Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da82ba94ef5606324cf310950fc1c6b0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
da82ba94ef5606324cf310950fc1c6b0_NeikiAnalytics.exe
-
Size
95KB
-
MD5
da82ba94ef5606324cf310950fc1c6b0
-
SHA1
043e28f21c9504e936d272b11b2504e358c74da6
-
SHA256
a86c839ca497b110b293d86f86c1174f03d6eb7d1c97e7a4056db21e1d37da48
-
SHA512
8a743ff781ab2f3ec6e5b392bf1da6eaa8a48e76f05baf11bb02bf51d90a2645b2aa0f3a919de85917caf1290c06dcd554920578d45284da2301ef0fe0d67aa8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxEPOfPrAc:ymb3NkkiQ3mdBjFo73PYP1lri3KuOnrT
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/3440-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7tbnht.exejddvp.exexlfxrrl.exefrxfxxf.exe5bnnhb.exevppdv.exevvvpp.exelfxrffx.exe1bnhhh.exe7djpv.exenttnhh.exetbbbhh.exejvppj.exe5xxrffx.exe5hnhbt.exevpddv.exejpvvp.exellxflrf.exe5nnhnh.exedvjvd.exe7jjjd.exe1xfxrrf.exehtbbtn.exehtbnhh.exerrrlfxx.exexfffxxx.exenhnhbb.exejvvpj.exerflfffx.exelrlfxrl.exethhhbh.exevppjj.exelrrlfxx.exerxrlffl.exehhnhtt.exevjpjd.exepdpjd.exerfxrfxr.exe5flffxx.exevpvpj.exelrxrrff.exebtbntn.exenhnthh.exepvvjv.exerffxrlf.exelllxxrl.exebhhbth.exehbnhbn.exe1vpjd.exexlrlfff.exe5lrlffx.exe3hnhhh.exevvdjv.exe3vvvj.exefxxrlrr.exettbtbb.exe1bbbtb.exe1ddvp.exerllfrrr.exerrlxrff.exehbbbbb.exetbhbnn.exevjpvd.exexlrfxxr.exepid process 1288 7tbnht.exe 4352 jddvp.exe 3464 xlfxrrl.exe 3720 frxfxxf.exe 1116 5bnnhb.exe 1632 vppdv.exe 3512 vvvpp.exe 3280 lfxrffx.exe 3772 1bnhhh.exe 4456 7djpv.exe 3968 nttnhh.exe 2468 tbbbhh.exe 396 jvppj.exe 4920 5xxrffx.exe 5080 5hnhbt.exe 1924 vpddv.exe 4908 jpvvp.exe 5016 llxflrf.exe 4924 5nnhnh.exe 3420 dvjvd.exe 1904 7jjjd.exe 4040 1xfxrrf.exe 3556 htbbtn.exe 4020 htbnhh.exe 2728 rrrlfxx.exe 3576 xfffxxx.exe 868 nhnhbb.exe 3984 jvvpj.exe 2364 rflfffx.exe 3740 lrlfxrl.exe 4528 thhhbh.exe 388 vppjj.exe 1664 lrrlfxx.exe 5100 rxrlffl.exe 4832 hhnhtt.exe 2776 vjpjd.exe 1932 pdpjd.exe 2700 rfxrfxr.exe 4208 5flffxx.exe 3720 vpvpj.exe 3332 lrxrrff.exe 1624 btbntn.exe 3096 nhnthh.exe 2260 pvvjv.exe 1476 rffxrlf.exe 3408 lllxxrl.exe 3988 bhhbth.exe 2608 hbnhbn.exe 4816 1vpjd.exe 3220 xlrlfff.exe 4396 5lrlffx.exe 2108 3hnhhh.exe 3268 vvdjv.exe 4920 3vvvj.exe 1860 fxxrlrr.exe 2756 ttbtbb.exe 2888 1bbbtb.exe 2084 1ddvp.exe 3924 rllfrrr.exe 404 rrlxrff.exe 412 hbbbbb.exe 2344 tbhbnn.exe 1896 vjpvd.exe 1552 xlrfxxr.exe -
Processes:
resource yara_rule behavioral2/memory/3440-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
da82ba94ef5606324cf310950fc1c6b0_NeikiAnalytics.exe7tbnht.exejddvp.exexlfxrrl.exefrxfxxf.exe5bnnhb.exevppdv.exevvvpp.exelfxrffx.exe1bnhhh.exe7djpv.exenttnhh.exetbbbhh.exejvppj.exe5xxrffx.exe5hnhbt.exevpddv.exejpvvp.exellxflrf.exe5nnhnh.exedvjvd.exe7jjjd.exedescription pid process target process PID 3440 wrote to memory of 1288 3440 da82ba94ef5606324cf310950fc1c6b0_NeikiAnalytics.exe 7tbnht.exe PID 3440 wrote to memory of 1288 3440 da82ba94ef5606324cf310950fc1c6b0_NeikiAnalytics.exe 7tbnht.exe PID 3440 wrote to memory of 1288 3440 da82ba94ef5606324cf310950fc1c6b0_NeikiAnalytics.exe 7tbnht.exe PID 1288 wrote to memory of 4352 1288 7tbnht.exe jddvp.exe PID 1288 wrote to memory of 4352 1288 7tbnht.exe jddvp.exe PID 1288 wrote to memory of 4352 1288 7tbnht.exe jddvp.exe PID 4352 wrote to memory of 3464 4352 jddvp.exe xlfxrrl.exe PID 4352 wrote to memory of 3464 4352 jddvp.exe xlfxrrl.exe PID 4352 wrote to memory of 3464 4352 jddvp.exe xlfxrrl.exe PID 3464 wrote to memory of 3720 3464 xlfxrrl.exe frxfxxf.exe PID 3464 wrote to memory of 3720 3464 xlfxrrl.exe frxfxxf.exe PID 3464 wrote to memory of 3720 3464 xlfxrrl.exe frxfxxf.exe PID 3720 wrote to memory of 1116 3720 frxfxxf.exe 5bnnhb.exe PID 3720 wrote to memory of 1116 3720 frxfxxf.exe 5bnnhb.exe PID 3720 wrote to memory of 1116 3720 frxfxxf.exe 5bnnhb.exe PID 1116 wrote to memory of 1632 1116 5bnnhb.exe vppdv.exe PID 1116 wrote to memory of 1632 1116 5bnnhb.exe vppdv.exe PID 1116 wrote to memory of 1632 1116 5bnnhb.exe vppdv.exe PID 1632 wrote to memory of 3512 1632 vppdv.exe vvvpp.exe PID 1632 wrote to memory of 3512 1632 vppdv.exe vvvpp.exe PID 1632 wrote to memory of 3512 1632 vppdv.exe vvvpp.exe PID 3512 wrote to memory of 3280 3512 vvvpp.exe lfxrffx.exe PID 3512 wrote to memory of 3280 3512 vvvpp.exe lfxrffx.exe PID 3512 wrote to memory of 3280 3512 vvvpp.exe lfxrffx.exe PID 3280 wrote to memory of 3772 3280 lfxrffx.exe 1bnhhh.exe PID 3280 wrote to memory of 3772 3280 lfxrffx.exe 1bnhhh.exe PID 3280 wrote to memory of 3772 3280 lfxrffx.exe 1bnhhh.exe PID 3772 wrote to memory of 4456 3772 1bnhhh.exe 7djpv.exe PID 3772 wrote to memory of 4456 3772 1bnhhh.exe 7djpv.exe PID 3772 wrote to memory of 4456 3772 1bnhhh.exe 7djpv.exe PID 4456 wrote to memory of 3968 4456 7djpv.exe nttnhh.exe PID 4456 wrote to memory of 3968 4456 7djpv.exe nttnhh.exe PID 4456 wrote to memory of 3968 4456 7djpv.exe nttnhh.exe PID 3968 wrote to memory of 2468 3968 nttnhh.exe tbbbhh.exe PID 3968 wrote to memory of 2468 3968 nttnhh.exe tbbbhh.exe PID 3968 wrote to memory of 2468 3968 nttnhh.exe tbbbhh.exe PID 2468 wrote to memory of 396 2468 tbbbhh.exe jvppj.exe PID 2468 wrote to memory of 396 2468 tbbbhh.exe jvppj.exe PID 2468 wrote to memory of 396 2468 tbbbhh.exe jvppj.exe PID 396 wrote to memory of 4920 396 jvppj.exe 5xxrffx.exe PID 396 wrote to memory of 4920 396 jvppj.exe 5xxrffx.exe PID 396 wrote to memory of 4920 396 jvppj.exe 5xxrffx.exe PID 4920 wrote to memory of 5080 4920 5xxrffx.exe 5hnhbt.exe PID 4920 wrote to memory of 5080 4920 5xxrffx.exe 5hnhbt.exe PID 4920 wrote to memory of 5080 4920 5xxrffx.exe 5hnhbt.exe PID 5080 wrote to memory of 1924 5080 5hnhbt.exe vpddv.exe PID 5080 wrote to memory of 1924 5080 5hnhbt.exe vpddv.exe PID 5080 wrote to memory of 1924 5080 5hnhbt.exe vpddv.exe PID 1924 wrote to memory of 4908 1924 vpddv.exe jpvvp.exe PID 1924 wrote to memory of 4908 1924 vpddv.exe jpvvp.exe PID 1924 wrote to memory of 4908 1924 vpddv.exe jpvvp.exe PID 4908 wrote to memory of 5016 4908 jpvvp.exe llxflrf.exe PID 4908 wrote to memory of 5016 4908 jpvvp.exe llxflrf.exe PID 4908 wrote to memory of 5016 4908 jpvvp.exe llxflrf.exe PID 5016 wrote to memory of 4924 5016 llxflrf.exe 5nnhnh.exe PID 5016 wrote to memory of 4924 5016 llxflrf.exe 5nnhnh.exe PID 5016 wrote to memory of 4924 5016 llxflrf.exe 5nnhnh.exe PID 4924 wrote to memory of 3420 4924 5nnhnh.exe dvjvd.exe PID 4924 wrote to memory of 3420 4924 5nnhnh.exe dvjvd.exe PID 4924 wrote to memory of 3420 4924 5nnhnh.exe dvjvd.exe PID 3420 wrote to memory of 1904 3420 dvjvd.exe 7jjjd.exe PID 3420 wrote to memory of 1904 3420 dvjvd.exe 7jjjd.exe PID 3420 wrote to memory of 1904 3420 dvjvd.exe 7jjjd.exe PID 1904 wrote to memory of 4040 1904 7jjjd.exe 1xfxrrf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da82ba94ef5606324cf310950fc1c6b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\da82ba94ef5606324cf310950fc1c6b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\7tbnht.exec:\7tbnht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\jddvp.exec:\jddvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\xlfxrrl.exec:\xlfxrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\frxfxxf.exec:\frxfxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\5bnnhb.exec:\5bnnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\vppdv.exec:\vppdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\vvvpp.exec:\vvvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\lfxrffx.exec:\lfxrffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\1bnhhh.exec:\1bnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\7djpv.exec:\7djpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\nttnhh.exec:\nttnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\tbbbhh.exec:\tbbbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\jvppj.exec:\jvppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\5xxrffx.exec:\5xxrffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\5hnhbt.exec:\5hnhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\vpddv.exec:\vpddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\jpvvp.exec:\jpvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\llxflrf.exec:\llxflrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\5nnhnh.exec:\5nnhnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\dvjvd.exec:\dvjvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\7jjjd.exec:\7jjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\1xfxrrf.exec:\1xfxrrf.exe23⤵
- Executes dropped EXE
PID:4040 -
\??\c:\htbbtn.exec:\htbbtn.exe24⤵
- Executes dropped EXE
PID:3556 -
\??\c:\htbnhh.exec:\htbnhh.exe25⤵
- Executes dropped EXE
PID:4020 -
\??\c:\rrrlfxx.exec:\rrrlfxx.exe26⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xfffxxx.exec:\xfffxxx.exe27⤵
- Executes dropped EXE
PID:3576 -
\??\c:\nhnhbb.exec:\nhnhbb.exe28⤵
- Executes dropped EXE
PID:868 -
\??\c:\jvvpj.exec:\jvvpj.exe29⤵
- Executes dropped EXE
PID:3984 -
\??\c:\rflfffx.exec:\rflfffx.exe30⤵
- Executes dropped EXE
PID:2364 -
\??\c:\lrlfxrl.exec:\lrlfxrl.exe31⤵
- Executes dropped EXE
PID:3740 -
\??\c:\thhhbh.exec:\thhhbh.exe32⤵
- Executes dropped EXE
PID:4528 -
\??\c:\vppjj.exec:\vppjj.exe33⤵
- Executes dropped EXE
PID:388 -
\??\c:\lrrlfxx.exec:\lrrlfxx.exe34⤵
- Executes dropped EXE
PID:1664 -
\??\c:\rxrlffl.exec:\rxrlffl.exe35⤵
- Executes dropped EXE
PID:5100 -
\??\c:\tnnnhb.exec:\tnnnhb.exe36⤵PID:3812
-
\??\c:\hhnhtt.exec:\hhnhtt.exe37⤵
- Executes dropped EXE
PID:4832 -
\??\c:\vjpjd.exec:\vjpjd.exe38⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pdpjd.exec:\pdpjd.exe39⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rfxrfxr.exec:\rfxrfxr.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\5flffxx.exec:\5flffxx.exe41⤵
- Executes dropped EXE
PID:4208 -
\??\c:\vpvpj.exec:\vpvpj.exe42⤵
- Executes dropped EXE
PID:3720 -
\??\c:\lrxrrff.exec:\lrxrrff.exe43⤵
- Executes dropped EXE
PID:3332 -
\??\c:\btbntn.exec:\btbntn.exe44⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nhnthh.exec:\nhnthh.exe45⤵
- Executes dropped EXE
PID:3096 -
\??\c:\pvvjv.exec:\pvvjv.exe46⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rffxrlf.exec:\rffxrlf.exe47⤵
- Executes dropped EXE
PID:1476 -
\??\c:\lllxxrl.exec:\lllxxrl.exe48⤵
- Executes dropped EXE
PID:3408 -
\??\c:\bhhbth.exec:\bhhbth.exe49⤵
- Executes dropped EXE
PID:3988 -
\??\c:\hbnhbn.exec:\hbnhbn.exe50⤵
- Executes dropped EXE
PID:2608 -
\??\c:\1vpjd.exec:\1vpjd.exe51⤵
- Executes dropped EXE
PID:4816 -
\??\c:\xlrlfff.exec:\xlrlfff.exe52⤵
- Executes dropped EXE
PID:3220 -
\??\c:\5lrlffx.exec:\5lrlffx.exe53⤵
- Executes dropped EXE
PID:4396 -
\??\c:\3hnhhh.exec:\3hnhhh.exe54⤵
- Executes dropped EXE
PID:2108 -
\??\c:\vvdjv.exec:\vvdjv.exe55⤵
- Executes dropped EXE
PID:3268 -
\??\c:\3vvvj.exec:\3vvvj.exe56⤵
- Executes dropped EXE
PID:4920 -
\??\c:\fxxrlrr.exec:\fxxrlrr.exe57⤵
- Executes dropped EXE
PID:1860 -
\??\c:\ttbtbb.exec:\ttbtbb.exe58⤵
- Executes dropped EXE
PID:2756 -
\??\c:\1bbbtb.exec:\1bbbtb.exe59⤵
- Executes dropped EXE
PID:2888 -
\??\c:\1ddvp.exec:\1ddvp.exe60⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rllfrrr.exec:\rllfrrr.exe61⤵
- Executes dropped EXE
PID:3924 -
\??\c:\rrlxrff.exec:\rrlxrff.exe62⤵
- Executes dropped EXE
PID:404 -
\??\c:\hbbbbb.exec:\hbbbbb.exe63⤵
- Executes dropped EXE
PID:412 -
\??\c:\tbhbnn.exec:\tbhbnn.exe64⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vjpvd.exec:\vjpvd.exe65⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xlrfxxr.exec:\xlrfxxr.exe66⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xxffxxx.exec:\xxffxxx.exe67⤵PID:2456
-
\??\c:\tnnntt.exec:\tnnntt.exe68⤵PID:3556
-
\??\c:\5vjdd.exec:\5vjdd.exe69⤵PID:3632
-
\??\c:\dvvpj.exec:\dvvpj.exe70⤵PID:1940
-
\??\c:\frrrffx.exec:\frrrffx.exe71⤵PID:2764
-
\??\c:\5fxrlxr.exec:\5fxrlxr.exe72⤵PID:2480
-
\??\c:\tbbbnn.exec:\tbbbnn.exe73⤵PID:1180
-
\??\c:\hbtnnn.exec:\hbtnnn.exe74⤵PID:4840
-
\??\c:\dpdvp.exec:\dpdvp.exe75⤵PID:2884
-
\??\c:\3rfxflr.exec:\3rfxflr.exe76⤵PID:928
-
\??\c:\ffxxrll.exec:\ffxxrll.exe77⤵PID:1768
-
\??\c:\1nttnn.exec:\1nttnn.exe78⤵PID:2740
-
\??\c:\vvvdv.exec:\vvvdv.exe79⤵PID:2388
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe80⤵PID:744
-
\??\c:\lffxlxx.exec:\lffxlxx.exe81⤵PID:4320
-
\??\c:\btnhnn.exec:\btnhnn.exe82⤵PID:4092
-
\??\c:\dpvpj.exec:\dpvpj.exe83⤵PID:2588
-
\??\c:\jpdpj.exec:\jpdpj.exe84⤵PID:2776
-
\??\c:\xrxxrrx.exec:\xrxxrrx.exe85⤵PID:1932
-
\??\c:\xrfrrrr.exec:\xrfrrrr.exe86⤵PID:2700
-
\??\c:\nhnhnb.exec:\nhnhnb.exe87⤵PID:4208
-
\??\c:\dppjd.exec:\dppjd.exe88⤵PID:3720
-
\??\c:\llrllxf.exec:\llrllxf.exe89⤵PID:1056
-
\??\c:\bnbttt.exec:\bnbttt.exe90⤵PID:1408
-
\??\c:\3dvvp.exec:\3dvvp.exe91⤵PID:8
-
\??\c:\xfrlxxx.exec:\xfrlxxx.exe92⤵PID:4728
-
\??\c:\ffffxxx.exec:\ffffxxx.exe93⤵PID:4880
-
\??\c:\hbhbtt.exec:\hbhbtt.exe94⤵PID:2404
-
\??\c:\pvjpp.exec:\pvjpp.exe95⤵PID:4456
-
\??\c:\djjdv.exec:\djjdv.exe96⤵PID:512
-
\??\c:\fxxrffx.exec:\fxxrffx.exe97⤵PID:4496
-
\??\c:\lfxxrrl.exec:\lfxxrrl.exe98⤵PID:396
-
\??\c:\bnhbtt.exec:\bnhbtt.exe99⤵PID:936
-
\??\c:\9jdvv.exec:\9jdvv.exe100⤵PID:1368
-
\??\c:\3ddpv.exec:\3ddpv.exe101⤵PID:1164
-
\??\c:\1rfxffl.exec:\1rfxffl.exe102⤵PID:4852
-
\??\c:\frxrrrl.exec:\frxrrrl.exe103⤵PID:4772
-
\??\c:\ttbttb.exec:\ttbttb.exe104⤵PID:4464
-
\??\c:\dpjpp.exec:\dpjpp.exe105⤵PID:2952
-
\??\c:\dpddv.exec:\dpddv.exe106⤵PID:3948
-
\??\c:\3rfxrxr.exec:\3rfxrxr.exe107⤵PID:1904
-
\??\c:\xrllffx.exec:\xrllffx.exe108⤵PID:1136
-
\??\c:\9tbtnn.exec:\9tbtnn.exe109⤵PID:4080
-
\??\c:\3hhbnb.exec:\3hhbnb.exe110⤵PID:748
-
\??\c:\jdjdp.exec:\jdjdp.exe111⤵PID:4776
-
\??\c:\5xlfffx.exec:\5xlfffx.exe112⤵PID:3628
-
\??\c:\3ttnhn.exec:\3ttnhn.exe113⤵PID:3576
-
\??\c:\dvjjv.exec:\dvjjv.exe114⤵PID:2196
-
\??\c:\pjjdp.exec:\pjjdp.exe115⤵PID:1400
-
\??\c:\fxfxxrr.exec:\fxfxxrr.exe116⤵PID:1180
-
\??\c:\rrllfff.exec:\rrllfff.exe117⤵PID:2020
-
\??\c:\hbhbbt.exec:\hbhbbt.exe118⤵PID:1060
-
\??\c:\pjpjd.exec:\pjpjd.exe119⤵PID:672
-
\??\c:\vjvpd.exec:\vjvpd.exe120⤵PID:2620
-
\??\c:\nhnhbb.exec:\nhnhbb.exe121⤵PID:4196
-
\??\c:\7rxxlfx.exec:\7rxxlfx.exe122⤵PID:4328
-
\??\c:\ttbhnn.exec:\ttbhnn.exe123⤵PID:4200
-
\??\c:\jdjdj.exec:\jdjdj.exe124⤵PID:2564
-
\??\c:\jdpjp.exec:\jdpjp.exe125⤵PID:3496
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe126⤵PID:2776
-
\??\c:\rfffxxx.exec:\rfffxxx.exe127⤵PID:1932
-
\??\c:\tntttt.exec:\tntttt.exe128⤵PID:2700
-
\??\c:\9nnhtt.exec:\9nnhtt.exe129⤵PID:1020
-
\??\c:\jppjd.exec:\jppjd.exe130⤵PID:1728
-
\??\c:\9vddj.exec:\9vddj.exe131⤵PID:3512
-
\??\c:\rrrllfx.exec:\rrrllfx.exe132⤵PID:1968
-
\??\c:\tntnnn.exec:\tntnnn.exe133⤵PID:3988
-
\??\c:\hnbbht.exec:\hnbbht.exe134⤵PID:2584
-
\??\c:\jdvdv.exec:\jdvdv.exe135⤵PID:1544
-
\??\c:\1pdvd.exec:\1pdvd.exe136⤵PID:4412
-
\??\c:\xfxrffx.exec:\xfxrffx.exe137⤵PID:1368
-
\??\c:\xxffllf.exec:\xxffllf.exe138⤵PID:4036
-
\??\c:\9tbbtn.exec:\9tbbtn.exe139⤵PID:860
-
\??\c:\3btnhb.exec:\3btnhb.exe140⤵PID:4924
-
\??\c:\jjjjd.exec:\jjjjd.exe141⤵PID:2204
-
\??\c:\pdjdp.exec:\pdjdp.exe142⤵PID:1152
-
\??\c:\rrrffxx.exec:\rrrffxx.exe143⤵PID:4040
-
\??\c:\bthbbb.exec:\bthbbb.exe144⤵PID:4792
-
\??\c:\dppdv.exec:\dppdv.exe145⤵PID:2456
-
\??\c:\1rrfxxl.exec:\1rrfxxl.exe146⤵PID:2308
-
\??\c:\xfrxxxf.exec:\xfrxxxf.exe147⤵PID:1940
-
\??\c:\bnnhhb.exec:\bnnhhb.exe148⤵PID:3340
-
\??\c:\vpvvp.exec:\vpvvp.exe149⤵PID:1976
-
\??\c:\rrrlxrf.exec:\rrrlxrf.exe150⤵PID:3248
-
\??\c:\bbhbnn.exec:\bbhbnn.exe151⤵PID:960
-
\??\c:\rrrlfff.exec:\rrrlfff.exe152⤵PID:4740
-
\??\c:\hhntnb.exec:\hhntnb.exe153⤵PID:2364
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe154⤵PID:928
-
\??\c:\ntttnh.exec:\ntttnh.exe155⤵PID:1800
-
\??\c:\flrfxxx.exec:\flrfxxx.exe156⤵PID:4868
-
\??\c:\bbhnnn.exec:\bbhnnn.exe157⤵PID:3260
-
\??\c:\thhhtb.exec:\thhhtb.exe158⤵PID:848
-
\??\c:\5pdvj.exec:\5pdvj.exe159⤵PID:228
-
\??\c:\pdpjd.exec:\pdpjd.exe160⤵PID:2864
-
\??\c:\7fllffr.exec:\7fllffr.exe161⤵PID:3464
-
\??\c:\hbhbnt.exec:\hbhbnt.exe162⤵PID:4828
-
\??\c:\7bhbbb.exec:\7bhbbb.exe163⤵PID:1828
-
\??\c:\pddvv.exec:\pddvv.exe164⤵PID:3332
-
\??\c:\rxfxlll.exec:\rxfxlll.exe165⤵PID:1116
-
\??\c:\flllrrx.exec:\flllrrx.exe166⤵PID:3096
-
\??\c:\hhhbbt.exec:\hhhbbt.exe167⤵PID:932
-
\??\c:\bhbttt.exec:\bhbttt.exe168⤵PID:3568
-
\??\c:\3jvjd.exec:\3jvjd.exe169⤵PID:4428
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe170⤵PID:512
-
\??\c:\5xxfxxr.exec:\5xxfxxr.exe171⤵PID:4424
-
\??\c:\7tbbtn.exec:\7tbbtn.exe172⤵PID:2188
-
\??\c:\tthhhh.exec:\tthhhh.exe173⤵PID:5016
-
\??\c:\pjjpd.exec:\pjjpd.exe174⤵PID:1144
-
\??\c:\dddpd.exec:\dddpd.exe175⤵PID:528
-
\??\c:\lfrrrll.exec:\lfrrrll.exe176⤵PID:4236
-
\??\c:\llxrxxf.exec:\llxrxxf.exe177⤵PID:4856
-
\??\c:\ttttnn.exec:\ttttnn.exe178⤵PID:2900
-
\??\c:\htbbnn.exec:\htbbnn.exe179⤵PID:2456
-
\??\c:\jvpjj.exec:\jvpjj.exe180⤵PID:4916
-
\??\c:\pjpvd.exec:\pjpvd.exe181⤵PID:2480
-
\??\c:\xxfrllf.exec:\xxfrllf.exe182⤵PID:1948
-
\??\c:\xlxxlll.exec:\xlxxlll.exe183⤵PID:2196
-
\??\c:\xlxrlrl.exec:\xlxrlrl.exe184⤵PID:1180
-
\??\c:\thnhhh.exec:\thnhhh.exe185⤵PID:960
-
\??\c:\9thbbb.exec:\9thbbb.exe186⤵PID:3776
-
\??\c:\vppjj.exec:\vppjj.exe187⤵PID:672
-
\??\c:\jddvp.exec:\jddvp.exe188⤵PID:3352
-
\??\c:\5frlxxf.exec:\5frlxxf.exe189⤵PID:3164
-
\??\c:\nbbbtt.exec:\nbbbtt.exe190⤵PID:4328
-
\??\c:\7hhbtn.exec:\7hhbtn.exe191⤵PID:3972
-
\??\c:\pddvd.exec:\pddvd.exe192⤵PID:228
-
\??\c:\pjdvp.exec:\pjdvp.exe193⤵PID:2488
-
\??\c:\rlfrfll.exec:\rlfrfll.exe194⤵PID:2136
-
\??\c:\5flxrrr.exec:\5flxrrr.exe195⤵PID:4208
-
\??\c:\5xlfxrl.exec:\5xlfxrl.exe196⤵PID:3528
-
\??\c:\bbhbhn.exec:\bbhbhn.exe197⤵PID:372
-
\??\c:\tntnbb.exec:\tntnbb.exe198⤵PID:4836
-
\??\c:\jdpjv.exec:\jdpjv.exe199⤵PID:1096
-
\??\c:\vpdjv.exec:\vpdjv.exe200⤵PID:3988
-
\??\c:\llxffxf.exec:\llxffxf.exe201⤵PID:4588
-
\??\c:\lrxrfxx.exec:\lrxrfxx.exe202⤵PID:1376
-
\??\c:\hbttbb.exec:\hbttbb.exe203⤵PID:4424
-
\??\c:\ntttnt.exec:\ntttnt.exe204⤵PID:2188
-
\??\c:\1pppd.exec:\1pppd.exe205⤵PID:412
-
\??\c:\rrlxxxf.exec:\rrlxxxf.exe206⤵PID:3420
-
\??\c:\llxxlfx.exec:\llxxlfx.exe207⤵PID:464
-
\??\c:\7ntbtt.exec:\7ntbtt.exe208⤵PID:4040
-
\??\c:\thtnhh.exec:\thtnhh.exe209⤵PID:1552
-
\??\c:\jdvpp.exec:\jdvpp.exe210⤵PID:2780
-
\??\c:\fllfffl.exec:\fllfffl.exe211⤵PID:3596
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe212⤵PID:3884
-
\??\c:\bbtnht.exec:\bbtnht.exe213⤵PID:5064
-
\??\c:\tnbhhn.exec:\tnbhhn.exe214⤵PID:2948
-
\??\c:\jddvp.exec:\jddvp.exe215⤵PID:5112
-
\??\c:\xfllllr.exec:\xfllllr.exe216⤵PID:3740
-
\??\c:\5hbbtt.exec:\5hbbtt.exe217⤵PID:4528
-
\??\c:\tnhbnn.exec:\tnhbnn.exe218⤵PID:3776
-
\??\c:\pjppd.exec:\pjppd.exe219⤵PID:3296
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe220⤵PID:5100
-
\??\c:\llxxfxf.exec:\llxxfxf.exe221⤵PID:3432
-
\??\c:\hthhbb.exec:\hthhbb.exe222⤵PID:4320
-
\??\c:\1tbbtb.exec:\1tbbtb.exe223⤵PID:3260
-
\??\c:\vjjjv.exec:\vjjjv.exe224⤵PID:3496
-
\??\c:\1ppdv.exec:\1ppdv.exe225⤵PID:5084
-
\??\c:\rrrlffx.exec:\rrrlffx.exe226⤵PID:4460
-
\??\c:\rfflflf.exec:\rfflflf.exe227⤵PID:4828
-
\??\c:\1bbtnh.exec:\1bbtnh.exe228⤵PID:1632
-
\??\c:\5vvpj.exec:\5vvpj.exe229⤵PID:8
-
\??\c:\5djjd.exec:\5djjd.exe230⤵PID:3240
-
\??\c:\rlfrllf.exec:\rlfrllf.exe231⤵PID:452
-
\??\c:\fflllll.exec:\fflllll.exe232⤵PID:3968
-
\??\c:\tbhttb.exec:\tbhttb.exe233⤵PID:532
-
\??\c:\htttnn.exec:\htttnn.exe234⤵PID:936
-
\??\c:\5vdvd.exec:\5vdvd.exe235⤵PID:4412
-
\??\c:\rxxrfff.exec:\rxxrfff.exe236⤵PID:2084
-
\??\c:\bntnhb.exec:\bntnhb.exe237⤵PID:5092
-
\??\c:\tnhbnn.exec:\tnhbnn.exe238⤵PID:2348
-
\??\c:\pjjdv.exec:\pjjdv.exe239⤵PID:5012
-
\??\c:\jjdvj.exec:\jjdvj.exe240⤵PID:3060
-
\??\c:\7rfxrrl.exec:\7rfxrrl.exe241⤵PID:2316
-
\??\c:\xrrlffx.exec:\xrrlffx.exe242⤵PID:1712