Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d6d827d01a9a6150fe87e5df7964e590_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d6d827d01a9a6150fe87e5df7964e590_NeikiAnalytics.exe
-
Size
88KB
-
MD5
d6d827d01a9a6150fe87e5df7964e590
-
SHA1
94147b347d2481f2c83fedb9d5e183d0d4be14bc
-
SHA256
7adce874d484e72f8a8ef5cce0bd6060e4e9762f7a2d05afcd4b9d132ab90044
-
SHA512
8af88b1f9ad6350bd4265a30bc5c0d5b8eb44f0e7ccfac7842610d5bbcdeecab6b0696159b28a0e26fa4a2431d9c02466145d07ea560a8339240d0d0f4fe7233
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73yqKH/Kjve2:ymb3NkkiQ3mdBjFo73yX+vZ
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2740-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-86-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1484-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1236-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/572-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/868-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hbtbhh.exe1fxfxxf.exenhttbt.exerlllxfl.exetnbhnt.exetnhbhh.exe1dpdd.exelfrxllr.exetnbtbh.exebbhhnt.exedvvdp.exexrlrlxf.exettnnbn.exebtttbt.exejdvdp.exedvvdp.exellfrlrr.exe3htbht.exe3nbntt.exepjvdd.exexlfrxfl.exexlxlffx.exe3bttnb.exenhntnt.exedjdpp.exefxlxflf.exehbbnht.exenhbthn.exepdpvp.exexxlffff.exebtnnbh.exenhthnt.exejdvdp.exefrfrxfx.exefxlfllr.exe7bnbht.exehthtbh.exeddvdd.exevpddj.exelxrrflr.exetnhtnn.exe1hnthh.exejdvjp.exe5jdvj.exefxlxlrf.exe1lfxllr.exetnhnbh.exe7bnbhh.exedpjvd.exe9dppv.exelxllllr.exe5lrrxxl.exehthhnn.exebntbtb.exejdjjv.exejdpvd.exerfxrxxf.exebbtbbn.exenbnnnt.exe1ddpj.exevpjpv.exerfrxllf.exellxxfff.exebbbnhn.exepid process 1980 hbtbhh.exe 2664 1fxfxxf.exe 2724 nhttbt.exe 1904 rlllxfl.exe 2512 tnbhnt.exe 2508 tnhbhh.exe 2904 1dpdd.exe 1484 lfrxllr.exe 2532 tnbtbh.exe 2760 bbhhnt.exe 2772 dvvdp.exe 296 xrlrlxf.exe 1560 ttnnbn.exe 1412 btttbt.exe 1512 jdvdp.exe 1236 dvvdp.exe 2324 llfrlrr.exe 1896 3htbht.exe 1924 3nbntt.exe 2220 pjvdd.exe 764 xlfrxfl.exe 572 xlxlffx.exe 824 3bttnb.exe 1060 nhntnt.exe 3016 djdpp.exe 1796 fxlxflf.exe 868 hbbnht.exe 2412 nhbthn.exe 1928 pdpvp.exe 2700 xxlffff.exe 2308 btnnbh.exe 1976 nhthnt.exe 2556 jdvdp.exe 1500 frfrxfx.exe 2608 fxlfllr.exe 2824 7bnbht.exe 2688 hthtbh.exe 2580 ddvdd.exe 2776 vpddj.exe 2500 lxrrflr.exe 2484 tnhtnn.exe 2496 1hnthh.exe 2528 jdvjp.exe 1520 5jdvj.exe 2440 fxlxlrf.exe 2644 1lfxllr.exe 2264 tnhnbh.exe 1596 7bnbhh.exe 1004 dpjvd.exe 1720 9dppv.exe 1416 lxllllr.exe 1472 5lrrxxl.exe 2916 hthhnn.exe 1172 bntbtb.exe 2192 jdjjv.exe 2324 jdpvd.exe 2836 rfxrxxf.exe 1924 bbtbbn.exe 2208 nbnnnt.exe 1656 1ddpj.exe 264 vpjpv.exe 1644 rfrxllf.exe 824 llxxfff.exe 1204 bbbnhn.exe -
Processes:
resource yara_rule behavioral1/memory/2740-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1236-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/572-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/868-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d6d827d01a9a6150fe87e5df7964e590_NeikiAnalytics.exehbtbhh.exe1fxfxxf.exenhttbt.exerlllxfl.exetnbhnt.exetnhbhh.exe1dpdd.exelfrxllr.exetnbtbh.exebbhhnt.exedvvdp.exexrlrlxf.exettnnbn.exebtttbt.exejdvdp.exedescription pid process target process PID 2740 wrote to memory of 1980 2740 d6d827d01a9a6150fe87e5df7964e590_NeikiAnalytics.exe hbtbhh.exe PID 2740 wrote to memory of 1980 2740 d6d827d01a9a6150fe87e5df7964e590_NeikiAnalytics.exe hbtbhh.exe PID 2740 wrote to memory of 1980 2740 d6d827d01a9a6150fe87e5df7964e590_NeikiAnalytics.exe hbtbhh.exe PID 2740 wrote to memory of 1980 2740 d6d827d01a9a6150fe87e5df7964e590_NeikiAnalytics.exe hbtbhh.exe PID 1980 wrote to memory of 2664 1980 hbtbhh.exe 1fxfxxf.exe PID 1980 wrote to memory of 2664 1980 hbtbhh.exe 1fxfxxf.exe PID 1980 wrote to memory of 2664 1980 hbtbhh.exe 1fxfxxf.exe PID 1980 wrote to memory of 2664 1980 hbtbhh.exe 1fxfxxf.exe PID 2664 wrote to memory of 2724 2664 1fxfxxf.exe nhttbt.exe PID 2664 wrote to memory of 2724 2664 1fxfxxf.exe nhttbt.exe PID 2664 wrote to memory of 2724 2664 1fxfxxf.exe nhttbt.exe PID 2664 wrote to memory of 2724 2664 1fxfxxf.exe nhttbt.exe PID 2724 wrote to memory of 1904 2724 nhttbt.exe rlllxfl.exe PID 2724 wrote to memory of 1904 2724 nhttbt.exe rlllxfl.exe PID 2724 wrote to memory of 1904 2724 nhttbt.exe rlllxfl.exe PID 2724 wrote to memory of 1904 2724 nhttbt.exe rlllxfl.exe PID 1904 wrote to memory of 2512 1904 rlllxfl.exe tnbhnt.exe PID 1904 wrote to memory of 2512 1904 rlllxfl.exe tnbhnt.exe PID 1904 wrote to memory of 2512 1904 rlllxfl.exe tnbhnt.exe PID 1904 wrote to memory of 2512 1904 rlllxfl.exe tnbhnt.exe PID 2512 wrote to memory of 2508 2512 tnbhnt.exe tnhbhh.exe PID 2512 wrote to memory of 2508 2512 tnbhnt.exe tnhbhh.exe PID 2512 wrote to memory of 2508 2512 tnbhnt.exe tnhbhh.exe PID 2512 wrote to memory of 2508 2512 tnbhnt.exe tnhbhh.exe PID 2508 wrote to memory of 2904 2508 tnhbhh.exe 1dpdd.exe PID 2508 wrote to memory of 2904 2508 tnhbhh.exe 1dpdd.exe PID 2508 wrote to memory of 2904 2508 tnhbhh.exe 1dpdd.exe PID 2508 wrote to memory of 2904 2508 tnhbhh.exe 1dpdd.exe PID 2904 wrote to memory of 1484 2904 1dpdd.exe lfrxllr.exe PID 2904 wrote to memory of 1484 2904 1dpdd.exe lfrxllr.exe PID 2904 wrote to memory of 1484 2904 1dpdd.exe lfrxllr.exe PID 2904 wrote to memory of 1484 2904 1dpdd.exe lfrxllr.exe PID 1484 wrote to memory of 2532 1484 lfrxllr.exe tnbtbh.exe PID 1484 wrote to memory of 2532 1484 lfrxllr.exe tnbtbh.exe PID 1484 wrote to memory of 2532 1484 lfrxllr.exe tnbtbh.exe PID 1484 wrote to memory of 2532 1484 lfrxllr.exe tnbtbh.exe PID 2532 wrote to memory of 2760 2532 tnbtbh.exe bbhhnt.exe PID 2532 wrote to memory of 2760 2532 tnbtbh.exe bbhhnt.exe PID 2532 wrote to memory of 2760 2532 tnbtbh.exe bbhhnt.exe PID 2532 wrote to memory of 2760 2532 tnbtbh.exe bbhhnt.exe PID 2760 wrote to memory of 2772 2760 bbhhnt.exe dvvdp.exe PID 2760 wrote to memory of 2772 2760 bbhhnt.exe dvvdp.exe PID 2760 wrote to memory of 2772 2760 bbhhnt.exe dvvdp.exe PID 2760 wrote to memory of 2772 2760 bbhhnt.exe dvvdp.exe PID 2772 wrote to memory of 296 2772 dvvdp.exe xrlrlxf.exe PID 2772 wrote to memory of 296 2772 dvvdp.exe xrlrlxf.exe PID 2772 wrote to memory of 296 2772 dvvdp.exe xrlrlxf.exe PID 2772 wrote to memory of 296 2772 dvvdp.exe xrlrlxf.exe PID 296 wrote to memory of 1560 296 xrlrlxf.exe ttnnbn.exe PID 296 wrote to memory of 1560 296 xrlrlxf.exe ttnnbn.exe PID 296 wrote to memory of 1560 296 xrlrlxf.exe ttnnbn.exe PID 296 wrote to memory of 1560 296 xrlrlxf.exe ttnnbn.exe PID 1560 wrote to memory of 1412 1560 ttnnbn.exe btttbt.exe PID 1560 wrote to memory of 1412 1560 ttnnbn.exe btttbt.exe PID 1560 wrote to memory of 1412 1560 ttnnbn.exe btttbt.exe PID 1560 wrote to memory of 1412 1560 ttnnbn.exe btttbt.exe PID 1412 wrote to memory of 1512 1412 btttbt.exe jdvdp.exe PID 1412 wrote to memory of 1512 1412 btttbt.exe jdvdp.exe PID 1412 wrote to memory of 1512 1412 btttbt.exe jdvdp.exe PID 1412 wrote to memory of 1512 1412 btttbt.exe jdvdp.exe PID 1512 wrote to memory of 1236 1512 jdvdp.exe dvvdp.exe PID 1512 wrote to memory of 1236 1512 jdvdp.exe dvvdp.exe PID 1512 wrote to memory of 1236 1512 jdvdp.exe dvvdp.exe PID 1512 wrote to memory of 1236 1512 jdvdp.exe dvvdp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6d827d01a9a6150fe87e5df7964e590_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d6d827d01a9a6150fe87e5df7964e590_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\hbtbhh.exec:\hbtbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\1fxfxxf.exec:\1fxfxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\nhttbt.exec:\nhttbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rlllxfl.exec:\rlllxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\tnbhnt.exec:\tnbhnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\tnhbhh.exec:\tnhbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\1dpdd.exec:\1dpdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\lfrxllr.exec:\lfrxllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\tnbtbh.exec:\tnbtbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\bbhhnt.exec:\bbhhnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\dvvdp.exec:\dvvdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\xrlrlxf.exec:\xrlrlxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
\??\c:\ttnnbn.exec:\ttnnbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\btttbt.exec:\btttbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\jdvdp.exec:\jdvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\dvvdp.exec:\dvvdp.exe17⤵
- Executes dropped EXE
PID:1236 -
\??\c:\llfrlrr.exec:\llfrlrr.exe18⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3htbht.exec:\3htbht.exe19⤵
- Executes dropped EXE
PID:1896 -
\??\c:\3nbntt.exec:\3nbntt.exe20⤵
- Executes dropped EXE
PID:1924 -
\??\c:\pjvdd.exec:\pjvdd.exe21⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xlfrxfl.exec:\xlfrxfl.exe22⤵
- Executes dropped EXE
PID:764 -
\??\c:\xlxlffx.exec:\xlxlffx.exe23⤵
- Executes dropped EXE
PID:572 -
\??\c:\3bttnb.exec:\3bttnb.exe24⤵
- Executes dropped EXE
PID:824 -
\??\c:\nhntnt.exec:\nhntnt.exe25⤵
- Executes dropped EXE
PID:1060 -
\??\c:\djdpp.exec:\djdpp.exe26⤵
- Executes dropped EXE
PID:3016 -
\??\c:\fxlxflf.exec:\fxlxflf.exe27⤵
- Executes dropped EXE
PID:1796 -
\??\c:\hbbnht.exec:\hbbnht.exe28⤵
- Executes dropped EXE
PID:868 -
\??\c:\nhbthn.exec:\nhbthn.exe29⤵
- Executes dropped EXE
PID:2412 -
\??\c:\pdpvp.exec:\pdpvp.exe30⤵
- Executes dropped EXE
PID:1928 -
\??\c:\xxlffff.exec:\xxlffff.exe31⤵
- Executes dropped EXE
PID:2700 -
\??\c:\btnnbh.exec:\btnnbh.exe32⤵
- Executes dropped EXE
PID:2308 -
\??\c:\nhthnt.exec:\nhthnt.exe33⤵
- Executes dropped EXE
PID:1976 -
\??\c:\jdvdp.exec:\jdvdp.exe34⤵
- Executes dropped EXE
PID:2556 -
\??\c:\frfrxfx.exec:\frfrxfx.exe35⤵
- Executes dropped EXE
PID:1500 -
\??\c:\fxlfllr.exec:\fxlfllr.exe36⤵
- Executes dropped EXE
PID:2608 -
\??\c:\7bnbht.exec:\7bnbht.exe37⤵
- Executes dropped EXE
PID:2824 -
\??\c:\hthtbh.exec:\hthtbh.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\ddvdd.exec:\ddvdd.exe39⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vpddj.exec:\vpddj.exe40⤵
- Executes dropped EXE
PID:2776 -
\??\c:\lxrrflr.exec:\lxrrflr.exe41⤵
- Executes dropped EXE
PID:2500 -
\??\c:\tnhtnn.exec:\tnhtnn.exe42⤵
- Executes dropped EXE
PID:2484 -
\??\c:\1hnthh.exec:\1hnthh.exe43⤵
- Executes dropped EXE
PID:2496 -
\??\c:\jdvjp.exec:\jdvjp.exe44⤵
- Executes dropped EXE
PID:2528 -
\??\c:\5jdvj.exec:\5jdvj.exe45⤵
- Executes dropped EXE
PID:1520 -
\??\c:\fxlxlrf.exec:\fxlxlrf.exe46⤵
- Executes dropped EXE
PID:2440 -
\??\c:\1lfxllr.exec:\1lfxllr.exe47⤵
- Executes dropped EXE
PID:2644 -
\??\c:\tnhnbh.exec:\tnhnbh.exe48⤵
- Executes dropped EXE
PID:2264 -
\??\c:\7bnbhh.exec:\7bnbhh.exe49⤵
- Executes dropped EXE
PID:1596 -
\??\c:\dpjvd.exec:\dpjvd.exe50⤵
- Executes dropped EXE
PID:1004 -
\??\c:\9dppv.exec:\9dppv.exe51⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lxllllr.exec:\lxllllr.exe52⤵
- Executes dropped EXE
PID:1416 -
\??\c:\5lrrxxl.exec:\5lrrxxl.exe53⤵
- Executes dropped EXE
PID:1472 -
\??\c:\hthhnn.exec:\hthhnn.exe54⤵
- Executes dropped EXE
PID:2916 -
\??\c:\bntbtb.exec:\bntbtb.exe55⤵
- Executes dropped EXE
PID:1172 -
\??\c:\jdjjv.exec:\jdjjv.exe56⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jdpvd.exec:\jdpvd.exe57⤵
- Executes dropped EXE
PID:2324 -
\??\c:\rfxrxxf.exec:\rfxrxxf.exe58⤵
- Executes dropped EXE
PID:2836 -
\??\c:\bbtbbn.exec:\bbtbbn.exe59⤵
- Executes dropped EXE
PID:1924 -
\??\c:\nbnnnt.exec:\nbnnnt.exe60⤵
- Executes dropped EXE
PID:2208 -
\??\c:\1ddpj.exec:\1ddpj.exe61⤵
- Executes dropped EXE
PID:1656 -
\??\c:\vpjpv.exec:\vpjpv.exe62⤵
- Executes dropped EXE
PID:264 -
\??\c:\rfrxllf.exec:\rfrxllf.exe63⤵
- Executes dropped EXE
PID:1644 -
\??\c:\llxxfff.exec:\llxxfff.exe64⤵
- Executes dropped EXE
PID:824 -
\??\c:\bbbnhn.exec:\bbbnhn.exe65⤵
- Executes dropped EXE
PID:1204 -
\??\c:\tnbnhb.exec:\tnbnhb.exe66⤵PID:2084
-
\??\c:\ppdjv.exec:\ppdjv.exe67⤵PID:3012
-
\??\c:\vpvvv.exec:\vpvvv.exe68⤵PID:1632
-
\??\c:\5rlllrf.exec:\5rlllrf.exe69⤵PID:2280
-
\??\c:\xxxlxlx.exec:\xxxlxlx.exe70⤵PID:2944
-
\??\c:\tnthtt.exec:\tnthtt.exe71⤵PID:1080
-
\??\c:\nbnhtt.exec:\nbnhtt.exe72⤵PID:1776
-
\??\c:\vpdpd.exec:\vpdpd.exe73⤵PID:288
-
\??\c:\vpvdj.exec:\vpvdj.exe74⤵PID:1232
-
\??\c:\xxlxrxf.exec:\xxlxrxf.exe75⤵PID:2316
-
\??\c:\llxrllx.exec:\llxrllx.exe76⤵PID:1980
-
\??\c:\7ntbbh.exec:\7ntbbh.exe77⤵PID:1496
-
\??\c:\tthbnn.exec:\tthbnn.exe78⤵PID:2604
-
\??\c:\vpdpd.exec:\vpdpd.exe79⤵PID:2736
-
\??\c:\vpjpp.exec:\vpjpp.exe80⤵PID:2332
-
\??\c:\fxllrfx.exec:\fxllrfx.exe81⤵PID:2784
-
\??\c:\rfrrxrr.exec:\rfrrxrr.exe82⤵PID:2712
-
\??\c:\5rrfxrl.exec:\5rrfxrl.exe83⤵PID:2716
-
\??\c:\5htbhn.exec:\5htbhn.exe84⤵PID:2540
-
\??\c:\5hbbhn.exec:\5hbbhn.exe85⤵PID:548
-
\??\c:\3pjvj.exec:\3pjvj.exe86⤵PID:1320
-
\??\c:\ddppd.exec:\ddppd.exe87⤵PID:1348
-
\??\c:\ffxxlff.exec:\ffxxlff.exe88⤵PID:1216
-
\??\c:\rfxfrrx.exec:\rfxfrrx.exe89⤵PID:2652
-
\??\c:\hhbnhh.exec:\hhbnhh.exe90⤵PID:2348
-
\??\c:\5nhbhh.exec:\5nhbhh.exe91⤵PID:1528
-
\??\c:\dvvvp.exec:\dvvvp.exe92⤵PID:1012
-
\??\c:\vvpvd.exec:\vvpvd.exe93⤵PID:2132
-
\??\c:\rrfflrf.exec:\rrfflrf.exe94⤵PID:1436
-
\??\c:\xrfflfl.exec:\xrfflfl.exe95⤵PID:2384
-
\??\c:\bnbhnt.exec:\bnbhnt.exe96⤵PID:2032
-
\??\c:\hhbthn.exec:\hhbthn.exe97⤵PID:2000
-
\??\c:\vpddv.exec:\vpddv.exe98⤵PID:2340
-
\??\c:\dpjpv.exec:\dpjpv.exe99⤵PID:1728
-
\??\c:\fxrlxlr.exec:\fxrlxlr.exe100⤵PID:2800
-
\??\c:\rlfrlrf.exec:\rlfrlrf.exe101⤵PID:1948
-
\??\c:\hbnbhh.exec:\hbnbhh.exe102⤵PID:2404
-
\??\c:\1bhnth.exec:\1bhnth.exe103⤵PID:2228
-
\??\c:\vdpjd.exec:\vdpjd.exe104⤵PID:796
-
\??\c:\ddvdp.exec:\ddvdp.exe105⤵PID:1732
-
\??\c:\5xflllx.exec:\5xflllx.exe106⤵PID:1884
-
\??\c:\rrflxlf.exec:\rrflxlf.exe107⤵PID:2436
-
\??\c:\1tbntt.exec:\1tbntt.exe108⤵PID:984
-
\??\c:\vjvvj.exec:\vjvvj.exe109⤵PID:1684
-
\??\c:\jdpjd.exec:\jdpjd.exe110⤵PID:904
-
\??\c:\pdvjj.exec:\pdvjj.exe111⤵PID:868
-
\??\c:\rfxflrf.exec:\rfxflrf.exe112⤵PID:2008
-
\??\c:\lfxfllr.exec:\lfxfllr.exe113⤵PID:2864
-
\??\c:\ttnhnn.exec:\ttnhnn.exe114⤵PID:2056
-
\??\c:\dpvdj.exec:\dpvdj.exe115⤵PID:864
-
\??\c:\7jvdd.exec:\7jvdd.exe116⤵PID:1592
-
\??\c:\lffxllr.exec:\lffxllr.exe117⤵PID:1976
-
\??\c:\rfxfxfl.exec:\rfxfxfl.exe118⤵PID:1608
-
\??\c:\btbhtb.exec:\btbhtb.exe119⤵PID:1492
-
\??\c:\thnntb.exec:\thnntb.exe120⤵PID:2820
-
\??\c:\vdpvj.exec:\vdpvj.exe121⤵PID:2620
-
\??\c:\5pjdd.exec:\5pjdd.exe122⤵PID:2592
-
\??\c:\5rrllrf.exec:\5rrllrf.exe123⤵PID:2624
-
\??\c:\rlrxllr.exec:\rlrxllr.exe124⤵PID:2776
-
\??\c:\hbnbtb.exec:\hbnbtb.exe125⤵PID:1904
-
\??\c:\7htbhn.exec:\7htbhn.exe126⤵PID:1588
-
\??\c:\jpjpd.exec:\jpjpd.exe127⤵PID:2900
-
\??\c:\pjvdp.exec:\pjvdp.exe128⤵PID:2508
-
\??\c:\5rrllfl.exec:\5rrllfl.exe129⤵PID:1240
-
\??\c:\lllrxlr.exec:\lllrxlr.exe130⤵PID:2640
-
\??\c:\7ttnbh.exec:\7ttnbh.exe131⤵PID:2644
-
\??\c:\thnntb.exec:\thnntb.exe132⤵PID:2264
-
\??\c:\vdpdd.exec:\vdpdd.exe133⤵PID:2772
-
\??\c:\jdvdp.exec:\jdvdp.exe134⤵PID:1020
-
\??\c:\7rrfflr.exec:\7rrfflr.exe135⤵PID:2136
-
\??\c:\lfxffrx.exec:\lfxffrx.exe136⤵PID:2100
-
\??\c:\thtnnt.exec:\thtnnt.exe137⤵PID:1176
-
\??\c:\ntnhhb.exec:\ntnhhb.exe138⤵PID:2916
-
\??\c:\fxflflr.exec:\fxflflr.exe139⤵PID:2036
-
\??\c:\xrxflrx.exec:\xrxflrx.exe140⤵PID:2192
-
\??\c:\3bbhnh.exec:\3bbhnh.exe141⤵PID:2004
-
\??\c:\nbbhbh.exec:\nbbhbh.exe142⤵PID:2448
-
\??\c:\hbtbnn.exec:\hbtbnn.exe143⤵PID:1100
-
\??\c:\pjvdp.exec:\pjvdp.exe144⤵PID:1048
-
\??\c:\pjdjv.exec:\pjdjv.exe145⤵PID:1656
-
\??\c:\fxfrllr.exec:\fxfrllr.exe146⤵PID:520
-
\??\c:\bbthbh.exec:\bbthbh.exe147⤵PID:892
-
\??\c:\bnhtbn.exec:\bnhtbn.exe148⤵PID:3008
-
\??\c:\djjjp.exec:\djjjp.exe149⤵PID:2964
-
\??\c:\vdpjp.exec:\vdpjp.exe150⤵PID:2084
-
\??\c:\3xflrxf.exec:\3xflrxf.exe151⤵PID:3012
-
\??\c:\llfrrxl.exec:\llfrrxl.exe152⤵PID:2960
-
\??\c:\nhtbth.exec:\nhtbth.exe153⤵PID:676
-
\??\c:\nhbtth.exec:\nhbtth.exe154⤵PID:1848
-
\??\c:\1pdpv.exec:\1pdpv.exe155⤵PID:1972
-
\??\c:\pjvjp.exec:\pjvjp.exe156⤵PID:1672
-
\??\c:\rrxfrrx.exec:\rrxfrrx.exe157⤵PID:1716
-
\??\c:\xxrrflf.exec:\xxrrflf.exe158⤵PID:1232
-
\??\c:\1tthth.exec:\1tthth.exe159⤵PID:1488
-
\??\c:\tbhbnt.exec:\tbhbnt.exe160⤵PID:1980
-
\??\c:\vpdjj.exec:\vpdjj.exe161⤵PID:2972
-
\??\c:\pjddp.exec:\pjddp.exe162⤵PID:2608
-
\??\c:\7xxxlfr.exec:\7xxxlfr.exe163⤵PID:2720
-
\??\c:\7xrlxfl.exec:\7xrlxfl.exe164⤵PID:2332
-
\??\c:\nhtbth.exec:\nhtbth.exe165⤵PID:1712
-
\??\c:\1jvvd.exec:\1jvvd.exe166⤵PID:2468
-
\??\c:\djpvj.exec:\djpvj.exe167⤵PID:1516
-
\??\c:\3ffrxfr.exec:\3ffrxfr.exe168⤵PID:2540
-
\??\c:\3lfxrxx.exec:\3lfxrxx.exe169⤵PID:2284
-
\??\c:\bbthbb.exec:\bbthbb.exe170⤵PID:828
-
\??\c:\bthntb.exec:\bthntb.exe171⤵PID:836
-
\??\c:\9jddj.exec:\9jddj.exe172⤵PID:1216
-
\??\c:\5jvvj.exec:\5jvvj.exe173⤵PID:2096
-
\??\c:\xrxflrf.exec:\xrxflrf.exe174⤵PID:2348
-
\??\c:\xrllxxl.exec:\xrllxxl.exe175⤵PID:748
-
\??\c:\nnbnbh.exec:\nnbnbh.exe176⤵PID:1540
-
\??\c:\nnhnbn.exec:\nnhnbn.exe177⤵PID:1404
-
\??\c:\dvdvd.exec:\dvdvd.exe178⤵PID:1468
-
\??\c:\vvdpj.exec:\vvdpj.exe179⤵PID:2384
-
\??\c:\llffffr.exec:\llffffr.exe180⤵PID:2032
-
\??\c:\frfrlrx.exec:\frfrlrx.exe181⤵PID:832
-
\??\c:\3nhhbh.exec:\3nhhbh.exe182⤵PID:2340
-
\??\c:\jjdvj.exec:\jjdvj.exe183⤵PID:1944
-
\??\c:\jdvpd.exec:\jdvpd.exe184⤵PID:980
-
\??\c:\rrrrflx.exec:\rrrrflx.exe185⤵PID:660
-
\??\c:\frlrlxl.exec:\frlrlxl.exe186⤵PID:1640
-
\??\c:\tnhnnb.exec:\tnhnnb.exe187⤵PID:672
-
\??\c:\bnbntb.exec:\bnbntb.exe188⤵PID:1648
-
\??\c:\1pddv.exec:\1pddv.exe189⤵PID:2252
-
\??\c:\lfxxlxr.exec:\lfxxlxr.exe190⤵PID:2424
-
\??\c:\5lllxxf.exec:\5lllxxf.exe191⤵PID:1060
-
\??\c:\hhntbh.exec:\hhntbh.exe192⤵PID:1876
-
\??\c:\hhbnhn.exec:\hhbnhn.exe193⤵PID:876
-
\??\c:\pppvj.exec:\pppvj.exe194⤵PID:308
-
\??\c:\llxxflx.exec:\llxxflx.exe195⤵PID:868
-
\??\c:\lllxlxf.exec:\lllxlxf.exe196⤵PID:2412
-
\??\c:\ttbttb.exec:\ttbttb.exe197⤵PID:1668
-
\??\c:\thtbhn.exec:\thtbhn.exe198⤵PID:2308
-
\??\c:\dvppp.exec:\dvppp.exe199⤵PID:1672
-
\??\c:\xrffflx.exec:\xrffflx.exe200⤵PID:1592
-
\??\c:\xrlrffr.exec:\xrlrffr.exe201⤵PID:2684
-
\??\c:\bnhbtt.exec:\bnhbtt.exe202⤵PID:2892
-
\??\c:\vvdpv.exec:\vvdpv.exe203⤵PID:1500
-
\??\c:\5rrxlrx.exec:\5rrxlrx.exe204⤵PID:2472
-
\??\c:\5flxffr.exec:\5flxffr.exe205⤵PID:2620
-
\??\c:\btnnth.exec:\btnnth.exe206⤵PID:1604
-
\??\c:\hbhhtb.exec:\hbhhtb.exe207⤵PID:2624
-
\??\c:\vjdjp.exec:\vjdjp.exe208⤵PID:2776
-
\??\c:\jjdjp.exec:\jjdjp.exe209⤵PID:1904
-
\??\c:\1xrffxf.exec:\1xrffxf.exe210⤵PID:2480
-
\??\c:\rlxllfx.exec:\rlxllfx.exe211⤵PID:2900
-
\??\c:\9nbhtt.exec:\9nbhtt.exe212⤵PID:1368
-
\??\c:\3vjvv.exec:\3vjvv.exe213⤵PID:1240
-
\??\c:\9djjv.exec:\9djjv.exe214⤵PID:2640
-
\??\c:\rllxlxf.exec:\rllxlxf.exe215⤵PID:1544
-
\??\c:\frrlrxx.exec:\frrlrxx.exe216⤵PID:2780
-
\??\c:\tnhtbb.exec:\tnhtbb.exe217⤵PID:2772
-
\??\c:\nbthhn.exec:\nbthhn.exe218⤵PID:1252
-
\??\c:\7pjpv.exec:\7pjpv.exe219⤵PID:2136
-
\??\c:\jdvvd.exec:\jdvvd.exe220⤵PID:2888
-
\??\c:\lxrrflx.exec:\lxrrflx.exe221⤵PID:1176
-
\??\c:\lfxlfrf.exec:\lfxlfrf.exe222⤵PID:2916
-
\??\c:\bthhtt.exec:\bthhtt.exe223⤵PID:2036
-
\??\c:\7bhntb.exec:\7bhntb.exe224⤵PID:2192
-
\??\c:\vpdjv.exec:\vpdjv.exe225⤵PID:2004
-
\??\c:\vpjvd.exec:\vpjvd.exe226⤵PID:2220
-
\??\c:\7lfrxfl.exec:\7lfrxfl.exe227⤵PID:1100
-
\??\c:\hbnthn.exec:\hbnthn.exe228⤵PID:1724
-
\??\c:\9nhhtt.exec:\9nhhtt.exe229⤵PID:1788
-
\??\c:\pjdjp.exec:\pjdjp.exe230⤵PID:1532
-
\??\c:\dvdpp.exec:\dvdpp.exe231⤵PID:892
-
\??\c:\fxlrlrl.exec:\fxlrlrl.exe232⤵PID:236
-
\??\c:\fxllxrx.exec:\fxllxrx.exe233⤵PID:2964
-
\??\c:\7nbnhh.exec:\7nbnhh.exe234⤵PID:1536
-
\??\c:\nbntbb.exec:\nbntbb.exe235⤵PID:1016
-
\??\c:\1pdvv.exec:\1pdvv.exe236⤵PID:2852
-
\??\c:\lxrxffl.exec:\lxrxffl.exe237⤵PID:1912
-
\??\c:\ffrrffr.exec:\ffrrffr.exe238⤵PID:3048
-
\??\c:\btbttn.exec:\btbttn.exe239⤵PID:1776
-
\??\c:\nbbnbb.exec:\nbbnbb.exe240⤵PID:1600
-
\??\c:\9pjpd.exec:\9pjpd.exe241⤵PID:2364
-
\??\c:\5dpvp.exec:\5dpvp.exe242⤵PID:1852