Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 22:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
135fc4914e879247fd8951963012db10_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
135fc4914e879247fd8951963012db10_NeikiAnalytics.exe
-
Size
65KB
-
MD5
135fc4914e879247fd8951963012db10
-
SHA1
066e34c413d54a9b4988b58957e64799c8f4d1ac
-
SHA256
b2432b844c7a40263894904a48b2675c207c57bb23f5239fbb405b1628075c9b
-
SHA512
2b0a039a3472fc82e10daf84ac6b2764557ab80e720d0a6c5a8163efd2eaf0d74fa2ab3c3ed41491e880acf4b9f31b947ff6d66383a1615433c993a871eab9a5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfQ:ymb3NkkiQ3mdBjFI4Vc
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/3704-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1252-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7bhnbh.exevjpjd.exelxlllll.exe1nhbtt.exepvvvp.exedpvvp.exelxlrlxx.exe3nhhbn.exejjpjd.exe1hbbbb.exe3jpvj.exexffxrll.exettnhth.exedvdvv.exexxlffll.exehnbbhh.exevdpjd.exetnbbhh.exevpddj.exerfxxxxx.exebnttbh.exe5vdvd.exeppvpp.exefxxxxxf.exehbhbbb.exentnhbn.exe9fffflr.exenbbnbh.exettnhhh.exejjpjd.exeffllrrl.exehtthhb.exebhhhhn.exe5vjdj.exepvjdd.exe5ntbbb.exepppjj.exe1vdjj.exerlrllrr.exebnttnn.exe3ppvp.exexflfxxx.exentthtt.exepdpvp.exe5jjpd.exe3rxfxff.exe1frrrxr.exe5hhttt.exe1pppp.exe9vvpj.exexfrrxxr.exenhtnnn.exeddjdv.exeffxrllf.exefrrrrrr.exenhnhbb.exeddjjj.exelrflfxf.exexrflffr.exehbbbtt.exepvpvp.exe1lrfffx.exe5xxrxll.exe7hbbtt.exepid process 2264 7bhnbh.exe 2440 vjpjd.exe 1208 lxlllll.exe 4512 1nhbtt.exe 4296 pvvvp.exe 4780 dpvvp.exe 2688 lxlrlxx.exe 3380 3nhhbn.exe 4640 jjpjd.exe 4644 1hbbbb.exe 4656 3jpvj.exe 2248 xffxrll.exe 3780 ttnhth.exe 2836 dvdvv.exe 3280 xxlffll.exe 4492 hnbbhh.exe 4552 vdpjd.exe 3580 tnbbhh.exe 3872 vpddj.exe 1500 rfxxxxx.exe 1252 bnttbh.exe 4960 5vdvd.exe 3756 ppvpp.exe 2380 fxxxxxf.exe 1392 hbhbbb.exe 3092 ntnhbn.exe 1184 9fffflr.exe 1672 nbbnbh.exe 5092 ttnhhh.exe 4092 jjpjd.exe 5052 ffllrrl.exe 2956 htthhb.exe 4528 bhhhhn.exe 3788 5vjdj.exe 3344 pvjdd.exe 4464 5ntbbb.exe 1680 pppjj.exe 4840 1vdjj.exe 2732 rlrllrr.exe 4308 bnttnn.exe 3704 3ppvp.exe 3688 xflfxxx.exe 1952 ntthtt.exe 1980 pdpvp.exe 4084 5jjpd.exe 3004 3rxfxff.exe 3376 1frrrxr.exe 2600 5hhttt.exe 4780 1pppp.exe 1312 9vvpj.exe 3380 xfrrxxr.exe 1624 nhtnnn.exe 3272 ddjdv.exe 2188 ffxrllf.exe 5032 frrrrrr.exe 3860 nhnhbb.exe 1596 ddjjj.exe 3692 lrflfxf.exe 2504 xrflffr.exe 4712 hbbbtt.exe 4492 pvpvp.exe 3036 1lrfffx.exe 3216 5xxrxll.exe 4036 7hbbtt.exe -
Processes:
resource yara_rule behavioral2/memory/3704-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3780-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1500-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1252-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
135fc4914e879247fd8951963012db10_NeikiAnalytics.exe7bhnbh.exevjpjd.exelxlllll.exe1nhbtt.exepvvvp.exedpvvp.exelxlrlxx.exe3nhhbn.exejjpjd.exe1hbbbb.exe3jpvj.exexffxrll.exettnhth.exedvdvv.exexxlffll.exehnbbhh.exevdpjd.exetnbbhh.exevpddj.exerfxxxxx.exebnttbh.exedescription pid process target process PID 3704 wrote to memory of 2264 3704 135fc4914e879247fd8951963012db10_NeikiAnalytics.exe 7bhnbh.exe PID 3704 wrote to memory of 2264 3704 135fc4914e879247fd8951963012db10_NeikiAnalytics.exe 7bhnbh.exe PID 3704 wrote to memory of 2264 3704 135fc4914e879247fd8951963012db10_NeikiAnalytics.exe 7bhnbh.exe PID 2264 wrote to memory of 2440 2264 7bhnbh.exe vjpjd.exe PID 2264 wrote to memory of 2440 2264 7bhnbh.exe vjpjd.exe PID 2264 wrote to memory of 2440 2264 7bhnbh.exe vjpjd.exe PID 2440 wrote to memory of 1208 2440 vjpjd.exe lxlllll.exe PID 2440 wrote to memory of 1208 2440 vjpjd.exe lxlllll.exe PID 2440 wrote to memory of 1208 2440 vjpjd.exe lxlllll.exe PID 1208 wrote to memory of 4512 1208 lxlllll.exe 1nhbtt.exe PID 1208 wrote to memory of 4512 1208 lxlllll.exe 1nhbtt.exe PID 1208 wrote to memory of 4512 1208 lxlllll.exe 1nhbtt.exe PID 4512 wrote to memory of 4296 4512 1nhbtt.exe pvvvp.exe PID 4512 wrote to memory of 4296 4512 1nhbtt.exe pvvvp.exe PID 4512 wrote to memory of 4296 4512 1nhbtt.exe pvvvp.exe PID 4296 wrote to memory of 4780 4296 pvvvp.exe dpvvp.exe PID 4296 wrote to memory of 4780 4296 pvvvp.exe dpvvp.exe PID 4296 wrote to memory of 4780 4296 pvvvp.exe dpvvp.exe PID 4780 wrote to memory of 2688 4780 dpvvp.exe lxlrlxx.exe PID 4780 wrote to memory of 2688 4780 dpvvp.exe lxlrlxx.exe PID 4780 wrote to memory of 2688 4780 dpvvp.exe lxlrlxx.exe PID 2688 wrote to memory of 3380 2688 lxlrlxx.exe 3nhhbn.exe PID 2688 wrote to memory of 3380 2688 lxlrlxx.exe 3nhhbn.exe PID 2688 wrote to memory of 3380 2688 lxlrlxx.exe 3nhhbn.exe PID 3380 wrote to memory of 4640 3380 3nhhbn.exe jjpjd.exe PID 3380 wrote to memory of 4640 3380 3nhhbn.exe jjpjd.exe PID 3380 wrote to memory of 4640 3380 3nhhbn.exe jjpjd.exe PID 4640 wrote to memory of 4644 4640 jjpjd.exe 1hbbbb.exe PID 4640 wrote to memory of 4644 4640 jjpjd.exe 1hbbbb.exe PID 4640 wrote to memory of 4644 4640 jjpjd.exe 1hbbbb.exe PID 4644 wrote to memory of 4656 4644 1hbbbb.exe 3jpvj.exe PID 4644 wrote to memory of 4656 4644 1hbbbb.exe 3jpvj.exe PID 4644 wrote to memory of 4656 4644 1hbbbb.exe 3jpvj.exe PID 4656 wrote to memory of 2248 4656 3jpvj.exe xffxrll.exe PID 4656 wrote to memory of 2248 4656 3jpvj.exe xffxrll.exe PID 4656 wrote to memory of 2248 4656 3jpvj.exe xffxrll.exe PID 2248 wrote to memory of 3780 2248 xffxrll.exe ttnhth.exe PID 2248 wrote to memory of 3780 2248 xffxrll.exe ttnhth.exe PID 2248 wrote to memory of 3780 2248 xffxrll.exe ttnhth.exe PID 3780 wrote to memory of 2836 3780 ttnhth.exe dvdvv.exe PID 3780 wrote to memory of 2836 3780 ttnhth.exe dvdvv.exe PID 3780 wrote to memory of 2836 3780 ttnhth.exe dvdvv.exe PID 2836 wrote to memory of 3280 2836 dvdvv.exe xxlffll.exe PID 2836 wrote to memory of 3280 2836 dvdvv.exe xxlffll.exe PID 2836 wrote to memory of 3280 2836 dvdvv.exe xxlffll.exe PID 3280 wrote to memory of 4492 3280 xxlffll.exe hnbbhh.exe PID 3280 wrote to memory of 4492 3280 xxlffll.exe hnbbhh.exe PID 3280 wrote to memory of 4492 3280 xxlffll.exe hnbbhh.exe PID 4492 wrote to memory of 4552 4492 hnbbhh.exe vdpjd.exe PID 4492 wrote to memory of 4552 4492 hnbbhh.exe vdpjd.exe PID 4492 wrote to memory of 4552 4492 hnbbhh.exe vdpjd.exe PID 4552 wrote to memory of 3580 4552 vdpjd.exe tnbbhh.exe PID 4552 wrote to memory of 3580 4552 vdpjd.exe tnbbhh.exe PID 4552 wrote to memory of 3580 4552 vdpjd.exe tnbbhh.exe PID 3580 wrote to memory of 3872 3580 tnbbhh.exe vpddj.exe PID 3580 wrote to memory of 3872 3580 tnbbhh.exe vpddj.exe PID 3580 wrote to memory of 3872 3580 tnbbhh.exe vpddj.exe PID 3872 wrote to memory of 1500 3872 vpddj.exe rfxxxxx.exe PID 3872 wrote to memory of 1500 3872 vpddj.exe rfxxxxx.exe PID 3872 wrote to memory of 1500 3872 vpddj.exe rfxxxxx.exe PID 1500 wrote to memory of 1252 1500 rfxxxxx.exe bnttbh.exe PID 1500 wrote to memory of 1252 1500 rfxxxxx.exe bnttbh.exe PID 1500 wrote to memory of 1252 1500 rfxxxxx.exe bnttbh.exe PID 1252 wrote to memory of 4960 1252 bnttbh.exe 5vdvd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\135fc4914e879247fd8951963012db10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\135fc4914e879247fd8951963012db10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\7bhnbh.exec:\7bhnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\vjpjd.exec:\vjpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\lxlllll.exec:\lxlllll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\1nhbtt.exec:\1nhbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\pvvvp.exec:\pvvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\dpvvp.exec:\dpvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\lxlrlxx.exec:\lxlrlxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\3nhhbn.exec:\3nhhbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\jjpjd.exec:\jjpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\1hbbbb.exec:\1hbbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\3jpvj.exec:\3jpvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\xffxrll.exec:\xffxrll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\ttnhth.exec:\ttnhth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\dvdvv.exec:\dvdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\xxlffll.exec:\xxlffll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\hnbbhh.exec:\hnbbhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\vdpjd.exec:\vdpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\tnbbhh.exec:\tnbbhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\vpddj.exec:\vpddj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\rfxxxxx.exec:\rfxxxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\bnttbh.exec:\bnttbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\5vdvd.exec:\5vdvd.exe23⤵
- Executes dropped EXE
PID:4960 -
\??\c:\ppvpp.exec:\ppvpp.exe24⤵
- Executes dropped EXE
PID:3756 -
\??\c:\fxxxxxf.exec:\fxxxxxf.exe25⤵
- Executes dropped EXE
PID:2380 -
\??\c:\hbhbbb.exec:\hbhbbb.exe26⤵
- Executes dropped EXE
PID:1392 -
\??\c:\ntnhbn.exec:\ntnhbn.exe27⤵
- Executes dropped EXE
PID:3092 -
\??\c:\9fffflr.exec:\9fffflr.exe28⤵
- Executes dropped EXE
PID:1184 -
\??\c:\nbbnbh.exec:\nbbnbh.exe29⤵
- Executes dropped EXE
PID:1672 -
\??\c:\ttnhhh.exec:\ttnhhh.exe30⤵
- Executes dropped EXE
PID:5092 -
\??\c:\jjpjd.exec:\jjpjd.exe31⤵
- Executes dropped EXE
PID:4092 -
\??\c:\ffllrrl.exec:\ffllrrl.exe32⤵
- Executes dropped EXE
PID:5052 -
\??\c:\htthhb.exec:\htthhb.exe33⤵
- Executes dropped EXE
PID:2956 -
\??\c:\bhhhhn.exec:\bhhhhn.exe34⤵
- Executes dropped EXE
PID:4528 -
\??\c:\5vjdj.exec:\5vjdj.exe35⤵
- Executes dropped EXE
PID:3788 -
\??\c:\pvjdd.exec:\pvjdd.exe36⤵
- Executes dropped EXE
PID:3344 -
\??\c:\5ntbbb.exec:\5ntbbb.exe37⤵
- Executes dropped EXE
PID:4464 -
\??\c:\pppjj.exec:\pppjj.exe38⤵
- Executes dropped EXE
PID:1680 -
\??\c:\1vdjj.exec:\1vdjj.exe39⤵
- Executes dropped EXE
PID:4840 -
\??\c:\rlrllrr.exec:\rlrllrr.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\bnttnn.exec:\bnttnn.exe41⤵
- Executes dropped EXE
PID:4308 -
\??\c:\3ppvp.exec:\3ppvp.exe42⤵
- Executes dropped EXE
PID:3704 -
\??\c:\xflfxxx.exec:\xflfxxx.exe43⤵
- Executes dropped EXE
PID:3688 -
\??\c:\ntthtt.exec:\ntthtt.exe44⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pdpvp.exec:\pdpvp.exe45⤵
- Executes dropped EXE
PID:1980 -
\??\c:\5jjpd.exec:\5jjpd.exe46⤵
- Executes dropped EXE
PID:4084 -
\??\c:\3rxfxff.exec:\3rxfxff.exe47⤵
- Executes dropped EXE
PID:3004 -
\??\c:\1frrrxr.exec:\1frrrxr.exe48⤵
- Executes dropped EXE
PID:3376 -
\??\c:\5hhttt.exec:\5hhttt.exe49⤵
- Executes dropped EXE
PID:2600 -
\??\c:\1pppp.exec:\1pppp.exe50⤵
- Executes dropped EXE
PID:4780 -
\??\c:\9vvpj.exec:\9vvpj.exe51⤵
- Executes dropped EXE
PID:1312 -
\??\c:\xfrrxxr.exec:\xfrrxxr.exe52⤵
- Executes dropped EXE
PID:3380 -
\??\c:\nhtnnn.exec:\nhtnnn.exe53⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ddjdv.exec:\ddjdv.exe54⤵
- Executes dropped EXE
PID:3272 -
\??\c:\ffxrllf.exec:\ffxrllf.exe55⤵
- Executes dropped EXE
PID:2188 -
\??\c:\frrrrrr.exec:\frrrrrr.exe56⤵
- Executes dropped EXE
PID:5032 -
\??\c:\nhnhbb.exec:\nhnhbb.exe57⤵
- Executes dropped EXE
PID:3860 -
\??\c:\ddjjj.exec:\ddjjj.exe58⤵
- Executes dropped EXE
PID:1596 -
\??\c:\lrflfxf.exec:\lrflfxf.exe59⤵
- Executes dropped EXE
PID:3692 -
\??\c:\xrflffr.exec:\xrflffr.exe60⤵
- Executes dropped EXE
PID:2504 -
\??\c:\hbbbtt.exec:\hbbbtt.exe61⤵
- Executes dropped EXE
PID:4712 -
\??\c:\pvpvp.exec:\pvpvp.exe62⤵
- Executes dropped EXE
PID:4492 -
\??\c:\1lrfffx.exec:\1lrfffx.exe63⤵
- Executes dropped EXE
PID:3036 -
\??\c:\5xxrxll.exec:\5xxrxll.exe64⤵
- Executes dropped EXE
PID:3216 -
\??\c:\7hbbtt.exec:\7hbbtt.exe65⤵
- Executes dropped EXE
PID:4036 -
\??\c:\ddpjv.exec:\ddpjv.exe66⤵PID:924
-
\??\c:\vppjj.exec:\vppjj.exe67⤵PID:2160
-
\??\c:\7xfxfxl.exec:\7xfxfxl.exe68⤵PID:1824
-
\??\c:\nbnttb.exec:\nbnttb.exe69⤵PID:3972
-
\??\c:\hhhhhb.exec:\hhhhhb.exe70⤵PID:2512
-
\??\c:\jjjjj.exec:\jjjjj.exe71⤵PID:4984
-
\??\c:\rxffflx.exec:\rxffflx.exe72⤵PID:2308
-
\??\c:\llfxlfx.exec:\llfxlfx.exe73⤵PID:452
-
\??\c:\hbbbbb.exec:\hbbbbb.exe74⤵PID:4052
-
\??\c:\ddddv.exec:\ddddv.exe75⤵PID:3092
-
\??\c:\dpvvj.exec:\dpvvj.exe76⤵PID:1184
-
\??\c:\rfrlxrl.exec:\rfrlxrl.exe77⤵PID:4964
-
\??\c:\1hhhhb.exec:\1hhhhb.exe78⤵PID:1432
-
\??\c:\bthbbb.exec:\bthbbb.exe79⤵PID:4704
-
\??\c:\dvjjv.exec:\dvjjv.exe80⤵PID:1204
-
\??\c:\xrrlfff.exec:\xrrlfff.exe81⤵PID:3260
-
\??\c:\frfxrrl.exec:\frfxrrl.exe82⤵PID:3724
-
\??\c:\nhntnn.exec:\nhntnn.exe83⤵PID:3700
-
\??\c:\pjvvp.exec:\pjvvp.exe84⤵PID:880
-
\??\c:\vpjdj.exec:\vpjdj.exe85⤵PID:4440
-
\??\c:\7rfxxxx.exec:\7rfxxxx.exe86⤵PID:4208
-
\??\c:\ffxxxlf.exec:\ffxxxlf.exe87⤵PID:4464
-
\??\c:\bbnntt.exec:\bbnntt.exe88⤵PID:5116
-
\??\c:\jjpvv.exec:\jjpvv.exe89⤵PID:2584
-
\??\c:\vdjjv.exec:\vdjjv.exe90⤵PID:1628
-
\??\c:\bbhhbh.exec:\bbhhbh.exe91⤵PID:60
-
\??\c:\tnnhbb.exec:\tnnhbb.exe92⤵PID:3468
-
\??\c:\jjddj.exec:\jjddj.exe93⤵PID:2724
-
\??\c:\jddvv.exec:\jddvv.exe94⤵PID:1456
-
\??\c:\xrrlrll.exec:\xrrlrll.exe95⤵PID:4068
-
\??\c:\9fllllr.exec:\9fllllr.exe96⤵PID:2432
-
\??\c:\tttttt.exec:\tttttt.exe97⤵PID:4932
-
\??\c:\jdppj.exec:\jdppj.exe98⤵PID:3472
-
\??\c:\xrrlffx.exec:\xrrlffx.exe99⤵PID:1888
-
\??\c:\bthhhn.exec:\bthhhn.exe100⤵PID:2688
-
\??\c:\5jdjj.exec:\5jdjj.exe101⤵PID:2564
-
\??\c:\3frrllf.exec:\3frrllf.exe102⤵PID:2996
-
\??\c:\pvjvp.exec:\pvjvp.exe103⤵PID:4644
-
\??\c:\frfffxx.exec:\frfffxx.exe104⤵PID:4456
-
\??\c:\bhbtbb.exec:\bhbtbb.exe105⤵PID:1864
-
\??\c:\jvddd.exec:\jvddd.exe106⤵PID:2352
-
\??\c:\flfrfxl.exec:\flfrfxl.exe107⤵PID:3224
-
\??\c:\dvvvp.exec:\dvvvp.exe108⤵PID:2636
-
\??\c:\nthbhh.exec:\nthbhh.exe109⤵PID:2368
-
\??\c:\xrffrrf.exec:\xrffrrf.exe110⤵PID:2172
-
\??\c:\dpdvp.exec:\dpdvp.exe111⤵PID:1920
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe112⤵PID:1372
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe113⤵PID:1812
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe114⤵PID:2056
-
\??\c:\7hbtnt.exec:\7hbtnt.exe115⤵PID:840
-
\??\c:\pdppp.exec:\pdppp.exe116⤵PID:4188
-
\??\c:\lrlffll.exec:\lrlffll.exe117⤵PID:2372
-
\??\c:\5fllrrf.exec:\5fllrrf.exe118⤵PID:4460
-
\??\c:\bbbbbt.exec:\bbbbbt.exe119⤵PID:3120
-
\??\c:\vvvpj.exec:\vvvpj.exe120⤵PID:2380
-
\??\c:\ppvpp.exec:\ppvpp.exe121⤵PID:2108
-
\??\c:\xxfxxxr.exec:\xxfxxxr.exe122⤵PID:4940
-
\??\c:\fxflffx.exec:\fxflffx.exe123⤵PID:492
-
\??\c:\btbbnt.exec:\btbbnt.exe124⤵PID:4052
-
\??\c:\bnhnnn.exec:\bnhnnn.exe125⤵PID:2936
-
\??\c:\3jddv.exec:\3jddv.exe126⤵PID:1184
-
\??\c:\lrlllll.exec:\lrlllll.exe127⤵PID:3988
-
\??\c:\rlllrfr.exec:\rlllrfr.exe128⤵PID:1432
-
\??\c:\1bhhhh.exec:\1bhhhh.exe129⤵PID:3740
-
\??\c:\jjvpj.exec:\jjvpj.exe130⤵PID:1552
-
\??\c:\jpvvd.exec:\jpvvd.exe131⤵PID:3604
-
\??\c:\rxffflf.exec:\rxffflf.exe132⤵PID:3724
-
\??\c:\vppvp.exec:\vppvp.exe133⤵PID:3888
-
\??\c:\1ddvp.exec:\1ddvp.exe134⤵PID:412
-
\??\c:\rrffffr.exec:\rrffffr.exe135⤵PID:4480
-
\??\c:\lrlrrxl.exec:\lrlrrxl.exe136⤵PID:1068
-
\??\c:\9nbhbh.exec:\9nbhbh.exe137⤵PID:4688
-
\??\c:\ttnthh.exec:\ttnthh.exe138⤵PID:4904
-
\??\c:\pdddv.exec:\pdddv.exe139⤵PID:3024
-
\??\c:\xfrrlrr.exec:\xfrrlrr.exe140⤵PID:5060
-
\??\c:\7bhhnn.exec:\7bhhnn.exe141⤵PID:4516
-
\??\c:\1htntt.exec:\1htntt.exe142⤵PID:656
-
\??\c:\dpjjp.exec:\dpjjp.exe143⤵PID:4512
-
\??\c:\5flxxrl.exec:\5flxxrl.exe144⤵PID:1064
-
\??\c:\7hnbtt.exec:\7hnbtt.exe145⤵PID:1580
-
\??\c:\1ntnnt.exec:\1ntnnt.exe146⤵PID:1852
-
\??\c:\3jvvd.exec:\3jvvd.exe147⤵PID:2740
-
\??\c:\xffllrr.exec:\xffllrr.exe148⤵PID:2204
-
\??\c:\5rllrxr.exec:\5rllrxr.exe149⤵PID:4544
-
\??\c:\1tbhhh.exec:\1tbhhh.exe150⤵PID:868
-
\??\c:\pdjjv.exec:\pdjjv.exe151⤵PID:2068
-
\??\c:\jjvvp.exec:\jjvvp.exe152⤵PID:1664
-
\??\c:\3xrlxxr.exec:\3xrlxxr.exe153⤵PID:4364
-
\??\c:\1bhbnt.exec:\1bhbnt.exe154⤵PID:3452
-
\??\c:\jvjvp.exec:\jvjvp.exe155⤵PID:1264
-
\??\c:\3fffffr.exec:\3fffffr.exe156⤵PID:572
-
\??\c:\lrrrrrr.exec:\lrrrrrr.exe157⤵PID:2096
-
\??\c:\nhbbnn.exec:\nhbbnn.exe158⤵PID:556
-
\??\c:\vjppp.exec:\vjppp.exe159⤵PID:2172
-
\??\c:\lffxrrf.exec:\lffxrrf.exe160⤵PID:1120
-
\??\c:\xxffllf.exec:\xxffllf.exe161⤵PID:1372
-
\??\c:\jdjjj.exec:\jdjjj.exe162⤵PID:1812
-
\??\c:\pvpjd.exec:\pvpjd.exe163⤵PID:4956
-
\??\c:\llfxfrf.exec:\llfxfrf.exe164⤵PID:1252
-
\??\c:\1hhhbt.exec:\1hhhbt.exe165⤵PID:1948
-
\??\c:\jpddd.exec:\jpddd.exe166⤵PID:4960
-
\??\c:\dvvdv.exec:\dvvdv.exe167⤵PID:3548
-
\??\c:\fxxxlll.exec:\fxxxlll.exe168⤵PID:4852
-
\??\c:\lfxrrrl.exec:\lfxrrrl.exe169⤵PID:4728
-
\??\c:\9ntnnh.exec:\9ntnnh.exe170⤵PID:4972
-
\??\c:\5bbbtt.exec:\5bbbtt.exe171⤵PID:4032
-
\??\c:\pjvvd.exec:\pjvvd.exe172⤵PID:1836
-
\??\c:\jddpd.exec:\jddpd.exe173⤵PID:3440
-
\??\c:\5xxxrrl.exec:\5xxxrrl.exe174⤵PID:4836
-
\??\c:\lrlrrfl.exec:\lrlrrfl.exe175⤵PID:1248
-
\??\c:\tnbbbh.exec:\tnbbbh.exe176⤵PID:844
-
\??\c:\3bttnh.exec:\3bttnh.exe177⤵PID:1384
-
\??\c:\9dpjj.exec:\9dpjj.exe178⤵PID:1536
-
\??\c:\3xlrlxr.exec:\3xlrlxr.exe179⤵PID:1056
-
\??\c:\lxrfxrl.exec:\lxrfxrl.exe180⤵PID:3964
-
\??\c:\bbbbbn.exec:\bbbbbn.exe181⤵PID:1076
-
\??\c:\ppvjd.exec:\ppvjd.exe182⤵PID:2440
-
\??\c:\frfxrxr.exec:\frfxrxr.exe183⤵PID:1832
-
\??\c:\bntttt.exec:\bntttt.exe184⤵PID:1208
-
\??\c:\jddpj.exec:\jddpj.exe185⤵PID:1556
-
\??\c:\vdpdj.exec:\vdpdj.exe186⤵PID:4296
-
\??\c:\1frrrxx.exec:\1frrrxx.exe187⤵PID:4400
-
\??\c:\1tbbtt.exec:\1tbbtt.exe188⤵PID:1324
-
\??\c:\vpjvp.exec:\vpjvp.exe189⤵PID:4264
-
\??\c:\xxffxlr.exec:\xxffxlr.exe190⤵PID:1992
-
\??\c:\nbtnbh.exec:\nbtnbh.exe191⤵PID:2688
-
\??\c:\5flfxfx.exec:\5flfxfx.exe192⤵PID:4224
-
\??\c:\thttnh.exec:\thttnh.exe193⤵PID:1692
-
\??\c:\xrrrlll.exec:\xrrrlll.exe194⤵PID:2248
-
\??\c:\bbhhhb.exec:\bbhhhb.exe195⤵PID:3780
-
\??\c:\tbhnhh.exec:\tbhnhh.exe196⤵PID:660
-
\??\c:\pjdvd.exec:\pjdvd.exe197⤵PID:4976
-
\??\c:\rlxxrrl.exec:\rlxxrrl.exe198⤵PID:836
-
\??\c:\7lrrxxx.exec:\7lrrxxx.exe199⤵PID:2544
-
\??\c:\hbnnnh.exec:\hbnnnh.exe200⤵PID:4620
-
\??\c:\7nttnt.exec:\7nttnt.exe201⤵PID:1920
-
\??\c:\fflllrr.exec:\fflllrr.exe202⤵PID:3216
-
\??\c:\rlfxffr.exec:\rlfxffr.exe203⤵PID:4044
-
\??\c:\vjddv.exec:\vjddv.exe204⤵PID:2056
-
\??\c:\vjvpj.exec:\vjvpj.exe205⤵PID:1812
-
\??\c:\fxlflfr.exec:\fxlflfr.exe206⤵PID:4956
-
\??\c:\bnnnnn.exec:\bnnnnn.exe207⤵PID:2540
-
\??\c:\pjddp.exec:\pjddp.exe208⤵PID:1576
-
\??\c:\djdvv.exec:\djdvv.exe209⤵PID:2360
-
\??\c:\rrlxxxl.exec:\rrlxxxl.exe210⤵PID:2380
-
\??\c:\tbhhhh.exec:\tbhhhh.exe211⤵PID:4852
-
\??\c:\thbbhn.exec:\thbbhn.exe212⤵PID:1828
-
\??\c:\jpvvp.exec:\jpvvp.exe213⤵PID:3092
-
\??\c:\llrrlrl.exec:\llrrlrl.exe214⤵PID:1184
-
\??\c:\xrffrlx.exec:\xrffrlx.exe215⤵PID:1836
-
\??\c:\bththb.exec:\bththb.exe216⤵PID:4572
-
\??\c:\nnbtht.exec:\nnbtht.exe217⤵PID:4836
-
\??\c:\pdpdd.exec:\pdpdd.exe218⤵PID:3604
-
\??\c:\pddvp.exec:\pddvp.exe219⤵PID:1296
-
\??\c:\lflxrll.exec:\lflxrll.exe220⤵PID:4936
-
\??\c:\tnnbhh.exec:\tnnbhh.exe221⤵PID:2888
-
\??\c:\ttbttt.exec:\ttbttt.exe222⤵PID:1056
-
\??\c:\vvddd.exec:\vvddd.exe223⤵PID:4688
-
\??\c:\lflfrxl.exec:\lflfrxl.exe224⤵PID:3420
-
\??\c:\rffrxrf.exec:\rffrxrf.exe225⤵PID:1952
-
\??\c:\thhbtn.exec:\thhbtn.exe226⤵PID:2724
-
\??\c:\pppjj.exec:\pppjj.exe227⤵PID:2296
-
\??\c:\dvvpp.exec:\dvvpp.exe228⤵PID:4084
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe229⤵PID:1336
-
\??\c:\hnbnht.exec:\hnbnht.exe230⤵PID:2004
-
\??\c:\nhnbhh.exec:\nhnbhh.exe231⤵PID:3472
-
\??\c:\9djjp.exec:\9djjp.exe232⤵PID:4780
-
\??\c:\llrlllf.exec:\llrlllf.exe233⤵PID:500
-
\??\c:\rlrrrxx.exec:\rlrrrxx.exe234⤵PID:4640
-
\??\c:\nbhhbb.exec:\nbhhbb.exe235⤵PID:4672
-
\??\c:\9pjpd.exec:\9pjpd.exe236⤵PID:2996
-
\??\c:\pppvp.exec:\pppvp.exe237⤵PID:2188
-
\??\c:\1flfllr.exec:\1flfllr.exe238⤵PID:64
-
\??\c:\thnnnn.exec:\thnnnn.exe239⤵PID:2836
-
\??\c:\hbbtnn.exec:\hbbtnn.exe240⤵PID:4240
-
\??\c:\vjvdp.exec:\vjvdp.exe241⤵PID:1416
-
\??\c:\fxfffxx.exec:\fxfffxx.exe242⤵PID:2504