Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 17:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fdb7ab0849fe756d2299e1bad7a70860_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
fdb7ab0849fe756d2299e1bad7a70860_NeikiAnalytics.exe
-
Size
75KB
-
MD5
fdb7ab0849fe756d2299e1bad7a70860
-
SHA1
0463f0758f7781dca1ec0e13db852e08a4972bf1
-
SHA256
4ed4e7b131d6192cdce6dfd699c96e8cca6e33f58c89a49ef14f8564048235fc
-
SHA512
257c70203e61ca15986895b7fe6371be68b0b4f378372b330cbd754cf3ec87a86bf5c2b9c46e2abf880cc2331cdebe09390cfac4d50e8292373fe292207ae68a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rIN0:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCuG
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/2908-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1420-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4128-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vvpvp.exelflfrlx.exehbbbbb.exeppjjv.exefrrllrl.exe3xlffxx.exehtnbnn.exevddvj.exelrfxrlf.exe5bthhb.exejdvpj.exedjvpj.exefflllxr.exe1bhhhn.exe5jvvv.exe3frllrr.exe5rrrxxr.exebnbbbh.exevpjpd.exe9fxxlll.exerfflrll.exentbttb.exedvddd.exeflfflxx.exentbhbb.exehbhhbh.exedpdvd.exeffxllll.exethnhbb.exedvjdp.exellffxfx.exe5flrrrl.exennbbbn.exepjvvp.exeddjjp.exexfxrlrl.exehhbhhn.exepdvjj.exe5vjdd.exexflrlll.exelflrlll.exebhtbhn.exedvvpp.exe1dpvv.exexrxxfff.exexlxrrrx.exehhbttb.exevvvpj.exevvvvv.exexrlxfxx.exenbhbbh.exettttnn.exedddvj.exejdppj.exerrrrlxx.exe1xffxff.exehnhnht.exetnbbhh.exeddvvd.exejjjpd.exefrxrrrr.exexlrrffx.exebthbtt.exethhbbt.exepid process 1576 vvpvp.exe 1456 lflfrlx.exe 4596 hbbbbb.exe 1588 ppjjv.exe 4412 frrllrl.exe 3512 3xlffxx.exe 2724 htnbnn.exe 4860 vddvj.exe 1956 lrfxrlf.exe 4000 5bthhb.exe 4852 jdvpj.exe 3528 djvpj.exe 1420 fflllxr.exe 2012 1bhhhn.exe 1968 5jvvv.exe 432 3frllrr.exe 4440 5rrrxxr.exe 1748 bnbbbh.exe 1292 vpjpd.exe 4692 9fxxlll.exe 4064 rfflrll.exe 3216 ntbttb.exe 3496 dvddd.exe 2028 flfflxx.exe 1476 ntbhbb.exe 4128 hbhhbh.exe 4748 dpdvd.exe 1124 ffxllll.exe 5052 thnhbb.exe 4628 dvjdp.exe 4388 llffxfx.exe 4616 5flrrrl.exe 4416 nnbbbn.exe 3164 pjvvp.exe 2840 ddjjp.exe 1616 xfxrlrl.exe 4492 hhbhhn.exe 4856 pdvjj.exe 3752 5vjdd.exe 1912 xflrlll.exe 2308 lflrlll.exe 3348 bhtbhn.exe 3060 dvvpp.exe 3516 1dpvv.exe 3532 xrxxfff.exe 8 xlxrrrx.exe 2976 hhbttb.exe 228 vvvpj.exe 2724 vvvvv.exe 1684 xrlxfxx.exe 1592 nbhbbh.exe 3096 ttttnn.exe 1436 dddvj.exe 3144 jdppj.exe 1960 rrrrlxx.exe 2960 1xffxff.exe 384 hnhnht.exe 2012 tnbbhh.exe 2376 ddvvd.exe 3712 jjjpd.exe 812 frxrrrr.exe 1736 xlrrffx.exe 3356 bthbtt.exe 4296 thhbbt.exe -
Processes:
resource yara_rule behavioral2/memory/2908-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4128-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fdb7ab0849fe756d2299e1bad7a70860_NeikiAnalytics.exevvpvp.exelflfrlx.exehbbbbb.exeppjjv.exefrrllrl.exe3xlffxx.exehtnbnn.exevddvj.exelrfxrlf.exe5bthhb.exejdvpj.exedjvpj.exefflllxr.exe1bhhhn.exe5jvvv.exe3frllrr.exe5rrrxxr.exebnbbbh.exevpjpd.exe9fxxlll.exerfflrll.exedescription pid process target process PID 2908 wrote to memory of 1576 2908 fdb7ab0849fe756d2299e1bad7a70860_NeikiAnalytics.exe vvpvp.exe PID 2908 wrote to memory of 1576 2908 fdb7ab0849fe756d2299e1bad7a70860_NeikiAnalytics.exe vvpvp.exe PID 2908 wrote to memory of 1576 2908 fdb7ab0849fe756d2299e1bad7a70860_NeikiAnalytics.exe vvpvp.exe PID 1576 wrote to memory of 1456 1576 vvpvp.exe lflfrlx.exe PID 1576 wrote to memory of 1456 1576 vvpvp.exe lflfrlx.exe PID 1576 wrote to memory of 1456 1576 vvpvp.exe lflfrlx.exe PID 1456 wrote to memory of 4596 1456 lflfrlx.exe hbbbbb.exe PID 1456 wrote to memory of 4596 1456 lflfrlx.exe hbbbbb.exe PID 1456 wrote to memory of 4596 1456 lflfrlx.exe hbbbbb.exe PID 4596 wrote to memory of 1588 4596 hbbbbb.exe ppjjv.exe PID 4596 wrote to memory of 1588 4596 hbbbbb.exe ppjjv.exe PID 4596 wrote to memory of 1588 4596 hbbbbb.exe ppjjv.exe PID 1588 wrote to memory of 4412 1588 ppjjv.exe frrllrl.exe PID 1588 wrote to memory of 4412 1588 ppjjv.exe frrllrl.exe PID 1588 wrote to memory of 4412 1588 ppjjv.exe frrllrl.exe PID 4412 wrote to memory of 3512 4412 frrllrl.exe 3xlffxx.exe PID 4412 wrote to memory of 3512 4412 frrllrl.exe 3xlffxx.exe PID 4412 wrote to memory of 3512 4412 frrllrl.exe 3xlffxx.exe PID 3512 wrote to memory of 2724 3512 3xlffxx.exe htnbnn.exe PID 3512 wrote to memory of 2724 3512 3xlffxx.exe htnbnn.exe PID 3512 wrote to memory of 2724 3512 3xlffxx.exe htnbnn.exe PID 2724 wrote to memory of 4860 2724 htnbnn.exe vddvj.exe PID 2724 wrote to memory of 4860 2724 htnbnn.exe vddvj.exe PID 2724 wrote to memory of 4860 2724 htnbnn.exe vddvj.exe PID 4860 wrote to memory of 1956 4860 vddvj.exe lrfxrlf.exe PID 4860 wrote to memory of 1956 4860 vddvj.exe lrfxrlf.exe PID 4860 wrote to memory of 1956 4860 vddvj.exe lrfxrlf.exe PID 1956 wrote to memory of 4000 1956 lrfxrlf.exe 5bthhb.exe PID 1956 wrote to memory of 4000 1956 lrfxrlf.exe 5bthhb.exe PID 1956 wrote to memory of 4000 1956 lrfxrlf.exe 5bthhb.exe PID 4000 wrote to memory of 4852 4000 5bthhb.exe jdvpj.exe PID 4000 wrote to memory of 4852 4000 5bthhb.exe jdvpj.exe PID 4000 wrote to memory of 4852 4000 5bthhb.exe jdvpj.exe PID 4852 wrote to memory of 3528 4852 jdvpj.exe djvpj.exe PID 4852 wrote to memory of 3528 4852 jdvpj.exe djvpj.exe PID 4852 wrote to memory of 3528 4852 jdvpj.exe djvpj.exe PID 3528 wrote to memory of 1420 3528 djvpj.exe fflllxr.exe PID 3528 wrote to memory of 1420 3528 djvpj.exe fflllxr.exe PID 3528 wrote to memory of 1420 3528 djvpj.exe fflllxr.exe PID 1420 wrote to memory of 2012 1420 fflllxr.exe 1bhhhn.exe PID 1420 wrote to memory of 2012 1420 fflllxr.exe 1bhhhn.exe PID 1420 wrote to memory of 2012 1420 fflllxr.exe 1bhhhn.exe PID 2012 wrote to memory of 1968 2012 1bhhhn.exe 5jvvv.exe PID 2012 wrote to memory of 1968 2012 1bhhhn.exe 5jvvv.exe PID 2012 wrote to memory of 1968 2012 1bhhhn.exe 5jvvv.exe PID 1968 wrote to memory of 432 1968 5jvvv.exe 3frllrr.exe PID 1968 wrote to memory of 432 1968 5jvvv.exe 3frllrr.exe PID 1968 wrote to memory of 432 1968 5jvvv.exe 3frllrr.exe PID 432 wrote to memory of 4440 432 3frllrr.exe 5rrrxxr.exe PID 432 wrote to memory of 4440 432 3frllrr.exe 5rrrxxr.exe PID 432 wrote to memory of 4440 432 3frllrr.exe 5rrrxxr.exe PID 4440 wrote to memory of 1748 4440 5rrrxxr.exe bnbbbh.exe PID 4440 wrote to memory of 1748 4440 5rrrxxr.exe bnbbbh.exe PID 4440 wrote to memory of 1748 4440 5rrrxxr.exe bnbbbh.exe PID 1748 wrote to memory of 1292 1748 bnbbbh.exe vpjpd.exe PID 1748 wrote to memory of 1292 1748 bnbbbh.exe vpjpd.exe PID 1748 wrote to memory of 1292 1748 bnbbbh.exe vpjpd.exe PID 1292 wrote to memory of 4692 1292 vpjpd.exe 9fxxlll.exe PID 1292 wrote to memory of 4692 1292 vpjpd.exe 9fxxlll.exe PID 1292 wrote to memory of 4692 1292 vpjpd.exe 9fxxlll.exe PID 4692 wrote to memory of 4064 4692 9fxxlll.exe rfflrll.exe PID 4692 wrote to memory of 4064 4692 9fxxlll.exe rfflrll.exe PID 4692 wrote to memory of 4064 4692 9fxxlll.exe rfflrll.exe PID 4064 wrote to memory of 3216 4064 rfflrll.exe ntbttb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdb7ab0849fe756d2299e1bad7a70860_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\fdb7ab0849fe756d2299e1bad7a70860_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\vvpvp.exec:\vvpvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\lflfrlx.exec:\lflfrlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\hbbbbb.exec:\hbbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\ppjjv.exec:\ppjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\frrllrl.exec:\frrllrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\3xlffxx.exec:\3xlffxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\htnbnn.exec:\htnbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\vddvj.exec:\vddvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\lrfxrlf.exec:\lrfxrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\5bthhb.exec:\5bthhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\jdvpj.exec:\jdvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\djvpj.exec:\djvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\fflllxr.exec:\fflllxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\1bhhhn.exec:\1bhhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\5jvvv.exec:\5jvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\3frllrr.exec:\3frllrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\5rrrxxr.exec:\5rrrxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\bnbbbh.exec:\bnbbbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\vpjpd.exec:\vpjpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\9fxxlll.exec:\9fxxlll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\rfflrll.exec:\rfflrll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\ntbttb.exec:\ntbttb.exe23⤵
- Executes dropped EXE
PID:3216 -
\??\c:\dvddd.exec:\dvddd.exe24⤵
- Executes dropped EXE
PID:3496 -
\??\c:\flfflxx.exec:\flfflxx.exe25⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ntbhbb.exec:\ntbhbb.exe26⤵
- Executes dropped EXE
PID:1476 -
\??\c:\hbhhbh.exec:\hbhhbh.exe27⤵
- Executes dropped EXE
PID:4128 -
\??\c:\dpdvd.exec:\dpdvd.exe28⤵
- Executes dropped EXE
PID:4748 -
\??\c:\ffxllll.exec:\ffxllll.exe29⤵
- Executes dropped EXE
PID:1124 -
\??\c:\thnhbb.exec:\thnhbb.exe30⤵
- Executes dropped EXE
PID:5052 -
\??\c:\dvjdp.exec:\dvjdp.exe31⤵
- Executes dropped EXE
PID:4628 -
\??\c:\llffxfx.exec:\llffxfx.exe32⤵
- Executes dropped EXE
PID:4388 -
\??\c:\5flrrrl.exec:\5flrrrl.exe33⤵
- Executes dropped EXE
PID:4616 -
\??\c:\nnbbbn.exec:\nnbbbn.exe34⤵
- Executes dropped EXE
PID:4416 -
\??\c:\pjvvp.exec:\pjvvp.exe35⤵
- Executes dropped EXE
PID:3164 -
\??\c:\ddjjp.exec:\ddjjp.exe36⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xfxrlrl.exec:\xfxrlrl.exe37⤵
- Executes dropped EXE
PID:1616 -
\??\c:\hhbhhn.exec:\hhbhhn.exe38⤵
- Executes dropped EXE
PID:4492 -
\??\c:\pdvjj.exec:\pdvjj.exe39⤵
- Executes dropped EXE
PID:4856 -
\??\c:\5vjdd.exec:\5vjdd.exe40⤵
- Executes dropped EXE
PID:3752 -
\??\c:\xflrlll.exec:\xflrlll.exe41⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lflrlll.exec:\lflrlll.exe42⤵
- Executes dropped EXE
PID:2308 -
\??\c:\bhtbhn.exec:\bhtbhn.exe43⤵
- Executes dropped EXE
PID:3348 -
\??\c:\dvvpp.exec:\dvvpp.exe44⤵
- Executes dropped EXE
PID:3060 -
\??\c:\1dpvv.exec:\1dpvv.exe45⤵
- Executes dropped EXE
PID:3516 -
\??\c:\xrxxfff.exec:\xrxxfff.exe46⤵
- Executes dropped EXE
PID:3532 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe47⤵
- Executes dropped EXE
PID:8 -
\??\c:\hhbttb.exec:\hhbttb.exe48⤵
- Executes dropped EXE
PID:2976 -
\??\c:\vvvpj.exec:\vvvpj.exe49⤵
- Executes dropped EXE
PID:228 -
\??\c:\vvvvv.exec:\vvvvv.exe50⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xrlxfxx.exec:\xrlxfxx.exe51⤵
- Executes dropped EXE
PID:1684 -
\??\c:\nbhbbh.exec:\nbhbbh.exe52⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ttttnn.exec:\ttttnn.exe53⤵
- Executes dropped EXE
PID:3096 -
\??\c:\dddvj.exec:\dddvj.exe54⤵
- Executes dropped EXE
PID:1436 -
\??\c:\jdppj.exec:\jdppj.exe55⤵
- Executes dropped EXE
PID:3144 -
\??\c:\rrrrlxx.exec:\rrrrlxx.exe56⤵
- Executes dropped EXE
PID:1960 -
\??\c:\1xffxff.exec:\1xffxff.exe57⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hnhnht.exec:\hnhnht.exe58⤵
- Executes dropped EXE
PID:384 -
\??\c:\tnbbhh.exec:\tnbbhh.exe59⤵
- Executes dropped EXE
PID:2012 -
\??\c:\ddvvd.exec:\ddvvd.exe60⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jjjpd.exec:\jjjpd.exe61⤵
- Executes dropped EXE
PID:3712 -
\??\c:\frxrrrr.exec:\frxrrrr.exe62⤵
- Executes dropped EXE
PID:812 -
\??\c:\xlrrffx.exec:\xlrrffx.exe63⤵
- Executes dropped EXE
PID:1736 -
\??\c:\bthbtt.exec:\bthbtt.exe64⤵
- Executes dropped EXE
PID:3356 -
\??\c:\thhbbt.exec:\thhbbt.exe65⤵
- Executes dropped EXE
PID:4296 -
\??\c:\ppjjd.exec:\ppjjd.exe66⤵PID:2524
-
\??\c:\3vddv.exec:\3vddv.exe67⤵PID:5080
-
\??\c:\7lxrxfx.exec:\7lxrxfx.exe68⤵PID:4520
-
\??\c:\lxffflf.exec:\lxffflf.exe69⤵PID:4640
-
\??\c:\hbhbht.exec:\hbhbht.exe70⤵PID:3032
-
\??\c:\btbbbh.exec:\btbbbh.exe71⤵PID:1340
-
\??\c:\1jppj.exec:\1jppj.exe72⤵PID:2028
-
\??\c:\dvvpd.exec:\dvvpd.exe73⤵PID:536
-
\??\c:\1rxxrrx.exec:\1rxxrrx.exe74⤵PID:4128
-
\??\c:\9frrlff.exec:\9frrlff.exe75⤵PID:3708
-
\??\c:\1llfxxx.exec:\1llfxxx.exe76⤵PID:1600
-
\??\c:\9thnnt.exec:\9thnnt.exe77⤵PID:3388
-
\??\c:\nhnhhh.exec:\nhnhhh.exe78⤵PID:5060
-
\??\c:\dvvvp.exec:\dvvvp.exe79⤵PID:4628
-
\??\c:\xrllxff.exec:\xrllxff.exe80⤵PID:4140
-
\??\c:\xxxxlrx.exec:\xxxxlrx.exe81⤵PID:5008
-
\??\c:\htbthh.exec:\htbthh.exe82⤵PID:2572
-
\??\c:\htbbnn.exec:\htbbnn.exe83⤵PID:1632
-
\??\c:\1jppp.exec:\1jppp.exe84⤵PID:2324
-
\??\c:\rlffxfx.exec:\rlffxfx.exe85⤵PID:2640
-
\??\c:\tnbtbn.exec:\tnbtbn.exe86⤵PID:3148
-
\??\c:\jpvpv.exec:\jpvpv.exe87⤵PID:2992
-
\??\c:\jvvdd.exec:\jvvdd.exe88⤵PID:4492
-
\??\c:\lrxflrr.exec:\lrxflrr.exe89⤵PID:2660
-
\??\c:\7xlllll.exec:\7xlllll.exe90⤵PID:468
-
\??\c:\nbbhhn.exec:\nbbhhn.exe91⤵PID:1576
-
\??\c:\jvvjd.exec:\jvvjd.exe92⤵PID:2308
-
\??\c:\vvppd.exec:\vvppd.exe93⤵PID:3348
-
\??\c:\7llxrxl.exec:\7llxrxl.exe94⤵PID:2664
-
\??\c:\nbbtth.exec:\nbbtth.exe95⤵PID:3516
-
\??\c:\tnttbb.exec:\tnttbb.exe96⤵PID:1556
-
\??\c:\pjvvj.exec:\pjvvj.exe97⤵PID:1304
-
\??\c:\3jppp.exec:\3jppp.exe98⤵PID:4920
-
\??\c:\xlfxlxr.exec:\xlfxlxr.exe99⤵PID:208
-
\??\c:\9rrrrrr.exec:\9rrrrrr.exe100⤵PID:1572
-
\??\c:\nnnnnb.exec:\nnnnnb.exe101⤵PID:2620
-
\??\c:\vjvpj.exec:\vjvpj.exe102⤵PID:764
-
\??\c:\jdppv.exec:\jdppv.exe103⤵PID:3668
-
\??\c:\lxrllrx.exec:\lxrllrx.exe104⤵PID:3796
-
\??\c:\xrxrrfx.exec:\xrxrrfx.exe105⤵PID:2100
-
\??\c:\1bbbbb.exec:\1bbbbb.exe106⤵PID:3908
-
\??\c:\bbhbbh.exec:\bbhbbh.exe107⤵PID:3168
-
\??\c:\3jpjd.exec:\3jpjd.exe108⤵PID:636
-
\??\c:\vvdvj.exec:\vvdvj.exe109⤵PID:1800
-
\??\c:\xxfxxxr.exec:\xxfxxxr.exe110⤵PID:4228
-
\??\c:\nhtttb.exec:\nhtttb.exe111⤵PID:2372
-
\??\c:\bbtnhb.exec:\bbtnhb.exe112⤵PID:3344
-
\??\c:\dddvv.exec:\dddvv.exe113⤵PID:5076
-
\??\c:\fflrffr.exec:\fflrffr.exe114⤵PID:3844
-
\??\c:\1rfllrr.exec:\1rfllrr.exe115⤵PID:3476
-
\??\c:\btbnht.exec:\btbnht.exe116⤵PID:4772
-
\??\c:\nnhhnn.exec:\nnhhnn.exe117⤵PID:4064
-
\??\c:\7ddvv.exec:\7ddvv.exe118⤵PID:3468
-
\??\c:\fflfxff.exec:\fflfxff.exe119⤵PID:4896
-
\??\c:\llrfllx.exec:\llrfllx.exe120⤵PID:1068
-
\??\c:\btttnh.exec:\btttnh.exe121⤵PID:1340
-
\??\c:\tbbttb.exec:\tbbttb.exe122⤵PID:1928
-
\??\c:\3pvvv.exec:\3pvvv.exe123⤵PID:4748
-
\??\c:\dvddp.exec:\dvddp.exe124⤵PID:3708
-
\??\c:\lflffrl.exec:\lflffrl.exe125⤵PID:1600
-
\??\c:\frrxxxf.exec:\frrxxxf.exe126⤵PID:1916
-
\??\c:\xllrrxr.exec:\xllrrxr.exe127⤵PID:5068
-
\??\c:\3btttb.exec:\3btttb.exe128⤵PID:4628
-
\??\c:\ppjjp.exec:\ppjjp.exe129⤵PID:1432
-
\??\c:\pjddd.exec:\pjddd.exe130⤵PID:5008
-
\??\c:\jddvj.exec:\jddvj.exe131⤵PID:2572
-
\??\c:\fxxrllr.exec:\fxxrllr.exe132⤵PID:1632
-
\??\c:\fxffxxr.exec:\fxffxxr.exe133⤵PID:2324
-
\??\c:\hhbtbb.exec:\hhbtbb.exe134⤵PID:2640
-
\??\c:\9ntntt.exec:\9ntntt.exe135⤵PID:2460
-
\??\c:\9dddd.exec:\9dddd.exe136⤵PID:4460
-
\??\c:\vpddj.exec:\vpddj.exe137⤵PID:3016
-
\??\c:\frxrlrl.exec:\frxrlrl.exe138⤵PID:3752
-
\??\c:\xrffllf.exec:\xrffllf.exe139⤵PID:1576
-
\??\c:\hbhbbb.exec:\hbhbbb.exe140⤵PID:4768
-
\??\c:\nhtnnt.exec:\nhtnnt.exe141⤵PID:3348
-
\??\c:\vppjd.exec:\vppjd.exe142⤵PID:1052
-
\??\c:\jdjjv.exec:\jdjjv.exe143⤵PID:1296
-
\??\c:\llfxxxr.exec:\llfxxxr.exe144⤵PID:1556
-
\??\c:\xxrlffx.exec:\xxrlffx.exe145⤵PID:220
-
\??\c:\nhthhb.exec:\nhthhb.exe146⤵PID:4232
-
\??\c:\tbnhbb.exec:\tbnhbb.exe147⤵PID:924
-
\??\c:\dvppj.exec:\dvppj.exe148⤵PID:4408
-
\??\c:\jddvv.exec:\jddvv.exe149⤵PID:4656
-
\??\c:\7xfxrrf.exec:\7xfxrrf.exe150⤵PID:676
-
\??\c:\3rxxrrl.exec:\3rxxrrl.exe151⤵PID:3152
-
\??\c:\3nhnhn.exec:\3nhnhn.exe152⤵PID:4028
-
\??\c:\9pvpp.exec:\9pvpp.exe153⤵PID:2300
-
\??\c:\lxffffl.exec:\lxffffl.exe154⤵PID:4732
-
\??\c:\7rrrlll.exec:\7rrrlll.exe155⤵PID:1564
-
\??\c:\nhbttt.exec:\nhbttt.exe156⤵PID:4480
-
\??\c:\5hhnhh.exec:\5hhnhh.exe157⤵PID:2716
-
\??\c:\dvpjv.exec:\dvpjv.exe158⤵PID:5032
-
\??\c:\jjvpj.exec:\jjvpj.exe159⤵PID:4620
-
\??\c:\fxfffff.exec:\fxfffff.exe160⤵PID:2884
-
\??\c:\xxfxrrr.exec:\xxfxrrr.exe161⤵PID:2948
-
\??\c:\nhtntt.exec:\nhtntt.exe162⤵PID:5080
-
\??\c:\bbbbbb.exec:\bbbbbb.exe163⤵PID:4252
-
\??\c:\1vddd.exec:\1vddd.exe164⤵PID:2328
-
\??\c:\fxllrxl.exec:\fxllrxl.exe165⤵PID:1740
-
\??\c:\1xxrlrl.exec:\1xxrlrl.exe166⤵PID:2028
-
\??\c:\7lrxrxr.exec:\7lrxrxr.exe167⤵PID:3776
-
\??\c:\9hhtnn.exec:\9hhtnn.exe168⤵PID:5052
-
\??\c:\nbnntn.exec:\nbnntn.exe169⤵PID:1404
-
\??\c:\jdvvv.exec:\jdvvv.exe170⤵PID:3472
-
\??\c:\1dpdj.exec:\1dpdj.exe171⤵PID:5064
-
\??\c:\7lrlxrl.exec:\7lrlxrl.exe172⤵PID:3248
-
\??\c:\xrrrllf.exec:\xrrrllf.exe173⤵PID:4316
-
\??\c:\hbtnhb.exec:\hbtnhb.exe174⤵PID:4664
-
\??\c:\hbhnnn.exec:\hbhnnn.exe175⤵PID:1452
-
\??\c:\vvvvd.exec:\vvvvd.exe176⤵PID:2168
-
\??\c:\9pjjj.exec:\9pjjj.exe177⤵PID:976
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe178⤵PID:3964
-
\??\c:\lfrrrxl.exec:\lfrrrxl.exe179⤵PID:3052
-
\??\c:\nhnnbb.exec:\nhnnbb.exe180⤵PID:4904
-
\??\c:\thnnbb.exec:\thnnbb.exe181⤵PID:3644
-
\??\c:\xrrfxxx.exec:\xrrfxxx.exe182⤵PID:3656
-
\??\c:\xrxxxll.exec:\xrxxxll.exe183⤵PID:2740
-
\??\c:\nhtttt.exec:\nhtttt.exe184⤵PID:1084
-
\??\c:\1tbbtt.exec:\1tbbtt.exe185⤵PID:1636
-
\??\c:\pdjjp.exec:\pdjjp.exe186⤵PID:2724
-
\??\c:\dpddv.exec:\dpddv.exe187⤵PID:1692
-
\??\c:\rfxlrff.exec:\rfxlrff.exe188⤵PID:1568
-
\??\c:\bbbbnh.exec:\bbbbnh.exe189⤵PID:3096
-
\??\c:\nhnnhn.exec:\nhnnhn.exe190⤵PID:3024
-
\??\c:\pdpvd.exec:\pdpvd.exe191⤵PID:5104
-
\??\c:\5xxxllx.exec:\5xxxllx.exe192⤵PID:3176
-
\??\c:\tbhthb.exec:\tbhthb.exe193⤵PID:3152
-
\??\c:\jdvpj.exec:\jdvpj.exe194⤵PID:1848
-
\??\c:\flrxxxx.exec:\flrxxxx.exe195⤵PID:2012
-
\??\c:\7djdd.exec:\7djdd.exe196⤵PID:852
-
\??\c:\rflllll.exec:\rflllll.exe197⤵PID:4844
-
\??\c:\llfrxxf.exec:\llfrxxf.exe198⤵PID:4228
-
\??\c:\bbhhnt.exec:\bbhhnt.exe199⤵PID:2372
-
\??\c:\vddjv.exec:\vddjv.exe200⤵PID:5076
-
\??\c:\dvvpj.exec:\dvvpj.exe201⤵PID:2864
-
\??\c:\rffrrlf.exec:\rffrrlf.exe202⤵PID:4552
-
\??\c:\nthhnn.exec:\nthhnn.exe203⤵PID:2368
-
\??\c:\nbbnnb.exec:\nbbnnb.exe204⤵PID:3684
-
\??\c:\pdjdv.exec:\pdjdv.exe205⤵PID:1324
-
\??\c:\9xffffl.exec:\9xffffl.exe206⤵PID:1340
-
\??\c:\rfrxflf.exec:\rfrxflf.exe207⤵PID:2028
-
\??\c:\nnnttb.exec:\nnnttb.exe208⤵PID:3776
-
\??\c:\5djpv.exec:\5djpv.exe209⤵PID:4140
-
\??\c:\jjjdv.exec:\jjjdv.exe210⤵PID:3980
-
\??\c:\xlxrfff.exec:\xlxrfff.exe211⤵PID:2448
-
\??\c:\7lllfff.exec:\7lllfff.exe212⤵PID:4416
-
\??\c:\nbbbtt.exec:\nbbbtt.exe213⤵PID:4784
-
\??\c:\tthhtt.exec:\tthhtt.exe214⤵PID:2324
-
\??\c:\jdjjj.exec:\jdjjj.exe215⤵PID:2992
-
\??\c:\xlxrfrr.exec:\xlxrfrr.exe216⤵PID:1452
-
\??\c:\7frrrrr.exec:\7frrrrr.exe217⤵PID:944
-
\??\c:\bbbhhb.exec:\bbbhhb.exe218⤵PID:4568
-
\??\c:\9htbnn.exec:\9htbnn.exe219⤵PID:1912
-
\??\c:\jddvj.exec:\jddvj.exe220⤵PID:3052
-
\??\c:\dddjv.exec:\dddjv.exe221⤵PID:4904
-
\??\c:\jddvp.exec:\jddvp.exe222⤵PID:1188
-
\??\c:\rrrrlll.exec:\rrrrlll.exe223⤵PID:2732
-
\??\c:\flrlfff.exec:\flrlfff.exe224⤵PID:1296
-
\??\c:\btttbh.exec:\btttbh.exe225⤵PID:1084
-
\??\c:\ddvvp.exec:\ddvvp.exe226⤵PID:4920
-
\??\c:\jvddd.exec:\jvddd.exe227⤵PID:1572
-
\??\c:\xrfxlll.exec:\xrfxlll.exe228⤵PID:1956
-
\??\c:\thbbbb.exec:\thbbbb.exe229⤵PID:1568
-
\??\c:\9vvpd.exec:\9vvpd.exe230⤵PID:3096
-
\??\c:\vppvj.exec:\vppvj.exe231⤵PID:4376
-
\??\c:\3flrlxx.exec:\3flrlxx.exe232⤵PID:5104
-
\??\c:\9rxrrfl.exec:\9rxrrfl.exe233⤵PID:4356
-
\??\c:\btbtnb.exec:\btbtnb.exe234⤵PID:3812
-
\??\c:\bhnnbb.exec:\bhnnbb.exe235⤵PID:636
-
\??\c:\thttnn.exec:\thttnn.exe236⤵PID:956
-
\??\c:\jjpjv.exec:\jjpjv.exe237⤵PID:2376
-
\??\c:\pppdd.exec:\pppdd.exe238⤵PID:4304
-
\??\c:\rxffxxr.exec:\rxffxxr.exe239⤵PID:3748
-
\??\c:\9nhhhh.exec:\9nhhhh.exe240⤵PID:2372
-
\??\c:\tnttnn.exec:\tnttnn.exe241⤵PID:2884
-
\??\c:\vjjjd.exec:\vjjjd.exe242⤵PID:3216