Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 10:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
352fe4a0a1b45e04b96b39022784bd0d812aeb11a895d47751846110ce7a9210_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
352fe4a0a1b45e04b96b39022784bd0d812aeb11a895d47751846110ce7a9210_NeikiAnalytics.exe
-
Size
78KB
-
MD5
4181c51e533d3b1c573fa0a5d97b4600
-
SHA1
f11504725d6d3594afa84bee9674043d9e6b37a6
-
SHA256
352fe4a0a1b45e04b96b39022784bd0d812aeb11a895d47751846110ce7a9210
-
SHA512
5e59a13db3471c250bf15468753b5350422399a6e46311b63c4b9d45e278a6d5de12744e0c17102e0b09b526c5c44fa955b0e426432d9713ea2e1ac58be77cdb
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2wVEJ6FlLgbI:ymb3NkkiQ3mdBjF+3TU2KEJ6WI
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/1644-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/960-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/892-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rxfrlfx.exe3nnhbb.exepjjdv.exejppjd.exeflrlffx.exe7jjdj.exejdpvp.exe9rxlflf.exelrrlllf.exennhbtt.exebtbthh.exe1pppj.exellxrllf.exebhbttt.exedvppj.exexllrffx.exebnhbtt.exepddvp.exejdjdd.exe7lrlllf.exefxxxrxr.exebbbtnn.exevvdvj.exelrrlxxr.exehtbbtt.exepdppj.exefxrlxxr.exelffrllx.exe1htnhh.exepjjdp.exelffxlll.exebntnhh.exetnhthn.exe9djjd.exerlrrrxr.exetntnht.exe7vvjd.exejpppd.exejddjj.exefllfxxr.exehtbbbb.exehttnhh.exe9djjd.exevpdvp.exelxlfxxr.exebnbttn.exehnnhbt.exeppjvd.exe1jpjd.exerlrlxxl.exellllfff.exenhhhnn.exenhnnnt.exeddvvp.exejdjdv.exelrrlxxr.exe1tbhtt.exehbtnhb.exejjpdd.exejjpjj.exexxffllf.exe1fffxxr.exebnnhhn.exepjppp.exepid process 3952 rxfrlfx.exe 2428 3nnhbb.exe 3900 pjjdv.exe 4216 jppjd.exe 960 flrlffx.exe 4892 7jjdj.exe 892 jdpvp.exe 2152 9rxlflf.exe 4808 lrrlllf.exe 4712 nnhbtt.exe 2364 btbthh.exe 1732 1pppj.exe 1424 llxrllf.exe 3844 bhbttt.exe 4800 dvppj.exe 2780 xllrffx.exe 4504 bnhbtt.exe 2384 pddvp.exe 4228 jdjdd.exe 1396 7lrlllf.exe 3008 fxxxrxr.exe 4616 bbbtnn.exe 4076 vvdvj.exe 1816 lrrlxxr.exe 1792 htbbtt.exe 3236 pdppj.exe 1008 fxrlxxr.exe 3220 lffrllx.exe 2576 1htnhh.exe 4856 pjjdp.exe 4080 lffxlll.exe 1456 bntnhh.exe 4220 tnhthn.exe 3744 9djjd.exe 4336 rlrrrxr.exe 4372 tntnht.exe 3516 7vvjd.exe 388 jpppd.exe 2472 jddjj.exe 2276 fllfxxr.exe 4516 htbbbb.exe 4408 httnhh.exe 3028 9djjd.exe 1476 vpdvp.exe 4284 lxlfxxr.exe 2444 bnbttn.exe 4400 hnnhbt.exe 2752 ppjvd.exe 3340 1jpjd.exe 1188 rlrlxxl.exe 1352 llllfff.exe 2124 nhhhnn.exe 2328 nhnnnt.exe 3196 ddvvp.exe 4880 jdjdv.exe 1184 lrrlxxr.exe 2780 1tbhtt.exe 2928 hbtnhb.exe 3624 jjpdd.exe 400 jjpjj.exe 1268 xxffllf.exe 4236 1fffxxr.exe 2104 bnnhhn.exe 3548 pjppp.exe -
Processes:
resource yara_rule behavioral2/memory/1644-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/892-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
352fe4a0a1b45e04b96b39022784bd0d812aeb11a895d47751846110ce7a9210_NeikiAnalytics.exerxfrlfx.exe3nnhbb.exepjjdv.exejppjd.exeflrlffx.exe7jjdj.exejdpvp.exe9rxlflf.exelrrlllf.exennhbtt.exebtbthh.exe1pppj.exellxrllf.exebhbttt.exedvppj.exexllrffx.exebnhbtt.exepddvp.exejdjdd.exe7lrlllf.exefxxxrxr.exedescription pid process target process PID 1644 wrote to memory of 3952 1644 352fe4a0a1b45e04b96b39022784bd0d812aeb11a895d47751846110ce7a9210_NeikiAnalytics.exe rxfrlfx.exe PID 1644 wrote to memory of 3952 1644 352fe4a0a1b45e04b96b39022784bd0d812aeb11a895d47751846110ce7a9210_NeikiAnalytics.exe rxfrlfx.exe PID 1644 wrote to memory of 3952 1644 352fe4a0a1b45e04b96b39022784bd0d812aeb11a895d47751846110ce7a9210_NeikiAnalytics.exe rxfrlfx.exe PID 3952 wrote to memory of 2428 3952 rxfrlfx.exe 3nnhbb.exe PID 3952 wrote to memory of 2428 3952 rxfrlfx.exe 3nnhbb.exe PID 3952 wrote to memory of 2428 3952 rxfrlfx.exe 3nnhbb.exe PID 2428 wrote to memory of 3900 2428 3nnhbb.exe pjjdv.exe PID 2428 wrote to memory of 3900 2428 3nnhbb.exe pjjdv.exe PID 2428 wrote to memory of 3900 2428 3nnhbb.exe pjjdv.exe PID 3900 wrote to memory of 4216 3900 pjjdv.exe jppjd.exe PID 3900 wrote to memory of 4216 3900 pjjdv.exe jppjd.exe PID 3900 wrote to memory of 4216 3900 pjjdv.exe jppjd.exe PID 4216 wrote to memory of 960 4216 jppjd.exe flrlffx.exe PID 4216 wrote to memory of 960 4216 jppjd.exe flrlffx.exe PID 4216 wrote to memory of 960 4216 jppjd.exe flrlffx.exe PID 960 wrote to memory of 4892 960 flrlffx.exe 7jjdj.exe PID 960 wrote to memory of 4892 960 flrlffx.exe 7jjdj.exe PID 960 wrote to memory of 4892 960 flrlffx.exe 7jjdj.exe PID 4892 wrote to memory of 892 4892 7jjdj.exe jdpvp.exe PID 4892 wrote to memory of 892 4892 7jjdj.exe jdpvp.exe PID 4892 wrote to memory of 892 4892 7jjdj.exe jdpvp.exe PID 892 wrote to memory of 2152 892 jdpvp.exe 9rxlflf.exe PID 892 wrote to memory of 2152 892 jdpvp.exe 9rxlflf.exe PID 892 wrote to memory of 2152 892 jdpvp.exe 9rxlflf.exe PID 2152 wrote to memory of 4808 2152 9rxlflf.exe lrrlllf.exe PID 2152 wrote to memory of 4808 2152 9rxlflf.exe lrrlllf.exe PID 2152 wrote to memory of 4808 2152 9rxlflf.exe lrrlllf.exe PID 4808 wrote to memory of 4712 4808 lrrlllf.exe nnhbtt.exe PID 4808 wrote to memory of 4712 4808 lrrlllf.exe nnhbtt.exe PID 4808 wrote to memory of 4712 4808 lrrlllf.exe nnhbtt.exe PID 4712 wrote to memory of 2364 4712 nnhbtt.exe btbthh.exe PID 4712 wrote to memory of 2364 4712 nnhbtt.exe btbthh.exe PID 4712 wrote to memory of 2364 4712 nnhbtt.exe btbthh.exe PID 2364 wrote to memory of 1732 2364 btbthh.exe 1pppj.exe PID 2364 wrote to memory of 1732 2364 btbthh.exe 1pppj.exe PID 2364 wrote to memory of 1732 2364 btbthh.exe 1pppj.exe PID 1732 wrote to memory of 1424 1732 1pppj.exe llxrllf.exe PID 1732 wrote to memory of 1424 1732 1pppj.exe llxrllf.exe PID 1732 wrote to memory of 1424 1732 1pppj.exe llxrllf.exe PID 1424 wrote to memory of 3844 1424 llxrllf.exe bhbttt.exe PID 1424 wrote to memory of 3844 1424 llxrllf.exe bhbttt.exe PID 1424 wrote to memory of 3844 1424 llxrllf.exe bhbttt.exe PID 3844 wrote to memory of 4800 3844 bhbttt.exe dvppj.exe PID 3844 wrote to memory of 4800 3844 bhbttt.exe dvppj.exe PID 3844 wrote to memory of 4800 3844 bhbttt.exe dvppj.exe PID 4800 wrote to memory of 2780 4800 dvppj.exe xllrffx.exe PID 4800 wrote to memory of 2780 4800 dvppj.exe xllrffx.exe PID 4800 wrote to memory of 2780 4800 dvppj.exe xllrffx.exe PID 2780 wrote to memory of 4504 2780 xllrffx.exe bnhbtt.exe PID 2780 wrote to memory of 4504 2780 xllrffx.exe bnhbtt.exe PID 2780 wrote to memory of 4504 2780 xllrffx.exe bnhbtt.exe PID 4504 wrote to memory of 2384 4504 bnhbtt.exe pddvp.exe PID 4504 wrote to memory of 2384 4504 bnhbtt.exe pddvp.exe PID 4504 wrote to memory of 2384 4504 bnhbtt.exe pddvp.exe PID 2384 wrote to memory of 4228 2384 pddvp.exe jdjdd.exe PID 2384 wrote to memory of 4228 2384 pddvp.exe jdjdd.exe PID 2384 wrote to memory of 4228 2384 pddvp.exe jdjdd.exe PID 4228 wrote to memory of 1396 4228 jdjdd.exe 7lrlllf.exe PID 4228 wrote to memory of 1396 4228 jdjdd.exe 7lrlllf.exe PID 4228 wrote to memory of 1396 4228 jdjdd.exe 7lrlllf.exe PID 1396 wrote to memory of 3008 1396 7lrlllf.exe fxxxrxr.exe PID 1396 wrote to memory of 3008 1396 7lrlllf.exe fxxxrxr.exe PID 1396 wrote to memory of 3008 1396 7lrlllf.exe fxxxrxr.exe PID 3008 wrote to memory of 4616 3008 fxxxrxr.exe bbbtnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\352fe4a0a1b45e04b96b39022784bd0d812aeb11a895d47751846110ce7a9210_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\352fe4a0a1b45e04b96b39022784bd0d812aeb11a895d47751846110ce7a9210_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\rxfrlfx.exec:\rxfrlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\3nnhbb.exec:\3nnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\pjjdv.exec:\pjjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\jppjd.exec:\jppjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\flrlffx.exec:\flrlffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\7jjdj.exec:\7jjdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\jdpvp.exec:\jdpvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\9rxlflf.exec:\9rxlflf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\lrrlllf.exec:\lrrlllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\nnhbtt.exec:\nnhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\btbthh.exec:\btbthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\1pppj.exec:\1pppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\llxrllf.exec:\llxrllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\bhbttt.exec:\bhbttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\dvppj.exec:\dvppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\xllrffx.exec:\xllrffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\bnhbtt.exec:\bnhbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\pddvp.exec:\pddvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\jdjdd.exec:\jdjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\7lrlllf.exec:\7lrlllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\fxxxrxr.exec:\fxxxrxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\bbbtnn.exec:\bbbtnn.exe23⤵
- Executes dropped EXE
PID:4616 -
\??\c:\vvdvj.exec:\vvdvj.exe24⤵
- Executes dropped EXE
PID:4076 -
\??\c:\lrrlxxr.exec:\lrrlxxr.exe25⤵
- Executes dropped EXE
PID:1816 -
\??\c:\htbbtt.exec:\htbbtt.exe26⤵
- Executes dropped EXE
PID:1792 -
\??\c:\pdppj.exec:\pdppj.exe27⤵
- Executes dropped EXE
PID:3236 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe28⤵
- Executes dropped EXE
PID:1008 -
\??\c:\lffrllx.exec:\lffrllx.exe29⤵
- Executes dropped EXE
PID:3220 -
\??\c:\1htnhh.exec:\1htnhh.exe30⤵
- Executes dropped EXE
PID:2576 -
\??\c:\pjjdp.exec:\pjjdp.exe31⤵
- Executes dropped EXE
PID:4856 -
\??\c:\lffxlll.exec:\lffxlll.exe32⤵
- Executes dropped EXE
PID:4080 -
\??\c:\bntnhh.exec:\bntnhh.exe33⤵
- Executes dropped EXE
PID:1456 -
\??\c:\tnhthn.exec:\tnhthn.exe34⤵
- Executes dropped EXE
PID:4220 -
\??\c:\9djjd.exec:\9djjd.exe35⤵
- Executes dropped EXE
PID:3744 -
\??\c:\rlrrrxr.exec:\rlrrrxr.exe36⤵
- Executes dropped EXE
PID:4336 -
\??\c:\tntnht.exec:\tntnht.exe37⤵
- Executes dropped EXE
PID:4372 -
\??\c:\7vvjd.exec:\7vvjd.exe38⤵
- Executes dropped EXE
PID:3516 -
\??\c:\jpppd.exec:\jpppd.exe39⤵
- Executes dropped EXE
PID:388 -
\??\c:\jddjj.exec:\jddjj.exe40⤵
- Executes dropped EXE
PID:2472 -
\??\c:\fllfxxr.exec:\fllfxxr.exe41⤵
- Executes dropped EXE
PID:2276 -
\??\c:\htbbbb.exec:\htbbbb.exe42⤵
- Executes dropped EXE
PID:4516 -
\??\c:\httnhh.exec:\httnhh.exe43⤵
- Executes dropped EXE
PID:4408 -
\??\c:\9djjd.exec:\9djjd.exe44⤵
- Executes dropped EXE
PID:3028 -
\??\c:\vpdvp.exec:\vpdvp.exe45⤵
- Executes dropped EXE
PID:1476 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe46⤵
- Executes dropped EXE
PID:4284 -
\??\c:\bnbttn.exec:\bnbttn.exe47⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hnnhbt.exec:\hnnhbt.exe48⤵
- Executes dropped EXE
PID:4400 -
\??\c:\ppjvd.exec:\ppjvd.exe49⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1jpjd.exec:\1jpjd.exe50⤵
- Executes dropped EXE
PID:3340 -
\??\c:\rlrlxxl.exec:\rlrlxxl.exe51⤵
- Executes dropped EXE
PID:1188 -
\??\c:\llllfff.exec:\llllfff.exe52⤵
- Executes dropped EXE
PID:1352 -
\??\c:\nhhhnn.exec:\nhhhnn.exe53⤵
- Executes dropped EXE
PID:2124 -
\??\c:\nhnnnt.exec:\nhnnnt.exe54⤵
- Executes dropped EXE
PID:2328 -
\??\c:\ddvvp.exec:\ddvvp.exe55⤵
- Executes dropped EXE
PID:3196 -
\??\c:\jdjdv.exec:\jdjdv.exe56⤵
- Executes dropped EXE
PID:4880 -
\??\c:\lrrlxxr.exec:\lrrlxxr.exe57⤵
- Executes dropped EXE
PID:1184 -
\??\c:\1tbhtt.exec:\1tbhtt.exe58⤵
- Executes dropped EXE
PID:2780 -
\??\c:\hbtnhb.exec:\hbtnhb.exe59⤵
- Executes dropped EXE
PID:2928 -
\??\c:\jjpdd.exec:\jjpdd.exe60⤵
- Executes dropped EXE
PID:3624 -
\??\c:\jjpjj.exec:\jjpjj.exe61⤵
- Executes dropped EXE
PID:400 -
\??\c:\xxffllf.exec:\xxffllf.exe62⤵
- Executes dropped EXE
PID:1268 -
\??\c:\1fffxxr.exec:\1fffxxr.exe63⤵
- Executes dropped EXE
PID:4236 -
\??\c:\bnnhhn.exec:\bnnhhn.exe64⤵
- Executes dropped EXE
PID:2104 -
\??\c:\pjppp.exec:\pjppp.exe65⤵
- Executes dropped EXE
PID:3548 -
\??\c:\vvdvd.exec:\vvdvd.exe66⤵PID:3664
-
\??\c:\rxrrlll.exec:\rxrrlll.exe67⤵PID:1524
-
\??\c:\lllfxff.exec:\lllfxff.exe68⤵PID:2712
-
\??\c:\bhtttt.exec:\bhtttt.exe69⤵PID:2884
-
\??\c:\9ntttt.exec:\9ntttt.exe70⤵PID:2468
-
\??\c:\7jjjd.exec:\7jjjd.exe71⤵PID:3172
-
\??\c:\dvdvv.exec:\dvdvv.exe72⤵PID:2484
-
\??\c:\1xxlfxr.exec:\1xxlfxr.exe73⤵PID:2084
-
\??\c:\xrxxxxf.exec:\xrxxxxf.exe74⤵PID:3816
-
\??\c:\nhbhbh.exec:\nhbhbh.exe75⤵PID:1604
-
\??\c:\pjddv.exec:\pjddv.exe76⤵PID:5108
-
\??\c:\7pvpj.exec:\7pvpj.exe77⤵PID:2844
-
\??\c:\3rrlrrl.exec:\3rrlrrl.exe78⤵PID:4304
-
\??\c:\bbnhbb.exec:\bbnhbb.exe79⤵PID:4524
-
\??\c:\thnhbh.exec:\thnhbh.exe80⤵PID:1668
-
\??\c:\jdjjd.exec:\jdjjd.exe81⤵PID:3468
-
\??\c:\xxlrfrf.exec:\xxlrfrf.exe82⤵PID:4908
-
\??\c:\bnbnhh.exec:\bnbnhh.exe83⤵PID:1644
-
\??\c:\1pppj.exec:\1pppj.exe84⤵PID:4324
-
\??\c:\pjpdv.exec:\pjpdv.exe85⤵PID:1812
-
\??\c:\fxfxrxx.exec:\fxfxrxx.exe86⤵PID:2552
-
\??\c:\7bnnhh.exec:\7bnnhh.exe87⤵PID:2616
-
\??\c:\9vddp.exec:\9vddp.exe88⤵PID:3972
-
\??\c:\frxrrrx.exec:\frxrrrx.exe89⤵PID:3264
-
\??\c:\tnnhbb.exec:\tnnhbb.exe90⤵PID:2100
-
\??\c:\hntttt.exec:\hntttt.exe91⤵PID:892
-
\??\c:\vjpjv.exec:\vjpjv.exe92⤵PID:1744
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe93⤵PID:2560
-
\??\c:\nbhthh.exec:\nbhthh.exe94⤵PID:1776
-
\??\c:\bttbtb.exec:\bttbtb.exe95⤵PID:4712
-
\??\c:\jdjpp.exec:\jdjpp.exe96⤵PID:2924
-
\??\c:\lxrlffx.exec:\lxrlffx.exe97⤵PID:5048
-
\??\c:\xxxxxff.exec:\xxxxxff.exe98⤵PID:2488
-
\??\c:\ntbttt.exec:\ntbttt.exe99⤵PID:1468
-
\??\c:\5pdjv.exec:\5pdjv.exe100⤵PID:4556
-
\??\c:\1xffrlr.exec:\1xffrlr.exe101⤵PID:1484
-
\??\c:\9xlllfl.exec:\9xlllfl.exe102⤵PID:4728
-
\??\c:\nttbtt.exec:\nttbtt.exe103⤵PID:1876
-
\??\c:\hbbthh.exec:\hbbthh.exe104⤵PID:1580
-
\??\c:\xrxxxxf.exec:\xrxxxxf.exe105⤵PID:2296
-
\??\c:\bhnthb.exec:\bhnthb.exe106⤵PID:1976
-
\??\c:\htbnth.exec:\htbnth.exe107⤵PID:1000
-
\??\c:\jvvpp.exec:\jvvpp.exe108⤵PID:4388
-
\??\c:\jdjdp.exec:\jdjdp.exe109⤵PID:2696
-
\??\c:\lflfxll.exec:\lflfxll.exe110⤵PID:2672
-
\??\c:\5rllxrl.exec:\5rllxrl.exe111⤵PID:2920
-
\??\c:\bttnhn.exec:\bttnhn.exe112⤵PID:4016
-
\??\c:\btnhnn.exec:\btnhnn.exe113⤵PID:1040
-
\??\c:\5ppjv.exec:\5ppjv.exe114⤵PID:1816
-
\??\c:\lxrfrlx.exec:\lxrfrlx.exe115⤵PID:2156
-
\??\c:\fffxrfx.exec:\fffxrfx.exe116⤵PID:4048
-
\??\c:\jpddd.exec:\jpddd.exe117⤵PID:3660
-
\??\c:\jjjdv.exec:\jjjdv.exe118⤵PID:956
-
\??\c:\fllfxll.exec:\fllfxll.exe119⤵PID:2084
-
\??\c:\5tnhbb.exec:\5tnhbb.exe120⤵PID:4852
-
\??\c:\5ppjd.exec:\5ppjd.exe121⤵PID:4588
-
\??\c:\rlrfrff.exec:\rlrfrff.exe122⤵PID:1972
-
\??\c:\bhnhbb.exec:\bhnhbb.exe123⤵PID:3476
-
\??\c:\jjvdj.exec:\jjvdj.exe124⤵PID:2624
-
\??\c:\xrflfll.exec:\xrflfll.exe125⤵PID:1536
-
\??\c:\xrlrlxl.exec:\xrlrlxl.exe126⤵PID:4336
-
\??\c:\nhnhbt.exec:\nhnhbt.exe127⤵PID:4536
-
\??\c:\jjddj.exec:\jjddj.exe128⤵PID:4544
-
\??\c:\dvdvj.exec:\dvdvj.exe129⤵PID:4528
-
\??\c:\9lrlllf.exec:\9lrlllf.exe130⤵PID:4104
-
\??\c:\bnnnbb.exec:\bnnnbb.exe131⤵PID:1592
-
\??\c:\3dvvp.exec:\3dvvp.exe132⤵PID:4216
-
\??\c:\jvvvj.exec:\jvvvj.exe133⤵PID:3012
-
\??\c:\lfxxrlf.exec:\lfxxrlf.exe134⤵PID:3740
-
\??\c:\lxxrrll.exec:\lxxrrll.exe135⤵PID:4872
-
\??\c:\hnhnth.exec:\hnhnth.exe136⤵PID:5060
-
\??\c:\jvjpj.exec:\jvjpj.exe137⤵PID:4864
-
\??\c:\jvdvp.exec:\jvdvp.exe138⤵PID:4716
-
\??\c:\9rxlfff.exec:\9rxlfff.exe139⤵PID:2416
-
\??\c:\nhbnbn.exec:\nhbnbn.exe140⤵PID:3044
-
\??\c:\rlxxrxx.exec:\rlxxrxx.exe141⤵PID:2228
-
\??\c:\thnhhh.exec:\thnhhh.exe142⤵PID:4664
-
\??\c:\pdpjp.exec:\pdpjp.exe143⤵PID:2480
-
\??\c:\7ddvj.exec:\7ddvj.exe144⤵PID:1680
-
\??\c:\5fxlfrr.exec:\5fxlfrr.exe145⤵PID:2248
-
\??\c:\hhnntt.exec:\hhnntt.exe146⤵PID:2376
-
\??\c:\7vjjj.exec:\7vjjj.exe147⤵PID:2232
-
\??\c:\jvpjd.exec:\jvpjd.exe148⤵PID:824
-
\??\c:\7llllff.exec:\7llllff.exe149⤵PID:3128
-
\??\c:\7lrlfff.exec:\7lrlfff.exe150⤵PID:4328
-
\??\c:\3hnhbb.exec:\3hnhbb.exe151⤵PID:4228
-
\??\c:\1hhtbb.exec:\1hhtbb.exe152⤵PID:3356
-
\??\c:\vpjdd.exec:\vpjdd.exe153⤵PID:1564
-
\??\c:\3xfxxxf.exec:\3xfxxxf.exe154⤵PID:3008
-
\??\c:\hhbhnn.exec:\hhbhnn.exe155⤵PID:3964
-
\??\c:\7nnnhh.exec:\7nnnhh.exe156⤵PID:2724
-
\??\c:\pdvpp.exec:\pdvpp.exe157⤵PID:3664
-
\??\c:\xflllrr.exec:\xflllrr.exe158⤵PID:2652
-
\??\c:\hhttbh.exec:\hhttbh.exe159⤵PID:868
-
\??\c:\nhbtnn.exec:\nhbtnn.exe160⤵PID:1740
-
\??\c:\vjppv.exec:\vjppv.exe161⤵PID:3536
-
\??\c:\xrxrlll.exec:\xrxrlll.exe162⤵PID:1708
-
\??\c:\hbbtnn.exec:\hbbtnn.exe163⤵PID:2932
-
\??\c:\thhbtn.exec:\thhbtn.exe164⤵PID:5108
-
\??\c:\3jvpj.exec:\3jvpj.exe165⤵PID:4788
-
\??\c:\7vpjd.exec:\7vpjd.exe166⤵PID:1972
-
\??\c:\xxfxxrf.exec:\xxfxxrf.exe167⤵PID:3476
-
\??\c:\rxrlfff.exec:\rxrlfff.exe168⤵PID:2624
-
\??\c:\hhnhbb.exec:\hhnhbb.exe169⤵PID:744
-
\??\c:\pjvvp.exec:\pjvvp.exe170⤵PID:4908
-
\??\c:\vvdjd.exec:\vvdjd.exe171⤵PID:3524
-
\??\c:\7llfxrr.exec:\7llfxrr.exe172⤵PID:2800
-
\??\c:\1ffrlxx.exec:\1ffrlxx.exe173⤵PID:1428
-
\??\c:\htbbtt.exec:\htbbtt.exe174⤵PID:1400
-
\??\c:\btttnn.exec:\btttnn.exe175⤵PID:2616
-
\??\c:\pjjdp.exec:\pjjdp.exe176⤵PID:4516
-
\??\c:\rlrrfff.exec:\rlrrfff.exe177⤵PID:2868
-
\??\c:\htttnn.exec:\htttnn.exe178⤵PID:1372
-
\??\c:\bttnhh.exec:\bttnhh.exe179⤵PID:1544
-
\??\c:\jvjdp.exec:\jvjdp.exe180⤵PID:2152
-
\??\c:\vdjdp.exec:\vdjdp.exe181⤵PID:2444
-
\??\c:\llllxxx.exec:\llllxxx.exe182⤵PID:4200
-
\??\c:\nbtnhb.exec:\nbtnhb.exe183⤵PID:3920
-
\??\c:\bthbhh.exec:\bthbhh.exe184⤵PID:3376
-
\??\c:\1dddd.exec:\1dddd.exe185⤵PID:1076
-
\??\c:\7jjjv.exec:\7jjjv.exe186⤵PID:5064
-
\??\c:\fffxrll.exec:\fffxrll.exe187⤵PID:3308
-
\??\c:\lfllfrl.exec:\lfllfrl.exe188⤵PID:2228
-
\??\c:\9tnhhh.exec:\9tnhhh.exe189⤵PID:4664
-
\??\c:\bnnnbt.exec:\bnnnbt.exe190⤵PID:2480
-
\??\c:\vjjjd.exec:\vjjjd.exe191⤵PID:4604
-
\??\c:\7rlfxxr.exec:\7rlfxxr.exe192⤵PID:1896
-
\??\c:\3tbbbb.exec:\3tbbbb.exe193⤵PID:1300
-
\??\c:\tthbbb.exec:\tthbbb.exe194⤵PID:4428
-
\??\c:\jvjjj.exec:\jvjjj.exe195⤵PID:1312
-
\??\c:\vvvpd.exec:\vvvpd.exe196⤵PID:4696
-
\??\c:\rxlfrrr.exec:\rxlfrrr.exe197⤵PID:1216
-
\??\c:\7rrlfrl.exec:\7rrlfrl.exe198⤵PID:4388
-
\??\c:\nhhbbb.exec:\nhhbbb.exe199⤵PID:2104
-
\??\c:\bnnhbb.exec:\bnnhbb.exe200⤵PID:2672
-
\??\c:\bnnhtt.exec:\bnnhtt.exe201⤵PID:4384
-
\??\c:\9pvpj.exec:\9pvpj.exe202⤵PID:1480
-
\??\c:\7vvpd.exec:\7vvpd.exe203⤵PID:1124
-
\??\c:\7lxrrrx.exec:\7lxrrrx.exe204⤵PID:2484
-
\??\c:\lfrrlll.exec:\lfrrlll.exe205⤵PID:372
-
\??\c:\hbhbbb.exec:\hbhbbb.exe206⤵PID:3816
-
\??\c:\bbnnhh.exec:\bbnnhh.exe207⤵PID:3600
-
\??\c:\hbbbtt.exec:\hbbbtt.exe208⤵PID:2844
-
\??\c:\3ppjd.exec:\3ppjd.exe209⤵PID:3896
-
\??\c:\jvvvp.exec:\jvvvp.exe210⤵PID:4552
-
\??\c:\xxfxrrx.exec:\xxfxrrx.exe211⤵PID:1192
-
\??\c:\rlrrfrr.exec:\rlrrfrr.exe212⤵PID:1644
-
\??\c:\htttnn.exec:\htttnn.exe213⤵PID:4324
-
\??\c:\9tbbbb.exec:\9tbbbb.exe214⤵PID:2448
-
\??\c:\tthbhn.exec:\tthbhn.exe215⤵PID:4652
-
\??\c:\vvddd.exec:\vvddd.exe216⤵PID:2980
-
\??\c:\htbbtn.exec:\htbbtn.exe217⤵PID:4844
-
\??\c:\rfffrxr.exec:\rfffrxr.exe218⤵PID:5072
-
\??\c:\tnhbbb.exec:\tnhbbb.exe219⤵PID:1476
-
\??\c:\pddvj.exec:\pddvj.exe220⤵PID:624
-
\??\c:\7rrxllr.exec:\7rrxllr.exe221⤵PID:3460
-
\??\c:\fxllllf.exec:\fxllllf.exe222⤵PID:1988
-
\??\c:\nhbhhh.exec:\nhbhhh.exe223⤵PID:3580
-
\??\c:\bnnnnt.exec:\bnnnnt.exe224⤵PID:2004
-
\??\c:\dvvpj.exec:\dvvpj.exe225⤵PID:3512
-
\??\c:\vpddd.exec:\vpddd.exe226⤵PID:3772
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe227⤵PID:3044
-
\??\c:\hhhhnn.exec:\hhhhnn.exe228⤵PID:5048
-
\??\c:\tnnhbb.exec:\tnnhbb.exe229⤵PID:1424
-
\??\c:\9pvjd.exec:\9pvjd.exe230⤵PID:3980
-
\??\c:\fffxrfr.exec:\fffxrfr.exe231⤵PID:1672
-
\??\c:\rrflxlx.exec:\rrflxlx.exe232⤵PID:4592
-
\??\c:\tbbbbt.exec:\tbbbbt.exe233⤵PID:2376
-
\??\c:\9bbtnn.exec:\9bbtnn.exe234⤵PID:944
-
\??\c:\3vddv.exec:\3vddv.exe235⤵PID:1580
-
\??\c:\9vvpd.exec:\9vvpd.exe236⤵PID:2296
-
\??\c:\frllxlr.exec:\frllxlr.exe237⤵PID:4328
-
\??\c:\rllxrrr.exec:\rllxrrr.exe238⤵PID:2184
-
\??\c:\bnnnhh.exec:\bnnnhh.exe239⤵PID:5100
-
\??\c:\9tbtth.exec:\9tbtth.exe240⤵PID:3548
-
\??\c:\dddjd.exec:\dddjd.exe241⤵PID:2920
-