\frxrxrx.exe107⤵PID:2800
-
\??\c:\xlllxrr.exec:\xlllxrr.exe108⤵PID:1224
-
\??\c:\1nbthb.exec:\1nbthb.exe109⤵PID:1208
-
\??\c:\dpjvv.exec:\dpjvv.exe110⤵PID:3644
-
\??\c:\pddpv.exec:\pddpv.exe111⤵PID:3100
-
\??\c:\djpdp.exec:\djpdp.exe112⤵PID:3488
-
\??\c:\lrlxlfr.exec:\lrlxlfr.exe113⤵PID:1908
-
\??\c:\1hbthb.exec:\1hbthb.exe114⤵PID:4552
-
\??\c:\bhtnbt.exec:\bhtnbt.exe115⤵PID:1276
-
\??\c:\dppdp.exec:\dppdp.exe116⤵PID:2620
-
\??\c:\pjvjj.exec:\pjvjj.exe117⤵PID:736
-
\??\c:\fllxlfx.exec:\fllxlfx.exe118⤵PID:4424
-
\??\c:\rfffrrf.exec:\rfffrrf.exe119⤵PID:3424
-
\??\c:\nttnhb.exec:\nttnhb.exe120⤵PID:540
-
\??\c:\htthtn.exec:\htthtn.exe121⤵PID:1540
-
\??\c:\7pjdj.exec:\7pjdj.exe122⤵PID:1656
-
\??\c:\xxllfxr.exec:\xxllfxr.exe123⤵PID:4820
-
\??\c:\fxrlffx.exec:\fxrlffx.exe124⤵PID:4896
-
\??\c:\bhhbnh.exec:\bhhbnh.exe125⤵PID:3256
-
\??\c:\1pdpv.exec:\1pdpv.exe126⤵PID:2040
-
\??\c:\xlfrfxr.exec:\xlfrfxr.exe127⤵PID:3700
-
\??\c:\3btttt.exec:\3btttt.exe128⤵PID:3660
-
\??\c:\1ntntt.exec:\1ntntt.exe129⤵PID:3216
-
\??\c:\pdpdp.exec:\pdpdp.exe130⤵PID:1536
-
\??\c:\vjjdv.exec:\vjjdv.exe131⤵PID:3532
-
\??\c:\xflfrrl.exec:\xflfrrl.exe132⤵PID:4236
-
\??\c:\9fxxlfx.exec:\9fxxlfx.exe133⤵PID:4968
-
\??\c:\thbhtt.exec:\thbhtt.exe134⤵PID:4768
-
\??\c:\thnbtn.exec:\thnbtn.exe135⤵PID:4860
-
\??\c:\vjjdj.exec:\vjjdj.exe136⤵PID:4868
-
\??\c:\rrxrfxr.exec:\rrxrfxr.exe137⤵PID:220
-
\??\c:\rrxxfff.exec:\rrxxfff.exe138⤵PID:388
-
\??\c:\9hbbbb.exec:\9hbbbb.exe139⤵PID:3976
-
\??\c:\dppjv.exec:\dppjv.exe140⤵PID:1560
-
\??\c:\jppdv.exec:\jppdv.exe141⤵PID:3864
-
\??\c:\5fxrfxr.exec:\5fxrfxr.exe142⤵PID:5112
-
\??\c:\httnbt.exec:\httnbt.exe143⤵PID:2108
-
\??\c:\tnnbtn.exec:\tnnbtn.exe144⤵PID:924
-
\??\c:\9ppjj.exec:\9ppjj.exe145⤵PID:1124
-
\??\c:\pjvvd.exec:\pjvvd.exe146⤵PID:5004
-
\??\c:\lllfxrr.exec:\lllfxrr.exe147⤵PID:1396
-
\??\c:\flfxlfr.exec:\flfxlfr.exe148⤵PID:4976
-
\??\c:\thbtbb.exec:\thbtbb.exe149⤵PID:2544
-
\??\c:\bbnntt.exec:\bbnntt.exe150⤵PID:3868
-
\??\c:\vpjjj.exec:\vpjjj.exe151⤵PID:1352
-
\??\c:\5jddp.exec:\5jddp.exe152⤵PID:2764
-
\??\c:\xflfrlf.exec:\xflfrlf.exe153⤵PID:3980
-
\??\c:\1hhhhh.exec:\1hhhhh.exe154⤵PID:4964
-
\??\c:\hbhbhh.exec:\hbhbhh.exe155⤵PID:2136
-
\??\c:\pvjjv.exec:\pvjjv.exe156⤵PID:4752
-
\??\c:\xffxlfx.exec:\xffxlfx.exe157⤵PID:5060
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe158⤵PID:368
-
\??\c:\fxxrllf.exec:\fxxrllf.exe159⤵PID:4504
-
\??\c:\9tnnhh.exec:\9tnnhh.exe160⤵PID:4540
-
\??\c:\7dppd.exec:\7dppd.exe161⤵PID:1272
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe162⤵PID:4828
-
\??\c:\lxrlrlx.exec:\lxrlrlx.exe163⤵PID:452
-
\??\c:\nbhthb.exec:\nbhthb.exe164⤵PID:2620
-
\??\c:\bnhbhb.exec:\bnhbhb.exe165⤵PID:736
-
\??\c:\pdvpv.exec:\pdvpv.exe166⤵PID:2268
-
\??\c:\9jdvj.exec:\9jdvj.exe167⤵PID:3424
-
\??\c:\3ffxllf.exec:\3ffxllf.exe168⤵PID:4064
-
\??\c:\3xrlxxr.exec:\3xrlxxr.exe169⤵PID:2200
-
\??\c:\hbbtnn.exec:\hbbtnn.exe170⤵PID:2824
-
\??\c:\9vvjd.exec:\9vvjd.exe171⤵PID:1836
-
\??\c:\1llxxxx.exec:\1llxxxx.exe172⤵PID:1704
-
\??\c:\hnnbtn.exec:\hnnbtn.exe173⤵PID:4908
-
\??\c:\bttntt.exec:\bttntt.exe174⤵PID:1652
-
\??\c:\3pvpp.exec:\3pvpp.exe175⤵PID:5044
-
\??\c:\9rxrrrx.exec:\9rxrrrx.exe176⤵PID:1448
-
\??\c:\bbbbtt.exec:\bbbbtt.exe177⤵PID:2324
-
\??\c:\thhhtn.exec:\thhhtn.exe178⤵PID:2380
-
\??\c:\ddvpd.exec:\ddvpd.exe179⤵PID:2428
-
\??\c:\xlffrll.exec:\xlffrll.exe180⤵PID:4676
-
\??\c:\3xxxxxr.exec:\3xxxxxr.exe181⤵PID:4348
-
\??\c:\tnhbtt.exec:\tnhbtt.exe182⤵PID:2396
-
\??\c:\jdjjj.exec:\jdjjj.exe183⤵PID:2604
-
\??\c:\vpvvd.exec:\vpvvd.exe184⤵PID:2320
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe185⤵PID:4624
-
\??\c:\thnbbt.exec:\thnbbt.exe186⤵PID:4144
-
\??\c:\7bnhtt.exec:\7bnhtt.exe187⤵PID:812
-
\??\c:\tbbnbn.exec:\tbbnbn.exe188⤵PID:4456
-
\??\c:\jddvj.exec:\jddvj.exe189⤵PID:1612
-
\??\c:\jvpdv.exec:\jvpdv.exe190⤵PID:4976
-
\??\c:\lfrxrxx.exec:\lfrxrxx.exe191⤵PID:2544
-
\??\c:\xrxfxxx.exec:\xrxfxxx.exe192⤵PID:4132
-
\??\c:\3ttnbb.exec:\3ttnbb.exe193⤵PID:3992
-
\??\c:\hbtnhh.exec:\hbtnhh.exe194⤵PID:1616
-
\??\c:\djjjv.exec:\djjjv.exe195⤵PID:2576
-
\??\c:\7vvpd.exec:\7vvpd.exe196⤵PID:2800
-
\??\c:\llffrxr.exec:\llffrxr.exe197⤵PID:1916
-
\??\c:\rrxfrrl.exec:\rrxfrrl.exe198⤵PID:1208
-
\??\c:\1bnhnn.exec:\1bnhnn.exe199⤵PID:5116
-
\??\c:\hbbtnh.exec:\hbbtnh.exe200⤵PID:4140
-
\??\c:\hhbbtt.exec:\hhbbtt.exe201⤵PID:4780
-
\??\c:\dpjdd.exec:\dpjdd.exe202⤵PID:4828
-
\??\c:\1vjdv.exec:\1vjdv.exe203⤵PID:396
-
\??\c:\rrrlxxr.exec:\rrrlxxr.exe204⤵PID:2620
-
\??\c:\rllfrrl.exec:\rllfrrl.exe205⤵PID:1788
-
\??\c:\thhbnn.exec:\thhbnn.exe206⤵PID:1976
-
\??\c:\nnttnn.exec:\nnttnn.exe207⤵PID:876
-
\??\c:\1pvpv.exec:\1pvpv.exe208⤵PID:2312
-
\??\c:\dppjj.exec:\dppjj.exe209⤵PID:4820
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe210⤵PID:3516
-
\??\c:\frrrlxr.exec:\frrrlxr.exe211⤵PID:2712
-
\??\c:\nttnhh.exec:\nttnhh.exe212⤵PID:1392
-
\??\c:\tnhbtt.exec:\tnhbtt.exe213⤵PID:3548
-
\??\c:\pppjd.exec:\pppjd.exe214⤵PID:3216
-
\??\c:\pdvpj.exec:\pdvpj.exe215⤵PID:3532
-
\??\c:\rxxxfff.exec:\rxxxfff.exe216⤵PID:2324
-
\??\c:\rxxrrfx.exec:\rxxrrfx.exe217⤵PID:4660
-
\??\c:\bnhhbb.exec:\bnhhbb.exe218⤵PID:1700
-
\??\c:\5ntbtt.exec:\5ntbtt.exe219⤵PID:2100
-
\??\c:\dpjdv.exec:\dpjdv.exe220⤵PID:2276
-
\??\c:\jdpjv.exec:\jdpjv.exe221⤵PID:388
-
\??\c:\llfxllx.exec:\llfxllx.exe222⤵PID:2540
-
\??\c:\lxrlffr.exec:\lxrlffr.exe223⤵PID:1328
-
\??\c:\nbtnhh.exec:\nbtnhh.exe224⤵PID:2600
-
\??\c:\nhtnhb.exec:\nhtnhb.exe225⤵PID:1968
-
\??\c:\7pppj.exec:\7pppj.exe226⤵PID:1032
-
\??\c:\jddvp.exec:\jddvp.exe227⤵PID:2148
-
\??\c:\pdvpj.exec:\pdvpj.exe228⤵PID:812
-
\??\c:\rrrlxxl.exec:\rrrlxxl.exe229⤵PID:3240
-
\??\c:\xrrrxxx.exec:\xrrrxxx.exe230⤵PID:1600
-
\??\c:\ththnh.exec:\ththnh.exe231⤵PID:1920
-
\??\c:\thhbtt.exec:\thhbtt.exe232⤵PID:3972
-
\??\c:\bthbnh.exec:\bthbnh.exe233⤵PID:4940
-
\??\c:\7djdv.exec:\7djdv.exe234⤵PID:3980
-
\??\c:\lflrxxr.exec:\lflrxxr.exe235⤵PID:4804
-
\??\c:\llllrrx.exec:\llllrrx.exe236⤵PID:688
-
\??\c:\hnthbt.exec:\hnthbt.exe237⤵PID:996
-
\??\c:\jddvp.exec:\jddvp.exe238⤵PID:4504
-
\??\c:\dvpdv.exec:\dvpdv.exe239⤵PID:5116
-
\??\c:\fffxrrl.exec:\fffxrrl.exe240⤵PID:1912
-
\??\c:\nhbthh.exec:\nhbthh.exe241⤵PID:3604
-
\??\c:\htnhtt.exec:\htnhtt.exe242⤵PID:1256