Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 06:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
91830d201985557fde2087a57907a600_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
91830d201985557fde2087a57907a600_NeikiAnalytics.exe
-
Size
67KB
-
MD5
91830d201985557fde2087a57907a600
-
SHA1
5bb4fdfaafdcb5085c564b548eab1577128ade3e
-
SHA256
9904addaaf653d3f5cf8db1a2fdf63e74beacc5f3f8182ac06c0e7772e7ae5e5
-
SHA512
b975a47318da6c50fc00675805308fd62c0a92d920813636c9e8fa20cea2db50d624b53307394a81405d2aa1f3160ae27ea2acd90c2418097dcd1cbbdb3b628d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvPrgpXn6G:ymb3NkkiQ3mdBjF0yMlwrbG
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/3748-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2092-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/940-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3868-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bbttnn.exevdpdj.exevjvpp.exerlrlrlr.exebhtnhh.exebnhtnn.exejvvvp.exe5rfrlff.exerlxxfxf.exebnnhbb.exejddvp.exexrxxrrx.exeflllrxl.exe5tbtnh.exe1ppjd.exepvvvj.exe7rxrlff.exennhbbb.exe1ddjv.exepjjvj.exelfffxxr.exehtnnhh.exejddvp.exedpjpp.exerlllxxr.exebtbthb.exepdvpj.exe7vjvj.exe5fflrrr.exe9hhbtn.exevvjjd.exe9frrxxx.exe5nttnn.exepvddv.exefxrlxxr.exenbnhhh.exejppjd.exe3xxrffx.exejvpjd.exerrfxffr.exefrrrrrl.exehttnhh.exexfxlffr.exebbhhhh.exetttnbt.exepdvjp.exeffffxrl.exenhbbtt.exetntnbb.exevdppj.exedpjjd.exerlxrffx.exelfxrrlf.exenhnbbb.exe9tthtn.exejpvpp.exejdjvv.exefllxlfx.exexllxrrl.exebnnhbb.exe3bnbtn.exejvjdv.exefrxrffl.exelrrlfxr.exepid process 3880 bbttnn.exe 3928 vdpdj.exe 2396 vjvpp.exe 4132 rlrlrlr.exe 1540 bhtnhh.exe 4500 bnhtnn.exe 4232 jvvvp.exe 1872 5rfrlff.exe 1712 rlxxfxf.exe 3024 bnnhbb.exe 3004 jddvp.exe 2092 xrxxrrx.exe 4924 flllrxl.exe 4900 5tbtnh.exe 4060 1ppjd.exe 1480 pvvvj.exe 1064 7rxrlff.exe 4880 nnhbbb.exe 1372 1ddjv.exe 2200 pjjvj.exe 4932 lfffxxr.exe 3496 htnnhh.exe 4136 jddvp.exe 2880 dpjpp.exe 1552 rlllxxr.exe 2684 btbthb.exe 4892 pdvpj.exe 940 7vjvj.exe 448 5fflrrr.exe 3868 9hhbtn.exe 2968 vvjjd.exe 404 9frrxxx.exe 4596 5nttnn.exe 4612 pvddv.exe 4440 fxrlxxr.exe 4264 nbnhhh.exe 4384 jppjd.exe 2320 3xxrffx.exe 4508 jvpjd.exe 4112 rrfxffr.exe 4032 frrrrrl.exe 4648 httnhh.exe 3192 xfxlffr.exe 3608 bbhhhh.exe 2316 tttnbt.exe 744 pdvjp.exe 4128 ffffxrl.exe 4100 nhbbtt.exe 3164 tntnbb.exe 4272 vdppj.exe 1772 dpjjd.exe 4568 rlxrffx.exe 4680 lfxrrlf.exe 4228 nhnbbb.exe 2208 9tthtn.exe 1608 jpvpp.exe 1872 jdjvv.exe 512 fllxlfx.exe 1488 xllxrrl.exe 4292 bnnhbb.exe 2576 3bnbtn.exe 2904 jvjdv.exe 3620 frxrffl.exe 4704 lrrlfxr.exe -
Processes:
resource yara_rule behavioral2/memory/3748-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3868-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
91830d201985557fde2087a57907a600_NeikiAnalytics.exebbttnn.exevdpdj.exevjvpp.exerlrlrlr.exebhtnhh.exebnhtnn.exejvvvp.exe5rfrlff.exerlxxfxf.exebnnhbb.exejddvp.exexrxxrrx.exeflllrxl.exe5tbtnh.exe1ppjd.exepvvvj.exe7rxrlff.exennhbbb.exe1ddjv.exepjjvj.exelfffxxr.exedescription pid process target process PID 3748 wrote to memory of 3880 3748 91830d201985557fde2087a57907a600_NeikiAnalytics.exe bbttnn.exe PID 3748 wrote to memory of 3880 3748 91830d201985557fde2087a57907a600_NeikiAnalytics.exe bbttnn.exe PID 3748 wrote to memory of 3880 3748 91830d201985557fde2087a57907a600_NeikiAnalytics.exe bbttnn.exe PID 3880 wrote to memory of 3928 3880 bbttnn.exe vdpdj.exe PID 3880 wrote to memory of 3928 3880 bbttnn.exe vdpdj.exe PID 3880 wrote to memory of 3928 3880 bbttnn.exe vdpdj.exe PID 3928 wrote to memory of 2396 3928 vdpdj.exe vjvpp.exe PID 3928 wrote to memory of 2396 3928 vdpdj.exe vjvpp.exe PID 3928 wrote to memory of 2396 3928 vdpdj.exe vjvpp.exe PID 2396 wrote to memory of 4132 2396 vjvpp.exe rlrlrlr.exe PID 2396 wrote to memory of 4132 2396 vjvpp.exe rlrlrlr.exe PID 2396 wrote to memory of 4132 2396 vjvpp.exe rlrlrlr.exe PID 4132 wrote to memory of 1540 4132 rlrlrlr.exe bhtnhh.exe PID 4132 wrote to memory of 1540 4132 rlrlrlr.exe bhtnhh.exe PID 4132 wrote to memory of 1540 4132 rlrlrlr.exe bhtnhh.exe PID 1540 wrote to memory of 4500 1540 bhtnhh.exe bnhtnn.exe PID 1540 wrote to memory of 4500 1540 bhtnhh.exe bnhtnn.exe PID 1540 wrote to memory of 4500 1540 bhtnhh.exe bnhtnn.exe PID 4500 wrote to memory of 4232 4500 bnhtnn.exe jvvvp.exe PID 4500 wrote to memory of 4232 4500 bnhtnn.exe jvvvp.exe PID 4500 wrote to memory of 4232 4500 bnhtnn.exe jvvvp.exe PID 4232 wrote to memory of 1872 4232 jvvvp.exe 5rfrlff.exe PID 4232 wrote to memory of 1872 4232 jvvvp.exe 5rfrlff.exe PID 4232 wrote to memory of 1872 4232 jvvvp.exe 5rfrlff.exe PID 1872 wrote to memory of 1712 1872 5rfrlff.exe rlxxfxf.exe PID 1872 wrote to memory of 1712 1872 5rfrlff.exe rlxxfxf.exe PID 1872 wrote to memory of 1712 1872 5rfrlff.exe rlxxfxf.exe PID 1712 wrote to memory of 3024 1712 rlxxfxf.exe bnnhbb.exe PID 1712 wrote to memory of 3024 1712 rlxxfxf.exe bnnhbb.exe PID 1712 wrote to memory of 3024 1712 rlxxfxf.exe bnnhbb.exe PID 3024 wrote to memory of 3004 3024 bnnhbb.exe jddvp.exe PID 3024 wrote to memory of 3004 3024 bnnhbb.exe jddvp.exe PID 3024 wrote to memory of 3004 3024 bnnhbb.exe jddvp.exe PID 3004 wrote to memory of 2092 3004 jddvp.exe xrxxrrx.exe PID 3004 wrote to memory of 2092 3004 jddvp.exe xrxxrrx.exe PID 3004 wrote to memory of 2092 3004 jddvp.exe xrxxrrx.exe PID 2092 wrote to memory of 4924 2092 xrxxrrx.exe flllrxl.exe PID 2092 wrote to memory of 4924 2092 xrxxrrx.exe flllrxl.exe PID 2092 wrote to memory of 4924 2092 xrxxrrx.exe flllrxl.exe PID 4924 wrote to memory of 4900 4924 flllrxl.exe 5tbtnh.exe PID 4924 wrote to memory of 4900 4924 flllrxl.exe 5tbtnh.exe PID 4924 wrote to memory of 4900 4924 flllrxl.exe 5tbtnh.exe PID 4900 wrote to memory of 4060 4900 5tbtnh.exe 1ppjd.exe PID 4900 wrote to memory of 4060 4900 5tbtnh.exe 1ppjd.exe PID 4900 wrote to memory of 4060 4900 5tbtnh.exe 1ppjd.exe PID 4060 wrote to memory of 1480 4060 1ppjd.exe pvvvj.exe PID 4060 wrote to memory of 1480 4060 1ppjd.exe pvvvj.exe PID 4060 wrote to memory of 1480 4060 1ppjd.exe pvvvj.exe PID 1480 wrote to memory of 1064 1480 pvvvj.exe 7rxrlff.exe PID 1480 wrote to memory of 1064 1480 pvvvj.exe 7rxrlff.exe PID 1480 wrote to memory of 1064 1480 pvvvj.exe 7rxrlff.exe PID 1064 wrote to memory of 4880 1064 7rxrlff.exe nnhbbb.exe PID 1064 wrote to memory of 4880 1064 7rxrlff.exe nnhbbb.exe PID 1064 wrote to memory of 4880 1064 7rxrlff.exe nnhbbb.exe PID 4880 wrote to memory of 1372 4880 nnhbbb.exe 1ddjv.exe PID 4880 wrote to memory of 1372 4880 nnhbbb.exe 1ddjv.exe PID 4880 wrote to memory of 1372 4880 nnhbbb.exe 1ddjv.exe PID 1372 wrote to memory of 2200 1372 1ddjv.exe pjjvj.exe PID 1372 wrote to memory of 2200 1372 1ddjv.exe pjjvj.exe PID 1372 wrote to memory of 2200 1372 1ddjv.exe pjjvj.exe PID 2200 wrote to memory of 4932 2200 pjjvj.exe lfffxxr.exe PID 2200 wrote to memory of 4932 2200 pjjvj.exe lfffxxr.exe PID 2200 wrote to memory of 4932 2200 pjjvj.exe lfffxxr.exe PID 4932 wrote to memory of 3496 4932 lfffxxr.exe htnnhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91830d201985557fde2087a57907a600_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\91830d201985557fde2087a57907a600_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\bbttnn.exec:\bbttnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\vdpdj.exec:\vdpdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\vjvpp.exec:\vjvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\rlrlrlr.exec:\rlrlrlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\bhtnhh.exec:\bhtnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\bnhtnn.exec:\bnhtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\jvvvp.exec:\jvvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\5rfrlff.exec:\5rfrlff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\rlxxfxf.exec:\rlxxfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\bnnhbb.exec:\bnnhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\jddvp.exec:\jddvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\xrxxrrx.exec:\xrxxrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\flllrxl.exec:\flllrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\5tbtnh.exec:\5tbtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\1ppjd.exec:\1ppjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\pvvvj.exec:\pvvvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\7rxrlff.exec:\7rxrlff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\nnhbbb.exec:\nnhbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\1ddjv.exec:\1ddjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\pjjvj.exec:\pjjvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\lfffxxr.exec:\lfffxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\htnnhh.exec:\htnnhh.exe23⤵
- Executes dropped EXE
PID:3496 -
\??\c:\jddvp.exec:\jddvp.exe24⤵
- Executes dropped EXE
PID:4136 -
\??\c:\dpjpp.exec:\dpjpp.exe25⤵
- Executes dropped EXE
PID:2880 -
\??\c:\rlllxxr.exec:\rlllxxr.exe26⤵
- Executes dropped EXE
PID:1552 -
\??\c:\btbthb.exec:\btbthb.exe27⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pdvpj.exec:\pdvpj.exe28⤵
- Executes dropped EXE
PID:4892 -
\??\c:\7vjvj.exec:\7vjvj.exe29⤵
- Executes dropped EXE
PID:940 -
\??\c:\5fflrrr.exec:\5fflrrr.exe30⤵
- Executes dropped EXE
PID:448 -
\??\c:\9hhbtn.exec:\9hhbtn.exe31⤵
- Executes dropped EXE
PID:3868 -
\??\c:\vvjjd.exec:\vvjjd.exe32⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9frrxxx.exec:\9frrxxx.exe33⤵
- Executes dropped EXE
PID:404 -
\??\c:\5nttnn.exec:\5nttnn.exe34⤵
- Executes dropped EXE
PID:4596 -
\??\c:\pvddv.exec:\pvddv.exe35⤵
- Executes dropped EXE
PID:4612 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe36⤵
- Executes dropped EXE
PID:4440 -
\??\c:\nbnhhh.exec:\nbnhhh.exe37⤵
- Executes dropped EXE
PID:4264 -
\??\c:\jppjd.exec:\jppjd.exe38⤵
- Executes dropped EXE
PID:4384 -
\??\c:\3xxrffx.exec:\3xxrffx.exe39⤵
- Executes dropped EXE
PID:2320 -
\??\c:\jvpjd.exec:\jvpjd.exe40⤵
- Executes dropped EXE
PID:4508 -
\??\c:\rrfxffr.exec:\rrfxffr.exe41⤵
- Executes dropped EXE
PID:4112 -
\??\c:\frrrrrl.exec:\frrrrrl.exe42⤵
- Executes dropped EXE
PID:4032 -
\??\c:\httnhh.exec:\httnhh.exe43⤵
- Executes dropped EXE
PID:4648 -
\??\c:\xfxlffr.exec:\xfxlffr.exe44⤵
- Executes dropped EXE
PID:3192 -
\??\c:\bbhhhh.exec:\bbhhhh.exe45⤵
- Executes dropped EXE
PID:3608 -
\??\c:\tttnbt.exec:\tttnbt.exe46⤵
- Executes dropped EXE
PID:2316 -
\??\c:\pdvjp.exec:\pdvjp.exe47⤵
- Executes dropped EXE
PID:744 -
\??\c:\ffffxrl.exec:\ffffxrl.exe48⤵
- Executes dropped EXE
PID:4128 -
\??\c:\nhbbtt.exec:\nhbbtt.exe49⤵
- Executes dropped EXE
PID:4100 -
\??\c:\tntnbb.exec:\tntnbb.exe50⤵
- Executes dropped EXE
PID:3164 -
\??\c:\vdppj.exec:\vdppj.exe51⤵
- Executes dropped EXE
PID:4272 -
\??\c:\dpjjd.exec:\dpjjd.exe52⤵
- Executes dropped EXE
PID:1772 -
\??\c:\rlxrffx.exec:\rlxrffx.exe53⤵
- Executes dropped EXE
PID:4568 -
\??\c:\lfxrrlf.exec:\lfxrrlf.exe54⤵
- Executes dropped EXE
PID:4680 -
\??\c:\nhnbbb.exec:\nhnbbb.exe55⤵
- Executes dropped EXE
PID:4228 -
\??\c:\9tthtn.exec:\9tthtn.exe56⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jpvpp.exec:\jpvpp.exe57⤵
- Executes dropped EXE
PID:1608 -
\??\c:\jdjvv.exec:\jdjvv.exe58⤵
- Executes dropped EXE
PID:1872 -
\??\c:\fllxlfx.exec:\fllxlfx.exe59⤵
- Executes dropped EXE
PID:512 -
\??\c:\xllxrrl.exec:\xllxrrl.exe60⤵
- Executes dropped EXE
PID:1488 -
\??\c:\bnnhbb.exec:\bnnhbb.exe61⤵
- Executes dropped EXE
PID:4292 -
\??\c:\3bnbtn.exec:\3bnbtn.exe62⤵
- Executes dropped EXE
PID:2576 -
\??\c:\jvjdv.exec:\jvjdv.exe63⤵
- Executes dropped EXE
PID:2904 -
\??\c:\frxrffl.exec:\frxrffl.exe64⤵
- Executes dropped EXE
PID:3620 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe65⤵
- Executes dropped EXE
PID:4704 -
\??\c:\7bbnhh.exec:\7bbnhh.exe66⤵PID:2328
-
\??\c:\7jvjj.exec:\7jvjj.exe67⤵PID:4900
-
\??\c:\dvdpv.exec:\dvdpv.exe68⤵PID:5060
-
\??\c:\rxxxlll.exec:\rxxxlll.exe69⤵PID:2132
-
\??\c:\fxxrlrl.exec:\fxxrlrl.exe70⤵PID:3616
-
\??\c:\hbnhbb.exec:\hbnhbb.exe71⤵PID:4880
-
\??\c:\dvdpj.exec:\dvdpj.exe72⤵PID:1372
-
\??\c:\fxlrlff.exec:\fxlrlff.exe73⤵PID:3384
-
\??\c:\lrxrxrl.exec:\lrxrxrl.exe74⤵PID:4668
-
\??\c:\bbtthh.exec:\bbtthh.exe75⤵PID:3932
-
\??\c:\lffffll.exec:\lffffll.exe76⤵PID:720
-
\??\c:\bthhbh.exec:\bthhbh.exe77⤵PID:4136
-
\??\c:\hhbthh.exec:\hhbthh.exe78⤵PID:3836
-
\??\c:\pjdvd.exec:\pjdvd.exe79⤵PID:1980
-
\??\c:\pjvpp.exec:\pjvpp.exe80⤵PID:4020
-
\??\c:\llxxflr.exec:\llxxflr.exe81⤵PID:4572
-
\??\c:\xlflrxl.exec:\xlflrxl.exe82⤵PID:1324
-
\??\c:\9hbhbb.exec:\9hbhbb.exe83⤵PID:2184
-
\??\c:\3vvpd.exec:\3vvpd.exe84⤵PID:1708
-
\??\c:\jdddp.exec:\jdddp.exe85⤵PID:60
-
\??\c:\xfrrlrl.exec:\xfrrlrl.exe86⤵PID:2920
-
\??\c:\ttbbtt.exec:\ttbbtt.exe87⤵PID:3216
-
\??\c:\hbtnhh.exec:\hbtnhh.exe88⤵PID:2300
-
\??\c:\9dppd.exec:\9dppd.exe89⤵PID:2788
-
\??\c:\pdvpv.exec:\pdvpv.exe90⤵PID:3692
-
\??\c:\fxxrllf.exec:\fxxrllf.exe91⤵PID:2808
-
\??\c:\frrfxrl.exec:\frrfxrl.exe92⤵PID:4440
-
\??\c:\9hnnhh.exec:\9hnnhh.exe93⤵PID:2784
-
\??\c:\jvdvp.exec:\jvdvp.exe94⤵PID:4908
-
\??\c:\pddpd.exec:\pddpd.exe95⤵PID:2912
-
\??\c:\rrfxrff.exec:\rrfxrff.exe96⤵PID:3668
-
\??\c:\thnnhb.exec:\thnnhb.exe97⤵PID:1416
-
\??\c:\tnnnbb.exec:\tnnnbb.exe98⤵PID:348
-
\??\c:\vjjdv.exec:\vjjdv.exe99⤵PID:4956
-
\??\c:\xlxlxrf.exec:\xlxlxrf.exe100⤵PID:4360
-
\??\c:\lffxllf.exec:\lffxllf.exe101⤵PID:388
-
\??\c:\hnhhbb.exec:\hnhhbb.exe102⤵PID:3548
-
\??\c:\3dvpd.exec:\3dvpd.exe103⤵PID:5024
-
\??\c:\vpjpj.exec:\vpjpj.exe104⤵PID:4520
-
\??\c:\xrrxrxr.exec:\xrrxrxr.exe105⤵PID:3908
-
\??\c:\rlxffff.exec:\rlxffff.exe106⤵PID:868
-
\??\c:\htnhbb.exec:\htnhbb.exe107⤵PID:4808
-
\??\c:\bnbtnt.exec:\bnbtnt.exe108⤵PID:624
-
\??\c:\thbttt.exec:\thbttt.exe109⤵PID:4008
-
\??\c:\jvjdv.exec:\jvjdv.exe110⤵PID:4004
-
\??\c:\5dddv.exec:\5dddv.exe111⤵PID:2000
-
\??\c:\7rxfxrl.exec:\7rxfxrl.exe112⤵PID:896
-
\??\c:\frxlffx.exec:\frxlffx.exe113⤵PID:1316
-
\??\c:\hbtnhh.exec:\hbtnhh.exe114⤵PID:2056
-
\??\c:\hbnhbb.exec:\hbnhbb.exe115⤵PID:3620
-
\??\c:\pjpjd.exec:\pjpjd.exe116⤵PID:4704
-
\??\c:\dvpjd.exec:\dvpjd.exe117⤵PID:2328
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe118⤵PID:3116
-
\??\c:\rlrfllr.exec:\rlrfllr.exe119⤵PID:1388
-
\??\c:\7rrlffx.exec:\7rrlffx.exe120⤵PID:3844
-
\??\c:\jjvpj.exec:\jjvpj.exe121⤵PID:2332
-
\??\c:\dvvpj.exec:\dvvpj.exe122⤵PID:2176
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe123⤵PID:4944
-
\??\c:\hbbttt.exec:\hbbttt.exe124⤵PID:2160
-
\??\c:\3nnhbn.exec:\3nnhbn.exe125⤵PID:5096
-
\??\c:\vjjjj.exec:\vjjjj.exe126⤵PID:5004
-
\??\c:\hbnnbb.exec:\hbnnbb.exe127⤵PID:4344
-
\??\c:\nbnnnn.exec:\nbnnnn.exe128⤵PID:1044
-
\??\c:\dvvpj.exec:\dvvpj.exe129⤵PID:2424
-
\??\c:\ddvvp.exec:\ddvvp.exe130⤵PID:4504
-
\??\c:\frfxllf.exec:\frfxllf.exe131⤵PID:996
-
\??\c:\nbbbtt.exec:\nbbbtt.exe132⤵PID:1216
-
\??\c:\dvvpj.exec:\dvvpj.exe133⤵PID:4700
-
\??\c:\rffxllf.exec:\rffxllf.exe134⤵PID:432
-
\??\c:\bntttt.exec:\bntttt.exe135⤵PID:768
-
\??\c:\7bnnhh.exec:\7bnnhh.exe136⤵PID:2012
-
\??\c:\7vpjd.exec:\7vpjd.exe137⤵PID:1644
-
\??\c:\rlfxlfx.exec:\rlfxlfx.exe138⤵PID:5092
-
\??\c:\5xffllx.exec:\5xffllx.exe139⤵PID:4912
-
\??\c:\9ntnhh.exec:\9ntnhh.exe140⤵PID:3600
-
\??\c:\5ddvp.exec:\5ddvp.exe141⤵PID:3108
-
\??\c:\vpjdp.exec:\vpjdp.exe142⤵PID:3448
-
\??\c:\llrrrfx.exec:\llrrrfx.exe143⤵PID:2672
-
\??\c:\nhbhhh.exec:\nhbhhh.exe144⤵PID:4348
-
\??\c:\thbbtt.exec:\thbbtt.exe145⤵PID:2712
-
\??\c:\jjpjd.exec:\jjpjd.exe146⤵PID:4856
-
\??\c:\xfxxlrr.exec:\xfxxlrr.exe147⤵PID:4720
-
\??\c:\fxxrllf.exec:\fxxrllf.exe148⤵PID:216
-
\??\c:\nhhnnh.exec:\nhhnnh.exe149⤵PID:4896
-
\??\c:\btnhhh.exec:\btnhhh.exe150⤵PID:4368
-
\??\c:\vpjdp.exec:\vpjdp.exe151⤵PID:2316
-
\??\c:\frlfrlf.exec:\frlfrlf.exe152⤵PID:2088
-
\??\c:\1rlxxfx.exec:\1rlxxfx.exe153⤵PID:5024
-
\??\c:\tnhbtn.exec:\tnhbtn.exe154⤵PID:4364
-
\??\c:\bbhtnn.exec:\bbhtnn.exe155⤵PID:3908
-
\??\c:\vppjv.exec:\vppjv.exe156⤵PID:4816
-
\??\c:\xlxrlxx.exec:\xlxrlxx.exe157⤵PID:3236
-
\??\c:\xfrrxxr.exec:\xfrrxxr.exe158⤵PID:4228
-
\??\c:\bntnhh.exec:\bntnhh.exe159⤵PID:1220
-
\??\c:\btnnbb.exec:\btnnbb.exe160⤵PID:1712
-
\??\c:\jdpdj.exec:\jdpdj.exe161⤵PID:4992
-
\??\c:\jvpjv.exec:\jvpjv.exe162⤵PID:3004
-
\??\c:\lxlxlff.exec:\lxlxlff.exe163⤵PID:896
-
\??\c:\5rfxxxf.exec:\5rfxxxf.exe164⤵PID:536
-
\??\c:\tbbhbb.exec:\tbbhbb.exe165⤵PID:2496
-
\??\c:\1bbthh.exec:\1bbthh.exe166⤵PID:3596
-
\??\c:\jpvvj.exec:\jpvvj.exe167⤵PID:1664
-
\??\c:\7llfrrl.exec:\7llfrrl.exe168⤵PID:2916
-
\??\c:\btbhnn.exec:\btbhnn.exe169⤵PID:1480
-
\??\c:\hhtthh.exec:\hhtthh.exe170⤵PID:4056
-
\??\c:\jddvj.exec:\jddvj.exe171⤵PID:4560
-
\??\c:\jpdvj.exec:\jpdvj.exe172⤵PID:2936
-
\??\c:\frxrlff.exec:\frxrlff.exe173⤵PID:1484
-
\??\c:\rrxlffx.exec:\rrxlffx.exe174⤵PID:4916
-
\??\c:\5hbbnn.exec:\5hbbnn.exe175⤵PID:4696
-
\??\c:\pdpvj.exec:\pdpvj.exe176⤵PID:3996
-
\??\c:\frfxrrr.exec:\frfxrrr.exe177⤵PID:2880
-
\??\c:\lrlxrlf.exec:\lrlxrlf.exe178⤵PID:1648
-
\??\c:\hbhtbt.exec:\hbhtbt.exe179⤵PID:2752
-
\??\c:\3tbthh.exec:\3tbthh.exe180⤵PID:3916
-
\??\c:\pvppj.exec:\pvppj.exe181⤵PID:792
-
\??\c:\vvpjj.exec:\vvpjj.exe182⤵PID:4400
-
\??\c:\rxfxllf.exec:\rxfxllf.exe183⤵PID:448
-
\??\c:\nhbbnn.exec:\nhbbnn.exe184⤵PID:2556
-
\??\c:\nnnhbb.exec:\nnnhbb.exe185⤵PID:3868
-
\??\c:\vdjdp.exec:\vdjdp.exe186⤵PID:2920
-
\??\c:\pdjdp.exec:\pdjdp.exe187⤵PID:4664
-
\??\c:\rlfrxxf.exec:\rlfrxxf.exe188⤵PID:4596
-
\??\c:\fxlfrrx.exec:\fxlfrrx.exe189⤵PID:4612
-
\??\c:\nntbtn.exec:\nntbtn.exe190⤵PID:4372
-
\??\c:\hthttt.exec:\hthttt.exe191⤵PID:4264
-
\??\c:\9vpjv.exec:\9vpjv.exe192⤵PID:4824
-
\??\c:\xrrxlfx.exec:\xrrxlfx.exe193⤵PID:2428
-
\??\c:\lflflll.exec:\lflflll.exe194⤵PID:4508
-
\??\c:\3bbnhb.exec:\3bbnhb.exe195⤵PID:3656
-
\??\c:\5dddv.exec:\5dddv.exe196⤵PID:1156
-
\??\c:\ddjdp.exec:\ddjdp.exe197⤵PID:4452
-
\??\c:\lfllfll.exec:\lfllfll.exe198⤵PID:4968
-
\??\c:\xlrlffr.exec:\xlrlffr.exe199⤵PID:5076
-
\??\c:\hbnhhh.exec:\hbnhhh.exe200⤵PID:2540
-
\??\c:\hbbbbb.exec:\hbbbbb.exe201⤵PID:3880
-
\??\c:\vddjd.exec:\vddjd.exe202⤵PID:4972
-
\??\c:\9xrlrrf.exec:\9xrlrrf.exe203⤵PID:5024
-
\??\c:\lxflxxl.exec:\lxflxxl.exe204⤵PID:988
-
\??\c:\nnnnhb.exec:\nnnnhb.exe205⤵PID:1600
-
\??\c:\hnhhbb.exec:\hnhhbb.exe206⤵PID:4680
-
\??\c:\dpjdj.exec:\dpjdj.exe207⤵PID:2164
-
\??\c:\jpjjd.exec:\jpjjd.exe208⤵PID:1608
-
\??\c:\xffxllx.exec:\xffxllx.exe209⤵PID:2960
-
\??\c:\lrrlffx.exec:\lrrlffx.exe210⤵PID:3348
-
\??\c:\tnhbtn.exec:\tnhbtn.exe211⤵PID:2576
-
\??\c:\nntbtt.exec:\nntbtt.exe212⤵PID:3976
-
\??\c:\pjdjd.exec:\pjdjd.exe213⤵PID:2092
-
\??\c:\vdjdp.exec:\vdjdp.exe214⤵PID:3720
-
\??\c:\lffrlxr.exec:\lffrlxr.exe215⤵PID:3204
-
\??\c:\nbtttt.exec:\nbtttt.exe216⤵PID:5056
-
\??\c:\htnhbb.exec:\htnhbb.exe217⤵PID:5060
-
\??\c:\tttnnn.exec:\tttnnn.exe218⤵PID:4108
-
\??\c:\jjdjv.exec:\jjdjv.exe219⤵PID:1124
-
\??\c:\ppvpd.exec:\ppvpd.exe220⤵PID:2200
-
\??\c:\rrfxffx.exec:\rrfxffx.exe221⤵PID:2936
-
\??\c:\hhhbtt.exec:\hhhbtt.exe222⤵PID:2160
-
\??\c:\ttnnnh.exec:\ttnnnh.exe223⤵PID:720
-
\??\c:\jppjv.exec:\jppjv.exe224⤵PID:2628
-
\??\c:\1pjdp.exec:\1pjdp.exe225⤵PID:4636
-
\??\c:\fxrlxxl.exec:\fxrlxxl.exe226⤵PID:1168
-
\??\c:\bnnhtn.exec:\bnnhtn.exe227⤵PID:1536
-
\??\c:\hnhbhb.exec:\hnhbhb.exe228⤵PID:4892
-
\??\c:\pdpvd.exec:\pdpvd.exe229⤵PID:940
-
\??\c:\ddddj.exec:\ddddj.exe230⤵PID:1324
-
\??\c:\xxlxlfx.exec:\xxlxlfx.exe231⤵PID:4700
-
\??\c:\frrlfxr.exec:\frrlfxr.exe232⤵PID:1708
-
\??\c:\thbthb.exec:\thbthb.exe233⤵PID:2124
-
\??\c:\5nbnbt.exec:\5nbnbt.exe234⤵PID:1888
-
\??\c:\5jjdv.exec:\5jjdv.exe235⤵PID:3324
-
\??\c:\djdpd.exec:\djdpd.exe236⤵PID:3028
-
\??\c:\rrlxrrr.exec:\rrlxrrr.exe237⤵PID:1968
-
\??\c:\nbhhhh.exec:\nbhhhh.exe238⤵PID:1396
-
\??\c:\nnnhtn.exec:\nnnhtn.exe239⤵PID:3600
-
\??\c:\1dvpd.exec:\1dvpd.exe240⤵PID:3108
-
\??\c:\xfffxfx.exec:\xfffxfx.exe241⤵PID:5032
-
\??\c:\xfxxfxf.exec:\xfxxfxf.exe242⤵PID:2672