Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 18:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28190e947371b4d5b0dfc7b9a940b450_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
28190e947371b4d5b0dfc7b9a940b450_NeikiAnalytics.exe
-
Size
67KB
-
MD5
28190e947371b4d5b0dfc7b9a940b450
-
SHA1
3e8e784d64d9feeec15a2886fe0f471a500fd640
-
SHA256
69edf348ae7d0252801019b857788cd210460b5df2b496f03f672cfbd4d84cb6
-
SHA512
30eeb398954c2797a3650eb7c311f8b5aad073ae43f5dff99e045b3bdbed5be27115ecc6e9a550feed1fa04a21d50ea6f51d4c4b57dba2cddd248634c7808371
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfsIQ7:ymb3NkkiQ3mdBjFI4VAIQ7
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/3420-6-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1228-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/520-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3760-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5jppp.exefxrxxff.exefxfllxr.exennnhnb.exedjddj.exejdddj.exefflfxff.exelxlffxx.exehtttnn.exevppjd.exejdddd.exefxfxxrx.exennntbh.exepjvvd.exellflffr.exetttnnn.exevvjjp.exerfxxfff.exe5nttnn.exebnnbtn.exeppddv.exefxlxfxr.exenhnbtt.exedvvjj.exedvdvv.exe7fxrxrf.exe1tbnhh.exe1ddvd.exe3pvpj.exe7fflxxx.exenhhtbt.exe7nnhbb.exejdjjj.exexxlllll.exexlrxrrx.exe9bhbbb.exebhtnnn.exedvjjv.exelrrllrr.exerlfxrrl.exe7hnnbb.exennbbtt.exepppdv.exe3lrlxfx.exe1xffffx.exetntnnn.exebbbthh.exepjjdd.exe5lrflfl.exehbhbtt.exevpjdv.exe5vdpj.exelfxrfxr.exenbtnhb.exebnnbhb.exepvvvp.exellfxlfr.exelllrlxl.exehnbhbb.exejdjvj.exexrxxrxr.exe1xfffxx.exebbbbtt.exebtbhhh.exepid process 1228 5jppp.exe 3204 fxrxxff.exe 2732 fxfllxr.exe 224 nnnhnb.exe 3916 djddj.exe 3404 jdddj.exe 4524 fflfxff.exe 2052 lxlffxx.exe 4528 htttnn.exe 3972 vppjd.exe 1904 jdddd.exe 4940 fxfxxrx.exe 2292 nnntbh.exe 4724 pjvvd.exe 440 llflffr.exe 1136 tttnnn.exe 520 vvjjp.exe 3296 rfxxfff.exe 2592 5nttnn.exe 4100 bnnbtn.exe 3760 ppddv.exe 884 fxlxfxr.exe 1820 nhnbtt.exe 4552 dvvjj.exe 536 dvdvv.exe 1316 7fxrxrf.exe 3208 1tbnhh.exe 2136 1ddvd.exe 3900 3pvpj.exe 4704 7fflxxx.exe 5024 nhhtbt.exe 5084 7nnhbb.exe 2708 jdjjj.exe 1832 xxlllll.exe 1032 xlrxrrx.exe 1896 9bhbbb.exe 1588 bhtnnn.exe 1216 dvjjv.exe 4312 lrrllrr.exe 2700 rlfxrrl.exe 3492 7hnnbb.exe 4224 nnbbtt.exe 4388 pppdv.exe 3624 3lrlxfx.exe 3764 1xffffx.exe 4680 tntnnn.exe 4720 bbbthh.exe 2184 pjjdd.exe 4524 5lrflfl.exe 2716 hbhbtt.exe 3520 vpjdv.exe 1160 5vdpj.exe 2624 lfxrfxr.exe 3068 nbtnhb.exe 2276 bnnbhb.exe 1220 pvvvp.exe 4800 llfxlfr.exe 4484 lllrlxl.exe 4684 hnbhbb.exe 3636 jdjvj.exe 460 xrxxrxr.exe 4900 1xfffxx.exe 1456 bbbbtt.exe 3064 btbhhh.exe -
Processes:
resource yara_rule behavioral2/memory/3916-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1228-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/520-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3760-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
28190e947371b4d5b0dfc7b9a940b450_NeikiAnalytics.exe5jppp.exefxrxxff.exefxfllxr.exennnhnb.exedjddj.exejdddj.exefflfxff.exelxlffxx.exehtttnn.exevppjd.exejdddd.exefxfxxrx.exennntbh.exepjvvd.exellflffr.exetttnnn.exevvjjp.exerfxxfff.exe5nttnn.exebnnbtn.exeppddv.exedescription pid process target process PID 3420 wrote to memory of 1228 3420 28190e947371b4d5b0dfc7b9a940b450_NeikiAnalytics.exe 5jppp.exe PID 3420 wrote to memory of 1228 3420 28190e947371b4d5b0dfc7b9a940b450_NeikiAnalytics.exe 5jppp.exe PID 3420 wrote to memory of 1228 3420 28190e947371b4d5b0dfc7b9a940b450_NeikiAnalytics.exe 5jppp.exe PID 1228 wrote to memory of 3204 1228 5jppp.exe fxrxxff.exe PID 1228 wrote to memory of 3204 1228 5jppp.exe fxrxxff.exe PID 1228 wrote to memory of 3204 1228 5jppp.exe fxrxxff.exe PID 3204 wrote to memory of 2732 3204 fxrxxff.exe fxfllxr.exe PID 3204 wrote to memory of 2732 3204 fxrxxff.exe fxfllxr.exe PID 3204 wrote to memory of 2732 3204 fxrxxff.exe fxfllxr.exe PID 2732 wrote to memory of 224 2732 fxfllxr.exe nnnhnb.exe PID 2732 wrote to memory of 224 2732 fxfllxr.exe nnnhnb.exe PID 2732 wrote to memory of 224 2732 fxfllxr.exe nnnhnb.exe PID 224 wrote to memory of 3916 224 nnnhnb.exe djddj.exe PID 224 wrote to memory of 3916 224 nnnhnb.exe djddj.exe PID 224 wrote to memory of 3916 224 nnnhnb.exe djddj.exe PID 3916 wrote to memory of 3404 3916 djddj.exe jdddj.exe PID 3916 wrote to memory of 3404 3916 djddj.exe jdddj.exe PID 3916 wrote to memory of 3404 3916 djddj.exe jdddj.exe PID 3404 wrote to memory of 4524 3404 jdddj.exe fflfxff.exe PID 3404 wrote to memory of 4524 3404 jdddj.exe fflfxff.exe PID 3404 wrote to memory of 4524 3404 jdddj.exe fflfxff.exe PID 4524 wrote to memory of 2052 4524 fflfxff.exe lxlffxx.exe PID 4524 wrote to memory of 2052 4524 fflfxff.exe lxlffxx.exe PID 4524 wrote to memory of 2052 4524 fflfxff.exe lxlffxx.exe PID 2052 wrote to memory of 4528 2052 lxlffxx.exe htttnn.exe PID 2052 wrote to memory of 4528 2052 lxlffxx.exe htttnn.exe PID 2052 wrote to memory of 4528 2052 lxlffxx.exe htttnn.exe PID 4528 wrote to memory of 3972 4528 htttnn.exe vppjd.exe PID 4528 wrote to memory of 3972 4528 htttnn.exe vppjd.exe PID 4528 wrote to memory of 3972 4528 htttnn.exe vppjd.exe PID 3972 wrote to memory of 1904 3972 vppjd.exe jdddd.exe PID 3972 wrote to memory of 1904 3972 vppjd.exe jdddd.exe PID 3972 wrote to memory of 1904 3972 vppjd.exe jdddd.exe PID 1904 wrote to memory of 4940 1904 jdddd.exe fxfxxrx.exe PID 1904 wrote to memory of 4940 1904 jdddd.exe fxfxxrx.exe PID 1904 wrote to memory of 4940 1904 jdddd.exe fxfxxrx.exe PID 4940 wrote to memory of 2292 4940 fxfxxrx.exe nnntbh.exe PID 4940 wrote to memory of 2292 4940 fxfxxrx.exe nnntbh.exe PID 4940 wrote to memory of 2292 4940 fxfxxrx.exe nnntbh.exe PID 2292 wrote to memory of 4724 2292 nnntbh.exe pjvvd.exe PID 2292 wrote to memory of 4724 2292 nnntbh.exe pjvvd.exe PID 2292 wrote to memory of 4724 2292 nnntbh.exe pjvvd.exe PID 4724 wrote to memory of 440 4724 pjvvd.exe llflffr.exe PID 4724 wrote to memory of 440 4724 pjvvd.exe llflffr.exe PID 4724 wrote to memory of 440 4724 pjvvd.exe llflffr.exe PID 440 wrote to memory of 1136 440 llflffr.exe tttnnn.exe PID 440 wrote to memory of 1136 440 llflffr.exe tttnnn.exe PID 440 wrote to memory of 1136 440 llflffr.exe tttnnn.exe PID 1136 wrote to memory of 520 1136 tttnnn.exe vvjjp.exe PID 1136 wrote to memory of 520 1136 tttnnn.exe vvjjp.exe PID 1136 wrote to memory of 520 1136 tttnnn.exe vvjjp.exe PID 520 wrote to memory of 3296 520 vvjjp.exe rfxxfff.exe PID 520 wrote to memory of 3296 520 vvjjp.exe rfxxfff.exe PID 520 wrote to memory of 3296 520 vvjjp.exe rfxxfff.exe PID 3296 wrote to memory of 2592 3296 rfxxfff.exe 5nttnn.exe PID 3296 wrote to memory of 2592 3296 rfxxfff.exe 5nttnn.exe PID 3296 wrote to memory of 2592 3296 rfxxfff.exe 5nttnn.exe PID 2592 wrote to memory of 4100 2592 5nttnn.exe bnnbtn.exe PID 2592 wrote to memory of 4100 2592 5nttnn.exe bnnbtn.exe PID 2592 wrote to memory of 4100 2592 5nttnn.exe bnnbtn.exe PID 4100 wrote to memory of 3760 4100 bnnbtn.exe ppddv.exe PID 4100 wrote to memory of 3760 4100 bnnbtn.exe ppddv.exe PID 4100 wrote to memory of 3760 4100 bnnbtn.exe ppddv.exe PID 3760 wrote to memory of 884 3760 ppddv.exe fxlxfxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28190e947371b4d5b0dfc7b9a940b450_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\28190e947371b4d5b0dfc7b9a940b450_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\5jppp.exec:\5jppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\fxrxxff.exec:\fxrxxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\fxfllxr.exec:\fxfllxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nnnhnb.exec:\nnnhnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\djddj.exec:\djddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\jdddj.exec:\jdddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\fflfxff.exec:\fflfxff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\lxlffxx.exec:\lxlffxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\htttnn.exec:\htttnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\vppjd.exec:\vppjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\jdddd.exec:\jdddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\fxfxxrx.exec:\fxfxxrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\nnntbh.exec:\nnntbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\pjvvd.exec:\pjvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\llflffr.exec:\llflffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\tttnnn.exec:\tttnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\vvjjp.exec:\vvjjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
\??\c:\rfxxfff.exec:\rfxxfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\5nttnn.exec:\5nttnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\bnnbtn.exec:\bnnbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\ppddv.exec:\ppddv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\fxlxfxr.exec:\fxlxfxr.exe23⤵
- Executes dropped EXE
PID:884 -
\??\c:\nhnbtt.exec:\nhnbtt.exe24⤵
- Executes dropped EXE
PID:1820 -
\??\c:\dvvjj.exec:\dvvjj.exe25⤵
- Executes dropped EXE
PID:4552 -
\??\c:\dvdvv.exec:\dvdvv.exe26⤵
- Executes dropped EXE
PID:536 -
\??\c:\7fxrxrf.exec:\7fxrxrf.exe27⤵
- Executes dropped EXE
PID:1316 -
\??\c:\1tbnhh.exec:\1tbnhh.exe28⤵
- Executes dropped EXE
PID:3208 -
\??\c:\1ddvd.exec:\1ddvd.exe29⤵
- Executes dropped EXE
PID:2136 -
\??\c:\3pvpj.exec:\3pvpj.exe30⤵
- Executes dropped EXE
PID:3900 -
\??\c:\7fflxxx.exec:\7fflxxx.exe31⤵
- Executes dropped EXE
PID:4704 -
\??\c:\nhhtbt.exec:\nhhtbt.exe32⤵
- Executes dropped EXE
PID:5024 -
\??\c:\7nnhbb.exec:\7nnhbb.exe33⤵
- Executes dropped EXE
PID:5084 -
\??\c:\jdjjj.exec:\jdjjj.exe34⤵
- Executes dropped EXE
PID:2708 -
\??\c:\xxlllll.exec:\xxlllll.exe35⤵
- Executes dropped EXE
PID:1832 -
\??\c:\xlrxrrx.exec:\xlrxrrx.exe36⤵
- Executes dropped EXE
PID:1032 -
\??\c:\9bhbbb.exec:\9bhbbb.exe37⤵
- Executes dropped EXE
PID:1896 -
\??\c:\bhtnnn.exec:\bhtnnn.exe38⤵
- Executes dropped EXE
PID:1588 -
\??\c:\dvjjv.exec:\dvjjv.exe39⤵
- Executes dropped EXE
PID:1216 -
\??\c:\lrrllrr.exec:\lrrllrr.exe40⤵
- Executes dropped EXE
PID:4312 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe41⤵
- Executes dropped EXE
PID:2700 -
\??\c:\7hnnbb.exec:\7hnnbb.exe42⤵
- Executes dropped EXE
PID:3492 -
\??\c:\nnbbtt.exec:\nnbbtt.exe43⤵
- Executes dropped EXE
PID:4224 -
\??\c:\pppdv.exec:\pppdv.exe44⤵
- Executes dropped EXE
PID:4388 -
\??\c:\3lrlxfx.exec:\3lrlxfx.exe45⤵
- Executes dropped EXE
PID:3624 -
\??\c:\1xffffx.exec:\1xffffx.exe46⤵
- Executes dropped EXE
PID:3764 -
\??\c:\tntnnn.exec:\tntnnn.exe47⤵
- Executes dropped EXE
PID:4680 -
\??\c:\bbbthh.exec:\bbbthh.exe48⤵
- Executes dropped EXE
PID:4720 -
\??\c:\pjjdd.exec:\pjjdd.exe49⤵
- Executes dropped EXE
PID:2184 -
\??\c:\5lrflfl.exec:\5lrflfl.exe50⤵
- Executes dropped EXE
PID:4524 -
\??\c:\hbhbtt.exec:\hbhbtt.exe51⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vpjdv.exec:\vpjdv.exe52⤵
- Executes dropped EXE
PID:3520 -
\??\c:\5vdpj.exec:\5vdpj.exe53⤵
- Executes dropped EXE
PID:1160 -
\??\c:\lfxrfxr.exec:\lfxrfxr.exe54⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nbtnhb.exec:\nbtnhb.exe55⤵
- Executes dropped EXE
PID:3068 -
\??\c:\bnnbhb.exec:\bnnbhb.exe56⤵
- Executes dropped EXE
PID:2276 -
\??\c:\pvvvp.exec:\pvvvp.exe57⤵
- Executes dropped EXE
PID:1220 -
\??\c:\llfxlfr.exec:\llfxlfr.exe58⤵
- Executes dropped EXE
PID:4800 -
\??\c:\lllrlxl.exec:\lllrlxl.exe59⤵
- Executes dropped EXE
PID:4484 -
\??\c:\hnbhbb.exec:\hnbhbb.exe60⤵
- Executes dropped EXE
PID:4684 -
\??\c:\jdjvj.exec:\jdjvj.exe61⤵
- Executes dropped EXE
PID:3636 -
\??\c:\xrxxrxr.exec:\xrxxrxr.exe62⤵
- Executes dropped EXE
PID:460 -
\??\c:\1xfffxx.exec:\1xfffxx.exe63⤵
- Executes dropped EXE
PID:4900 -
\??\c:\bbbbtt.exec:\bbbbtt.exe64⤵
- Executes dropped EXE
PID:1456 -
\??\c:\btbhhh.exec:\btbhhh.exe65⤵
- Executes dropped EXE
PID:3064 -
\??\c:\dpvdj.exec:\dpvdj.exe66⤵PID:3708
-
\??\c:\rlffllr.exec:\rlffllr.exe67⤵PID:4728
-
\??\c:\hhtnhh.exec:\hhtnhh.exe68⤵PID:1164
-
\??\c:\bbbbhh.exec:\bbbbhh.exe69⤵PID:3596
-
\??\c:\vdjdp.exec:\vdjdp.exe70⤵PID:536
-
\??\c:\btbtnn.exec:\btbtnn.exe71⤵PID:1316
-
\??\c:\nnttbb.exec:\nnttbb.exe72⤵PID:3208
-
\??\c:\1jjpd.exec:\1jjpd.exe73⤵PID:4932
-
\??\c:\flllffl.exec:\flllffl.exe74⤵PID:1376
-
\??\c:\ffllrrl.exec:\ffllrrl.exe75⤵PID:3900
-
\??\c:\nnhnnn.exec:\nnhnnn.exe76⤵PID:1824
-
\??\c:\vpvpp.exec:\vpvpp.exe77⤵PID:3172
-
\??\c:\3lrrxxl.exec:\3lrrxxl.exe78⤵PID:644
-
\??\c:\frxxlll.exec:\frxxlll.exe79⤵PID:3076
-
\??\c:\bnnbtn.exec:\bnnbtn.exe80⤵PID:4504
-
\??\c:\hhnntb.exec:\hhnntb.exe81⤵PID:3524
-
\??\c:\7jpjd.exec:\7jpjd.exe82⤵PID:1200
-
\??\c:\jdvvj.exec:\jdvvj.exe83⤵PID:4324
-
\??\c:\fxxxffx.exec:\fxxxffx.exe84⤵PID:4140
-
\??\c:\fffxrrl.exec:\fffxrrl.exe85⤵PID:4852
-
\??\c:\nnthtt.exec:\nnthtt.exe86⤵PID:1704
-
\??\c:\1vppj.exec:\1vppj.exe87⤵PID:4692
-
\??\c:\pdjjv.exec:\pdjjv.exe88⤵PID:4572
-
\??\c:\5frlxxf.exec:\5frlxxf.exe89⤵PID:3232
-
\??\c:\llllxrf.exec:\llllxrf.exe90⤵PID:2744
-
\??\c:\hhtttt.exec:\hhtttt.exe91⤵PID:1336
-
\??\c:\ppppj.exec:\ppppj.exe92⤵PID:3404
-
\??\c:\pjvvd.exec:\pjvvd.exe93⤵PID:1996
-
\??\c:\5flrllf.exec:\5flrllf.exe94⤵PID:808
-
\??\c:\5lxrrrl.exec:\5lxrrrl.exe95⤵PID:1472
-
\??\c:\bbhbbb.exec:\bbhbbb.exe96⤵PID:2924
-
\??\c:\7tttnh.exec:\7tttnh.exe97⤵PID:3972
-
\??\c:\dvjpv.exec:\dvjpv.exe98⤵PID:2764
-
\??\c:\xlxffll.exec:\xlxffll.exe99⤵PID:3376
-
\??\c:\xxxffff.exec:\xxxffff.exe100⤵PID:444
-
\??\c:\hbbtth.exec:\hbbtth.exe101⤵PID:4008
-
\??\c:\jdjjd.exec:\jdjjd.exe102⤵PID:4036
-
\??\c:\pvpjj.exec:\pvpjj.exe103⤵PID:2328
-
\??\c:\frfxrrr.exec:\frfxrrr.exe104⤵PID:4672
-
\??\c:\xxllffr.exec:\xxllffr.exe105⤵PID:2056
-
\??\c:\hhnhht.exec:\hhnhht.exe106⤵PID:1740
-
\??\c:\hnhbbn.exec:\hnhbbn.exe107⤵PID:3648
-
\??\c:\bhthhb.exec:\bhthhb.exe108⤵PID:3888
-
\??\c:\vpppj.exec:\vpppj.exe109⤵PID:1180
-
\??\c:\xrllrlx.exec:\xrllrlx.exe110⤵PID:4516
-
\??\c:\5llrrrr.exec:\5llrrrr.exe111⤵PID:1720
-
\??\c:\hbbbbb.exec:\hbbbbb.exe112⤵PID:3708
-
\??\c:\htbtbt.exec:\htbtbt.exe113⤵PID:4728
-
\??\c:\jjvdj.exec:\jjvdj.exe114⤵PID:5112
-
\??\c:\flxfxxf.exec:\flxfxxf.exe115⤵PID:4752
-
\??\c:\fxxfffx.exec:\fxxfffx.exe116⤵PID:1892
-
\??\c:\hthbbh.exec:\hthbbh.exe117⤵PID:2136
-
\??\c:\tthnbh.exec:\tthnbh.exe118⤵PID:2704
-
\??\c:\pppjd.exec:\pppjd.exe119⤵PID:1376
-
\??\c:\llffxxr.exec:\llffxxr.exe120⤵PID:4116
-
\??\c:\fxffllx.exec:\fxffllx.exe121⤵PID:2156
-
\??\c:\hbhhht.exec:\hbhhht.exe122⤵PID:2884
-
\??\c:\hhbbtt.exec:\hhbbtt.exe123⤵PID:4676
-
\??\c:\ddpjd.exec:\ddpjd.exe124⤵PID:1600
-
\??\c:\jvjdd.exec:\jvjdd.exe125⤵PID:4248
-
\??\c:\ntttnt.exec:\ntttnt.exe126⤵PID:1944
-
\??\c:\vpddv.exec:\vpddv.exe127⤵PID:1704
-
\??\c:\pjpjd.exec:\pjpjd.exe128⤵PID:5048
-
\??\c:\3fxfllx.exec:\3fxfllx.exe129⤵PID:4572
-
\??\c:\1lxrlxr.exec:\1lxrlxr.exe130⤵PID:2888
-
\??\c:\7bhhht.exec:\7bhhht.exe131⤵PID:2224
-
\??\c:\dpvpj.exec:\dpvpj.exe132⤵PID:3604
-
\??\c:\jdjdj.exec:\jdjdj.exe133⤵PID:980
-
\??\c:\flrrfxr.exec:\flrrfxr.exe134⤵PID:1300
-
\??\c:\bhnhhh.exec:\bhnhhh.exe135⤵PID:3380
-
\??\c:\dvpjp.exec:\dvpjp.exe136⤵PID:2712
-
\??\c:\flllflr.exec:\flllflr.exe137⤵PID:4844
-
\??\c:\1rxxflr.exec:\1rxxflr.exe138⤵PID:1160
-
\??\c:\9thhtb.exec:\9thhtb.exe139⤵PID:1252
-
\??\c:\vpjdd.exec:\vpjdd.exe140⤵PID:4004
-
\??\c:\jddjj.exec:\jddjj.exe141⤵PID:3304
-
\??\c:\ppjjd.exec:\ppjjd.exe142⤵PID:2064
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe143⤵PID:560
-
\??\c:\hbhbbb.exec:\hbhbbb.exe144⤵PID:520
-
\??\c:\vjdvp.exec:\vjdvp.exe145⤵PID:4188
-
\??\c:\7lflrfl.exec:\7lflrfl.exe146⤵PID:872
-
\??\c:\7fxrxxr.exec:\7fxrxxr.exe147⤵PID:2756
-
\??\c:\bhhhbt.exec:\bhhhbt.exe148⤵PID:3680
-
\??\c:\djjpj.exec:\djjpj.exe149⤵PID:3760
-
\??\c:\jdjvp.exec:\jdjvp.exe150⤵PID:5088
-
\??\c:\rrlfrxr.exec:\rrlfrxr.exe151⤵PID:1820
-
\??\c:\dvjjj.exec:\dvjjj.exe152⤵PID:3964
-
\??\c:\bbbnhh.exec:\bbbnhh.exe153⤵PID:1812
-
\??\c:\hhnhbb.exec:\hhnhbb.exe154⤵PID:780
-
\??\c:\pvvpv.exec:\pvvpv.exe155⤵PID:5064
-
\??\c:\fflfflf.exec:\fflfflf.exe156⤵PID:3208
-
\??\c:\rrrlxll.exec:\rrrlxll.exe157⤵PID:3652
-
\??\c:\hnhbbn.exec:\hnhbbn.exe158⤵PID:4404
-
\??\c:\jjvpp.exec:\jjvpp.exe159⤵PID:2728
-
\??\c:\jdjjp.exec:\jdjjp.exe160⤵PID:2708
-
\??\c:\nhnnnn.exec:\nhnnnn.exe161⤵PID:4856
-
\??\c:\5pddd.exec:\5pddd.exe162⤵PID:3116
-
\??\c:\jjjjv.exec:\jjjjv.exe163⤵PID:4296
-
\??\c:\xfflrfr.exec:\xfflrfr.exe164⤵PID:1932
-
\??\c:\7bhbnn.exec:\7bhbnn.exe165⤵PID:4248
-
\??\c:\tnbhnn.exec:\tnbhnn.exe166⤵PID:1620
-
\??\c:\jdddv.exec:\jdddv.exe167⤵PID:1480
-
\??\c:\jvjdv.exec:\jvjdv.exe168⤵PID:3924
-
\??\c:\fxrrfxl.exec:\fxrrfxl.exe169⤵PID:1992
-
\??\c:\tbbthb.exec:\tbbthb.exe170⤵PID:4108
-
\??\c:\vdjdv.exec:\vdjdv.exe171⤵PID:5108
-
\??\c:\jvvvp.exec:\jvvvp.exe172⤵PID:4524
-
\??\c:\xlrlllf.exec:\xlrlllf.exe173⤵PID:2832
-
\??\c:\7rxrlll.exec:\7rxrlll.exe174⤵PID:2688
-
\??\c:\nbhbtt.exec:\nbhbtt.exe175⤵PID:3380
-
\??\c:\pjjjd.exec:\pjjjd.exe176⤵PID:1904
-
\??\c:\9lrlrrf.exec:\9lrlrrf.exe177⤵PID:4844
-
\??\c:\ntnhhh.exec:\ntnhhh.exe178⤵PID:3068
-
\??\c:\dvjdv.exec:\dvjdv.exe179⤵PID:404
-
\??\c:\jppjv.exec:\jppjv.exe180⤵PID:1524
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe181⤵PID:1220
-
\??\c:\nbbnth.exec:\nbbnth.exe182⤵PID:4472
-
\??\c:\thtnnn.exec:\thtnnn.exe183⤵PID:4940
-
\??\c:\ddpjj.exec:\ddpjj.exe184⤵PID:1404
-
\??\c:\dvjjd.exec:\dvjjd.exe185⤵PID:3296
-
\??\c:\xlrllll.exec:\xlrllll.exe186⤵PID:2756
-
\??\c:\nhbtnh.exec:\nhbtnh.exe187⤵PID:3680
-
\??\c:\3btnbt.exec:\3btnbt.exe188⤵PID:2360
-
\??\c:\dvvjj.exec:\dvvjj.exe189⤵PID:5088
-
\??\c:\1xrrffx.exec:\1xrrffx.exe190⤵PID:1820
-
\??\c:\rfffxxr.exec:\rfffxxr.exe191⤵PID:3496
-
\??\c:\nhbbtn.exec:\nhbbtn.exe192⤵PID:1988
-
\??\c:\hnhnbh.exec:\hnhnbh.exe193⤵PID:628
-
\??\c:\5dvpd.exec:\5dvpd.exe194⤵PID:5000
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe195⤵PID:1848
-
\??\c:\bbhtnt.exec:\bbhtnt.exe196⤵PID:3856
-
\??\c:\lfxxxxr.exec:\lfxxxxr.exe197⤵PID:2728
-
\??\c:\hnbbnn.exec:\hnbbnn.exe198⤵PID:2708
-
\??\c:\ddpjp.exec:\ddpjp.exe199⤵PID:4856
-
\??\c:\tttnhh.exec:\tttnhh.exe200⤵PID:3524
-
\??\c:\jpvjj.exec:\jpvjj.exe201⤵PID:1188
-
\??\c:\nhhbbb.exec:\nhhbbb.exe202⤵PID:1944
-
\??\c:\pjdpd.exec:\pjdpd.exe203⤵PID:4224
-
\??\c:\1fllfff.exec:\1fllfff.exe204⤵PID:4840
-
\??\c:\flrxrxx.exec:\flrxrxx.exe205⤵PID:3916
-
\??\c:\bnbtnt.exec:\bnbtnt.exe206⤵PID:2224
-
\??\c:\jvjjj.exec:\jvjjj.exe207⤵PID:656
-
\??\c:\fxrrlll.exec:\fxrrlll.exe208⤵PID:2188
-
\??\c:\7xfffll.exec:\7xfffll.exe209⤵PID:2832
-
\??\c:\djvvp.exec:\djvvp.exe210⤵PID:2712
-
\??\c:\xlrlfll.exec:\xlrlfll.exe211⤵PID:2628
-
\??\c:\djjjj.exec:\djjjj.exe212⤵PID:1904
-
\??\c:\3thbhh.exec:\3thbhh.exe213⤵PID:1252
-
\??\c:\rllfrrr.exec:\rllfrrr.exe214⤵PID:2276
-
\??\c:\9tbtnn.exec:\9tbtnn.exe215⤵PID:4956
-
\??\c:\dvddd.exec:\dvddd.exe216⤵PID:4448
-
\??\c:\9pvjv.exec:\9pvjv.exe217⤵PID:420
-
\??\c:\xrrlfff.exec:\xrrlfff.exe218⤵PID:2416
-
\??\c:\lxflllf.exec:\lxflllf.exe219⤵PID:1020
-
\??\c:\1tbhbh.exec:\1tbhbh.exe220⤵PID:4736
-
\??\c:\dvdjd.exec:\dvdjd.exe221⤵PID:884
-
\??\c:\9pjdd.exec:\9pjdd.exe222⤵PID:4548
-
\??\c:\1lrlfxx.exec:\1lrlfxx.exe223⤵PID:2120
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe224⤵PID:2288
-
\??\c:\tbhnnt.exec:\tbhnnt.exe225⤵PID:4728
-
\??\c:\dpddd.exec:\dpddd.exe226⤵PID:1164
-
\??\c:\vdddv.exec:\vdddv.exe227⤵PID:1988
-
\??\c:\rfrfxrr.exec:\rfrfxrr.exe228⤵PID:3208
-
\??\c:\bbthtt.exec:\bbthtt.exe229⤵PID:3652
-
\??\c:\hhbtnh.exec:\hhbtnh.exe230⤵PID:1832
-
\??\c:\7pppp.exec:\7pppp.exe231⤵PID:2884
-
\??\c:\7lfrxxf.exec:\7lfrxxf.exe232⤵PID:2176
-
\??\c:\xlfrlxf.exec:\xlfrlxf.exe233⤵PID:1356
-
\??\c:\nhnntt.exec:\nhnntt.exe234⤵PID:3420
-
\??\c:\nhttbb.exec:\nhttbb.exe235⤵PID:4852
-
\??\c:\jpjdp.exec:\jpjdp.exe236⤵PID:4248
-
\??\c:\xxlxrxx.exec:\xxlxrxx.exe237⤵PID:1620
-
\??\c:\5xrlllf.exec:\5xrlllf.exe238⤵PID:2888
-
\??\c:\nhbbtt.exec:\nhbbtt.exe239⤵PID:2912
-
\??\c:\rflfrxr.exec:\rflfrxr.exe240⤵PID:808
-
\??\c:\ntthbt.exec:\ntthbt.exe241⤵PID:3372
-
\??\c:\7jjjd.exec:\7jjjd.exe242⤵PID:4120