Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 03:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0f3b32e128ec7a107a86ff544929ad0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a0f3b32e128ec7a107a86ff544929ad0_NeikiAnalytics.exe
-
Size
66KB
-
MD5
a0f3b32e128ec7a107a86ff544929ad0
-
SHA1
efac7d94926431c491b443a5da5548afe1e7103c
-
SHA256
8cb19b216ea0dd4adb88d569212bde5a4db058e2b5856ae2fd78c774934aab1a
-
SHA512
5346b794f438393f728aff3f7db2506e0135600322139f07eb14155d656b9032861fdc68fc4e520acde6dd6bb07ca4098c9fbae1c9ceabccc3374c6b5921c3b2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUPqrDZu:ymb3NkkiQ3mdBjF0yUmY
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/3108-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-63-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/620-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tttttt.exedjvdp.exexrrlflx.exetbttnt.exejdpvv.exedvvdv.exelrfxrxl.exethtttt.exevvdvv.exevvvvv.exerflrrxx.exetbnntb.exepjjjv.exelfllfff.exebhhhbh.exevjpjv.exedddjj.exexrrrlrl.exethtttt.exe3dddd.exe3ffxxfx.exe3rlrrxx.exehnbbhn.exejdppv.exexrxffff.exettbtnb.exevjdvv.exepvdvv.exefxxxxxx.exebbbhhh.exetnttnn.exejvjpv.exerlllffl.exebntbbb.exevjjdd.exexfrxxxx.exerllrllf.exepdppp.exelxlfxxf.exeppvdj.exellllxrr.exelxlfxxr.exetttttb.exejpvvp.exerlrxxrx.exentnbbb.exejvdjd.exe7vdvv.exe7xrrflx.exerlxxllf.exetbntnt.exe7pppd.exetthtnn.exepvvpp.exeflfrlll.exe1ffffff.exebnbttn.exe7ntnhh.exevdvjv.exerrxffxf.exerfffxlx.exe3dddd.exelrlffff.exe1ffrlrr.exepid process 3108 tttttt.exe 2092 djvdp.exe 3972 xrrlflx.exe 4012 tbttnt.exe 3484 jdpvv.exe 2952 dvvdv.exe 3492 lrfxrxl.exe 4588 thtttt.exe 2076 vvdvv.exe 2468 vvvvv.exe 3944 rflrrxx.exe 4416 tbnntb.exe 5092 pjjjv.exe 3248 lfllfff.exe 4456 bhhhbh.exe 5060 vjpjv.exe 4968 dddjj.exe 620 xrrrlrl.exe 4004 thtttt.exe 4516 3dddd.exe 4584 3ffxxfx.exe 3752 3rlrrxx.exe 4336 hnbbhn.exe 1924 jdppv.exe 2220 xrxffff.exe 1728 ttbtnb.exe 4688 vjdvv.exe 3716 pvdvv.exe 2444 fxxxxxx.exe 4284 bbbhhh.exe 3264 tnttnn.exe 2276 jvjpv.exe 532 rlllffl.exe 2176 bntbbb.exe 3348 vjjdd.exe 1004 xfrxxxx.exe 4056 rllrllf.exe 3092 pdppp.exe 2288 lxlfxxf.exe 4100 ppvdj.exe 2808 llllxrr.exe 1064 lxlfxxr.exe 1544 tttttb.exe 1448 jpvvp.exe 4332 rlrxxrx.exe 1208 ntnbbb.exe 2476 jvdjd.exe 2968 7vdvv.exe 4296 7xrrflx.exe 3340 rlxxllf.exe 2468 tbntnt.exe 2124 7pppd.exe 804 tthtnn.exe 1960 pvvpp.exe 3756 flfrlll.exe 4724 1ffffff.exe 868 bnbttn.exe 4624 7ntnhh.exe 3204 vdvjv.exe 4968 rrxffxf.exe 3824 rfffxlx.exe 2116 3dddd.exe 2916 lrlffff.exe 4896 1ffrlrr.exe -
Processes:
resource yara_rule behavioral2/memory/3108-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/620-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a0f3b32e128ec7a107a86ff544929ad0_NeikiAnalytics.exetttttt.exedjvdp.exexrrlflx.exetbttnt.exejdpvv.exedvvdv.exelrfxrxl.exethtttt.exevvdvv.exevvvvv.exerflrrxx.exetbnntb.exepjjjv.exelfllfff.exebhhhbh.exevjpjv.exedddjj.exexrrrlrl.exethtttt.exe3dddd.exe3ffxxfx.exedescription pid process target process PID 2944 wrote to memory of 3108 2944 a0f3b32e128ec7a107a86ff544929ad0_NeikiAnalytics.exe tttttt.exe PID 2944 wrote to memory of 3108 2944 a0f3b32e128ec7a107a86ff544929ad0_NeikiAnalytics.exe tttttt.exe PID 2944 wrote to memory of 3108 2944 a0f3b32e128ec7a107a86ff544929ad0_NeikiAnalytics.exe tttttt.exe PID 3108 wrote to memory of 2092 3108 tttttt.exe djvdp.exe PID 3108 wrote to memory of 2092 3108 tttttt.exe djvdp.exe PID 3108 wrote to memory of 2092 3108 tttttt.exe djvdp.exe PID 2092 wrote to memory of 3972 2092 djvdp.exe xrrlflx.exe PID 2092 wrote to memory of 3972 2092 djvdp.exe xrrlflx.exe PID 2092 wrote to memory of 3972 2092 djvdp.exe xrrlflx.exe PID 3972 wrote to memory of 4012 3972 xrrlflx.exe tbttnt.exe PID 3972 wrote to memory of 4012 3972 xrrlflx.exe tbttnt.exe PID 3972 wrote to memory of 4012 3972 xrrlflx.exe tbttnt.exe PID 4012 wrote to memory of 3484 4012 tbttnt.exe jdpvv.exe PID 4012 wrote to memory of 3484 4012 tbttnt.exe jdpvv.exe PID 4012 wrote to memory of 3484 4012 tbttnt.exe jdpvv.exe PID 3484 wrote to memory of 2952 3484 jdpvv.exe dvvdv.exe PID 3484 wrote to memory of 2952 3484 jdpvv.exe dvvdv.exe PID 3484 wrote to memory of 2952 3484 jdpvv.exe dvvdv.exe PID 2952 wrote to memory of 3492 2952 dvvdv.exe lrfxrxl.exe PID 2952 wrote to memory of 3492 2952 dvvdv.exe lrfxrxl.exe PID 2952 wrote to memory of 3492 2952 dvvdv.exe lrfxrxl.exe PID 3492 wrote to memory of 4588 3492 lrfxrxl.exe thtttt.exe PID 3492 wrote to memory of 4588 3492 lrfxrxl.exe thtttt.exe PID 3492 wrote to memory of 4588 3492 lrfxrxl.exe thtttt.exe PID 4588 wrote to memory of 2076 4588 thtttt.exe vvdvv.exe PID 4588 wrote to memory of 2076 4588 thtttt.exe vvdvv.exe PID 4588 wrote to memory of 2076 4588 thtttt.exe vvdvv.exe PID 2076 wrote to memory of 2468 2076 vvdvv.exe vvvvv.exe PID 2076 wrote to memory of 2468 2076 vvdvv.exe vvvvv.exe PID 2076 wrote to memory of 2468 2076 vvdvv.exe vvvvv.exe PID 2468 wrote to memory of 3944 2468 vvvvv.exe rflrrxx.exe PID 2468 wrote to memory of 3944 2468 vvvvv.exe rflrrxx.exe PID 2468 wrote to memory of 3944 2468 vvvvv.exe rflrrxx.exe PID 3944 wrote to memory of 4416 3944 rflrrxx.exe tbnntb.exe PID 3944 wrote to memory of 4416 3944 rflrrxx.exe tbnntb.exe PID 3944 wrote to memory of 4416 3944 rflrrxx.exe tbnntb.exe PID 4416 wrote to memory of 5092 4416 tbnntb.exe pjjjv.exe PID 4416 wrote to memory of 5092 4416 tbnntb.exe pjjjv.exe PID 4416 wrote to memory of 5092 4416 tbnntb.exe pjjjv.exe PID 5092 wrote to memory of 3248 5092 pjjjv.exe lfllfff.exe PID 5092 wrote to memory of 3248 5092 pjjjv.exe lfllfff.exe PID 5092 wrote to memory of 3248 5092 pjjjv.exe lfllfff.exe PID 3248 wrote to memory of 4456 3248 lfllfff.exe bhhhbh.exe PID 3248 wrote to memory of 4456 3248 lfllfff.exe bhhhbh.exe PID 3248 wrote to memory of 4456 3248 lfllfff.exe bhhhbh.exe PID 4456 wrote to memory of 5060 4456 bhhhbh.exe vjpjv.exe PID 4456 wrote to memory of 5060 4456 bhhhbh.exe vjpjv.exe PID 4456 wrote to memory of 5060 4456 bhhhbh.exe vjpjv.exe PID 5060 wrote to memory of 4968 5060 vjpjv.exe dddjj.exe PID 5060 wrote to memory of 4968 5060 vjpjv.exe dddjj.exe PID 5060 wrote to memory of 4968 5060 vjpjv.exe dddjj.exe PID 4968 wrote to memory of 620 4968 dddjj.exe xrrrlrl.exe PID 4968 wrote to memory of 620 4968 dddjj.exe xrrrlrl.exe PID 4968 wrote to memory of 620 4968 dddjj.exe xrrrlrl.exe PID 620 wrote to memory of 4004 620 xrrrlrl.exe thtttt.exe PID 620 wrote to memory of 4004 620 xrrrlrl.exe thtttt.exe PID 620 wrote to memory of 4004 620 xrrrlrl.exe thtttt.exe PID 4004 wrote to memory of 4516 4004 thtttt.exe 3dddd.exe PID 4004 wrote to memory of 4516 4004 thtttt.exe 3dddd.exe PID 4004 wrote to memory of 4516 4004 thtttt.exe 3dddd.exe PID 4516 wrote to memory of 4584 4516 3dddd.exe 3ffxxfx.exe PID 4516 wrote to memory of 4584 4516 3dddd.exe 3ffxxfx.exe PID 4516 wrote to memory of 4584 4516 3dddd.exe 3ffxxfx.exe PID 4584 wrote to memory of 3752 4584 3ffxxfx.exe 3rlrrxx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0f3b32e128ec7a107a86ff544929ad0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a0f3b32e128ec7a107a86ff544929ad0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\tttttt.exec:\tttttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\djvdp.exec:\djvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\xrrlflx.exec:\xrrlflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\tbttnt.exec:\tbttnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\jdpvv.exec:\jdpvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\dvvdv.exec:\dvvdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\lrfxrxl.exec:\lrfxrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\thtttt.exec:\thtttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\vvdvv.exec:\vvdvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\vvvvv.exec:\vvvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\rflrrxx.exec:\rflrrxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\tbnntb.exec:\tbnntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\pjjjv.exec:\pjjjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\lfllfff.exec:\lfllfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\bhhhbh.exec:\bhhhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\vjpjv.exec:\vjpjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\dddjj.exec:\dddjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\xrrrlrl.exec:\xrrrlrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\thtttt.exec:\thtttt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\3dddd.exec:\3dddd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\3ffxxfx.exec:\3ffxxfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\3rlrrxx.exec:\3rlrrxx.exe23⤵
- Executes dropped EXE
PID:3752 -
\??\c:\hnbbhn.exec:\hnbbhn.exe24⤵
- Executes dropped EXE
PID:4336 -
\??\c:\jdppv.exec:\jdppv.exe25⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xrxffff.exec:\xrxffff.exe26⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ttbtnb.exec:\ttbtnb.exe27⤵
- Executes dropped EXE
PID:1728 -
\??\c:\vjdvv.exec:\vjdvv.exe28⤵
- Executes dropped EXE
PID:4688 -
\??\c:\pvdvv.exec:\pvdvv.exe29⤵
- Executes dropped EXE
PID:3716 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe30⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bbbhhh.exec:\bbbhhh.exe31⤵
- Executes dropped EXE
PID:4284 -
\??\c:\tnttnn.exec:\tnttnn.exe32⤵
- Executes dropped EXE
PID:3264 -
\??\c:\jvjpv.exec:\jvjpv.exe33⤵
- Executes dropped EXE
PID:2276 -
\??\c:\rlllffl.exec:\rlllffl.exe34⤵
- Executes dropped EXE
PID:532 -
\??\c:\bntbbb.exec:\bntbbb.exe35⤵
- Executes dropped EXE
PID:2176 -
\??\c:\vjjdd.exec:\vjjdd.exe36⤵
- Executes dropped EXE
PID:3348 -
\??\c:\xfrxxxx.exec:\xfrxxxx.exe37⤵
- Executes dropped EXE
PID:1004 -
\??\c:\rllrllf.exec:\rllrllf.exe38⤵
- Executes dropped EXE
PID:4056 -
\??\c:\pdppp.exec:\pdppp.exe39⤵
- Executes dropped EXE
PID:3092 -
\??\c:\lxlfxxf.exec:\lxlfxxf.exe40⤵
- Executes dropped EXE
PID:2288 -
\??\c:\tnnhnh.exec:\tnnhnh.exe41⤵PID:1652
-
\??\c:\ppvdj.exec:\ppvdj.exe42⤵
- Executes dropped EXE
PID:4100 -
\??\c:\llllxrr.exec:\llllxrr.exe43⤵
- Executes dropped EXE
PID:2808 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe44⤵
- Executes dropped EXE
PID:1064 -
\??\c:\tttttb.exec:\tttttb.exe45⤵
- Executes dropped EXE
PID:1544 -
\??\c:\jpvvp.exec:\jpvvp.exe46⤵
- Executes dropped EXE
PID:1448 -
\??\c:\rlrxxrx.exec:\rlrxxrx.exe47⤵
- Executes dropped EXE
PID:4332 -
\??\c:\ntnbbb.exec:\ntnbbb.exe48⤵
- Executes dropped EXE
PID:1208 -
\??\c:\jvdjd.exec:\jvdjd.exe49⤵
- Executes dropped EXE
PID:2476 -
\??\c:\7vdvv.exec:\7vdvv.exe50⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7xrrflx.exec:\7xrrflx.exe51⤵
- Executes dropped EXE
PID:4296 -
\??\c:\rlxxllf.exec:\rlxxllf.exe52⤵
- Executes dropped EXE
PID:3340 -
\??\c:\tbntnt.exec:\tbntnt.exe53⤵
- Executes dropped EXE
PID:2468 -
\??\c:\7pppd.exec:\7pppd.exe54⤵
- Executes dropped EXE
PID:2124 -
\??\c:\tthtnn.exec:\tthtnn.exe55⤵
- Executes dropped EXE
PID:804 -
\??\c:\pvvpp.exec:\pvvpp.exe56⤵
- Executes dropped EXE
PID:1960 -
\??\c:\flfrlll.exec:\flfrlll.exe57⤵
- Executes dropped EXE
PID:3756 -
\??\c:\1ffffff.exec:\1ffffff.exe58⤵
- Executes dropped EXE
PID:4724 -
\??\c:\bnbttn.exec:\bnbttn.exe59⤵
- Executes dropped EXE
PID:868 -
\??\c:\7ntnhh.exec:\7ntnhh.exe60⤵
- Executes dropped EXE
PID:4624 -
\??\c:\vdvjv.exec:\vdvjv.exe61⤵
- Executes dropped EXE
PID:3204 -
\??\c:\rrxffxf.exec:\rrxffxf.exe62⤵
- Executes dropped EXE
PID:4968 -
\??\c:\rfffxlx.exec:\rfffxlx.exe63⤵
- Executes dropped EXE
PID:3824 -
\??\c:\3dddd.exec:\3dddd.exe64⤵
- Executes dropped EXE
PID:2116 -
\??\c:\lrlffff.exec:\lrlffff.exe65⤵
- Executes dropped EXE
PID:2916 -
\??\c:\1ffrlrr.exec:\1ffrlrr.exe66⤵
- Executes dropped EXE
PID:4896 -
\??\c:\tbbhhn.exec:\tbbhhn.exe67⤵PID:3876
-
\??\c:\7jvvv.exec:\7jvvv.exe68⤵PID:3752
-
\??\c:\jdjvp.exec:\jdjvp.exe69⤵PID:4784
-
\??\c:\rrffllr.exec:\rrffllr.exe70⤵PID:884
-
\??\c:\1bttnn.exec:\1bttnn.exe71⤵PID:60
-
\??\c:\bnnnnn.exec:\bnnnnn.exe72⤵PID:1540
-
\??\c:\dvpdv.exec:\dvpdv.exe73⤵PID:936
-
\??\c:\xrflfrl.exec:\xrflfrl.exe74⤵PID:1908
-
\??\c:\xrrrrrl.exec:\xrrrrrl.exe75⤵PID:4192
-
\??\c:\1nhttt.exec:\1nhttt.exe76⤵PID:3576
-
\??\c:\nntnhh.exec:\nntnhh.exe77⤵PID:3828
-
\??\c:\5vvvp.exec:\5vvvp.exe78⤵PID:4776
-
\??\c:\3xxrflf.exec:\3xxrflf.exe79⤵PID:2624
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe80⤵PID:3644
-
\??\c:\nnhnnb.exec:\nnhnnb.exe81⤵PID:3440
-
\??\c:\1thhhn.exec:\1thhhn.exe82⤵PID:4840
-
\??\c:\vvpjd.exec:\vvpjd.exe83⤵PID:3272
-
\??\c:\vjjjd.exec:\vjjjd.exe84⤵PID:4796
-
\??\c:\ffrxfrl.exec:\ffrxfrl.exe85⤵PID:4320
-
\??\c:\hbnnbh.exec:\hbnnbh.exe86⤵PID:2072
-
\??\c:\5hnnhb.exec:\5hnnhb.exe87⤵PID:4400
-
\??\c:\dvvvv.exec:\dvvvv.exe88⤵PID:2092
-
\??\c:\7jdvp.exec:\7jdvp.exe89⤵PID:4660
-
\??\c:\xxlfxlr.exec:\xxlfxlr.exe90⤵PID:2488
-
\??\c:\lrxxrrr.exec:\lrxxrrr.exe91⤵PID:4368
-
\??\c:\7hnhnn.exec:\7hnhnn.exe92⤵PID:4628
-
\??\c:\dvdjj.exec:\dvdjj.exe93⤵PID:2352
-
\??\c:\xfxrfrf.exec:\xfxrfrf.exe94⤵PID:4244
-
\??\c:\hthttn.exec:\hthttn.exe95⤵PID:2592
-
\??\c:\pjpjp.exec:\pjpjp.exe96⤵PID:2420
-
\??\c:\1vpdv.exec:\1vpdv.exe97⤵PID:2260
-
\??\c:\rrfrllf.exec:\rrfrllf.exe98⤵PID:4224
-
\??\c:\thnnht.exec:\thnnht.exe99⤵PID:3944
-
\??\c:\pjjvp.exec:\pjjvp.exe100⤵PID:4308
-
\??\c:\llllflr.exec:\llllflr.exe101⤵PID:3568
-
\??\c:\1thbtt.exec:\1thbtt.exe102⤵PID:3992
-
\??\c:\bntttt.exec:\bntttt.exe103⤵PID:4564
-
\??\c:\pjvdj.exec:\pjvdj.exe104⤵PID:4724
-
\??\c:\rfxxxxx.exec:\rfxxxxx.exe105⤵PID:1628
-
\??\c:\bbhhht.exec:\bbhhht.exe106⤵PID:1644
-
\??\c:\vppdp.exec:\vppdp.exe107⤵PID:3616
-
\??\c:\dvdpj.exec:\dvdpj.exe108⤵PID:4444
-
\??\c:\rrlrxxr.exec:\rrlrxxr.exe109⤵PID:4956
-
\??\c:\3lrrfff.exec:\3lrrfff.exe110⤵PID:2560
-
\??\c:\bbbhhh.exec:\bbbhhh.exe111⤵PID:1044
-
\??\c:\9dpjd.exec:\9dpjd.exe112⤵PID:4684
-
\??\c:\djvpp.exec:\djvpp.exe113⤵PID:1756
-
\??\c:\ffxxrxx.exec:\ffxxrxx.exe114⤵PID:2220
-
\??\c:\lfllflf.exec:\lfllflf.exe115⤵PID:1936
-
\??\c:\xfrrrrr.exec:\xfrrrrr.exe116⤵PID:1904
-
\??\c:\1nntnt.exec:\1nntnt.exe117⤵PID:4196
-
\??\c:\tttnhh.exec:\tttnhh.exe118⤵PID:1052
-
\??\c:\ppdpp.exec:\ppdpp.exe119⤵PID:2940
-
\??\c:\rllllrl.exec:\rllllrl.exe120⤵PID:4360
-
\??\c:\3fxfxrf.exec:\3fxfxrf.exe121⤵PID:1980
-
\??\c:\bhttbb.exec:\bhttbb.exe122⤵PID:3440
-
\??\c:\bnbbhh.exec:\bnbbhh.exe123⤵PID:4840
-
\??\c:\ddddd.exec:\ddddd.exe124⤵PID:4700
-
\??\c:\xflfxxr.exec:\xflfxxr.exe125⤵PID:1436
-
\??\c:\nhhtbn.exec:\nhhtbn.exe126⤵PID:3208
-
\??\c:\vppjd.exec:\vppjd.exe127⤵PID:4932
-
\??\c:\rfffxxr.exec:\rfffxxr.exe128⤵PID:1404
-
\??\c:\3rffflx.exec:\3rffflx.exe129⤵PID:5080
-
\??\c:\fxfffff.exec:\fxfffff.exe130⤵PID:3708
-
\??\c:\btbbbn.exec:\btbbbn.exe131⤵PID:5044
-
\??\c:\3jpvp.exec:\3jpvp.exe132⤵PID:2612
-
\??\c:\vjvdv.exec:\vjvdv.exe133⤵PID:2848
-
\??\c:\xlllffx.exec:\xlllffx.exe134⤵PID:3176
-
\??\c:\xxrffxl.exec:\xxrffxl.exe135⤵PID:1688
-
\??\c:\1bnntb.exec:\1bnntb.exe136⤵PID:1292
-
\??\c:\3bbbtt.exec:\3bbbtt.exe137⤵PID:2516
-
\??\c:\7jddp.exec:\7jddp.exe138⤵PID:3944
-
\??\c:\jjppd.exec:\jjppd.exe139⤵PID:1612
-
\??\c:\rrxrllf.exec:\rrxrllf.exe140⤵PID:3568
-
\??\c:\ffllrrx.exec:\ffllrrx.exe141⤵PID:3992
-
\??\c:\hhntnt.exec:\hhntnt.exe142⤵PID:4564
-
\??\c:\vdddd.exec:\vdddd.exe143⤵PID:4724
-
\??\c:\vpjdd.exec:\vpjdd.exe144⤵PID:1628
-
\??\c:\lfllrrx.exec:\lfllrrx.exe145⤵PID:4860
-
\??\c:\vvppp.exec:\vvppp.exe146⤵PID:2804
-
\??\c:\dpjjp.exec:\dpjjp.exe147⤵PID:2464
-
\??\c:\lxfffff.exec:\lxfffff.exe148⤵PID:1520
-
\??\c:\5xxxffl.exec:\5xxxffl.exe149⤵PID:1152
-
\??\c:\ttbbtt.exec:\ttbbtt.exe150⤵PID:4048
-
\??\c:\thtnhh.exec:\thtnhh.exe151⤵PID:4476
-
\??\c:\pjppv.exec:\pjppv.exe152⤵PID:3292
-
\??\c:\7lrrrxf.exec:\7lrrrxf.exe153⤵PID:5104
-
\??\c:\xlxrrfx.exec:\xlxrrfx.exe154⤵PID:4196
-
\??\c:\hthhbh.exec:\hthhbh.exe155⤵PID:1952
-
\??\c:\5jdpj.exec:\5jdpj.exe156⤵PID:4460
-
\??\c:\ppjjp.exec:\ppjjp.exe157⤵PID:3160
-
\??\c:\rrfllxl.exec:\rrfllxl.exe158⤵PID:1980
-
\??\c:\bbbbbb.exec:\bbbbbb.exe159⤵PID:3440
-
\??\c:\jjjjd.exec:\jjjjd.exe160⤵PID:4840
-
\??\c:\dvjjd.exec:\dvjjd.exe161⤵PID:4700
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe162⤵PID:4320
-
\??\c:\ntbttn.exec:\ntbttn.exe163⤵PID:3984
-
\??\c:\pppjj.exec:\pppjj.exe164⤵PID:3632
-
\??\c:\llxrlfl.exec:\llxrlfl.exe165⤵PID:1968
-
\??\c:\pddjj.exec:\pddjj.exe166⤵PID:1544
-
\??\c:\pddpp.exec:\pddpp.exe167⤵PID:1528
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe168⤵PID:2024
-
\??\c:\7frllrr.exec:\7frllrr.exe169⤵PID:2120
-
\??\c:\hnhbhb.exec:\hnhbhb.exe170⤵PID:3260
-
\??\c:\1rxfrrx.exec:\1rxfrrx.exe171⤵PID:3796
-
\??\c:\9rxrrfr.exec:\9rxrrfr.exe172⤵PID:2348
-
\??\c:\ppvvd.exec:\ppvvd.exe173⤵PID:2260
-
\??\c:\fxfxrlx.exec:\fxfxrlx.exe174⤵PID:2124
-
\??\c:\tbnhhh.exec:\tbnhhh.exe175⤵PID:1396
-
\??\c:\5pdvp.exec:\5pdvp.exe176⤵PID:1704
-
\??\c:\5rxrllf.exec:\5rxrllf.exe177⤵PID:4312
-
\??\c:\tbbbbh.exec:\tbbbbh.exe178⤵PID:2548
-
\??\c:\hhnhhh.exec:\hhnhhh.exe179⤵PID:4524
-
\??\c:\9pppd.exec:\9pppd.exe180⤵PID:1188
-
\??\c:\xllfxrr.exec:\xllfxrr.exe181⤵PID:1628
-
\??\c:\5lllfll.exec:\5lllfll.exe182⤵PID:3220
-
\??\c:\tthhbh.exec:\tthhbh.exe183⤵PID:3616
-
\??\c:\nthhbh.exec:\nthhbh.exe184⤵PID:4592
-
\??\c:\3jvdj.exec:\3jvdj.exe185⤵PID:4956
-
\??\c:\rrlfrxf.exec:\rrlfrxf.exe186⤵PID:1276
-
\??\c:\rfxrllr.exec:\rfxrllr.exe187⤵PID:3336
-
\??\c:\nthhhn.exec:\nthhhn.exe188⤵PID:60
-
\??\c:\bbbbht.exec:\bbbbht.exe189⤵PID:1540
-
\??\c:\vpvvv.exec:\vpvvv.exe190⤵PID:4052
-
\??\c:\3vddj.exec:\3vddj.exe191⤵PID:1904
-
\??\c:\xrxfrxx.exec:\xrxfrxx.exe192⤵PID:2636
-
\??\c:\xrxxxxf.exec:\xrxxxxf.exe193⤵PID:1952
-
\??\c:\nbnttb.exec:\nbnttb.exe194⤵PID:3620
-
\??\c:\hbnbnh.exec:\hbnbnh.exe195⤵PID:3740
-
\??\c:\jvpdj.exec:\jvpdj.exe196⤵PID:2340
-
\??\c:\dvdvp.exec:\dvdvp.exe197⤵PID:4840
-
\??\c:\1fllrxx.exec:\1fllrxx.exe198⤵PID:4700
-
\??\c:\9llllll.exec:\9llllll.exe199⤵PID:1444
-
\??\c:\tnnhbb.exec:\tnnhbb.exe200⤵PID:2808
-
\??\c:\bhbbtt.exec:\bhbbtt.exe201⤵PID:3484
-
\??\c:\vdjjd.exec:\vdjjd.exe202⤵PID:4792
-
\??\c:\xrrlffx.exec:\xrrlffx.exe203⤵PID:2944
-
\??\c:\9lrlfff.exec:\9lrlfff.exe204⤵PID:5044
-
\??\c:\bbnntt.exec:\bbnntt.exe205⤵PID:2800
-
\??\c:\vjjpp.exec:\vjjpp.exe206⤵PID:2592
-
\??\c:\vdpdp.exec:\vdpdp.exe207⤵PID:3260
-
\??\c:\1lfrrlr.exec:\1lfrrlr.exe208⤵PID:4424
-
\??\c:\nbbhbh.exec:\nbbhbh.exe209⤵PID:1292
-
\??\c:\nbbbnt.exec:\nbbbnt.exe210⤵PID:4580
-
\??\c:\pvpdv.exec:\pvpdv.exe211⤵PID:2124
-
\??\c:\lxffrrr.exec:\lxffrrr.exe212⤵PID:2480
-
\??\c:\1rxrrrr.exec:\1rxrrrr.exe213⤵PID:3992
-
\??\c:\thbbtn.exec:\thbbtn.exe214⤵PID:3652
-
\??\c:\7bbbtt.exec:\7bbbtt.exe215⤵PID:620
-
\??\c:\1ppjd.exec:\1ppjd.exe216⤵PID:1188
-
\??\c:\lllllrr.exec:\lllllrr.exe217⤵PID:1628
-
\??\c:\xfflffx.exec:\xfflffx.exe218⤵PID:3220
-
\??\c:\tthhbb.exec:\tthhbb.exe219⤵PID:2916
-
\??\c:\nnttht.exec:\nnttht.exe220⤵PID:4592
-
\??\c:\7jjjp.exec:\7jjjp.exe221⤵PID:1520
-
\??\c:\jvvvp.exec:\jvvvp.exe222⤵PID:4684
-
\??\c:\frlxllf.exec:\frlxllf.exe223⤵PID:2220
-
\??\c:\9hhhhh.exec:\9hhhhh.exe224⤵PID:4336
-
\??\c:\nbbnbh.exec:\nbbnbh.exe225⤵PID:2072
-
\??\c:\5pvjp.exec:\5pvjp.exe226⤵PID:4048
-
\??\c:\pvvvv.exec:\pvvvv.exe227⤵PID:2444
-
\??\c:\rlxxrrl.exec:\rlxxrrl.exe228⤵PID:2140
-
\??\c:\9lrlxxr.exec:\9lrlxxr.exe229⤵PID:1904
-
\??\c:\bhnnhn.exec:\bhnnhn.exe230⤵PID:1108
-
\??\c:\jjjjd.exec:\jjjjd.exe231⤵PID:4480
-
\??\c:\vdjdv.exec:\vdjdv.exe232⤵PID:2796
-
\??\c:\llrflrx.exec:\llrflrx.exe233⤵PID:4796
-
\??\c:\vvjpj.exec:\vvjpj.exe234⤵PID:2340
-
\??\c:\7djjj.exec:\7djjj.exe235⤵PID:3972
-
\??\c:\rrfrxfl.exec:\rrfrxfl.exe236⤵PID:3296
-
\??\c:\rffrrll.exec:\rffrrll.exe237⤵PID:4700
-
\??\c:\bbbtnt.exec:\bbbtnt.exe238⤵PID:2564
-
\??\c:\thhhbb.exec:\thhhbb.exe239⤵PID:1400
-
\??\c:\xfllffl.exec:\xfllffl.exe240⤵PID:1968
-
\??\c:\xfxxrrr.exec:\xfxxrrr.exe241⤵PID:4904
-
\??\c:\5bhhbb.exec:\5bhhbb.exe242⤵PID:4984