Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 04:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a774e7f1f94a96bcb160ee331ee35070_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a774e7f1f94a96bcb160ee331ee35070_NeikiAnalytics.exe
-
Size
389KB
-
MD5
a774e7f1f94a96bcb160ee331ee35070
-
SHA1
efab24c72513123eb8df63af1669b5ae49695967
-
SHA256
cc15b3da6bbeff2861ea3d6fb4e09bd4ba95d92ac2d8a013d1150831bf199152
-
SHA512
63ef9d72e1989a94e29d64cddcc0534c5ead7eb7224cd312b59007d9863b730250c27117853052f4d54e429735dc892d5edad1408a88ce9dc56599b59fe72613
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfi:SgdnJVU4TlnwJ6Go/
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/2060-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1336-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1300-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1076-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rlrrlfx.exejddpj.exe3ppjd.exentntbh.exedvddj.exettnhhh.exeflffxlf.exelfrllll.exebhbbtt.exepvppj.exexrffxxx.exethhbtn.exexlrrfxx.exetnbnnt.exeddvvp.exe3pvvp.exettbbtt.exefxlfrlr.exetnhbhh.exehhbtnn.exefxfxxrr.exerlrffff.exerlrlllf.exepjddd.exebnttbb.exehhnnnn.exepdpdd.exe1fllllx.exennhhhh.exefllrlrl.exebhhhhn.exetnhnhh.exejvddj.exelflrllf.exebtbbbh.exejddjd.exethnntt.exeppdvd.exejvjdv.exelflllrr.exettnnnh.exeppdpj.exefrxrrll.exehbhttt.exejppjd.exefrlfrrl.exehbnbnn.exedvpjj.exelfrfrrl.exebnnnbb.exepvpjd.exellrllrl.exebhthtn.exedpdvp.exerlfxrrl.exenhnhtt.exedpdjd.exelxrlfrl.exenbnhbb.exevdpjd.exe3llfxxr.exehnbttb.exetnhbtn.exejpppj.exepid process 1336 rlrrlfx.exe 1588 jddpj.exe 2476 3ppjd.exe 1300 ntntbh.exe 432 dvddj.exe 2552 ttnhhh.exe 4952 flffxlf.exe 3368 lfrllll.exe 3444 bhbbtt.exe 3192 pvppj.exe 1636 xrffxxx.exe 1176 thhbtn.exe 3328 xlrrfxx.exe 3044 tnbnnt.exe 2412 ddvvp.exe 4856 3pvvp.exe 5032 ttbbtt.exe 3620 fxlfrlr.exe 3636 tnhbhh.exe 2512 hhbtnn.exe 5052 fxfxxrr.exe 4848 rlrffff.exe 1076 rlrlllf.exe 4308 pjddd.exe 8 bnttbb.exe 4384 hhnnnn.exe 1968 pdpdd.exe 3520 1fllllx.exe 4400 nnhhhh.exe 2556 fllrlrl.exe 760 bhhhhn.exe 2776 tnhnhh.exe 3172 jvddj.exe 4436 lflrllf.exe 1576 btbbbh.exe 4520 jddjd.exe 1336 thnntt.exe 4880 ppdvd.exe 1260 jvjdv.exe 1292 lflllrr.exe 4800 ttnnnh.exe 2328 ppdpj.exe 1580 frxrrll.exe 4648 hbhttt.exe 808 jppjd.exe 3820 frlfrrl.exe 2144 hbnbnn.exe 4636 dvpjj.exe 688 lfrfrrl.exe 2128 bnnnbb.exe 4028 pvpjd.exe 2028 llrllrl.exe 4744 bhthtn.exe 3328 dpdvp.exe 4164 rlfxrrl.exe 1372 nhnhtt.exe 700 dpdjd.exe 4584 lxrlfrl.exe 4220 nbnhbb.exe 1316 vdpjd.exe 4380 3llfxxr.exe 336 hnbttb.exe 3440 tnhbtn.exe 4592 jpppj.exe -
Processes:
resource yara_rule behavioral2/memory/2060-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2552-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1076-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a774e7f1f94a96bcb160ee331ee35070_NeikiAnalytics.exerlrrlfx.exejddpj.exe3ppjd.exentntbh.exedvddj.exettnhhh.exeflffxlf.exelfrllll.exebhbbtt.exepvppj.exexrffxxx.exethhbtn.exexlrrfxx.exetnbnnt.exeddvvp.exe3pvvp.exettbbtt.exefxlfrlr.exetnhbhh.exehhbtnn.exefxfxxrr.exedescription pid process target process PID 2060 wrote to memory of 1336 2060 a774e7f1f94a96bcb160ee331ee35070_NeikiAnalytics.exe rlrrlfx.exe PID 2060 wrote to memory of 1336 2060 a774e7f1f94a96bcb160ee331ee35070_NeikiAnalytics.exe rlrrlfx.exe PID 2060 wrote to memory of 1336 2060 a774e7f1f94a96bcb160ee331ee35070_NeikiAnalytics.exe rlrrlfx.exe PID 1336 wrote to memory of 1588 1336 rlrrlfx.exe jddpj.exe PID 1336 wrote to memory of 1588 1336 rlrrlfx.exe jddpj.exe PID 1336 wrote to memory of 1588 1336 rlrrlfx.exe jddpj.exe PID 1588 wrote to memory of 2476 1588 jddpj.exe 3ppjd.exe PID 1588 wrote to memory of 2476 1588 jddpj.exe 3ppjd.exe PID 1588 wrote to memory of 2476 1588 jddpj.exe 3ppjd.exe PID 2476 wrote to memory of 1300 2476 3ppjd.exe ntntbh.exe PID 2476 wrote to memory of 1300 2476 3ppjd.exe ntntbh.exe PID 2476 wrote to memory of 1300 2476 3ppjd.exe ntntbh.exe PID 1300 wrote to memory of 432 1300 ntntbh.exe dvddj.exe PID 1300 wrote to memory of 432 1300 ntntbh.exe dvddj.exe PID 1300 wrote to memory of 432 1300 ntntbh.exe dvddj.exe PID 432 wrote to memory of 2552 432 dvddj.exe ttnhhh.exe PID 432 wrote to memory of 2552 432 dvddj.exe ttnhhh.exe PID 432 wrote to memory of 2552 432 dvddj.exe ttnhhh.exe PID 2552 wrote to memory of 4952 2552 ttnhhh.exe flffxlf.exe PID 2552 wrote to memory of 4952 2552 ttnhhh.exe flffxlf.exe PID 2552 wrote to memory of 4952 2552 ttnhhh.exe flffxlf.exe PID 4952 wrote to memory of 3368 4952 flffxlf.exe lfrllll.exe PID 4952 wrote to memory of 3368 4952 flffxlf.exe lfrllll.exe PID 4952 wrote to memory of 3368 4952 flffxlf.exe lfrllll.exe PID 3368 wrote to memory of 3444 3368 lfrllll.exe bhbbtt.exe PID 3368 wrote to memory of 3444 3368 lfrllll.exe bhbbtt.exe PID 3368 wrote to memory of 3444 3368 lfrllll.exe bhbbtt.exe PID 3444 wrote to memory of 3192 3444 bhbbtt.exe pvppj.exe PID 3444 wrote to memory of 3192 3444 bhbbtt.exe pvppj.exe PID 3444 wrote to memory of 3192 3444 bhbbtt.exe pvppj.exe PID 3192 wrote to memory of 1636 3192 pvppj.exe xrffxxx.exe PID 3192 wrote to memory of 1636 3192 pvppj.exe xrffxxx.exe PID 3192 wrote to memory of 1636 3192 pvppj.exe xrffxxx.exe PID 1636 wrote to memory of 1176 1636 xrffxxx.exe thhbtn.exe PID 1636 wrote to memory of 1176 1636 xrffxxx.exe thhbtn.exe PID 1636 wrote to memory of 1176 1636 xrffxxx.exe thhbtn.exe PID 1176 wrote to memory of 3328 1176 thhbtn.exe xlrrfxx.exe PID 1176 wrote to memory of 3328 1176 thhbtn.exe xlrrfxx.exe PID 1176 wrote to memory of 3328 1176 thhbtn.exe xlrrfxx.exe PID 3328 wrote to memory of 3044 3328 xlrrfxx.exe tnbnnt.exe PID 3328 wrote to memory of 3044 3328 xlrrfxx.exe tnbnnt.exe PID 3328 wrote to memory of 3044 3328 xlrrfxx.exe tnbnnt.exe PID 3044 wrote to memory of 2412 3044 tnbnnt.exe ddvvp.exe PID 3044 wrote to memory of 2412 3044 tnbnnt.exe ddvvp.exe PID 3044 wrote to memory of 2412 3044 tnbnnt.exe ddvvp.exe PID 2412 wrote to memory of 4856 2412 ddvvp.exe 3pvvp.exe PID 2412 wrote to memory of 4856 2412 ddvvp.exe 3pvvp.exe PID 2412 wrote to memory of 4856 2412 ddvvp.exe 3pvvp.exe PID 4856 wrote to memory of 5032 4856 3pvvp.exe ttbbtt.exe PID 4856 wrote to memory of 5032 4856 3pvvp.exe ttbbtt.exe PID 4856 wrote to memory of 5032 4856 3pvvp.exe ttbbtt.exe PID 5032 wrote to memory of 3620 5032 ttbbtt.exe fxlfrlr.exe PID 5032 wrote to memory of 3620 5032 ttbbtt.exe fxlfrlr.exe PID 5032 wrote to memory of 3620 5032 ttbbtt.exe fxlfrlr.exe PID 3620 wrote to memory of 3636 3620 fxlfrlr.exe tnhbhh.exe PID 3620 wrote to memory of 3636 3620 fxlfrlr.exe tnhbhh.exe PID 3620 wrote to memory of 3636 3620 fxlfrlr.exe tnhbhh.exe PID 3636 wrote to memory of 2512 3636 tnhbhh.exe hhbtnn.exe PID 3636 wrote to memory of 2512 3636 tnhbhh.exe hhbtnn.exe PID 3636 wrote to memory of 2512 3636 tnhbhh.exe hhbtnn.exe PID 2512 wrote to memory of 5052 2512 hhbtnn.exe fxfxxrr.exe PID 2512 wrote to memory of 5052 2512 hhbtnn.exe fxfxxrr.exe PID 2512 wrote to memory of 5052 2512 hhbtnn.exe fxfxxrr.exe PID 5052 wrote to memory of 4848 5052 fxfxxrr.exe rlrffff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a774e7f1f94a96bcb160ee331ee35070_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a774e7f1f94a96bcb160ee331ee35070_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\rlrrlfx.exec:\rlrrlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\jddpj.exec:\jddpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\3ppjd.exec:\3ppjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\ntntbh.exec:\ntntbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\dvddj.exec:\dvddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\ttnhhh.exec:\ttnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\flffxlf.exec:\flffxlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\lfrllll.exec:\lfrllll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\bhbbtt.exec:\bhbbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\pvppj.exec:\pvppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\xrffxxx.exec:\xrffxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\thhbtn.exec:\thhbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\xlrrfxx.exec:\xlrrfxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\tnbnnt.exec:\tnbnnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\ddvvp.exec:\ddvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\3pvvp.exec:\3pvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\ttbbtt.exec:\ttbbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\fxlfrlr.exec:\fxlfrlr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\tnhbhh.exec:\tnhbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\hhbtnn.exec:\hhbtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\rlrffff.exec:\rlrffff.exe23⤵
- Executes dropped EXE
PID:4848 -
\??\c:\rlrlllf.exec:\rlrlllf.exe24⤵
- Executes dropped EXE
PID:1076 -
\??\c:\pjddd.exec:\pjddd.exe25⤵
- Executes dropped EXE
PID:4308 -
\??\c:\bnttbb.exec:\bnttbb.exe26⤵
- Executes dropped EXE
PID:8 -
\??\c:\hhnnnn.exec:\hhnnnn.exe27⤵
- Executes dropped EXE
PID:4384 -
\??\c:\pdpdd.exec:\pdpdd.exe28⤵
- Executes dropped EXE
PID:1968 -
\??\c:\1fllllx.exec:\1fllllx.exe29⤵
- Executes dropped EXE
PID:3520 -
\??\c:\nnhhhh.exec:\nnhhhh.exe30⤵
- Executes dropped EXE
PID:4400 -
\??\c:\fllrlrl.exec:\fllrlrl.exe31⤵
- Executes dropped EXE
PID:2556 -
\??\c:\bhhhhn.exec:\bhhhhn.exe32⤵
- Executes dropped EXE
PID:760 -
\??\c:\tnhnhh.exec:\tnhnhh.exe33⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jvddj.exec:\jvddj.exe34⤵
- Executes dropped EXE
PID:3172 -
\??\c:\lflrllf.exec:\lflrllf.exe35⤵
- Executes dropped EXE
PID:4436 -
\??\c:\btbbbh.exec:\btbbbh.exe36⤵
- Executes dropped EXE
PID:1576 -
\??\c:\jddjd.exec:\jddjd.exe37⤵
- Executes dropped EXE
PID:4520 -
\??\c:\thnntt.exec:\thnntt.exe38⤵
- Executes dropped EXE
PID:1336 -
\??\c:\ppdvd.exec:\ppdvd.exe39⤵
- Executes dropped EXE
PID:4880 -
\??\c:\jvjdv.exec:\jvjdv.exe40⤵
- Executes dropped EXE
PID:1260 -
\??\c:\lflllrr.exec:\lflllrr.exe41⤵
- Executes dropped EXE
PID:1292 -
\??\c:\ttnnnh.exec:\ttnnnh.exe42⤵
- Executes dropped EXE
PID:4800 -
\??\c:\ppdpj.exec:\ppdpj.exe43⤵
- Executes dropped EXE
PID:2328 -
\??\c:\frxrrll.exec:\frxrrll.exe44⤵
- Executes dropped EXE
PID:1580 -
\??\c:\hbhttt.exec:\hbhttt.exe45⤵
- Executes dropped EXE
PID:4648 -
\??\c:\jppjd.exec:\jppjd.exe46⤵
- Executes dropped EXE
PID:808 -
\??\c:\frlfrrl.exec:\frlfrrl.exe47⤵
- Executes dropped EXE
PID:3820 -
\??\c:\hbnbnn.exec:\hbnbnn.exe48⤵
- Executes dropped EXE
PID:2144 -
\??\c:\dvpjj.exec:\dvpjj.exe49⤵
- Executes dropped EXE
PID:4636 -
\??\c:\lfrfrrl.exec:\lfrfrrl.exe50⤵
- Executes dropped EXE
PID:688 -
\??\c:\bnnnbb.exec:\bnnnbb.exe51⤵
- Executes dropped EXE
PID:2128 -
\??\c:\pvpjd.exec:\pvpjd.exe52⤵
- Executes dropped EXE
PID:4028 -
\??\c:\llrllrl.exec:\llrllrl.exe53⤵
- Executes dropped EXE
PID:2028 -
\??\c:\bhthtn.exec:\bhthtn.exe54⤵
- Executes dropped EXE
PID:4744 -
\??\c:\dpdvp.exec:\dpdvp.exe55⤵
- Executes dropped EXE
PID:3328 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe56⤵
- Executes dropped EXE
PID:4164 -
\??\c:\nhnhtt.exec:\nhnhtt.exe57⤵
- Executes dropped EXE
PID:1372 -
\??\c:\dpdjd.exec:\dpdjd.exe58⤵
- Executes dropped EXE
PID:700 -
\??\c:\lxrlfrl.exec:\lxrlfrl.exe59⤵
- Executes dropped EXE
PID:4584 -
\??\c:\nbnhbb.exec:\nbnhbb.exe60⤵
- Executes dropped EXE
PID:4220 -
\??\c:\vdpjd.exec:\vdpjd.exe61⤵
- Executes dropped EXE
PID:1316 -
\??\c:\3llfxxr.exec:\3llfxxr.exe62⤵
- Executes dropped EXE
PID:4380 -
\??\c:\hnbttb.exec:\hnbttb.exe63⤵
- Executes dropped EXE
PID:336 -
\??\c:\tnhbtn.exec:\tnhbtn.exe64⤵
- Executes dropped EXE
PID:3440 -
\??\c:\jpppj.exec:\jpppj.exe65⤵
- Executes dropped EXE
PID:4592 -
\??\c:\xlllfrx.exec:\xlllfrx.exe66⤵PID:3760
-
\??\c:\tnthnh.exec:\tnthnh.exe67⤵PID:4536
-
\??\c:\fxxlllf.exec:\fxxlllf.exe68⤵PID:4528
-
\??\c:\rrlllrr.exec:\rrlllrr.exe69⤵PID:3692
-
\??\c:\1flfxxr.exec:\1flfxxr.exe70⤵PID:4384
-
\??\c:\flfffff.exec:\flfffff.exe71⤵PID:2332
-
\??\c:\tnbhtb.exec:\tnbhtb.exe72⤵PID:2964
-
\??\c:\vjjvv.exec:\vjjvv.exe73⤵PID:3508
-
\??\c:\rxlrxrl.exec:\rxlrxrl.exe74⤵PID:4524
-
\??\c:\hhnhbb.exec:\hhnhbb.exe75⤵PID:4812
-
\??\c:\jvpjp.exec:\jvpjp.exe76⤵PID:1088
-
\??\c:\rlllfff.exec:\rlllfff.exe77⤵PID:1680
-
\??\c:\btnnhh.exec:\btnnhh.exe78⤵PID:2816
-
\??\c:\bnnnhh.exec:\bnnnhh.exe79⤵PID:3240
-
\??\c:\rflxrfx.exec:\rflxrfx.exe80⤵PID:4124
-
\??\c:\lxfxrlf.exec:\lxfxrlf.exe81⤵PID:3968
-
\??\c:\btnnhh.exec:\btnnhh.exe82⤵PID:3428
-
\??\c:\5flllll.exec:\5flllll.exe83⤵PID:4680
-
\??\c:\5xxlfff.exec:\5xxlfff.exe84⤵PID:4668
-
\??\c:\bbtnhb.exec:\bbtnhb.exe85⤵PID:4648
-
\??\c:\dvppd.exec:\dvppd.exe86⤵PID:3200
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe87⤵PID:5004
-
\??\c:\ttbbnn.exec:\ttbbnn.exe88⤵PID:1212
-
\??\c:\tbhhbt.exec:\tbhhbt.exe89⤵PID:5064
-
\??\c:\dppjd.exec:\dppjd.exe90⤵PID:1224
-
\??\c:\rrlrxlx.exec:\rrlrxlx.exe91⤵PID:5076
-
\??\c:\xfrrxff.exec:\xfrrxff.exe92⤵PID:2028
-
\??\c:\thtthb.exec:\thtthb.exe93⤵PID:2088
-
\??\c:\pdpdv.exec:\pdpdv.exe94⤵PID:3328
-
\??\c:\llxrlfx.exec:\llxrlfx.exe95⤵PID:1060
-
\??\c:\rflfrrl.exec:\rflfrrl.exe96⤵PID:1372
-
\??\c:\bthhnn.exec:\bthhnn.exe97⤵PID:4832
-
\??\c:\vvjdd.exec:\vvjdd.exe98⤵PID:4584
-
\??\c:\5xrrlrl.exec:\5xrrlrl.exe99⤵PID:1804
-
\??\c:\bbhhbb.exec:\bbhhbb.exe100⤵PID:2384
-
\??\c:\dvdvp.exec:\dvdvp.exe101⤵PID:2176
-
\??\c:\9rlxxrr.exec:\9rlxxrr.exe102⤵PID:336
-
\??\c:\btnnbb.exec:\btnnbb.exe103⤵PID:3440
-
\??\c:\nbbhhn.exec:\nbbhhn.exe104⤵PID:1396
-
\??\c:\pjdvp.exec:\pjdvp.exe105⤵PID:1564
-
\??\c:\lfflrrr.exec:\lfflrrr.exe106⤵PID:4308
-
\??\c:\lxlfxff.exec:\lxlfxff.exe107⤵PID:3980
-
\??\c:\hhnhht.exec:\hhnhht.exe108⤵PID:4760
-
\??\c:\djppj.exec:\djppj.exe109⤵PID:4268
-
\??\c:\dvddv.exec:\dvddv.exe110⤵PID:2568
-
\??\c:\xrxxllf.exec:\xrxxllf.exe111⤵PID:4400
-
\??\c:\ttbbtn.exec:\ttbbtn.exe112⤵PID:5108
-
\??\c:\5thbbh.exec:\5thbbh.exe113⤵PID:4788
-
\??\c:\ppvpj.exec:\ppvpj.exe114⤵PID:4336
-
\??\c:\rlrrffr.exec:\rlrrffr.exe115⤵PID:1000
-
\??\c:\bthbnn.exec:\bthbnn.exe116⤵PID:3364
-
\??\c:\jjjjp.exec:\jjjjp.exe117⤵PID:4228
-
\??\c:\vdvpp.exec:\vdvpp.exe118⤵PID:548
-
\??\c:\9xfxfll.exec:\9xfxfll.exe119⤵PID:3064
-
\??\c:\nnnnhn.exec:\nnnnhn.exe120⤵PID:3556
-
\??\c:\nhtttb.exec:\nhtttb.exe121⤵PID:2932
-
\??\c:\vpdvj.exec:\vpdvj.exe122⤵PID:4544
-
\??\c:\rlxxlfl.exec:\rlxxlfl.exe123⤵PID:3456
-
\??\c:\1ttttt.exec:\1ttttt.exe124⤵PID:4920
-
\??\c:\3pjjj.exec:\3pjjj.exe125⤵PID:544
-
\??\c:\xfffffr.exec:\xfffffr.exe126⤵PID:3444
-
\??\c:\lflfxff.exec:\lflfxff.exe127⤵PID:3224
-
\??\c:\hbnbhn.exec:\hbnbhn.exe128⤵PID:3504
-
\??\c:\jdjjj.exec:\jdjjj.exe129⤵PID:2616
-
\??\c:\pjvpv.exec:\pjvpv.exe130⤵PID:4692
-
\??\c:\fxrlfxl.exec:\fxrlfxl.exe131⤵PID:2196
-
\??\c:\bhbtnh.exec:\bhbtnh.exe132⤵PID:2676
-
\??\c:\jdjdv.exec:\jdjdv.exe133⤵PID:3920
-
\??\c:\1lfffll.exec:\1lfffll.exe134⤵PID:1724
-
\??\c:\nhhhhh.exec:\nhhhhh.exe135⤵PID:4508
-
\??\c:\btbhhh.exec:\btbhhh.exe136⤵PID:636
-
\??\c:\3vvpd.exec:\3vvpd.exe137⤵PID:2228
-
\??\c:\rrlllrr.exec:\rrlllrr.exe138⤵PID:3412
-
\??\c:\nntnhb.exec:\nntnhb.exe139⤵PID:2904
-
\??\c:\jdvdv.exec:\jdvdv.exe140⤵PID:1568
-
\??\c:\lrrlrrf.exec:\lrrlrrf.exe141⤵PID:4884
-
\??\c:\rxlrrll.exec:\rxlrrll.exe142⤵PID:4592
-
\??\c:\thtttt.exec:\thtttt.exe143⤵PID:3756
-
\??\c:\nnnnth.exec:\nnnnth.exe144⤵PID:1932
-
\??\c:\jpjjd.exec:\jpjjd.exe145⤵PID:3372
-
\??\c:\lrxrrfx.exec:\lrxrrfx.exe146⤵PID:3752
-
\??\c:\hhnbtb.exec:\hhnbtb.exe147⤵PID:1968
-
\??\c:\hhbbtt.exec:\hhbbtt.exe148⤵PID:2492
-
\??\c:\vdjdp.exec:\vdjdp.exe149⤵PID:2332
-
\??\c:\lflffxx.exec:\lflffxx.exe150⤵PID:2964
-
\??\c:\1xfxfrr.exec:\1xfxfrr.exe151⤵PID:4320
-
\??\c:\nhbbbb.exec:\nhbbbb.exe152⤵PID:1576
-
\??\c:\7vvvp.exec:\7vvvp.exe153⤵PID:2396
-
\??\c:\rflffxx.exec:\rflffxx.exe154⤵PID:1440
-
\??\c:\rlrlllf.exec:\rlrlllf.exe155⤵PID:4564
-
\??\c:\tnbhhn.exec:\tnbhhn.exe156⤵PID:812
-
\??\c:\vppvv.exec:\vppvv.exe157⤵PID:1300
-
\??\c:\ddjdd.exec:\ddjdd.exe158⤵PID:3088
-
\??\c:\1xrrlrl.exec:\1xrrlrl.exe159⤵PID:2560
-
\??\c:\thtttb.exec:\thtttb.exe160⤵PID:4952
-
\??\c:\jpvvv.exec:\jpvvv.exe161⤵PID:3820
-
\??\c:\lflfxxx.exec:\lflfxxx.exe162⤵PID:3320
-
\??\c:\5rrlllx.exec:\5rrlllx.exe163⤵PID:1196
-
\??\c:\ntnttt.exec:\ntnttt.exe164⤵PID:3100
-
\??\c:\hnbttt.exec:\hnbttt.exe165⤵PID:3632
-
\??\c:\pvjdd.exec:\pvjdd.exe166⤵PID:5080
-
\??\c:\rrffffx.exec:\rrffffx.exe167⤵PID:1176
-
\??\c:\rlrllrr.exec:\rlrllrr.exe168⤵PID:1612
-
\??\c:\7bhbtt.exec:\7bhbtt.exe169⤵PID:4900
-
\??\c:\hbnnnn.exec:\hbnnnn.exe170⤵PID:2088
-
\??\c:\pjppj.exec:\pjppj.exe171⤵PID:3360
-
\??\c:\lxflflf.exec:\lxflflf.exe172⤵PID:1060
-
\??\c:\nbnbnn.exec:\nbnbnn.exe173⤵PID:1372
-
\??\c:\bbtttb.exec:\bbtttb.exe174⤵PID:1996
-
\??\c:\jddvp.exec:\jddvp.exe175⤵PID:4272
-
\??\c:\vddjj.exec:\vddjj.exe176⤵PID:4380
-
\??\c:\fxlfffx.exec:\fxlfffx.exe177⤵PID:3552
-
\??\c:\hnbnhh.exec:\hnbnhh.exe178⤵PID:4056
-
\??\c:\ppdvp.exec:\ppdvp.exe179⤵PID:3032
-
\??\c:\dddvv.exec:\dddvv.exe180⤵PID:3532
-
\??\c:\fxfrxxf.exec:\fxfrxxf.exe181⤵PID:1396
-
\??\c:\hthhbb.exec:\hthhbb.exe182⤵PID:4748
-
\??\c:\7jppp.exec:\7jppp.exe183⤵PID:3144
-
\??\c:\7vvpj.exec:\7vvpj.exe184⤵PID:2024
-
\??\c:\ffrllll.exec:\ffrllll.exe185⤵PID:4760
-
\??\c:\hbnhnt.exec:\hbnhnt.exe186⤵PID:3152
-
\??\c:\pdjdd.exec:\pdjdd.exe187⤵PID:4000
-
\??\c:\fflxxxf.exec:\fflxxxf.exe188⤵PID:2528
-
\??\c:\1ntttn.exec:\1ntttn.exe189⤵PID:1504
-
\??\c:\hbbttt.exec:\hbbttt.exe190⤵PID:2332
-
\??\c:\vjppj.exec:\vjppj.exe191⤵PID:2964
-
\??\c:\rxrfxxr.exec:\rxrfxxr.exe192⤵PID:4812
-
\??\c:\hnbnnh.exec:\hnbnnh.exe193⤵PID:4788
-
\??\c:\1dpjp.exec:\1dpjp.exe194⤵PID:1336
-
\??\c:\llrrfxr.exec:\llrrfxr.exe195⤵PID:932
-
\??\c:\lfrffll.exec:\lfrffll.exe196⤵PID:2476
-
\??\c:\bttnhh.exec:\bttnhh.exe197⤵PID:1260
-
\??\c:\dvvvd.exec:\dvvvd.exe198⤵PID:4124
-
\??\c:\xlxxxxx.exec:\xlxxxxx.exe199⤵PID:432
-
\??\c:\nbhntn.exec:\nbhntn.exe200⤵PID:2932
-
\??\c:\djdvd.exec:\djdvd.exe201⤵PID:1444
-
\??\c:\jjjdp.exec:\jjjdp.exe202⤵PID:3456
-
\??\c:\rflfxrl.exec:\rflfxrl.exe203⤵PID:2144
-
\??\c:\1nnbnn.exec:\1nnbnn.exe204⤵PID:464
-
\??\c:\vpppp.exec:\vpppp.exe205⤵PID:2620
-
\??\c:\jvvvp.exec:\jvvvp.exe206⤵PID:2980
-
\??\c:\3rfrflf.exec:\3rfrflf.exe207⤵PID:3504
-
\??\c:\hhbtbb.exec:\hhbtbb.exe208⤵PID:4548
-
\??\c:\3pjdv.exec:\3pjdv.exe209⤵PID:3104
-
\??\c:\xrrlrll.exec:\xrrlrll.exe210⤵PID:2196
-
\??\c:\nhnntn.exec:\nhnntn.exe211⤵PID:4392
-
\??\c:\jjdvd.exec:\jjdvd.exe212⤵PID:3700
-
\??\c:\xrffflf.exec:\xrffflf.exe213⤵PID:3460
-
\??\c:\hhhhhh.exec:\hhhhhh.exe214⤵PID:1372
-
\??\c:\tthbtt.exec:\tthbtt.exe215⤵PID:2228
-
\??\c:\vpvjd.exec:\vpvjd.exe216⤵PID:1352
-
\??\c:\frfxrlf.exec:\frfxrlf.exe217⤵PID:2540
-
\??\c:\9nbbhh.exec:\9nbbhh.exe218⤵PID:988
-
\??\c:\djvpv.exec:\djvpv.exe219⤵PID:4056
-
\??\c:\dvdjj.exec:\dvdjj.exe220⤵PID:4592
-
\??\c:\xrrrxlx.exec:\xrrrxlx.exe221⤵PID:3756
-
\??\c:\7hbttb.exec:\7hbttb.exe222⤵PID:2320
-
\??\c:\bthbbt.exec:\bthbbt.exe223⤵PID:3156
-
\??\c:\vvvpp.exec:\vvvpp.exe224⤵PID:3752
-
\??\c:\lrlllll.exec:\lrlllll.exe225⤵PID:4128
-
\??\c:\tbnntn.exec:\tbnntn.exe226⤵PID:2492
-
\??\c:\tttttt.exec:\tttttt.exe227⤵PID:3012
-
\??\c:\ddvdv.exec:\ddvdv.exe228⤵PID:3992
-
\??\c:\frrlfxr.exec:\frrlfxr.exe229⤵PID:448
-
\??\c:\btbtnn.exec:\btbtnn.exe230⤵PID:1116
-
\??\c:\ppvvp.exec:\ppvvp.exe231⤵PID:2520
-
\??\c:\ppjjp.exec:\ppjjp.exe232⤵PID:2060
-
\??\c:\5lxxxrx.exec:\5lxxxrx.exe233⤵PID:996
-
\??\c:\bntnhb.exec:\bntnhb.exe234⤵PID:1588
-
\??\c:\vpvdv.exec:\vpvdv.exe235⤵PID:3364
-
\??\c:\frfxrxr.exec:\frfxrxr.exe236⤵PID:2680
-
\??\c:\nnhbtb.exec:\nnhbtb.exe237⤵PID:5064
-
\??\c:\hhtnhh.exec:\hhtnhh.exe238⤵PID:3968
-
\??\c:\pjvvj.exec:\pjvvj.exe239⤵PID:4420
-
\??\c:\llxxxxx.exec:\llxxxxx.exe240⤵PID:3020
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe241⤵PID:4952
-
\??\c:\hhhbtt.exec:\hhhbtt.exe242⤵PID:3368