Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 20:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b197561305b5d0d81936568344229e0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0b197561305b5d0d81936568344229e0_NeikiAnalytics.exe
-
Size
55KB
-
MD5
0b197561305b5d0d81936568344229e0
-
SHA1
ed43c6508dce4dad6697df5a27660a0d4abb8cd6
-
SHA256
43ee29e67a23093436b15fc4b30767d8e5e1117e46fddbb595ed3768cd000ff0
-
SHA512
4bd600b94f4e3aaf8a947d7960b49accc0960171570a2accebf62746cce7c173bbdbea981997b29db160d4e0ecc4e75052baec3198b3897fc52b7c0ad745dc2a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfEVp:ymb3NkkiQ3mdBjFI0
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/1676-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/688-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-28-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1088-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/848-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tnbttn.exepjpdd.exerfffxxx.exelfllllf.exejvddp.exeddjpj.exerlrrffx.exe9bhhnn.exenhhbnn.exerflfxlf.exenthhbb.exejvvvp.exe7lllrrx.exehhhbnh.exebnthbb.exevvjdp.exepppjp.exelxflfrl.exetnbbbn.exebbhbtt.exepvpjp.exelfxrfff.exellfrllx.exehbttnn.exeppppv.exejdvjd.exebbbtbt.exetnhhbb.exedvpdj.exexrrlffx.exe9xllxff.exe5bbbbt.exe3htnhh.exedjvpj.exexrlfrrr.exebtttbt.exe5bbbth.exepdjjv.exerlflxxr.exethtnbt.exetnnhhh.exevvpjj.exe9xxlxxr.exe1frxffl.exentbbtt.exe7bhbbt.exevddjv.exerxlfffl.exetnnhbt.exevpjvj.exedppjp.exe1ffrffr.exerrllfxr.exebnnhbh.exe3pdvp.exe9vvpp.exe9xxxlll.exebbhbht.exe7nhnbb.exedvvpd.exeppjdd.exefrlrfrl.exetbhnbb.exehbhnhh.exepid process 3692 tnbttn.exe 688 pjpdd.exe 4912 rfffxxx.exe 3116 lfllllf.exe 2184 jvddp.exe 3500 ddjpj.exe 2732 rlrrffx.exe 5000 9bhhnn.exe 2808 nhhbnn.exe 4420 rflfxlf.exe 2956 nthhbb.exe 3396 jvvvp.exe 2760 7lllrrx.exe 1620 hhhbnh.exe 1468 bnthbb.exe 912 vvjdp.exe 4736 pppjp.exe 4612 lxflfrl.exe 3672 tnbbbn.exe 1764 bbhbtt.exe 1016 pvpjp.exe 4452 lfxrfff.exe 1456 llfrllx.exe 3508 hbttnn.exe 2768 ppppv.exe 3156 jdvjd.exe 1088 bbbtbt.exe 2764 tnhhbb.exe 848 dvpdj.exe 2364 xrrlffx.exe 4720 9xllxff.exe 4020 5bbbbt.exe 4848 3htnhh.exe 2712 djvpj.exe 2332 xrlfrrr.exe 3284 btttbt.exe 1528 5bbbth.exe 4624 pdjjv.exe 3620 rlflxxr.exe 4992 thtnbt.exe 2796 tnnhhh.exe 3500 vvpjj.exe 2592 9xxlxxr.exe 2732 1frxffl.exe 5000 ntbbtt.exe 2104 7bhbbt.exe 4256 vddjv.exe 4392 rxlfffl.exe 1028 tnnhbt.exe 2908 vpjvj.exe 3396 dppjp.exe 2760 1ffrffr.exe 956 rrllfxr.exe 2792 bnnhbh.exe 2824 3pdvp.exe 884 9vvpp.exe 4920 9xxxlll.exe 4424 bbhbht.exe 4692 7nhnbb.exe 1764 dvvpd.exe 1312 ppjdd.exe 3492 frlrfrl.exe 1444 tbhnbb.exe 4556 hbhnhh.exe -
Processes:
resource yara_rule behavioral2/memory/1676-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1088-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/848-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0b197561305b5d0d81936568344229e0_NeikiAnalytics.exetnbttn.exepjpdd.exerfffxxx.exelfllllf.exejvddp.exeddjpj.exerlrrffx.exe9bhhnn.exenhhbnn.exerflfxlf.exenthhbb.exejvvvp.exe7lllrrx.exehhhbnh.exebnthbb.exevvjdp.exepppjp.exelxflfrl.exetnbbbn.exebbhbtt.exepvpjp.exedescription pid process target process PID 1676 wrote to memory of 3692 1676 0b197561305b5d0d81936568344229e0_NeikiAnalytics.exe tnbttn.exe PID 1676 wrote to memory of 3692 1676 0b197561305b5d0d81936568344229e0_NeikiAnalytics.exe tnbttn.exe PID 1676 wrote to memory of 3692 1676 0b197561305b5d0d81936568344229e0_NeikiAnalytics.exe tnbttn.exe PID 3692 wrote to memory of 688 3692 tnbttn.exe pjpdd.exe PID 3692 wrote to memory of 688 3692 tnbttn.exe pjpdd.exe PID 3692 wrote to memory of 688 3692 tnbttn.exe pjpdd.exe PID 688 wrote to memory of 4912 688 pjpdd.exe rfffxxx.exe PID 688 wrote to memory of 4912 688 pjpdd.exe rfffxxx.exe PID 688 wrote to memory of 4912 688 pjpdd.exe rfffxxx.exe PID 4912 wrote to memory of 3116 4912 rfffxxx.exe lfllllf.exe PID 4912 wrote to memory of 3116 4912 rfffxxx.exe lfllllf.exe PID 4912 wrote to memory of 3116 4912 rfffxxx.exe lfllllf.exe PID 3116 wrote to memory of 2184 3116 lfllllf.exe jvddp.exe PID 3116 wrote to memory of 2184 3116 lfllllf.exe jvddp.exe PID 3116 wrote to memory of 2184 3116 lfllllf.exe jvddp.exe PID 2184 wrote to memory of 3500 2184 jvddp.exe ddjpj.exe PID 2184 wrote to memory of 3500 2184 jvddp.exe ddjpj.exe PID 2184 wrote to memory of 3500 2184 jvddp.exe ddjpj.exe PID 3500 wrote to memory of 2732 3500 ddjpj.exe rlrrffx.exe PID 3500 wrote to memory of 2732 3500 ddjpj.exe rlrrffx.exe PID 3500 wrote to memory of 2732 3500 ddjpj.exe rlrrffx.exe PID 2732 wrote to memory of 5000 2732 rlrrffx.exe 9bhhnn.exe PID 2732 wrote to memory of 5000 2732 rlrrffx.exe 9bhhnn.exe PID 2732 wrote to memory of 5000 2732 rlrrffx.exe 9bhhnn.exe PID 5000 wrote to memory of 2808 5000 9bhhnn.exe nhhbnn.exe PID 5000 wrote to memory of 2808 5000 9bhhnn.exe nhhbnn.exe PID 5000 wrote to memory of 2808 5000 9bhhnn.exe nhhbnn.exe PID 2808 wrote to memory of 4420 2808 nhhbnn.exe rflfxlf.exe PID 2808 wrote to memory of 4420 2808 nhhbnn.exe rflfxlf.exe PID 2808 wrote to memory of 4420 2808 nhhbnn.exe rflfxlf.exe PID 4420 wrote to memory of 2956 4420 rflfxlf.exe nthhbb.exe PID 4420 wrote to memory of 2956 4420 rflfxlf.exe nthhbb.exe PID 4420 wrote to memory of 2956 4420 rflfxlf.exe nthhbb.exe PID 2956 wrote to memory of 3396 2956 nthhbb.exe jvvvp.exe PID 2956 wrote to memory of 3396 2956 nthhbb.exe jvvvp.exe PID 2956 wrote to memory of 3396 2956 nthhbb.exe jvvvp.exe PID 3396 wrote to memory of 2760 3396 jvvvp.exe 7lllrrx.exe PID 3396 wrote to memory of 2760 3396 jvvvp.exe 7lllrrx.exe PID 3396 wrote to memory of 2760 3396 jvvvp.exe 7lllrrx.exe PID 2760 wrote to memory of 1620 2760 7lllrrx.exe hhhbnh.exe PID 2760 wrote to memory of 1620 2760 7lllrrx.exe hhhbnh.exe PID 2760 wrote to memory of 1620 2760 7lllrrx.exe hhhbnh.exe PID 1620 wrote to memory of 1468 1620 hhhbnh.exe bnthbb.exe PID 1620 wrote to memory of 1468 1620 hhhbnh.exe bnthbb.exe PID 1620 wrote to memory of 1468 1620 hhhbnh.exe bnthbb.exe PID 1468 wrote to memory of 912 1468 bnthbb.exe vvjdp.exe PID 1468 wrote to memory of 912 1468 bnthbb.exe vvjdp.exe PID 1468 wrote to memory of 912 1468 bnthbb.exe vvjdp.exe PID 912 wrote to memory of 4736 912 vvjdp.exe pppjp.exe PID 912 wrote to memory of 4736 912 vvjdp.exe pppjp.exe PID 912 wrote to memory of 4736 912 vvjdp.exe pppjp.exe PID 4736 wrote to memory of 4612 4736 pppjp.exe lxflfrl.exe PID 4736 wrote to memory of 4612 4736 pppjp.exe lxflfrl.exe PID 4736 wrote to memory of 4612 4736 pppjp.exe lxflfrl.exe PID 4612 wrote to memory of 3672 4612 lxflfrl.exe tnbbbn.exe PID 4612 wrote to memory of 3672 4612 lxflfrl.exe tnbbbn.exe PID 4612 wrote to memory of 3672 4612 lxflfrl.exe tnbbbn.exe PID 3672 wrote to memory of 1764 3672 tnbbbn.exe bbhbtt.exe PID 3672 wrote to memory of 1764 3672 tnbbbn.exe bbhbtt.exe PID 3672 wrote to memory of 1764 3672 tnbbbn.exe bbhbtt.exe PID 1764 wrote to memory of 1016 1764 bbhbtt.exe pvpjp.exe PID 1764 wrote to memory of 1016 1764 bbhbtt.exe pvpjp.exe PID 1764 wrote to memory of 1016 1764 bbhbtt.exe pvpjp.exe PID 1016 wrote to memory of 4452 1016 pvpjp.exe lfxrfff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b197561305b5d0d81936568344229e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0b197561305b5d0d81936568344229e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\tnbttn.exec:\tnbttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\pjpdd.exec:\pjpdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\rfffxxx.exec:\rfffxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\lfllllf.exec:\lfllllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\jvddp.exec:\jvddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\ddjpj.exec:\ddjpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\rlrrffx.exec:\rlrrffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\9bhhnn.exec:\9bhhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\nhhbnn.exec:\nhhbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\rflfxlf.exec:\rflfxlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\nthhbb.exec:\nthhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\jvvvp.exec:\jvvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\7lllrrx.exec:\7lllrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\hhhbnh.exec:\hhhbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\bnthbb.exec:\bnthbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\vvjdp.exec:\vvjdp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\pppjp.exec:\pppjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\lxflfrl.exec:\lxflfrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\tnbbbn.exec:\tnbbbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\bbhbtt.exec:\bbhbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\pvpjp.exec:\pvpjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\lfxrfff.exec:\lfxrfff.exe23⤵
- Executes dropped EXE
PID:4452 -
\??\c:\llfrllx.exec:\llfrllx.exe24⤵
- Executes dropped EXE
PID:1456 -
\??\c:\hbttnn.exec:\hbttnn.exe25⤵
- Executes dropped EXE
PID:3508 -
\??\c:\ppppv.exec:\ppppv.exe26⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jdvjd.exec:\jdvjd.exe27⤵
- Executes dropped EXE
PID:3156 -
\??\c:\bbbtbt.exec:\bbbtbt.exe28⤵
- Executes dropped EXE
PID:1088 -
\??\c:\tnhhbb.exec:\tnhhbb.exe29⤵
- Executes dropped EXE
PID:2764 -
\??\c:\dvpdj.exec:\dvpdj.exe30⤵
- Executes dropped EXE
PID:848 -
\??\c:\xrrlffx.exec:\xrrlffx.exe31⤵
- Executes dropped EXE
PID:2364 -
\??\c:\9xllxff.exec:\9xllxff.exe32⤵
- Executes dropped EXE
PID:4720 -
\??\c:\5bbbbt.exec:\5bbbbt.exe33⤵
- Executes dropped EXE
PID:4020 -
\??\c:\3htnhh.exec:\3htnhh.exe34⤵
- Executes dropped EXE
PID:4848 -
\??\c:\djvpj.exec:\djvpj.exe35⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xrlfrrr.exec:\xrlfrrr.exe36⤵
- Executes dropped EXE
PID:2332 -
\??\c:\btttbt.exec:\btttbt.exe37⤵
- Executes dropped EXE
PID:3284 -
\??\c:\5bbbth.exec:\5bbbth.exe38⤵
- Executes dropped EXE
PID:1528 -
\??\c:\pdjjv.exec:\pdjjv.exe39⤵
- Executes dropped EXE
PID:4624 -
\??\c:\rlflxxr.exec:\rlflxxr.exe40⤵
- Executes dropped EXE
PID:3620 -
\??\c:\thtnbt.exec:\thtnbt.exe41⤵
- Executes dropped EXE
PID:4992 -
\??\c:\tnnhhh.exec:\tnnhhh.exe42⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vvpjj.exec:\vvpjj.exe43⤵
- Executes dropped EXE
PID:3500 -
\??\c:\9xxlxxr.exec:\9xxlxxr.exe44⤵
- Executes dropped EXE
PID:2592 -
\??\c:\1frxffl.exec:\1frxffl.exe45⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ntbbtt.exec:\ntbbtt.exe46⤵
- Executes dropped EXE
PID:5000 -
\??\c:\7bhbbt.exec:\7bhbbt.exe47⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vddjv.exec:\vddjv.exe48⤵
- Executes dropped EXE
PID:4256 -
\??\c:\rxlfffl.exec:\rxlfffl.exe49⤵
- Executes dropped EXE
PID:4392 -
\??\c:\tnnhbt.exec:\tnnhbt.exe50⤵
- Executes dropped EXE
PID:1028 -
\??\c:\vpjvj.exec:\vpjvj.exe51⤵
- Executes dropped EXE
PID:2908 -
\??\c:\dppjp.exec:\dppjp.exe52⤵
- Executes dropped EXE
PID:3396 -
\??\c:\1ffrffr.exec:\1ffrffr.exe53⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rrllfxr.exec:\rrllfxr.exe54⤵
- Executes dropped EXE
PID:956 -
\??\c:\bnnhbh.exec:\bnnhbh.exe55⤵
- Executes dropped EXE
PID:2792 -
\??\c:\3pdvp.exec:\3pdvp.exe56⤵
- Executes dropped EXE
PID:2824 -
\??\c:\9vvpp.exec:\9vvpp.exe57⤵
- Executes dropped EXE
PID:884 -
\??\c:\9xxxlll.exec:\9xxxlll.exe58⤵
- Executes dropped EXE
PID:4920 -
\??\c:\bbhbht.exec:\bbhbht.exe59⤵
- Executes dropped EXE
PID:4424 -
\??\c:\7nhnbb.exec:\7nhnbb.exe60⤵
- Executes dropped EXE
PID:4692 -
\??\c:\dvvpd.exec:\dvvpd.exe61⤵
- Executes dropped EXE
PID:1764 -
\??\c:\ppjdd.exec:\ppjdd.exe62⤵
- Executes dropped EXE
PID:1312 -
\??\c:\frlrfrl.exec:\frlrfrl.exe63⤵
- Executes dropped EXE
PID:3492 -
\??\c:\tbhnbb.exec:\tbhnbb.exe64⤵
- Executes dropped EXE
PID:1444 -
\??\c:\hbhnhh.exec:\hbhnhh.exe65⤵
- Executes dropped EXE
PID:4556 -
\??\c:\djjjv.exec:\djjjv.exe66⤵PID:3508
-
\??\c:\xlrlfff.exec:\xlrlfff.exe67⤵PID:2580
-
\??\c:\5ttnnn.exec:\5ttnnn.exe68⤵PID:800
-
\??\c:\tbnnbb.exec:\tbnnbb.exe69⤵PID:1288
-
\??\c:\httnhh.exec:\httnhh.exe70⤵PID:4240
-
\??\c:\dvpdd.exec:\dvpdd.exe71⤵PID:944
-
\??\c:\lxxrffx.exec:\lxxrffx.exe72⤵PID:4248
-
\??\c:\5lrrrfr.exec:\5lrrrfr.exe73⤵PID:860
-
\??\c:\tntbhh.exec:\tntbhh.exe74⤵PID:3940
-
\??\c:\btnnhh.exec:\btnnhh.exe75⤵PID:3392
-
\??\c:\vjppd.exec:\vjppd.exe76⤵PID:4336
-
\??\c:\vdpjj.exec:\vdpjj.exe77⤵PID:3888
-
\??\c:\rffxrrl.exec:\rffxrrl.exe78⤵PID:3416
-
\??\c:\frfxrrl.exec:\frfxrrl.exe79⤵PID:4636
-
\??\c:\1nbttt.exec:\1nbttt.exe80⤵PID:3620
-
\??\c:\7vppj.exec:\7vppj.exe81⤵PID:4908
-
\??\c:\pppdv.exec:\pppdv.exe82⤵PID:2404
-
\??\c:\rllllfl.exec:\rllllfl.exe83⤵PID:3684
-
\??\c:\hbbttt.exec:\hbbttt.exe84⤵PID:732
-
\??\c:\ntthtt.exec:\ntthtt.exe85⤵PID:696
-
\??\c:\bbbtnh.exec:\bbbtnh.exe86⤵PID:960
-
\??\c:\dvpvj.exec:\dvpvj.exe87⤵PID:660
-
\??\c:\lfxrffx.exec:\lfxrffx.exe88⤵PID:3808
-
\??\c:\xxxrllx.exec:\xxxrllx.exe89⤵PID:2076
-
\??\c:\5hbtnn.exec:\5hbtnn.exe90⤵PID:644
-
\??\c:\nbhnbb.exec:\nbhnbb.exe91⤵PID:1356
-
\??\c:\jjddv.exec:\jjddv.exe92⤵PID:820
-
\??\c:\dpvvp.exec:\dpvvp.exe93⤵PID:3272
-
\??\c:\1rlrlxx.exec:\1rlrlxx.exe94⤵PID:3984
-
\??\c:\fxxrffl.exec:\fxxrffl.exe95⤵PID:1784
-
\??\c:\bbnnhh.exec:\bbnnhh.exe96⤵PID:384
-
\??\c:\dvdjp.exec:\dvdjp.exe97⤵PID:2792
-
\??\c:\3dvpd.exec:\3dvpd.exe98⤵PID:4604
-
\??\c:\vdddj.exec:\vdddj.exe99⤵PID:4580
-
\??\c:\lffrffl.exec:\lffrffl.exe100⤵PID:3672
-
\??\c:\bnntbt.exec:\bnntbt.exe101⤵PID:1396
-
\??\c:\btnttt.exec:\btnttt.exe102⤵PID:1964
-
\??\c:\jdjpp.exec:\jdjpp.exe103⤵PID:4940
-
\??\c:\1jppv.exec:\1jppv.exe104⤵PID:4896
-
\??\c:\lrlfxxr.exec:\lrlfxxr.exe105⤵PID:2844
-
\??\c:\rlxxflr.exec:\rlxxflr.exe106⤵PID:2416
-
\??\c:\bbnhbb.exec:\bbnhbb.exe107⤵PID:3112
-
\??\c:\hbbbth.exec:\hbbbth.exe108⤵PID:3156
-
\??\c:\vpdvv.exec:\vpdvv.exe109⤵PID:3784
-
\??\c:\3jdvv.exec:\3jdvv.exe110⤵PID:3912
-
\??\c:\xflfrxx.exec:\xflfrxx.exe111⤵PID:3456
-
\??\c:\llxlxxl.exec:\llxlxxl.exe112⤵PID:1344
-
\??\c:\hbtnnn.exec:\hbtnnn.exe113⤵PID:3668
-
\??\c:\hbnhhh.exec:\hbnhhh.exe114⤵PID:1704
-
\??\c:\vpdvv.exec:\vpdvv.exe115⤵PID:3408
-
\??\c:\9vvpj.exec:\9vvpj.exe116⤵PID:2476
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe117⤵PID:4028
-
\??\c:\1nthbn.exec:\1nthbn.exe118⤵PID:4400
-
\??\c:\hthhbb.exec:\hthhbb.exe119⤵PID:1508
-
\??\c:\3nhhtt.exec:\3nhhtt.exe120⤵PID:732
-
\??\c:\vppvp.exec:\vppvp.exe121⤵PID:5000
-
\??\c:\5djjj.exec:\5djjj.exe122⤵PID:2072
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe123⤵PID:3232
-
\??\c:\5xlfxxx.exec:\5xlfxxx.exe124⤵PID:4420
-
\??\c:\5tttnn.exec:\5tttnn.exe125⤵PID:1060
-
\??\c:\7hnhtt.exec:\7hnhtt.exe126⤵PID:2852
-
\??\c:\pddvj.exec:\pddvj.exe127⤵PID:616
-
\??\c:\rxlxxxr.exec:\rxlxxxr.exe128⤵PID:700
-
\??\c:\nnnnnb.exec:\nnnnnb.exe129⤵PID:2776
-
\??\c:\pdjjj.exec:\pdjjj.exe130⤵PID:2176
-
\??\c:\pjjdd.exec:\pjjdd.exe131⤵PID:912
-
\??\c:\rlfrfll.exec:\rlfrfll.exe132⤵PID:4612
-
\??\c:\9lxxxxl.exec:\9lxxxxl.exe133⤵PID:2376
-
\??\c:\dvvjj.exec:\dvvjj.exe134⤵PID:2212
-
\??\c:\hthbnn.exec:\hthbnn.exe135⤵PID:4576
-
\??\c:\hhbttn.exec:\hhbttn.exe136⤵PID:4932
-
\??\c:\jjjvd.exec:\jjjvd.exe137⤵PID:1764
-
\??\c:\dddjd.exec:\dddjd.exe138⤵PID:4528
-
\??\c:\9rrlxlf.exec:\9rrlxlf.exe139⤵PID:1492
-
\??\c:\lxffffl.exec:\lxffffl.exe140⤵PID:2144
-
\??\c:\nbhntb.exec:\nbhntb.exe141⤵PID:2632
-
\??\c:\pddvv.exec:\pddvv.exe142⤵PID:3576
-
\??\c:\9pvdj.exec:\9pvdj.exe143⤵PID:932
-
\??\c:\lflfffl.exec:\lflfffl.exe144⤵PID:4232
-
\??\c:\lxfxrll.exec:\lxfxrll.exe145⤵PID:2848
-
\??\c:\bhnbnb.exec:\bhnbnb.exe146⤵PID:1552
-
\??\c:\nnnhbt.exec:\nnnhbt.exe147⤵PID:3332
-
\??\c:\dvpjj.exec:\dvpjj.exe148⤵PID:464
-
\??\c:\rflfffr.exec:\rflfffr.exe149⤵PID:2332
-
\??\c:\fxrrllf.exec:\fxrrllf.exe150⤵PID:3408
-
\??\c:\thnnhh.exec:\thnnhh.exe151⤵PID:4048
-
\??\c:\jddpd.exec:\jddpd.exe152⤵PID:4852
-
\??\c:\pjjdv.exec:\pjjdv.exe153⤵PID:1240
-
\??\c:\lfxrffx.exec:\lfxrffx.exe154⤵PID:3436
-
\??\c:\lrxffll.exec:\lrxffll.exe155⤵PID:732
-
\??\c:\htbttt.exec:\htbttt.exe156⤵PID:1328
-
\??\c:\htbttt.exec:\htbttt.exe157⤵PID:660
-
\??\c:\1jjdd.exec:\1jjdd.exe158⤵PID:2072
-
\??\c:\ppjpd.exec:\ppjpd.exe159⤵PID:2232
-
\??\c:\pvppj.exec:\pvppj.exe160⤵PID:1432
-
\??\c:\fllfxrr.exec:\fllfxrr.exe161⤵PID:3060
-
\??\c:\xrrlfff.exec:\xrrlfff.exe162⤵PID:4488
-
\??\c:\thhbth.exec:\thhbth.exe163⤵PID:2908
-
\??\c:\5nhtnb.exec:\5nhtnb.exe164⤵PID:4816
-
\??\c:\vjvjd.exec:\vjvjd.exe165⤵PID:2856
-
\??\c:\9pdvj.exec:\9pdvj.exe166⤵PID:5076
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe167⤵PID:4920
-
\??\c:\3hnhbb.exec:\3hnhbb.exe168⤵PID:4552
-
\??\c:\hnhtnt.exec:\hnhtnt.exe169⤵PID:4504
-
\??\c:\ddpjd.exec:\ddpjd.exe170⤵PID:744
-
\??\c:\pddvj.exec:\pddvj.exe171⤵PID:1016
-
\??\c:\fffrffl.exec:\fffrffl.exe172⤵PID:3840
-
\??\c:\3xrrrrr.exec:\3xrrrrr.exe173⤵PID:2180
-
\??\c:\rlrrlll.exec:\rlrrlll.exe174⤵PID:1952
-
\??\c:\3bbntn.exec:\3bbntn.exe175⤵PID:2416
-
\??\c:\hbttth.exec:\hbttth.exe176⤵PID:800
-
\??\c:\pdjdd.exec:\pdjdd.exe177⤵PID:1192
-
\??\c:\jdppp.exec:\jdppp.exe178⤵PID:1752
-
\??\c:\vppjj.exec:\vppjj.exe179⤵PID:3912
-
\??\c:\llrlffx.exec:\llrlffx.exe180⤵PID:4532
-
\??\c:\xxlfxxr.exec:\xxlfxxr.exe181⤵PID:1344
-
\??\c:\hbtnhb.exec:\hbtnhb.exe182⤵PID:1676
-
\??\c:\5fffxfx.exec:\5fffxfx.exe183⤵PID:3888
-
\??\c:\xxffrrl.exec:\xxffrrl.exe184⤵PID:4624
-
\??\c:\hbttbb.exec:\hbttbb.exe185⤵PID:2404
-
\??\c:\5tnhbn.exec:\5tnhbn.exe186⤵PID:4400
-
\??\c:\vvvpj.exec:\vvvpj.exe187⤵PID:1948
-
\??\c:\llllllr.exec:\llllllr.exe188⤵PID:3644
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe189⤵PID:4304
-
\??\c:\7hhtnn.exec:\7hhtnn.exe190⤵PID:4364
-
\??\c:\vpvvp.exec:\vpvvp.exe191⤵PID:960
-
\??\c:\djjdd.exec:\djjdd.exe192⤵PID:3808
-
\??\c:\dppjj.exec:\dppjj.exe193⤵PID:4744
-
\??\c:\7xrrflf.exec:\7xrrflf.exe194⤵PID:1356
-
\??\c:\lfrxrrl.exec:\lfrxrrl.exe195⤵PID:2596
-
\??\c:\1nnbbb.exec:\1nnbbb.exe196⤵PID:220
-
\??\c:\nhhtbt.exec:\nhhtbt.exe197⤵PID:1480
-
\??\c:\7jdpv.exec:\7jdpv.exe198⤵PID:1784
-
\??\c:\ddjjv.exec:\ddjjv.exe199⤵PID:2576
-
\??\c:\9rxrffx.exec:\9rxrffx.exe200⤵PID:4696
-
\??\c:\fxrxllf.exec:\fxrxllf.exe201⤵PID:5076
-
\??\c:\nbnhbb.exec:\nbnhbb.exe202⤵PID:4788
-
\??\c:\hbnttb.exec:\hbnttb.exe203⤵PID:3672
-
\??\c:\pvppj.exec:\pvppj.exe204⤵PID:2804
-
\??\c:\ddvpj.exec:\ddvpj.exe205⤵PID:4932
-
\??\c:\lfxrffx.exec:\lfxrffx.exe206⤵PID:380
-
\??\c:\rrfxrrl.exec:\rrfxrrl.exe207⤵PID:4860
-
\??\c:\7nbbtn.exec:\7nbbtn.exe208⤵PID:1492
-
\??\c:\jvvvj.exec:\jvvvj.exe209⤵PID:2580
-
\??\c:\pdjdp.exec:\pdjdp.exe210⤵PID:828
-
\??\c:\9rrrfff.exec:\9rrrfff.exe211⤵PID:1288
-
\??\c:\xxrrllr.exec:\xxrrllr.exe212⤵PID:3932
-
\??\c:\nnhbtt.exec:\nnhbtt.exe213⤵PID:932
-
\??\c:\bnhhhh.exec:\bnhhhh.exe214⤵PID:3800
-
\??\c:\vdpjj.exec:\vdpjj.exe215⤵PID:1004
-
\??\c:\pjpjv.exec:\pjpjv.exe216⤵PID:4380
-
\??\c:\xxlfrrl.exec:\xxlfrrl.exe217⤵PID:1528
-
\??\c:\fxxrllf.exec:\fxxrllf.exe218⤵PID:1676
-
\??\c:\3htnnt.exec:\3htnnt.exe219⤵PID:2476
-
\??\c:\5hnhtn.exec:\5hnhtn.exe220⤵PID:4624
-
\??\c:\vjpjp.exec:\vjpjp.exe221⤵PID:940
-
\??\c:\vdppd.exec:\vdppd.exe222⤵PID:3472
-
\??\c:\vpvpj.exec:\vpvpj.exe223⤵PID:5004
-
\??\c:\5rllxff.exec:\5rllxff.exe224⤵PID:4304
-
\??\c:\9xfxllf.exec:\9xfxllf.exe225⤵PID:4364
-
\??\c:\hbbbbt.exec:\hbbbbt.exe226⤵PID:1448
-
\??\c:\bhbbbb.exec:\bhbbbb.exe227⤵PID:5020
-
\??\c:\dvdvd.exec:\dvdvd.exe228⤵PID:1432
-
\??\c:\9lrllll.exec:\9lrllll.exe229⤵PID:1620
-
\??\c:\7bbbtt.exec:\7bbbtt.exe230⤵PID:852
-
\??\c:\jdjjd.exec:\jdjjd.exe231⤵PID:1728
-
\??\c:\9vpjv.exec:\9vpjv.exe232⤵PID:1480
-
\??\c:\djdpp.exec:\djdpp.exe233⤵PID:2576
-
\??\c:\lfffxfr.exec:\lfffxfr.exe234⤵PID:4920
-
\??\c:\fxrlffx.exec:\fxrlffx.exe235⤵PID:4692
-
\??\c:\bbbbtb.exec:\bbbbtb.exe236⤵PID:1624
-
\??\c:\bttnnn.exec:\bttnnn.exe237⤵PID:4704
-
\??\c:\dpjdv.exec:\dpjdv.exe238⤵PID:5036
-
\??\c:\llrxfxr.exec:\llrxfxr.exe239⤵PID:3492
-
\??\c:\xrrxlfl.exec:\xrrxlfl.exe240⤵PID:4060
-
\??\c:\1nnnnn.exec:\1nnnnn.exe241⤵PID:2788
-