Analysis
-
max time kernel
142s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe
-
Size
95KB
-
MD5
4d88a72974b14e91ddc32395ac2d1aa0
-
SHA1
20de311c0c078372f1e1dcc81e4f57f06a0385bc
-
SHA256
fa01885804d6bec09be3d4102951ef487b6fdfe83a1a166c0dc2bc6d2956ba0c
-
SHA512
d98bff9325391cf3369a5992a4e5805a8f91211fb396ac958a2cd46d4b649e2094256a07e9659662ca2817592ed0a7adb1b593403f3cee8a77bb94dd2cb1ecf0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTQk:ymb3NkkiQ3mdBjFIj+qNhvZuHQY0k
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral1/memory/2912-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1184-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/964-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/384-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/572-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/604-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1052-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nbnhnb.exejppdv.exellflxlx.exetnttbb.exethntbb.exeddjjp.exennnbbb.exejjjjv.exelllflrx.exettnbnt.exejjvdd.exejppvd.exe5rllrxl.exettnbnt.exehbhhnb.exedddjd.exejppjd.exexrlrfrf.exenhnhtb.exenhtbht.exevddvj.exerrxxlrf.exehthtbh.exe7jppv.exelfflxrx.exerfxrlxr.exeppjdv.exedvjvd.exe1rrffrf.exenhntbh.exehbnhnh.exedjvvp.exexlrxflr.exefrlrrrf.exe7jvdd.exe3xlrxxf.exelfrrlrx.exennnbnt.exe5btbnb.exevjdpj.exe7djvp.exe1lflrrx.exehtnnbb.exepjvvj.exefflfxfl.exerfrrfxx.exe3nhhnt.exevjppv.exedpddj.exe3fllxff.exerffxffl.exehnbbhh.exejdjvp.exejvjdv.exexlrlffx.exexlffffx.exennbnbn.exebbttnt.exevpdvv.exedvvvv.exerrrrrfr.exe7ntthn.exebthnhh.exedvddv.exepid process 2976 nbnhnb.exe 2036 jppdv.exe 2660 llflxlx.exe 2664 tnttbb.exe 1184 thntbb.exe 2292 ddjjp.exe 2480 nnnbbb.exe 2848 jjjjv.exe 2152 lllflrx.exe 2508 ttnbnt.exe 1332 jjvdd.exe 2860 jppvd.exe 2820 5rllrxl.exe 2988 ttnbnt.exe 3000 hbhhnb.exe 964 dddjd.exe 2272 jppjd.exe 2044 xrlrfrf.exe 1616 nhnhtb.exe 1652 nhtbht.exe 384 vddvj.exe 472 rrxxlrf.exe 2952 hthtbh.exe 572 7jppv.exe 1048 lfflxrx.exe 1852 rfxrlxr.exe 1640 ppjdv.exe 604 dvjvd.exe 1052 1rrffrf.exe 2396 nhntbh.exe 1724 hbnhnh.exe 2244 djvvp.exe 1636 xlrxflr.exe 2056 frlrrrf.exe 2972 7jvdd.exe 2920 3xlrxxf.exe 2020 lfrrlrx.exe 2788 nnnbnt.exe 2612 5btbnb.exe 2780 vjdpj.exe 2756 7djvp.exe 2468 1lflrrx.exe 2852 htnnbb.exe 2108 pjvvj.exe 1096 fflfxfl.exe 2900 rfrrfxx.exe 1136 3nhhnt.exe 2832 vjppv.exe 2728 dpddj.exe 2860 3fllxff.exe 2904 rffxffl.exe 1376 hnbbhh.exe 3048 jdjvp.exe 844 jvjdv.exe 1800 xlrlffx.exe 2388 xlffffx.exe 1584 nnbnbn.exe 324 bbttnt.exe 1796 vpdvv.exe 592 dvvvv.exe 2960 rrrrrfr.exe 564 7ntthn.exe 1140 bthnhh.exe 2440 dvddv.exe -
Processes:
resource yara_rule behavioral1/memory/2912-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1184-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/964-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/384-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/572-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/604-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1052-277-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exenbnhnb.exejppdv.exellflxlx.exetnttbb.exethntbb.exeddjjp.exennnbbb.exejjjjv.exelllflrx.exettnbnt.exejjvdd.exejppvd.exe5rllrxl.exettnbnt.exehbhhnb.exedescription pid process target process PID 2912 wrote to memory of 2976 2912 4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe nbnhnb.exe PID 2912 wrote to memory of 2976 2912 4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe nbnhnb.exe PID 2912 wrote to memory of 2976 2912 4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe nbnhnb.exe PID 2912 wrote to memory of 2976 2912 4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe nbnhnb.exe PID 2976 wrote to memory of 2036 2976 nbnhnb.exe jppdv.exe PID 2976 wrote to memory of 2036 2976 nbnhnb.exe jppdv.exe PID 2976 wrote to memory of 2036 2976 nbnhnb.exe jppdv.exe PID 2976 wrote to memory of 2036 2976 nbnhnb.exe jppdv.exe PID 2036 wrote to memory of 2660 2036 jppdv.exe llflxlx.exe PID 2036 wrote to memory of 2660 2036 jppdv.exe llflxlx.exe PID 2036 wrote to memory of 2660 2036 jppdv.exe llflxlx.exe PID 2036 wrote to memory of 2660 2036 jppdv.exe llflxlx.exe PID 2660 wrote to memory of 2664 2660 llflxlx.exe tnttbb.exe PID 2660 wrote to memory of 2664 2660 llflxlx.exe tnttbb.exe PID 2660 wrote to memory of 2664 2660 llflxlx.exe tnttbb.exe PID 2660 wrote to memory of 2664 2660 llflxlx.exe tnttbb.exe PID 2664 wrote to memory of 1184 2664 tnttbb.exe thntbb.exe PID 2664 wrote to memory of 1184 2664 tnttbb.exe thntbb.exe PID 2664 wrote to memory of 1184 2664 tnttbb.exe thntbb.exe PID 2664 wrote to memory of 1184 2664 tnttbb.exe thntbb.exe PID 1184 wrote to memory of 2292 1184 thntbb.exe ddjjp.exe PID 1184 wrote to memory of 2292 1184 thntbb.exe ddjjp.exe PID 1184 wrote to memory of 2292 1184 thntbb.exe ddjjp.exe PID 1184 wrote to memory of 2292 1184 thntbb.exe ddjjp.exe PID 2292 wrote to memory of 2480 2292 ddjjp.exe nnnbbb.exe PID 2292 wrote to memory of 2480 2292 ddjjp.exe nnnbbb.exe PID 2292 wrote to memory of 2480 2292 ddjjp.exe nnnbbb.exe PID 2292 wrote to memory of 2480 2292 ddjjp.exe nnnbbb.exe PID 2480 wrote to memory of 2848 2480 nnnbbb.exe jjjjv.exe PID 2480 wrote to memory of 2848 2480 nnnbbb.exe jjjjv.exe PID 2480 wrote to memory of 2848 2480 nnnbbb.exe jjjjv.exe PID 2480 wrote to memory of 2848 2480 nnnbbb.exe jjjjv.exe PID 2848 wrote to memory of 2152 2848 jjjjv.exe lllflrx.exe PID 2848 wrote to memory of 2152 2848 jjjjv.exe lllflrx.exe PID 2848 wrote to memory of 2152 2848 jjjjv.exe lllflrx.exe PID 2848 wrote to memory of 2152 2848 jjjjv.exe lllflrx.exe PID 2152 wrote to memory of 2508 2152 lllflrx.exe ttnbnt.exe PID 2152 wrote to memory of 2508 2152 lllflrx.exe ttnbnt.exe PID 2152 wrote to memory of 2508 2152 lllflrx.exe ttnbnt.exe PID 2152 wrote to memory of 2508 2152 lllflrx.exe ttnbnt.exe PID 2508 wrote to memory of 1332 2508 ttnbnt.exe jjvdd.exe PID 2508 wrote to memory of 1332 2508 ttnbnt.exe jjvdd.exe PID 2508 wrote to memory of 1332 2508 ttnbnt.exe jjvdd.exe PID 2508 wrote to memory of 1332 2508 ttnbnt.exe jjvdd.exe PID 1332 wrote to memory of 2860 1332 jjvdd.exe jppvd.exe PID 1332 wrote to memory of 2860 1332 jjvdd.exe jppvd.exe PID 1332 wrote to memory of 2860 1332 jjvdd.exe jppvd.exe PID 1332 wrote to memory of 2860 1332 jjvdd.exe jppvd.exe PID 2860 wrote to memory of 2820 2860 jppvd.exe 5rllrxl.exe PID 2860 wrote to memory of 2820 2860 jppvd.exe 5rllrxl.exe PID 2860 wrote to memory of 2820 2860 jppvd.exe 5rllrxl.exe PID 2860 wrote to memory of 2820 2860 jppvd.exe 5rllrxl.exe PID 2820 wrote to memory of 2988 2820 5rllrxl.exe ttnbnt.exe PID 2820 wrote to memory of 2988 2820 5rllrxl.exe ttnbnt.exe PID 2820 wrote to memory of 2988 2820 5rllrxl.exe ttnbnt.exe PID 2820 wrote to memory of 2988 2820 5rllrxl.exe ttnbnt.exe PID 2988 wrote to memory of 3000 2988 ttnbnt.exe hbhhnb.exe PID 2988 wrote to memory of 3000 2988 ttnbnt.exe hbhhnb.exe PID 2988 wrote to memory of 3000 2988 ttnbnt.exe hbhhnb.exe PID 2988 wrote to memory of 3000 2988 ttnbnt.exe hbhhnb.exe PID 3000 wrote to memory of 964 3000 hbhhnb.exe dddjd.exe PID 3000 wrote to memory of 964 3000 hbhhnb.exe dddjd.exe PID 3000 wrote to memory of 964 3000 hbhhnb.exe dddjd.exe PID 3000 wrote to memory of 964 3000 hbhhnb.exe dddjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\nbnhnb.exec:\nbnhnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\jppdv.exec:\jppdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\llflxlx.exec:\llflxlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\tnttbb.exec:\tnttbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\thntbb.exec:\thntbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\ddjjp.exec:\ddjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\nnnbbb.exec:\nnnbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\jjjjv.exec:\jjjjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\lllflrx.exec:\lllflrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\ttnbnt.exec:\ttnbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\jjvdd.exec:\jjvdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\jppvd.exec:\jppvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\5rllrxl.exec:\5rllrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\ttnbnt.exec:\ttnbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\hbhhnb.exec:\hbhhnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\dddjd.exec:\dddjd.exe17⤵
- Executes dropped EXE
PID:964 -
\??\c:\jppjd.exec:\jppjd.exe18⤵
- Executes dropped EXE
PID:2272 -
\??\c:\xrlrfrf.exec:\xrlrfrf.exe19⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nhnhtb.exec:\nhnhtb.exe20⤵
- Executes dropped EXE
PID:1616 -
\??\c:\nhtbht.exec:\nhtbht.exe21⤵
- Executes dropped EXE
PID:1652 -
\??\c:\vddvj.exec:\vddvj.exe22⤵
- Executes dropped EXE
PID:384 -
\??\c:\rrxxlrf.exec:\rrxxlrf.exe23⤵
- Executes dropped EXE
PID:472 -
\??\c:\hthtbh.exec:\hthtbh.exe24⤵
- Executes dropped EXE
PID:2952 -
\??\c:\7jppv.exec:\7jppv.exe25⤵
- Executes dropped EXE
PID:572 -
\??\c:\lfflxrx.exec:\lfflxrx.exe26⤵
- Executes dropped EXE
PID:1048 -
\??\c:\rfxrlxr.exec:\rfxrlxr.exe27⤵
- Executes dropped EXE
PID:1852 -
\??\c:\ppjdv.exec:\ppjdv.exe28⤵
- Executes dropped EXE
PID:1640 -
\??\c:\dvjvd.exec:\dvjvd.exe29⤵
- Executes dropped EXE
PID:604 -
\??\c:\1rrffrf.exec:\1rrffrf.exe30⤵
- Executes dropped EXE
PID:1052 -
\??\c:\nhntbh.exec:\nhntbh.exe31⤵
- Executes dropped EXE
PID:2396 -
\??\c:\hbnhnh.exec:\hbnhnh.exe32⤵
- Executes dropped EXE
PID:1724 -
\??\c:\djvvp.exec:\djvvp.exe33⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xlrxflr.exec:\xlrxflr.exe34⤵
- Executes dropped EXE
PID:1636 -
\??\c:\frlrrrf.exec:\frlrrrf.exe35⤵
- Executes dropped EXE
PID:2056 -
\??\c:\7jvdd.exec:\7jvdd.exe36⤵
- Executes dropped EXE
PID:2972 -
\??\c:\3xlrxxf.exec:\3xlrxxf.exe37⤵
- Executes dropped EXE
PID:2920 -
\??\c:\lfrrlrx.exec:\lfrrlrx.exe38⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nnnbnt.exec:\nnnbnt.exe39⤵
- Executes dropped EXE
PID:2788 -
\??\c:\5btbnb.exec:\5btbnb.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\vjdpj.exec:\vjdpj.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\7djvp.exec:\7djvp.exe42⤵
- Executes dropped EXE
PID:2756 -
\??\c:\1lflrrx.exec:\1lflrrx.exe43⤵
- Executes dropped EXE
PID:2468 -
\??\c:\htnnbb.exec:\htnnbb.exe44⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pjvvj.exec:\pjvvj.exe45⤵
- Executes dropped EXE
PID:2108 -
\??\c:\fflfxfl.exec:\fflfxfl.exe46⤵
- Executes dropped EXE
PID:1096 -
\??\c:\rfrrfxx.exec:\rfrrfxx.exe47⤵
- Executes dropped EXE
PID:2900 -
\??\c:\3nhhnt.exec:\3nhhnt.exe48⤵
- Executes dropped EXE
PID:1136 -
\??\c:\vjppv.exec:\vjppv.exe49⤵
- Executes dropped EXE
PID:2832 -
\??\c:\dpddj.exec:\dpddj.exe50⤵
- Executes dropped EXE
PID:2728 -
\??\c:\3fllxff.exec:\3fllxff.exe51⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rffxffl.exec:\rffxffl.exe52⤵
- Executes dropped EXE
PID:2904 -
\??\c:\hnbbhh.exec:\hnbbhh.exe53⤵
- Executes dropped EXE
PID:1376 -
\??\c:\jdjvp.exec:\jdjvp.exe54⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jvjdv.exec:\jvjdv.exe55⤵
- Executes dropped EXE
PID:844 -
\??\c:\xlrlffx.exec:\xlrlffx.exe56⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xlffffx.exec:\xlffffx.exe57⤵
- Executes dropped EXE
PID:2388 -
\??\c:\nnbnbn.exec:\nnbnbn.exe58⤵
- Executes dropped EXE
PID:1584 -
\??\c:\bbttnt.exec:\bbttnt.exe59⤵
- Executes dropped EXE
PID:324 -
\??\c:\vpdvv.exec:\vpdvv.exe60⤵
- Executes dropped EXE
PID:1796 -
\??\c:\dvvvv.exec:\dvvvv.exe61⤵
- Executes dropped EXE
PID:592 -
\??\c:\rrrrrfr.exec:\rrrrrfr.exe62⤵
- Executes dropped EXE
PID:2960 -
\??\c:\7ntthn.exec:\7ntthn.exe63⤵
- Executes dropped EXE
PID:564 -
\??\c:\bthnhh.exec:\bthnhh.exe64⤵
- Executes dropped EXE
PID:1140 -
\??\c:\dvddv.exec:\dvddv.exe65⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xllllrx.exec:\xllllrx.exe66⤵PID:2308
-
\??\c:\9fllxxf.exec:\9fllxxf.exe67⤵PID:796
-
\??\c:\nhthnb.exec:\nhthnb.exe68⤵PID:1068
-
\??\c:\bhbnnb.exec:\bhbnnb.exe69⤵PID:2088
-
\??\c:\pppvj.exec:\pppvj.exe70⤵PID:604
-
\??\c:\rfrrxlx.exec:\rfrrxlx.exe71⤵PID:1052
-
\??\c:\fxrlxfr.exec:\fxrlxfr.exe72⤵PID:1952
-
\??\c:\ttttnb.exec:\ttttnb.exe73⤵PID:1932
-
\??\c:\ttnbht.exec:\ttnbht.exe74⤵PID:2792
-
\??\c:\hnthtb.exec:\hnthtb.exe75⤵PID:2104
-
\??\c:\7dvvd.exec:\7dvvd.exe76⤵PID:1636
-
\??\c:\ppvdp.exec:\ppvdp.exe77⤵PID:2656
-
\??\c:\ffxfxlf.exec:\ffxfxlf.exe78⤵PID:2148
-
\??\c:\fxxrllf.exec:\fxxrllf.exe79⤵PID:2036
-
\??\c:\7nthnb.exec:\7nthnb.exe80⤵PID:2296
-
\??\c:\7nhhtt.exec:\7nhhtt.exe81⤵PID:2772
-
\??\c:\jjdpj.exec:\jjdpj.exe82⤵PID:2612
-
\??\c:\9vppd.exec:\9vppd.exe83⤵PID:2868
-
\??\c:\rlfrxfx.exec:\rlfrxfx.exe84⤵PID:2756
-
\??\c:\xxllrlx.exec:\xxllrlx.exe85⤵PID:2768
-
\??\c:\9tbnhn.exec:\9tbnhn.exe86⤵PID:3032
-
\??\c:\ntbthh.exec:\ntbthh.exe87⤵PID:2108
-
\??\c:\jdjpd.exec:\jdjpd.exe88⤵PID:3004
-
\??\c:\jdppj.exec:\jdppj.exe89⤵PID:2888
-
\??\c:\fffrlxx.exec:\fffrlxx.exe90⤵PID:2908
-
\??\c:\llxfrrf.exec:\llxfrrf.exe91⤵PID:1956
-
\??\c:\rlxlxfr.exec:\rlxlxfr.exe92⤵PID:2740
-
\??\c:\hhtbnt.exec:\hhtbnt.exe93⤵PID:2836
-
\??\c:\ntnhbn.exec:\ntnhbn.exe94⤵PID:2904
-
\??\c:\pdddp.exec:\pdddp.exe95⤵PID:2276
-
\??\c:\pjpvj.exec:\pjpvj.exe96⤵PID:952
-
\??\c:\9llxrff.exec:\9llxrff.exe97⤵PID:964
-
\??\c:\fxrxrxf.exec:\fxrxrxf.exe98⤵PID:2272
-
\??\c:\1flxrfl.exec:\1flxrfl.exe99⤵PID:1276
-
\??\c:\5nnbht.exec:\5nnbht.exe100⤵PID:2892
-
\??\c:\nnbnhn.exec:\nnbnhn.exe101⤵PID:1900
-
\??\c:\jdvdj.exec:\jdvdj.exe102⤵PID:1128
-
\??\c:\ppjpp.exec:\ppjpp.exe103⤵PID:2452
-
\??\c:\frrlllf.exec:\frrlllf.exe104⤵PID:1216
-
\??\c:\rrrfxlr.exec:\rrrfxlr.exe105⤵PID:2408
-
\??\c:\ttnthn.exec:\ttnthn.exe106⤵PID:1140
-
\??\c:\3bnthh.exec:\3bnthh.exe107⤵PID:1528
-
\??\c:\vddpj.exec:\vddpj.exe108⤵PID:2156
-
\??\c:\vvpdp.exec:\vvpdp.exe109⤵PID:2016
-
\??\c:\9lxxxfr.exec:\9lxxxfr.exe110⤵PID:2012
-
\??\c:\1rlflrf.exec:\1rlflrf.exe111⤵PID:972
-
\??\c:\lrffrll.exec:\lrffrll.exe112⤵PID:2280
-
\??\c:\tthbbn.exec:\tthbbn.exe113⤵PID:1960
-
\??\c:\jdvdp.exec:\jdvdp.exe114⤵PID:1952
-
\??\c:\vpvdd.exec:\vpvdd.exe115⤵PID:2420
-
\??\c:\rlfflrx.exec:\rlfflrx.exe116⤵PID:2792
-
\??\c:\9frrxff.exec:\9frrxff.exe117⤵PID:1628
-
\??\c:\bhnhbh.exec:\bhnhbh.exe118⤵PID:2576
-
\??\c:\bbttht.exec:\bbttht.exe119⤵PID:2056
-
\??\c:\pppdj.exec:\pppdj.exe120⤵PID:2148
-
\??\c:\dvppd.exec:\dvppd.exe121⤵PID:2664
-
\??\c:\7ddpd.exec:\7ddpd.exe122⤵PID:2700
-
\??\c:\1lxxlrl.exec:\1lxxlrl.exe123⤵PID:2788
-
\??\c:\1frxlrf.exec:\1frxlrf.exe124⤵PID:2524
-
\??\c:\thnhht.exec:\thnhht.exe125⤵PID:2292
-
\??\c:\3hbhth.exec:\3hbhth.exe126⤵PID:2604
-
\??\c:\jdpdd.exec:\jdpdd.exe127⤵PID:2468
-
\??\c:\vpjdj.exec:\vpjdj.exe128⤵PID:3032
-
\??\c:\9fxflrf.exec:\9fxflrf.exe129⤵PID:1096
-
\??\c:\xrrxrxl.exec:\xrrxrxl.exe130⤵PID:3004
-
\??\c:\hbthnb.exec:\hbthnb.exe131⤵PID:2900
-
\??\c:\bbntnb.exec:\bbntnb.exe132⤵PID:2908
-
\??\c:\vdvdp.exec:\vdvdp.exe133⤵PID:2832
-
\??\c:\xlllxff.exec:\xlllxff.exe134⤵PID:3016
-
\??\c:\tnnbht.exec:\tnnbht.exe135⤵PID:2860
-
\??\c:\tthhnt.exec:\tthhnt.exe136⤵PID:916
-
\??\c:\djpjd.exec:\djpjd.exe137⤵PID:1376
-
\??\c:\dpvvv.exec:\dpvvv.exe138⤵PID:952
-
\??\c:\1fxrrxr.exec:\1fxrrxr.exe139⤵PID:844
-
\??\c:\tnbhnt.exec:\tnbhnt.exe140⤵PID:1800
-
\??\c:\hnnhnt.exec:\hnnhnt.exe141⤵PID:2388
-
\??\c:\vjdvj.exec:\vjdvj.exe142⤵PID:1584
-
\??\c:\ppjvp.exec:\ppjvp.exe143⤵PID:324
-
\??\c:\lfflrff.exec:\lfflrff.exe144⤵PID:384
-
\??\c:\tthbhh.exec:\tthbhh.exe145⤵PID:668
-
\??\c:\hbnbht.exec:\hbnbht.exe146⤵PID:1216
-
\??\c:\vppvd.exec:\vppvd.exe147⤵PID:564
-
\??\c:\ddjjv.exec:\ddjjv.exe148⤵PID:1284
-
\??\c:\9rlrffx.exec:\9rlrffx.exe149⤵PID:2440
-
\??\c:\llxfflr.exec:\llxfflr.exe150⤵PID:948
-
\??\c:\nhtntt.exec:\nhtntt.exe151⤵PID:2016
-
\??\c:\hbhnhh.exec:\hbhnhh.exe152⤵PID:320
-
\??\c:\9vvjv.exec:\9vvjv.exe153⤵PID:2088
-
\??\c:\9pdpv.exec:\9pdpv.exe154⤵PID:2396
-
\??\c:\vpddj.exec:\vpddj.exe155⤵PID:1052
-
\??\c:\fxxlxxl.exec:\fxxlxxl.exe156⤵PID:2912
-
\??\c:\5nhnhn.exec:\5nhnhn.exe157⤵PID:1932
-
\??\c:\nnnnnt.exec:\nnnnnt.exe158⤵PID:2976
-
\??\c:\pjdjv.exec:\pjdjv.exe159⤵PID:2092
-
\??\c:\dvpvv.exec:\dvpvv.exe160⤵PID:2680
-
\??\c:\3flrlxl.exec:\3flrlxl.exe161⤵PID:2656
-
\??\c:\lfrrlrx.exec:\lfrrlrx.exe162⤵PID:2148
-
\??\c:\3bbntb.exec:\3bbntb.exe163⤵PID:2920
-
\??\c:\hhbbbn.exec:\hhbbbn.exe164⤵PID:2700
-
\??\c:\jdvpd.exec:\jdvpd.exe165⤵PID:2772
-
\??\c:\jjjdd.exec:\jjjdd.exe166⤵PID:1940
-
\??\c:\7vpdd.exec:\7vpdd.exe167⤵PID:2480
-
\??\c:\xlxffll.exec:\xlxffll.exe168⤵PID:2604
-
\??\c:\1fflrfr.exec:\1fflrfr.exe169⤵PID:2768
-
\??\c:\llflxxr.exec:\llflxxr.exe170⤵PID:3040
-
\??\c:\bbnhtt.exec:\bbnhtt.exe171⤵PID:2764
-
\??\c:\9vddv.exec:\9vddv.exe172⤵PID:3004
-
\??\c:\pvppd.exec:\pvppd.exe173⤵PID:2888
-
\??\c:\3fflrfr.exec:\3fflrfr.exe174⤵PID:2864
-
\??\c:\llxrxlx.exec:\llxrxlx.exe175⤵PID:1956
-
\??\c:\hhbbnn.exec:\hhbbnn.exe176⤵PID:828
-
\??\c:\nhbntb.exec:\nhbntb.exe177⤵PID:960
-
\??\c:\dpjdj.exec:\dpjdj.exe178⤵PID:2904
-
\??\c:\rrrxlxr.exec:\rrrxlxr.exe179⤵PID:2276
-
\??\c:\7xxlxlr.exec:\7xxlxlr.exe180⤵PID:952
-
\??\c:\9llflxl.exec:\9llflxl.exe181⤵PID:964
-
\??\c:\3ttnth.exec:\3ttnth.exe182⤵PID:608
-
\??\c:\tnthbh.exec:\tnthbh.exe183⤵PID:1276
-
\??\c:\jjvdv.exec:\jjvdv.exe184⤵PID:2892
-
\??\c:\vvvdv.exec:\vvvdv.exe185⤵PID:1900
-
\??\c:\dddjp.exec:\dddjp.exe186⤵PID:1128
-
\??\c:\lfflrfl.exec:\lfflrfl.exe187⤵PID:2432
-
\??\c:\bttbbn.exec:\bttbbn.exe188⤵PID:1076
-
\??\c:\7bttbh.exec:\7bttbh.exe189⤵PID:2408
-
\??\c:\vvjjv.exec:\vvjjv.exe190⤵PID:1140
-
\??\c:\5xllxfl.exec:\5xllxfl.exe191⤵PID:1528
-
\??\c:\xxxlffr.exec:\xxxlffr.exe192⤵PID:2308
-
\??\c:\5bthtb.exec:\5bthtb.exe193⤵PID:2016
-
\??\c:\vvpjp.exec:\vvpjp.exe194⤵PID:2240
-
\??\c:\vvpdj.exec:\vvpdj.exe195⤵PID:2088
-
\??\c:\rlrrrlf.exec:\rlrrrlf.exe196⤵PID:2396
-
\??\c:\rrlffxf.exec:\rrlffxf.exe197⤵PID:1052
-
\??\c:\bnhnbb.exec:\bnhnbb.exe198⤵PID:2068
-
\??\c:\9nthth.exec:\9nthth.exe199⤵PID:1932
-
\??\c:\pdvpj.exec:\pdvpj.exe200⤵PID:2976
-
\??\c:\9rlfxxf.exec:\9rlfxxf.exe201⤵PID:2092
-
\??\c:\llfrlxl.exec:\llfrlxl.exe202⤵PID:2660
-
\??\c:\httbnt.exec:\httbnt.exe203⤵PID:2504
-
\??\c:\ntnhnt.exec:\ntnhnt.exe204⤵PID:2148
-
\??\c:\vvdjv.exec:\vvdjv.exe205⤵PID:2920
-
\??\c:\vjjdp.exec:\vjjdp.exe206⤵PID:2700
-
\??\c:\lffxflx.exec:\lffxflx.exe207⤵PID:2772
-
\??\c:\5lfrxlx.exec:\5lfrxlx.exe208⤵PID:1940
-
\??\c:\3flflrf.exec:\3flflrf.exe209⤵PID:2480
-
\??\c:\3nhbth.exec:\3nhbth.exe210⤵PID:2604
-
\??\c:\hhtbbb.exec:\hhtbbb.exe211⤵PID:2768
-
\??\c:\ppjdj.exec:\ppjdj.exe212⤵PID:3040
-
\??\c:\ppvdj.exec:\ppvdj.exe213⤵PID:1136
-
\??\c:\frxxrlr.exec:\frxxrlr.exe214⤵PID:3004
-
\??\c:\bnhntt.exec:\bnhntt.exe215⤵PID:2888
-
\??\c:\hbbhhn.exec:\hbbhhn.exe216⤵PID:3008
-
\??\c:\pjpdj.exec:\pjpdj.exe217⤵PID:1956
-
\??\c:\pvpdj.exec:\pvpdj.exe218⤵PID:828
-
\??\c:\xrffrxf.exec:\xrffrxf.exe219⤵PID:960
-
\??\c:\rxfxlfr.exec:\rxfxlfr.exe220⤵PID:2904
-
\??\c:\nnhtht.exec:\nnhtht.exe221⤵PID:2276
-
\??\c:\bhnnhh.exec:\bhnnhh.exe222⤵PID:1456
-
\??\c:\5pddv.exec:\5pddv.exe223⤵PID:964
-
\??\c:\5jdjp.exec:\5jdjp.exe224⤵PID:540
-
\??\c:\lflflrx.exec:\lflflrx.exe225⤵PID:280
-
\??\c:\rlxrffl.exec:\rlxrffl.exe226⤵PID:1584
-
\??\c:\ttbtht.exec:\ttbtht.exe227⤵PID:1900
-
\??\c:\hbbbhb.exec:\hbbbhb.exe228⤵PID:1128
-
\??\c:\pjdpp.exec:\pjdpp.exe229⤵PID:2432
-
\??\c:\dpdvp.exec:\dpdvp.exe230⤵PID:1076
-
\??\c:\fxlrffx.exec:\fxlrffx.exe231⤵PID:920
-
\??\c:\5hbbnn.exec:\5hbbnn.exe232⤵PID:1284
-
\??\c:\7hthnn.exec:\7hthnn.exe233⤵PID:2080
-
\??\c:\7vddp.exec:\7vddp.exe234⤵PID:1988
-
\??\c:\vvpvj.exec:\vvpvj.exe235⤵PID:2096
-
\??\c:\rlxfflx.exec:\rlxfflx.exe236⤵PID:2216
-
\??\c:\7xlffxf.exec:\7xlffxf.exe237⤵PID:904
-
\??\c:\1hhhnb.exec:\1hhhnb.exe238⤵PID:1724
-
\??\c:\btbhbb.exec:\btbhbb.exe239⤵PID:2232
-
\??\c:\5hntbh.exec:\5hntbh.exe240⤵PID:2992
-
\??\c:\vpjjd.exec:\vpjjd.exe241⤵PID:2844
-
\??\c:\jdjjp.exec:\jdjjp.exe242⤵PID:2692