Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 20:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09e448d6acaaa3714663ecb28531a590_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
09e448d6acaaa3714663ecb28531a590_NeikiAnalytics.exe
-
Size
348KB
-
MD5
09e448d6acaaa3714663ecb28531a590
-
SHA1
6fcdd4207baba52bdaefae47abd5afc68e80190d
-
SHA256
b145a74f7cf04b6d3a8a8489d6b0c08eab9e23b867cca2a8ea2dbc304d7b972a
-
SHA512
9d4bc69eb176e04e0dc2dbc980c18b3aaadbb53bb7c5554c0e87f3c9b48f52686ef0cf2e5d02c31dd899b4b7851d76d1c000c89f110540f32721c23c90f3ee54
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31TeMN7E1DCqkj5ad427ykS9WOCUyTAoqt:n3C9BRo7MlrWKo+lS0Le4xRSAoq7mjKz
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/856-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/292-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1216-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/752-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/880-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ttntnb.exejdddv.exebbntbn.exeddvdj.exerlrxllx.exebbtthn.exepjvvd.exeflfrflf.exebhtbbn.exe5dvpv.exerlrrrrf.exetnbthh.exehbthbh.exe9jdjp.exerlrrxxl.exetnttbh.exe3djpv.exefxflxfl.exehhtbhh.exe5nbhnt.exevpvvd.exelxlxflr.exe7ntttb.exedpdvv.exexlflxrx.exelfrrrxx.exehtntnt.exe9dvpv.exexxlrlrl.exehhhtnt.exeppppv.exe9fxfrrf.exe7xfflfl.exebtttht.exe5jddv.exelxlrxfl.exexrflrrf.exettbbbb.exepjjvj.exepjddv.exefxxflxr.exerrflllr.exe7htbhn.exevjvvd.exe5jvpv.exerlrfrxx.exexrxxffl.exenttnnb.exe5pddj.exedvjjp.exeflrrfxx.exefxxffxf.exe1hbhnt.exennbbhn.exe3vjpv.exevjddp.exerxlfxrl.exerlflrrx.exetnbtbb.exenhbbnn.exedpddv.exepdppp.exelxllllx.exefrffrlf.exepid process 1736 ttntnb.exe 2908 jdddv.exe 2648 bbntbn.exe 2560 ddvdj.exe 2728 rlrxllx.exe 2200 bbtthn.exe 2460 pjvvd.exe 2888 flfrflf.exe 292 bhtbbn.exe 2776 5dvpv.exe 2144 rlrrrrf.exe 2432 tnbthh.exe 1948 hbthbh.exe 1980 9jdjp.exe 1728 rlrrxxl.exe 2444 tnttbh.exe 644 3djpv.exe 880 fxflxfl.exe 2100 hhtbhh.exe 2436 5nbhnt.exe 1928 vpvvd.exe 1872 lxlxflr.exe 404 7ntttb.exe 2132 dpdvv.exe 1376 xlflxrx.exe 752 lfrrrxx.exe 2864 htntnt.exe 1216 9dvpv.exe 2008 xxlrlrl.exe 3036 hhhtnt.exe 912 ppppv.exe 2056 9fxfrrf.exe 1620 7xfflfl.exe 2004 btttht.exe 2104 5jddv.exe 2744 lxlrxfl.exe 2812 xrflrrf.exe 2596 ttbbbb.exe 2560 pjjvj.exe 2652 pjddv.exe 2624 fxxflxr.exe 2476 rrflllr.exe 2892 7htbhn.exe 2708 vjvvd.exe 2212 5jvpv.exe 2884 rlrfrxx.exe 2776 xrxxffl.exe 1560 nttnnb.exe 2432 5pddj.exe 1120 dvjjp.exe 1456 flrrfxx.exe 2644 fxxffxf.exe 1600 1hbhnt.exe 2444 nnbbhn.exe 2084 3vjpv.exe 2076 vjddp.exe 2696 rxlfxrl.exe 2840 rlflrrx.exe 3032 tnbtbb.exe 2324 nhbbnn.exe 408 dpddv.exe 3060 pdppp.exe 1568 lxllllx.exe 2832 frffrlf.exe -
Processes:
resource yara_rule behavioral1/memory/856-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/292-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1216-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/752-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/880-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-69-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
09e448d6acaaa3714663ecb28531a590_NeikiAnalytics.exettntnb.exejdddv.exebbntbn.exeddvdj.exerlrxllx.exebbtthn.exepjvvd.exeflfrflf.exebhtbbn.exe5dvpv.exerlrrrrf.exetnbthh.exehbthbh.exe9jdjp.exerlrrxxl.exedescription pid process target process PID 856 wrote to memory of 1736 856 09e448d6acaaa3714663ecb28531a590_NeikiAnalytics.exe ttntnb.exe PID 856 wrote to memory of 1736 856 09e448d6acaaa3714663ecb28531a590_NeikiAnalytics.exe ttntnb.exe PID 856 wrote to memory of 1736 856 09e448d6acaaa3714663ecb28531a590_NeikiAnalytics.exe ttntnb.exe PID 856 wrote to memory of 1736 856 09e448d6acaaa3714663ecb28531a590_NeikiAnalytics.exe ttntnb.exe PID 1736 wrote to memory of 2908 1736 ttntnb.exe jdddv.exe PID 1736 wrote to memory of 2908 1736 ttntnb.exe jdddv.exe PID 1736 wrote to memory of 2908 1736 ttntnb.exe jdddv.exe PID 1736 wrote to memory of 2908 1736 ttntnb.exe jdddv.exe PID 2908 wrote to memory of 2648 2908 jdddv.exe bbntbn.exe PID 2908 wrote to memory of 2648 2908 jdddv.exe bbntbn.exe PID 2908 wrote to memory of 2648 2908 jdddv.exe bbntbn.exe PID 2908 wrote to memory of 2648 2908 jdddv.exe bbntbn.exe PID 2648 wrote to memory of 2560 2648 bbntbn.exe pjjvj.exe PID 2648 wrote to memory of 2560 2648 bbntbn.exe pjjvj.exe PID 2648 wrote to memory of 2560 2648 bbntbn.exe pjjvj.exe PID 2648 wrote to memory of 2560 2648 bbntbn.exe pjjvj.exe PID 2560 wrote to memory of 2728 2560 ddvdj.exe rlrxllx.exe PID 2560 wrote to memory of 2728 2560 ddvdj.exe rlrxllx.exe PID 2560 wrote to memory of 2728 2560 ddvdj.exe rlrxllx.exe PID 2560 wrote to memory of 2728 2560 ddvdj.exe rlrxllx.exe PID 2728 wrote to memory of 2200 2728 rlrxllx.exe bbtthn.exe PID 2728 wrote to memory of 2200 2728 rlrxllx.exe bbtthn.exe PID 2728 wrote to memory of 2200 2728 rlrxllx.exe bbtthn.exe PID 2728 wrote to memory of 2200 2728 rlrxllx.exe bbtthn.exe PID 2200 wrote to memory of 2460 2200 bbtthn.exe pjvvd.exe PID 2200 wrote to memory of 2460 2200 bbtthn.exe pjvvd.exe PID 2200 wrote to memory of 2460 2200 bbtthn.exe pjvvd.exe PID 2200 wrote to memory of 2460 2200 bbtthn.exe pjvvd.exe PID 2460 wrote to memory of 2888 2460 pjvvd.exe flfrflf.exe PID 2460 wrote to memory of 2888 2460 pjvvd.exe flfrflf.exe PID 2460 wrote to memory of 2888 2460 pjvvd.exe flfrflf.exe PID 2460 wrote to memory of 2888 2460 pjvvd.exe flfrflf.exe PID 2888 wrote to memory of 292 2888 flfrflf.exe bhtbbn.exe PID 2888 wrote to memory of 292 2888 flfrflf.exe bhtbbn.exe PID 2888 wrote to memory of 292 2888 flfrflf.exe bhtbbn.exe PID 2888 wrote to memory of 292 2888 flfrflf.exe bhtbbn.exe PID 292 wrote to memory of 2776 292 bhtbbn.exe xrxxffl.exe PID 292 wrote to memory of 2776 292 bhtbbn.exe xrxxffl.exe PID 292 wrote to memory of 2776 292 bhtbbn.exe xrxxffl.exe PID 292 wrote to memory of 2776 292 bhtbbn.exe xrxxffl.exe PID 2776 wrote to memory of 2144 2776 5dvpv.exe rlrrrrf.exe PID 2776 wrote to memory of 2144 2776 5dvpv.exe rlrrrrf.exe PID 2776 wrote to memory of 2144 2776 5dvpv.exe rlrrrrf.exe PID 2776 wrote to memory of 2144 2776 5dvpv.exe rlrrrrf.exe PID 2144 wrote to memory of 2432 2144 rlrrrrf.exe tnbthh.exe PID 2144 wrote to memory of 2432 2144 rlrrrrf.exe tnbthh.exe PID 2144 wrote to memory of 2432 2144 rlrrrrf.exe tnbthh.exe PID 2144 wrote to memory of 2432 2144 rlrrrrf.exe tnbthh.exe PID 2432 wrote to memory of 1948 2432 tnbthh.exe hbthbh.exe PID 2432 wrote to memory of 1948 2432 tnbthh.exe hbthbh.exe PID 2432 wrote to memory of 1948 2432 tnbthh.exe hbthbh.exe PID 2432 wrote to memory of 1948 2432 tnbthh.exe hbthbh.exe PID 1948 wrote to memory of 1980 1948 hbthbh.exe 9jdjp.exe PID 1948 wrote to memory of 1980 1948 hbthbh.exe 9jdjp.exe PID 1948 wrote to memory of 1980 1948 hbthbh.exe 9jdjp.exe PID 1948 wrote to memory of 1980 1948 hbthbh.exe 9jdjp.exe PID 1980 wrote to memory of 1728 1980 9jdjp.exe rlrrxxl.exe PID 1980 wrote to memory of 1728 1980 9jdjp.exe rlrrxxl.exe PID 1980 wrote to memory of 1728 1980 9jdjp.exe rlrrxxl.exe PID 1980 wrote to memory of 1728 1980 9jdjp.exe rlrrxxl.exe PID 1728 wrote to memory of 2444 1728 rlrrxxl.exe nnbbhn.exe PID 1728 wrote to memory of 2444 1728 rlrrxxl.exe nnbbhn.exe PID 1728 wrote to memory of 2444 1728 rlrrxxl.exe nnbbhn.exe PID 1728 wrote to memory of 2444 1728 rlrrxxl.exe nnbbhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09e448d6acaaa3714663ecb28531a590_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\09e448d6acaaa3714663ecb28531a590_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\ttntnb.exec:\ttntnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\jdddv.exec:\jdddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\bbntbn.exec:\bbntbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\ddvdj.exec:\ddvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\rlrxllx.exec:\rlrxllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\bbtthn.exec:\bbtthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\pjvvd.exec:\pjvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\flfrflf.exec:\flfrflf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\bhtbbn.exec:\bhtbbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
\??\c:\5dvpv.exec:\5dvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\rlrrrrf.exec:\rlrrrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\tnbthh.exec:\tnbthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\hbthbh.exec:\hbthbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\9jdjp.exec:\9jdjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\rlrrxxl.exec:\rlrrxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\tnttbh.exec:\tnttbh.exe17⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3djpv.exec:\3djpv.exe18⤵
- Executes dropped EXE
PID:644 -
\??\c:\fxflxfl.exec:\fxflxfl.exe19⤵
- Executes dropped EXE
PID:880 -
\??\c:\hhtbhh.exec:\hhtbhh.exe20⤵
- Executes dropped EXE
PID:2100 -
\??\c:\5nbhnt.exec:\5nbhnt.exe21⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vpvvd.exec:\vpvvd.exe22⤵
- Executes dropped EXE
PID:1928 -
\??\c:\lxlxflr.exec:\lxlxflr.exe23⤵
- Executes dropped EXE
PID:1872 -
\??\c:\7ntttb.exec:\7ntttb.exe24⤵
- Executes dropped EXE
PID:404 -
\??\c:\dpdvv.exec:\dpdvv.exe25⤵
- Executes dropped EXE
PID:2132 -
\??\c:\xlflxrx.exec:\xlflxrx.exe26⤵
- Executes dropped EXE
PID:1376 -
\??\c:\lfrrrxx.exec:\lfrrrxx.exe27⤵
- Executes dropped EXE
PID:752 -
\??\c:\htntnt.exec:\htntnt.exe28⤵
- Executes dropped EXE
PID:2864 -
\??\c:\9dvpv.exec:\9dvpv.exe29⤵
- Executes dropped EXE
PID:1216 -
\??\c:\xxlrlrl.exec:\xxlrlrl.exe30⤵
- Executes dropped EXE
PID:2008 -
\??\c:\hhhtnt.exec:\hhhtnt.exe31⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ppppv.exec:\ppppv.exe32⤵
- Executes dropped EXE
PID:912 -
\??\c:\9fxfrrf.exec:\9fxfrrf.exe33⤵
- Executes dropped EXE
PID:2056 -
\??\c:\7xfflfl.exec:\7xfflfl.exe34⤵
- Executes dropped EXE
PID:1620 -
\??\c:\btttht.exec:\btttht.exe35⤵
- Executes dropped EXE
PID:2004 -
\??\c:\5jddv.exec:\5jddv.exe36⤵
- Executes dropped EXE
PID:2104 -
\??\c:\lxlrxfl.exec:\lxlrxfl.exe37⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xrflrrf.exec:\xrflrrf.exe38⤵
- Executes dropped EXE
PID:2812 -
\??\c:\ttbbbb.exec:\ttbbbb.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\pjjvj.exec:\pjjvj.exe40⤵
- Executes dropped EXE
PID:2560 -
\??\c:\pjddv.exec:\pjddv.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\fxxflxr.exec:\fxxflxr.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rrflllr.exec:\rrflllr.exe43⤵
- Executes dropped EXE
PID:2476 -
\??\c:\7htbhn.exec:\7htbhn.exe44⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vjvvd.exec:\vjvvd.exe45⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5jvpv.exec:\5jvpv.exe46⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rlrfrxx.exec:\rlrfrxx.exe47⤵
- Executes dropped EXE
PID:2884 -
\??\c:\xrxxffl.exec:\xrxxffl.exe48⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nttnnb.exec:\nttnnb.exe49⤵
- Executes dropped EXE
PID:1560 -
\??\c:\5pddj.exec:\5pddj.exe50⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dvjjp.exec:\dvjjp.exe51⤵
- Executes dropped EXE
PID:1120 -
\??\c:\flrrfxx.exec:\flrrfxx.exe52⤵
- Executes dropped EXE
PID:1456 -
\??\c:\fxxffxf.exec:\fxxffxf.exe53⤵
- Executes dropped EXE
PID:2644 -
\??\c:\1hbhnt.exec:\1hbhnt.exe54⤵
- Executes dropped EXE
PID:1600 -
\??\c:\nnbbhn.exec:\nnbbhn.exe55⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3vjpv.exec:\3vjpv.exe56⤵
- Executes dropped EXE
PID:2084 -
\??\c:\vjddp.exec:\vjddp.exe57⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rxlfxrl.exec:\rxlfxrl.exe58⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rlflrrx.exec:\rlflrrx.exe59⤵
- Executes dropped EXE
PID:2840 -
\??\c:\tnbtbb.exec:\tnbtbb.exe60⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nhbbnn.exec:\nhbbnn.exe61⤵
- Executes dropped EXE
PID:2324 -
\??\c:\dpddv.exec:\dpddv.exe62⤵
- Executes dropped EXE
PID:408 -
\??\c:\pdppp.exec:\pdppp.exe63⤵
- Executes dropped EXE
PID:3060 -
\??\c:\lxllllx.exec:\lxllllx.exe64⤵
- Executes dropped EXE
PID:1568 -
\??\c:\frffrlf.exec:\frffrlf.exe65⤵
- Executes dropped EXE
PID:2832 -
\??\c:\nhntbh.exec:\nhntbh.exe66⤵PID:1084
-
\??\c:\vpjvv.exec:\vpjvv.exe67⤵PID:920
-
\??\c:\vjjjp.exec:\vjjjp.exe68⤵PID:2864
-
\??\c:\lxfxfff.exec:\lxfxfff.exe69⤵PID:720
-
\??\c:\1tnttn.exec:\1tnttn.exe70⤵PID:1396
-
\??\c:\vpdjv.exec:\vpdjv.exe71⤵PID:1660
-
\??\c:\rlfrxxf.exec:\rlfrxxf.exe72⤵PID:1528
-
\??\c:\tntttb.exec:\tntttb.exe73⤵PID:1264
-
\??\c:\pdpdj.exec:\pdpdj.exe74⤵PID:1592
-
\??\c:\1jjjj.exec:\1jjjj.exe75⤵PID:1624
-
\??\c:\vjvvv.exec:\vjvvv.exe76⤵PID:2844
-
\??\c:\1jvpv.exec:\1jvpv.exe77⤵PID:2664
-
\??\c:\bthhbb.exec:\bthhbb.exe78⤵PID:3024
-
\??\c:\9jvvj.exec:\9jvvj.exe79⤵PID:2740
-
\??\c:\1pjpv.exec:\1pjpv.exe80⤵PID:2632
-
\??\c:\xxllxxl.exec:\xxllxxl.exe81⤵PID:3040
-
\??\c:\ffrrxrl.exec:\ffrrxrl.exe82⤵PID:2712
-
\??\c:\1ttnnn.exec:\1ttnnn.exe83⤵PID:1612
-
\??\c:\vppvv.exec:\vppvv.exe84⤵PID:2200
-
\??\c:\3jvvj.exec:\3jvvj.exe85⤵PID:2204
-
\??\c:\1lrrrrf.exec:\1lrrrrf.exe86⤵PID:3056
-
\??\c:\7bntbn.exec:\7bntbn.exe87⤵PID:1276
-
\??\c:\5tbttb.exec:\5tbttb.exe88⤵PID:2788
-
\??\c:\jvpdv.exec:\jvpdv.exe89⤵PID:2276
-
\??\c:\dpvpp.exec:\dpvpp.exe90⤵PID:1308
-
\??\c:\3rlffff.exec:\3rlffff.exe91⤵PID:1772
-
\??\c:\nnhntb.exec:\nnhntb.exe92⤵PID:1976
-
\??\c:\tnhntt.exec:\tnhntt.exe93⤵PID:2068
-
\??\c:\3dddj.exec:\3dddj.exe94⤵PID:1460
-
\??\c:\xrllrxf.exec:\xrllrxf.exe95⤵PID:1800
-
\??\c:\rlrxlll.exec:\rlrxlll.exe96⤵PID:1544
-
\??\c:\5hthhb.exec:\5hthhb.exe97⤵PID:2012
-
\??\c:\pppjp.exec:\pppjp.exe98⤵PID:2300
-
\??\c:\1pdvv.exec:\1pdvv.exe99⤵PID:784
-
\??\c:\fxrxllr.exec:\fxrxllr.exe100⤵PID:2296
-
\??\c:\1bnbhh.exec:\1bnbhh.exe101⤵PID:2436
-
\??\c:\hhnttt.exec:\hhnttt.exe102⤵PID:2316
-
\??\c:\pjpjp.exec:\pjpjp.exe103⤵PID:1532
-
\??\c:\3lfxllx.exec:\3lfxllx.exe104⤵PID:448
-
\??\c:\llllrfl.exec:\llllrfl.exe105⤵PID:792
-
\??\c:\bthhhn.exec:\bthhhn.exe106⤵PID:780
-
\??\c:\vdjvj.exec:\vdjvj.exe107⤵PID:624
-
\??\c:\xxxxfrx.exec:\xxxxfrx.exe108⤵PID:1088
-
\??\c:\ffrxlrf.exec:\ffrxlrf.exe109⤵PID:2428
-
\??\c:\btthtb.exec:\btthtb.exe110⤵PID:2000
-
\??\c:\bbttbb.exec:\bbttbb.exe111⤵PID:1048
-
\??\c:\djpvj.exec:\djpvj.exe112⤵PID:2380
-
\??\c:\5frxxxf.exec:\5frxxxf.exe113⤵PID:2416
-
\??\c:\hhtbth.exec:\hhtbth.exe114⤵PID:2912
-
\??\c:\nnnntb.exec:\nnnntb.exe115⤵PID:2312
-
\??\c:\7pjpd.exec:\7pjpd.exe116⤵PID:1264
-
\??\c:\ffrrxrf.exec:\ffrrxrf.exe117⤵PID:2968
-
\??\c:\llflllx.exec:\llflllx.exe118⤵PID:1624
-
\??\c:\9bhhhh.exec:\9bhhhh.exe119⤵PID:2796
-
\??\c:\5jjjd.exec:\5jjjd.exe120⤵PID:1260
-
\??\c:\jdvdp.exec:\jdvdp.exe121⤵PID:2656
-
\??\c:\frflllf.exec:\frflllf.exe122⤵PID:2740
-
\??\c:\tnthnt.exec:\tnthnt.exe123⤵PID:2632
-
\??\c:\pjddp.exec:\pjddp.exe124⤵PID:3040
-
\??\c:\3pvdp.exec:\3pvdp.exe125⤵PID:2464
-
\??\c:\lfrfrrf.exec:\lfrfrrf.exe126⤵PID:2620
-
\??\c:\lflrxfr.exec:\lflrxfr.exe127⤵PID:2200
-
\??\c:\nnbhnt.exec:\nnbhnt.exe128⤵PID:2204
-
\??\c:\ppdpj.exec:\ppdpj.exe129⤵PID:2568
-
\??\c:\1pjpv.exec:\1pjpv.exe130⤵PID:292
-
\??\c:\rllxrlr.exec:\rllxrlr.exe131⤵PID:2788
-
\??\c:\nhthhn.exec:\nhthhn.exe132⤵PID:2276
-
\??\c:\bnbbhn.exec:\bnbbhn.exe133⤵PID:1364
-
\??\c:\jdpjj.exec:\jdpjj.exe134⤵PID:1772
-
\??\c:\5xrrrrx.exec:\5xrrrrx.exe135⤵PID:2344
-
\??\c:\9frxffl.exec:\9frxffl.exe136⤵PID:1728
-
\??\c:\tnnnbh.exec:\tnnnbh.exe137⤵PID:1656
-
\??\c:\bnbbnh.exec:\bnbbnh.exe138⤵PID:1800
-
\??\c:\pjddj.exec:\pjddj.exe139⤵PID:2108
-
\??\c:\5rfxffl.exec:\5rfxffl.exe140⤵PID:2012
-
\??\c:\nnbnnn.exec:\nnbnnn.exe141⤵PID:1824
-
\??\c:\nhbbnh.exec:\nhbbnh.exe142⤵PID:784
-
\??\c:\pjdjd.exec:\pjdjd.exe143⤵PID:2100
-
\??\c:\jjpdv.exec:\jjpdv.exe144⤵PID:2436
-
\??\c:\xrxfllr.exec:\xrxfllr.exe145⤵PID:1116
-
\??\c:\tnbhnn.exec:\tnbhnn.exe146⤵PID:1532
-
\??\c:\jvjdp.exec:\jvjdp.exe147⤵PID:1360
-
\??\c:\frlfrrx.exec:\frlfrrx.exe148⤵PID:792
-
\??\c:\ppjjp.exec:\ppjjp.exe149⤵PID:1056
-
\??\c:\jdjdj.exec:\jdjdj.exe150⤵PID:1836
-
\??\c:\3lrfffx.exec:\3lrfffx.exe151⤵PID:1696
-
\??\c:\rffrxfr.exec:\rffrxfr.exe152⤵PID:2232
-
\??\c:\hhbhbn.exec:\hhbhbn.exe153⤵PID:2820
-
\??\c:\9bbhnt.exec:\9bbhnt.exe154⤵PID:2876
-
\??\c:\dvvdj.exec:\dvvdj.exe155⤵PID:1176
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe156⤵PID:2800
-
\??\c:\lfflxfx.exec:\lfflxfx.exe157⤵PID:2364
-
\??\c:\5ntnnn.exec:\5ntnnn.exe158⤵PID:1616
-
\??\c:\vpvjv.exec:\vpvjv.exe159⤵PID:2960
-
\??\c:\vvpdp.exec:\vvpdp.exe160⤵PID:2844
-
\??\c:\rfrxlrr.exec:\rfrxlrr.exe161⤵PID:2196
-
\??\c:\fxlflrx.exec:\fxlflrx.exe162⤵PID:3024
-
\??\c:\nbbhnt.exec:\nbbhnt.exe163⤵PID:2812
-
\??\c:\vjpjj.exec:\vjpjj.exe164⤵PID:560
-
\??\c:\jpjpj.exec:\jpjpj.exe165⤵PID:2560
-
\??\c:\rrflflx.exec:\rrflflx.exe166⤵PID:2736
-
\??\c:\bbnbtn.exec:\bbnbtn.exe167⤵PID:2488
-
\??\c:\thbnth.exec:\thbnth.exe168⤵PID:2936
-
\??\c:\vpddp.exec:\vpddp.exe169⤵PID:2904
-
\??\c:\vjdvd.exec:\vjdvd.exe170⤵PID:2396
-
\??\c:\rxrlfxx.exec:\rxrlfxx.exe171⤵PID:1952
-
\??\c:\7bbnnt.exec:\7bbnnt.exe172⤵PID:2124
-
\??\c:\bthhbt.exec:\bthhbt.exe173⤵PID:3068
-
\??\c:\pdjdj.exec:\pdjdj.exe174⤵PID:1828
-
\??\c:\ddvjp.exec:\ddvjp.exe175⤵PID:2420
-
\??\c:\1fxffll.exec:\1fxffll.exe176⤵PID:2640
-
\??\c:\bbhbbt.exec:\bbhbbt.exe177⤵PID:2524
-
\??\c:\bthbbb.exec:\bthbbb.exe178⤵PID:1604
-
\??\c:\9vdjv.exec:\9vdjv.exe179⤵PID:1548
-
\??\c:\vpjdp.exec:\vpjdp.exe180⤵PID:1464
-
\??\c:\7fllrxf.exec:\7fllrxf.exe181⤵PID:2308
-
\??\c:\7hbntb.exec:\7hbntb.exe182⤵PID:2300
-
\??\c:\hbthtb.exec:\hbthtb.exe183⤵PID:1956
-
\??\c:\jjjpj.exec:\jjjpj.exe184⤵PID:1220
-
\??\c:\1rffllr.exec:\1rffllr.exe185⤵PID:804
-
\??\c:\xrlrlff.exec:\xrlrlff.exe186⤵PID:2316
-
\??\c:\bntnnn.exec:\bntnnn.exe187⤵PID:1008
-
\??\c:\pdpjj.exec:\pdpjj.exe188⤵PID:448
-
\??\c:\xxlrxfl.exec:\xxlrxfl.exe189⤵PID:1712
-
\??\c:\lfrxrxl.exec:\lfrxrxl.exe190⤵PID:1768
-
\??\c:\1ntthn.exec:\1ntthn.exe191⤵PID:1632
-
\??\c:\htntnt.exec:\htntnt.exe192⤵PID:624
-
\??\c:\3vvdj.exec:\3vvdj.exe193⤵PID:1288
-
\??\c:\xrxxffl.exec:\xrxxffl.exe194⤵PID:1780
-
\??\c:\xxfllll.exec:\xxfllll.exe195⤵PID:652
-
\??\c:\ntbttn.exec:\ntbttn.exe196⤵PID:932
-
\??\c:\1vjjj.exec:\1vjjj.exe197⤵PID:1524
-
\??\c:\xffxlfx.exec:\xffxlfx.exe198⤵PID:1764
-
\??\c:\7xllrrr.exec:\7xllrrr.exe199⤵PID:2952
-
\??\c:\5nnhnn.exec:\5nnhnn.exe200⤵PID:2536
-
\??\c:\pjdvp.exec:\pjdvp.exe201⤵PID:1736
-
\??\c:\3vpvj.exec:\3vpvj.exe202⤵PID:3052
-
\??\c:\9xrfrrf.exec:\9xrfrrf.exe203⤵PID:2676
-
\??\c:\bnbbbn.exec:\bnbbbn.exe204⤵PID:2980
-
\??\c:\hbntbt.exec:\hbntbt.exe205⤵PID:2684
-
\??\c:\djpvd.exec:\djpvd.exe206⤵PID:2492
-
\??\c:\jdppd.exec:\jdppd.exe207⤵PID:2496
-
\??\c:\xrrxxrx.exec:\xrrxxrx.exe208⤵PID:2628
-
\??\c:\btbbhh.exec:\btbbhh.exe209⤵PID:2456
-
\??\c:\bthnnt.exec:\bthnnt.exe210⤵PID:2624
-
\??\c:\dvjdj.exec:\dvjdj.exe211⤵PID:2512
-
\??\c:\xlfxfxf.exec:\xlfxfxf.exe212⤵PID:1996
-
\??\c:\3xlxrrx.exec:\3xlxrrx.exe213⤵PID:2204
-
\??\c:\3nnhhh.exec:\3nnhhh.exe214⤵PID:1276
-
\??\c:\nnhhnn.exec:\nnhhnn.exe215⤵PID:1628
-
\??\c:\ddvjv.exec:\ddvjv.exe216⤵PID:2880
-
\??\c:\fxrfrrf.exec:\fxrfrrf.exe217⤵PID:2868
-
\??\c:\1lrrffl.exec:\1lrrffl.exe218⤵PID:776
-
\??\c:\5tnntb.exec:\5tnntb.exe219⤵PID:2268
-
\??\c:\9hthbn.exec:\9hthbn.exe220⤵PID:2516
-
\??\c:\pjdvd.exec:\pjdvd.exe221⤵PID:1648
-
\??\c:\7rxfllx.exec:\7rxfllx.exe222⤵PID:852
-
\??\c:\xrlrffl.exec:\xrlrffl.exe223⤵PID:908
-
\??\c:\nhbntt.exec:\nhbntt.exe224⤵PID:2072
-
\??\c:\nhnntn.exec:\nhnntn.exe225⤵PID:1328
-
\??\c:\pjvvd.exec:\pjvvd.exe226⤵PID:2152
-
\??\c:\pjvjd.exec:\pjvjd.exe227⤵PID:2840
-
\??\c:\xrxlxfr.exec:\xrxlxfr.exe228⤵PID:924
-
\??\c:\7thntt.exec:\7thntt.exe229⤵PID:1872
-
\??\c:\hbnhtt.exec:\hbnhtt.exe230⤵PID:404
-
\??\c:\jjvvj.exec:\jjvvj.exe231⤵PID:1692
-
\??\c:\xxrfxlx.exec:\xxrfxlx.exe232⤵PID:1880
-
\??\c:\1fxflrx.exec:\1fxflrx.exe233⤵PID:1348
-
\??\c:\bttbhh.exec:\bttbhh.exe234⤵PID:1552
-
\??\c:\dvppd.exec:\dvppd.exe235⤵PID:2944
-
\??\c:\xrffxxl.exec:\xrffxxl.exe236⤵PID:956
-
\??\c:\1lrxrfl.exec:\1lrxrfl.exe237⤵PID:2864
-
\??\c:\nbtbnn.exec:\nbtbnn.exe238⤵PID:1216
-
\??\c:\7nbhhh.exec:\7nbhhh.exe239⤵PID:1396
-
\??\c:\dvpvd.exec:\dvpvd.exe240⤵PID:2932
-
\??\c:\xrfllrx.exec:\xrfllrx.exe241⤵PID:1528
-