Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 21:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
00f3bb2a1cb8c52766d4a8ccb13fd3e0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
00f3bb2a1cb8c52766d4a8ccb13fd3e0_NeikiAnalytics.exe
-
Size
104KB
-
MD5
00f3bb2a1cb8c52766d4a8ccb13fd3e0
-
SHA1
8ce46497761da9755a9a504f4deaa8963ac6669e
-
SHA256
c1a7161990678415c176e4164ffbebcdbb949fc9e77a708d841a60200e8ad5d0
-
SHA512
c83f9a484d7b3995e3dc2a35e493f16507e62d09ca278aadfe07fc77ef2f08c95d648deffb08c9f6c5303747f54d4591eb1794ba314f648dea601181d5c026d4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoTNKDeS98hPUdHV7RNzfJNc:ymb3NkkiQ3mdBjFo5KDe88g1fDc
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/3156-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/852-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jdpvv.exellffrxf.exe1xxrrff.exebtbhbn.exetnnntt.exepdjdv.exelxfxrlf.exethnnnn.exehbhhhh.exedjjdv.exe1lrrlrr.exehbnhnt.exeddjvp.exexrrxrrr.exerrxxxrf.exebbnnnt.exepdjdv.exe3fxxxxx.exehbhbbt.exepvvvp.exexrxrxxx.exe9fllrxf.exethnhnt.exejjppd.exefxfxxxr.exe5tbtbb.exehbbbhh.exe7xlfrrx.exe3rxrllf.exe5htnnn.exejjvvp.exexxffxxl.exetnhhnn.exevpvpj.exefrfxrrl.exenttnnh.exetnhhhh.exe9dvvp.exehhbttb.exe5vpvv.exepddvj.exe7lxrlrl.exebnnnnt.exetbhbbb.exejvddp.exe9jjdp.exellfxxxr.exexlfxrrl.exethbtnb.exebhhtnn.exe7pvvp.exedvvvp.exexrrlffx.exexlrfxxr.exebhnhnn.exebbnhhh.exepjddv.exedvddd.exeflrrllr.exebttntn.exenbnhbb.exeppjjd.exejdpjj.exelflfffl.exepid process 3024 jdpvv.exe 3476 llffrxf.exe 5040 1xxrrff.exe 3280 btbhbn.exe 4792 tnnntt.exe 4164 pdjdv.exe 852 lxfxrlf.exe 2528 thnnnn.exe 5044 hbhhhh.exe 2824 djjdv.exe 2568 1lrrlrr.exe 3836 hbnhnt.exe 1740 ddjvp.exe 5004 xrrxrrr.exe 2456 rrxxxrf.exe 4052 bbnnnt.exe 3140 pdjdv.exe 1964 3fxxxxx.exe 1796 hbhbbt.exe 4556 pvvvp.exe 4720 xrxrxxx.exe 2416 9fllrxf.exe 4884 thnhnt.exe 1504 jjppd.exe 4804 fxfxxxr.exe 2900 5tbtbb.exe 3216 hbbbhh.exe 4860 7xlfrrx.exe 4580 3rxrllf.exe 3692 5htnnn.exe 996 jjvvp.exe 1120 xxffxxl.exe 676 tnhhnn.exe 4432 vpvpj.exe 1424 frfxrrl.exe 3444 nttnnh.exe 4952 tnhhhh.exe 4424 9dvvp.exe 4340 hhbttb.exe 3360 5vpvv.exe 4304 pddvj.exe 2756 7lxrlrl.exe 4048 bnnnnt.exe 1096 tbhbbb.exe 2632 jvddp.exe 1364 9jjdp.exe 208 llfxxxr.exe 384 xlfxrrl.exe 2708 thbtnb.exe 1332 bhhtnn.exe 2028 7pvvp.exe 1360 dvvvp.exe 4084 xrrlffx.exe 3992 xlrfxxr.exe 3836 bhnhnn.exe 1720 bbnhhh.exe 1568 pjddv.exe 3572 dvddd.exe 4276 flrrllr.exe 4052 bttntn.exe 3708 nbnhbb.exe 5024 ppjjd.exe 1480 jdpjj.exe 2032 lflfffl.exe -
Processes:
resource yara_rule behavioral2/memory/3156-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/852-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-195-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
00f3bb2a1cb8c52766d4a8ccb13fd3e0_NeikiAnalytics.exejdpvv.exellffrxf.exe1xxrrff.exebtbhbn.exetnnntt.exepdjdv.exelxfxrlf.exethnnnn.exehbhhhh.exedjjdv.exe1lrrlrr.exehbnhnt.exeddjvp.exexrrxrrr.exerrxxxrf.exebbnnnt.exepdjdv.exe3fxxxxx.exehbhbbt.exepvvvp.exexrxrxxx.exedescription pid process target process PID 3156 wrote to memory of 3024 3156 00f3bb2a1cb8c52766d4a8ccb13fd3e0_NeikiAnalytics.exe jdpvv.exe PID 3156 wrote to memory of 3024 3156 00f3bb2a1cb8c52766d4a8ccb13fd3e0_NeikiAnalytics.exe jdpvv.exe PID 3156 wrote to memory of 3024 3156 00f3bb2a1cb8c52766d4a8ccb13fd3e0_NeikiAnalytics.exe jdpvv.exe PID 3024 wrote to memory of 3476 3024 jdpvv.exe llffrxf.exe PID 3024 wrote to memory of 3476 3024 jdpvv.exe llffrxf.exe PID 3024 wrote to memory of 3476 3024 jdpvv.exe llffrxf.exe PID 3476 wrote to memory of 5040 3476 llffrxf.exe 1xxrrff.exe PID 3476 wrote to memory of 5040 3476 llffrxf.exe 1xxrrff.exe PID 3476 wrote to memory of 5040 3476 llffrxf.exe 1xxrrff.exe PID 5040 wrote to memory of 3280 5040 1xxrrff.exe btbhbn.exe PID 5040 wrote to memory of 3280 5040 1xxrrff.exe btbhbn.exe PID 5040 wrote to memory of 3280 5040 1xxrrff.exe btbhbn.exe PID 3280 wrote to memory of 4792 3280 btbhbn.exe tnnntt.exe PID 3280 wrote to memory of 4792 3280 btbhbn.exe tnnntt.exe PID 3280 wrote to memory of 4792 3280 btbhbn.exe tnnntt.exe PID 4792 wrote to memory of 4164 4792 tnnntt.exe pdjdv.exe PID 4792 wrote to memory of 4164 4792 tnnntt.exe pdjdv.exe PID 4792 wrote to memory of 4164 4792 tnnntt.exe pdjdv.exe PID 4164 wrote to memory of 852 4164 pdjdv.exe lxfxrlf.exe PID 4164 wrote to memory of 852 4164 pdjdv.exe lxfxrlf.exe PID 4164 wrote to memory of 852 4164 pdjdv.exe lxfxrlf.exe PID 852 wrote to memory of 2528 852 lxfxrlf.exe thnnnn.exe PID 852 wrote to memory of 2528 852 lxfxrlf.exe thnnnn.exe PID 852 wrote to memory of 2528 852 lxfxrlf.exe thnnnn.exe PID 2528 wrote to memory of 5044 2528 thnnnn.exe hbhhhh.exe PID 2528 wrote to memory of 5044 2528 thnnnn.exe hbhhhh.exe PID 2528 wrote to memory of 5044 2528 thnnnn.exe hbhhhh.exe PID 5044 wrote to memory of 2824 5044 hbhhhh.exe djjdv.exe PID 5044 wrote to memory of 2824 5044 hbhhhh.exe djjdv.exe PID 5044 wrote to memory of 2824 5044 hbhhhh.exe djjdv.exe PID 2824 wrote to memory of 2568 2824 djjdv.exe 1lrrlrr.exe PID 2824 wrote to memory of 2568 2824 djjdv.exe 1lrrlrr.exe PID 2824 wrote to memory of 2568 2824 djjdv.exe 1lrrlrr.exe PID 2568 wrote to memory of 3836 2568 1lrrlrr.exe hbnhnt.exe PID 2568 wrote to memory of 3836 2568 1lrrlrr.exe hbnhnt.exe PID 2568 wrote to memory of 3836 2568 1lrrlrr.exe hbnhnt.exe PID 3836 wrote to memory of 1740 3836 hbnhnt.exe ddjvp.exe PID 3836 wrote to memory of 1740 3836 hbnhnt.exe ddjvp.exe PID 3836 wrote to memory of 1740 3836 hbnhnt.exe ddjvp.exe PID 1740 wrote to memory of 5004 1740 ddjvp.exe xrrxrrr.exe PID 1740 wrote to memory of 5004 1740 ddjvp.exe xrrxrrr.exe PID 1740 wrote to memory of 5004 1740 ddjvp.exe xrrxrrr.exe PID 5004 wrote to memory of 2456 5004 xrrxrrr.exe rrxxxrf.exe PID 5004 wrote to memory of 2456 5004 xrrxrrr.exe rrxxxrf.exe PID 5004 wrote to memory of 2456 5004 xrrxrrr.exe rrxxxrf.exe PID 2456 wrote to memory of 4052 2456 rrxxxrf.exe bbnnnt.exe PID 2456 wrote to memory of 4052 2456 rrxxxrf.exe bbnnnt.exe PID 2456 wrote to memory of 4052 2456 rrxxxrf.exe bbnnnt.exe PID 4052 wrote to memory of 3140 4052 bbnnnt.exe pdjdv.exe PID 4052 wrote to memory of 3140 4052 bbnnnt.exe pdjdv.exe PID 4052 wrote to memory of 3140 4052 bbnnnt.exe pdjdv.exe PID 3140 wrote to memory of 1964 3140 pdjdv.exe 3fxxxxx.exe PID 3140 wrote to memory of 1964 3140 pdjdv.exe 3fxxxxx.exe PID 3140 wrote to memory of 1964 3140 pdjdv.exe 3fxxxxx.exe PID 1964 wrote to memory of 1796 1964 3fxxxxx.exe hbhbbt.exe PID 1964 wrote to memory of 1796 1964 3fxxxxx.exe hbhbbt.exe PID 1964 wrote to memory of 1796 1964 3fxxxxx.exe hbhbbt.exe PID 1796 wrote to memory of 4556 1796 hbhbbt.exe pvvvp.exe PID 1796 wrote to memory of 4556 1796 hbhbbt.exe pvvvp.exe PID 1796 wrote to memory of 4556 1796 hbhbbt.exe pvvvp.exe PID 4556 wrote to memory of 4720 4556 pvvvp.exe xrxrxxx.exe PID 4556 wrote to memory of 4720 4556 pvvvp.exe xrxrxxx.exe PID 4556 wrote to memory of 4720 4556 pvvvp.exe xrxrxxx.exe PID 4720 wrote to memory of 2416 4720 xrxrxxx.exe 9fllrxf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00f3bb2a1cb8c52766d4a8ccb13fd3e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\00f3bb2a1cb8c52766d4a8ccb13fd3e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\jdpvv.exec:\jdpvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\llffrxf.exec:\llffrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\1xxrrff.exec:\1xxrrff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\btbhbn.exec:\btbhbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\tnnntt.exec:\tnnntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\pdjdv.exec:\pdjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\thnnnn.exec:\thnnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\hbhhhh.exec:\hbhhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\djjdv.exec:\djjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\1lrrlrr.exec:\1lrrlrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\hbnhnt.exec:\hbnhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\ddjvp.exec:\ddjvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\xrrxrrr.exec:\xrrxrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\rrxxxrf.exec:\rrxxxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\bbnnnt.exec:\bbnnnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\pdjdv.exec:\pdjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\3fxxxxx.exec:\3fxxxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\hbhbbt.exec:\hbhbbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\pvvvp.exec:\pvvvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\xrxrxxx.exec:\xrxrxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\9fllrxf.exec:\9fllrxf.exe23⤵
- Executes dropped EXE
PID:2416 -
\??\c:\thnhnt.exec:\thnhnt.exe24⤵
- Executes dropped EXE
PID:4884 -
\??\c:\jjppd.exec:\jjppd.exe25⤵
- Executes dropped EXE
PID:1504 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe26⤵
- Executes dropped EXE
PID:4804 -
\??\c:\5tbtbb.exec:\5tbtbb.exe27⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hbbbhh.exec:\hbbbhh.exe28⤵
- Executes dropped EXE
PID:3216 -
\??\c:\7xlfrrx.exec:\7xlfrrx.exe29⤵
- Executes dropped EXE
PID:4860 -
\??\c:\3rxrllf.exec:\3rxrllf.exe30⤵
- Executes dropped EXE
PID:4580 -
\??\c:\5htnnn.exec:\5htnnn.exe31⤵
- Executes dropped EXE
PID:3692 -
\??\c:\jjvvp.exec:\jjvvp.exe32⤵
- Executes dropped EXE
PID:996 -
\??\c:\xxffxxl.exec:\xxffxxl.exe33⤵
- Executes dropped EXE
PID:1120 -
\??\c:\tnhhnn.exec:\tnhhnn.exe34⤵
- Executes dropped EXE
PID:676 -
\??\c:\vpvpj.exec:\vpvpj.exe35⤵
- Executes dropped EXE
PID:4432 -
\??\c:\frfxrrl.exec:\frfxrrl.exe36⤵
- Executes dropped EXE
PID:1424 -
\??\c:\nttnnh.exec:\nttnnh.exe37⤵
- Executes dropped EXE
PID:3444 -
\??\c:\tnhhhh.exec:\tnhhhh.exe38⤵
- Executes dropped EXE
PID:4952 -
\??\c:\9dvvp.exec:\9dvvp.exe39⤵
- Executes dropped EXE
PID:4424 -
\??\c:\hhbttb.exec:\hhbttb.exe40⤵
- Executes dropped EXE
PID:4340 -
\??\c:\5vpvv.exec:\5vpvv.exe41⤵
- Executes dropped EXE
PID:3360 -
\??\c:\pddvj.exec:\pddvj.exe42⤵
- Executes dropped EXE
PID:4304 -
\??\c:\7lxrlrl.exec:\7lxrlrl.exe43⤵
- Executes dropped EXE
PID:2756 -
\??\c:\bnnnnt.exec:\bnnnnt.exe44⤵
- Executes dropped EXE
PID:4048 -
\??\c:\tbhbbb.exec:\tbhbbb.exe45⤵
- Executes dropped EXE
PID:1096 -
\??\c:\jvddp.exec:\jvddp.exe46⤵
- Executes dropped EXE
PID:2632 -
\??\c:\9jjdp.exec:\9jjdp.exe47⤵
- Executes dropped EXE
PID:1364 -
\??\c:\llfxxxr.exec:\llfxxxr.exe48⤵
- Executes dropped EXE
PID:208 -
\??\c:\xlfxrrl.exec:\xlfxrrl.exe49⤵
- Executes dropped EXE
PID:384 -
\??\c:\thbtnb.exec:\thbtnb.exe50⤵
- Executes dropped EXE
PID:2708 -
\??\c:\bhhtnn.exec:\bhhtnn.exe51⤵
- Executes dropped EXE
PID:1332 -
\??\c:\7pvvp.exec:\7pvvp.exe52⤵
- Executes dropped EXE
PID:2028 -
\??\c:\dvvvp.exec:\dvvvp.exe53⤵
- Executes dropped EXE
PID:1360 -
\??\c:\xrrlffx.exec:\xrrlffx.exe54⤵
- Executes dropped EXE
PID:4084 -
\??\c:\xlrfxxr.exec:\xlrfxxr.exe55⤵
- Executes dropped EXE
PID:3992 -
\??\c:\bhnhnn.exec:\bhnhnn.exe56⤵
- Executes dropped EXE
PID:3836 -
\??\c:\bbnhhh.exec:\bbnhhh.exe57⤵
- Executes dropped EXE
PID:1720 -
\??\c:\pjddv.exec:\pjddv.exe58⤵
- Executes dropped EXE
PID:1568 -
\??\c:\dvddd.exec:\dvddd.exe59⤵
- Executes dropped EXE
PID:3572 -
\??\c:\flrrllr.exec:\flrrllr.exe60⤵
- Executes dropped EXE
PID:4276 -
\??\c:\bttntn.exec:\bttntn.exe61⤵
- Executes dropped EXE
PID:4052 -
\??\c:\nbnhbb.exec:\nbnhbb.exe62⤵
- Executes dropped EXE
PID:3708 -
\??\c:\ppjjd.exec:\ppjjd.exe63⤵
- Executes dropped EXE
PID:5024 -
\??\c:\jdpjj.exec:\jdpjj.exe64⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lflfffl.exec:\lflfffl.exe65⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rxfllfx.exec:\rxfllfx.exe66⤵PID:1796
-
\??\c:\thnnnh.exec:\thnnnh.exe67⤵PID:3824
-
\??\c:\nhnhnh.exec:\nhnhnh.exe68⤵PID:3208
-
\??\c:\3jpvj.exec:\3jpvj.exe69⤵PID:376
-
\??\c:\jdjpv.exec:\jdjpv.exe70⤵PID:1748
-
\??\c:\1flfrrr.exec:\1flfrrr.exe71⤵PID:4852
-
\??\c:\tnnnnh.exec:\tnnnnh.exe72⤵PID:1156
-
\??\c:\9bbnbh.exec:\9bbnbh.exe73⤵PID:4136
-
\??\c:\vjvvp.exec:\vjvvp.exe74⤵PID:4216
-
\??\c:\vppdd.exec:\vppdd.exe75⤵PID:2256
-
\??\c:\rfllflf.exec:\rfllflf.exe76⤵PID:2728
-
\??\c:\5xrxllr.exec:\5xrxllr.exe77⤵PID:3968
-
\??\c:\tbbbtt.exec:\tbbbtt.exe78⤵PID:1536
-
\??\c:\fllffxx.exec:\fllffxx.exe79⤵PID:4580
-
\??\c:\xxllrrf.exec:\xxllrrf.exe80⤵PID:436
-
\??\c:\htttnn.exec:\htttnn.exe81⤵PID:2508
-
\??\c:\hhhhbb.exec:\hhhhbb.exe82⤵PID:3716
-
\??\c:\vddvv.exec:\vddvv.exe83⤵PID:2916
-
\??\c:\dpjpv.exec:\dpjpv.exe84⤵PID:2552
-
\??\c:\rrxrrrl.exec:\rrxrrrl.exe85⤵PID:3472
-
\??\c:\nbnhhh.exec:\nbnhhh.exe86⤵PID:4648
-
\??\c:\bhbtnn.exec:\bhbtnn.exe87⤵PID:964
-
\??\c:\pvjvp.exec:\pvjvp.exe88⤵PID:1684
-
\??\c:\vpjjv.exec:\vpjjv.exe89⤵PID:1916
-
\??\c:\frxrlxx.exec:\frxrlxx.exe90⤵PID:1252
-
\??\c:\lfrllfl.exec:\lfrllfl.exe91⤵PID:3496
-
\??\c:\btnnhh.exec:\btnnhh.exe92⤵PID:3524
-
\??\c:\bnbbtb.exec:\bnbbtb.exe93⤵PID:3504
-
\??\c:\ppdvv.exec:\ppdvv.exe94⤵PID:800
-
\??\c:\lfllflf.exec:\lfllflf.exe95⤵PID:4388
-
\??\c:\frrxrxr.exec:\frrxrxr.exe96⤵PID:1548
-
\??\c:\9nhhhn.exec:\9nhhhn.exe97⤵PID:2892
-
\??\c:\bbhhtt.exec:\bbhhtt.exe98⤵PID:1492
-
\??\c:\vjvvp.exec:\vjvvp.exe99⤵PID:4612
-
\??\c:\djdvv.exec:\djdvv.exe100⤵PID:2668
-
\??\c:\9rrrlrl.exec:\9rrrlrl.exe101⤵PID:1452
-
\??\c:\rxrlxfr.exec:\rxrlxfr.exe102⤵PID:2992
-
\??\c:\tnnhbb.exec:\tnnhbb.exe103⤵PID:3040
-
\??\c:\dvddp.exec:\dvddp.exe104⤵PID:632
-
\??\c:\djddp.exec:\djddp.exe105⤵PID:2288
-
\??\c:\lllflrl.exec:\lllflrl.exe106⤵PID:1680
-
\??\c:\ttbbbh.exec:\ttbbbh.exe107⤵PID:4568
-
\??\c:\hnnnnn.exec:\hnnnnn.exe108⤵PID:5076
-
\??\c:\ddppj.exec:\ddppj.exe109⤵PID:4364
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe110⤵PID:3100
-
\??\c:\hnnnhh.exec:\hnnnhh.exe111⤵PID:3708
-
\??\c:\jjvpp.exec:\jjvpp.exe112⤵PID:1716
-
\??\c:\ppppp.exec:\ppppp.exe113⤵PID:4380
-
\??\c:\lflrlrl.exec:\lflrlrl.exe114⤵PID:4528
-
\??\c:\bnnttt.exec:\bnnttt.exe115⤵PID:5032
-
\??\c:\bhhbtb.exec:\bhhbtb.exe116⤵PID:3740
-
\??\c:\vdjdd.exec:\vdjdd.exe117⤵PID:1668
-
\??\c:\rrffxxl.exec:\rrffxxl.exe118⤵PID:2328
-
\??\c:\rxlrxlx.exec:\rxlrxlx.exe119⤵PID:1504
-
\??\c:\hnnhtt.exec:\hnnhtt.exe120⤵PID:1640
-
\??\c:\jjvvd.exec:\jjvvd.exe121⤵PID:1156
-
\??\c:\rfrfffl.exec:\rfrfffl.exe122⤵PID:2056
-
\??\c:\9lrlffx.exec:\9lrlffx.exe123⤵PID:2620
-
\??\c:\nbhnnn.exec:\nbhnnn.exe124⤵PID:2012
-
\??\c:\tnbbtn.exec:\tnbbtn.exe125⤵PID:4860
-
\??\c:\5pvpp.exec:\5pvpp.exe126⤵PID:1328
-
\??\c:\vpvpj.exec:\vpvpj.exe127⤵PID:1020
-
\??\c:\hbtnnn.exec:\hbtnnn.exe128⤵PID:4572
-
\??\c:\5tthbb.exec:\5tthbb.exe129⤵PID:3172
-
\??\c:\pdjdv.exec:\pdjdv.exe130⤵PID:1120
-
\??\c:\htnbhb.exec:\htnbhb.exe131⤵PID:4440
-
\??\c:\dvpdp.exec:\dvpdp.exe132⤵PID:1424
-
\??\c:\rfxxxfl.exec:\rfxxxfl.exe133⤵PID:3628
-
\??\c:\nhhhhb.exec:\nhhhhb.exe134⤵PID:4092
-
\??\c:\bbntbb.exec:\bbntbb.exe135⤵PID:1684
-
\??\c:\djvvp.exec:\djvvp.exe136⤵PID:1916
-
\??\c:\lxxxffx.exec:\lxxxffx.exe137⤵PID:2624
-
\??\c:\lxrlfff.exec:\lxrlfff.exe138⤵PID:3476
-
\??\c:\7thhnt.exec:\7thhnt.exe139⤵PID:3696
-
\??\c:\jdppv.exec:\jdppv.exe140⤵PID:3636
-
\??\c:\5jppp.exec:\5jppp.exe141⤵PID:4068
-
\??\c:\btbbhh.exec:\btbbhh.exe142⤵PID:2784
-
\??\c:\pjvpj.exec:\pjvpj.exe143⤵PID:2892
-
\??\c:\fxfxlrl.exec:\fxfxlrl.exe144⤵PID:3872
-
\??\c:\lflrxxf.exec:\lflrxxf.exe145⤵PID:4612
-
\??\c:\hhtthh.exec:\hhtthh.exe146⤵PID:2760
-
\??\c:\rlllrrr.exec:\rlllrrr.exe147⤵PID:1760
-
\??\c:\nttnnn.exec:\nttnnn.exe148⤵PID:4932
-
\??\c:\llxxlll.exec:\llxxlll.exe149⤵PID:3040
-
\??\c:\ntbhbh.exec:\ntbhbh.exe150⤵PID:632
-
\??\c:\xllffff.exec:\xllffff.exe151⤵PID:5004
-
\??\c:\rlrrxfl.exec:\rlrrxfl.exe152⤵PID:5016
-
\??\c:\lflfxlf.exec:\lflfxlf.exe153⤵PID:3572
-
\??\c:\9tttnn.exec:\9tttnn.exe154⤵PID:2316
-
\??\c:\1vvdp.exec:\1vvdp.exe155⤵PID:4392
-
\??\c:\fxfllxf.exec:\fxfllxf.exe156⤵PID:4888
-
\??\c:\fxxfffx.exec:\fxxfffx.exe157⤵PID:4380
-
\??\c:\3bhntb.exec:\3bhntb.exe158⤵PID:4528
-
\??\c:\tbtnbb.exec:\tbtnbb.exe159⤵PID:3740
-
\??\c:\pvvpj.exec:\pvvpj.exe160⤵PID:2580
-
\??\c:\pjdvp.exec:\pjdvp.exe161⤵PID:1244
-
\??\c:\rffxrrr.exec:\rffxrrr.exe162⤵PID:2576
-
\??\c:\xrlllrr.exec:\xrlllrr.exe163⤵PID:2124
-
\??\c:\hhhbbb.exec:\hhhbbb.exe164⤵PID:4596
-
\??\c:\tthbnt.exec:\tthbnt.exe165⤵PID:2516
-
\??\c:\jjdvj.exec:\jjdvj.exe166⤵PID:2572
-
\??\c:\dvvvp.exec:\dvvvp.exe167⤵PID:3268
-
\??\c:\rfrrfrl.exec:\rfrrfrl.exe168⤵PID:3188
-
\??\c:\xxlllll.exec:\xxlllll.exe169⤵PID:3716
-
\??\c:\bhbbht.exec:\bhbbht.exe170⤵PID:2916
-
\??\c:\7thtbt.exec:\7thtbt.exe171⤵PID:1120
-
\??\c:\vvjpd.exec:\vvjpd.exe172⤵PID:1544
-
\??\c:\xfrrxlr.exec:\xfrrxlr.exe173⤵PID:4648
-
\??\c:\xffxlfr.exec:\xffxlfr.exe174⤵PID:4356
-
\??\c:\nnnnnt.exec:\nnnnnt.exe175⤵PID:4464
-
\??\c:\pjjdp.exec:\pjjdp.exe176⤵PID:1252
-
\??\c:\jdddv.exec:\jdddv.exe177⤵PID:624
-
\??\c:\xxxxrxf.exec:\xxxxrxf.exe178⤵PID:1052
-
\??\c:\xfrllll.exec:\xfrllll.exe179⤵PID:1468
-
\??\c:\hbhhnn.exec:\hbhhnn.exe180⤵PID:2600
-
\??\c:\7ntnhh.exec:\7ntnhh.exe181⤵PID:3820
-
\??\c:\ddpjv.exec:\ddpjv.exe182⤵PID:208
-
\??\c:\vdppj.exec:\vdppj.exe183⤵PID:532
-
\??\c:\lfxlfff.exec:\lfxlfff.exe184⤵PID:2188
-
\??\c:\fxrrlrl.exec:\fxrrlrl.exe185⤵PID:2668
-
\??\c:\nhbtnt.exec:\nhbtnt.exe186⤵PID:744
-
\??\c:\hbhhhh.exec:\hbhhhh.exe187⤵PID:4508
-
\??\c:\1vvpj.exec:\1vvpj.exe188⤵PID:5096
-
\??\c:\7jpjd.exec:\7jpjd.exe189⤵PID:3836
-
\??\c:\9rrlflf.exec:\9rrlflf.exe190⤵PID:2456
-
\??\c:\3fllffx.exec:\3fllffx.exe191⤵PID:1028
-
\??\c:\btnhhb.exec:\btnhhb.exe192⤵PID:4364
-
\??\c:\nhnbtb.exec:\nhnbtb.exe193⤵PID:4268
-
\??\c:\vdjdv.exec:\vdjdv.exe194⤵PID:396
-
\??\c:\frrlfll.exec:\frrlfll.exe195⤵PID:448
-
\??\c:\xlllxff.exec:\xlllxff.exe196⤵PID:4628
-
\??\c:\9bhhhn.exec:\9bhhhn.exe197⤵PID:5032
-
\??\c:\jvpjd.exec:\jvpjd.exe198⤵PID:4852
-
\??\c:\vpvpp.exec:\vpvpp.exe199⤵PID:4012
-
\??\c:\rxffxxr.exec:\rxffxxr.exe200⤵PID:4804
-
\??\c:\xlxxxxx.exec:\xlxxxxx.exe201⤵PID:2056
-
\??\c:\bnttnb.exec:\bnttnb.exe202⤵PID:2256
-
\??\c:\htbbnb.exec:\htbbnb.exe203⤵PID:4596
-
\??\c:\pdjjd.exec:\pdjjd.exe204⤵PID:2516
-
\??\c:\xlffxxr.exec:\xlffxxr.exe205⤵PID:1440
-
\??\c:\llrlrrx.exec:\llrlrrx.exe206⤵PID:5036
-
\??\c:\hbtttt.exec:\hbtttt.exe207⤵PID:4772
-
\??\c:\tthttt.exec:\tthttt.exe208⤵PID:1988
-
\??\c:\jjjjp.exec:\jjjjp.exe209⤵PID:4976
-
\??\c:\xfrllxx.exec:\xfrllxx.exe210⤵PID:1120
-
\??\c:\pjdvp.exec:\pjdvp.exe211⤵PID:1544
-
\??\c:\rrfllll.exec:\rrfllll.exe212⤵PID:4648
-
\??\c:\nttnnh.exec:\nttnnh.exe213⤵PID:4356
-
\??\c:\htttnn.exec:\htttnn.exe214⤵PID:4464
-
\??\c:\pjpjd.exec:\pjpjd.exe215⤵PID:4876
-
\??\c:\1vvvj.exec:\1vvvj.exe216⤵PID:2624
-
\??\c:\lfllffx.exec:\lfllffx.exe217⤵PID:1460
-
\??\c:\xfllffx.exec:\xfllffx.exe218⤵PID:1468
-
\??\c:\nbhbtt.exec:\nbhbtt.exe219⤵PID:1548
-
\??\c:\pjjjd.exec:\pjjjd.exe220⤵PID:1276
-
\??\c:\vvjdj.exec:\vvjdj.exe221⤵PID:208
-
\??\c:\5lrffrl.exec:\5lrffrl.exe222⤵PID:2708
-
\??\c:\llfffff.exec:\llfffff.exe223⤵PID:2028
-
\??\c:\htttnt.exec:\htttnt.exe224⤵PID:5044
-
\??\c:\vpjdv.exec:\vpjdv.exe225⤵PID:1760
-
\??\c:\vjjdv.exec:\vjjdv.exe226⤵PID:4084
-
\??\c:\lrxrrll.exec:\lrxrrll.exe227⤵PID:3224
-
\??\c:\httttt.exec:\httttt.exe228⤵PID:5008
-
\??\c:\tbnnhh.exec:\tbnnhh.exe229⤵PID:3680
-
\??\c:\3vddv.exec:\3vddv.exe230⤵PID:1564
-
\??\c:\vjjjj.exec:\vjjjj.exe231⤵PID:4708
-
\??\c:\9rrrllr.exec:\9rrrllr.exe232⤵PID:4764
-
\??\c:\ffxrxrl.exec:\ffxrxrl.exe233⤵PID:4888
-
\??\c:\hbbbbb.exec:\hbbbbb.exe234⤵PID:4912
-
\??\c:\bhhnhh.exec:\bhhnhh.exe235⤵PID:1600
-
\??\c:\vdjjj.exec:\vdjjj.exe236⤵PID:4644
-
\??\c:\pjpdp.exec:\pjpdp.exe237⤵PID:4852
-
\??\c:\rrxxffr.exec:\rrxxffr.exe238⤵PID:1244
-
\??\c:\xrlrrxx.exec:\xrlrrxx.exe239⤵PID:1092
-
\??\c:\bbhbnh.exec:\bbhbnh.exe240⤵PID:2056
-
\??\c:\bhhhbb.exec:\bhhhbb.exe241⤵PID:2256
-
\??\c:\jvvvp.exec:\jvvvp.exe242⤵PID:3924