Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 11:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f18234443933adce15e6f6e2da6079f0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
f18234443933adce15e6f6e2da6079f0_NeikiAnalytics.exe
-
Size
115KB
-
MD5
f18234443933adce15e6f6e2da6079f0
-
SHA1
97d64734fb634dd258d94a6c824d7d89f98ce797
-
SHA256
8b161ef64ce1eb10344f968cf23b9a42e605d77c0a3d8fb60094a44ddd5d670a
-
SHA512
1d1c1802f649c4bd5d69c6716cb03d4309fddf913b119ee544365e37dddb07643ac37bc04bc95e9a5fdcb659c9727647a9a51dc103f8f85eedbf9d71ef5a617c
-
SSDEEP
3072:ymb3NkkiQ3mdBjFosxXGPXbXQMFHLgDWSmjlkFd:n3C9BRosxW8MFHLMWvli
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/4832-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/792-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1876-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1352-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xxfxrrl.exetnhtnh.exejvdpv.exeflllfff.exebhtthn.exepdpvj.exelrlxffx.exefxxrxrr.exebbbhhn.exelfffxxr.exefxrrffx.exethbbth.exevddpj.exelffrllf.exehhtttb.exepjvpd.exerrlxfrl.exexlrfxxl.exebhnbbb.exepjvvp.exerffxrlf.exe1rllxrl.exettbbhb.exe5ppjd.exe5xlxfxx.exehbntnn.exejpvdd.exexrfrrrl.exexrfrxll.exebnnhnb.exevvvpd.exeffrlffr.exennnhtt.exehhnnhn.exepdvpj.exepvvpj.exexlrlxlx.exenbbbtn.exehnnnnh.exe3vddv.exefflllrx.exebbbnhn.exethtttb.exe3jjjj.exelrxfllf.exe7jpjj.exelxlxxxr.exenbnhhh.exenntnnn.exejjdvv.exelfxrrxl.exerlxxlrf.exenhnhbt.exehhtnbb.exedvjpv.exe3llfrrl.exelfrrxrr.exehnhbnh.exepvjpp.exelffxllf.exelxfxxxx.exehbnhbh.exejpvdp.exepvvpj.exepid process 3124 xxfxrrl.exe 4836 tnhtnh.exe 2012 jvdpv.exe 1728 flllfff.exe 224 bhtthn.exe 1704 pdpvj.exe 792 lrlxffx.exe 4544 fxxrxrr.exe 4064 bbbhhn.exe 3772 lfffxxr.exe 3412 fxrrffx.exe 5024 thbbth.exe 4088 vddpj.exe 3680 lffrllf.exe 4840 hhtttb.exe 2188 pjvpd.exe 5064 rrlxfrl.exe 3060 xlrfxxl.exe 1876 bhnbbb.exe 2368 pjvvp.exe 2152 rffxrlf.exe 4780 1rllxrl.exe 1352 ttbbhb.exe 1856 5ppjd.exe 1188 5xlxfxx.exe 5028 hbntnn.exe 3924 jpvdd.exe 764 xrfrrrl.exe 4844 xrfrxll.exe 4584 bnnhnb.exe 4712 vvvpd.exe 4984 ffrlffr.exe 4632 nnnhtt.exe 4548 hhnnhn.exe 4332 pdvpj.exe 1192 pvvpj.exe 4356 xlrlxlx.exe 4724 nbbbtn.exe 1404 hnnnnh.exe 944 3vddv.exe 1560 fflllrx.exe 2836 bbbnhn.exe 2012 thtttb.exe 4716 3jjjj.exe 3236 lrxfllf.exe 872 7jpjj.exe 2148 lxlxxxr.exe 4072 nbnhhh.exe 676 nntnnn.exe 5032 jjdvv.exe 4368 lfxrrxl.exe 3892 rlxxlrf.exe 4088 nhnhbt.exe 3116 hhtnbb.exe 2672 dvjpv.exe 2188 3llfrrl.exe 4392 lfrrxrr.exe 1588 hnhbnh.exe 2576 pvjpp.exe 3660 lffxllf.exe 1664 lxfxxxx.exe 884 hbnhbh.exe 1640 jpvdp.exe 3928 pvvpj.exe -
Processes:
resource yara_rule behavioral2/memory/4832-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/792-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1876-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1352-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f18234443933adce15e6f6e2da6079f0_NeikiAnalytics.exexxfxrrl.exetnhtnh.exejvdpv.exeflllfff.exebhtthn.exepdpvj.exelrlxffx.exefxxrxrr.exebbbhhn.exelfffxxr.exefxrrffx.exethbbth.exevddpj.exelffrllf.exehhtttb.exepjvpd.exerrlxfrl.exexlrfxxl.exebhnbbb.exepjvvp.exerffxrlf.exedescription pid process target process PID 4832 wrote to memory of 3124 4832 f18234443933adce15e6f6e2da6079f0_NeikiAnalytics.exe xxfxrrl.exe PID 4832 wrote to memory of 3124 4832 f18234443933adce15e6f6e2da6079f0_NeikiAnalytics.exe xxfxrrl.exe PID 4832 wrote to memory of 3124 4832 f18234443933adce15e6f6e2da6079f0_NeikiAnalytics.exe xxfxrrl.exe PID 3124 wrote to memory of 4836 3124 xxfxrrl.exe tnhtnh.exe PID 3124 wrote to memory of 4836 3124 xxfxrrl.exe tnhtnh.exe PID 3124 wrote to memory of 4836 3124 xxfxrrl.exe tnhtnh.exe PID 4836 wrote to memory of 2012 4836 tnhtnh.exe jvdpv.exe PID 4836 wrote to memory of 2012 4836 tnhtnh.exe jvdpv.exe PID 4836 wrote to memory of 2012 4836 tnhtnh.exe jvdpv.exe PID 2012 wrote to memory of 1728 2012 jvdpv.exe flllfff.exe PID 2012 wrote to memory of 1728 2012 jvdpv.exe flllfff.exe PID 2012 wrote to memory of 1728 2012 jvdpv.exe flllfff.exe PID 1728 wrote to memory of 224 1728 flllfff.exe bhtthn.exe PID 1728 wrote to memory of 224 1728 flllfff.exe bhtthn.exe PID 1728 wrote to memory of 224 1728 flllfff.exe bhtthn.exe PID 224 wrote to memory of 1704 224 bhtthn.exe pdpvj.exe PID 224 wrote to memory of 1704 224 bhtthn.exe pdpvj.exe PID 224 wrote to memory of 1704 224 bhtthn.exe pdpvj.exe PID 1704 wrote to memory of 792 1704 pdpvj.exe lrlxffx.exe PID 1704 wrote to memory of 792 1704 pdpvj.exe lrlxffx.exe PID 1704 wrote to memory of 792 1704 pdpvj.exe lrlxffx.exe PID 792 wrote to memory of 4544 792 lrlxffx.exe fxxrxrr.exe PID 792 wrote to memory of 4544 792 lrlxffx.exe fxxrxrr.exe PID 792 wrote to memory of 4544 792 lrlxffx.exe fxxrxrr.exe PID 4544 wrote to memory of 4064 4544 fxxrxrr.exe bbbhhn.exe PID 4544 wrote to memory of 4064 4544 fxxrxrr.exe bbbhhn.exe PID 4544 wrote to memory of 4064 4544 fxxrxrr.exe bbbhhn.exe PID 4064 wrote to memory of 3772 4064 bbbhhn.exe lfffxxr.exe PID 4064 wrote to memory of 3772 4064 bbbhhn.exe lfffxxr.exe PID 4064 wrote to memory of 3772 4064 bbbhhn.exe lfffxxr.exe PID 3772 wrote to memory of 3412 3772 lfffxxr.exe fxrrffx.exe PID 3772 wrote to memory of 3412 3772 lfffxxr.exe fxrrffx.exe PID 3772 wrote to memory of 3412 3772 lfffxxr.exe fxrrffx.exe PID 3412 wrote to memory of 5024 3412 fxrrffx.exe thbbth.exe PID 3412 wrote to memory of 5024 3412 fxrrffx.exe thbbth.exe PID 3412 wrote to memory of 5024 3412 fxrrffx.exe thbbth.exe PID 5024 wrote to memory of 4088 5024 thbbth.exe vddpj.exe PID 5024 wrote to memory of 4088 5024 thbbth.exe vddpj.exe PID 5024 wrote to memory of 4088 5024 thbbth.exe vddpj.exe PID 4088 wrote to memory of 3680 4088 vddpj.exe lffrllf.exe PID 4088 wrote to memory of 3680 4088 vddpj.exe lffrllf.exe PID 4088 wrote to memory of 3680 4088 vddpj.exe lffrllf.exe PID 3680 wrote to memory of 4840 3680 lffrllf.exe hhtttb.exe PID 3680 wrote to memory of 4840 3680 lffrllf.exe hhtttb.exe PID 3680 wrote to memory of 4840 3680 lffrllf.exe hhtttb.exe PID 4840 wrote to memory of 2188 4840 hhtttb.exe pjvpd.exe PID 4840 wrote to memory of 2188 4840 hhtttb.exe pjvpd.exe PID 4840 wrote to memory of 2188 4840 hhtttb.exe pjvpd.exe PID 2188 wrote to memory of 5064 2188 pjvpd.exe rrlxfrl.exe PID 2188 wrote to memory of 5064 2188 pjvpd.exe rrlxfrl.exe PID 2188 wrote to memory of 5064 2188 pjvpd.exe rrlxfrl.exe PID 5064 wrote to memory of 3060 5064 rrlxfrl.exe xlrfxxl.exe PID 5064 wrote to memory of 3060 5064 rrlxfrl.exe xlrfxxl.exe PID 5064 wrote to memory of 3060 5064 rrlxfrl.exe xlrfxxl.exe PID 3060 wrote to memory of 1876 3060 xlrfxxl.exe bhnbbb.exe PID 3060 wrote to memory of 1876 3060 xlrfxxl.exe bhnbbb.exe PID 3060 wrote to memory of 1876 3060 xlrfxxl.exe bhnbbb.exe PID 1876 wrote to memory of 2368 1876 bhnbbb.exe pjvvp.exe PID 1876 wrote to memory of 2368 1876 bhnbbb.exe pjvvp.exe PID 1876 wrote to memory of 2368 1876 bhnbbb.exe pjvvp.exe PID 2368 wrote to memory of 2152 2368 pjvvp.exe rffxrlf.exe PID 2368 wrote to memory of 2152 2368 pjvvp.exe rffxrlf.exe PID 2368 wrote to memory of 2152 2368 pjvvp.exe rffxrlf.exe PID 2152 wrote to memory of 4780 2152 rffxrlf.exe 1rllxrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f18234443933adce15e6f6e2da6079f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f18234443933adce15e6f6e2da6079f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\xxfxrrl.exec:\xxfxrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\tnhtnh.exec:\tnhtnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\jvdpv.exec:\jvdpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\flllfff.exec:\flllfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\bhtthn.exec:\bhtthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\pdpvj.exec:\pdpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\lrlxffx.exec:\lrlxffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\fxxrxrr.exec:\fxxrxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\bbbhhn.exec:\bbbhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\lfffxxr.exec:\lfffxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\fxrrffx.exec:\fxrrffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\thbbth.exec:\thbbth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\vddpj.exec:\vddpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\lffrllf.exec:\lffrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\hhtttb.exec:\hhtttb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\pjvpd.exec:\pjvpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\rrlxfrl.exec:\rrlxfrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\xlrfxxl.exec:\xlrfxxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\bhnbbb.exec:\bhnbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\pjvvp.exec:\pjvvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\rffxrlf.exec:\rffxrlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\1rllxrl.exec:\1rllxrl.exe23⤵
- Executes dropped EXE
PID:4780 -
\??\c:\ttbbhb.exec:\ttbbhb.exe24⤵
- Executes dropped EXE
PID:1352 -
\??\c:\5ppjd.exec:\5ppjd.exe25⤵
- Executes dropped EXE
PID:1856 -
\??\c:\5xlxfxx.exec:\5xlxfxx.exe26⤵
- Executes dropped EXE
PID:1188 -
\??\c:\hbntnn.exec:\hbntnn.exe27⤵
- Executes dropped EXE
PID:5028 -
\??\c:\jpvdd.exec:\jpvdd.exe28⤵
- Executes dropped EXE
PID:3924 -
\??\c:\xrfrrrl.exec:\xrfrrrl.exe29⤵
- Executes dropped EXE
PID:764 -
\??\c:\xrfrxll.exec:\xrfrxll.exe30⤵
- Executes dropped EXE
PID:4844 -
\??\c:\bnnhnb.exec:\bnnhnb.exe31⤵
- Executes dropped EXE
PID:4584 -
\??\c:\vvvpd.exec:\vvvpd.exe32⤵
- Executes dropped EXE
PID:4712 -
\??\c:\ffrlffr.exec:\ffrlffr.exe33⤵
- Executes dropped EXE
PID:4984 -
\??\c:\nnnhtt.exec:\nnnhtt.exe34⤵
- Executes dropped EXE
PID:4632 -
\??\c:\hhnnhn.exec:\hhnnhn.exe35⤵
- Executes dropped EXE
PID:4548 -
\??\c:\pdvpj.exec:\pdvpj.exe36⤵
- Executes dropped EXE
PID:4332 -
\??\c:\pvvpj.exec:\pvvpj.exe37⤵
- Executes dropped EXE
PID:1192 -
\??\c:\xlrlxlx.exec:\xlrlxlx.exe38⤵
- Executes dropped EXE
PID:4356 -
\??\c:\nbbbtn.exec:\nbbbtn.exe39⤵
- Executes dropped EXE
PID:4724 -
\??\c:\hnnnnh.exec:\hnnnnh.exe40⤵
- Executes dropped EXE
PID:1404 -
\??\c:\3vddv.exec:\3vddv.exe41⤵
- Executes dropped EXE
PID:944 -
\??\c:\fflllrx.exec:\fflllrx.exe42⤵
- Executes dropped EXE
PID:1560 -
\??\c:\bbbnhn.exec:\bbbnhn.exe43⤵
- Executes dropped EXE
PID:2836 -
\??\c:\thtttb.exec:\thtttb.exe44⤵
- Executes dropped EXE
PID:2012 -
\??\c:\3jjjj.exec:\3jjjj.exe45⤵
- Executes dropped EXE
PID:4716 -
\??\c:\lrxfllf.exec:\lrxfllf.exe46⤵
- Executes dropped EXE
PID:3236 -
\??\c:\7jpjj.exec:\7jpjj.exe47⤵
- Executes dropped EXE
PID:872 -
\??\c:\lxlxxxr.exec:\lxlxxxr.exe48⤵
- Executes dropped EXE
PID:2148 -
\??\c:\nbnhhh.exec:\nbnhhh.exe49⤵
- Executes dropped EXE
PID:4072 -
\??\c:\nntnnn.exec:\nntnnn.exe50⤵
- Executes dropped EXE
PID:676 -
\??\c:\jjdvv.exec:\jjdvv.exe51⤵
- Executes dropped EXE
PID:5032 -
\??\c:\lfxrrxl.exec:\lfxrrxl.exe52⤵
- Executes dropped EXE
PID:4368 -
\??\c:\rlxxlrf.exec:\rlxxlrf.exe53⤵
- Executes dropped EXE
PID:3892 -
\??\c:\nhnhbt.exec:\nhnhbt.exe54⤵
- Executes dropped EXE
PID:4088 -
\??\c:\hhtnbb.exec:\hhtnbb.exe55⤵
- Executes dropped EXE
PID:3116 -
\??\c:\dvjpv.exec:\dvjpv.exe56⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3llfrrl.exec:\3llfrrl.exe57⤵
- Executes dropped EXE
PID:2188 -
\??\c:\lfrrxrr.exec:\lfrrxrr.exe58⤵
- Executes dropped EXE
PID:4392 -
\??\c:\hnhbnh.exec:\hnhbnh.exe59⤵
- Executes dropped EXE
PID:1588 -
\??\c:\pvjpp.exec:\pvjpp.exe60⤵
- Executes dropped EXE
PID:2576 -
\??\c:\lffxllf.exec:\lffxllf.exe61⤵
- Executes dropped EXE
PID:3660 -
\??\c:\lxfxxxx.exec:\lxfxxxx.exe62⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hbnhbh.exec:\hbnhbh.exe63⤵
- Executes dropped EXE
PID:884 -
\??\c:\jpvdp.exec:\jpvdp.exe64⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pvvpj.exec:\pvvpj.exe65⤵
- Executes dropped EXE
PID:3928 -
\??\c:\3lrrrrl.exec:\3lrrrrl.exe66⤵PID:4916
-
\??\c:\lffrrrl.exec:\lffrrrl.exe67⤵PID:2088
-
\??\c:\nnntnt.exec:\nnntnt.exe68⤵PID:1524
-
\??\c:\jdpdj.exec:\jdpdj.exe69⤵PID:4252
-
\??\c:\pjdvp.exec:\pjdvp.exe70⤵PID:552
-
\??\c:\rxffrrl.exec:\rxffrrl.exe71⤵PID:4016
-
\??\c:\fffllrr.exec:\fffllrr.exe72⤵PID:4844
-
\??\c:\bhbtnh.exec:\bhbtnh.exe73⤵PID:1972
-
\??\c:\tntnhh.exec:\tntnhh.exe74⤵PID:2212
-
\??\c:\vvvpj.exec:\vvvpj.exe75⤵PID:4660
-
\??\c:\xxxfrfr.exec:\xxxfrfr.exe76⤵PID:4980
-
\??\c:\fffxxxx.exec:\fffxxxx.exe77⤵PID:1564
-
\??\c:\tnhbtn.exec:\tnhbtn.exe78⤵PID:4108
-
\??\c:\btbhth.exec:\btbhth.exe79⤵PID:4332
-
\??\c:\vpvdj.exec:\vpvdj.exe80⤵PID:4376
-
\??\c:\ppdvj.exec:\ppdvj.exe81⤵PID:4356
-
\??\c:\rxfxlrl.exec:\rxfxlrl.exe82⤵PID:4724
-
\??\c:\xlrfxlf.exec:\xlrfxlf.exe83⤵PID:2948
-
\??\c:\bhhnbn.exec:\bhhnbn.exe84⤵PID:4580
-
\??\c:\hhnbtb.exec:\hhnbtb.exe85⤵PID:4396
-
\??\c:\jvvpp.exec:\jvvpp.exe86⤵PID:996
-
\??\c:\lxrlfff.exec:\lxrlfff.exe87⤵PID:972
-
\??\c:\fxfffll.exec:\fxfffll.exe88⤵PID:3112
-
\??\c:\vpjvv.exec:\vpjvv.exe89⤵PID:1148
-
\??\c:\dvpdd.exec:\dvpdd.exe90⤵PID:2980
-
\??\c:\rxrrxxf.exec:\rxrrxxf.exe91⤵PID:4072
-
\??\c:\nttbbn.exec:\nttbbn.exe92⤵PID:3328
-
\??\c:\pdvpd.exec:\pdvpd.exe93⤵PID:3412
-
\??\c:\jvdpv.exec:\jvdpv.exe94⤵PID:3080
-
\??\c:\xrrrlff.exec:\xrrrlff.exe95⤵PID:1712
-
\??\c:\hthbtn.exec:\hthbtn.exe96⤵PID:1956
-
\??\c:\1bbtnb.exec:\1bbtnb.exe97⤵PID:3116
-
\??\c:\vvdvv.exec:\vvdvv.exe98⤵PID:2744
-
\??\c:\jdvjd.exec:\jdvjd.exe99⤵PID:3776
-
\??\c:\9rrlrlf.exec:\9rrlrlf.exe100⤵PID:4788
-
\??\c:\3htnth.exec:\3htnth.exe101⤵PID:4144
-
\??\c:\bnbbbt.exec:\bnbbbt.exe102⤵PID:2632
-
\??\c:\pjjpv.exec:\pjjpv.exe103⤵PID:5116
-
\??\c:\fffxrrl.exec:\fffxrrl.exe104⤵PID:1012
-
\??\c:\fxxfrrf.exec:\fxxfrrf.exe105⤵PID:3436
-
\??\c:\tbtnht.exec:\tbtnht.exe106⤵PID:4168
-
\??\c:\nttntt.exec:\nttntt.exe107⤵PID:2408
-
\??\c:\ddpjp.exec:\ddpjp.exe108⤵PID:2872
-
\??\c:\xrlrrlx.exec:\xrlrrlx.exe109⤵PID:1188
-
\??\c:\xlrxlll.exec:\xlrxlll.exe110⤵PID:5028
-
\??\c:\nnthhb.exec:\nnthhb.exe111⤵PID:4160
-
\??\c:\pvjjv.exec:\pvjjv.exe112⤵PID:5100
-
\??\c:\7xxrlll.exec:\7xxrlll.exe113⤵PID:4016
-
\??\c:\bbhtbb.exec:\bbhtbb.exe114⤵PID:4804
-
\??\c:\jpvvv.exec:\jpvvv.exe115⤵PID:3832
-
\??\c:\jvjjj.exec:\jvjjj.exe116⤵PID:1808
-
\??\c:\rrrrrxl.exec:\rrrrrxl.exe117⤵PID:2812
-
\??\c:\ffllrrf.exec:\ffllrrf.exe118⤵PID:1608
-
\??\c:\nhtbth.exec:\nhtbth.exe119⤵PID:1616
-
\??\c:\1djvp.exec:\1djvp.exe120⤵PID:964
-
\??\c:\xlfxlfr.exec:\xlfxlfr.exe121⤵PID:4332
-
\??\c:\bthhtt.exec:\bthhtt.exe122⤵PID:4728
-
\??\c:\tbntnn.exec:\tbntnn.exe123⤵PID:1404
-
\??\c:\pdvvp.exec:\pdvvp.exe124⤵PID:4348
-
\??\c:\5rfxlxr.exec:\5rfxlxr.exe125⤵PID:1560
-
\??\c:\3llfrrl.exec:\3llfrrl.exe126⤵PID:1380
-
\??\c:\nhhbnh.exec:\nhhbnh.exe127⤵PID:2012
-
\??\c:\vpjdd.exec:\vpjdd.exe128⤵PID:1132
-
\??\c:\3ppjd.exec:\3ppjd.exe129⤵PID:3408
-
\??\c:\5flfxfx.exec:\5flfxfx.exe130⤵PID:1136
-
\??\c:\xrllfff.exec:\xrllfff.exe131⤵PID:5004
-
\??\c:\ttttnn.exec:\ttttnn.exe132⤵PID:4220
-
\??\c:\3nnhbt.exec:\3nnhbt.exe133⤵PID:5048
-
\??\c:\dppjd.exec:\dppjd.exe134⤵PID:1152
-
\??\c:\fxllrxf.exec:\fxllrxf.exe135⤵PID:4468
-
\??\c:\xxxfxlx.exec:\xxxfxlx.exe136⤵PID:3908
-
\??\c:\httnhh.exec:\httnhh.exe137⤵PID:2928
-
\??\c:\thbbbh.exec:\thbbbh.exe138⤵PID:2672
-
\??\c:\jdjpj.exec:\jdjpj.exe139⤵PID:3116
-
\??\c:\9xfxrrl.exec:\9xfxrrl.exe140⤵PID:1356
-
\??\c:\rlffxxx.exec:\rlffxxx.exe141⤵PID:2400
-
\??\c:\hbtnbn.exec:\hbtnbn.exe142⤵PID:4788
-
\??\c:\jdvvp.exec:\jdvvp.exe143⤵PID:4044
-
\??\c:\dpdvp.exec:\dpdvp.exe144⤵PID:2632
-
\??\c:\rfrrfff.exec:\rfrrfff.exe145⤵PID:1664
-
\??\c:\lrfxxxr.exec:\lrfxxxr.exe146⤵PID:3756
-
\??\c:\nbbnth.exec:\nbbnth.exe147⤵PID:3436
-
\??\c:\hbtnhn.exec:\hbtnhn.exe148⤵PID:3928
-
\??\c:\vjvdj.exec:\vjvdj.exe149⤵PID:3952
-
\??\c:\jppjp.exec:\jppjp.exe150⤵PID:2872
-
\??\c:\rxlxllx.exec:\rxlxllx.exe151⤵PID:1188
-
\??\c:\hbhnnh.exec:\hbhnnh.exe152⤵PID:4132
-
\??\c:\bhbtbt.exec:\bhbtbt.exe153⤵PID:3148
-
\??\c:\vvpjd.exec:\vvpjd.exe154⤵PID:5012
-
\??\c:\llrlxfr.exec:\llrlxfr.exe155⤵PID:1828
-
\??\c:\bnbtnb.exec:\bnbtnb.exe156⤵PID:4452
-
\??\c:\bnntbh.exec:\bnntbh.exe157⤵PID:4804
-
\??\c:\dvvvj.exec:\dvvvj.exe158⤵PID:3832
-
\??\c:\jvjdp.exec:\jvjdp.exe159⤵PID:1688
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe160⤵PID:4768
-
\??\c:\5nbthb.exec:\5nbthb.exe161⤵PID:4504
-
\??\c:\hhnttb.exec:\hhnttb.exe162⤵PID:2956
-
\??\c:\dvjdv.exec:\dvjdv.exe163⤵PID:4792
-
\??\c:\vvpdj.exec:\vvpdj.exe164⤵PID:2948
-
\??\c:\1lrlfff.exec:\1lrlfff.exe165⤵PID:4908
-
\??\c:\nbbnhb.exec:\nbbnhb.exe166⤵PID:4396
-
\??\c:\btnbnb.exec:\btnbnb.exe167⤵PID:2012
-
\??\c:\5tbttt.exec:\5tbttt.exe168⤵PID:2148
-
\??\c:\vdvpj.exec:\vdvpj.exe169⤵PID:2040
-
\??\c:\pppjp.exec:\pppjp.exe170⤵PID:2392
-
\??\c:\3rrlxfx.exec:\3rrlxfx.exe171⤵PID:1480
-
\??\c:\fxflrrr.exec:\fxflrrr.exe172⤵PID:3152
-
\??\c:\tbbbhh.exec:\tbbbhh.exe173⤵PID:3680
-
\??\c:\jjjpp.exec:\jjjpp.exe174⤵PID:2616
-
\??\c:\dddjd.exec:\dddjd.exe175⤵PID:4592
-
\??\c:\thbnbt.exec:\thbnbt.exe176⤵PID:464
-
\??\c:\htbtnb.exec:\htbtnb.exe177⤵PID:3076
-
\??\c:\dvdvj.exec:\dvdvj.exe178⤵PID:3060
-
\??\c:\dpddp.exec:\dpddp.exe179⤵PID:4416
-
\??\c:\xfxfrff.exec:\xfxfrff.exe180⤵PID:4560
-
\??\c:\1nnhnn.exec:\1nnhnn.exe181⤵PID:3660
-
\??\c:\bbnhnt.exec:\bbnhnt.exe182⤵PID:2632
-
\??\c:\pvjvd.exec:\pvjvd.exe183⤵PID:1664
-
\??\c:\lflffff.exec:\lflffff.exe184⤵PID:3756
-
\??\c:\9ffffrx.exec:\9ffffrx.exe185⤵PID:3436
-
\??\c:\bbtbnt.exec:\bbtbnt.exe186⤵PID:3164
-
\??\c:\dvpvv.exec:\dvpvv.exe187⤵PID:4508
-
\??\c:\fxfffxl.exec:\fxfffxl.exe188⤵PID:2872
-
\??\c:\7rxxffr.exec:\7rxxffr.exe189⤵PID:3664
-
\??\c:\hbntnt.exec:\hbntnt.exe190⤵PID:396
-
\??\c:\bthbbh.exec:\bthbbh.exe191⤵PID:3148
-
\??\c:\vddjj.exec:\vddjj.exe192⤵PID:1424
-
\??\c:\9lfxxfx.exec:\9lfxxfx.exe193⤵PID:2988
-
\??\c:\7tbttb.exec:\7tbttb.exe194⤵PID:2212
-
\??\c:\hbnnhh.exec:\hbnnhh.exe195⤵PID:4804
-
\??\c:\jdpjp.exec:\jdpjp.exe196⤵PID:2168
-
\??\c:\frrlffr.exec:\frrlffr.exe197⤵PID:3628
-
\??\c:\hnnhnn.exec:\hnnhnn.exe198⤵PID:1428
-
\??\c:\pjvdj.exec:\pjvdj.exe199⤵PID:3428
-
\??\c:\7rlfrxx.exec:\7rlfrxx.exe200⤵PID:1076
-
\??\c:\dpddp.exec:\dpddp.exe201⤵PID:1404
-
\??\c:\jdppj.exec:\jdppj.exe202⤵PID:1948
-
\??\c:\frxrllr.exec:\frxrllr.exe203⤵PID:1964
-
\??\c:\hbbbtb.exec:\hbbbtb.exe204⤵PID:3184
-
\??\c:\7djdv.exec:\7djdv.exe205⤵PID:444
-
\??\c:\pjjjp.exec:\pjjjp.exe206⤵PID:3772
-
\??\c:\fxrllfx.exec:\fxrllfx.exe207⤵PID:2156
-
\??\c:\hhtthn.exec:\hhtthn.exe208⤵PID:372
-
\??\c:\nthhth.exec:\nthhth.exe209⤵PID:3412
-
\??\c:\pjppj.exec:\pjppj.exe210⤵PID:4532
-
\??\c:\jpdpj.exec:\jpdpj.exe211⤵PID:3908
-
\??\c:\1rllxff.exec:\1rllxff.exe212⤵PID:4460
-
\??\c:\nthtnb.exec:\nthtnb.exe213⤵PID:3424
-
\??\c:\btbtnh.exec:\btbtnh.exe214⤵PID:4136
-
\??\c:\jpjvp.exec:\jpjvp.exe215⤵PID:2428
-
\??\c:\ffrlrrr.exec:\ffrlrrr.exe216⤵PID:2580
-
\??\c:\frfxxff.exec:\frfxxff.exe217⤵PID:4788
-
\??\c:\bbhhtt.exec:\bbhhtt.exe218⤵PID:4900
-
\??\c:\tbtnnn.exec:\tbtnnn.exe219⤵PID:624
-
\??\c:\jddvp.exec:\jddvp.exe220⤵PID:916
-
\??\c:\pdjdv.exec:\pdjdv.exe221⤵PID:3928
-
\??\c:\lxrlxxr.exec:\lxrlxxr.exe222⤵PID:4876
-
\??\c:\tbtnhb.exec:\tbtnhb.exe223⤵PID:548
-
\??\c:\hhbhbn.exec:\hhbhbn.exe224⤵PID:1524
-
\??\c:\jvdvj.exec:\jvdvj.exe225⤵PID:3656
-
\??\c:\vpvjp.exec:\vpvjp.exe226⤵PID:3172
-
\??\c:\xlfffxr.exec:\xlfffxr.exe227⤵PID:3836
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe228⤵PID:4844
-
\??\c:\thhbnb.exec:\thhbnb.exe229⤵PID:2988
-
\??\c:\vppdv.exec:\vppdv.exe230⤵PID:2212
-
\??\c:\5ddpd.exec:\5ddpd.exe231⤵PID:4660
-
\??\c:\xlfxllx.exec:\xlfxllx.exe232⤵PID:2168
-
\??\c:\1tbbhb.exec:\1tbbhb.exe233⤵PID:4388
-
\??\c:\hbnhtt.exec:\hbnhtt.exe234⤵PID:1428
-
\??\c:\ddvjd.exec:\ddvjd.exe235⤵PID:3996
-
\??\c:\xllrffx.exec:\xllrffx.exe236⤵PID:1076
-
\??\c:\hbbbbh.exec:\hbbbbh.exe237⤵PID:1404
-
\??\c:\1djdv.exec:\1djdv.exe238⤵PID:2316
-
\??\c:\dpdvp.exec:\dpdvp.exe239⤵PID:1136
-
\??\c:\lrrxlrf.exec:\lrrxlrf.exe240⤵PID:3184
-
\??\c:\rlrfrfr.exec:\rlrfrfr.exe241⤵PID:4220
-
\??\c:\hhhnht.exec:\hhhnht.exe242⤵PID:5032