Analysis
-
max time kernel
147s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 17:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe
-
Size
361KB
-
MD5
1f90e1ef7c3edcb1d265cff7bad29450
-
SHA1
88c1a1b14fe6afd34dac05349844b42beb0f58b1
-
SHA256
f4d64914326bc7951b179c515497186a6f9136e21eb4597918dcabe896b7db5d
-
SHA512
07cd2636d3a7107d9e6eb3c19bb3b0be76b1cea4f3557855548aeedfb1e44fb08c2259d830d3d6c9291106cec3b92d44a346be73d555d23ee5df0d9ceae49319
-
SSDEEP
6144:n3C9BRIG0asYFm71m8+GdkB9yMu7N+8px7O/:n3C9uYA71kSMu08px7g
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/4476-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3760-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2672-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nnnhbh.exelffrrll.exenhtnnt.exejjjjj.exehhttnh.exerxflllf.exentbbtt.exejdvpd.exerrxrllf.exepvppp.exefxlffff.exe5djjd.exehbnnnn.exedjjjv.exebnbbbt.exepdjjj.exerrrllll.exetnnnhb.exerxxffrr.exebbbhbt.exepvpvp.exejjppp.exe9rffxrl.exebbnhbb.exebhnhnn.exe3tbtnn.exe5hbbtt.exevpvjj.exenhtbtb.exebthbhb.exerrxrllf.exettbtnn.exefllxxxr.exettttnt.exevdvpd.exepdvpp.exelrxxxxl.exepjvpj.exefrlfxrr.exennbbhh.exenhnhbb.exejdjdd.exefrxrllf.exe9bnhhh.exedppjd.exexlxlfxr.exehbhbtt.exejpppj.exerrrlllf.exethnnhh.exe7djdv.exe7rrllrr.exetnttnn.exedjpdp.exexflfrfl.exenhtnnt.exenhbhbb.exe5vdvp.exerxxlffx.exenbnhhh.exehtbtnn.exevjddv.exerfllfff.exetthhnb.exepid process 4500 nnnhbh.exe 4472 lffrrll.exe 1888 nhtnnt.exe 2332 jjjjj.exe 2116 hhttnh.exe 388 rxflllf.exe 1172 ntbbtt.exe 2784 jdvpd.exe 4036 rrxrllf.exe 3392 pvppp.exe 4932 fxlffff.exe 4640 5djjd.exe 4240 hbnnnn.exe 3836 djjjv.exe 2924 bnbbbt.exe 4264 pdjjj.exe 4192 rrrllll.exe 3760 tnnnhb.exe 60 rxxffrr.exe 3948 bbbhbt.exe 3500 pvpvp.exe 5040 jjppp.exe 2300 9rffxrl.exe 412 bbnhbb.exe 3904 bhnhnn.exe 540 3tbtnn.exe 3616 5hbbtt.exe 2672 vpvjj.exe 4032 nhtbtb.exe 2356 bthbhb.exe 2024 rrxrllf.exe 2420 ttbtnn.exe 4516 fllxxxr.exe 3464 ttttnt.exe 4924 vdvpd.exe 2004 pdvpp.exe 2788 lrxxxxl.exe 1464 pjvpj.exe 1688 frlfxrr.exe 4152 nnbbhh.exe 836 nhnhbb.exe 4804 jdjdd.exe 1976 frxrllf.exe 4244 9bnhhh.exe 3936 dppjd.exe 388 xlxlfxr.exe 2904 hbhbtt.exe 1936 jpppj.exe 4916 rrrlllf.exe 5064 thnnhh.exe 2296 7djdv.exe 5096 7rrllrr.exe 3240 tnttnn.exe 4872 djpdp.exe 808 xflfrfl.exe 976 nhtnnt.exe 952 nhbhbb.exe 4016 5vdvp.exe 372 rxxlffx.exe 4688 nbnhhh.exe 1604 htbtnn.exe 5100 vjddv.exe 4100 rfllfff.exe 1968 tthhnb.exe -
Processes:
resource yara_rule behavioral2/memory/4476-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3760-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/412-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2672-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exennnhbh.exelffrrll.exenhtnnt.exejjjjj.exehhttnh.exerxflllf.exentbbtt.exejdvpd.exerrxrllf.exepvppp.exefxlffff.exe5djjd.exehbnnnn.exedjjjv.exebnbbbt.exepdjjj.exerrrllll.exetnnnhb.exerxxffrr.exebbbhbt.exepvpvp.exedescription pid process target process PID 4476 wrote to memory of 4500 4476 1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe nnnhbh.exe PID 4476 wrote to memory of 4500 4476 1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe nnnhbh.exe PID 4476 wrote to memory of 4500 4476 1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe nnnhbh.exe PID 4500 wrote to memory of 4472 4500 nnnhbh.exe lffrrll.exe PID 4500 wrote to memory of 4472 4500 nnnhbh.exe lffrrll.exe PID 4500 wrote to memory of 4472 4500 nnnhbh.exe lffrrll.exe PID 4472 wrote to memory of 1888 4472 lffrrll.exe nhtnnt.exe PID 4472 wrote to memory of 1888 4472 lffrrll.exe nhtnnt.exe PID 4472 wrote to memory of 1888 4472 lffrrll.exe nhtnnt.exe PID 1888 wrote to memory of 2332 1888 nhtnnt.exe jjjjj.exe PID 1888 wrote to memory of 2332 1888 nhtnnt.exe jjjjj.exe PID 1888 wrote to memory of 2332 1888 nhtnnt.exe jjjjj.exe PID 2332 wrote to memory of 2116 2332 jjjjj.exe hhttnh.exe PID 2332 wrote to memory of 2116 2332 jjjjj.exe hhttnh.exe PID 2332 wrote to memory of 2116 2332 jjjjj.exe hhttnh.exe PID 2116 wrote to memory of 388 2116 hhttnh.exe rxflllf.exe PID 2116 wrote to memory of 388 2116 hhttnh.exe rxflllf.exe PID 2116 wrote to memory of 388 2116 hhttnh.exe rxflllf.exe PID 388 wrote to memory of 1172 388 rxflllf.exe ntbbtt.exe PID 388 wrote to memory of 1172 388 rxflllf.exe ntbbtt.exe PID 388 wrote to memory of 1172 388 rxflllf.exe ntbbtt.exe PID 1172 wrote to memory of 2784 1172 ntbbtt.exe jdvpd.exe PID 1172 wrote to memory of 2784 1172 ntbbtt.exe jdvpd.exe PID 1172 wrote to memory of 2784 1172 ntbbtt.exe jdvpd.exe PID 2784 wrote to memory of 4036 2784 jdvpd.exe rrxrllf.exe PID 2784 wrote to memory of 4036 2784 jdvpd.exe rrxrllf.exe PID 2784 wrote to memory of 4036 2784 jdvpd.exe rrxrllf.exe PID 4036 wrote to memory of 3392 4036 rrxrllf.exe pvppp.exe PID 4036 wrote to memory of 3392 4036 rrxrllf.exe pvppp.exe PID 4036 wrote to memory of 3392 4036 rrxrllf.exe pvppp.exe PID 3392 wrote to memory of 4932 3392 pvppp.exe fxlffff.exe PID 3392 wrote to memory of 4932 3392 pvppp.exe fxlffff.exe PID 3392 wrote to memory of 4932 3392 pvppp.exe fxlffff.exe PID 4932 wrote to memory of 4640 4932 fxlffff.exe 5djjd.exe PID 4932 wrote to memory of 4640 4932 fxlffff.exe 5djjd.exe PID 4932 wrote to memory of 4640 4932 fxlffff.exe 5djjd.exe PID 4640 wrote to memory of 4240 4640 5djjd.exe hbnnnn.exe PID 4640 wrote to memory of 4240 4640 5djjd.exe hbnnnn.exe PID 4640 wrote to memory of 4240 4640 5djjd.exe hbnnnn.exe PID 4240 wrote to memory of 3836 4240 hbnnnn.exe djjjv.exe PID 4240 wrote to memory of 3836 4240 hbnnnn.exe djjjv.exe PID 4240 wrote to memory of 3836 4240 hbnnnn.exe djjjv.exe PID 3836 wrote to memory of 2924 3836 djjjv.exe bnbbbt.exe PID 3836 wrote to memory of 2924 3836 djjjv.exe bnbbbt.exe PID 3836 wrote to memory of 2924 3836 djjjv.exe bnbbbt.exe PID 2924 wrote to memory of 4264 2924 bnbbbt.exe pdjjj.exe PID 2924 wrote to memory of 4264 2924 bnbbbt.exe pdjjj.exe PID 2924 wrote to memory of 4264 2924 bnbbbt.exe pdjjj.exe PID 4264 wrote to memory of 4192 4264 pdjjj.exe rrrllll.exe PID 4264 wrote to memory of 4192 4264 pdjjj.exe rrrllll.exe PID 4264 wrote to memory of 4192 4264 pdjjj.exe rrrllll.exe PID 4192 wrote to memory of 3760 4192 rrrllll.exe tnnnhb.exe PID 4192 wrote to memory of 3760 4192 rrrllll.exe tnnnhb.exe PID 4192 wrote to memory of 3760 4192 rrrllll.exe tnnnhb.exe PID 3760 wrote to memory of 60 3760 tnnnhb.exe rxxffrr.exe PID 3760 wrote to memory of 60 3760 tnnnhb.exe rxxffrr.exe PID 3760 wrote to memory of 60 3760 tnnnhb.exe rxxffrr.exe PID 60 wrote to memory of 3948 60 rxxffrr.exe bbbhbt.exe PID 60 wrote to memory of 3948 60 rxxffrr.exe bbbhbt.exe PID 60 wrote to memory of 3948 60 rxxffrr.exe bbbhbt.exe PID 3948 wrote to memory of 3500 3948 bbbhbt.exe pvpvp.exe PID 3948 wrote to memory of 3500 3948 bbbhbt.exe pvpvp.exe PID 3948 wrote to memory of 3500 3948 bbbhbt.exe pvpvp.exe PID 3500 wrote to memory of 5040 3500 pvpvp.exe jjppp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1f90e1ef7c3edcb1d265cff7bad29450_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\nnnhbh.exec:\nnnhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\lffrrll.exec:\lffrrll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\nhtnnt.exec:\nhtnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\jjjjj.exec:\jjjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\hhttnh.exec:\hhttnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\rxflllf.exec:\rxflllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\ntbbtt.exec:\ntbbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\jdvpd.exec:\jdvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\rrxrllf.exec:\rrxrllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\pvppp.exec:\pvppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\fxlffff.exec:\fxlffff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\5djjd.exec:\5djjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\hbnnnn.exec:\hbnnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\djjjv.exec:\djjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\bnbbbt.exec:\bnbbbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\pdjjj.exec:\pdjjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\rrrllll.exec:\rrrllll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\tnnnhb.exec:\tnnnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\rxxffrr.exec:\rxxffrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\bbbhbt.exec:\bbbhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\pvpvp.exec:\pvpvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\jjppp.exec:\jjppp.exe23⤵
- Executes dropped EXE
PID:5040 -
\??\c:\9rffxrl.exec:\9rffxrl.exe24⤵
- Executes dropped EXE
PID:2300 -
\??\c:\bbnhbb.exec:\bbnhbb.exe25⤵
- Executes dropped EXE
PID:412 -
\??\c:\bhnhnn.exec:\bhnhnn.exe26⤵
- Executes dropped EXE
PID:3904 -
\??\c:\3tbtnn.exec:\3tbtnn.exe27⤵
- Executes dropped EXE
PID:540 -
\??\c:\5hbbtt.exec:\5hbbtt.exe28⤵
- Executes dropped EXE
PID:3616 -
\??\c:\vpvjj.exec:\vpvjj.exe29⤵
- Executes dropped EXE
PID:2672 -
\??\c:\nhtbtb.exec:\nhtbtb.exe30⤵
- Executes dropped EXE
PID:4032 -
\??\c:\bthbhb.exec:\bthbhb.exe31⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rrxrllf.exec:\rrxrllf.exe32⤵
- Executes dropped EXE
PID:2024 -
\??\c:\ttbtnn.exec:\ttbtnn.exe33⤵
- Executes dropped EXE
PID:2420 -
\??\c:\fllxxxr.exec:\fllxxxr.exe34⤵
- Executes dropped EXE
PID:4516 -
\??\c:\ttttnt.exec:\ttttnt.exe35⤵
- Executes dropped EXE
PID:3464 -
\??\c:\vdvpd.exec:\vdvpd.exe36⤵
- Executes dropped EXE
PID:4924 -
\??\c:\pdvpp.exec:\pdvpp.exe37⤵
- Executes dropped EXE
PID:2004 -
\??\c:\lrxxxxl.exec:\lrxxxxl.exe38⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pjvpj.exec:\pjvpj.exe39⤵
- Executes dropped EXE
PID:1464 -
\??\c:\frlfxrr.exec:\frlfxrr.exe40⤵
- Executes dropped EXE
PID:1688 -
\??\c:\nnbbhh.exec:\nnbbhh.exe41⤵
- Executes dropped EXE
PID:4152 -
\??\c:\nhnhbb.exec:\nhnhbb.exe42⤵
- Executes dropped EXE
PID:836 -
\??\c:\jdjdd.exec:\jdjdd.exe43⤵
- Executes dropped EXE
PID:4804 -
\??\c:\frxrllf.exec:\frxrllf.exe44⤵
- Executes dropped EXE
PID:1976 -
\??\c:\9bnhhh.exec:\9bnhhh.exe45⤵
- Executes dropped EXE
PID:4244 -
\??\c:\dppjd.exec:\dppjd.exe46⤵
- Executes dropped EXE
PID:3936 -
\??\c:\xlxlfxr.exec:\xlxlfxr.exe47⤵
- Executes dropped EXE
PID:388 -
\??\c:\hbhbtt.exec:\hbhbtt.exe48⤵
- Executes dropped EXE
PID:2904 -
\??\c:\jpppj.exec:\jpppj.exe49⤵
- Executes dropped EXE
PID:1936 -
\??\c:\rrrlllf.exec:\rrrlllf.exe50⤵
- Executes dropped EXE
PID:4916 -
\??\c:\thnnhh.exec:\thnnhh.exe51⤵
- Executes dropped EXE
PID:5064 -
\??\c:\7djdv.exec:\7djdv.exe52⤵
- Executes dropped EXE
PID:2296 -
\??\c:\7rrllrr.exec:\7rrllrr.exe53⤵
- Executes dropped EXE
PID:5096 -
\??\c:\tnttnn.exec:\tnttnn.exe54⤵
- Executes dropped EXE
PID:3240 -
\??\c:\djpdp.exec:\djpdp.exe55⤵
- Executes dropped EXE
PID:4872 -
\??\c:\xflfrfl.exec:\xflfrfl.exe56⤵
- Executes dropped EXE
PID:808 -
\??\c:\nhtnnt.exec:\nhtnnt.exe57⤵
- Executes dropped EXE
PID:976 -
\??\c:\nhbhbb.exec:\nhbhbb.exe58⤵
- Executes dropped EXE
PID:952 -
\??\c:\5vdvp.exec:\5vdvp.exe59⤵
- Executes dropped EXE
PID:4016 -
\??\c:\rxxlffx.exec:\rxxlffx.exe60⤵
- Executes dropped EXE
PID:372 -
\??\c:\nbnhhh.exec:\nbnhhh.exe61⤵
- Executes dropped EXE
PID:4688 -
\??\c:\htbtnn.exec:\htbtnn.exe62⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vjddv.exec:\vjddv.exe63⤵
- Executes dropped EXE
PID:5100 -
\??\c:\rfllfff.exec:\rfllfff.exe64⤵
- Executes dropped EXE
PID:4100 -
\??\c:\tthhnb.exec:\tthhnb.exe65⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bnbbhb.exec:\bnbbhb.exe66⤵PID:3908
-
\??\c:\pdpjd.exec:\pdpjd.exe67⤵PID:3572
-
\??\c:\rxxrrff.exec:\rxxrrff.exe68⤵PID:2300
-
\??\c:\thtnnt.exec:\thtnnt.exe69⤵PID:632
-
\??\c:\ddddv.exec:\ddddv.exe70⤵PID:1148
-
\??\c:\xfrflll.exec:\xfrflll.exe71⤵PID:3904
-
\??\c:\lflxfxr.exec:\lflxfxr.exe72⤵PID:1096
-
\??\c:\ffxxrfl.exec:\ffxxrfl.exe73⤵PID:3828
-
\??\c:\9tnbth.exec:\9tnbth.exe74⤵PID:4944
-
\??\c:\nttntt.exec:\nttntt.exe75⤵PID:2100
-
\??\c:\dvvpp.exec:\dvvpp.exe76⤵PID:4744
-
\??\c:\3lfxxxr.exec:\3lfxxxr.exe77⤵PID:1320
-
\??\c:\thhbtn.exec:\thhbtn.exe78⤵PID:444
-
\??\c:\vpvpd.exec:\vpvpd.exe79⤵PID:1520
-
\??\c:\vddpp.exec:\vddpp.exe80⤵PID:4396
-
\??\c:\fffxrfx.exec:\fffxrfx.exe81⤵PID:3972
-
\??\c:\bhtntb.exec:\bhtntb.exe82⤵PID:4784
-
\??\c:\ppdjd.exec:\ppdjd.exe83⤵PID:5008
-
\??\c:\jpvdj.exec:\jpvdj.exe84⤵PID:2444
-
\??\c:\rlffxxr.exec:\rlffxxr.exe85⤵PID:3308
-
\??\c:\xfrrrll.exec:\xfrrrll.exe86⤵PID:900
-
\??\c:\nbhhhh.exec:\nbhhhh.exe87⤵PID:1836
-
\??\c:\pdjjd.exec:\pdjjd.exe88⤵PID:1796
-
\??\c:\pvppj.exec:\pvppj.exe89⤵PID:2020
-
\??\c:\xllrlff.exec:\xllrlff.exe90⤵PID:3936
-
\??\c:\rfxrlrl.exec:\rfxrlrl.exe91⤵PID:388
-
\??\c:\5thbbb.exec:\5thbbb.exe92⤵PID:5076
-
\??\c:\pdpjd.exec:\pdpjd.exe93⤵PID:1676
-
\??\c:\7fffxxr.exec:\7fffxxr.exe94⤵PID:4916
-
\??\c:\btttnb.exec:\btttnb.exe95⤵PID:2812
-
\??\c:\dvddv.exec:\dvddv.exe96⤵PID:5048
-
\??\c:\lffxxxr.exec:\lffxxxr.exe97⤵PID:4640
-
\??\c:\hnbtnh.exec:\hnbtnh.exe98⤵PID:4864
-
\??\c:\vppjj.exec:\vppjj.exe99⤵PID:4956
-
\??\c:\pdddd.exec:\pdddd.exe100⤵PID:3952
-
\??\c:\rxxfxlf.exec:\rxxfxlf.exe101⤵PID:1948
-
\??\c:\tttbbb.exec:\tttbbb.exe102⤵PID:2716
-
\??\c:\pjvvd.exec:\pjvvd.exe103⤵PID:4608
-
\??\c:\lffxrrr.exec:\lffxrrr.exe104⤵PID:3196
-
\??\c:\xrxrlfx.exec:\xrxrlfx.exe105⤵PID:3760
-
\??\c:\pjppj.exec:\pjppj.exe106⤵PID:2044
-
\??\c:\rlrrxxx.exec:\rlrrxxx.exe107⤵PID:4268
-
\??\c:\llfxxrl.exec:\llfxxrl.exe108⤵PID:4312
-
\??\c:\btbhhh.exec:\btbhhh.exe109⤵PID:3788
-
\??\c:\jvppp.exec:\jvppp.exe110⤵PID:3472
-
\??\c:\fxxrlff.exec:\fxxrlff.exe111⤵PID:448
-
\??\c:\dpddv.exec:\dpddv.exe112⤵PID:508
-
\??\c:\dvvvp.exec:\dvvvp.exe113⤵PID:1616
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe114⤵PID:3428
-
\??\c:\ttnhtt.exec:\ttnhtt.exe115⤵PID:4536
-
\??\c:\3pvjj.exec:\3pvjj.exe116⤵PID:1084
-
\??\c:\lffxxrr.exec:\lffxxrr.exe117⤵PID:2664
-
\??\c:\xfrfxxr.exec:\xfrfxxr.exe118⤵PID:2420
-
\??\c:\7hnhbh.exec:\7hnhbh.exe119⤵PID:4516
-
\??\c:\vppdv.exec:\vppdv.exe120⤵PID:4344
-
\??\c:\llxxrrr.exec:\llxxrrr.exe121⤵PID:2788
-
\??\c:\ffllllf.exec:\ffllllf.exe122⤵PID:3408
-
\??\c:\hthbtt.exec:\hthbtt.exe123⤵PID:3516
-
\??\c:\pppdd.exec:\pppdd.exe124⤵PID:900
-
\??\c:\frfffll.exec:\frfffll.exe125⤵PID:1976
-
\??\c:\xrfxrll.exec:\xrfxrll.exe126⤵PID:2896
-
\??\c:\9btntb.exec:\9btntb.exe127⤵PID:2424
-
\??\c:\jdvpp.exec:\jdvpp.exe128⤵PID:2784
-
\??\c:\fxrffrl.exec:\fxrffrl.exe129⤵PID:4992
-
\??\c:\vvdvj.exec:\vvdvj.exe130⤵PID:5076
-
\??\c:\5nhbnt.exec:\5nhbnt.exe131⤵PID:848
-
\??\c:\ppvpj.exec:\ppvpj.exe132⤵PID:2656
-
\??\c:\xlxfxfl.exec:\xlxfxfl.exe133⤵PID:4380
-
\??\c:\jppjd.exec:\jppjd.exe134⤵PID:5036
-
\??\c:\9xlflrx.exec:\9xlflrx.exe135⤵PID:1356
-
\??\c:\pdpjd.exec:\pdpjd.exe136⤵PID:4896
-
\??\c:\fffrrlf.exec:\fffrrlf.exe137⤵PID:4456
-
\??\c:\nbbntt.exec:\nbbntt.exe138⤵PID:2924
-
\??\c:\djpjj.exec:\djpjj.exe139⤵PID:4016
-
\??\c:\hbnnnh.exec:\hbnnnh.exe140⤵PID:2612
-
\??\c:\9flfxxr.exec:\9flfxxr.exe141⤵PID:3696
-
\??\c:\7bnnhh.exec:\7bnnhh.exe142⤵PID:1496
-
\??\c:\pjdvj.exec:\pjdvj.exe143⤵PID:4100
-
\??\c:\1xfxrlf.exec:\1xfxrlf.exe144⤵PID:5060
-
\??\c:\7frlfff.exec:\7frlfff.exe145⤵PID:5040
-
\??\c:\htbttt.exec:\htbttt.exe146⤵PID:4696
-
\??\c:\jdjdv.exec:\jdjdv.exe147⤵PID:4860
-
\??\c:\lflffff.exec:\lflffff.exe148⤵PID:1148
-
\??\c:\llllfff.exec:\llllfff.exe149⤵PID:3168
-
\??\c:\3httnn.exec:\3httnn.exe150⤵PID:2216
-
\??\c:\hnttnn.exec:\hnttnn.exe151⤵PID:4904
-
\??\c:\pdpjd.exec:\pdpjd.exe152⤵PID:4576
-
\??\c:\1lxxxxf.exec:\1lxxxxf.exe153⤵PID:4408
-
\??\c:\frxrrlf.exec:\frxrrlf.exe154⤵PID:2644
-
\??\c:\hbtttt.exec:\hbtttt.exe155⤵PID:844
-
\??\c:\vdpdv.exec:\vdpdv.exe156⤵PID:3632
-
\??\c:\rrrrffx.exec:\rrrrffx.exe157⤵PID:656
-
\??\c:\9lrrllf.exec:\9lrrllf.exe158⤵PID:3516
-
\??\c:\htbbbb.exec:\htbbbb.exe159⤵PID:2116
-
\??\c:\jjvpp.exec:\jjvpp.exe160⤵PID:2896
-
\??\c:\5jddp.exec:\5jddp.exe161⤵PID:1172
-
\??\c:\lfxrxlf.exec:\lfxrxlf.exe162⤵PID:2784
-
\??\c:\tbnhhb.exec:\tbnhhb.exe163⤵PID:4260
-
\??\c:\hnbtnh.exec:\hnbtnh.exe164⤵PID:4052
-
\??\c:\djdvv.exec:\djdvv.exe165⤵PID:848
-
\??\c:\flffxrx.exec:\flffxrx.exe166⤵PID:4552
-
\??\c:\nhnnhh.exec:\nhnnhh.exe167⤵PID:4380
-
\??\c:\ffrrrrr.exec:\ffrrrrr.exe168⤵PID:5036
-
\??\c:\bhhbbb.exec:\bhhbbb.exe169⤵PID:976
-
\??\c:\djjdv.exec:\djjdv.exe170⤵PID:4896
-
\??\c:\1lxlllx.exec:\1lxlllx.exe171⤵PID:3032
-
\??\c:\tntnnt.exec:\tntnnt.exe172⤵PID:2716
-
\??\c:\lfrffxx.exec:\lfrffxx.exe173⤵PID:2988
-
\??\c:\xfffxxx.exec:\xfffxxx.exe174⤵PID:4424
-
\??\c:\3htbbn.exec:\3htbbn.exe175⤵PID:3696
-
\??\c:\3pvpv.exec:\3pvpv.exe176⤵PID:3360
-
\??\c:\llfxfll.exec:\llfxfll.exe177⤵PID:3012
-
\??\c:\hntnnb.exec:\hntnnb.exe178⤵PID:1772
-
\??\c:\hthtnh.exec:\hthtnh.exe179⤵PID:5116
-
\??\c:\9xfllfl.exec:\9xfllfl.exe180⤵PID:1640
-
\??\c:\lxllllr.exec:\lxllllr.exe181⤵PID:5052
-
\??\c:\bbbtnn.exec:\bbbtnn.exe182⤵PID:3828
-
\??\c:\pdjdd.exec:\pdjdd.exe183⤵PID:1648
-
\??\c:\rrrlrrl.exec:\rrrlrrl.exe184⤵PID:3168
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe185⤵PID:2216
-
\??\c:\hnhhhh.exec:\hnhhhh.exe186⤵PID:4904
-
\??\c:\vjpjj.exec:\vjpjj.exe187⤵PID:4372
-
\??\c:\xlllllf.exec:\xlllllf.exe188⤵PID:1284
-
\??\c:\tnnnhn.exec:\tnnnhn.exe189⤵PID:2452
-
\??\c:\ppjpp.exec:\ppjpp.exe190⤵PID:412
-
\??\c:\lxrrrxx.exec:\lxrrrxx.exe191⤵PID:4428
-
\??\c:\5httnb.exec:\5httnb.exe192⤵PID:1800
-
\??\c:\5pvpj.exec:\5pvpj.exe193⤵PID:2016
-
\??\c:\lflxrff.exec:\lflxrff.exe194⤵PID:2208
-
\??\c:\5bhnbh.exec:\5bhnbh.exe195⤵PID:2896
-
\??\c:\thtnhh.exec:\thtnhh.exe196⤵PID:4992
-
\??\c:\vpjdv.exec:\vpjdv.exe197⤵PID:2784
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe198⤵PID:4260
-
\??\c:\tttbnn.exec:\tttbnn.exe199⤵PID:4052
-
\??\c:\pjpdv.exec:\pjpdv.exe200⤵PID:4940
-
\??\c:\rrlxfxx.exec:\rrlxfxx.exe201⤵PID:4552
-
\??\c:\3ntttb.exec:\3ntttb.exe202⤵PID:4548
-
\??\c:\hnbnnn.exec:\hnbnnn.exe203⤵PID:2932
-
\??\c:\jdjdv.exec:\jdjdv.exe204⤵PID:952
-
\??\c:\xfffrlr.exec:\xfffrlr.exe205⤵PID:1120
-
\??\c:\tnhhbh.exec:\tnhhbh.exe206⤵PID:2924
-
\??\c:\dvjvd.exec:\dvjvd.exe207⤵PID:4520
-
\??\c:\fxrrffr.exec:\fxrrffr.exe208⤵PID:548
-
\??\c:\thnhbb.exec:\thnhbb.exe209⤵PID:4656
-
\??\c:\djpjp.exec:\djpjp.exe210⤵PID:4568
-
\??\c:\jvjdv.exec:\jvjdv.exe211⤵PID:3124
-
\??\c:\7xrrlrl.exec:\7xrrlrl.exe212⤵PID:4312
-
\??\c:\hnbbnn.exec:\hnbbnn.exe213⤵PID:2300
-
\??\c:\jdvpv.exec:\jdvpv.exe214⤵PID:4496
-
\??\c:\ffxxxfl.exec:\ffxxxfl.exe215⤵PID:5052
-
\??\c:\rrlfxrx.exec:\rrlfxrx.exe216⤵PID:1448
-
\??\c:\hnbbbb.exec:\hnbbbb.exe217⤵PID:944
-
\??\c:\jpvvv.exec:\jpvvv.exe218⤵PID:4744
-
\??\c:\fxxrlff.exec:\fxxrlff.exe219⤵PID:2216
-
\??\c:\xxxlfxr.exec:\xxxlfxr.exe220⤵PID:2664
-
\??\c:\tnnhhb.exec:\tnnhhb.exe221⤵PID:4396
-
\??\c:\vdpjd.exec:\vdpjd.exe222⤵PID:4976
-
\??\c:\xlxrlrl.exec:\xlxrlrl.exe223⤵PID:2092
-
\??\c:\bhntth.exec:\bhntth.exe224⤵PID:1544
-
\??\c:\vvvjv.exec:\vvvjv.exe225⤵PID:1976
-
\??\c:\7rrxrxx.exec:\7rrxrxx.exe226⤵PID:388
-
\??\c:\rfxrxfx.exec:\rfxrxfx.exe227⤵PID:2208
-
\??\c:\htbtnh.exec:\htbtnh.exe228⤵PID:2820
-
\??\c:\htbttb.exec:\htbttb.exe229⤵PID:2656
-
\??\c:\jdpjd.exec:\jdpjd.exe230⤵PID:4260
-
\??\c:\fxxrxll.exec:\fxxrxll.exe231⤵PID:4324
-
\??\c:\lrffrxl.exec:\lrffrxl.exe232⤵PID:4380
-
\??\c:\thnnnn.exec:\thnnnn.exe233⤵PID:5036
-
\??\c:\5pvpj.exec:\5pvpj.exe234⤵PID:3856
-
\??\c:\llllxrx.exec:\llllxrx.exe235⤵PID:2388
-
\??\c:\lrxrllf.exec:\lrxrllf.exe236⤵PID:1000
-
\??\c:\5nnhbb.exec:\5nnhbb.exe237⤵PID:3952
-
\??\c:\ddvpp.exec:\ddvpp.exe238⤵PID:2852
-
\??\c:\pjjdd.exec:\pjjdd.exe239⤵PID:4104
-
\??\c:\lflfrrl.exec:\lflfrrl.exe240⤵PID:2988
-
\??\c:\nhnnhh.exec:\nhnnhh.exe241⤵PID:4424
-
\??\c:\5bnthn.exec:\5bnthn.exe242⤵PID:3696