Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 12:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9d1674e4b9e06cefaaa86ee35c9e0b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b9d1674e4b9e06cefaaa86ee35c9e0b0_NeikiAnalytics.exe
-
Size
76KB
-
MD5
b9d1674e4b9e06cefaaa86ee35c9e0b0
-
SHA1
8ff79d37730ef34c36168f5f9886ca9dfb842d01
-
SHA256
b7cd41758d07cf1b25af8aed65ce1be8bf7e9f8610c597750bd1f83e3ba92d97
-
SHA512
55011ad562b00a6b8ceea7fbd976a795651a66551623daa755e8fb25719442cf0986867cf4d00e678465eace9de83bf5e31c8f1aa2875c087bc9714e2985998f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA0:ymb3NkkiQ3mdBjFIIp9L9QrrA0
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/3992-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1896-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3800-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fxrllll.exehbntbb.exebnnnhh.exefxlfffl.exefxxxxxr.exebhtbbb.exeddvpp.exedddvv.exerflflff.exehttbbb.exepjvvv.exerxfxxxx.exe3nhhhh.exevjppp.exerlfffxx.exexrxxffl.exehhbttt.exedpjjj.exelllffff.exe5btttt.exevpdvp.exe9fllfff.exelfxrrrl.exenhtttt.exedvvvp.exe3rrlffx.exefllrrrl.exehbnnnn.exevvddj.exelfffxxx.exerllrlxx.exebbtttt.exepdpjp.exevjjdd.exe9lfxrrl.exerlxxllx.exethnnhh.exebhnhbb.exe3dppj.exe5pdpp.exe3xxrrrr.exerlrrxxx.exebbtbbh.exedppjd.exevpdvv.exefxffxff.exelxrlfff.exe9nnhnn.exehttnhh.exepddjd.exe9xxlxxx.exefrxrrlf.exetnbttt.exe1ntntt.exejvjdv.exefxxrllf.exexxrrrrr.exebnbhbh.exepppjp.exejdpjj.exellrlxxx.exexlxxxxx.exebhnnhh.exettbtnn.exepid process 4752 fxrllll.exe 4584 hbntbb.exe 3196 bnnnhh.exe 1012 fxlfffl.exe 4684 fxxxxxr.exe 1408 bhtbbb.exe 1664 ddvpp.exe 3488 dddvv.exe 4892 rflflff.exe 4528 httbbb.exe 4232 pjvvv.exe 4060 rxfxxxx.exe 2776 3nhhhh.exe 3200 vjppp.exe 4512 rlfffxx.exe 4992 xrxxffl.exe 1272 hhbttt.exe 3056 dpjjj.exe 1080 lllffff.exe 4976 5btttt.exe 1896 vpdvp.exe 4936 9fllfff.exe 3984 lfxrrrl.exe 1572 nhtttt.exe 4516 dvvvp.exe 4804 3rrlffx.exe 3800 fllrrrl.exe 5020 hbnnnn.exe 3132 vvddj.exe 4380 lfffxxx.exe 4792 rllrlxx.exe 4284 bbtttt.exe 920 pdpjp.exe 5060 vjjdd.exe 1528 9lfxrrl.exe 952 rlxxllx.exe 1004 thnnhh.exe 4344 bhnhbb.exe 2256 3dppj.exe 5052 5pdpp.exe 3324 3xxrrrr.exe 1136 rlrrxxx.exe 5104 bbtbbh.exe 1012 dppjd.exe 1684 vpdvv.exe 4600 fxffxff.exe 1756 lxrlfff.exe 4820 9nnhnn.exe 5100 httnhh.exe 3708 pddjd.exe 1692 9xxlxxx.exe 4912 frxrrlf.exe 2644 tnbttt.exe 184 1ntntt.exe 4060 jvjdv.exe 4032 fxxrllf.exe 2832 xxrrrrr.exe 3948 bnbhbh.exe 556 pppjp.exe 3340 jdpjj.exe 4672 llrlxxx.exe 3264 xlxxxxx.exe 3056 bhnnhh.exe 3464 ttbtnn.exe -
Processes:
resource yara_rule behavioral2/memory/3992-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1896-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3800-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b9d1674e4b9e06cefaaa86ee35c9e0b0_NeikiAnalytics.exefxrllll.exehbntbb.exebnnnhh.exefxlfffl.exefxxxxxr.exebhtbbb.exeddvpp.exedddvv.exerflflff.exehttbbb.exepjvvv.exerxfxxxx.exe3nhhhh.exevjppp.exerlfffxx.exexrxxffl.exehhbttt.exedpjjj.exelllffff.exe5btttt.exevpdvp.exedescription pid process target process PID 3992 wrote to memory of 4752 3992 b9d1674e4b9e06cefaaa86ee35c9e0b0_NeikiAnalytics.exe fxrllll.exe PID 3992 wrote to memory of 4752 3992 b9d1674e4b9e06cefaaa86ee35c9e0b0_NeikiAnalytics.exe fxrllll.exe PID 3992 wrote to memory of 4752 3992 b9d1674e4b9e06cefaaa86ee35c9e0b0_NeikiAnalytics.exe fxrllll.exe PID 4752 wrote to memory of 4584 4752 fxrllll.exe hbntbb.exe PID 4752 wrote to memory of 4584 4752 fxrllll.exe hbntbb.exe PID 4752 wrote to memory of 4584 4752 fxrllll.exe hbntbb.exe PID 4584 wrote to memory of 3196 4584 hbntbb.exe bnnnhh.exe PID 4584 wrote to memory of 3196 4584 hbntbb.exe bnnnhh.exe PID 4584 wrote to memory of 3196 4584 hbntbb.exe bnnnhh.exe PID 3196 wrote to memory of 1012 3196 bnnnhh.exe fxlfffl.exe PID 3196 wrote to memory of 1012 3196 bnnnhh.exe fxlfffl.exe PID 3196 wrote to memory of 1012 3196 bnnnhh.exe fxlfffl.exe PID 1012 wrote to memory of 4684 1012 fxlfffl.exe fxxxxxr.exe PID 1012 wrote to memory of 4684 1012 fxlfffl.exe fxxxxxr.exe PID 1012 wrote to memory of 4684 1012 fxlfffl.exe fxxxxxr.exe PID 4684 wrote to memory of 1408 4684 fxxxxxr.exe bhtbbb.exe PID 4684 wrote to memory of 1408 4684 fxxxxxr.exe bhtbbb.exe PID 4684 wrote to memory of 1408 4684 fxxxxxr.exe bhtbbb.exe PID 1408 wrote to memory of 1664 1408 bhtbbb.exe ddvpp.exe PID 1408 wrote to memory of 1664 1408 bhtbbb.exe ddvpp.exe PID 1408 wrote to memory of 1664 1408 bhtbbb.exe ddvpp.exe PID 1664 wrote to memory of 3488 1664 ddvpp.exe dddvv.exe PID 1664 wrote to memory of 3488 1664 ddvpp.exe dddvv.exe PID 1664 wrote to memory of 3488 1664 ddvpp.exe dddvv.exe PID 3488 wrote to memory of 4892 3488 dddvv.exe rflflff.exe PID 3488 wrote to memory of 4892 3488 dddvv.exe rflflff.exe PID 3488 wrote to memory of 4892 3488 dddvv.exe rflflff.exe PID 4892 wrote to memory of 4528 4892 rflflff.exe httbbb.exe PID 4892 wrote to memory of 4528 4892 rflflff.exe httbbb.exe PID 4892 wrote to memory of 4528 4892 rflflff.exe httbbb.exe PID 4528 wrote to memory of 4232 4528 httbbb.exe pjvvv.exe PID 4528 wrote to memory of 4232 4528 httbbb.exe pjvvv.exe PID 4528 wrote to memory of 4232 4528 httbbb.exe pjvvv.exe PID 4232 wrote to memory of 4060 4232 pjvvv.exe rxfxxxx.exe PID 4232 wrote to memory of 4060 4232 pjvvv.exe rxfxxxx.exe PID 4232 wrote to memory of 4060 4232 pjvvv.exe rxfxxxx.exe PID 4060 wrote to memory of 2776 4060 rxfxxxx.exe 3nhhhh.exe PID 4060 wrote to memory of 2776 4060 rxfxxxx.exe 3nhhhh.exe PID 4060 wrote to memory of 2776 4060 rxfxxxx.exe 3nhhhh.exe PID 2776 wrote to memory of 3200 2776 3nhhhh.exe vjppp.exe PID 2776 wrote to memory of 3200 2776 3nhhhh.exe vjppp.exe PID 2776 wrote to memory of 3200 2776 3nhhhh.exe vjppp.exe PID 3200 wrote to memory of 4512 3200 vjppp.exe rlfffxx.exe PID 3200 wrote to memory of 4512 3200 vjppp.exe rlfffxx.exe PID 3200 wrote to memory of 4512 3200 vjppp.exe rlfffxx.exe PID 4512 wrote to memory of 4992 4512 rlfffxx.exe xrxxffl.exe PID 4512 wrote to memory of 4992 4512 rlfffxx.exe xrxxffl.exe PID 4512 wrote to memory of 4992 4512 rlfffxx.exe xrxxffl.exe PID 4992 wrote to memory of 1272 4992 xrxxffl.exe hhbttt.exe PID 4992 wrote to memory of 1272 4992 xrxxffl.exe hhbttt.exe PID 4992 wrote to memory of 1272 4992 xrxxffl.exe hhbttt.exe PID 1272 wrote to memory of 3056 1272 hhbttt.exe dpjjj.exe PID 1272 wrote to memory of 3056 1272 hhbttt.exe dpjjj.exe PID 1272 wrote to memory of 3056 1272 hhbttt.exe dpjjj.exe PID 3056 wrote to memory of 1080 3056 dpjjj.exe lllffff.exe PID 3056 wrote to memory of 1080 3056 dpjjj.exe lllffff.exe PID 3056 wrote to memory of 1080 3056 dpjjj.exe lllffff.exe PID 1080 wrote to memory of 4976 1080 lllffff.exe 5btttt.exe PID 1080 wrote to memory of 4976 1080 lllffff.exe 5btttt.exe PID 1080 wrote to memory of 4976 1080 lllffff.exe 5btttt.exe PID 4976 wrote to memory of 1896 4976 5btttt.exe vpdvp.exe PID 4976 wrote to memory of 1896 4976 5btttt.exe vpdvp.exe PID 4976 wrote to memory of 1896 4976 5btttt.exe vpdvp.exe PID 1896 wrote to memory of 4936 1896 vpdvp.exe 9fllfff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9d1674e4b9e06cefaaa86ee35c9e0b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b9d1674e4b9e06cefaaa86ee35c9e0b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\fxrllll.exec:\fxrllll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\hbntbb.exec:\hbntbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\bnnnhh.exec:\bnnnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\fxlfffl.exec:\fxlfffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\fxxxxxr.exec:\fxxxxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\bhtbbb.exec:\bhtbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\ddvpp.exec:\ddvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\dddvv.exec:\dddvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\rflflff.exec:\rflflff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\httbbb.exec:\httbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\pjvvv.exec:\pjvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\rxfxxxx.exec:\rxfxxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\3nhhhh.exec:\3nhhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\vjppp.exec:\vjppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\rlfffxx.exec:\rlfffxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\xrxxffl.exec:\xrxxffl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\hhbttt.exec:\hhbttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\dpjjj.exec:\dpjjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\lllffff.exec:\lllffff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\5btttt.exec:\5btttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\vpdvp.exec:\vpdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\9fllfff.exec:\9fllfff.exe23⤵
- Executes dropped EXE
PID:4936 -
\??\c:\lfxrrrl.exec:\lfxrrrl.exe24⤵
- Executes dropped EXE
PID:3984 -
\??\c:\nhtttt.exec:\nhtttt.exe25⤵
- Executes dropped EXE
PID:1572 -
\??\c:\dvvvp.exec:\dvvvp.exe26⤵
- Executes dropped EXE
PID:4516 -
\??\c:\3rrlffx.exec:\3rrlffx.exe27⤵
- Executes dropped EXE
PID:4804 -
\??\c:\fllrrrl.exec:\fllrrrl.exe28⤵
- Executes dropped EXE
PID:3800 -
\??\c:\hbnnnn.exec:\hbnnnn.exe29⤵
- Executes dropped EXE
PID:5020 -
\??\c:\vvddj.exec:\vvddj.exe30⤵
- Executes dropped EXE
PID:3132 -
\??\c:\lfffxxx.exec:\lfffxxx.exe31⤵
- Executes dropped EXE
PID:4380 -
\??\c:\rllrlxx.exec:\rllrlxx.exe32⤵
- Executes dropped EXE
PID:4792 -
\??\c:\bbtttt.exec:\bbtttt.exe33⤵
- Executes dropped EXE
PID:4284 -
\??\c:\pdpjp.exec:\pdpjp.exe34⤵
- Executes dropped EXE
PID:920 -
\??\c:\vjjdd.exec:\vjjdd.exe35⤵
- Executes dropped EXE
PID:5060 -
\??\c:\9lfxrrl.exec:\9lfxrrl.exe36⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rlxxllx.exec:\rlxxllx.exe37⤵
- Executes dropped EXE
PID:952 -
\??\c:\thnnhh.exec:\thnnhh.exe38⤵
- Executes dropped EXE
PID:1004 -
\??\c:\bhnhbb.exec:\bhnhbb.exe39⤵
- Executes dropped EXE
PID:4344 -
\??\c:\3dppj.exec:\3dppj.exe40⤵
- Executes dropped EXE
PID:2256 -
\??\c:\5pdpp.exec:\5pdpp.exe41⤵
- Executes dropped EXE
PID:5052 -
\??\c:\3xxrrrr.exec:\3xxrrrr.exe42⤵
- Executes dropped EXE
PID:3324 -
\??\c:\rlrrxxx.exec:\rlrrxxx.exe43⤵
- Executes dropped EXE
PID:1136 -
\??\c:\bbtbbh.exec:\bbtbbh.exe44⤵
- Executes dropped EXE
PID:5104 -
\??\c:\dppjd.exec:\dppjd.exe45⤵
- Executes dropped EXE
PID:1012 -
\??\c:\vpdvv.exec:\vpdvv.exe46⤵
- Executes dropped EXE
PID:1684 -
\??\c:\fxffxff.exec:\fxffxff.exe47⤵
- Executes dropped EXE
PID:4600 -
\??\c:\lxrlfff.exec:\lxrlfff.exe48⤵
- Executes dropped EXE
PID:1756 -
\??\c:\9nnhnn.exec:\9nnhnn.exe49⤵
- Executes dropped EXE
PID:4820 -
\??\c:\httnhh.exec:\httnhh.exe50⤵
- Executes dropped EXE
PID:5100 -
\??\c:\pddjd.exec:\pddjd.exe51⤵
- Executes dropped EXE
PID:3708 -
\??\c:\9xxlxxx.exec:\9xxlxxx.exe52⤵
- Executes dropped EXE
PID:1692 -
\??\c:\frxrrlf.exec:\frxrrlf.exe53⤵
- Executes dropped EXE
PID:4912 -
\??\c:\tnbttt.exec:\tnbttt.exe54⤵
- Executes dropped EXE
PID:2644 -
\??\c:\1ntntt.exec:\1ntntt.exe55⤵
- Executes dropped EXE
PID:184 -
\??\c:\jvjdv.exec:\jvjdv.exe56⤵
- Executes dropped EXE
PID:4060 -
\??\c:\fxxrllf.exec:\fxxrllf.exe57⤵
- Executes dropped EXE
PID:4032 -
\??\c:\xxrrrrr.exec:\xxrrrrr.exe58⤵
- Executes dropped EXE
PID:2832 -
\??\c:\bnbhbh.exec:\bnbhbh.exe59⤵
- Executes dropped EXE
PID:3948 -
\??\c:\pppjp.exec:\pppjp.exe60⤵
- Executes dropped EXE
PID:556 -
\??\c:\jdpjj.exec:\jdpjj.exe61⤵
- Executes dropped EXE
PID:3340 -
\??\c:\llrlxxx.exec:\llrlxxx.exe62⤵
- Executes dropped EXE
PID:4672 -
\??\c:\xlxxxxx.exec:\xlxxxxx.exe63⤵
- Executes dropped EXE
PID:3264 -
\??\c:\bhnnhh.exec:\bhnnhh.exe64⤵
- Executes dropped EXE
PID:3056 -
\??\c:\ttbtnn.exec:\ttbtnn.exe65⤵
- Executes dropped EXE
PID:3464 -
\??\c:\pjpvp.exec:\pjpvp.exe66⤵PID:1268
-
\??\c:\frrrfll.exec:\frrrfll.exe67⤵PID:2516
-
\??\c:\rxffxff.exec:\rxffxff.exe68⤵PID:1632
-
\??\c:\hthhbb.exec:\hthhbb.exe69⤵PID:3128
-
\??\c:\9hhhhn.exec:\9hhhhn.exe70⤵PID:4024
-
\??\c:\vdddv.exec:\vdddv.exe71⤵PID:1784
-
\??\c:\xrlfffr.exec:\xrlfffr.exe72⤵PID:1572
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe73⤵PID:3112
-
\??\c:\nhhhnn.exec:\nhhhnn.exe74⤵PID:2020
-
\??\c:\tnbbnn.exec:\tnbbnn.exe75⤵PID:4180
-
\??\c:\pjpjd.exec:\pjpjd.exe76⤵PID:3800
-
\??\c:\lffllll.exec:\lffllll.exe77⤵PID:1996
-
\??\c:\9tbbbb.exec:\9tbbbb.exe78⤵PID:2676
-
\??\c:\htbttn.exec:\htbttn.exe79⤵PID:4128
-
\??\c:\llrxfll.exec:\llrxfll.exe80⤵PID:4612
-
\??\c:\nnhhbb.exec:\nnhhbb.exe81⤵PID:4552
-
\??\c:\hnnnbb.exec:\hnnnbb.exe82⤵PID:4068
-
\??\c:\vdppj.exec:\vdppj.exe83⤵PID:3356
-
\??\c:\ppvvp.exec:\ppvvp.exe84⤵PID:1652
-
\??\c:\xxlfxxx.exec:\xxlfxxx.exe85⤵PID:644
-
\??\c:\frfxllx.exec:\frfxllx.exe86⤵PID:1580
-
\??\c:\btnhtt.exec:\btnhtt.exe87⤵PID:4332
-
\??\c:\hbbbbh.exec:\hbbbbh.exe88⤵PID:2008
-
\??\c:\jjjjd.exec:\jjjjd.exe89⤵PID:2372
-
\??\c:\pjjpj.exec:\pjjpj.exe90⤵PID:3432
-
\??\c:\5ffxxxx.exec:\5ffxxxx.exe91⤵PID:3268
-
\??\c:\rfffxxx.exec:\rfffxxx.exe92⤵PID:2872
-
\??\c:\hbntnn.exec:\hbntnn.exe93⤵PID:5104
-
\??\c:\tnhhbh.exec:\tnhhbh.exe94⤵PID:4260
-
\??\c:\vvppj.exec:\vvppj.exe95⤵PID:2056
-
\??\c:\9ddvv.exec:\9ddvv.exe96⤵PID:60
-
\??\c:\lffxxxf.exec:\lffxxxf.exe97⤵PID:3488
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe98⤵PID:1404
-
\??\c:\3nbbbb.exec:\3nbbbb.exe99⤵PID:2720
-
\??\c:\btttnb.exec:\btttnb.exe100⤵PID:1692
-
\??\c:\9vvpj.exec:\9vvpj.exe101⤵PID:1820
-
\??\c:\vppvv.exec:\vppvv.exe102⤵PID:4360
-
\??\c:\xxflflr.exec:\xxflflr.exe103⤵PID:4352
-
\??\c:\bhthbb.exec:\bhthbb.exe104⤵PID:4948
-
\??\c:\pvppp.exec:\pvppp.exe105⤵PID:2488
-
\??\c:\frxrlfx.exec:\frxrlfx.exe106⤵PID:4896
-
\??\c:\9tbbnt.exec:\9tbbnt.exe107⤵PID:2252
-
\??\c:\bhbnnn.exec:\bhbnnn.exe108⤵PID:4608
-
\??\c:\dpppp.exec:\dpppp.exe109⤵PID:4124
-
\??\c:\fxrfllr.exec:\fxrfllr.exe110⤵PID:1604
-
\??\c:\bbnbbn.exec:\bbnbbn.exe111⤵PID:452
-
\??\c:\bbbbtt.exec:\bbbbtt.exe112⤵PID:3292
-
\??\c:\dvppp.exec:\dvppp.exe113⤵PID:1056
-
\??\c:\7dvdv.exec:\7dvdv.exe114⤵PID:2064
-
\??\c:\fffllll.exec:\fffllll.exe115⤵PID:2068
-
\??\c:\rflrlll.exec:\rflrlll.exe116⤵PID:4960
-
\??\c:\xxffffx.exec:\xxffffx.exe117⤵PID:5004
-
\??\c:\btnhht.exec:\btnhht.exe118⤵PID:232
-
\??\c:\1nnhnt.exec:\1nnhnt.exe119⤵PID:3512
-
\??\c:\vpvvd.exec:\vpvvd.exe120⤵PID:868
-
\??\c:\ddvpj.exec:\ddvpj.exe121⤵PID:3036
-
\??\c:\fxffxxl.exec:\fxffxxl.exe122⤵PID:1996
-
\??\c:\xxfrxxr.exec:\xxfrxxr.exe123⤵PID:1484
-
\??\c:\rfrxxff.exec:\rfrxxff.exe124⤵PID:4128
-
\??\c:\nhhbbb.exec:\nhhbbb.exe125⤵PID:4404
-
\??\c:\vvdvv.exec:\vvdvv.exe126⤵PID:3332
-
\??\c:\dpppp.exec:\dpppp.exe127⤵PID:1592
-
\??\c:\lfflrrl.exec:\lfflrrl.exe128⤵PID:1928
-
\??\c:\lfrrfff.exec:\lfrrfff.exe129⤵PID:1088
-
\??\c:\1hbnnn.exec:\1hbnnn.exe130⤵PID:2588
-
\??\c:\thnntn.exec:\thnntn.exe131⤵PID:3304
-
\??\c:\vpvpp.exec:\vpvpp.exe132⤵PID:4344
-
\??\c:\bbbthb.exec:\bbbthb.exe133⤵PID:2256
-
\??\c:\7jjdd.exec:\7jjdd.exe134⤵PID:4752
-
\??\c:\rfxrrxf.exec:\rfxrrxf.exe135⤵PID:1136
-
\??\c:\lllrlxl.exec:\lllrlxl.exe136⤵PID:4420
-
\??\c:\nhhhhh.exec:\nhhhhh.exe137⤵PID:1952
-
\??\c:\bhnhbn.exec:\bhnhbn.exe138⤵PID:2860
-
\??\c:\vppdv.exec:\vppdv.exe139⤵PID:3676
-
\??\c:\xfrrllf.exec:\xfrrllf.exe140⤵PID:3016
-
\??\c:\xxrlfff.exec:\xxrlfff.exe141⤵PID:1424
-
\??\c:\nthnnn.exec:\nthnnn.exe142⤵PID:4892
-
\??\c:\thhhnn.exec:\thhhnn.exe143⤵PID:4528
-
\??\c:\jjppj.exec:\jjppj.exe144⤵PID:1684
-
\??\c:\vvjdp.exec:\vvjdp.exe145⤵PID:3272
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe146⤵PID:2644
-
\??\c:\xxrlrrr.exec:\xxrlrrr.exe147⤵PID:4232
-
\??\c:\hbhbbt.exec:\hbhbbt.exe148⤵PID:2776
-
\??\c:\httttb.exec:\httttb.exe149⤵PID:4860
-
\??\c:\tnbtnn.exec:\tnbtnn.exe150⤵PID:3576
-
\??\c:\7vjdp.exec:\7vjdp.exe151⤵PID:4624
-
\??\c:\jppjj.exec:\jppjj.exe152⤵PID:2592
-
\??\c:\xrrlfll.exec:\xrrlfll.exe153⤵PID:5028
-
\??\c:\rxrrrrr.exec:\rxrrrrr.exe154⤵PID:2452
-
\??\c:\tnnnnn.exec:\tnnnnn.exe155⤵PID:3056
-
\??\c:\bhhhhh.exec:\bhhhhh.exe156⤵PID:2516
-
\??\c:\nbhbtn.exec:\nbhbtn.exe157⤵PID:3816
-
\??\c:\pddvv.exec:\pddvv.exe158⤵PID:3856
-
\??\c:\vjjdv.exec:\vjjdv.exe159⤵PID:2400
-
\??\c:\rflfrrl.exec:\rflfrrl.exe160⤵PID:1872
-
\??\c:\xxxrrrx.exec:\xxxrrrx.exe161⤵PID:876
-
\??\c:\tthbbt.exec:\tthbbt.exe162⤵PID:1428
-
\??\c:\bnnttt.exec:\bnnttt.exe163⤵PID:3896
-
\??\c:\pjjvp.exec:\pjjvp.exe164⤵PID:380
-
\??\c:\jjjdp.exec:\jjjdp.exe165⤵PID:1412
-
\??\c:\xllfflf.exec:\xllfflf.exe166⤵PID:4404
-
\??\c:\5xxxxll.exec:\5xxxxll.exe167⤵PID:3152
-
\??\c:\xllfxxr.exec:\xllfxxr.exe168⤵PID:1940
-
\??\c:\hhhnnt.exec:\hhhnnt.exe169⤵PID:1860
-
\??\c:\nhhhbb.exec:\nhhhbb.exe170⤵PID:3028
-
\??\c:\vpvvv.exec:\vpvvv.exe171⤵PID:3416
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe172⤵PID:2256
-
\??\c:\rffrlll.exec:\rffrlll.exe173⤵PID:4752
-
\??\c:\btbbnh.exec:\btbbnh.exe174⤵PID:4428
-
\??\c:\ttttbb.exec:\ttttbb.exe175⤵PID:2872
-
\??\c:\vpdvj.exec:\vpdvj.exe176⤵PID:436
-
\??\c:\ppdjj.exec:\ppdjj.exe177⤵PID:4600
-
\??\c:\rrrrlll.exec:\rrrrlll.exe178⤵PID:1664
-
\??\c:\7xfxxll.exec:\7xfxxll.exe179⤵PID:2472
-
\??\c:\bbnhbb.exec:\bbnhbb.exe180⤵PID:4864
-
\??\c:\htntnn.exec:\htntnn.exe181⤵PID:4868
-
\??\c:\djdvd.exec:\djdvd.exe182⤵PID:4384
-
\??\c:\dvddv.exec:\dvddv.exe183⤵PID:2808
-
\??\c:\rrxrflr.exec:\rrxrflr.exe184⤵PID:5000
-
\??\c:\thnntb.exec:\thnntb.exe185⤵PID:3272
-
\??\c:\nhnnhn.exec:\nhnnhn.exe186⤵PID:5112
-
\??\c:\jvdvj.exec:\jvdvj.exe187⤵PID:4360
-
\??\c:\vpvdj.exec:\vpvdj.exe188⤵PID:4032
-
\??\c:\1lxxflr.exec:\1lxxflr.exe189⤵PID:4508
-
\??\c:\fxrlffx.exec:\fxrlffx.exe190⤵PID:4860
-
\??\c:\bnttnn.exec:\bnttnn.exe191⤵PID:3576
-
\??\c:\nnnnth.exec:\nnnnth.exe192⤵PID:4624
-
\??\c:\dvvvj.exec:\dvvvj.exe193⤵PID:4124
-
\??\c:\llllfff.exec:\llllfff.exe194⤵PID:812
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe195⤵PID:2452
-
\??\c:\lflllll.exec:\lflllll.exe196⤵PID:3216
-
\??\c:\nbbhbb.exec:\nbbhbb.exe197⤵PID:3056
-
\??\c:\vpddv.exec:\vpddv.exe198⤵PID:1632
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe199⤵PID:1960
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe200⤵PID:3856
-
\??\c:\bnnhbn.exec:\bnnhbn.exe201⤵PID:2400
-
\??\c:\ttbbtt.exec:\ttbbtt.exe202⤵PID:2316
-
\??\c:\hhhbbb.exec:\hhhbbb.exe203⤵PID:1524
-
\??\c:\ppdpj.exec:\ppdpj.exe204⤵PID:1428
-
\??\c:\vdjvp.exec:\vdjvp.exe205⤵PID:2676
-
\??\c:\xrxrlll.exec:\xrxrlll.exe206⤵PID:4552
-
\??\c:\fxlxrrf.exec:\fxlxrrf.exe207⤵PID:1412
-
\??\c:\nnbtnn.exec:\nnbtnn.exe208⤵PID:4404
-
\??\c:\vvddj.exec:\vvddj.exe209⤵PID:3152
-
\??\c:\7llrrll.exec:\7llrrll.exe210⤵PID:2480
-
\??\c:\xrrlffx.exec:\xrrlffx.exe211⤵PID:1860
-
\??\c:\vpddp.exec:\vpddp.exe212⤵PID:3028
-
\??\c:\pjddv.exec:\pjddv.exe213⤵PID:3416
-
\??\c:\llfxrrl.exec:\llfxrrl.exe214⤵PID:3196
-
\??\c:\hnthbb.exec:\hnthbb.exe215⤵PID:4752
-
\??\c:\pjvjj.exec:\pjvjj.exe216⤵PID:1408
-
\??\c:\rrfxxxf.exec:\rrfxxxf.exe217⤵PID:388
-
\??\c:\ntttbh.exec:\ntttbh.exe218⤵PID:436
-
\??\c:\ntnbbt.exec:\ntnbbt.exe219⤵PID:1536
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe220⤵PID:3488
-
\??\c:\9btttt.exec:\9btttt.exe221⤵PID:2472
-
\??\c:\tthhtt.exec:\tthhtt.exe222⤵PID:4968
-
\??\c:\ppjjd.exec:\ppjjd.exe223⤵PID:4868
-
\??\c:\ffxflrx.exec:\ffxflrx.exe224⤵PID:4384
-
\??\c:\ppdvd.exec:\ppdvd.exe225⤵PID:2808
-
\??\c:\xrxxllr.exec:\xrxxllr.exe226⤵PID:1820
-
\??\c:\fxflfff.exec:\fxflfff.exe227⤵PID:3272
-
\??\c:\bnntnn.exec:\bnntnn.exe228⤵PID:5112
-
\??\c:\vpjjp.exec:\vpjjp.exe229⤵PID:1372
-
\??\c:\fxfllll.exec:\fxfllll.exe230⤵PID:3780
-
\??\c:\9rrrllx.exec:\9rrrllx.exe231⤵PID:4032
-
\??\c:\rllflff.exec:\rllflff.exe232⤵PID:4860
-
\??\c:\hhhhhh.exec:\hhhhhh.exe233⤵PID:2892
-
\??\c:\tntnbb.exec:\tntnbb.exe234⤵PID:3264
-
\??\c:\jpjdj.exec:\jpjdj.exe235⤵PID:3032
-
\??\c:\3rxxflr.exec:\3rxxflr.exe236⤵PID:4536
-
\??\c:\xrrrllf.exec:\xrrrllf.exe237⤵PID:2088
-
\??\c:\btnnhb.exec:\btnnhb.exe238⤵PID:2544
-
\??\c:\hhhhhb.exec:\hhhhhb.exe239⤵PID:640
-
\??\c:\1vpdv.exec:\1vpdv.exe240⤵PID:4960
-
\??\c:\vvvpj.exec:\vvvpj.exe241⤵PID:3112
-
\??\c:\5llfffx.exec:\5llfffx.exe242⤵PID:1872