Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 05:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
889979f8e2913b3a49a3881ef9fb8330_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
889979f8e2913b3a49a3881ef9fb8330_NeikiAnalytics.exe
-
Size
87KB
-
MD5
889979f8e2913b3a49a3881ef9fb8330
-
SHA1
bf7c49025291720c612b2f284e32ae93a617c832
-
SHA256
cb5eeb9fcb2a564867433bb7db921d9a1608095ae61f6e2dd299c8c78f4d6458
-
SHA512
eab71ca6111e7df5117b20cd172c02c19961a555b8bf1d8ce45689052a4ef17568a5b8ea72c117e691ec8dfc49ff233f65daf9eb0c98d8ee1740db87b04fdbfa
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2wV3jaCJ5jH3eT:ymb3NkkiQ3mdBjF+3TU2K3bJZXS
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/1100-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1876-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1592-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/672-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/676-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
btbbtt.exedjdvj.exerlrfrlf.exelxxrlfx.exe7nnbtn.exe9vppd.exejvdvv.exe1llrrrx.exelffrlfx.exe3ntnbh.exejpvpp.exellfrfxl.exe5nhhbb.exenbhthb.exeppppj.exexxfxrlr.exebnnbtn.exe1dddp.exedvjdp.exexxrfrlf.exelllxrlx.exe5hbthb.exepjvpj.exellfxllx.exebtnnbh.exe5pdvv.exexrrlxxx.exetbbtnn.exehbhtnt.exeddvpv.exevdpjd.exerfxrxrr.exejddvv.exevpdvj.exexfxrllf.exexrxrfxr.exe7nnnbn.exetbtttt.exe3pdvp.exe7rrlxrl.exe3hnbtt.exevdppj.exebhbthh.exe1pjdv.exehhtnbh.exehtnbtn.exexlrflxx.exe5bnttb.exepjjvj.exelfllffx.exentbbtn.exevvjvp.exefxxrlll.exebtnnhh.exenbbtbb.exedpdpp.exelfrlxxx.exefrlxlll.exenhtnbb.exebttnbb.exe7vvjd.exejjpdp.exexflxffx.exerlxrfxr.exepid process 4160 btbbtt.exe 1876 djdvj.exe 4840 rlrfrlf.exe 888 lxxrlfx.exe 2412 7nnbtn.exe 2940 9vppd.exe 3840 jvdvv.exe 3696 1llrrrx.exe 3768 lffrlfx.exe 1960 3ntnbh.exe 4464 jpvpp.exe 1380 llfrfxl.exe 1028 5nhhbb.exe 2404 nbhthb.exe 1696 ppppj.exe 2004 xxfxrlr.exe 1804 bnnbtn.exe 2028 1dddp.exe 1592 dvjdp.exe 4864 xxrfrlf.exe 4384 lllxrlx.exe 736 5hbthb.exe 4984 pjvpj.exe 3580 llfxllx.exe 4292 btnnbh.exe 3988 5pdvv.exe 672 xrrlxxx.exe 3620 tbbtnn.exe 3020 hbhtnt.exe 3968 ddvpv.exe 676 vdpjd.exe 4408 rfxrxrr.exe 4152 jddvv.exe 1488 vpdvj.exe 2512 xfxrllf.exe 2304 xrxrfxr.exe 3332 7nnnbn.exe 2312 tbtttt.exe 3060 3pdvp.exe 1104 7rrlxrl.exe 4664 3hnbtt.exe 4700 vdppj.exe 3304 bhbthh.exe 4640 1pjdv.exe 1064 hhtnbh.exe 3176 htnbtn.exe 2052 xlrflxx.exe 5036 5bnttb.exe 1668 pjjvj.exe 4160 lfllffx.exe 1876 ntbbtn.exe 4996 vvjvp.exe 3604 fxxrlll.exe 888 btnnhh.exe 440 nbbtbb.exe 3892 dpdpp.exe 2520 lfrlxxx.exe 1520 frlxlll.exe 1460 nhtnbb.exe 4512 bttnbb.exe 1572 7vvjd.exe 1960 jjpdp.exe 3676 xflxffx.exe 3912 rlxrfxr.exe -
Processes:
resource yara_rule behavioral2/memory/1100-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1876-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2404-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/672-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/676-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
889979f8e2913b3a49a3881ef9fb8330_NeikiAnalytics.exebtbbtt.exedjdvj.exerlrfrlf.exelxxrlfx.exe7nnbtn.exe9vppd.exejvdvv.exe1llrrrx.exelffrlfx.exe3ntnbh.exejpvpp.exellfrfxl.exe5nhhbb.exenbhthb.exeppppj.exexxfxrlr.exebnnbtn.exe1dddp.exedvjdp.exexxrfrlf.exelllxrlx.exedescription pid process target process PID 1100 wrote to memory of 4160 1100 889979f8e2913b3a49a3881ef9fb8330_NeikiAnalytics.exe btbbtt.exe PID 1100 wrote to memory of 4160 1100 889979f8e2913b3a49a3881ef9fb8330_NeikiAnalytics.exe btbbtt.exe PID 1100 wrote to memory of 4160 1100 889979f8e2913b3a49a3881ef9fb8330_NeikiAnalytics.exe btbbtt.exe PID 4160 wrote to memory of 1876 4160 btbbtt.exe djdvj.exe PID 4160 wrote to memory of 1876 4160 btbbtt.exe djdvj.exe PID 4160 wrote to memory of 1876 4160 btbbtt.exe djdvj.exe PID 1876 wrote to memory of 4840 1876 djdvj.exe rlrfrlf.exe PID 1876 wrote to memory of 4840 1876 djdvj.exe rlrfrlf.exe PID 1876 wrote to memory of 4840 1876 djdvj.exe rlrfrlf.exe PID 4840 wrote to memory of 888 4840 rlrfrlf.exe lxxrlfx.exe PID 4840 wrote to memory of 888 4840 rlrfrlf.exe lxxrlfx.exe PID 4840 wrote to memory of 888 4840 rlrfrlf.exe lxxrlfx.exe PID 888 wrote to memory of 2412 888 lxxrlfx.exe 7nnbtn.exe PID 888 wrote to memory of 2412 888 lxxrlfx.exe 7nnbtn.exe PID 888 wrote to memory of 2412 888 lxxrlfx.exe 7nnbtn.exe PID 2412 wrote to memory of 2940 2412 7nnbtn.exe 9vppd.exe PID 2412 wrote to memory of 2940 2412 7nnbtn.exe 9vppd.exe PID 2412 wrote to memory of 2940 2412 7nnbtn.exe 9vppd.exe PID 2940 wrote to memory of 3840 2940 9vppd.exe jvdvv.exe PID 2940 wrote to memory of 3840 2940 9vppd.exe jvdvv.exe PID 2940 wrote to memory of 3840 2940 9vppd.exe jvdvv.exe PID 3840 wrote to memory of 3696 3840 jvdvv.exe 1llrrrx.exe PID 3840 wrote to memory of 3696 3840 jvdvv.exe 1llrrrx.exe PID 3840 wrote to memory of 3696 3840 jvdvv.exe 1llrrrx.exe PID 3696 wrote to memory of 3768 3696 1llrrrx.exe lffrlfx.exe PID 3696 wrote to memory of 3768 3696 1llrrrx.exe lffrlfx.exe PID 3696 wrote to memory of 3768 3696 1llrrrx.exe lffrlfx.exe PID 3768 wrote to memory of 1960 3768 lffrlfx.exe 3ntnbh.exe PID 3768 wrote to memory of 1960 3768 lffrlfx.exe 3ntnbh.exe PID 3768 wrote to memory of 1960 3768 lffrlfx.exe 3ntnbh.exe PID 1960 wrote to memory of 4464 1960 3ntnbh.exe jpvpp.exe PID 1960 wrote to memory of 4464 1960 3ntnbh.exe jpvpp.exe PID 1960 wrote to memory of 4464 1960 3ntnbh.exe jpvpp.exe PID 4464 wrote to memory of 1380 4464 jpvpp.exe llfrfxl.exe PID 4464 wrote to memory of 1380 4464 jpvpp.exe llfrfxl.exe PID 4464 wrote to memory of 1380 4464 jpvpp.exe llfrfxl.exe PID 1380 wrote to memory of 1028 1380 llfrfxl.exe 5nhhbb.exe PID 1380 wrote to memory of 1028 1380 llfrfxl.exe 5nhhbb.exe PID 1380 wrote to memory of 1028 1380 llfrfxl.exe 5nhhbb.exe PID 1028 wrote to memory of 2404 1028 5nhhbb.exe nbhthb.exe PID 1028 wrote to memory of 2404 1028 5nhhbb.exe nbhthb.exe PID 1028 wrote to memory of 2404 1028 5nhhbb.exe nbhthb.exe PID 2404 wrote to memory of 1696 2404 nbhthb.exe ppppj.exe PID 2404 wrote to memory of 1696 2404 nbhthb.exe ppppj.exe PID 2404 wrote to memory of 1696 2404 nbhthb.exe ppppj.exe PID 1696 wrote to memory of 2004 1696 ppppj.exe xxfxrlr.exe PID 1696 wrote to memory of 2004 1696 ppppj.exe xxfxrlr.exe PID 1696 wrote to memory of 2004 1696 ppppj.exe xxfxrlr.exe PID 2004 wrote to memory of 1804 2004 xxfxrlr.exe bnnbtn.exe PID 2004 wrote to memory of 1804 2004 xxfxrlr.exe bnnbtn.exe PID 2004 wrote to memory of 1804 2004 xxfxrlr.exe bnnbtn.exe PID 1804 wrote to memory of 2028 1804 bnnbtn.exe 1dddp.exe PID 1804 wrote to memory of 2028 1804 bnnbtn.exe 1dddp.exe PID 1804 wrote to memory of 2028 1804 bnnbtn.exe 1dddp.exe PID 2028 wrote to memory of 1592 2028 1dddp.exe dvjdp.exe PID 2028 wrote to memory of 1592 2028 1dddp.exe dvjdp.exe PID 2028 wrote to memory of 1592 2028 1dddp.exe dvjdp.exe PID 1592 wrote to memory of 4864 1592 dvjdp.exe xxrfrlf.exe PID 1592 wrote to memory of 4864 1592 dvjdp.exe xxrfrlf.exe PID 1592 wrote to memory of 4864 1592 dvjdp.exe xxrfrlf.exe PID 4864 wrote to memory of 4384 4864 xxrfrlf.exe lllxrlx.exe PID 4864 wrote to memory of 4384 4864 xxrfrlf.exe lllxrlx.exe PID 4864 wrote to memory of 4384 4864 xxrfrlf.exe lllxrlx.exe PID 4384 wrote to memory of 736 4384 lllxrlx.exe 5hbthb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\889979f8e2913b3a49a3881ef9fb8330_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\889979f8e2913b3a49a3881ef9fb8330_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\btbbtt.exec:\btbbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\djdvj.exec:\djdvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\rlrfrlf.exec:\rlrfrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\7nnbtn.exec:\7nnbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\9vppd.exec:\9vppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\jvdvv.exec:\jvdvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\1llrrrx.exec:\1llrrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\lffrlfx.exec:\lffrlfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\3ntnbh.exec:\3ntnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\jpvpp.exec:\jpvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\llfrfxl.exec:\llfrfxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\5nhhbb.exec:\5nhhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\nbhthb.exec:\nbhthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\ppppj.exec:\ppppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\xxfxrlr.exec:\xxfxrlr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\bnnbtn.exec:\bnnbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\1dddp.exec:\1dddp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\dvjdp.exec:\dvjdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\xxrfrlf.exec:\xxrfrlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\lllxrlx.exec:\lllxrlx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\5hbthb.exec:\5hbthb.exe23⤵
- Executes dropped EXE
PID:736 -
\??\c:\pjvpj.exec:\pjvpj.exe24⤵
- Executes dropped EXE
PID:4984 -
\??\c:\llfxllx.exec:\llfxllx.exe25⤵
- Executes dropped EXE
PID:3580 -
\??\c:\btnnbh.exec:\btnnbh.exe26⤵
- Executes dropped EXE
PID:4292 -
\??\c:\5pdvv.exec:\5pdvv.exe27⤵
- Executes dropped EXE
PID:3988 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe28⤵
- Executes dropped EXE
PID:672 -
\??\c:\tbbtnn.exec:\tbbtnn.exe29⤵
- Executes dropped EXE
PID:3620 -
\??\c:\hbhtnt.exec:\hbhtnt.exe30⤵
- Executes dropped EXE
PID:3020 -
\??\c:\ddvpv.exec:\ddvpv.exe31⤵
- Executes dropped EXE
PID:3968 -
\??\c:\vdpjd.exec:\vdpjd.exe32⤵
- Executes dropped EXE
PID:676 -
\??\c:\rfxrxrr.exec:\rfxrxrr.exe33⤵
- Executes dropped EXE
PID:4408 -
\??\c:\jddvv.exec:\jddvv.exe34⤵
- Executes dropped EXE
PID:4152 -
\??\c:\vpdvj.exec:\vpdvj.exe35⤵
- Executes dropped EXE
PID:1488 -
\??\c:\xfxrllf.exec:\xfxrllf.exe36⤵
- Executes dropped EXE
PID:2512 -
\??\c:\xrxrfxr.exec:\xrxrfxr.exe37⤵
- Executes dropped EXE
PID:2304 -
\??\c:\7nnnbn.exec:\7nnnbn.exe38⤵
- Executes dropped EXE
PID:3332 -
\??\c:\tbtttt.exec:\tbtttt.exe39⤵
- Executes dropped EXE
PID:2312 -
\??\c:\3pdvp.exec:\3pdvp.exe40⤵
- Executes dropped EXE
PID:3060 -
\??\c:\7rrlxrl.exec:\7rrlxrl.exe41⤵
- Executes dropped EXE
PID:1104 -
\??\c:\3hnbtt.exec:\3hnbtt.exe42⤵
- Executes dropped EXE
PID:4664 -
\??\c:\vdppj.exec:\vdppj.exe43⤵
- Executes dropped EXE
PID:4700 -
\??\c:\bhbthh.exec:\bhbthh.exe44⤵
- Executes dropped EXE
PID:3304 -
\??\c:\1pjdv.exec:\1pjdv.exe45⤵
- Executes dropped EXE
PID:4640 -
\??\c:\hhtnbh.exec:\hhtnbh.exe46⤵
- Executes dropped EXE
PID:1064 -
\??\c:\htnbtn.exec:\htnbtn.exe47⤵
- Executes dropped EXE
PID:3176 -
\??\c:\xlrflxx.exec:\xlrflxx.exe48⤵
- Executes dropped EXE
PID:2052 -
\??\c:\5bnttb.exec:\5bnttb.exe49⤵
- Executes dropped EXE
PID:5036 -
\??\c:\pjjvj.exec:\pjjvj.exe50⤵
- Executes dropped EXE
PID:1668 -
\??\c:\lfllffx.exec:\lfllffx.exe51⤵
- Executes dropped EXE
PID:4160 -
\??\c:\ntbbtn.exec:\ntbbtn.exe52⤵
- Executes dropped EXE
PID:1876 -
\??\c:\vvjvp.exec:\vvjvp.exe53⤵
- Executes dropped EXE
PID:4996 -
\??\c:\fxxrlll.exec:\fxxrlll.exe54⤵
- Executes dropped EXE
PID:3604 -
\??\c:\btnnhh.exec:\btnnhh.exe55⤵
- Executes dropped EXE
PID:888 -
\??\c:\nbbtbb.exec:\nbbtbb.exe56⤵
- Executes dropped EXE
PID:440 -
\??\c:\dpdpp.exec:\dpdpp.exe57⤵
- Executes dropped EXE
PID:3892 -
\??\c:\lfrlxxx.exec:\lfrlxxx.exe58⤵
- Executes dropped EXE
PID:2520 -
\??\c:\frlxlll.exec:\frlxlll.exe59⤵
- Executes dropped EXE
PID:1520 -
\??\c:\nhtnbb.exec:\nhtnbb.exe60⤵
- Executes dropped EXE
PID:1460 -
\??\c:\bttnbb.exec:\bttnbb.exe61⤵
- Executes dropped EXE
PID:4512 -
\??\c:\7vvjd.exec:\7vvjd.exe62⤵
- Executes dropped EXE
PID:1572 -
\??\c:\jjpdp.exec:\jjpdp.exe63⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xflxffx.exec:\xflxffx.exe64⤵
- Executes dropped EXE
PID:3676 -
\??\c:\rlxrfxr.exec:\rlxrfxr.exe65⤵
- Executes dropped EXE
PID:3912 -
\??\c:\bhbtnn.exec:\bhbtnn.exe66⤵PID:1128
-
\??\c:\vpdpd.exec:\vpdpd.exe67⤵PID:1028
-
\??\c:\jvpjd.exec:\jvpjd.exe68⤵PID:4608
-
\??\c:\lllfrrf.exec:\lllfrrf.exe69⤵PID:1712
-
\??\c:\bhhbtn.exec:\bhhbtn.exe70⤵PID:4668
-
\??\c:\btbttt.exec:\btbttt.exe71⤵PID:3144
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe72⤵PID:2596
-
\??\c:\1bhhbt.exec:\1bhhbt.exe73⤵PID:2028
-
\??\c:\1hnnhh.exec:\1hnnhh.exe74⤵PID:1592
-
\??\c:\jdjvp.exec:\jdjvp.exe75⤵PID:2020
-
\??\c:\pjjdp.exec:\pjjdp.exe76⤵PID:4092
-
\??\c:\9ffxlfr.exec:\9ffxlfr.exe77⤵PID:1476
-
\??\c:\tnnhnn.exec:\tnnhnn.exe78⤵PID:1392
-
\??\c:\hbhbtb.exec:\hbhbtb.exe79⤵PID:2856
-
\??\c:\7ppjj.exec:\7ppjj.exe80⤵PID:3804
-
\??\c:\fxrlrrr.exec:\fxrlrrr.exe81⤵PID:3580
-
\??\c:\xrrlllf.exec:\xrrlllf.exe82⤵PID:1980
-
\??\c:\1nhbbb.exec:\1nhbbb.exe83⤵PID:1612
-
\??\c:\pvdvp.exec:\pvdvp.exe84⤵PID:2240
-
\??\c:\jpjdv.exec:\jpjdv.exe85⤵PID:4108
-
\??\c:\xxfxlff.exec:\xxfxlff.exe86⤵PID:4188
-
\??\c:\llrfxrl.exec:\llrfxrl.exe87⤵PID:2336
-
\??\c:\7hbhbb.exec:\7hbhbb.exe88⤵PID:2676
-
\??\c:\dvvpd.exec:\dvvpd.exe89⤵PID:4528
-
\??\c:\3jpjd.exec:\3jpjd.exe90⤵PID:1088
-
\??\c:\rlffxrl.exec:\rlffxrl.exe91⤵PID:4796
-
\??\c:\fffxrlf.exec:\fffxrlf.exe92⤵PID:4152
-
\??\c:\hbtnhn.exec:\hbtnhn.exe93⤵PID:2220
-
\??\c:\pddvj.exec:\pddvj.exe94⤵PID:4140
-
\??\c:\jppjv.exec:\jppjv.exe95⤵PID:4920
-
\??\c:\rllflll.exec:\rllflll.exe96⤵PID:4516
-
\??\c:\9llxrrr.exec:\9llxrrr.exe97⤵PID:3204
-
\??\c:\bhhhhh.exec:\bhhhhh.exe98⤵PID:4076
-
\??\c:\dpjdj.exec:\dpjdj.exe99⤵PID:1376
-
\??\c:\ppvjd.exec:\ppvjd.exe100⤵PID:3788
-
\??\c:\lllfffl.exec:\lllfffl.exe101⤵PID:2640
-
\??\c:\lxrrlfx.exec:\lxrrlfx.exe102⤵PID:1404
-
\??\c:\hhbbnh.exec:\hhbbnh.exe103⤵PID:3732
-
\??\c:\hhhthb.exec:\hhhthb.exe104⤵PID:4828
-
\??\c:\dpdpj.exec:\dpdpj.exe105⤵PID:4436
-
\??\c:\dpvjd.exec:\dpvjd.exe106⤵PID:2968
-
\??\c:\xxrlrrl.exec:\xxrlrrl.exe107⤵PID:2012
-
\??\c:\hbbbtt.exec:\hbbbtt.exe108⤵PID:4440
-
\??\c:\bhnhtn.exec:\bhnhtn.exe109⤵PID:752
-
\??\c:\pdddp.exec:\pdddp.exe110⤵PID:1876
-
\??\c:\5ddvp.exec:\5ddvp.exe111⤵PID:3888
-
\??\c:\vjjdd.exec:\vjjdd.exe112⤵PID:3604
-
\??\c:\llllxrl.exec:\llllxrl.exe113⤵PID:3288
-
\??\c:\ffxrlfx.exec:\ffxrlfx.exe114⤵PID:2940
-
\??\c:\7tbbbt.exec:\7tbbbt.exe115⤵PID:3704
-
\??\c:\htbtth.exec:\htbtth.exe116⤵PID:2996
-
\??\c:\7vpjp.exec:\7vpjp.exe117⤵PID:768
-
\??\c:\9jdvp.exec:\9jdvp.exe118⤵PID:4944
-
\??\c:\xffxrlf.exec:\xffxrlf.exe119⤵PID:3676
-
\??\c:\xfllxrl.exec:\xfllxrl.exe120⤵PID:704
-
\??\c:\xxfrlfr.exec:\xxfrlfr.exe121⤵PID:1028
-
\??\c:\1htnbb.exec:\1htnbb.exe122⤵PID:1360
-
\??\c:\3rxxlxx.exec:\3rxxlxx.exe123⤵PID:2004
-
\??\c:\rffxffx.exec:\rffxffx.exe124⤵PID:3208
-
\??\c:\5ttbhh.exec:\5ttbhh.exe125⤵PID:4692
-
\??\c:\thnnhh.exec:\thnnhh.exe126⤵PID:396
-
\??\c:\1ppjv.exec:\1ppjv.exe127⤵PID:1592
-
\??\c:\7xfrfxx.exec:\7xfrfxx.exe128⤵PID:1184
-
\??\c:\nbbthb.exec:\nbbthb.exe129⤵PID:4224
-
\??\c:\9nhthh.exec:\9nhthh.exe130⤵PID:1476
-
\??\c:\pjvpd.exec:\pjvpd.exe131⤵PID:2820
-
\??\c:\lllfxxr.exec:\lllfxxr.exe132⤵PID:2856
-
\??\c:\bbtnhb.exec:\bbtnhb.exe133⤵PID:4576
-
\??\c:\nhntbb.exec:\nhntbb.exe134⤵PID:2936
-
\??\c:\dvddj.exec:\dvddj.exe135⤵PID:4024
-
\??\c:\rlrlffr.exec:\rlrlffr.exe136⤵PID:672
-
\??\c:\rlfxrll.exec:\rlfxrll.exe137⤵PID:2240
-
\??\c:\9bbhtt.exec:\9bbhtt.exe138⤵PID:432
-
\??\c:\jpvjd.exec:\jpvjd.exe139⤵PID:4680
-
\??\c:\jvddp.exec:\jvddp.exe140⤵PID:2336
-
\??\c:\lllxffr.exec:\lllxffr.exe141⤵PID:2676
-
\??\c:\9frllff.exec:\9frllff.exe142⤵PID:4116
-
\??\c:\bthhbb.exec:\bthhbb.exe143⤵PID:1088
-
\??\c:\dpvpj.exec:\dpvpj.exe144⤵PID:2540
-
\??\c:\5fxrffx.exec:\5fxrffx.exe145⤵PID:2340
-
\??\c:\fxfffff.exec:\fxfffff.exe146⤵PID:2316
-
\??\c:\thhbtt.exec:\thhbtt.exe147⤵PID:4140
-
\??\c:\thbbtn.exec:\thbbtn.exe148⤵PID:2024
-
\??\c:\vvpvp.exec:\vvpvp.exe149⤵PID:3136
-
\??\c:\llllffx.exec:\llllffx.exe150⤵PID:3204
-
\??\c:\xffxffx.exec:\xffxffx.exe151⤵PID:780
-
\??\c:\htbttt.exec:\htbttt.exe152⤵PID:2572
-
\??\c:\jvjdv.exec:\jvjdv.exe153⤵PID:3788
-
\??\c:\jvvpd.exec:\jvvpd.exe154⤵PID:3304
-
\??\c:\5rxrffx.exec:\5rxrffx.exe155⤵PID:1404
-
\??\c:\hbnhbt.exec:\hbnhbt.exe156⤵PID:3732
-
\??\c:\5nhbhh.exec:\5nhbhh.exe157⤵PID:3176
-
\??\c:\dpvpd.exec:\dpvpd.exe158⤵PID:4436
-
\??\c:\dpvjv.exec:\dpvjv.exe159⤵PID:5036
-
\??\c:\xllxrlr.exec:\xllxrlr.exe160⤵PID:2012
-
\??\c:\1xrrlff.exec:\1xrrlff.exe161⤵PID:4932
-
\??\c:\nnbtnn.exec:\nnbtnn.exe162⤵PID:1448
-
\??\c:\1dddp.exec:\1dddp.exe163⤵PID:1300
-
\??\c:\dvdpp.exec:\dvdpp.exe164⤵PID:2584
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe165⤵PID:2808
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe166⤵PID:3288
-
\??\c:\hhtnbb.exec:\hhtnbb.exe167⤵PID:3500
-
\??\c:\djjdj.exec:\djjdj.exe168⤵PID:656
-
\??\c:\lfxfrlf.exec:\lfxfrlf.exe169⤵PID:2248
-
\??\c:\ffffxxr.exec:\ffffxxr.exe170⤵PID:3240
-
\??\c:\btnnhb.exec:\btnnhb.exe171⤵PID:2136
-
\??\c:\7nnhtt.exec:\7nnhtt.exe172⤵PID:1956
-
\??\c:\jdjdp.exec:\jdjdp.exe173⤵PID:4604
-
\??\c:\rrlfrrl.exec:\rrlfrrl.exe174⤵PID:464
-
\??\c:\rrrlfxx.exec:\rrrlfxx.exe175⤵PID:1016
-
\??\c:\nhhhhb.exec:\nhhhhb.exe176⤵PID:3112
-
\??\c:\bttbtt.exec:\bttbtt.exe177⤵PID:3236
-
\??\c:\jdvvj.exec:\jdvvj.exe178⤵PID:4688
-
\??\c:\dpdvj.exec:\dpdvj.exe179⤵PID:4008
-
\??\c:\3fxrrrx.exec:\3fxrrrx.exe180⤵PID:2648
-
\??\c:\fxlfxrr.exec:\fxlfxrr.exe181⤵PID:3736
-
\??\c:\tthnhn.exec:\tthnhn.exe182⤵PID:552
-
\??\c:\nbbtnh.exec:\nbbtnh.exe183⤵PID:736
-
\??\c:\pjppp.exec:\pjppp.exe184⤵PID:4984
-
\??\c:\lflffll.exec:\lflffll.exe185⤵PID:2296
-
\??\c:\tbbtnn.exec:\tbbtnn.exe186⤵PID:4860
-
\??\c:\bhhhnn.exec:\bhhhnn.exe187⤵PID:4232
-
\??\c:\vvdvd.exec:\vvdvd.exe188⤵PID:1612
-
\??\c:\pddpj.exec:\pddpj.exe189⤵PID:3320
-
\??\c:\frxlrrl.exec:\frxlrrl.exe190⤵PID:4108
-
\??\c:\frllfxr.exec:\frllfxr.exe191⤵PID:4188
-
\??\c:\nhhhnn.exec:\nhhhnn.exe192⤵PID:1224
-
\??\c:\bntnhh.exec:\bntnhh.exe193⤵PID:4356
-
\??\c:\7pppp.exec:\7pppp.exe194⤵PID:1152
-
\??\c:\fxrllll.exec:\fxrllll.exe195⤵PID:2676
-
\??\c:\rlrxrfx.exec:\rlrxrfx.exe196⤵PID:4116
-
\??\c:\nnbtnh.exec:\nnbtnh.exe197⤵PID:4780
-
\??\c:\ththnb.exec:\ththnb.exe198⤵PID:4716
-
\??\c:\dppjj.exec:\dppjj.exe199⤵PID:4588
-
\??\c:\xflrrrr.exec:\xflrrrr.exe200⤵PID:3540
-
\??\c:\xlfxxxr.exec:\xlfxxxr.exe201⤵PID:1544
-
\??\c:\thttnn.exec:\thttnn.exe202⤵PID:4516
-
\??\c:\hbbtnh.exec:\hbbtnh.exe203⤵PID:772
-
\??\c:\vpppj.exec:\vpppj.exe204⤵PID:3552
-
\??\c:\ffxrrrr.exec:\ffxrrrr.exe205⤵PID:3232
-
\??\c:\xrrrllf.exec:\xrrrllf.exe206⤵PID:540
-
\??\c:\nhhhbb.exec:\nhhhbb.exe207⤵PID:2640
-
\??\c:\nttthh.exec:\nttthh.exe208⤵PID:2904
-
\??\c:\ddvpv.exec:\ddvpv.exe209⤵PID:4460
-
\??\c:\jpvdv.exec:\jpvdv.exe210⤵PID:1456
-
\??\c:\3llfrxx.exec:\3llfrxx.exe211⤵PID:2968
-
\??\c:\7hbbbh.exec:\7hbbbh.exe212⤵PID:2716
-
\??\c:\btbthn.exec:\btbthn.exe213⤵PID:2964
-
\??\c:\dvvpd.exec:\dvvpd.exe214⤵PID:3632
-
\??\c:\vppjj.exec:\vppjj.exe215⤵PID:4996
-
\??\c:\3lrxxxr.exec:\3lrxxxr.exe216⤵PID:1208
-
\??\c:\frrrllf.exec:\frrrllf.exe217⤵PID:2416
-
\??\c:\ntttnt.exec:\ntttnt.exe218⤵PID:2584
-
\??\c:\hhhnbb.exec:\hhhnbb.exe219⤵PID:3288
-
\??\c:\jdpjv.exec:\jdpjv.exe220⤵PID:3500
-
\??\c:\xrxrlrl.exec:\xrxrlrl.exe221⤵PID:4512
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe222⤵PID:2248
-
\??\c:\thbtnn.exec:\thbtnn.exe223⤵PID:4944
-
\??\c:\nbtnhh.exec:\nbtnhh.exe224⤵PID:1128
-
\??\c:\dvpjp.exec:\dvpjp.exe225⤵PID:1956
-
\??\c:\pjjdp.exec:\pjjdp.exe226⤵PID:1696
-
\??\c:\rfllfxx.exec:\rfllfxx.exe227⤵PID:3680
-
\??\c:\nhhhbb.exec:\nhhhbb.exe228⤵PID:2028
-
\??\c:\bbnnhn.exec:\bbnnhn.exe229⤵PID:4692
-
\??\c:\djjpj.exec:\djjpj.exe230⤵PID:4688
-
\??\c:\vvdpj.exec:\vvdpj.exe231⤵PID:4008
-
\??\c:\5xllrrl.exec:\5xllrrl.exe232⤵PID:2648
-
\??\c:\rlrfxxx.exec:\rlrfxxx.exe233⤵PID:3736
-
\??\c:\bbhhbb.exec:\bbhhbb.exe234⤵PID:2104
-
\??\c:\nnhntb.exec:\nnhntb.exe235⤵PID:940
-
\??\c:\5djdv.exec:\5djdv.exe236⤵PID:3728
-
\??\c:\rxrlxrr.exec:\rxrlxrr.exe237⤵PID:3988
-
\??\c:\rrxrrll.exec:\rrxrrll.exe238⤵PID:4860
-
\??\c:\3hbttn.exec:\3hbttn.exe239⤵PID:1972
-
\??\c:\pvvpj.exec:\pvvpj.exe240⤵PID:1612
-
\??\c:\pvdvp.exec:\pvdvp.exe241⤵PID:3320
-
\??\c:\xrrlfff.exec:\xrrlfff.exe242⤵PID:432