Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 17:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fcbc119198856c71d92e740275e28890_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
fcbc119198856c71d92e740275e28890_NeikiAnalytics.exe
-
Size
343KB
-
MD5
fcbc119198856c71d92e740275e28890
-
SHA1
65055439ff939d23028daad1238486dd613b38aa
-
SHA256
8ee894f4eb1997e4ed2b3500053ac2aee7de380c39ec1d34d827044bd967ab9c
-
SHA512
d94f887fcab6a9a8bb2ee116f9a25948da7cb8726ea2f59bb1dcf99e8b467f52840f871a3315f2df548c060d49128dd08346b51dcf06d3d1a32af284c4fce1a5
-
SSDEEP
6144:n3C9BRo/AIX2MUXownfWQkyCpxwJz9e0pQowLh3EhToK9cT085mnFhXjmnwJQyII:n3C9uDnUXoSWlnwJv90aKToFqwfIBm
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/4916-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/960-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/484-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dddjv.exejpjdp.exexlrllll.exenthbbh.exevdjdd.exeffllxxx.exehtbbbb.exedvpjd.exeflfrlfl.exetbbbbh.exepvvvp.exelfrrrrl.exebtnnnn.exepvddv.exerfrrrrr.exebbnntt.exepdvpp.exexlfxffr.exe7vvvp.exeppvpp.exeffffxfx.exennttbb.exe5lfxxfl.exehhnbtt.exedvppd.exerrfxlll.exelrrxxxf.exe9ttnhh.exedjdjj.exerflxxxf.exe5bhnnb.exejvdjj.exefllflfl.exe5hhhhn.exettnnth.exeppvvv.exerrlllrr.exexlrxrrf.exe9htbnt.exe3jvpv.exexffxxxf.exellrrllx.exehnbbtt.exejpppp.exejdjpp.exelxlxlrf.exe1bbbtb.exetttntt.exedvvvv.exeflfxxxr.exerrlllff.exenbtnhh.exeppdvv.exevdjjv.exefrrrxrx.exehbttnn.exevdvvv.exefxffxll.exe9fffrrl.exehnbbtb.exenbhbbn.exejvjdd.exexrxrlrl.exexxfflrf.exepid process 3712 dddjv.exe 3312 jpjdp.exe 5084 xlrllll.exe 3976 nthbbh.exe 4580 vdjdd.exe 4260 ffllxxx.exe 816 htbbbb.exe 3592 dvpjd.exe 872 flfrlfl.exe 3572 tbbbbh.exe 1432 pvvvp.exe 2316 lfrrrrl.exe 2932 btnnnn.exe 4688 pvddv.exe 4860 rfrrrrr.exe 4600 bbnntt.exe 4680 pdvpp.exe 4728 xlfxffr.exe 2880 7vvvp.exe 484 ppvpp.exe 1316 ffffxfx.exe 3248 nnttbb.exe 4792 5lfxxfl.exe 960 hhnbtt.exe 2460 dvppd.exe 3768 rrfxlll.exe 4508 lrrxxxf.exe 4724 9ttnhh.exe 3840 djdjj.exe 3184 rflxxxf.exe 4340 5bhnnb.exe 3340 jvdjj.exe 3696 fllflfl.exe 536 5hhhhn.exe 1408 ttnnth.exe 4564 ppvvv.exe 2108 rrlllrr.exe 2164 xlrxrrf.exe 2412 9htbnt.exe 408 3jvpv.exe 3732 xffxxxf.exe 2032 llrrllx.exe 3572 hnbbtt.exe 1572 jpppp.exe 4372 jdjpp.exe 5056 lxlxlrf.exe 2696 1bbbtb.exe 672 tttntt.exe 2316 dvvvv.exe 688 flfxxxr.exe 3816 rrlllff.exe 4860 nbtnhh.exe 3536 ppdvv.exe 1128 vdjjv.exe 2024 frrrxrx.exe 2880 hbttnn.exe 2052 vdvvv.exe 1976 fxffxll.exe 4380 9fffrrl.exe 3760 hnbbtb.exe 2920 nbhbbn.exe 4968 jvjdd.exe 4460 xrxrlrl.exe 4008 xxfflrf.exe -
Processes:
resource yara_rule behavioral2/memory/4916-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/484-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-11-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fcbc119198856c71d92e740275e28890_NeikiAnalytics.exedddjv.exejpjdp.exexlrllll.exenthbbh.exevdjdd.exeffllxxx.exehtbbbb.exedvpjd.exeflfrlfl.exetbbbbh.exepvvvp.exelfrrrrl.exebtnnnn.exepvddv.exerfrrrrr.exebbnntt.exepdvpp.exexlfxffr.exe7vvvp.exeppvpp.exeffffxfx.exedescription pid process target process PID 4916 wrote to memory of 3712 4916 fcbc119198856c71d92e740275e28890_NeikiAnalytics.exe dddjv.exe PID 4916 wrote to memory of 3712 4916 fcbc119198856c71d92e740275e28890_NeikiAnalytics.exe dddjv.exe PID 4916 wrote to memory of 3712 4916 fcbc119198856c71d92e740275e28890_NeikiAnalytics.exe dddjv.exe PID 3712 wrote to memory of 3312 3712 dddjv.exe jpjdp.exe PID 3712 wrote to memory of 3312 3712 dddjv.exe jpjdp.exe PID 3712 wrote to memory of 3312 3712 dddjv.exe jpjdp.exe PID 3312 wrote to memory of 5084 3312 jpjdp.exe xlrllll.exe PID 3312 wrote to memory of 5084 3312 jpjdp.exe xlrllll.exe PID 3312 wrote to memory of 5084 3312 jpjdp.exe xlrllll.exe PID 5084 wrote to memory of 3976 5084 xlrllll.exe nthbbh.exe PID 5084 wrote to memory of 3976 5084 xlrllll.exe nthbbh.exe PID 5084 wrote to memory of 3976 5084 xlrllll.exe nthbbh.exe PID 3976 wrote to memory of 4580 3976 nthbbh.exe vdjdd.exe PID 3976 wrote to memory of 4580 3976 nthbbh.exe vdjdd.exe PID 3976 wrote to memory of 4580 3976 nthbbh.exe vdjdd.exe PID 4580 wrote to memory of 4260 4580 vdjdd.exe ffllxxx.exe PID 4580 wrote to memory of 4260 4580 vdjdd.exe ffllxxx.exe PID 4580 wrote to memory of 4260 4580 vdjdd.exe ffllxxx.exe PID 4260 wrote to memory of 816 4260 ffllxxx.exe htbbbb.exe PID 4260 wrote to memory of 816 4260 ffllxxx.exe htbbbb.exe PID 4260 wrote to memory of 816 4260 ffllxxx.exe htbbbb.exe PID 816 wrote to memory of 3592 816 htbbbb.exe dvpjd.exe PID 816 wrote to memory of 3592 816 htbbbb.exe dvpjd.exe PID 816 wrote to memory of 3592 816 htbbbb.exe dvpjd.exe PID 3592 wrote to memory of 872 3592 dvpjd.exe flfrlfl.exe PID 3592 wrote to memory of 872 3592 dvpjd.exe flfrlfl.exe PID 3592 wrote to memory of 872 3592 dvpjd.exe flfrlfl.exe PID 872 wrote to memory of 3572 872 flfrlfl.exe hnbbtt.exe PID 872 wrote to memory of 3572 872 flfrlfl.exe hnbbtt.exe PID 872 wrote to memory of 3572 872 flfrlfl.exe hnbbtt.exe PID 3572 wrote to memory of 1432 3572 tbbbbh.exe pvvvp.exe PID 3572 wrote to memory of 1432 3572 tbbbbh.exe pvvvp.exe PID 3572 wrote to memory of 1432 3572 tbbbbh.exe pvvvp.exe PID 1432 wrote to memory of 2316 1432 pvvvp.exe lfrrrrl.exe PID 1432 wrote to memory of 2316 1432 pvvvp.exe lfrrrrl.exe PID 1432 wrote to memory of 2316 1432 pvvvp.exe lfrrrrl.exe PID 2316 wrote to memory of 2932 2316 lfrrrrl.exe btnnnn.exe PID 2316 wrote to memory of 2932 2316 lfrrrrl.exe btnnnn.exe PID 2316 wrote to memory of 2932 2316 lfrrrrl.exe btnnnn.exe PID 2932 wrote to memory of 4688 2932 btnnnn.exe pvddv.exe PID 2932 wrote to memory of 4688 2932 btnnnn.exe pvddv.exe PID 2932 wrote to memory of 4688 2932 btnnnn.exe pvddv.exe PID 4688 wrote to memory of 4860 4688 pvddv.exe nbtnhh.exe PID 4688 wrote to memory of 4860 4688 pvddv.exe nbtnhh.exe PID 4688 wrote to memory of 4860 4688 pvddv.exe nbtnhh.exe PID 4860 wrote to memory of 4600 4860 rfrrrrr.exe bbnntt.exe PID 4860 wrote to memory of 4600 4860 rfrrrrr.exe bbnntt.exe PID 4860 wrote to memory of 4600 4860 rfrrrrr.exe bbnntt.exe PID 4600 wrote to memory of 4680 4600 bbnntt.exe frfrfxl.exe PID 4600 wrote to memory of 4680 4600 bbnntt.exe frfrfxl.exe PID 4600 wrote to memory of 4680 4600 bbnntt.exe frfrfxl.exe PID 4680 wrote to memory of 4728 4680 pdvpp.exe xlfxffr.exe PID 4680 wrote to memory of 4728 4680 pdvpp.exe xlfxffr.exe PID 4680 wrote to memory of 4728 4680 pdvpp.exe xlfxffr.exe PID 4728 wrote to memory of 2880 4728 xlfxffr.exe 7vvvp.exe PID 4728 wrote to memory of 2880 4728 xlfxffr.exe 7vvvp.exe PID 4728 wrote to memory of 2880 4728 xlfxffr.exe 7vvvp.exe PID 2880 wrote to memory of 484 2880 7vvvp.exe ppvpp.exe PID 2880 wrote to memory of 484 2880 7vvvp.exe ppvpp.exe PID 2880 wrote to memory of 484 2880 7vvvp.exe ppvpp.exe PID 484 wrote to memory of 1316 484 ppvpp.exe ffffxfx.exe PID 484 wrote to memory of 1316 484 ppvpp.exe ffffxfx.exe PID 484 wrote to memory of 1316 484 ppvpp.exe ffffxfx.exe PID 1316 wrote to memory of 3248 1316 ffffxfx.exe vjdpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3844809093\zmstage.exeC:\Users\Admin\AppData\Local\Temp\3844809093\zmstage.exe1⤵PID:3356
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\fcbc119198856c71d92e740275e28890_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\fcbc119198856c71d92e740275e28890_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\dddjv.exec:\dddjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\jpjdp.exec:\jpjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\xlrllll.exec:\xlrllll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\nthbbh.exec:\nthbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\vdjdd.exec:\vdjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\ffllxxx.exec:\ffllxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\htbbbb.exec:\htbbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\dvpjd.exec:\dvpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\flfrlfl.exec:\flfrlfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\tbbbbh.exec:\tbbbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\pvvvp.exec:\pvvvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\lfrrrrl.exec:\lfrrrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\btnnnn.exec:\btnnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\pvddv.exec:\pvddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\rfrrrrr.exec:\rfrrrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\bbnntt.exec:\bbnntt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\pdvpp.exec:\pdvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\xlfxffr.exec:\xlfxffr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\7vvvp.exec:\7vvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\ppvpp.exec:\ppvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\ffffxfx.exec:\ffffxfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\nnttbb.exec:\nnttbb.exe23⤵
- Executes dropped EXE
PID:3248 -
\??\c:\5lfxxfl.exec:\5lfxxfl.exe24⤵
- Executes dropped EXE
PID:4792 -
\??\c:\hhnbtt.exec:\hhnbtt.exe25⤵
- Executes dropped EXE
PID:960 -
\??\c:\dvppd.exec:\dvppd.exe26⤵
- Executes dropped EXE
PID:2460 -
\??\c:\rrfxlll.exec:\rrfxlll.exe27⤵
- Executes dropped EXE
PID:3768 -
\??\c:\lrrxxxf.exec:\lrrxxxf.exe28⤵
- Executes dropped EXE
PID:4508 -
\??\c:\9ttnhh.exec:\9ttnhh.exe29⤵
- Executes dropped EXE
PID:4724 -
\??\c:\djdjj.exec:\djdjj.exe30⤵
- Executes dropped EXE
PID:3840 -
\??\c:\rflxxxf.exec:\rflxxxf.exe31⤵
- Executes dropped EXE
PID:3184 -
\??\c:\5bhnnb.exec:\5bhnnb.exe32⤵
- Executes dropped EXE
PID:4340 -
\??\c:\jvdjj.exec:\jvdjj.exe33⤵
- Executes dropped EXE
PID:3340 -
\??\c:\fllflfl.exec:\fllflfl.exe34⤵
- Executes dropped EXE
PID:3696 -
\??\c:\5hhhhn.exec:\5hhhhn.exe35⤵
- Executes dropped EXE
PID:536 -
\??\c:\ttnnth.exec:\ttnnth.exe36⤵
- Executes dropped EXE
PID:1408 -
\??\c:\ppvvv.exec:\ppvvv.exe37⤵
- Executes dropped EXE
PID:4564 -
\??\c:\rrlllrr.exec:\rrlllrr.exe38⤵
- Executes dropped EXE
PID:2108 -
\??\c:\xlrxrrf.exec:\xlrxrrf.exe39⤵
- Executes dropped EXE
PID:2164 -
\??\c:\9htbnt.exec:\9htbnt.exe40⤵
- Executes dropped EXE
PID:2412 -
\??\c:\3jvpv.exec:\3jvpv.exe41⤵
- Executes dropped EXE
PID:408 -
\??\c:\xffxxxf.exec:\xffxxxf.exe42⤵
- Executes dropped EXE
PID:3732 -
\??\c:\llrrllx.exec:\llrrllx.exe43⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hnbbtt.exec:\hnbbtt.exe44⤵
- Executes dropped EXE
PID:3572 -
\??\c:\jpppp.exec:\jpppp.exe45⤵
- Executes dropped EXE
PID:1572 -
\??\c:\jdjpp.exec:\jdjpp.exe46⤵
- Executes dropped EXE
PID:4372 -
\??\c:\lxlxlrf.exec:\lxlxlrf.exe47⤵
- Executes dropped EXE
PID:5056 -
\??\c:\1bbbtb.exec:\1bbbtb.exe48⤵
- Executes dropped EXE
PID:2696 -
\??\c:\tttntt.exec:\tttntt.exe49⤵
- Executes dropped EXE
PID:672 -
\??\c:\dvvvv.exec:\dvvvv.exe50⤵
- Executes dropped EXE
PID:2316 -
\??\c:\flfxxxr.exec:\flfxxxr.exe51⤵
- Executes dropped EXE
PID:688 -
\??\c:\rrlllff.exec:\rrlllff.exe52⤵
- Executes dropped EXE
PID:3816 -
\??\c:\nbtnhh.exec:\nbtnhh.exe53⤵
- Executes dropped EXE
PID:4860 -
\??\c:\ppdvv.exec:\ppdvv.exe54⤵
- Executes dropped EXE
PID:3536 -
\??\c:\vdjjv.exec:\vdjjv.exe55⤵
- Executes dropped EXE
PID:1128 -
\??\c:\frrrxrx.exec:\frrrxrx.exe56⤵
- Executes dropped EXE
PID:2024 -
\??\c:\hbttnn.exec:\hbttnn.exe57⤵
- Executes dropped EXE
PID:2880 -
\??\c:\vdvvv.exec:\vdvvv.exe58⤵
- Executes dropped EXE
PID:2052 -
\??\c:\fxffxll.exec:\fxffxll.exe59⤵
- Executes dropped EXE
PID:1976 -
\??\c:\9fffrrl.exec:\9fffrrl.exe60⤵
- Executes dropped EXE
PID:4380 -
\??\c:\hnbbtb.exec:\hnbbtb.exe61⤵
- Executes dropped EXE
PID:3760 -
\??\c:\nbhbbn.exec:\nbhbbn.exe62⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jvjdd.exec:\jvjdd.exe63⤵
- Executes dropped EXE
PID:4968 -
\??\c:\xrxrlrl.exec:\xrxrlrl.exe64⤵
- Executes dropped EXE
PID:4460 -
\??\c:\xxfflrf.exec:\xxfflrf.exe65⤵
- Executes dropped EXE
PID:4008 -
\??\c:\5tttnn.exec:\5tttnn.exe66⤵PID:1156
-
\??\c:\jpdvv.exec:\jpdvv.exe67⤵PID:3856
-
\??\c:\dvppj.exec:\dvppj.exe68⤵PID:1984
-
\??\c:\ffrflll.exec:\ffrflll.exe69⤵PID:4508
-
\??\c:\5thhhn.exec:\5thhhn.exe70⤵PID:1740
-
\??\c:\bhbttb.exec:\bhbttb.exe71⤵PID:2936
-
\??\c:\1jjdd.exec:\1jjdd.exe72⤵PID:4964
-
\??\c:\fxrllxr.exec:\fxrllxr.exe73⤵PID:3920
-
\??\c:\frrrxlr.exec:\frrrxlr.exe74⤵PID:4328
-
\??\c:\nhhbbh.exec:\nhhbbh.exe75⤵PID:3712
-
\??\c:\ddvpv.exec:\ddvpv.exe76⤵PID:236
-
\??\c:\ppvdd.exec:\ppvdd.exe77⤵PID:536
-
\??\c:\fxffffx.exec:\fxffffx.exe78⤵PID:2988
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe79⤵PID:2744
-
\??\c:\htbnhb.exec:\htbnhb.exe80⤵PID:2172
-
\??\c:\tttnnt.exec:\tttnnt.exe81⤵PID:3024
-
\??\c:\jdddv.exec:\jdddv.exe82⤵PID:2332
-
\??\c:\rlrxxfl.exec:\rlrxxfl.exe83⤵PID:2720
-
\??\c:\llxrllr.exec:\llxrllr.exe84⤵PID:2992
-
\??\c:\bhbttt.exec:\bhbttt.exe85⤵PID:4452
-
\??\c:\jppjd.exec:\jppjd.exe86⤵PID:3884
-
\??\c:\lflfrrf.exec:\lflfrrf.exe87⤵PID:2168
-
\??\c:\flxrxrf.exec:\flxrxrf.exe88⤵PID:4348
-
\??\c:\bnhntt.exec:\bnhntt.exe89⤵PID:2724
-
\??\c:\nhhhbb.exec:\nhhhbb.exe90⤵PID:2280
-
\??\c:\5jjdv.exec:\5jjdv.exe91⤵PID:3576
-
\??\c:\flrffxr.exec:\flrffxr.exe92⤵PID:2548
-
\??\c:\frxxfff.exec:\frxxfff.exe93⤵PID:4012
-
\??\c:\bbhnnh.exec:\bbhnnh.exe94⤵PID:4600
-
\??\c:\hnnttt.exec:\hnnttt.exe95⤵PID:1956
-
\??\c:\vvvpv.exec:\vvvpv.exe96⤵PID:4680
-
\??\c:\xxlrflx.exec:\xxlrflx.exe97⤵PID:3748
-
\??\c:\xxllllr.exec:\xxllllr.exe98⤵PID:1764
-
\??\c:\nbhbhn.exec:\nbhbhn.exe99⤵PID:4884
-
\??\c:\tbtnbn.exec:\tbtnbn.exe100⤵PID:1812
-
\??\c:\3vdvp.exec:\3vdvp.exe101⤵PID:3552
-
\??\c:\rxllffx.exec:\rxllffx.exe102⤵PID:1620
-
\??\c:\hhnhhn.exec:\hhnhhn.exe103⤵PID:4972
-
\??\c:\bbbthh.exec:\bbbthh.exe104⤵PID:3544
-
\??\c:\nhhhbb.exec:\nhhhbb.exe105⤵PID:3528
-
\??\c:\vpvpp.exec:\vpvpp.exe106⤵PID:4676
-
\??\c:\rffrllf.exec:\rffrllf.exe107⤵PID:4104
-
\??\c:\tthnth.exec:\tthnth.exe108⤵PID:4592
-
\??\c:\nnbthh.exec:\nnbthh.exe109⤵PID:1992
-
\??\c:\pjjdv.exec:\pjjdv.exe110⤵PID:3840
-
\??\c:\vvvpp.exec:\vvvpp.exe111⤵PID:4548
-
\??\c:\frxrlfl.exec:\frxrlfl.exe112⤵PID:3340
-
\??\c:\hntttt.exec:\hntttt.exe113⤵PID:5084
-
\??\c:\bbhhbt.exec:\bbhhbt.exe114⤵PID:5028
-
\??\c:\jvvpj.exec:\jvvpj.exe115⤵PID:2744
-
\??\c:\ddppj.exec:\ddppj.exe116⤵PID:1840
-
\??\c:\lfrlfxl.exec:\lfrlfxl.exe117⤵PID:1532
-
\??\c:\tntnhb.exec:\tntnhb.exe118⤵PID:2876
-
\??\c:\hbhtbt.exec:\hbhtbt.exe119⤵PID:1468
-
\??\c:\jvpdp.exec:\jvpdp.exe120⤵PID:4704
-
\??\c:\rflfxrx.exec:\rflfxrx.exe121⤵PID:1004
-
\??\c:\lxxxxrl.exec:\lxxxxrl.exe122⤵PID:1672
-
\??\c:\bnhhnb.exec:\bnhhnb.exe123⤵PID:2092
-
\??\c:\vpvpj.exec:\vpvpj.exe124⤵PID:1388
-
\??\c:\jpjdp.exec:\jpjdp.exe125⤵PID:3880
-
\??\c:\flxllxx.exec:\flxllxx.exe126⤵PID:2668
-
\??\c:\btttnh.exec:\btttnh.exe127⤵PID:3316
-
\??\c:\dpjdp.exec:\dpjdp.exe128⤵PID:2004
-
\??\c:\jjvvp.exec:\jjvvp.exe129⤵PID:5052
-
\??\c:\fffxlfx.exec:\fffxlfx.exe130⤵PID:1152
-
\??\c:\xffxxrl.exec:\xffxxrl.exe131⤵PID:2948
-
\??\c:\hnhnth.exec:\hnhnth.exe132⤵PID:3748
-
\??\c:\jdpjj.exec:\jdpjj.exe133⤵PID:5032
-
\??\c:\dvpjv.exec:\dvpjv.exe134⤵PID:4884
-
\??\c:\9fflxlx.exec:\9fflxlx.exe135⤵PID:1632
-
\??\c:\bnbnhh.exec:\bnbnhh.exe136⤵PID:3552
-
\??\c:\btnbtn.exec:\btnbtn.exe137⤵PID:1620
-
\??\c:\dvpdp.exec:\dvpdp.exe138⤵PID:4220
-
\??\c:\vjjdv.exec:\vjjdv.exe139⤵PID:3240
-
\??\c:\rxlfffx.exec:\rxlfffx.exe140⤵PID:3528
-
\??\c:\lxffrrl.exec:\lxffrrl.exe141⤵PID:4676
-
\??\c:\nnbttt.exec:\nnbttt.exe142⤵PID:4988
-
\??\c:\ddpdv.exec:\ddpdv.exe143⤵PID:2936
-
\??\c:\llffllx.exec:\llffllx.exe144⤵PID:464
-
\??\c:\xxfrrxr.exec:\xxfrrxr.exe145⤵PID:3712
-
\??\c:\bbthnn.exec:\bbthnn.exe146⤵PID:3448
-
\??\c:\djpjv.exec:\djpjv.exe147⤵PID:1688
-
\??\c:\vvjdv.exec:\vvjdv.exe148⤵PID:1512
-
\??\c:\rrfrfxf.exec:\rrfrfxf.exe149⤵PID:2412
-
\??\c:\rrxrxxf.exec:\rrxrxxf.exe150⤵PID:1076
-
\??\c:\ttbbhh.exec:\ttbbhh.exe151⤵PID:3212
-
\??\c:\hhnbtn.exec:\hhnbtn.exe152⤵PID:1944
-
\??\c:\jvjvp.exec:\jvjvp.exe153⤵PID:2300
-
\??\c:\frxrxrr.exec:\frxrxrr.exe154⤵PID:4452
-
\??\c:\5rfxrrr.exec:\5rfxrrr.exe155⤵PID:3628
-
\??\c:\bnhbbn.exec:\bnhbbn.exe156⤵PID:1924
-
\??\c:\nhhhbb.exec:\nhhhbb.exe157⤵PID:4392
-
\??\c:\pppjd.exec:\pppjd.exe158⤵PID:2448
-
\??\c:\xlfrfrf.exec:\xlfrfrf.exe159⤵PID:2812
-
\??\c:\xrxrfxx.exec:\xrxrfxx.exe160⤵PID:672
-
\??\c:\7hhbnt.exec:\7hhbnt.exe161⤵PID:3092
-
\??\c:\jpjdd.exec:\jpjdd.exe162⤵PID:2548
-
\??\c:\jpjjj.exec:\jpjjj.exe163⤵PID:2004
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe164⤵PID:5052
-
\??\c:\hhbbhn.exec:\hhbbhn.exe165⤵PID:4772
-
\??\c:\hnbbnn.exec:\hnbbnn.exe166⤵PID:2592
-
\??\c:\vjjdv.exec:\vjjdv.exe167⤵PID:4900
-
\??\c:\7ppjd.exec:\7ppjd.exe168⤵PID:1812
-
\??\c:\lfxxffr.exec:\lfxxffr.exe169⤵PID:4236
-
\??\c:\ttbbth.exec:\ttbbth.exe170⤵PID:4888
-
\??\c:\bhtttb.exec:\bhtttb.exe171⤵PID:4784
-
\??\c:\vdddv.exec:\vdddv.exe172⤵PID:2500
-
\??\c:\dvpdj.exec:\dvpdj.exe173⤵PID:4996
-
\??\c:\fffrffx.exec:\fffrffx.exe174⤵PID:4676
-
\??\c:\hbtntt.exec:\hbtntt.exe175⤵PID:4328
-
\??\c:\bntbtt.exec:\bntbtt.exe176⤵PID:4548
-
\??\c:\pvjjj.exec:\pvjjj.exe177⤵PID:2480
-
\??\c:\frlxlrx.exec:\frlxlrx.exe178⤵PID:3056
-
\??\c:\rlrllrx.exec:\rlrllrx.exe179⤵PID:1688
-
\??\c:\hhhhhh.exec:\hhhhhh.exe180⤵PID:1576
-
\??\c:\vjppj.exec:\vjppj.exe181⤵PID:3572
-
\??\c:\ddvvj.exec:\ddvvj.exe182⤵PID:3700
-
\??\c:\lllrllr.exec:\lllrllr.exe183⤵PID:4704
-
\??\c:\btnhht.exec:\btnhht.exe184⤵PID:1668
-
\??\c:\pddvv.exec:\pddvv.exe185⤵PID:4356
-
\??\c:\jvjjj.exec:\jvjjj.exe186⤵PID:3624
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe187⤵PID:2092
-
\??\c:\htbtth.exec:\htbtth.exe188⤵PID:3880
-
\??\c:\bnthbt.exec:\bnthbt.exe189⤵PID:3808
-
\??\c:\dvvpj.exec:\dvvpj.exe190⤵PID:3816
-
\??\c:\vpdjp.exec:\vpdjp.exe191⤵PID:4012
-
\??\c:\fxfrlrl.exec:\fxfrlrl.exe192⤵PID:4544
-
\??\c:\tthhhn.exec:\tthhhn.exe193⤵PID:4024
-
\??\c:\nnhthb.exec:\nnhthb.exe194⤵PID:4540
-
\??\c:\pjddd.exec:\pjddd.exe195⤵PID:2240
-
\??\c:\lrlflxl.exec:\lrlflxl.exe196⤵PID:1608
-
\??\c:\frfrfxl.exec:\frfrfxl.exe197⤵PID:4680
-
\??\c:\tnnhbt.exec:\tnnhbt.exe198⤵PID:4512
-
\??\c:\vpdvj.exec:\vpdvj.exe199⤵PID:2472
-
\??\c:\vvvpv.exec:\vvvpv.exe200⤵PID:3812
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe201⤵PID:1812
-
\??\c:\xxllffx.exec:\xxllffx.exe202⤵PID:1764
-
\??\c:\7hbttt.exec:\7hbttt.exe203⤵PID:2920
-
\??\c:\vvpjj.exec:\vvpjj.exe204⤵PID:4792
-
\??\c:\pddpj.exec:\pddpj.exe205⤵PID:3348
-
\??\c:\flrxrxr.exec:\flrxrxr.exe206⤵PID:516
-
\??\c:\lxfxllf.exec:\lxfxllf.exe207⤵PID:212
-
\??\c:\1bbtnt.exec:\1bbtnt.exe208⤵PID:3284
-
\??\c:\pjjdv.exec:\pjjdv.exe209⤵PID:3168
-
\??\c:\5vddv.exec:\5vddv.exe210⤵PID:1404
-
\??\c:\lxrlxxx.exec:\lxrlxxx.exe211⤵PID:4328
-
\??\c:\nhnthh.exec:\nhnthh.exe212⤵PID:3856
-
\??\c:\9bbthh.exec:\9bbthh.exe213⤵PID:2488
-
\??\c:\ddppj.exec:\ddppj.exe214⤵PID:4364
-
\??\c:\vpvjj.exec:\vpvjj.exe215⤵PID:1512
-
\??\c:\fxlrllf.exec:\fxlrllf.exe216⤵PID:2412
-
\??\c:\thhbtn.exec:\thhbtn.exe217⤵PID:4708
-
\??\c:\nttnhh.exec:\nttnhh.exe218⤵PID:2876
-
\??\c:\9jjvd.exec:\9jjvd.exe219⤵PID:2300
-
\??\c:\jvdpj.exec:\jvdpj.exe220⤵PID:3628
-
\??\c:\xlrflfr.exec:\xlrflfr.exe221⤵PID:4760
-
\??\c:\hhtnnh.exec:\hhtnnh.exe222⤵PID:1484
-
\??\c:\hnbhbb.exec:\hnbhbb.exe223⤵PID:2724
-
\??\c:\jjvpj.exec:\jjvpj.exe224⤵PID:2448
-
\??\c:\xxlxfrx.exec:\xxlxfrx.exe225⤵PID:3600
-
\??\c:\xlxrrxx.exec:\xlxrrxx.exe226⤵PID:3092
-
\??\c:\hnhbtn.exec:\hnhbtn.exe227⤵PID:3892
-
\??\c:\ddvpv.exec:\ddvpv.exe228⤵PID:2540
-
\??\c:\vjpjd.exec:\vjpjd.exe229⤵PID:2408
-
\??\c:\fffxxrr.exec:\fffxxrr.exe230⤵PID:1128
-
\??\c:\ntnttn.exec:\ntnttn.exe231⤵PID:3756
-
\??\c:\nntnhb.exec:\nntnhb.exe232⤵PID:1984
-
\??\c:\1vddp.exec:\1vddp.exe233⤵PID:4300
-
\??\c:\7djdv.exec:\7djdv.exe234⤵PID:3964
-
\??\c:\fxlrlrf.exec:\fxlrlrf.exe235⤵PID:2240
-
\??\c:\9hbtnh.exec:\9hbtnh.exe236⤵PID:5036
-
\??\c:\httttn.exec:\httttn.exe237⤵PID:4036
-
\??\c:\jpdvp.exec:\jpdvp.exe238⤵PID:2456
-
\??\c:\lfffxrr.exec:\lfffxrr.exe239⤵PID:744
-
\??\c:\xllllrx.exec:\xllllrx.exe240⤵PID:2844
-
\??\c:\nbnbbn.exec:\nbnbbn.exe241⤵PID:4500
-
\??\c:\bnhtht.exec:\bnhtht.exe242⤵PID:688