Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 23:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe
-
Size
244KB
-
MD5
2963ed62e8506848012aeca7bbb9b4b0
-
SHA1
336f5346d76edbae51577b72b11386348335328d
-
SHA256
bc671f9b02fc13da178dda77874e283d4804c0380a733d4ed984c8c6a970a98c
-
SHA512
a405ff885a9ed5a27c299a787713c9156f043af57381a78eadff29f8c088ec9d78d5aca4e433eea631b9204bb256835132dad76be4e9b0eb71f3de2082a8ca62
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFRX:n3C9uD6AUDCa4NYmRX
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/2668-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/424-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6064-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5380-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5380-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5232-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5264-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2092-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6136-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5428-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3444-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3760-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5588-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5936-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5772-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5136-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6108-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5vjdj.exejppdv.exebtnhtt.exe3xxrlfl.exe7hbttt.exejvvdv.exexlxlffx.exe7bbttt.exepjppj.exexrrlffr.exenntnhb.exe7bnhtt.exe3pppd.exefxfxffx.exe9nhnhh.exefflrxlx.exexflrrfr.exedvjdj.exeddjdd.exennnhtt.exethbttt.exejvdvp.exehthbnn.exedppjj.exexxflfll.exetttnnn.exejjppj.exe9rxrrlr.exe3ttbht.exe3vjdd.exerllrlrf.exehtthtn.exevpjvj.exepjjdd.exeffrrffr.exennttbn.exevjdvp.exexrrfrrf.exe1rlfrrx.exethnhbb.exe1pjvp.exelffrlfx.exe5lfxllf.exehntnnb.exedjjdv.exe5lrlfff.exerlfrlfx.exebhbthb.exedddvp.exelfxrfxr.exetbhttn.exejdpjd.exelxrrrxl.exe1xlflfl.exennhnbn.exenhnhtt.exevjdvd.exefxflxxf.exehhntnh.exe7bnbhb.exe7jjdv.exe1hnhbh.exepvvvp.exerffxlfx.exepid process 424 5vjdj.exe 6064 jppdv.exe 3044 btnhtt.exe 5380 3xxrlfl.exe 5232 7hbttt.exe 5264 jvvdv.exe 2092 xlxlffx.exe 60 7bbttt.exe 6136 pjppj.exe 5684 xrrlffr.exe 5428 nntnhb.exe 1168 7bnhtt.exe 3444 3pppd.exe 2080 fxfxffx.exe 3760 9nhnhh.exe 464 fflrxlx.exe 5836 xflrrfr.exe 5940 dvjdj.exe 4132 ddjdd.exe 5008 nnnhtt.exe 864 thbttt.exe 5588 jvdvp.exe 2416 hthbnn.exe 5936 dppjj.exe 3128 xxflfll.exe 4412 tttnnn.exe 5772 jjppj.exe 5116 9rxrrlr.exe 5136 3ttbht.exe 2340 3vjdd.exe 6108 rllrlrf.exe 1804 htthtn.exe 6112 vpjvj.exe 1148 pjjdd.exe 5064 ffrrffr.exe 2568 nnttbn.exe 4904 vjdvp.exe 1724 xrrfrrf.exe 2552 1rlfrrx.exe 3280 thnhbb.exe 4548 1pjvp.exe 768 lffrlfx.exe 3520 5lfxllf.exe 4608 hntnnb.exe 5080 djjdv.exe 1728 5lrlfff.exe 2912 rlfrlfx.exe 2988 bhbthb.exe 2936 dddvp.exe 1132 lfxrfxr.exe 3692 tbhttn.exe 1624 jdpjd.exe 2300 lxrrrxl.exe 5036 1xlflfl.exe 5472 nnhnbn.exe 2760 nhnhtt.exe 1472 vjdvd.exe 5328 fxflxxf.exe 5768 hhntnh.exe 5568 7bnbhb.exe 2976 7jjdv.exe 6092 1hnhbh.exe 2580 pvvvp.exe 1956 rffxlfx.exe -
Processes:
resource yara_rule behavioral2/memory/2668-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/424-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6064-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5380-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5380-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5232-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5264-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6136-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5428-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3760-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5588-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5936-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5772-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5136-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6108-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe5vjdj.exejppdv.exebtnhtt.exe3xxrlfl.exe7hbttt.exejvvdv.exexlxlffx.exe7bbttt.exepjppj.exexrrlffr.exenntnhb.exe7bnhtt.exe3pppd.exefxfxffx.exe9nhnhh.exefflrxlx.exexflrrfr.exedvjdj.exeddjdd.exennnhtt.exethbttt.exedescription pid process target process PID 2668 wrote to memory of 424 2668 2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe 5vjdj.exe PID 2668 wrote to memory of 424 2668 2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe 5vjdj.exe PID 2668 wrote to memory of 424 2668 2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe 5vjdj.exe PID 424 wrote to memory of 6064 424 5vjdj.exe jppdv.exe PID 424 wrote to memory of 6064 424 5vjdj.exe jppdv.exe PID 424 wrote to memory of 6064 424 5vjdj.exe jppdv.exe PID 6064 wrote to memory of 3044 6064 jppdv.exe btnhtt.exe PID 6064 wrote to memory of 3044 6064 jppdv.exe btnhtt.exe PID 6064 wrote to memory of 3044 6064 jppdv.exe btnhtt.exe PID 3044 wrote to memory of 5380 3044 btnhtt.exe 3xxrlfl.exe PID 3044 wrote to memory of 5380 3044 btnhtt.exe 3xxrlfl.exe PID 3044 wrote to memory of 5380 3044 btnhtt.exe 3xxrlfl.exe PID 5380 wrote to memory of 5232 5380 3xxrlfl.exe 7hbttt.exe PID 5380 wrote to memory of 5232 5380 3xxrlfl.exe 7hbttt.exe PID 5380 wrote to memory of 5232 5380 3xxrlfl.exe 7hbttt.exe PID 5232 wrote to memory of 5264 5232 7hbttt.exe jvvdv.exe PID 5232 wrote to memory of 5264 5232 7hbttt.exe jvvdv.exe PID 5232 wrote to memory of 5264 5232 7hbttt.exe jvvdv.exe PID 5264 wrote to memory of 2092 5264 jvvdv.exe xlxlffx.exe PID 5264 wrote to memory of 2092 5264 jvvdv.exe xlxlffx.exe PID 5264 wrote to memory of 2092 5264 jvvdv.exe xlxlffx.exe PID 2092 wrote to memory of 60 2092 xlxlffx.exe 7bbttt.exe PID 2092 wrote to memory of 60 2092 xlxlffx.exe 7bbttt.exe PID 2092 wrote to memory of 60 2092 xlxlffx.exe 7bbttt.exe PID 60 wrote to memory of 6136 60 7bbttt.exe pjppj.exe PID 60 wrote to memory of 6136 60 7bbttt.exe pjppj.exe PID 60 wrote to memory of 6136 60 7bbttt.exe pjppj.exe PID 6136 wrote to memory of 5684 6136 pjppj.exe xrrlffr.exe PID 6136 wrote to memory of 5684 6136 pjppj.exe xrrlffr.exe PID 6136 wrote to memory of 5684 6136 pjppj.exe xrrlffr.exe PID 5684 wrote to memory of 5428 5684 xrrlffr.exe nntnhb.exe PID 5684 wrote to memory of 5428 5684 xrrlffr.exe nntnhb.exe PID 5684 wrote to memory of 5428 5684 xrrlffr.exe nntnhb.exe PID 5428 wrote to memory of 1168 5428 nntnhb.exe 7bnhtt.exe PID 5428 wrote to memory of 1168 5428 nntnhb.exe 7bnhtt.exe PID 5428 wrote to memory of 1168 5428 nntnhb.exe 7bnhtt.exe PID 1168 wrote to memory of 3444 1168 7bnhtt.exe 3pppd.exe PID 1168 wrote to memory of 3444 1168 7bnhtt.exe 3pppd.exe PID 1168 wrote to memory of 3444 1168 7bnhtt.exe 3pppd.exe PID 3444 wrote to memory of 2080 3444 3pppd.exe fxfxffx.exe PID 3444 wrote to memory of 2080 3444 3pppd.exe fxfxffx.exe PID 3444 wrote to memory of 2080 3444 3pppd.exe fxfxffx.exe PID 2080 wrote to memory of 3760 2080 fxfxffx.exe 9nhnhh.exe PID 2080 wrote to memory of 3760 2080 fxfxffx.exe 9nhnhh.exe PID 2080 wrote to memory of 3760 2080 fxfxffx.exe 9nhnhh.exe PID 3760 wrote to memory of 464 3760 9nhnhh.exe fflrxlx.exe PID 3760 wrote to memory of 464 3760 9nhnhh.exe fflrxlx.exe PID 3760 wrote to memory of 464 3760 9nhnhh.exe fflrxlx.exe PID 464 wrote to memory of 5836 464 fflrxlx.exe xflrrfr.exe PID 464 wrote to memory of 5836 464 fflrxlx.exe xflrrfr.exe PID 464 wrote to memory of 5836 464 fflrxlx.exe xflrrfr.exe PID 5836 wrote to memory of 5940 5836 xflrrfr.exe dvjdj.exe PID 5836 wrote to memory of 5940 5836 xflrrfr.exe dvjdj.exe PID 5836 wrote to memory of 5940 5836 xflrrfr.exe dvjdj.exe PID 5940 wrote to memory of 4132 5940 dvjdj.exe ddjdd.exe PID 5940 wrote to memory of 4132 5940 dvjdj.exe ddjdd.exe PID 5940 wrote to memory of 4132 5940 dvjdj.exe ddjdd.exe PID 4132 wrote to memory of 5008 4132 ddjdd.exe nnnhtt.exe PID 4132 wrote to memory of 5008 4132 ddjdd.exe nnnhtt.exe PID 4132 wrote to memory of 5008 4132 ddjdd.exe nnnhtt.exe PID 5008 wrote to memory of 864 5008 nnnhtt.exe thbttt.exe PID 5008 wrote to memory of 864 5008 nnnhtt.exe thbttt.exe PID 5008 wrote to memory of 864 5008 nnnhtt.exe thbttt.exe PID 864 wrote to memory of 5588 864 thbttt.exe jvdvp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\5vjdj.exec:\5vjdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
\??\c:\jppdv.exec:\jppdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
\??\c:\btnhtt.exec:\btnhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\3xxrlfl.exec:\3xxrlfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
\??\c:\7hbttt.exec:\7hbttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
\??\c:\jvvdv.exec:\jvvdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5264 -
\??\c:\xlxlffx.exec:\xlxlffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\7bbttt.exec:\7bbttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\pjppj.exec:\pjppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
\??\c:\xrrlffr.exec:\xrrlffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
\??\c:\nntnhb.exec:\nntnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
\??\c:\7bnhtt.exec:\7bnhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\3pppd.exec:\3pppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\fxfxffx.exec:\fxfxffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\9nhnhh.exec:\9nhnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\fflrxlx.exec:\fflrxlx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\xflrrfr.exec:\xflrrfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
\??\c:\dvjdj.exec:\dvjdj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
\??\c:\ddjdd.exec:\ddjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\nnnhtt.exec:\nnnhtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\thbttt.exec:\thbttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\jvdvp.exec:\jvdvp.exe23⤵
- Executes dropped EXE
PID:5588 -
\??\c:\hthbnn.exec:\hthbnn.exe24⤵
- Executes dropped EXE
PID:2416 -
\??\c:\dppjj.exec:\dppjj.exe25⤵
- Executes dropped EXE
PID:5936 -
\??\c:\xxflfll.exec:\xxflfll.exe26⤵
- Executes dropped EXE
PID:3128 -
\??\c:\tttnnn.exec:\tttnnn.exe27⤵
- Executes dropped EXE
PID:4412 -
\??\c:\jjppj.exec:\jjppj.exe28⤵
- Executes dropped EXE
PID:5772 -
\??\c:\9rxrrlr.exec:\9rxrrlr.exe29⤵
- Executes dropped EXE
PID:5116 -
\??\c:\3ttbht.exec:\3ttbht.exe30⤵
- Executes dropped EXE
PID:5136 -
\??\c:\3vjdd.exec:\3vjdd.exe31⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rllrlrf.exec:\rllrlrf.exe32⤵
- Executes dropped EXE
PID:6108 -
\??\c:\htthtn.exec:\htthtn.exe33⤵
- Executes dropped EXE
PID:1804 -
\??\c:\vpjvj.exec:\vpjvj.exe34⤵
- Executes dropped EXE
PID:6112 -
\??\c:\pjjdd.exec:\pjjdd.exe35⤵
- Executes dropped EXE
PID:1148 -
\??\c:\ffrrffr.exec:\ffrrffr.exe36⤵
- Executes dropped EXE
PID:5064 -
\??\c:\nnttbn.exec:\nnttbn.exe37⤵
- Executes dropped EXE
PID:2568 -
\??\c:\vjdvp.exec:\vjdvp.exe38⤵
- Executes dropped EXE
PID:4904 -
\??\c:\xrrfrrf.exec:\xrrfrrf.exe39⤵
- Executes dropped EXE
PID:1724 -
\??\c:\1rlfrrx.exec:\1rlfrrx.exe40⤵
- Executes dropped EXE
PID:2552 -
\??\c:\thnhbb.exec:\thnhbb.exe41⤵
- Executes dropped EXE
PID:3280 -
\??\c:\1pjvp.exec:\1pjvp.exe42⤵
- Executes dropped EXE
PID:4548 -
\??\c:\lffrlfx.exec:\lffrlfx.exe43⤵
- Executes dropped EXE
PID:768 -
\??\c:\5lfxllf.exec:\5lfxllf.exe44⤵
- Executes dropped EXE
PID:3520 -
\??\c:\hntnnb.exec:\hntnnb.exe45⤵
- Executes dropped EXE
PID:4608 -
\??\c:\djjdv.exec:\djjdv.exe46⤵
- Executes dropped EXE
PID:5080 -
\??\c:\5lrlfff.exec:\5lrlfff.exe47⤵
- Executes dropped EXE
PID:1728 -
\??\c:\rlfrlfx.exec:\rlfrlfx.exe48⤵
- Executes dropped EXE
PID:2912 -
\??\c:\bhbthb.exec:\bhbthb.exe49⤵
- Executes dropped EXE
PID:2988 -
\??\c:\dddvp.exec:\dddvp.exe50⤵
- Executes dropped EXE
PID:2936 -
\??\c:\lfxrfxr.exec:\lfxrfxr.exe51⤵
- Executes dropped EXE
PID:1132 -
\??\c:\tbhttn.exec:\tbhttn.exe52⤵
- Executes dropped EXE
PID:3692 -
\??\c:\jdpjd.exec:\jdpjd.exe53⤵
- Executes dropped EXE
PID:1624 -
\??\c:\lxrrrxl.exec:\lxrrrxl.exe54⤵
- Executes dropped EXE
PID:2300 -
\??\c:\1xlflfl.exec:\1xlflfl.exe55⤵
- Executes dropped EXE
PID:5036 -
\??\c:\nnhnbn.exec:\nnhnbn.exe56⤵
- Executes dropped EXE
PID:5472 -
\??\c:\nhnhtt.exec:\nhnhtt.exe57⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vjdvd.exec:\vjdvd.exe58⤵
- Executes dropped EXE
PID:1472 -
\??\c:\fxflxxf.exec:\fxflxxf.exe59⤵
- Executes dropped EXE
PID:5328 -
\??\c:\hhntnh.exec:\hhntnh.exe60⤵
- Executes dropped EXE
PID:5768 -
\??\c:\7bnbhb.exec:\7bnbhb.exe61⤵
- Executes dropped EXE
PID:5568 -
\??\c:\7jjdv.exec:\7jjdv.exe62⤵
- Executes dropped EXE
PID:2976 -
\??\c:\1hnhbh.exec:\1hnhbh.exe63⤵
- Executes dropped EXE
PID:6092 -
\??\c:\pvvvp.exec:\pvvvp.exe64⤵
- Executes dropped EXE
PID:2580 -
\??\c:\rffxlfx.exec:\rffxlfx.exe65⤵
- Executes dropped EXE
PID:1956 -
\??\c:\tnbbtt.exec:\tnbbtt.exe66⤵PID:216
-
\??\c:\vjjdp.exec:\vjjdp.exe67⤵PID:4492
-
\??\c:\9vvvp.exec:\9vvvp.exe68⤵PID:4212
-
\??\c:\ttbbtb.exec:\ttbbtb.exe69⤵PID:1172
-
\??\c:\7hbtnn.exec:\7hbtnn.exe70⤵PID:6064
-
\??\c:\ddppd.exec:\ddppd.exe71⤵PID:1524
-
\??\c:\rflxrll.exec:\rflxrll.exe72⤵PID:1512
-
\??\c:\rrxlfxx.exec:\rrxlfxx.exe73⤵PID:3124
-
\??\c:\nbhtht.exec:\nbhtht.exe74⤵PID:1972
-
\??\c:\dvpjv.exec:\dvpjv.exe75⤵PID:884
-
\??\c:\7dvjv.exec:\7dvjv.exe76⤵PID:4228
-
\??\c:\rllfllf.exec:\rllfllf.exe77⤵PID:4944
-
\??\c:\thhbtt.exec:\thhbtt.exe78⤵PID:1640
-
\??\c:\ttnnbt.exec:\ttnnbt.exe79⤵PID:5856
-
\??\c:\vjjjd.exec:\vjjjd.exe80⤵PID:5196
-
\??\c:\5ppjd.exec:\5ppjd.exe81⤵PID:5364
-
\??\c:\rrxxxfx.exec:\rrxxxfx.exe82⤵PID:4688
-
\??\c:\bntnbb.exec:\bntnbb.exe83⤵PID:5428
-
\??\c:\ddjdd.exec:\ddjdd.exe84⤵PID:5624
-
\??\c:\9jppj.exec:\9jppj.exe85⤵PID:740
-
\??\c:\xflfrrl.exec:\xflfrrl.exe86⤵PID:428
-
\??\c:\btbtnh.exec:\btbtnh.exe87⤵PID:4300
-
\??\c:\vjpdp.exec:\vjpdp.exe88⤵PID:5012
-
\??\c:\ppvpj.exec:\ppvpj.exe89⤵PID:404
-
\??\c:\rfrrffx.exec:\rfrrffx.exe90⤵PID:5164
-
\??\c:\nbbhtt.exec:\nbbhtt.exe91⤵PID:5004
-
\??\c:\vjvjp.exec:\vjvjp.exe92⤵PID:716
-
\??\c:\ffxrxrx.exec:\ffxrxrx.exe93⤵PID:5644
-
\??\c:\lfflflf.exec:\lfflflf.exe94⤵PID:2104
-
\??\c:\bbhbnh.exec:\bbhbnh.exe95⤵PID:5660
-
\??\c:\5jvvp.exec:\5jvvp.exe96⤵PID:5796
-
\??\c:\lfxrlff.exec:\lfxrlff.exe97⤵PID:4544
-
\??\c:\xflfffr.exec:\xflfffr.exe98⤵PID:2108
-
\??\c:\nbbnhh.exec:\nbbnhh.exe99⤵PID:5260
-
\??\c:\ntthtn.exec:\ntthtn.exe100⤵PID:3764
-
\??\c:\thtnbb.exec:\thtnbb.exe101⤵PID:5488
-
\??\c:\jvdvp.exec:\jvdvp.exe102⤵PID:5356
-
\??\c:\ddjjd.exec:\ddjjd.exe103⤵PID:944
-
\??\c:\lrrrlrf.exec:\lrrrlrf.exe104⤵PID:4004
-
\??\c:\nbbnhb.exec:\nbbnhb.exe105⤵PID:688
-
\??\c:\hbtbhb.exec:\hbtbhb.exe106⤵PID:1888
-
\??\c:\jvdjp.exec:\jvdjp.exe107⤵PID:2820
-
\??\c:\vvjjj.exec:\vvjjj.exe108⤵PID:4908
-
\??\c:\llfxrxl.exec:\llfxrxl.exe109⤵PID:5868
-
\??\c:\hhtbhn.exec:\hhtbhn.exe110⤵PID:5712
-
\??\c:\jpddv.exec:\jpddv.exe111⤵PID:2172
-
\??\c:\rflxffr.exec:\rflxffr.exe112⤵PID:5280
-
\??\c:\htthtn.exec:\htthtn.exe113⤵PID:4016
-
\??\c:\vppjd.exec:\vppjd.exe114⤵PID:768
-
\??\c:\djjdp.exec:\djjdp.exe115⤵PID:3520
-
\??\c:\lxfxrll.exec:\lxfxrll.exe116⤵PID:4608
-
\??\c:\9bbtnh.exec:\9bbtnh.exe117⤵PID:4088
-
\??\c:\nbbnbn.exec:\nbbnbn.exe118⤵PID:1728
-
\??\c:\jdvjv.exec:\jdvjv.exe119⤵PID:3712
-
\??\c:\vjjpp.exec:\vjjpp.exe120⤵PID:744
-
\??\c:\lxfrrll.exec:\lxfrrll.exe121⤵PID:4960
-
\??\c:\thhbnh.exec:\thhbnh.exe122⤵PID:1504
-
\??\c:\bhtbht.exec:\bhtbht.exe123⤵PID:3420
-
\??\c:\1pjvj.exec:\1pjvj.exe124⤵PID:4852
-
\??\c:\xrxlxrf.exec:\xrxlxrf.exe125⤵PID:5716
-
\??\c:\flrlfxr.exec:\flrlfxr.exe126⤵PID:5600
-
\??\c:\bhtnhh.exec:\bhtnhh.exe127⤵PID:4656
-
\??\c:\jppvj.exec:\jppvj.exe128⤵PID:4344
-
\??\c:\jpdjj.exec:\jpdjj.exe129⤵PID:2072
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe130⤵PID:2236
-
\??\c:\nbnnnt.exec:\nbnnnt.exe131⤵PID:508
-
\??\c:\pjppj.exec:\pjppj.exe132⤵PID:1936
-
\??\c:\dpdjj.exec:\dpdjj.exe133⤵PID:3464
-
\??\c:\xxxrfxr.exec:\xxxrfxr.exe134⤵PID:4040
-
\??\c:\bttnnh.exec:\bttnnh.exe135⤵PID:760
-
\??\c:\bhnhbb.exec:\bhnhbb.exe136⤵PID:212
-
\??\c:\dpdvj.exec:\dpdvj.exe137⤵PID:4484
-
\??\c:\hbbnbn.exec:\hbbnbn.exe138⤵PID:4044
-
\??\c:\3vdpd.exec:\3vdpd.exe139⤵PID:5368
-
\??\c:\pjjpp.exec:\pjjpp.exe140⤵PID:2064
-
\??\c:\fxxfrrl.exec:\fxxfrrl.exe141⤵PID:3980
-
\??\c:\thtthh.exec:\thtthh.exe142⤵PID:1108
-
\??\c:\5jdvp.exec:\5jdvp.exe143⤵PID:3260
-
\??\c:\vdjdp.exec:\vdjdp.exe144⤵PID:3772
-
\??\c:\xffrfxf.exec:\xffrfxf.exe145⤵PID:1928
-
\??\c:\frfxfxr.exec:\frfxfxr.exe146⤵PID:6084
-
\??\c:\bhhtht.exec:\bhhtht.exe147⤵PID:3052
-
\??\c:\pdjvp.exec:\pdjvp.exe148⤵PID:5452
-
\??\c:\3rxlfxl.exec:\3rxlfxl.exe149⤵PID:5708
-
\??\c:\frxxrxx.exec:\frxxrxx.exe150⤵PID:4756
-
\??\c:\httnhb.exec:\httnhb.exe151⤵PID:1932
-
\??\c:\dpdjj.exec:\dpdjj.exe152⤵PID:1992
-
\??\c:\ffffxxx.exec:\ffffxxx.exe153⤵PID:1044
-
\??\c:\ntnhbt.exec:\ntnhbt.exe154⤵PID:4816
-
\??\c:\vvddd.exec:\vvddd.exe155⤵PID:4032
-
\??\c:\9xxrrxr.exec:\9xxrrxr.exe156⤵PID:648
-
\??\c:\nhhbhh.exec:\nhhbhh.exe157⤵PID:5276
-
\??\c:\1dvdv.exec:\1dvdv.exe158⤵PID:4696
-
\??\c:\dpddv.exec:\dpddv.exe159⤵PID:3268
-
\??\c:\fxlfffl.exec:\fxlfffl.exe160⤵PID:1212
-
\??\c:\nhnhbn.exec:\nhnhbn.exe161⤵PID:4716
-
\??\c:\thhnbn.exec:\thhnbn.exe162⤵PID:2248
-
\??\c:\dddvp.exec:\dddvp.exe163⤵PID:3640
-
\??\c:\llflrxx.exec:\llflrxx.exe164⤵PID:5820
-
\??\c:\tbnhbt.exec:\tbnhbt.exe165⤵PID:5344
-
\??\c:\bnbtnh.exec:\bnbtnh.exe166⤵PID:4664
-
\??\c:\jjjdv.exec:\jjjdv.exe167⤵PID:5260
-
\??\c:\5xrfrll.exec:\5xrfrll.exe168⤵PID:3764
-
\??\c:\lfxfxxr.exec:\lfxfxxr.exe169⤵PID:5488
-
\??\c:\tbbbtt.exec:\tbbbtt.exe170⤵PID:1988
-
\??\c:\jjjdp.exec:\jjjdp.exe171⤵PID:3204
-
\??\c:\jvddd.exec:\jvddd.exe172⤵PID:2460
-
\??\c:\1llfxxr.exec:\1llfxxr.exe173⤵PID:4428
-
\??\c:\lfxrllf.exec:\lfxrllf.exe174⤵PID:2656
-
\??\c:\nbnhht.exec:\nbnhht.exe175⤵PID:2996
-
\??\c:\pddvp.exec:\pddvp.exe176⤵PID:2892
-
\??\c:\jjpdp.exec:\jjpdp.exe177⤵PID:4580
-
\??\c:\5frfllf.exec:\5frfllf.exe178⤵PID:3040
-
\??\c:\tnthth.exec:\tnthth.exe179⤵PID:536
-
\??\c:\7hnbhb.exec:\7hnbhb.exe180⤵PID:5080
-
\??\c:\ppvjd.exec:\ppvjd.exe181⤵PID:3712
-
\??\c:\rlxfrfr.exec:\rlxfrfr.exe182⤵PID:2008
-
\??\c:\nhnhnn.exec:\nhnhnn.exe183⤵PID:4188
-
\??\c:\hthhhb.exec:\hthhhb.exe184⤵PID:1184
-
\??\c:\ppvpd.exec:\ppvpd.exe185⤵PID:1624
-
\??\c:\xrxlrlf.exec:\xrxlrlf.exe186⤵PID:1252
-
\??\c:\fxfflrr.exec:\fxfflrr.exe187⤵PID:5036
-
\??\c:\1thhnt.exec:\1thhnt.exe188⤵PID:5600
-
\??\c:\vdjvp.exec:\vdjvp.exe189⤵PID:1864
-
\??\c:\7xxrllf.exec:\7xxrllf.exe190⤵PID:4344
-
\??\c:\9thtbb.exec:\9thtbb.exe191⤵PID:5768
-
\??\c:\hbnntb.exec:\hbnntb.exe192⤵PID:2236
-
\??\c:\jvddv.exec:\jvddv.exe193⤵PID:508
-
\??\c:\llrfxlf.exec:\llrfxlf.exe194⤵PID:2232
-
\??\c:\lfffffr.exec:\lfffffr.exe195⤵PID:228
-
\??\c:\bnhnbb.exec:\bnhnbb.exe196⤵PID:1492
-
\??\c:\dddvp.exec:\dddvp.exe197⤵PID:212
-
\??\c:\ffllllf.exec:\ffllllf.exe198⤵PID:4484
-
\??\c:\3hhtnh.exec:\3hhtnh.exe199⤵PID:1508
-
\??\c:\bntnhh.exec:\bntnhh.exe200⤵PID:4948
-
\??\c:\jdpdv.exec:\jdpdv.exe201⤵PID:1524
-
\??\c:\vpdpd.exec:\vpdpd.exe202⤵PID:1512
-
\??\c:\rlxlrlx.exec:\rlxlrlx.exe203⤵PID:2224
-
\??\c:\ntbbnh.exec:\ntbbnh.exe204⤵PID:5348
-
\??\c:\vjdvv.exec:\vjdvv.exe205⤵PID:4512
-
\??\c:\rlxrfrl.exec:\rlxrfrl.exe206⤵PID:1236
-
\??\c:\nbhbtt.exec:\nbhbtt.exe207⤵PID:5608
-
\??\c:\9pvpv.exec:\9pvpv.exe208⤵PID:5844
-
\??\c:\vvjjv.exec:\vvjjv.exe209⤵PID:5684
-
\??\c:\xlxrlxx.exec:\xlxrlxx.exe210⤵PID:5364
-
\??\c:\3bhtbh.exec:\3bhtbh.exe211⤵PID:5424
-
\??\c:\hhhbnh.exec:\hhhbnh.exe212⤵PID:3632
-
\??\c:\vpvpp.exec:\vpvpp.exe213⤵PID:3224
-
\??\c:\rxxrffx.exec:\rxxrffx.exe214⤵PID:428
-
\??\c:\jvvdv.exec:\jvvdv.exe215⤵PID:464
-
\??\c:\fffxxrl.exec:\fffxxrl.exe216⤵PID:5288
-
\??\c:\5ntntt.exec:\5ntntt.exe217⤵PID:2020
-
\??\c:\htthtn.exec:\htthtn.exe218⤵PID:4772
-
\??\c:\dvjpj.exec:\dvjpj.exe219⤵PID:864
-
\??\c:\jvvpd.exec:\jvvpd.exe220⤵PID:964
-
\??\c:\5fxlxxr.exec:\5fxlxxr.exe221⤵PID:2452
-
\??\c:\bntthn.exec:\bntthn.exe222⤵PID:5336
-
\??\c:\jdpvd.exec:\jdpvd.exe223⤵PID:3740
-
\??\c:\jdpjv.exec:\jdpjv.exe224⤵PID:804
-
\??\c:\lxrfxrr.exec:\lxrfxrr.exe225⤵PID:3380
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe226⤵PID:5628
-
\??\c:\nbhtbb.exec:\nbhtbb.exe227⤵PID:5696
-
\??\c:\dpjdp.exec:\dpjdp.exe228⤵PID:4932
-
\??\c:\rllfxxr.exec:\rllfxxr.exe229⤵PID:4064
-
\??\c:\7thbtb.exec:\7thbtb.exe230⤵PID:2340
-
\??\c:\nnnhbb.exec:\nnnhbb.exe231⤵PID:1844
-
\??\c:\pddvp.exec:\pddvp.exe232⤵PID:1804
-
\??\c:\dvjjj.exec:\dvjjj.exe233⤵PID:2968
-
\??\c:\rrlflrr.exec:\rrlflrr.exe234⤵PID:5044
-
\??\c:\nhnbhb.exec:\nhnbhb.exe235⤵PID:2296
-
\??\c:\ddddv.exec:\ddddv.exe236⤵PID:4904
-
\??\c:\xflffxr.exec:\xflffxr.exe237⤵PID:3972
-
\??\c:\rlfflxr.exec:\rlfflxr.exe238⤵PID:3696
-
\??\c:\7hhttb.exec:\7hhttb.exe239⤵PID:2680
-
\??\c:\1jjjp.exec:\1jjjp.exe240⤵PID:3040
-
\??\c:\1fxxrrl.exec:\1fxxrrl.exe241⤵PID:3520
-
\??\c:\1llfxxr.exec:\1llfxxr.exe242⤵PID:4088