Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 23:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
603f335e2861ba28c89f52716a701860_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
603f335e2861ba28c89f52716a701860_NeikiAnalytics.exe
-
Size
92KB
-
MD5
603f335e2861ba28c89f52716a701860
-
SHA1
c030eafbfd7d4ab95d34e13179040177e839fa47
-
SHA256
c05639d826765df8c4406c8f6969a9d8038dec6157a238934212b96486419263
-
SHA512
4e02916811e5899cb23eccb3e3b57c4972d8c88eb724312b634d5c9717808a241b99cbb4dd0c1729cf9aaba44e940e942f079706e7ca1026e0266b8445f8172a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/21w:ymb3NkkiQ3mdBjFo73PYP1lri3K8Gy
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/4296-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-5-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-9-0x0000000000550000-0x0000000000590000-memory.dmp family_blackmoon behavioral2/memory/2172-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ddppd.exellffxxl.exenbnhhb.exebnbbbb.exevpdvv.exexflxrfl.exe9nttnt.exedvvvp.exe3flfxfl.exettbttt.exenbthtt.exexlxxxfr.exerxlfrlf.exentbttt.exevdvvd.exefrrfxxl.exetbhbbb.exe3hhbbb.exe1pvvj.exexrlllll.exe1xlffff.exebtbbbb.exe3pdvv.exedvvpj.exelflxrxr.exenhnnhh.exejdddd.exepppjd.exerfxxrfl.exehbtbth.exejdvjv.exeffrrxxf.exeflfxrfx.exe9hnhbb.exe5hhhhh.exevppjp.exerlrlfff.exeffxrrrr.exethhbtb.exennbthh.exe1pppp.exejjjjd.exexrrllll.exefxfxxff.exe1hhhbb.exenntnnn.exeddppv.exe9fxxxfx.exerfxrrll.exenhnhbb.exejjppj.exexlrllll.exerrrlflf.exennhhhh.exetbhbnn.exe1jjdd.exe5rlfxff.exelffllll.exehbhhhh.exenhnnnn.exejjjjj.exevdpvv.exeffxxfff.exefxrrrfx.exepid process 2172 ddppd.exe 4268 llffxxl.exe 3100 nbnhhb.exe 2232 bnbbbb.exe 3412 vpdvv.exe 3596 xflxrfl.exe 4640 9nttnt.exe 1072 dvvvp.exe 4232 3flfxfl.exe 2816 ttbttt.exe 116 nbthtt.exe 844 xlxxxfr.exe 2616 rxlfrlf.exe 2772 ntbttt.exe 3492 vdvvd.exe 3580 frrfxxl.exe 4972 tbhbbb.exe 4380 3hhbbb.exe 5012 1pvvj.exe 5064 xrlllll.exe 1456 1xlffff.exe 428 btbbbb.exe 4992 3pdvv.exe 5076 dvvpj.exe 4168 lflxrxr.exe 3324 nhnnhh.exe 2108 jdddd.exe 4944 pppjd.exe 3060 rfxxrfl.exe 4624 hbtbth.exe 3380 jdvjv.exe 1784 ffrrxxf.exe 2692 flfxrfx.exe 2316 9hnhbb.exe 4432 5hhhhh.exe 1800 vppjp.exe 3504 rlrlfff.exe 1852 ffxrrrr.exe 1680 thhbtb.exe 3100 nnbthh.exe 3428 1pppp.exe 3356 jjjjd.exe 3596 xrrllll.exe 2024 fxfxxff.exe 4176 1hhhbb.exe 4364 nntnnn.exe 1624 ddppv.exe 2972 9fxxxfx.exe 4840 rfxrrll.exe 1252 nhnhbb.exe 2168 jjppj.exe 2624 xlrllll.exe 1372 rrrlflf.exe 5004 nnhhhh.exe 3388 tbhbnn.exe 1856 1jjdd.exe 3384 5rlfxff.exe 216 lffllll.exe 3848 hbhhhh.exe 4532 nhnnnn.exe 3324 jjjjj.exe 4948 vdpvv.exe 3224 ffxxfff.exe 3536 fxrrrfx.exe -
Processes:
resource yara_rule behavioral2/memory/4296-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
603f335e2861ba28c89f52716a701860_NeikiAnalytics.exeddppd.exellffxxl.exenbnhhb.exebnbbbb.exevpdvv.exexflxrfl.exe9nttnt.exedvvvp.exe3flfxfl.exettbttt.exenbthtt.exexlxxxfr.exerxlfrlf.exentbttt.exevdvvd.exefrrfxxl.exetbhbbb.exe3hhbbb.exe1pvvj.exexrlllll.exe1xlffff.exedescription pid process target process PID 4296 wrote to memory of 2172 4296 603f335e2861ba28c89f52716a701860_NeikiAnalytics.exe ddppd.exe PID 4296 wrote to memory of 2172 4296 603f335e2861ba28c89f52716a701860_NeikiAnalytics.exe ddppd.exe PID 4296 wrote to memory of 2172 4296 603f335e2861ba28c89f52716a701860_NeikiAnalytics.exe ddppd.exe PID 2172 wrote to memory of 4268 2172 ddppd.exe llffxxl.exe PID 2172 wrote to memory of 4268 2172 ddppd.exe llffxxl.exe PID 2172 wrote to memory of 4268 2172 ddppd.exe llffxxl.exe PID 4268 wrote to memory of 3100 4268 llffxxl.exe nbnhhb.exe PID 4268 wrote to memory of 3100 4268 llffxxl.exe nbnhhb.exe PID 4268 wrote to memory of 3100 4268 llffxxl.exe nbnhhb.exe PID 3100 wrote to memory of 2232 3100 nbnhhb.exe bnbbbb.exe PID 3100 wrote to memory of 2232 3100 nbnhhb.exe bnbbbb.exe PID 3100 wrote to memory of 2232 3100 nbnhhb.exe bnbbbb.exe PID 2232 wrote to memory of 3412 2232 bnbbbb.exe vpdvv.exe PID 2232 wrote to memory of 3412 2232 bnbbbb.exe vpdvv.exe PID 2232 wrote to memory of 3412 2232 bnbbbb.exe vpdvv.exe PID 3412 wrote to memory of 3596 3412 vpdvv.exe xflxrfl.exe PID 3412 wrote to memory of 3596 3412 vpdvv.exe xflxrfl.exe PID 3412 wrote to memory of 3596 3412 vpdvv.exe xflxrfl.exe PID 3596 wrote to memory of 4640 3596 xflxrfl.exe 9nttnt.exe PID 3596 wrote to memory of 4640 3596 xflxrfl.exe 9nttnt.exe PID 3596 wrote to memory of 4640 3596 xflxrfl.exe 9nttnt.exe PID 4640 wrote to memory of 1072 4640 9nttnt.exe dvvvp.exe PID 4640 wrote to memory of 1072 4640 9nttnt.exe dvvvp.exe PID 4640 wrote to memory of 1072 4640 9nttnt.exe dvvvp.exe PID 1072 wrote to memory of 4232 1072 dvvvp.exe 3flfxfl.exe PID 1072 wrote to memory of 4232 1072 dvvvp.exe 3flfxfl.exe PID 1072 wrote to memory of 4232 1072 dvvvp.exe 3flfxfl.exe PID 4232 wrote to memory of 2816 4232 3flfxfl.exe ttbttt.exe PID 4232 wrote to memory of 2816 4232 3flfxfl.exe ttbttt.exe PID 4232 wrote to memory of 2816 4232 3flfxfl.exe ttbttt.exe PID 2816 wrote to memory of 116 2816 ttbttt.exe nbthtt.exe PID 2816 wrote to memory of 116 2816 ttbttt.exe nbthtt.exe PID 2816 wrote to memory of 116 2816 ttbttt.exe nbthtt.exe PID 116 wrote to memory of 844 116 nbthtt.exe xlxxxfr.exe PID 116 wrote to memory of 844 116 nbthtt.exe xlxxxfr.exe PID 116 wrote to memory of 844 116 nbthtt.exe xlxxxfr.exe PID 844 wrote to memory of 2616 844 xlxxxfr.exe rxlfrlf.exe PID 844 wrote to memory of 2616 844 xlxxxfr.exe rxlfrlf.exe PID 844 wrote to memory of 2616 844 xlxxxfr.exe rxlfrlf.exe PID 2616 wrote to memory of 2772 2616 rxlfrlf.exe ntbttt.exe PID 2616 wrote to memory of 2772 2616 rxlfrlf.exe ntbttt.exe PID 2616 wrote to memory of 2772 2616 rxlfrlf.exe ntbttt.exe PID 2772 wrote to memory of 3492 2772 ntbttt.exe vdvvd.exe PID 2772 wrote to memory of 3492 2772 ntbttt.exe vdvvd.exe PID 2772 wrote to memory of 3492 2772 ntbttt.exe vdvvd.exe PID 3492 wrote to memory of 3580 3492 vdvvd.exe frrfxxl.exe PID 3492 wrote to memory of 3580 3492 vdvvd.exe frrfxxl.exe PID 3492 wrote to memory of 3580 3492 vdvvd.exe frrfxxl.exe PID 3580 wrote to memory of 4972 3580 frrfxxl.exe tbhbbb.exe PID 3580 wrote to memory of 4972 3580 frrfxxl.exe tbhbbb.exe PID 3580 wrote to memory of 4972 3580 frrfxxl.exe tbhbbb.exe PID 4972 wrote to memory of 4380 4972 tbhbbb.exe 3hhbbb.exe PID 4972 wrote to memory of 4380 4972 tbhbbb.exe 3hhbbb.exe PID 4972 wrote to memory of 4380 4972 tbhbbb.exe 3hhbbb.exe PID 4380 wrote to memory of 5012 4380 3hhbbb.exe 1pvvj.exe PID 4380 wrote to memory of 5012 4380 3hhbbb.exe 1pvvj.exe PID 4380 wrote to memory of 5012 4380 3hhbbb.exe 1pvvj.exe PID 5012 wrote to memory of 5064 5012 1pvvj.exe xrlllll.exe PID 5012 wrote to memory of 5064 5012 1pvvj.exe xrlllll.exe PID 5012 wrote to memory of 5064 5012 1pvvj.exe xrlllll.exe PID 5064 wrote to memory of 1456 5064 xrlllll.exe 1xlffff.exe PID 5064 wrote to memory of 1456 5064 xrlllll.exe 1xlffff.exe PID 5064 wrote to memory of 1456 5064 xrlllll.exe 1xlffff.exe PID 1456 wrote to memory of 428 1456 1xlffff.exe btbbbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\603f335e2861ba28c89f52716a701860_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\603f335e2861ba28c89f52716a701860_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\ddppd.exec:\ddppd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\llffxxl.exec:\llffxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\nbnhhb.exec:\nbnhhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\bnbbbb.exec:\bnbbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\vpdvv.exec:\vpdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\xflxrfl.exec:\xflxrfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\9nttnt.exec:\9nttnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\dvvvp.exec:\dvvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\3flfxfl.exec:\3flfxfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\ttbttt.exec:\ttbttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\nbthtt.exec:\nbthtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\xlxxxfr.exec:\xlxxxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\rxlfrlf.exec:\rxlfrlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ntbttt.exec:\ntbttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\vdvvd.exec:\vdvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\frrfxxl.exec:\frrfxxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\tbhbbb.exec:\tbhbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\3hhbbb.exec:\3hhbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\1pvvj.exec:\1pvvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\xrlllll.exec:\xrlllll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\1xlffff.exec:\1xlffff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\btbbbb.exec:\btbbbb.exe23⤵
- Executes dropped EXE
PID:428 -
\??\c:\3pdvv.exec:\3pdvv.exe24⤵
- Executes dropped EXE
PID:4992 -
\??\c:\dvvpj.exec:\dvvpj.exe25⤵
- Executes dropped EXE
PID:5076 -
\??\c:\lflxrxr.exec:\lflxrxr.exe26⤵
- Executes dropped EXE
PID:4168 -
\??\c:\nhnnhh.exec:\nhnnhh.exe27⤵
- Executes dropped EXE
PID:3324 -
\??\c:\jdddd.exec:\jdddd.exe28⤵
- Executes dropped EXE
PID:2108 -
\??\c:\pppjd.exec:\pppjd.exe29⤵
- Executes dropped EXE
PID:4944 -
\??\c:\rfxxrfl.exec:\rfxxrfl.exe30⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hbtbth.exec:\hbtbth.exe31⤵
- Executes dropped EXE
PID:4624 -
\??\c:\jdvjv.exec:\jdvjv.exe32⤵
- Executes dropped EXE
PID:3380 -
\??\c:\ffrrxxf.exec:\ffrrxxf.exe33⤵
- Executes dropped EXE
PID:1784 -
\??\c:\flfxrfx.exec:\flfxrfx.exe34⤵
- Executes dropped EXE
PID:2692 -
\??\c:\9hnhbb.exec:\9hnhbb.exe35⤵
- Executes dropped EXE
PID:2316 -
\??\c:\5hhhhh.exec:\5hhhhh.exe36⤵
- Executes dropped EXE
PID:4432 -
\??\c:\vppjp.exec:\vppjp.exe37⤵
- Executes dropped EXE
PID:1800 -
\??\c:\rlrlfff.exec:\rlrlfff.exe38⤵
- Executes dropped EXE
PID:3504 -
\??\c:\ffxrrrr.exec:\ffxrrrr.exe39⤵
- Executes dropped EXE
PID:1852 -
\??\c:\thhbtb.exec:\thhbtb.exe40⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nnbthh.exec:\nnbthh.exe41⤵
- Executes dropped EXE
PID:3100 -
\??\c:\1pppp.exec:\1pppp.exe42⤵
- Executes dropped EXE
PID:3428 -
\??\c:\jjjjd.exec:\jjjjd.exe43⤵
- Executes dropped EXE
PID:3356 -
\??\c:\xrrllll.exec:\xrrllll.exe44⤵
- Executes dropped EXE
PID:3596 -
\??\c:\fxfxxff.exec:\fxfxxff.exe45⤵
- Executes dropped EXE
PID:2024 -
\??\c:\1hhhbb.exec:\1hhhbb.exe46⤵
- Executes dropped EXE
PID:4176 -
\??\c:\nntnnn.exec:\nntnnn.exe47⤵
- Executes dropped EXE
PID:4364 -
\??\c:\ddppv.exec:\ddppv.exe48⤵
- Executes dropped EXE
PID:1624 -
\??\c:\9fxxxfx.exec:\9fxxxfx.exe49⤵
- Executes dropped EXE
PID:2972 -
\??\c:\rfxrrll.exec:\rfxrrll.exe50⤵
- Executes dropped EXE
PID:4840 -
\??\c:\nhnhbb.exec:\nhnhbb.exe51⤵
- Executes dropped EXE
PID:1252 -
\??\c:\jjppj.exec:\jjppj.exe52⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xlrllll.exec:\xlrllll.exe53⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rrrlflf.exec:\rrrlflf.exe54⤵
- Executes dropped EXE
PID:1372 -
\??\c:\nnhhhh.exec:\nnhhhh.exe55⤵
- Executes dropped EXE
PID:5004 -
\??\c:\tbhbnn.exec:\tbhbnn.exe56⤵
- Executes dropped EXE
PID:3388 -
\??\c:\1jjdd.exec:\1jjdd.exe57⤵
- Executes dropped EXE
PID:1856 -
\??\c:\5rlfxff.exec:\5rlfxff.exe58⤵
- Executes dropped EXE
PID:3384 -
\??\c:\lffllll.exec:\lffllll.exe59⤵
- Executes dropped EXE
PID:216 -
\??\c:\hbhhhh.exec:\hbhhhh.exe60⤵
- Executes dropped EXE
PID:3848 -
\??\c:\nhnnnn.exec:\nhnnnn.exe61⤵
- Executes dropped EXE
PID:4532 -
\??\c:\jjjjj.exec:\jjjjj.exe62⤵
- Executes dropped EXE
PID:3324 -
\??\c:\vdpvv.exec:\vdpvv.exe63⤵
- Executes dropped EXE
PID:4948 -
\??\c:\ffxxfff.exec:\ffxxfff.exe64⤵
- Executes dropped EXE
PID:3224 -
\??\c:\fxrrrfx.exec:\fxrrrfx.exe65⤵
- Executes dropped EXE
PID:3536 -
\??\c:\9nnnhh.exec:\9nnnhh.exe66⤵PID:3276
-
\??\c:\9hnnnt.exec:\9hnnnt.exe67⤵PID:4172
-
\??\c:\hbbhbh.exec:\hbbhbh.exe68⤵PID:952
-
\??\c:\dpvpp.exec:\dpvpp.exe69⤵PID:1784
-
\??\c:\djpjd.exec:\djpjd.exe70⤵PID:544
-
\??\c:\3rrxxxx.exec:\3rrxxxx.exe71⤵PID:1708
-
\??\c:\rfrxrxx.exec:\rfrxrxx.exe72⤵PID:4636
-
\??\c:\hhbhnh.exec:\hhbhnh.exe73⤵PID:5052
-
\??\c:\dvddd.exec:\dvddd.exe74⤵PID:4340
-
\??\c:\pvdvp.exec:\pvdvp.exe75⤵PID:4164
-
\??\c:\llrlrrx.exec:\llrlrrx.exe76⤵PID:4756
-
\??\c:\5fxxrrl.exec:\5fxxrrl.exe77⤵PID:1680
-
\??\c:\tnhbtt.exec:\tnhbtt.exe78⤵PID:3740
-
\??\c:\jvdvp.exec:\jvdvp.exe79⤵PID:736
-
\??\c:\jjpjj.exec:\jjpjj.exe80⤵PID:4640
-
\??\c:\1lllfff.exec:\1lllfff.exe81⤵PID:728
-
\??\c:\3thhhh.exec:\3thhhh.exe82⤵PID:4232
-
\??\c:\nnnnnn.exec:\nnnnnn.exe83⤵PID:4300
-
\??\c:\jvvvd.exec:\jvvvd.exe84⤵PID:460
-
\??\c:\xllrrxx.exec:\xllrrxx.exe85⤵PID:116
-
\??\c:\bnnhhh.exec:\bnnhhh.exe86⤵PID:2852
-
\??\c:\htbttn.exec:\htbttn.exe87⤵PID:4176
-
\??\c:\jjppp.exec:\jjppp.exe88⤵PID:3336
-
\??\c:\vpdvv.exec:\vpdvv.exe89⤵PID:1624
-
\??\c:\rrfxxxx.exec:\rrfxxxx.exe90⤵PID:4596
-
\??\c:\7xxrlll.exec:\7xxrlll.exe91⤵PID:4728
-
\??\c:\nthbtt.exec:\nthbtt.exe92⤵PID:408
-
\??\c:\9jpjv.exec:\9jpjv.exe93⤵PID:4676
-
\??\c:\vpdjj.exec:\vpdjj.exe94⤵PID:3652
-
\??\c:\rlrlllf.exec:\rlrlllf.exe95⤵PID:2512
-
\??\c:\nbhbhh.exec:\nbhbhh.exe96⤵PID:2536
-
\??\c:\5bhbtt.exec:\5bhbtt.exe97⤵PID:4508
-
\??\c:\nthbbb.exec:\nthbbb.exe98⤵PID:1456
-
\??\c:\djpvv.exec:\djpvv.exe99⤵PID:4004
-
\??\c:\jppdv.exec:\jppdv.exe100⤵PID:1764
-
\??\c:\xlxfxxf.exec:\xlxfxxf.exe101⤵PID:3952
-
\??\c:\lxlffxx.exec:\lxlffxx.exe102⤵PID:4168
-
\??\c:\nbnttn.exec:\nbnttn.exe103⤵PID:4440
-
\??\c:\hhbtbh.exec:\hhbtbh.exe104⤵PID:3324
-
\??\c:\pddpj.exec:\pddpj.exe105⤵PID:4948
-
\??\c:\flxrllx.exec:\flxrllx.exe106⤵PID:3256
-
\??\c:\lxffxfx.exec:\lxffxfx.exe107⤵PID:3536
-
\??\c:\ttntth.exec:\ttntth.exe108⤵PID:3276
-
\??\c:\hbtttb.exec:\hbtttb.exe109⤵PID:3440
-
\??\c:\jjjjv.exec:\jjjjv.exe110⤵PID:952
-
\??\c:\1pddv.exec:\1pddv.exe111⤵PID:1784
-
\??\c:\jpdvj.exec:\jpdvj.exe112⤵PID:4564
-
\??\c:\xxffrxl.exec:\xxffrxl.exe113⤵PID:4144
-
\??\c:\nhnhbb.exec:\nhnhbb.exe114⤵PID:1268
-
\??\c:\5hbtnt.exec:\5hbtnt.exe115⤵PID:1852
-
\??\c:\hnthnh.exec:\hnthnh.exe116⤵PID:2232
-
\??\c:\9pddd.exec:\9pddd.exe117⤵PID:3396
-
\??\c:\xxlllll.exec:\xxlllll.exe118⤵PID:4016
-
\??\c:\lrrrrrx.exec:\lrrrrrx.exe119⤵PID:3428
-
\??\c:\rrrrlll.exec:\rrrrlll.exe120⤵PID:5116
-
\??\c:\nhhhnn.exec:\nhhhnn.exe121⤵PID:4640
-
\??\c:\ddpvj.exec:\ddpvj.exe122⤵PID:728
-
\??\c:\vvjjj.exec:\vvjjj.exe123⤵PID:4232
-
\??\c:\xfxfrlx.exec:\xfxfrlx.exe124⤵PID:2244
-
\??\c:\xflxxrl.exec:\xflxxrl.exe125⤵PID:3752
-
\??\c:\hhhhbh.exec:\hhhhbh.exe126⤵PID:2024
-
\??\c:\nnbbtb.exec:\nnbbtb.exe127⤵PID:4280
-
\??\c:\bbtnbb.exec:\bbtnbb.exe128⤵PID:5048
-
\??\c:\jppjj.exec:\jppjj.exe129⤵PID:4628
-
\??\c:\vdpjd.exec:\vdpjd.exe130⤵PID:4596
-
\??\c:\rlrlfrl.exec:\rlrlfrl.exe131⤵PID:2764
-
\??\c:\5rlllll.exec:\5rlllll.exe132⤵PID:3120
-
\??\c:\nhbbbb.exec:\nhbbbb.exe133⤵PID:1152
-
\??\c:\1nbbtt.exec:\1nbbtt.exe134⤵PID:2512
-
\??\c:\vvvvp.exec:\vvvvp.exe135⤵PID:2536
-
\??\c:\jjjjv.exec:\jjjjv.exe136⤵PID:1856
-
\??\c:\3fffrrx.exec:\3fffrrx.exe137⤵PID:216
-
\??\c:\rrfxfrx.exec:\rrfxfrx.exe138⤵PID:3952
-
\??\c:\nbhbbb.exec:\nbhbbb.exe139⤵PID:3900
-
\??\c:\bnbttt.exec:\bnbttt.exe140⤵PID:3340
-
\??\c:\jpdjj.exec:\jpdjj.exe141⤵PID:1040
-
\??\c:\jpppd.exec:\jpppd.exe142⤵PID:4948
-
\??\c:\hhhhhn.exec:\hhhhhn.exe143⤵PID:4452
-
\??\c:\vdppj.exec:\vdppj.exe144⤵PID:3004
-
\??\c:\lrfrfrx.exec:\lrfrfrx.exe145⤵PID:1360
-
\??\c:\vdpjv.exec:\vdpjv.exe146⤵PID:4448
-
\??\c:\lrxxlfx.exec:\lrxxlfx.exe147⤵PID:2316
-
\??\c:\nnbbhh.exec:\nnbbhh.exe148⤵PID:4428
-
\??\c:\ddddv.exec:\ddddv.exe149⤵PID:1896
-
\??\c:\lxfxffr.exec:\lxfxffr.exe150⤵PID:228
-
\??\c:\thtthh.exec:\thtthh.exe151⤵PID:5040
-
\??\c:\nnhhbh.exec:\nnhhbh.exe152⤵PID:2664
-
\??\c:\jdppp.exec:\jdppp.exe153⤵PID:4420
-
\??\c:\5rxrlll.exec:\5rxrlll.exe154⤵PID:4016
-
\??\c:\bttttt.exec:\bttttt.exe155⤵PID:732
-
\??\c:\fllllll.exec:\fllllll.exe156⤵PID:2556
-
\??\c:\rflfffx.exec:\rflfffx.exe157⤵PID:1072
-
\??\c:\tttnnn.exec:\tttnnn.exe158⤵PID:4736
-
\??\c:\7nttbt.exec:\7nttbt.exe159⤵PID:3032
-
\??\c:\pdppv.exec:\pdppv.exe160⤵PID:2468
-
\??\c:\jvddj.exec:\jvddj.exe161⤵PID:2500
-
\??\c:\lflrxxx.exec:\lflrxxx.exe162⤵PID:4364
-
\??\c:\bnnnnn.exec:\bnnnnn.exe163⤵PID:2148
-
\??\c:\thhbbb.exec:\thhbbb.exe164⤵PID:5048
-
\??\c:\jvddd.exec:\jvddd.exe165⤵PID:1340
-
\??\c:\dpvvv.exec:\dpvvv.exe166⤵PID:3768
-
\??\c:\rfrlxrf.exec:\rfrlxrf.exe167⤵PID:4676
-
\??\c:\xflfxfx.exec:\xflfxfx.exe168⤵PID:2056
-
\??\c:\hhttnn.exec:\hhttnn.exe169⤵PID:5064
-
\??\c:\hhhntt.exec:\hhhntt.exe170⤵PID:2728
-
\??\c:\vpdvp.exec:\vpdvp.exe171⤵PID:4004
-
\??\c:\dvjjj.exec:\dvjjj.exe172⤵PID:1900
-
\??\c:\rllrllr.exec:\rllrllr.exe173⤵PID:3436
-
\??\c:\1rxxrfx.exec:\1rxxrfx.exe174⤵PID:2340
-
\??\c:\bthhhn.exec:\bthhhn.exe175⤵PID:4624
-
\??\c:\hbhhbh.exec:\hbhhbh.exe176⤵PID:1580
-
\??\c:\3tttbb.exec:\3tttbb.exe177⤵PID:548
-
\??\c:\ppdjj.exec:\ppdjj.exe178⤵PID:3004
-
\??\c:\dvjdp.exec:\dvjdp.exe179⤵PID:1360
-
\??\c:\fflffxr.exec:\fflffxr.exe180⤵PID:1112
-
\??\c:\3ntnhh.exec:\3ntnhh.exe181⤵PID:2316
-
\??\c:\nntttb.exec:\nntttb.exe182⤵PID:4144
-
\??\c:\dvdvv.exec:\dvdvv.exe183⤵PID:2420
-
\??\c:\pdppp.exec:\pdppp.exe184⤵PID:3504
-
\??\c:\rlfxrrf.exec:\rlfxrrf.exe185⤵PID:3888
-
\??\c:\xxxxlrx.exec:\xxxxlrx.exe186⤵PID:2664
-
\??\c:\3nhhtt.exec:\3nhhtt.exe187⤵PID:4420
-
\??\c:\bthbnn.exec:\bthbnn.exe188⤵PID:2180
-
\??\c:\jdjjv.exec:\jdjjv.exe189⤵PID:732
-
\??\c:\vjppp.exec:\vjppp.exe190⤵PID:2556
-
\??\c:\pjjjv.exec:\pjjjv.exe191⤵PID:1072
-
\??\c:\ffrrllf.exec:\ffrrllf.exe192⤵PID:2244
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe193⤵PID:4524
-
\??\c:\nnhhnn.exec:\nnhhnn.exe194⤵PID:1260
-
\??\c:\7bbbtn.exec:\7bbbtn.exe195⤵PID:3336
-
\??\c:\7dddv.exec:\7dddv.exe196⤵PID:1732
-
\??\c:\vjjjp.exec:\vjjjp.exe197⤵PID:2712
-
\??\c:\3ffxxxx.exec:\3ffxxxx.exe198⤵PID:856
-
\??\c:\xxffflr.exec:\xxffflr.exe199⤵PID:408
-
\??\c:\3lfflrl.exec:\3lfflrl.exe200⤵PID:3652
-
\??\c:\hbbbbb.exec:\hbbbbb.exe201⤵PID:3120
-
\??\c:\vvpvj.exec:\vvpvj.exe202⤵PID:1372
-
\??\c:\pjdpj.exec:\pjdpj.exe203⤵PID:1456
-
\??\c:\9llffll.exec:\9llffll.exe204⤵PID:2536
-
\??\c:\lfllflf.exec:\lfllflf.exe205⤵PID:4060
-
\??\c:\bbbbbb.exec:\bbbbbb.exe206⤵PID:8
-
\??\c:\bbbnhn.exec:\bbbnhn.exe207⤵PID:1996
-
\??\c:\ddpvp.exec:\ddpvp.exe208⤵PID:3008
-
\??\c:\dddvv.exec:\dddvv.exe209⤵PID:3380
-
\??\c:\xxffrff.exec:\xxffrff.exe210⤵PID:3640
-
\??\c:\hnhttb.exec:\hnhttb.exe211⤵PID:548
-
\??\c:\hhntbn.exec:\hhntbn.exe212⤵PID:4980
-
\??\c:\jpvvd.exec:\jpvvd.exe213⤵PID:3744
-
\??\c:\vjvpj.exec:\vjvpj.exe214⤵PID:4564
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe215⤵PID:2316
-
\??\c:\frfrlxx.exec:\frfrlxx.exe216⤵PID:4340
-
\??\c:\9frlrxr.exec:\9frlrxr.exe217⤵PID:1028
-
\??\c:\nthbbb.exec:\nthbbb.exe218⤵PID:540
-
\??\c:\bbbbbh.exec:\bbbbbh.exe219⤵PID:3888
-
\??\c:\3dvdd.exec:\3dvdd.exe220⤵PID:2208
-
\??\c:\9jjjj.exec:\9jjjj.exe221⤵PID:3936
-
\??\c:\xlrlfff.exec:\xlrlfff.exe222⤵PID:2744
-
\??\c:\fxlrlrr.exec:\fxlrlrr.exe223⤵PID:3368
-
\??\c:\bhhhhh.exec:\bhhhhh.exe224⤵PID:3228
-
\??\c:\nbtbbh.exec:\nbtbbh.exe225⤵PID:2480
-
\??\c:\dvppp.exec:\dvppp.exe226⤵PID:1416
-
\??\c:\vdppj.exec:\vdppj.exe227⤵PID:2608
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe228⤵PID:3016
-
\??\c:\5xxrrxr.exec:\5xxrrxr.exe229⤵PID:804
-
\??\c:\5bhhhh.exec:\5bhhhh.exe230⤵PID:1688
-
\??\c:\hbbbnn.exec:\hbbbnn.exe231⤵PID:4728
-
\??\c:\jpppp.exec:\jpppp.exe232⤵PID:2168
-
\??\c:\5dppd.exec:\5dppd.exe233⤵PID:3836
-
\??\c:\rlxxflr.exec:\rlxxflr.exe234⤵PID:2968
-
\??\c:\lrlfrrx.exec:\lrlfrrx.exe235⤵PID:2908
-
\??\c:\hhhbbb.exec:\hhhbbb.exe236⤵PID:1232
-
\??\c:\pjpvj.exec:\pjpvj.exe237⤵PID:2280
-
\??\c:\ppvdd.exec:\ppvdd.exe238⤵PID:216
-
\??\c:\ffrrlll.exec:\ffrrlll.exe239⤵PID:1324
-
\??\c:\frfxrrl.exec:\frfxrrl.exe240⤵PID:4580
-
\??\c:\nnbntb.exec:\nnbntb.exe241⤵PID:3276
-
\??\c:\bnthnn.exec:\bnthnn.exe242⤵PID:1824