Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 15:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ddde86cb0a38646bd51c690c802ed3e0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
ddde86cb0a38646bd51c690c802ed3e0_NeikiAnalytics.exe
-
Size
78KB
-
MD5
ddde86cb0a38646bd51c690c802ed3e0
-
SHA1
d0205a4dca05038de6e9d371b88e5f7c85d37b5c
-
SHA256
30dc35b9182141df990b4093f090a86caf23dc50d8cc11920f4296bc04aa47ee
-
SHA512
434b9410907a9c5217307525ce4dc3c41e2b00f051d4ed4f716c627329c6c9c91db23f9ca2a7e38820a7ce3adea1004ab31bc31df2941ca6545e9a581ae82e33
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAX8YieVIJclPvPJtcdcM:ymb3NkkiQ3mdBjFo68YBVIJc9JtxM
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/552-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-43-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4024-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/712-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/508-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2884-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xfxfrfx.exebnhbnh.exe1nbntn.exe3ppdv.exedpvpj.exelxfrlfx.exebhhtnh.exejjjdv.exe3fxlrxr.exefxxrlxr.exebhhbnn.exelxfllxr.exerrrfxrf.exenntbth.exelrfrlfr.exe5ffrrfx.exenbnntb.exedvpdp.exepdvpd.exelfrfrlf.exexlxlxrl.exe1nnhtn.exe9pvjv.exe3ppdp.exexlllfxf.exe3hnhtn.exepvpjd.exeppvpv.exexxxrxxr.exelxfrfxr.exebhtnnh.exehtbthh.exepvdvp.exejvdvv.exe3ffrlrr.exetbthtn.exe7hnhbh.exepddjd.exevdvdv.exe3rlfllx.exelxrxxff.exebtbntn.exenhbnhh.exejpdpj.exepvppd.exexfxrlfx.exe1frfxrf.exe5nnhbh.exevppvd.exevjdvj.exexlfrxxl.exebtthbn.exetbbnbt.exevpdvp.exepvpjv.exe1flxrfx.exerrfxxrf.exetthbnn.exebtnbnh.exejdvjd.exerxlfrlf.exelxrlfxl.exexrrfxrl.exe5thbnh.exepid process 2412 xfxfrfx.exe 1504 bnhbnh.exe 4864 1nbntn.exe 1244 3ppdv.exe 4024 dpvpj.exe 4608 lxfrlfx.exe 2604 bhhtnh.exe 1972 jjjdv.exe 1044 3fxlrxr.exe 712 fxxrlxr.exe 4552 bhhbnn.exe 4076 lxfllxr.exe 3544 rrrfxrf.exe 4976 nntbth.exe 2720 lrfrlfr.exe 1012 5ffrrfx.exe 2012 nbnntb.exe 1452 dvpdp.exe 4712 pdvpd.exe 5000 lfrfrlf.exe 4636 xlxlxrl.exe 448 1nnhtn.exe 372 9pvjv.exe 1188 3ppdp.exe 4216 xlllfxf.exe 508 3hnhtn.exe 2264 pvpjd.exe 4060 ppvpv.exe 2884 xxxrxxr.exe 3080 lxfrfxr.exe 716 bhtnnh.exe 872 htbthh.exe 3252 pvdvp.exe 4792 jvdvv.exe 4680 3ffrlrr.exe 552 tbthtn.exe 4824 7hnhbh.exe 2412 pddjd.exe 3788 vdvdv.exe 4056 3rlfllx.exe 4724 lxrxxff.exe 3676 btbntn.exe 4208 nhbnhh.exe 4544 jpdpj.exe 1128 pvppd.exe 3924 xfxrlfx.exe 1972 1frfxrf.exe 1576 5nnhbh.exe 2908 vppvd.exe 2104 vjdvj.exe 424 xlfrxxl.exe 3336 btthbn.exe 4124 tbbnbt.exe 3544 vpdvp.exe 4484 pvpjv.exe 4396 1flxrfx.exe 1900 rrfxxrf.exe 676 tthbnn.exe 2012 btnbnh.exe 1452 jdvjd.exe 1788 rxlfrlf.exe 1916 lxrlfxl.exe 3212 xrrfxrl.exe 2384 5thbnh.exe -
Processes:
resource yara_rule behavioral2/memory/552-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/712-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/712-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/712-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/712-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/508-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ddde86cb0a38646bd51c690c802ed3e0_NeikiAnalytics.exexfxfrfx.exebnhbnh.exe1nbntn.exe3ppdv.exedpvpj.exelxfrlfx.exebhhtnh.exejjjdv.exe3fxlrxr.exefxxrlxr.exebhhbnn.exelxfllxr.exerrrfxrf.exenntbth.exelrfrlfr.exe5ffrrfx.exenbnntb.exedvpdp.exepdvpd.exelfrfrlf.exexlxlxrl.exedescription pid process target process PID 552 wrote to memory of 2412 552 ddde86cb0a38646bd51c690c802ed3e0_NeikiAnalytics.exe xfxfrfx.exe PID 552 wrote to memory of 2412 552 ddde86cb0a38646bd51c690c802ed3e0_NeikiAnalytics.exe xfxfrfx.exe PID 552 wrote to memory of 2412 552 ddde86cb0a38646bd51c690c802ed3e0_NeikiAnalytics.exe xfxfrfx.exe PID 2412 wrote to memory of 1504 2412 xfxfrfx.exe bnhbnh.exe PID 2412 wrote to memory of 1504 2412 xfxfrfx.exe bnhbnh.exe PID 2412 wrote to memory of 1504 2412 xfxfrfx.exe bnhbnh.exe PID 1504 wrote to memory of 4864 1504 bnhbnh.exe 1nbntn.exe PID 1504 wrote to memory of 4864 1504 bnhbnh.exe 1nbntn.exe PID 1504 wrote to memory of 4864 1504 bnhbnh.exe 1nbntn.exe PID 4864 wrote to memory of 1244 4864 1nbntn.exe 3ppdv.exe PID 4864 wrote to memory of 1244 4864 1nbntn.exe 3ppdv.exe PID 4864 wrote to memory of 1244 4864 1nbntn.exe 3ppdv.exe PID 1244 wrote to memory of 4024 1244 3ppdv.exe dpvpj.exe PID 1244 wrote to memory of 4024 1244 3ppdv.exe dpvpj.exe PID 1244 wrote to memory of 4024 1244 3ppdv.exe dpvpj.exe PID 4024 wrote to memory of 4608 4024 dpvpj.exe lxfrlfx.exe PID 4024 wrote to memory of 4608 4024 dpvpj.exe lxfrlfx.exe PID 4024 wrote to memory of 4608 4024 dpvpj.exe lxfrlfx.exe PID 4608 wrote to memory of 2604 4608 lxfrlfx.exe bhhtnh.exe PID 4608 wrote to memory of 2604 4608 lxfrlfx.exe bhhtnh.exe PID 4608 wrote to memory of 2604 4608 lxfrlfx.exe bhhtnh.exe PID 2604 wrote to memory of 1972 2604 bhhtnh.exe jjjdv.exe PID 2604 wrote to memory of 1972 2604 bhhtnh.exe jjjdv.exe PID 2604 wrote to memory of 1972 2604 bhhtnh.exe jjjdv.exe PID 1972 wrote to memory of 1044 1972 jjjdv.exe 3fxlrxr.exe PID 1972 wrote to memory of 1044 1972 jjjdv.exe 3fxlrxr.exe PID 1972 wrote to memory of 1044 1972 jjjdv.exe 3fxlrxr.exe PID 1044 wrote to memory of 712 1044 3fxlrxr.exe fxxrlxr.exe PID 1044 wrote to memory of 712 1044 3fxlrxr.exe fxxrlxr.exe PID 1044 wrote to memory of 712 1044 3fxlrxr.exe fxxrlxr.exe PID 712 wrote to memory of 4552 712 fxxrlxr.exe bhhbnn.exe PID 712 wrote to memory of 4552 712 fxxrlxr.exe bhhbnn.exe PID 712 wrote to memory of 4552 712 fxxrlxr.exe bhhbnn.exe PID 4552 wrote to memory of 4076 4552 bhhbnn.exe lxfllxr.exe PID 4552 wrote to memory of 4076 4552 bhhbnn.exe lxfllxr.exe PID 4552 wrote to memory of 4076 4552 bhhbnn.exe lxfllxr.exe PID 4076 wrote to memory of 3544 4076 lxfllxr.exe rrrfxrf.exe PID 4076 wrote to memory of 3544 4076 lxfllxr.exe rrrfxrf.exe PID 4076 wrote to memory of 3544 4076 lxfllxr.exe rrrfxrf.exe PID 3544 wrote to memory of 4976 3544 rrrfxrf.exe nntbth.exe PID 3544 wrote to memory of 4976 3544 rrrfxrf.exe nntbth.exe PID 3544 wrote to memory of 4976 3544 rrrfxrf.exe nntbth.exe PID 4976 wrote to memory of 2720 4976 nntbth.exe lrfrlfr.exe PID 4976 wrote to memory of 2720 4976 nntbth.exe lrfrlfr.exe PID 4976 wrote to memory of 2720 4976 nntbth.exe lrfrlfr.exe PID 2720 wrote to memory of 1012 2720 lrfrlfr.exe 5ffrrfx.exe PID 2720 wrote to memory of 1012 2720 lrfrlfr.exe 5ffrrfx.exe PID 2720 wrote to memory of 1012 2720 lrfrlfr.exe 5ffrrfx.exe PID 1012 wrote to memory of 2012 1012 5ffrrfx.exe nbnntb.exe PID 1012 wrote to memory of 2012 1012 5ffrrfx.exe nbnntb.exe PID 1012 wrote to memory of 2012 1012 5ffrrfx.exe nbnntb.exe PID 2012 wrote to memory of 1452 2012 nbnntb.exe dvpdp.exe PID 2012 wrote to memory of 1452 2012 nbnntb.exe dvpdp.exe PID 2012 wrote to memory of 1452 2012 nbnntb.exe dvpdp.exe PID 1452 wrote to memory of 4712 1452 dvpdp.exe pdvpd.exe PID 1452 wrote to memory of 4712 1452 dvpdp.exe pdvpd.exe PID 1452 wrote to memory of 4712 1452 dvpdp.exe pdvpd.exe PID 4712 wrote to memory of 5000 4712 pdvpd.exe lfrfrlf.exe PID 4712 wrote to memory of 5000 4712 pdvpd.exe lfrfrlf.exe PID 4712 wrote to memory of 5000 4712 pdvpd.exe lfrfrlf.exe PID 5000 wrote to memory of 4636 5000 lfrfrlf.exe xlxlxrl.exe PID 5000 wrote to memory of 4636 5000 lfrfrlf.exe xlxlxrl.exe PID 5000 wrote to memory of 4636 5000 lfrfrlf.exe xlxlxrl.exe PID 4636 wrote to memory of 448 4636 xlxlxrl.exe 1nnhtn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddde86cb0a38646bd51c690c802ed3e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ddde86cb0a38646bd51c690c802ed3e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\xfxfrfx.exec:\xfxfrfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\bnhbnh.exec:\bnhbnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\1nbntn.exec:\1nbntn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\3ppdv.exec:\3ppdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\dpvpj.exec:\dpvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\lxfrlfx.exec:\lxfrlfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\bhhtnh.exec:\bhhtnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\jjjdv.exec:\jjjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\3fxlrxr.exec:\3fxlrxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\fxxrlxr.exec:\fxxrlxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\bhhbnn.exec:\bhhbnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\lxfllxr.exec:\lxfllxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\rrrfxrf.exec:\rrrfxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\nntbth.exec:\nntbth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\lrfrlfr.exec:\lrfrlfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\5ffrrfx.exec:\5ffrrfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\nbnntb.exec:\nbnntb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\dvpdp.exec:\dvpdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\pdvpd.exec:\pdvpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\lfrfrlf.exec:\lfrfrlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\xlxlxrl.exec:\xlxlxrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\1nnhtn.exec:\1nnhtn.exe23⤵
- Executes dropped EXE
PID:448 -
\??\c:\9pvjv.exec:\9pvjv.exe24⤵
- Executes dropped EXE
PID:372 -
\??\c:\3ppdp.exec:\3ppdp.exe25⤵
- Executes dropped EXE
PID:1188 -
\??\c:\xlllfxf.exec:\xlllfxf.exe26⤵
- Executes dropped EXE
PID:4216 -
\??\c:\3hnhtn.exec:\3hnhtn.exe27⤵
- Executes dropped EXE
PID:508 -
\??\c:\pvpjd.exec:\pvpjd.exe28⤵
- Executes dropped EXE
PID:2264 -
\??\c:\ppvpv.exec:\ppvpv.exe29⤵
- Executes dropped EXE
PID:4060 -
\??\c:\xxxrxxr.exec:\xxxrxxr.exe30⤵
- Executes dropped EXE
PID:2884 -
\??\c:\lxfrfxr.exec:\lxfrfxr.exe31⤵
- Executes dropped EXE
PID:3080 -
\??\c:\bhtnnh.exec:\bhtnnh.exe32⤵
- Executes dropped EXE
PID:716 -
\??\c:\htbthh.exec:\htbthh.exe33⤵
- Executes dropped EXE
PID:872 -
\??\c:\pvdvp.exec:\pvdvp.exe34⤵
- Executes dropped EXE
PID:3252 -
\??\c:\jvdvv.exec:\jvdvv.exe35⤵
- Executes dropped EXE
PID:4792 -
\??\c:\3ffrlrr.exec:\3ffrlrr.exe36⤵
- Executes dropped EXE
PID:4680 -
\??\c:\tbthtn.exec:\tbthtn.exe37⤵
- Executes dropped EXE
PID:552 -
\??\c:\7hnhbh.exec:\7hnhbh.exe38⤵
- Executes dropped EXE
PID:4824 -
\??\c:\pddjd.exec:\pddjd.exe39⤵
- Executes dropped EXE
PID:2412 -
\??\c:\vdvdv.exec:\vdvdv.exe40⤵
- Executes dropped EXE
PID:3788 -
\??\c:\3rlfllx.exec:\3rlfllx.exe41⤵
- Executes dropped EXE
PID:4056 -
\??\c:\lxrxxff.exec:\lxrxxff.exe42⤵
- Executes dropped EXE
PID:4724 -
\??\c:\btbntn.exec:\btbntn.exe43⤵
- Executes dropped EXE
PID:3676 -
\??\c:\nhbnhh.exec:\nhbnhh.exe44⤵
- Executes dropped EXE
PID:4208 -
\??\c:\jpdpj.exec:\jpdpj.exe45⤵
- Executes dropped EXE
PID:4544 -
\??\c:\pvppd.exec:\pvppd.exe46⤵
- Executes dropped EXE
PID:1128 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe47⤵
- Executes dropped EXE
PID:3924 -
\??\c:\1frfxrf.exec:\1frfxrf.exe48⤵
- Executes dropped EXE
PID:1972 -
\??\c:\5nnhbh.exec:\5nnhbh.exe49⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vppvd.exec:\vppvd.exe50⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vjdvj.exec:\vjdvj.exe51⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xlfrxxl.exec:\xlfrxxl.exe52⤵
- Executes dropped EXE
PID:424 -
\??\c:\btthbn.exec:\btthbn.exe53⤵
- Executes dropped EXE
PID:3336 -
\??\c:\tbbnbt.exec:\tbbnbt.exe54⤵
- Executes dropped EXE
PID:4124 -
\??\c:\vpdvp.exec:\vpdvp.exe55⤵
- Executes dropped EXE
PID:3544 -
\??\c:\pvpjv.exec:\pvpjv.exe56⤵
- Executes dropped EXE
PID:4484 -
\??\c:\1flxrfx.exec:\1flxrfx.exe57⤵
- Executes dropped EXE
PID:4396 -
\??\c:\rrfxxrf.exec:\rrfxxrf.exe58⤵
- Executes dropped EXE
PID:1900 -
\??\c:\tthbnn.exec:\tthbnn.exe59⤵
- Executes dropped EXE
PID:676 -
\??\c:\btnbnh.exec:\btnbnh.exe60⤵
- Executes dropped EXE
PID:2012 -
\??\c:\jdvjd.exec:\jdvjd.exe61⤵
- Executes dropped EXE
PID:1452 -
\??\c:\rxlfrlf.exec:\rxlfrlf.exe62⤵
- Executes dropped EXE
PID:1788 -
\??\c:\lxrlfxl.exec:\lxrlfxl.exe63⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xrrfxrl.exec:\xrrfxrl.exe64⤵
- Executes dropped EXE
PID:3212 -
\??\c:\5thbnh.exec:\5thbnh.exe65⤵
- Executes dropped EXE
PID:2384 -
\??\c:\bththb.exec:\bththb.exe66⤵PID:3556
-
\??\c:\5pdvd.exec:\5pdvd.exe67⤵PID:3684
-
\??\c:\pvppj.exec:\pvppj.exe68⤵PID:4364
-
\??\c:\7lfrxrl.exec:\7lfrxrl.exe69⤵PID:1224
-
\??\c:\rxfxrll.exec:\rxfxrll.exe70⤵PID:812
-
\??\c:\tnhtnh.exec:\tnhtnh.exe71⤵PID:396
-
\??\c:\1nbbhh.exec:\1nbbhh.exe72⤵PID:2724
-
\??\c:\pvvpd.exec:\pvvpd.exe73⤵PID:2712
-
\??\c:\jdjdp.exec:\jdjdp.exe74⤵PID:1268
-
\??\c:\5xxrrlf.exec:\5xxrrlf.exe75⤵PID:3272
-
\??\c:\3xlfrlx.exec:\3xlfrlx.exe76⤵PID:2180
-
\??\c:\llfxrlf.exec:\llfxrlf.exe77⤵PID:3876
-
\??\c:\1hhtnh.exec:\1hhtnh.exe78⤵PID:1944
-
\??\c:\hnthbt.exec:\hnthbt.exe79⤵PID:4756
-
\??\c:\ttnhhb.exec:\ttnhhb.exe80⤵PID:3452
-
\??\c:\7vvpj.exec:\7vvpj.exe81⤵PID:5032
-
\??\c:\vdjdd.exec:\vdjdd.exe82⤵PID:5040
-
\??\c:\5frllrl.exec:\5frllrl.exe83⤵PID:1904
-
\??\c:\rrllrxf.exec:\rrllrxf.exe84⤵PID:552
-
\??\c:\bbhtnh.exec:\bbhtnh.exe85⤵PID:2456
-
\??\c:\dpjdp.exec:\dpjdp.exe86⤵PID:2708
-
\??\c:\vppjv.exec:\vppjv.exe87⤵PID:368
-
\??\c:\rrfxlxr.exec:\rrfxlxr.exe88⤵PID:636
-
\??\c:\5llrfrf.exec:\5llrfrf.exe89⤵PID:2876
-
\??\c:\frrlllx.exec:\frrlllx.exe90⤵PID:4316
-
\??\c:\bttnnh.exec:\bttnnh.exe91⤵PID:2652
-
\??\c:\nhbttn.exec:\nhbttn.exe92⤵PID:4544
-
\??\c:\pvvjp.exec:\pvvjp.exe93⤵PID:4788
-
\??\c:\vpdvp.exec:\vpdvp.exe94⤵PID:3196
-
\??\c:\lrrffrx.exec:\lrrffrx.exe95⤵PID:1676
-
\??\c:\1nnhbt.exec:\1nnhbt.exe96⤵PID:4596
-
\??\c:\vvpjd.exec:\vvpjd.exe97⤵PID:1204
-
\??\c:\7jdpd.exec:\7jdpd.exe98⤵PID:2104
-
\??\c:\lxlxllx.exec:\lxlxllx.exe99⤵PID:436
-
\??\c:\lxxxfxl.exec:\lxxxfxl.exe100⤵PID:1952
-
\??\c:\hnhhnb.exec:\hnhhnb.exe101⤵PID:3544
-
\??\c:\jdpjj.exec:\jdpjj.exe102⤵PID:4484
-
\??\c:\ppjdv.exec:\ppjdv.exe103⤵PID:4252
-
\??\c:\5rxlxrl.exec:\5rxlxrl.exe104⤵PID:1312
-
\??\c:\frrlxxr.exec:\frrlxxr.exe105⤵PID:5116
-
\??\c:\lxrfxrf.exec:\lxrfxrf.exe106⤵PID:2012
-
\??\c:\bnnnth.exec:\bnnnth.exe107⤵PID:4932
-
\??\c:\nhhbht.exec:\nhhbht.exe108⤵PID:1728
-
\??\c:\jdvjv.exec:\jdvjv.exe109⤵PID:1916
-
\??\c:\jvjdp.exec:\jvjdp.exe110⤵PID:3232
-
\??\c:\xffxlfx.exec:\xffxlfx.exe111⤵PID:512
-
\??\c:\rrxrrlf.exec:\rrxrrlf.exe112⤵PID:4668
-
\??\c:\nbbbnn.exec:\nbbbnn.exe113⤵PID:2696
-
\??\c:\9hhbnn.exec:\9hhbnn.exe114⤵PID:1192
-
\??\c:\ntthtt.exec:\ntthtt.exe115⤵PID:3432
-
\??\c:\pdvjv.exec:\pdvjv.exe116⤵PID:4004
-
\??\c:\pvjvp.exec:\pvjvp.exe117⤵PID:4012
-
\??\c:\llfxlfx.exec:\llfxlfx.exe118⤵PID:4060
-
\??\c:\lffxrfx.exec:\lffxrfx.exe119⤵PID:1156
-
\??\c:\httnhb.exec:\httnhb.exe120⤵PID:3696
-
\??\c:\bnnhbt.exec:\bnnhbt.exe121⤵PID:4000
-
\??\c:\hnnhbt.exec:\hnnhbt.exe122⤵PID:1556
-
\??\c:\jjjdv.exec:\jjjdv.exe123⤵PID:3956
-
\??\c:\pvvpj.exec:\pvvpj.exe124⤵PID:4756
-
\??\c:\lrfrfxr.exec:\lrfrfxr.exe125⤵PID:1384
-
\??\c:\frfxrlf.exec:\frfxrlf.exe126⤵PID:2232
-
\??\c:\ttnhbt.exec:\ttnhbt.exe127⤵PID:4680
-
\??\c:\nbtnnh.exec:\nbtnnh.exe128⤵PID:4340
-
\??\c:\thhbth.exec:\thhbth.exe129⤵PID:2716
-
\??\c:\jddpp.exec:\jddpp.exe130⤵PID:1504
-
\??\c:\3dvpd.exec:\3dvpd.exe131⤵PID:4556
-
\??\c:\9rrflxf.exec:\9rrflxf.exe132⤵PID:4808
-
\??\c:\1xrlfxx.exec:\1xrlfxx.exe133⤵PID:4024
-
\??\c:\nhbtnt.exec:\nhbtnt.exe134⤵PID:2876
-
\??\c:\3nhthh.exec:\3nhthh.exe135⤵PID:3980
-
\??\c:\hnnhtt.exec:\hnnhtt.exe136⤵PID:2324
-
\??\c:\ppddj.exec:\ppddj.exe137⤵PID:5084
-
\??\c:\9jvjp.exec:\9jvjp.exe138⤵PID:4700
-
\??\c:\1xxfrlx.exec:\1xxfrlx.exe139⤵PID:1036
-
\??\c:\3llrlfx.exec:\3llrlfx.exe140⤵PID:3472
-
\??\c:\xxxrrlf.exec:\xxxrrlf.exe141⤵PID:4568
-
\??\c:\bnhtnh.exec:\bnhtnh.exe142⤵PID:3032
-
\??\c:\nbtntt.exec:\nbtntt.exe143⤵PID:4088
-
\??\c:\djpvp.exec:\djpvp.exe144⤵PID:1996
-
\??\c:\vddpj.exec:\vddpj.exe145⤵PID:4524
-
\??\c:\xrrrlxr.exec:\xrrrlxr.exe146⤵PID:3004
-
\??\c:\fffxrlf.exec:\fffxrlf.exe147⤵PID:4484
-
\??\c:\hnnhbh.exec:\hnnhbh.exe148⤵PID:1008
-
\??\c:\3hbnbt.exec:\3hbnbt.exe149⤵PID:1600
-
\??\c:\djdvp.exec:\djdvp.exe150⤵PID:5116
-
\??\c:\vdvpv.exec:\vdvpv.exe151⤵PID:3596
-
\??\c:\fxlxfxx.exec:\fxlxfxx.exe152⤵PID:2040
-
\??\c:\5tthtt.exec:\5tthtt.exe153⤵PID:1924
-
\??\c:\vppdp.exec:\vppdp.exe154⤵PID:624
-
\??\c:\9dvpd.exec:\9dvpd.exe155⤵PID:372
-
\??\c:\dvjdp.exec:\dvjdp.exe156⤵PID:3428
-
\??\c:\lffxlff.exec:\lffxlff.exe157⤵PID:3944
-
\??\c:\dvjpp.exec:\dvjpp.exe158⤵PID:3220
-
\??\c:\7btnbt.exec:\7btnbt.exe159⤵PID:4224
-
\??\c:\jppdp.exec:\jppdp.exe160⤵PID:396
-
\??\c:\xrlxfxl.exec:\xrlxfxl.exe161⤵PID:3400
-
\??\c:\frrfflr.exec:\frrfflr.exe162⤵PID:3108
-
\??\c:\nnhbnn.exec:\nnhbnn.exe163⤵PID:2288
-
\??\c:\btthbt.exec:\btthbt.exe164⤵PID:2884
-
\??\c:\5vdpp.exec:\5vdpp.exe165⤵PID:4520
-
\??\c:\vvvjj.exec:\vvvjj.exe166⤵PID:996
-
\??\c:\5fxlrxl.exec:\5fxlrxl.exe167⤵PID:4848
-
\??\c:\rrrlxrl.exec:\rrrlxrl.exe168⤵PID:3116
-
\??\c:\nbtnnb.exec:\nbtnnb.exe169⤵PID:3252
-
\??\c:\3dvpp.exec:\3dvpp.exe170⤵PID:2636
-
\??\c:\jpjpj.exec:\jpjpj.exe171⤵PID:2036
-
\??\c:\vpjdp.exec:\vpjdp.exe172⤵PID:4824
-
\??\c:\rlxlxxl.exec:\rlxlxxl.exe173⤵PID:552
-
\??\c:\rrlrlrl.exec:\rrlrlrl.exe174⤵PID:368
-
\??\c:\tbbbnb.exec:\tbbbnb.exe175⤵PID:1252
-
\??\c:\7nhhhh.exec:\7nhhhh.exe176⤵PID:2948
-
\??\c:\7jpvp.exec:\7jpvp.exe177⤵PID:2604
-
\??\c:\vpvpd.exec:\vpvpd.exe178⤵PID:5048
-
\??\c:\fxxlxxl.exec:\fxxlxxl.exe179⤵PID:4788
-
\??\c:\nttnhb.exec:\nttnhb.exe180⤵PID:3396
-
\??\c:\vjpjd.exec:\vjpjd.exe181⤵PID:4092
-
\??\c:\9flxrff.exec:\9flxrff.exe182⤵PID:712
-
\??\c:\9xrrllf.exec:\9xrrllf.exe183⤵PID:4116
-
\??\c:\tnnnhh.exec:\tnnnhh.exe184⤵PID:540
-
\??\c:\nhbthb.exec:\nhbthb.exe185⤵PID:2320
-
\??\c:\vjjjd.exec:\vjjjd.exe186⤵PID:2296
-
\??\c:\vpjdd.exec:\vpjdd.exe187⤵PID:3544
-
\??\c:\xxxrxrl.exec:\xxxrxrl.exe188⤵PID:4524
-
\??\c:\5xfxxxx.exec:\5xfxxxx.exe189⤵PID:3560
-
\??\c:\rlxxffl.exec:\rlxxffl.exe190⤵PID:1416
-
\??\c:\ttbttn.exec:\ttbttn.exe191⤵PID:2448
-
\??\c:\vvvvp.exec:\vvvvp.exe192⤵PID:1452
-
\??\c:\dvvvp.exec:\dvvvp.exe193⤵PID:5012
-
\??\c:\xrfflrx.exec:\xrfflrx.exe194⤵PID:3492
-
\??\c:\rrrrlll.exec:\rrrrlll.exe195⤵PID:448
-
\??\c:\bbhhhh.exec:\bbhhhh.exe196⤵PID:3684
-
\??\c:\5ntnnn.exec:\5ntnnn.exe197⤵PID:4212
-
\??\c:\jdjjv.exec:\jdjjv.exe198⤵PID:2164
-
\??\c:\vpvvd.exec:\vpvvd.exe199⤵PID:2264
-
\??\c:\5ddvj.exec:\5ddvj.exe200⤵PID:320
-
\??\c:\lxxrlxr.exec:\lxxrlxr.exe201⤵PID:396
-
\??\c:\xrrrlll.exec:\xrrrlll.exe202⤵PID:3376
-
\??\c:\9tbtbb.exec:\9tbtbb.exe203⤵PID:3904
-
\??\c:\3pvvp.exec:\3pvvp.exe204⤵PID:1768
-
\??\c:\vjpjp.exec:\vjpjp.exe205⤵PID:3876
-
\??\c:\xrfxrrr.exec:\xrfxrrr.exe206⤵PID:4520
-
\??\c:\xlllfff.exec:\xlllfff.exe207⤵PID:2096
-
\??\c:\nnnhbb.exec:\nnnhbb.exe208⤵PID:1584
-
\??\c:\thtntn.exec:\thtntn.exe209⤵PID:4456
-
\??\c:\3ntnhh.exec:\3ntnhh.exe210⤵PID:1904
-
\??\c:\dvvjv.exec:\dvvjv.exe211⤵PID:2128
-
\??\c:\5vvjd.exec:\5vvjd.exe212⤵PID:4340
-
\??\c:\fxlrrxx.exec:\fxlrrxx.exe213⤵PID:3040
-
\??\c:\xrxxffl.exec:\xrxxffl.exe214⤵PID:552
-
\??\c:\9nttnn.exec:\9nttnn.exe215⤵PID:3692
-
\??\c:\tnnhnh.exec:\tnnhnh.exe216⤵PID:1648
-
\??\c:\pjvjj.exec:\pjvjj.exe217⤵PID:3260
-
\??\c:\dppdd.exec:\dppdd.exe218⤵PID:2804
-
\??\c:\dvjvp.exec:\dvjvp.exe219⤵PID:4548
-
\??\c:\5lrlflr.exec:\5lrlflr.exe220⤵PID:1040
-
\??\c:\btnnhh.exec:\btnnhh.exe221⤵PID:4568
-
\??\c:\hthbhh.exec:\hthbhh.exe222⤵PID:2664
-
\??\c:\nhtbtb.exec:\nhtbtb.exe223⤵PID:3460
-
\??\c:\vdjjj.exec:\vdjjj.exe224⤵PID:2296
-
\??\c:\3ddvj.exec:\3ddvj.exe225⤵PID:3028
-
\??\c:\frxrfxx.exec:\frxrfxx.exe226⤵PID:3120
-
\??\c:\1frlxxl.exec:\1frlxxl.exe227⤵PID:1984
-
\??\c:\tttnnn.exec:\tttnnn.exe228⤵PID:3964
-
\??\c:\nhhhbh.exec:\nhhhbh.exe229⤵PID:1532
-
\??\c:\thbthh.exec:\thbthh.exe230⤵PID:2384
-
\??\c:\3dddv.exec:\3dddv.exe231⤵PID:1188
-
\??\c:\vvppj.exec:\vvppj.exe232⤵PID:624
-
\??\c:\llrlfxx.exec:\llrlfxx.exe233⤵PID:3724
-
\??\c:\frfxrlf.exec:\frfxrlf.exe234⤵PID:4212
-
\??\c:\rxflfff.exec:\rxflfff.exe235⤵PID:4324
-
\??\c:\tntttt.exec:\tntttt.exe236⤵PID:2724
-
\??\c:\vdvpp.exec:\vdvpp.exe237⤵PID:680
-
\??\c:\pjjdv.exec:\pjjdv.exe238⤵PID:2800
-
\??\c:\xrxxffl.exec:\xrxxffl.exe239⤵PID:408
-
\??\c:\lflfrfr.exec:\lflfrfr.exe240⤵PID:2884
-
\??\c:\tbtbtn.exec:\tbtbtn.exe241⤵PID:4504
-
\??\c:\nhbbtt.exec:\nhbbtt.exe242⤵PID:2020