Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 02:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
52afa0f82627200f1810fac4d74b40b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
52afa0f82627200f1810fac4d74b40b0_NeikiAnalytics.exe
-
Size
389KB
-
MD5
52afa0f82627200f1810fac4d74b40b0
-
SHA1
4a3fb6b4980da15adc3f411f285b9a590d69d72b
-
SHA256
cc686ec6604648f5b67cbab6ea04cabb9ccf0f9f9a888df0676db1861774b108
-
SHA512
c4c8af77352447a541a79f45a1d45cd4c53d7f74997293f81de4d4e7a3ae300269ba5f88666ca6ef21c868f1422c73afaeb294520a482390176f154a9cc5df7d
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Gom
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/1100-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1100-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/860-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ttbtbt.exelrlxrlf.exehbtnbh.exepjdpd.exe3lrlxxl.exenbhbnn.exedvjvj.exebnhntn.exe1vjpp.exevvdpj.exe5xfrlll.exevddpj.exerrxlffx.exehnnhhh.exeddpjd.exefrxrflx.exe1jdpj.exe1xllfxx.exenbbnhb.exejppvj.exevvjdd.exefffxffx.exehbhbtt.exe5rlflfr.exethnbnh.exevpvvp.exejvvpj.exefxlxrff.exehtbttn.exevdpdd.exelffxrrr.exedjvdj.exevdjvj.exelrfrffr.exeththbt.exe3jvpd.exelflflll.exe9nnhbt.exethnhnh.exejjppp.exefxxrrxr.exethtnht.exevjdpd.exexxfrxrr.exexxxllfx.exe1pdvp.exepjdvp.exe9rlffrf.exellxlfrf.exetntntt.exevpdvj.exefxfrllf.exexffxxxf.exe7bbtnn.exedjvdp.exerrxxrfx.exe3xlxllf.exe9btnnn.exejppdp.exefxlrrrl.exexrxlrll.exethhtnh.exeppvjd.exejpvpj.exepid process 2832 ttbtbt.exe 2372 lrlxrlf.exe 3080 hbtnbh.exe 4904 pjdpd.exe 4980 3lrlxxl.exe 2172 nbhbnn.exe 2032 dvjvj.exe 4260 bnhntn.exe 376 1vjpp.exe 2788 vvdpj.exe 5000 5xfrlll.exe 4424 vddpj.exe 2584 rrxlffx.exe 3372 hnnhhh.exe 4320 ddpjd.exe 2248 frxrflx.exe 3644 1jdpj.exe 4008 1xllfxx.exe 4480 nbbnhb.exe 4104 jppvj.exe 4012 vvjdd.exe 1056 fffxffx.exe 4628 hbhbtt.exe 2284 5rlflfr.exe 3628 thnbnh.exe 860 vpvvp.exe 3504 jvvpj.exe 4472 fxlxrff.exe 4504 htbttn.exe 4584 vdpdd.exe 4880 lffxrrr.exe 3128 djvdj.exe 1744 vdjvj.exe 4308 lrfrffr.exe 856 ththbt.exe 900 3jvpd.exe 1988 lflflll.exe 1352 9nnhbt.exe 3116 thnhnh.exe 3004 jjppp.exe 216 fxxrrxr.exe 4488 thtnht.exe 5104 vjdpd.exe 2300 xxfrxrr.exe 2032 xxxllfx.exe 4684 1pdvp.exe 5052 pjdvp.exe 2324 9rlffrf.exe 60 llxlfrf.exe 780 tntntt.exe 5084 vpdvj.exe 5096 fxfrllf.exe 3616 xffxxxf.exe 4040 7bbtnn.exe 3212 djvdp.exe 4832 rrxxrfx.exe 2844 3xlxllf.exe 1712 9btnnn.exe 2868 jppdp.exe 2336 fxlrrrl.exe 4480 xrxlrll.exe 2604 thhtnh.exe 2856 ppvjd.exe 4276 jpvpj.exe -
Processes:
resource yara_rule behavioral2/memory/1100-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1100-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/860-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-182-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
52afa0f82627200f1810fac4d74b40b0_NeikiAnalytics.exettbtbt.exelrlxrlf.exehbtnbh.exepjdpd.exe3lrlxxl.exenbhbnn.exedvjvj.exebnhntn.exe1vjpp.exevvdpj.exe5xfrlll.exevddpj.exerrxlffx.exehnnhhh.exeddpjd.exefrxrflx.exe1jdpj.exe1xllfxx.exenbbnhb.exejppvj.exevvjdd.exedescription pid process target process PID 1100 wrote to memory of 2832 1100 52afa0f82627200f1810fac4d74b40b0_NeikiAnalytics.exe ttbtbt.exe PID 1100 wrote to memory of 2832 1100 52afa0f82627200f1810fac4d74b40b0_NeikiAnalytics.exe ttbtbt.exe PID 1100 wrote to memory of 2832 1100 52afa0f82627200f1810fac4d74b40b0_NeikiAnalytics.exe ttbtbt.exe PID 2832 wrote to memory of 2372 2832 ttbtbt.exe lrlxrlf.exe PID 2832 wrote to memory of 2372 2832 ttbtbt.exe lrlxrlf.exe PID 2832 wrote to memory of 2372 2832 ttbtbt.exe lrlxrlf.exe PID 2372 wrote to memory of 3080 2372 lrlxrlf.exe hbtnbh.exe PID 2372 wrote to memory of 3080 2372 lrlxrlf.exe hbtnbh.exe PID 2372 wrote to memory of 3080 2372 lrlxrlf.exe hbtnbh.exe PID 3080 wrote to memory of 4904 3080 hbtnbh.exe pjdpd.exe PID 3080 wrote to memory of 4904 3080 hbtnbh.exe pjdpd.exe PID 3080 wrote to memory of 4904 3080 hbtnbh.exe pjdpd.exe PID 4904 wrote to memory of 4980 4904 pjdpd.exe 3lrlxxl.exe PID 4904 wrote to memory of 4980 4904 pjdpd.exe 3lrlxxl.exe PID 4904 wrote to memory of 4980 4904 pjdpd.exe 3lrlxxl.exe PID 4980 wrote to memory of 2172 4980 3lrlxxl.exe nbhbnn.exe PID 4980 wrote to memory of 2172 4980 3lrlxxl.exe nbhbnn.exe PID 4980 wrote to memory of 2172 4980 3lrlxxl.exe nbhbnn.exe PID 2172 wrote to memory of 2032 2172 nbhbnn.exe xxxllfx.exe PID 2172 wrote to memory of 2032 2172 nbhbnn.exe xxxllfx.exe PID 2172 wrote to memory of 2032 2172 nbhbnn.exe xxxllfx.exe PID 2032 wrote to memory of 4260 2032 dvjvj.exe bnhntn.exe PID 2032 wrote to memory of 4260 2032 dvjvj.exe bnhntn.exe PID 2032 wrote to memory of 4260 2032 dvjvj.exe bnhntn.exe PID 4260 wrote to memory of 376 4260 bnhntn.exe 1vjpp.exe PID 4260 wrote to memory of 376 4260 bnhntn.exe 1vjpp.exe PID 4260 wrote to memory of 376 4260 bnhntn.exe 1vjpp.exe PID 376 wrote to memory of 2788 376 1vjpp.exe vvdpj.exe PID 376 wrote to memory of 2788 376 1vjpp.exe vvdpj.exe PID 376 wrote to memory of 2788 376 1vjpp.exe vvdpj.exe PID 2788 wrote to memory of 5000 2788 vvdpj.exe 5xfrlll.exe PID 2788 wrote to memory of 5000 2788 vvdpj.exe 5xfrlll.exe PID 2788 wrote to memory of 5000 2788 vvdpj.exe 5xfrlll.exe PID 5000 wrote to memory of 4424 5000 5xfrlll.exe vddpj.exe PID 5000 wrote to memory of 4424 5000 5xfrlll.exe vddpj.exe PID 5000 wrote to memory of 4424 5000 5xfrlll.exe vddpj.exe PID 4424 wrote to memory of 2584 4424 vddpj.exe rrxlffx.exe PID 4424 wrote to memory of 2584 4424 vddpj.exe rrxlffx.exe PID 4424 wrote to memory of 2584 4424 vddpj.exe rrxlffx.exe PID 2584 wrote to memory of 3372 2584 rrxlffx.exe hnnhhh.exe PID 2584 wrote to memory of 3372 2584 rrxlffx.exe hnnhhh.exe PID 2584 wrote to memory of 3372 2584 rrxlffx.exe hnnhhh.exe PID 3372 wrote to memory of 4320 3372 hnnhhh.exe ddpjd.exe PID 3372 wrote to memory of 4320 3372 hnnhhh.exe ddpjd.exe PID 3372 wrote to memory of 4320 3372 hnnhhh.exe ddpjd.exe PID 4320 wrote to memory of 2248 4320 ddpjd.exe frxrflx.exe PID 4320 wrote to memory of 2248 4320 ddpjd.exe frxrflx.exe PID 4320 wrote to memory of 2248 4320 ddpjd.exe frxrflx.exe PID 2248 wrote to memory of 3644 2248 frxrflx.exe 1jdpj.exe PID 2248 wrote to memory of 3644 2248 frxrflx.exe 1jdpj.exe PID 2248 wrote to memory of 3644 2248 frxrflx.exe 1jdpj.exe PID 3644 wrote to memory of 4008 3644 1jdpj.exe 1xllfxx.exe PID 3644 wrote to memory of 4008 3644 1jdpj.exe 1xllfxx.exe PID 3644 wrote to memory of 4008 3644 1jdpj.exe 1xllfxx.exe PID 4008 wrote to memory of 4480 4008 1xllfxx.exe xrxlrll.exe PID 4008 wrote to memory of 4480 4008 1xllfxx.exe xrxlrll.exe PID 4008 wrote to memory of 4480 4008 1xllfxx.exe xrxlrll.exe PID 4480 wrote to memory of 4104 4480 nbbnhb.exe jppvj.exe PID 4480 wrote to memory of 4104 4480 nbbnhb.exe jppvj.exe PID 4480 wrote to memory of 4104 4480 nbbnhb.exe jppvj.exe PID 4104 wrote to memory of 4012 4104 jppvj.exe vvjdd.exe PID 4104 wrote to memory of 4012 4104 jppvj.exe vvjdd.exe PID 4104 wrote to memory of 4012 4104 jppvj.exe vvjdd.exe PID 4012 wrote to memory of 1056 4012 vvjdd.exe fffxffx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52afa0f82627200f1810fac4d74b40b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\52afa0f82627200f1810fac4d74b40b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\ttbtbt.exec:\ttbtbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\lrlxrlf.exec:\lrlxrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\hbtnbh.exec:\hbtnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\pjdpd.exec:\pjdpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\3lrlxxl.exec:\3lrlxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\nbhbnn.exec:\nbhbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\dvjvj.exec:\dvjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\bnhntn.exec:\bnhntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\1vjpp.exec:\1vjpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\vvdpj.exec:\vvdpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\5xfrlll.exec:\5xfrlll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\vddpj.exec:\vddpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\rrxlffx.exec:\rrxlffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\hnnhhh.exec:\hnnhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\ddpjd.exec:\ddpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\frxrflx.exec:\frxrflx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\1jdpj.exec:\1jdpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\1xllfxx.exec:\1xllfxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\nbbnhb.exec:\nbbnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\jppvj.exec:\jppvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\vvjdd.exec:\vvjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\fffxffx.exec:\fffxffx.exe23⤵
- Executes dropped EXE
PID:1056 -
\??\c:\hbhbtt.exec:\hbhbtt.exe24⤵
- Executes dropped EXE
PID:4628 -
\??\c:\5rlflfr.exec:\5rlflfr.exe25⤵
- Executes dropped EXE
PID:2284 -
\??\c:\thnbnh.exec:\thnbnh.exe26⤵
- Executes dropped EXE
PID:3628 -
\??\c:\vpvvp.exec:\vpvvp.exe27⤵
- Executes dropped EXE
PID:860 -
\??\c:\jvvpj.exec:\jvvpj.exe28⤵
- Executes dropped EXE
PID:3504 -
\??\c:\fxlxrff.exec:\fxlxrff.exe29⤵
- Executes dropped EXE
PID:4472 -
\??\c:\htbttn.exec:\htbttn.exe30⤵
- Executes dropped EXE
PID:4504 -
\??\c:\vdpdd.exec:\vdpdd.exe31⤵
- Executes dropped EXE
PID:4584 -
\??\c:\lffxrrr.exec:\lffxrrr.exe32⤵
- Executes dropped EXE
PID:4880 -
\??\c:\djvdj.exec:\djvdj.exe33⤵
- Executes dropped EXE
PID:3128 -
\??\c:\vdjvj.exec:\vdjvj.exe34⤵
- Executes dropped EXE
PID:1744 -
\??\c:\lrfrffr.exec:\lrfrffr.exe35⤵
- Executes dropped EXE
PID:4308 -
\??\c:\ththbt.exec:\ththbt.exe36⤵
- Executes dropped EXE
PID:856 -
\??\c:\3jvpd.exec:\3jvpd.exe37⤵
- Executes dropped EXE
PID:900 -
\??\c:\lflflll.exec:\lflflll.exe38⤵
- Executes dropped EXE
PID:1988 -
\??\c:\9nnhbt.exec:\9nnhbt.exe39⤵
- Executes dropped EXE
PID:1352 -
\??\c:\thnhnh.exec:\thnhnh.exe40⤵
- Executes dropped EXE
PID:3116 -
\??\c:\jjppp.exec:\jjppp.exe41⤵
- Executes dropped EXE
PID:3004 -
\??\c:\fxxrrxr.exec:\fxxrrxr.exe42⤵
- Executes dropped EXE
PID:216 -
\??\c:\thtnht.exec:\thtnht.exe43⤵
- Executes dropped EXE
PID:4488 -
\??\c:\vjdpd.exec:\vjdpd.exe44⤵
- Executes dropped EXE
PID:5104 -
\??\c:\xxfrxrr.exec:\xxfrxrr.exe45⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xxxllfx.exec:\xxxllfx.exe46⤵
- Executes dropped EXE
PID:2032 -
\??\c:\1pdvp.exec:\1pdvp.exe47⤵
- Executes dropped EXE
PID:4684 -
\??\c:\pjdvp.exec:\pjdvp.exe48⤵
- Executes dropped EXE
PID:5052 -
\??\c:\9rlffrf.exec:\9rlffrf.exe49⤵
- Executes dropped EXE
PID:2324 -
\??\c:\llxlfrf.exec:\llxlfrf.exe50⤵
- Executes dropped EXE
PID:60 -
\??\c:\tntntt.exec:\tntntt.exe51⤵
- Executes dropped EXE
PID:780 -
\??\c:\vpdvj.exec:\vpdvj.exe52⤵
- Executes dropped EXE
PID:5084 -
\??\c:\fxfrllf.exec:\fxfrllf.exe53⤵
- Executes dropped EXE
PID:5096 -
\??\c:\xffxxxf.exec:\xffxxxf.exe54⤵
- Executes dropped EXE
PID:3616 -
\??\c:\7bbtnn.exec:\7bbtnn.exe55⤵
- Executes dropped EXE
PID:4040 -
\??\c:\djvdp.exec:\djvdp.exe56⤵
- Executes dropped EXE
PID:3212 -
\??\c:\rrxxrfx.exec:\rrxxrfx.exe57⤵
- Executes dropped EXE
PID:4832 -
\??\c:\3xlxllf.exec:\3xlxllf.exe58⤵
- Executes dropped EXE
PID:2844 -
\??\c:\9btnnn.exec:\9btnnn.exe59⤵
- Executes dropped EXE
PID:1712 -
\??\c:\jppdp.exec:\jppdp.exe60⤵
- Executes dropped EXE
PID:2868 -
\??\c:\fxlrrrl.exec:\fxlrrrl.exe61⤵
- Executes dropped EXE
PID:2336 -
\??\c:\xrxlrll.exec:\xrxlrll.exe62⤵
- Executes dropped EXE
PID:4480 -
\??\c:\thhtnh.exec:\thhtnh.exe63⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ppvjd.exec:\ppvjd.exe64⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jpvpj.exec:\jpvpj.exe65⤵
- Executes dropped EXE
PID:4276 -
\??\c:\xxlxffr.exec:\xxlxffr.exe66⤵PID:1084
-
\??\c:\5hhbth.exec:\5hhbth.exe67⤵PID:1748
-
\??\c:\hhbbtn.exec:\hhbbtn.exe68⤵PID:1524
-
\??\c:\vpjdj.exec:\vpjdj.exe69⤵PID:3436
-
\??\c:\3llfxrl.exec:\3llfxrl.exe70⤵PID:224
-
\??\c:\ttthtn.exec:\ttthtn.exe71⤵PID:1576
-
\??\c:\7htntn.exec:\7htntn.exe72⤵PID:4484
-
\??\c:\jjjpv.exec:\jjjpv.exe73⤵PID:2928
-
\??\c:\jdvpd.exec:\jdvpd.exe74⤵PID:3696
-
\??\c:\rrrrlfx.exec:\rrrrlfx.exe75⤵PID:740
-
\??\c:\bhhtbh.exec:\bhhtbh.exe76⤵PID:628
-
\??\c:\tbbnhb.exec:\tbbnhb.exe77⤵PID:3060
-
\??\c:\3jjvp.exec:\3jjvp.exe78⤵PID:3128
-
\??\c:\jvvpd.exec:\jvvpd.exe79⤵PID:4000
-
\??\c:\5lfxlfx.exec:\5lfxlfx.exe80⤵PID:2184
-
\??\c:\bbtnbt.exec:\bbtnbt.exe81⤵PID:2684
-
\??\c:\hbntnt.exec:\hbntnt.exe82⤵PID:1848
-
\??\c:\pddpj.exec:\pddpj.exe83⤵PID:3036
-
\??\c:\dvjdd.exec:\dvjdd.exe84⤵PID:1352
-
\??\c:\xllxrlf.exec:\xllxrlf.exe85⤵PID:4992
-
\??\c:\ntbthb.exec:\ntbthb.exe86⤵PID:4752
-
\??\c:\bhnthb.exec:\bhnthb.exe87⤵PID:5056
-
\??\c:\7djdd.exec:\7djdd.exe88⤵PID:3888
-
\??\c:\fxlxlfx.exec:\fxlxlfx.exe89⤵PID:1388
-
\??\c:\nhthtn.exec:\nhthtn.exe90⤵PID:5024
-
\??\c:\xrfxrlx.exec:\xrfxrlx.exe91⤵PID:376
-
\??\c:\hthbtn.exec:\hthbtn.exe92⤵PID:3592
-
\??\c:\frrlxfl.exec:\frrlxfl.exe93⤵PID:3540
-
\??\c:\hnnbnh.exec:\hnnbnh.exe94⤵PID:3660
-
\??\c:\ddvjv.exec:\ddvjv.exe95⤵PID:3328
-
\??\c:\7xrfrrx.exec:\7xrfrrx.exe96⤵PID:4328
-
\??\c:\bnhtnt.exec:\bnhtnt.exe97⤵PID:3108
-
\??\c:\nhbttn.exec:\nhbttn.exe98⤵PID:4040
-
\??\c:\vvjdd.exec:\vvjdd.exe99⤵PID:3212
-
\??\c:\lxxrfxr.exec:\lxxrfxr.exe100⤵PID:4876
-
\??\c:\nnthbt.exec:\nnthbt.exe101⤵PID:3640
-
\??\c:\ttbtbt.exec:\ttbtbt.exe102⤵PID:1712
-
\??\c:\vpjjd.exec:\vpjjd.exe103⤵PID:1904
-
\??\c:\3jjdv.exec:\3jjdv.exe104⤵PID:1652
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe105⤵PID:1768
-
\??\c:\btthbb.exec:\btthbb.exe106⤵PID:1616
-
\??\c:\tbhhtn.exec:\tbhhtn.exe107⤵PID:1056
-
\??\c:\dvvjd.exec:\dvvjd.exe108⤵PID:3056
-
\??\c:\rxrlffx.exec:\rxrlffx.exe109⤵PID:4800
-
\??\c:\httnbh.exec:\httnbh.exe110⤵PID:3488
-
\??\c:\rlfrlxr.exec:\rlfrlxr.exe111⤵PID:2240
-
\??\c:\pjjdv.exec:\pjjdv.exe112⤵PID:752
-
\??\c:\djdjp.exec:\djdjp.exe113⤵PID:4076
-
\??\c:\7lfxllx.exec:\7lfxllx.exe114⤵PID:2988
-
\??\c:\bbhtbt.exec:\bbhtbt.exe115⤵PID:2736
-
\??\c:\vvvjv.exec:\vvvjv.exe116⤵PID:4908
-
\??\c:\ddjvj.exec:\ddjvj.exe117⤵PID:4584
-
\??\c:\1rrlrlf.exec:\1rrlrlf.exe118⤵PID:4880
-
\??\c:\tbhthh.exec:\tbhthh.exe119⤵PID:4528
-
\??\c:\3tbnht.exec:\3tbnht.exe120⤵PID:3060
-
\??\c:\9vjdj.exec:\9vjdj.exe121⤵PID:4384
-
\??\c:\pdjdv.exec:\pdjdv.exe122⤵PID:4308
-
\??\c:\lfxlfxl.exec:\lfxlfxl.exe123⤵PID:5112
-
\??\c:\thnbhb.exec:\thnbhb.exe124⤵PID:2684
-
\??\c:\9dvjv.exec:\9dvjv.exe125⤵PID:1848
-
\??\c:\pjjdv.exec:\pjjdv.exe126⤵PID:2660
-
\??\c:\5xlfrfx.exec:\5xlfrfx.exe127⤵PID:216
-
\??\c:\1hbtnh.exec:\1hbtnh.exe128⤵PID:5056
-
\??\c:\jdjvp.exec:\jdjvp.exe129⤵PID:4524
-
\??\c:\dpvvp.exec:\dpvvp.exe130⤵PID:2788
-
\??\c:\lrlfffx.exec:\lrlfffx.exe131⤵PID:4296
-
\??\c:\nhnbnh.exec:\nhnbnh.exe132⤵PID:60
-
\??\c:\7vpjv.exec:\7vpjv.exe133⤵PID:3612
-
\??\c:\pvpjd.exec:\pvpjd.exe134⤵PID:1152
-
\??\c:\xxfxllf.exec:\xxfxllf.exe135⤵PID:3096
-
\??\c:\hnhtnh.exec:\hnhtnh.exe136⤵PID:5044
-
\??\c:\dvvvp.exec:\dvvvp.exe137⤵PID:3212
-
\??\c:\1djjd.exec:\1djjd.exe138⤵PID:4552
-
\??\c:\xlllxrl.exec:\xlllxrl.exe139⤵PID:3640
-
\??\c:\ttnnnn.exec:\ttnnnn.exe140⤵PID:4136
-
\??\c:\7dvpd.exec:\7dvpd.exe141⤵PID:1904
-
\??\c:\3dvdv.exec:\3dvdv.exe142⤵PID:3476
-
\??\c:\xrlxrfx.exec:\xrlxrfx.exe143⤵PID:3252
-
\??\c:\tbbbbh.exec:\tbbbbh.exe144⤵PID:1056
-
\??\c:\hthttn.exec:\hthttn.exe145⤵PID:3056
-
\??\c:\7pjvp.exec:\7pjvp.exe146⤵PID:4800
-
\??\c:\fllxrlx.exec:\fllxrlx.exe147⤵PID:2260
-
\??\c:\tbbhnt.exec:\tbbhnt.exe148⤵PID:4020
-
\??\c:\1nnhbb.exec:\1nnhbb.exe149⤵PID:3992
-
\??\c:\vvvvj.exec:\vvvvj.exe150⤵PID:4076
-
\??\c:\vvvjd.exec:\vvvjd.exe151⤵PID:2988
-
\??\c:\1lrrrrr.exec:\1lrrrrr.exe152⤵PID:4048
-
\??\c:\htnnhn.exec:\htnnhn.exe153⤵PID:2108
-
\??\c:\htbbtb.exec:\htbbtb.exe154⤵PID:1532
-
\??\c:\ddddv.exec:\ddddv.exe155⤵PID:4880
-
\??\c:\7frrlrr.exec:\7frrlrr.exe156⤵PID:2720
-
\??\c:\xxffxxx.exec:\xxffxxx.exe157⤵PID:4448
-
\??\c:\bbhnbb.exec:\bbhnbb.exe158⤵PID:2148
-
\??\c:\vvpvv.exec:\vvpvv.exe159⤵PID:4260
-
\??\c:\pddvv.exec:\pddvv.exe160⤵PID:400
-
\??\c:\flfxfll.exec:\flfxfll.exe161⤵PID:1656
-
\??\c:\lxfrfxl.exec:\lxfrfxl.exe162⤵PID:3036
-
\??\c:\tthbtt.exec:\tthbtt.exe163⤵PID:3368
-
\??\c:\jjvpv.exec:\jjvpv.exe164⤵PID:220
-
\??\c:\vpvpp.exec:\vpvpp.exe165⤵PID:5040
-
\??\c:\xfrrlrl.exec:\xfrrlrl.exe166⤵PID:3868
-
\??\c:\nhhbbb.exec:\nhhbbb.exe167⤵PID:3668
-
\??\c:\1ttnhb.exec:\1ttnhb.exe168⤵PID:3980
-
\??\c:\vdpjv.exec:\vdpjv.exe169⤵PID:4296
-
\??\c:\1dpjv.exec:\1dpjv.exe170⤵PID:60
-
\??\c:\lrlxlrf.exec:\lrlxlrf.exe171⤵PID:4328
-
\??\c:\ttttnn.exec:\ttttnn.exe172⤵PID:1220
-
\??\c:\hbbtnn.exec:\hbbtnn.exe173⤵PID:3068
-
\??\c:\vddpp.exec:\vddpp.exe174⤵PID:1228
-
\??\c:\lrxrfxx.exec:\lrxrfxx.exe175⤵PID:4664
-
\??\c:\rxlrfrf.exec:\rxlrfrf.exe176⤵PID:796
-
\??\c:\nntnnn.exec:\nntnnn.exe177⤵PID:4824
-
\??\c:\jvjjj.exec:\jvjjj.exe178⤵PID:4136
-
\??\c:\dvdpj.exec:\dvdpj.exe179⤵PID:1900
-
\??\c:\flxxxxx.exec:\flxxxxx.exe180⤵PID:3476
-
\??\c:\7xrlffx.exec:\7xrlffx.exe181⤵PID:3788
-
\??\c:\hhtbtt.exec:\hhtbtt.exe182⤵PID:3876
-
\??\c:\vvvvp.exec:\vvvvp.exe183⤵PID:544
-
\??\c:\rrxrrrl.exec:\rrxrrrl.exe184⤵PID:3056
-
\??\c:\tbbbbb.exec:\tbbbbb.exe185⤵PID:4872
-
\??\c:\pjppj.exec:\pjppj.exe186⤵PID:1804
-
\??\c:\ddjvv.exec:\ddjvv.exe187⤵PID:224
-
\??\c:\9llfffx.exec:\9llfffx.exe188⤵PID:404
-
\??\c:\bhnnht.exec:\bhnnht.exe189⤵PID:4484
-
\??\c:\thttbt.exec:\thttbt.exe190⤵PID:2928
-
\??\c:\djjpv.exec:\djjpv.exe191⤵PID:4908
-
\??\c:\vjvpj.exec:\vjvpj.exe192⤵PID:1960
-
\??\c:\llffxxx.exec:\llffxxx.exe193⤵PID:3064
-
\??\c:\nnnnnh.exec:\nnnnnh.exe194⤵PID:3320
-
\??\c:\bthbbb.exec:\bthbbb.exe195⤵PID:3060
-
\??\c:\vpddv.exec:\vpddv.exe196⤵PID:2372
-
\??\c:\ffrlrrx.exec:\ffrlrrx.exe197⤵PID:4252
-
\??\c:\rflfxxl.exec:\rflfxxl.exe198⤵PID:5112
-
\??\c:\9nttbh.exec:\9nttbh.exe199⤵PID:5076
-
\??\c:\hbhbnt.exec:\hbhbnt.exe200⤵PID:1908
-
\??\c:\ddddd.exec:\ddddd.exe201⤵PID:1664
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe202⤵PID:464
-
\??\c:\tntbbb.exec:\tntbbb.exe203⤵PID:1036
-
\??\c:\tnnhtb.exec:\tnnhtb.exe204⤵PID:2044
-
\??\c:\jvjjd.exec:\jvjjd.exe205⤵PID:1388
-
\??\c:\lllfxff.exec:\lllfxff.exe206⤵PID:3316
-
\??\c:\llrlfff.exec:\llrlfff.exe207⤵PID:1256
-
\??\c:\ttbtnn.exec:\ttbtnn.exe208⤵PID:3540
-
\??\c:\3djdd.exec:\3djdd.exe209⤵PID:2900
-
\??\c:\7vvpj.exec:\7vvpj.exe210⤵PID:3132
-
\??\c:\lffrrrl.exec:\lffrrrl.exe211⤵PID:3704
-
\??\c:\tnbtnh.exec:\tnbtnh.exe212⤵PID:548
-
\??\c:\5vdvv.exec:\5vdvv.exe213⤵PID:3536
-
\??\c:\xxfxlfx.exec:\xxfxlfx.exe214⤵PID:3104
-
\??\c:\hnttnt.exec:\hnttnt.exe215⤵PID:2868
-
\??\c:\tbtnbt.exec:\tbtnbt.exe216⤵PID:432
-
\??\c:\dvjjj.exec:\dvjjj.exe217⤵PID:4012
-
\??\c:\rllflxr.exec:\rllflxr.exe218⤵PID:3472
-
\??\c:\xxxrllf.exec:\xxxrllf.exe219⤵PID:4160
-
\??\c:\thnhht.exec:\thnhht.exe220⤵PID:2036
-
\??\c:\djppj.exec:\djppj.exe221⤵PID:648
-
\??\c:\xxxrfll.exec:\xxxrfll.exe222⤵PID:3200
-
\??\c:\rllfffl.exec:\rllfffl.exe223⤵PID:1524
-
\??\c:\bhhtnh.exec:\bhhtnh.exe224⤵PID:4116
-
\??\c:\dpvpj.exec:\dpvpj.exe225⤵PID:4472
-
\??\c:\xlllfff.exec:\xlllfff.exe226⤵PID:4076
-
\??\c:\ttbthh.exec:\ttbthh.exe227⤵PID:1568
-
\??\c:\tnbnbb.exec:\tnbnbb.exe228⤵PID:64
-
\??\c:\9vpjd.exec:\9vpjd.exe229⤵PID:2108
-
\??\c:\xrrxffl.exec:\xrrxffl.exe230⤵PID:4400
-
\??\c:\bbhbhh.exec:\bbhbhh.exe231⤵PID:2136
-
\??\c:\htnhtb.exec:\htnhtb.exe232⤵PID:4056
-
\??\c:\jdjpd.exec:\jdjpd.exe233⤵PID:4644
-
\??\c:\lrfxrrf.exec:\lrfxrrf.exe234⤵PID:2096
-
\??\c:\rlfflxf.exec:\rlfflxf.exe235⤵PID:2200
-
\??\c:\thhbnh.exec:\thhbnh.exe236⤵PID:2720
-
\??\c:\dvdvv.exec:\dvdvv.exe237⤵PID:2408
-
\??\c:\xxfxllr.exec:\xxfxllr.exe238⤵PID:884
-
\??\c:\1lrrlll.exec:\1lrrlll.exe239⤵PID:4712
-
\??\c:\thtnnn.exec:\thtnnn.exe240⤵PID:1656
-
\??\c:\pjjdv.exec:\pjjdv.exe241⤵PID:3792
-
\??\c:\pppjp.exec:\pppjp.exe242⤵PID:1276