Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 06:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
90b90256780e8fd7f0a3729f546a4a00_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
90b90256780e8fd7f0a3729f546a4a00_NeikiAnalytics.exe
-
Size
65KB
-
MD5
90b90256780e8fd7f0a3729f546a4a00
-
SHA1
9b97685544ce7bd3a8d179ae5194acd2045c6d64
-
SHA256
35b07735f815ba3990fbff3f93eeb91a4a408d6388dc33aeb4eb59f59ff16393
-
SHA512
5e27a9aefa58720a7d3d7b4469dc661ff35b681c363eaaf1f45967be0e8d76ff5875b3b59ebf76e1cb3e385b49d42e5ff8e84feedc572ec97dc64243e94dc7f9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfDK:ymb3NkkiQ3mdBjFI4VC
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/4224-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/904-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lxxxxxx.exehbbnnb.exe3pvjj.exexrrlfff.exettnhhb.exexflxlfr.exebntntn.exejvvvv.exe9xlffff.exehhhhbt.exejvvdj.exelflrlll.exettttnn.exevpjpd.exexxxxxxf.exelflrlxr.exebthhtn.exevpvvv.exe1rxxxxr.exenbbttn.exebttnhb.exeddppj.exexlrxrrr.exe9xxrxxr.exettnhbh.exedpjdp.exenbtnhh.exejjjdv.exerlrrlff.exehbbbbt.exetntnbb.exepppjd.exelflxlfl.exenbbbtt.exetnnthh.exepjpjj.exelrxlffx.exehnhbbb.exenhbbnt.exe1jpdv.exexflffxx.exefxfrllr.exehtttbh.exe5bhbtt.exepjdvj.exedvjjp.exerlrlllf.exe5lrxrrr.exehhbnht.exebntttt.exe9pppj.exevpppd.exe1xffxxr.exe5nttnn.exenbbbtn.exejppjv.exedvvvp.exelrrlffx.exeflxffff.exetnhhhh.exenhtnbb.exe5pdvd.exevpvvp.exerlxllrl.exepid process 2216 lxxxxxx.exe 1912 hbbnnb.exe 4708 3pvjj.exe 1548 xrrlfff.exe 2280 ttnhhb.exe 3776 xflxlfr.exe 4920 bntntn.exe 3960 jvvvv.exe 4932 9xlffff.exe 1984 hhhhbt.exe 2728 jvvdj.exe 2708 lflrlll.exe 4564 ttttnn.exe 4324 vpjpd.exe 1440 xxxxxxf.exe 3596 lflrlxr.exe 3364 bthhtn.exe 1412 vpvvv.exe 4592 1rxxxxr.exe 904 nbbttn.exe 4844 bttnhb.exe 696 ddppj.exe 3516 xlrxrrr.exe 1700 9xxrxxr.exe 1628 ttnhbh.exe 3396 dpjdp.exe 3840 nbtnhh.exe 2788 jjjdv.exe 1432 rlrrlff.exe 3528 hbbbbt.exe 4544 tntnbb.exe 1400 pppjd.exe 2580 lflxlfl.exe 4972 nbbbtt.exe 1384 tnnthh.exe 4440 pjpjj.exe 876 lrxlffx.exe 2496 hnhbbb.exe 468 nhbbnt.exe 3964 1jpdv.exe 1820 xflffxx.exe 4800 fxfrllr.exe 368 htttbh.exe 756 5bhbtt.exe 4340 pjdvj.exe 2028 dvjjp.exe 4920 rlrlllf.exe 4692 5lrxrrr.exe 2780 hhbnht.exe 4956 bntttt.exe 2740 9pppj.exe 2852 vpppd.exe 2276 1xffxxr.exe 4084 5nttnn.exe 4576 nbbbtn.exe 3892 jppjv.exe 4596 dvvvp.exe 4212 lrrlffx.exe 4052 flxffff.exe 1144 tnhhhh.exe 1988 nhtnbb.exe 1412 5pdvd.exe 2340 vpvvp.exe 448 rlxllrl.exe -
Processes:
resource yara_rule behavioral2/memory/4224-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2708-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/904-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
90b90256780e8fd7f0a3729f546a4a00_NeikiAnalytics.exelxxxxxx.exehbbnnb.exe3pvjj.exexrrlfff.exettnhhb.exexflxlfr.exebntntn.exejvvvv.exe9xlffff.exehhhhbt.exejvvdj.exelflrlll.exettttnn.exevpjpd.exexxxxxxf.exelflrlxr.exebthhtn.exevpvvv.exe1rxxxxr.exenbbttn.exebttnhb.exedescription pid process target process PID 4224 wrote to memory of 2216 4224 90b90256780e8fd7f0a3729f546a4a00_NeikiAnalytics.exe lxxxxxx.exe PID 4224 wrote to memory of 2216 4224 90b90256780e8fd7f0a3729f546a4a00_NeikiAnalytics.exe lxxxxxx.exe PID 4224 wrote to memory of 2216 4224 90b90256780e8fd7f0a3729f546a4a00_NeikiAnalytics.exe lxxxxxx.exe PID 2216 wrote to memory of 1912 2216 lxxxxxx.exe hbbnnb.exe PID 2216 wrote to memory of 1912 2216 lxxxxxx.exe hbbnnb.exe PID 2216 wrote to memory of 1912 2216 lxxxxxx.exe hbbnnb.exe PID 1912 wrote to memory of 4708 1912 hbbnnb.exe 3pvjj.exe PID 1912 wrote to memory of 4708 1912 hbbnnb.exe 3pvjj.exe PID 1912 wrote to memory of 4708 1912 hbbnnb.exe 3pvjj.exe PID 4708 wrote to memory of 1548 4708 3pvjj.exe xrrlfff.exe PID 4708 wrote to memory of 1548 4708 3pvjj.exe xrrlfff.exe PID 4708 wrote to memory of 1548 4708 3pvjj.exe xrrlfff.exe PID 1548 wrote to memory of 2280 1548 xrrlfff.exe ttnhhb.exe PID 1548 wrote to memory of 2280 1548 xrrlfff.exe ttnhhb.exe PID 1548 wrote to memory of 2280 1548 xrrlfff.exe ttnhhb.exe PID 2280 wrote to memory of 3776 2280 ttnhhb.exe xflxlfr.exe PID 2280 wrote to memory of 3776 2280 ttnhhb.exe xflxlfr.exe PID 2280 wrote to memory of 3776 2280 ttnhhb.exe xflxlfr.exe PID 3776 wrote to memory of 4920 3776 xflxlfr.exe bntntn.exe PID 3776 wrote to memory of 4920 3776 xflxlfr.exe bntntn.exe PID 3776 wrote to memory of 4920 3776 xflxlfr.exe bntntn.exe PID 4920 wrote to memory of 3960 4920 bntntn.exe jvvvv.exe PID 4920 wrote to memory of 3960 4920 bntntn.exe jvvvv.exe PID 4920 wrote to memory of 3960 4920 bntntn.exe jvvvv.exe PID 3960 wrote to memory of 4932 3960 jvvvv.exe 9xlffff.exe PID 3960 wrote to memory of 4932 3960 jvvvv.exe 9xlffff.exe PID 3960 wrote to memory of 4932 3960 jvvvv.exe 9xlffff.exe PID 4932 wrote to memory of 1984 4932 9xlffff.exe hhhhbt.exe PID 4932 wrote to memory of 1984 4932 9xlffff.exe hhhhbt.exe PID 4932 wrote to memory of 1984 4932 9xlffff.exe hhhhbt.exe PID 1984 wrote to memory of 2728 1984 hhhhbt.exe jvvdj.exe PID 1984 wrote to memory of 2728 1984 hhhhbt.exe jvvdj.exe PID 1984 wrote to memory of 2728 1984 hhhhbt.exe jvvdj.exe PID 2728 wrote to memory of 2708 2728 jvvdj.exe lflrlll.exe PID 2728 wrote to memory of 2708 2728 jvvdj.exe lflrlll.exe PID 2728 wrote to memory of 2708 2728 jvvdj.exe lflrlll.exe PID 2708 wrote to memory of 4564 2708 lflrlll.exe ttttnn.exe PID 2708 wrote to memory of 4564 2708 lflrlll.exe ttttnn.exe PID 2708 wrote to memory of 4564 2708 lflrlll.exe ttttnn.exe PID 4564 wrote to memory of 4324 4564 ttttnn.exe vpjpd.exe PID 4564 wrote to memory of 4324 4564 ttttnn.exe vpjpd.exe PID 4564 wrote to memory of 4324 4564 ttttnn.exe vpjpd.exe PID 4324 wrote to memory of 1440 4324 vpjpd.exe xxxxxxf.exe PID 4324 wrote to memory of 1440 4324 vpjpd.exe xxxxxxf.exe PID 4324 wrote to memory of 1440 4324 vpjpd.exe xxxxxxf.exe PID 1440 wrote to memory of 3596 1440 xxxxxxf.exe lflrlxr.exe PID 1440 wrote to memory of 3596 1440 xxxxxxf.exe lflrlxr.exe PID 1440 wrote to memory of 3596 1440 xxxxxxf.exe lflrlxr.exe PID 3596 wrote to memory of 3364 3596 lflrlxr.exe bthhtn.exe PID 3596 wrote to memory of 3364 3596 lflrlxr.exe bthhtn.exe PID 3596 wrote to memory of 3364 3596 lflrlxr.exe bthhtn.exe PID 3364 wrote to memory of 1412 3364 bthhtn.exe vpvvv.exe PID 3364 wrote to memory of 1412 3364 bthhtn.exe vpvvv.exe PID 3364 wrote to memory of 1412 3364 bthhtn.exe vpvvv.exe PID 1412 wrote to memory of 4592 1412 vpvvv.exe 1rxxxxr.exe PID 1412 wrote to memory of 4592 1412 vpvvv.exe 1rxxxxr.exe PID 1412 wrote to memory of 4592 1412 vpvvv.exe 1rxxxxr.exe PID 4592 wrote to memory of 904 4592 1rxxxxr.exe nbbttn.exe PID 4592 wrote to memory of 904 4592 1rxxxxr.exe nbbttn.exe PID 4592 wrote to memory of 904 4592 1rxxxxr.exe nbbttn.exe PID 904 wrote to memory of 4844 904 nbbttn.exe bttnhb.exe PID 904 wrote to memory of 4844 904 nbbttn.exe bttnhb.exe PID 904 wrote to memory of 4844 904 nbbttn.exe bttnhb.exe PID 4844 wrote to memory of 696 4844 bttnhb.exe ddppj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90b90256780e8fd7f0a3729f546a4a00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\90b90256780e8fd7f0a3729f546a4a00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\hbbnnb.exec:\hbbnnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\3pvjj.exec:\3pvjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\xrrlfff.exec:\xrrlfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\ttnhhb.exec:\ttnhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\xflxlfr.exec:\xflxlfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\bntntn.exec:\bntntn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\jvvvv.exec:\jvvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\9xlffff.exec:\9xlffff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\hhhhbt.exec:\hhhhbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\jvvdj.exec:\jvvdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\lflrlll.exec:\lflrlll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\ttttnn.exec:\ttttnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\vpjpd.exec:\vpjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\xxxxxxf.exec:\xxxxxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\lflrlxr.exec:\lflrlxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\bthhtn.exec:\bthhtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\vpvvv.exec:\vpvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\1rxxxxr.exec:\1rxxxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\nbbttn.exec:\nbbttn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
\??\c:\bttnhb.exec:\bttnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\ddppj.exec:\ddppj.exe23⤵
- Executes dropped EXE
PID:696 -
\??\c:\xlrxrrr.exec:\xlrxrrr.exe24⤵
- Executes dropped EXE
PID:3516 -
\??\c:\9xxrxxr.exec:\9xxrxxr.exe25⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ttnhbh.exec:\ttnhbh.exe26⤵
- Executes dropped EXE
PID:1628 -
\??\c:\dpjdp.exec:\dpjdp.exe27⤵
- Executes dropped EXE
PID:3396 -
\??\c:\nbtnhh.exec:\nbtnhh.exe28⤵
- Executes dropped EXE
PID:3840 -
\??\c:\jjjdv.exec:\jjjdv.exe29⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rlrrlff.exec:\rlrrlff.exe30⤵
- Executes dropped EXE
PID:1432 -
\??\c:\hbbbbt.exec:\hbbbbt.exe31⤵
- Executes dropped EXE
PID:3528 -
\??\c:\tntnbb.exec:\tntnbb.exe32⤵
- Executes dropped EXE
PID:4544 -
\??\c:\pppjd.exec:\pppjd.exe33⤵
- Executes dropped EXE
PID:1400 -
\??\c:\lflxlfl.exec:\lflxlfl.exe34⤵
- Executes dropped EXE
PID:2580 -
\??\c:\nbbbtt.exec:\nbbbtt.exe35⤵
- Executes dropped EXE
PID:4972 -
\??\c:\tnnthh.exec:\tnnthh.exe36⤵
- Executes dropped EXE
PID:1384 -
\??\c:\pjpjj.exec:\pjpjj.exe37⤵
- Executes dropped EXE
PID:4440 -
\??\c:\lrxlffx.exec:\lrxlffx.exe38⤵
- Executes dropped EXE
PID:876 -
\??\c:\hnhbbb.exec:\hnhbbb.exe39⤵
- Executes dropped EXE
PID:2496 -
\??\c:\nhbbnt.exec:\nhbbnt.exe40⤵
- Executes dropped EXE
PID:468 -
\??\c:\1jpdv.exec:\1jpdv.exe41⤵
- Executes dropped EXE
PID:3964 -
\??\c:\xflffxx.exec:\xflffxx.exe42⤵
- Executes dropped EXE
PID:1820 -
\??\c:\fxfrllr.exec:\fxfrllr.exe43⤵
- Executes dropped EXE
PID:4800 -
\??\c:\htttbh.exec:\htttbh.exe44⤵
- Executes dropped EXE
PID:368 -
\??\c:\5bhbtt.exec:\5bhbtt.exe45⤵
- Executes dropped EXE
PID:756 -
\??\c:\pjdvj.exec:\pjdvj.exe46⤵
- Executes dropped EXE
PID:4340 -
\??\c:\dvjjp.exec:\dvjjp.exe47⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rlrlllf.exec:\rlrlllf.exe48⤵
- Executes dropped EXE
PID:4920 -
\??\c:\5lrxrrr.exec:\5lrxrrr.exe49⤵
- Executes dropped EXE
PID:4692 -
\??\c:\hhbnht.exec:\hhbnht.exe50⤵
- Executes dropped EXE
PID:2780 -
\??\c:\bntttt.exec:\bntttt.exe51⤵
- Executes dropped EXE
PID:4956 -
\??\c:\9pppj.exec:\9pppj.exe52⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vpppd.exec:\vpppd.exe53⤵
- Executes dropped EXE
PID:2852 -
\??\c:\1xffxxr.exec:\1xffxxr.exe54⤵
- Executes dropped EXE
PID:2276 -
\??\c:\5nttnn.exec:\5nttnn.exe55⤵
- Executes dropped EXE
PID:4084 -
\??\c:\nbbbtn.exec:\nbbbtn.exe56⤵
- Executes dropped EXE
PID:4576 -
\??\c:\jppjv.exec:\jppjv.exe57⤵
- Executes dropped EXE
PID:3892 -
\??\c:\dvvvp.exec:\dvvvp.exe58⤵
- Executes dropped EXE
PID:4596 -
\??\c:\lrrlffx.exec:\lrrlffx.exe59⤵
- Executes dropped EXE
PID:4212 -
\??\c:\flxffff.exec:\flxffff.exe60⤵
- Executes dropped EXE
PID:4052 -
\??\c:\tnhhhh.exec:\tnhhhh.exe61⤵
- Executes dropped EXE
PID:1144 -
\??\c:\nhtnbb.exec:\nhtnbb.exe62⤵
- Executes dropped EXE
PID:1988 -
\??\c:\5pdvd.exec:\5pdvd.exe63⤵
- Executes dropped EXE
PID:1412 -
\??\c:\vpvvp.exec:\vpvvp.exe64⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rlxllrl.exec:\rlxllrl.exe65⤵
- Executes dropped EXE
PID:448 -
\??\c:\5fffxxx.exec:\5fffxxx.exe66⤵PID:4488
-
\??\c:\nhntbb.exec:\nhntbb.exe67⤵PID:4500
-
\??\c:\hhnhhb.exec:\hhnhhb.exe68⤵PID:2108
-
\??\c:\jdddv.exec:\jdddv.exe69⤵PID:3516
-
\??\c:\lfffxll.exec:\lfffxll.exe70⤵PID:464
-
\??\c:\jpjjd.exec:\jpjjd.exe71⤵PID:1628
-
\??\c:\xrfffll.exec:\xrfffll.exe72⤵PID:968
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe73⤵PID:1184
-
\??\c:\hnhbbb.exec:\hnhbbb.exe74⤵PID:4092
-
\??\c:\ppppj.exec:\ppppj.exe75⤵PID:4288
-
\??\c:\llxrrxx.exec:\llxrrxx.exe76⤵PID:3256
-
\??\c:\rrfrlll.exec:\rrfrlll.exe77⤵PID:2332
-
\??\c:\ttbbbb.exec:\ttbbbb.exe78⤵PID:1772
-
\??\c:\pjjvv.exec:\pjjvv.exe79⤵PID:4744
-
\??\c:\pjjjd.exec:\pjjjd.exe80⤵PID:740
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe81⤵PID:4580
-
\??\c:\lfllflf.exec:\lfllflf.exe82⤵PID:2096
-
\??\c:\tnnbbn.exec:\tnnbbn.exe83⤵PID:4556
-
\??\c:\dvpdp.exec:\dvpdp.exe84⤵PID:4236
-
\??\c:\9pdvp.exec:\9pdvp.exe85⤵PID:4336
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe86⤵PID:3736
-
\??\c:\nnhhnt.exec:\nnhhnt.exe87⤵PID:4708
-
\??\c:\hnnhhh.exec:\hnnhhh.exe88⤵PID:3832
-
\??\c:\pppjj.exec:\pppjj.exe89⤵PID:2156
-
\??\c:\ffllfff.exec:\ffllfff.exe90⤵PID:4060
-
\??\c:\llfflfr.exec:\llfflfr.exe91⤵PID:4680
-
\??\c:\hhnnnn.exec:\hhnnnn.exe92⤵PID:4904
-
\??\c:\5djvp.exec:\5djvp.exe93⤵PID:1816
-
\??\c:\vdppp.exec:\vdppp.exe94⤵PID:1800
-
\??\c:\9rrlxxl.exec:\9rrlxxl.exe95⤵PID:4624
-
\??\c:\hhtthn.exec:\hhtthn.exe96⤵PID:1984
-
\??\c:\dpvpj.exec:\dpvpj.exe97⤵PID:1828
-
\??\c:\fxfxlff.exec:\fxfxlff.exe98⤵PID:1936
-
\??\c:\rlrrlll.exec:\rlrrlll.exe99⤵PID:1528
-
\??\c:\hbbhhh.exec:\hbbhhh.exe100⤵PID:2956
-
\??\c:\vpvvp.exec:\vpvvp.exe101⤵PID:2480
-
\??\c:\7flfrrx.exec:\7flfrrx.exe102⤵PID:3920
-
\??\c:\xxrxrrr.exec:\xxrxrrr.exe103⤵PID:3676
-
\??\c:\dvvvv.exec:\dvvvv.exe104⤵PID:4212
-
\??\c:\1djvp.exec:\1djvp.exe105⤵PID:1116
-
\??\c:\fffrfxr.exec:\fffrfxr.exe106⤵PID:2408
-
\??\c:\rlffxfl.exec:\rlffxfl.exe107⤵PID:1988
-
\??\c:\hnhbhh.exec:\hnhbhh.exe108⤵PID:4592
-
\??\c:\jdppj.exec:\jdppj.exe109⤵PID:2856
-
\??\c:\jppjj.exec:\jppjj.exe110⤵PID:4628
-
\??\c:\xflffxx.exec:\xflffxx.exe111⤵PID:1728
-
\??\c:\xfxxflr.exec:\xfxxflr.exe112⤵PID:1920
-
\??\c:\pjjjd.exec:\pjjjd.exe113⤵PID:1740
-
\??\c:\xrxrlll.exec:\xrxrlll.exe114⤵PID:4172
-
\??\c:\fllffff.exec:\fllffff.exe115⤵PID:3992
-
\??\c:\nbbbbh.exec:\nbbbbh.exe116⤵PID:3328
-
\??\c:\nhnnhh.exec:\nhnnhh.exe117⤵PID:3912
-
\??\c:\jvvpd.exec:\jvvpd.exe118⤵PID:4188
-
\??\c:\rxxrrlr.exec:\rxxrrlr.exe119⤵PID:4744
-
\??\c:\fxxrrlr.exec:\fxxrrlr.exe120⤵PID:4436
-
\??\c:\nbbthh.exec:\nbbthh.exe121⤵PID:1384
-
\??\c:\vjppd.exec:\vjppd.exe122⤵PID:3484
-
\??\c:\bnbtnn.exec:\bnbtnn.exe123⤵PID:2136
-
\??\c:\hbbnht.exec:\hbbnht.exe124⤵PID:668
-
\??\c:\vvpjj.exec:\vvpjj.exe125⤵PID:4112
-
\??\c:\xlllxxx.exec:\xlllxxx.exe126⤵PID:3964
-
\??\c:\3bthtn.exec:\3bthtn.exe127⤵PID:2288
-
\??\c:\9tnhhh.exec:\9tnhhh.exe128⤵PID:2156
-
\??\c:\jjjdp.exec:\jjjdp.exe129⤵PID:4060
-
\??\c:\flrlllf.exec:\flrlllf.exe130⤵PID:4340
-
\??\c:\jdjjj.exec:\jdjjj.exe131⤵PID:2304
-
\??\c:\llfxlfx.exec:\llfxlfx.exe132⤵PID:4232
-
\??\c:\hnnhbt.exec:\hnnhbt.exe133⤵PID:804
-
\??\c:\5tbthb.exec:\5tbthb.exe134⤵PID:4956
-
\??\c:\1nhbbb.exec:\1nhbbb.exe135⤵PID:1656
-
\??\c:\jdjdd.exec:\jdjdd.exe136⤵PID:1252
-
\??\c:\9pdpd.exec:\9pdpd.exe137⤵PID:532
-
\??\c:\3rffllf.exec:\3rffllf.exe138⤵PID:1528
-
\??\c:\bhnhbh.exec:\bhnhbh.exe139⤵PID:2956
-
\??\c:\3vdjp.exec:\3vdjp.exe140⤵PID:2768
-
\??\c:\xxxlxrr.exec:\xxxlxrr.exe141⤵PID:5116
-
\??\c:\thbbtt.exec:\thbbtt.exe142⤵PID:3312
-
\??\c:\hhthhh.exec:\hhthhh.exe143⤵PID:4144
-
\??\c:\1vpjv.exec:\1vpjv.exe144⤵PID:2316
-
\??\c:\rlfrlfx.exec:\rlfrlfx.exe145⤵PID:4104
-
\??\c:\llffffx.exec:\llffffx.exe146⤵PID:1988
-
\??\c:\bnhhbb.exec:\bnhhbb.exe147⤵PID:4472
-
\??\c:\nhtnhb.exec:\nhtnhb.exe148⤵PID:4500
-
\??\c:\pvddv.exec:\pvddv.exe149⤵PID:1700
-
\??\c:\rllxrrl.exec:\rllxrrl.exe150⤵PID:3532
-
\??\c:\rlrrlll.exec:\rlrrlll.exe151⤵PID:3020
-
\??\c:\9hhnbn.exec:\9hhnbn.exe152⤵PID:3268
-
\??\c:\hbbthh.exec:\hbbthh.exe153⤵PID:3256
-
\??\c:\djpjd.exec:\djpjd.exe154⤵PID:3352
-
\??\c:\dvdvp.exec:\dvdvp.exe155⤵PID:4852
-
\??\c:\fxfllfx.exec:\fxfllfx.exe156⤵PID:964
-
\??\c:\xllfxxx.exec:\xllfxxx.exe157⤵PID:3220
-
\??\c:\tbtnhh.exec:\tbtnhh.exe158⤵PID:4912
-
\??\c:\3hbtnn.exec:\3hbtnn.exe159⤵PID:876
-
\??\c:\3vjpd.exec:\3vjpd.exe160⤵PID:2136
-
\??\c:\ddvvp.exec:\ddvvp.exe161⤵PID:3736
-
\??\c:\9xxrffx.exec:\9xxrffx.exe162⤵PID:428
-
\??\c:\tnhbtn.exec:\tnhbtn.exe163⤵PID:1308
-
\??\c:\7hhbnh.exec:\7hhbnh.exe164⤵PID:4128
-
\??\c:\jvvpd.exec:\jvvpd.exe165⤵PID:2544
-
\??\c:\jvvjv.exec:\jvvjv.exe166⤵PID:1768
-
\??\c:\xrlrxrx.exec:\xrlrxrx.exe167⤵PID:3956
-
\??\c:\hbbhbb.exec:\hbbhbb.exe168⤵PID:3380
-
\??\c:\bbtttt.exec:\bbtttt.exe169⤵PID:2040
-
\??\c:\vdvjv.exec:\vdvjv.exe170⤵PID:396
-
\??\c:\dvjvp.exec:\dvjvp.exe171⤵PID:4044
-
\??\c:\lxfxrlr.exec:\lxfxrlr.exe172⤵PID:2852
-
\??\c:\bnnhbb.exec:\bnnhbb.exe173⤵PID:2640
-
\??\c:\htnhbb.exec:\htnhbb.exe174⤵PID:2248
-
\??\c:\jvvpj.exec:\jvvpj.exe175⤵PID:4576
-
\??\c:\vjdvj.exec:\vjdvj.exe176⤵PID:4324
-
\??\c:\lxrrffx.exec:\lxrrffx.exe177⤵PID:1932
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe178⤵PID:4176
-
\??\c:\9htntt.exec:\9htntt.exe179⤵PID:4052
-
\??\c:\tnttnh.exec:\tnttnh.exe180⤵PID:1144
-
\??\c:\vpvpv.exec:\vpvpv.exe181⤵PID:4724
-
\??\c:\pdpjv.exec:\pdpjv.exe182⤵PID:5024
-
\??\c:\fllflfx.exec:\fllflfx.exe183⤵PID:1988
-
\??\c:\5ffxllf.exec:\5ffxllf.exe184⤵PID:4164
-
\??\c:\tnhbbt.exec:\tnhbbt.exe185⤵PID:4880
-
\??\c:\nhnhnn.exec:\nhnhnn.exe186⤵PID:1096
-
\??\c:\jddvd.exec:\jddvd.exe187⤵PID:3472
-
\??\c:\pjjdv.exec:\pjjdv.exe188⤵PID:1432
-
\??\c:\xrxxfrl.exec:\xrxxfrl.exe189⤵PID:3912
-
\??\c:\xrllfff.exec:\xrllfff.exe190⤵PID:3352
-
\??\c:\7nttbb.exec:\7nttbb.exe191⤵PID:4852
-
\??\c:\9hnbnh.exec:\9hnbnh.exe192⤵PID:964
-
\??\c:\9jjdp.exec:\9jjdp.exe193⤵PID:4440
-
\??\c:\pvvpj.exec:\pvvpj.exe194⤵PID:4912
-
\??\c:\frrrffx.exec:\frrrffx.exe195⤵PID:3508
-
\??\c:\5rrrffx.exec:\5rrrffx.exe196⤵PID:824
-
\??\c:\1tbbtt.exec:\1tbbtt.exe197⤵PID:2412
-
\??\c:\ntbntn.exec:\ntbntn.exe198⤵PID:3140
-
\??\c:\7ttnhh.exec:\7ttnhh.exe199⤵PID:368
-
\??\c:\5vjdv.exec:\5vjdv.exe200⤵PID:1056
-
\??\c:\rrrfrlx.exec:\rrrfrlx.exe201⤵PID:2132
-
\??\c:\frrrlfx.exec:\frrrlfx.exe202⤵PID:4340
-
\??\c:\tnnnhh.exec:\tnnnhh.exe203⤵PID:2304
-
\??\c:\ntttnn.exec:\ntttnn.exe204⤵PID:4232
-
\??\c:\ppvpj.exec:\ppvpj.exe205⤵PID:1984
-
\??\c:\vpdpp.exec:\vpdpp.exe206⤵PID:328
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe207⤵PID:1616
-
\??\c:\rlrlfff.exec:\rlrlfff.exe208⤵PID:3828
-
\??\c:\tnnnhh.exec:\tnnnhh.exe209⤵PID:2640
-
\??\c:\bbtnnt.exec:\bbtnnt.exe210⤵PID:3544
-
\??\c:\pvvvj.exec:\pvvvj.exe211⤵PID:2480
-
\??\c:\xrrlxxf.exec:\xrrlxxf.exe212⤵PID:3920
-
\??\c:\frrlfff.exec:\frrlfff.exe213⤵PID:4212
-
\??\c:\bntttt.exec:\bntttt.exe214⤵PID:3200
-
\??\c:\7bhbnn.exec:\7bhbnn.exe215⤵PID:3648
-
\??\c:\jpppj.exec:\jpppj.exe216⤵PID:4392
-
\??\c:\1dvvp.exec:\1dvvp.exe217⤵PID:1764
-
\??\c:\xrlrlxf.exec:\xrlrlxf.exe218⤵PID:3340
-
\??\c:\frfxllx.exec:\frfxllx.exe219⤵PID:4488
-
\??\c:\ttbtnh.exec:\ttbtnh.exe220⤵PID:4732
-
\??\c:\9jdvp.exec:\9jdvp.exe221⤵PID:464
-
\??\c:\rrxlxrf.exec:\rrxlxrf.exe222⤵PID:1740
-
\??\c:\vpppj.exec:\vpppj.exe223⤵PID:1052
-
\??\c:\rlffrrr.exec:\rlffrrr.exe224⤵PID:4500
-
\??\c:\nbttnh.exec:\nbttnh.exe225⤵PID:3472
-
\??\c:\dvjpv.exec:\dvjpv.exe226⤵PID:3256
-
\??\c:\lrxrxxf.exec:\lrxrxxf.exe227⤵PID:4008
-
\??\c:\hbttnb.exec:\hbttnb.exe228⤵PID:952
-
\??\c:\dvjpv.exec:\dvjpv.exe229⤵PID:4224
-
\??\c:\xxrlllf.exec:\xxrlllf.exe230⤵PID:3220
-
\??\c:\tnnnnn.exec:\tnnnnn.exe231⤵PID:3668
-
\??\c:\jpjdv.exec:\jpjdv.exe232⤵PID:668
-
\??\c:\pjdjd.exec:\pjdjd.exe233⤵PID:1820
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe234⤵PID:3624
-
\??\c:\rxfllll.exec:\rxfllll.exe235⤵PID:1396
-
\??\c:\5tbbnn.exec:\5tbbnn.exe236⤵PID:3140
-
\??\c:\hntnnt.exec:\hntnnt.exe237⤵PID:3776
-
\??\c:\pjvpj.exec:\pjvpj.exe238⤵PID:2028
-
\??\c:\frxlxrl.exec:\frxlxrl.exe239⤵PID:3796
-
\??\c:\lflrrrr.exec:\lflrrrr.exe240⤵PID:3380
-
\??\c:\hbnnhh.exec:\hbnnhh.exe241⤵PID:804
-
\??\c:\1tnhbb.exec:\1tnhbb.exe242⤵PID:4956