Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 04:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a77c938bd7b212b1ad31ee67e19f2730_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a77c938bd7b212b1ad31ee67e19f2730_NeikiAnalytics.exe
-
Size
71KB
-
MD5
a77c938bd7b212b1ad31ee67e19f2730
-
SHA1
6fa782697a7e56635e913a676843210e19a158ae
-
SHA256
39177023ad42c37870954f3295d7c44bd000f84f002572f2f3f55c0ffc168bdf
-
SHA512
a378285ee26af645d86ce41a3ed42c9c85d8d1788657335566c1f927971dd288105d95a6f9232b367db8f91cf312ac8381e344315a3f5b80f10beecd55ea6f35
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7GTkT:ymb3NkkiQ3mdBjFIWYT
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/2368-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2888-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/976-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jdjjv.exe5flrxxx.exenbnhbt.exevpvpv.exedjvdd.exelflflff.exe3bhbbt.exehbnbbt.exejpppj.exe1dvjj.exexrlfxrl.exe1xrlxrl.exebnbbtt.exehtnhbt.exe1jdvp.exe3jjvj.exeflfxfrl.exefxxrrlf.exe1hnbnb.exentbtbb.exe1dvpj.exexflfrrf.exelfxrlrl.exenhnhnh.exe9tbtnh.exe5pjdv.exe9jjdj.exexfrfrlf.exe3hbhtn.exevddpd.exerfxrlfx.exehhtbnt.exevjdvj.exe1frlxxr.exefllfrfr.exe3tnhtb.exethtnhh.exeppppj.exelfxlffx.exexllfrrl.exenthnhn.exevjvpp.exeppjdj.exefxrfrfl.exe5thbtn.exebnhbtn.exehttnnt.exevjppp.exe1lfrlfr.exebttnhb.exehtbtnh.exepvvpp.exexrfrlrr.exelfxlxlr.exenbbttt.exetbtnhb.exedvjdp.exevjjvd.exerxxlxlf.exe5xfrxrx.exe9bthnn.exe7pjvj.exedvjvp.exe5frfrlf.exepid process 2424 jdjjv.exe 2820 5flrxxx.exe 2888 nbnhbt.exe 1676 vpvpv.exe 4092 djvdd.exe 1852 lflflff.exe 748 3bhbbt.exe 744 hbnbbt.exe 2844 jpppj.exe 4820 1dvjj.exe 224 xrlfxrl.exe 3160 1xrlxrl.exe 4420 bnbbtt.exe 4412 htnhbt.exe 1312 1jdvp.exe 3980 3jjvj.exe 1560 flfxfrl.exe 4944 fxxrrlf.exe 3420 1hnbnb.exe 1652 ntbtbb.exe 976 1dvpj.exe 1328 xflfrrf.exe 3028 lfxrlrl.exe 4956 nhnhnh.exe 4768 9tbtnh.exe 3400 5pjdv.exe 464 9jjdj.exe 3096 xfrfrlf.exe 2428 3hbhtn.exe 608 vddpd.exe 5072 rfxrlfx.exe 2648 hhtbnt.exe 4576 vjdvj.exe 4344 1frlxxr.exe 1104 fllfrfr.exe 3416 3tnhtb.exe 2540 thtnhh.exe 2036 ppppj.exe 4028 lfxlffx.exe 4264 xllfrrl.exe 2096 nthnhn.exe 3668 vjvpp.exe 3116 ppjdj.exe 2728 fxrfrfl.exe 2524 5thbtn.exe 2736 bnhbtn.exe 4076 httnnt.exe 5012 vjppp.exe 1000 1lfrlfr.exe 4652 bttnhb.exe 1592 htbtnh.exe 4172 pvvpp.exe 2544 xrfrlrr.exe 4920 lfxlxlr.exe 896 nbbttt.exe 2664 tbtnhb.exe 2840 dvjdp.exe 4936 vjjvd.exe 4148 rxxlxlf.exe 4624 5xfrxrx.exe 4972 9bthnn.exe 3868 7pjvj.exe 3084 dvjvp.exe 928 5frfrlf.exe -
Processes:
resource yara_rule behavioral2/memory/2368-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a77c938bd7b212b1ad31ee67e19f2730_NeikiAnalytics.exejdjjv.exe5flrxxx.exenbnhbt.exevpvpv.exedjvdd.exelflflff.exe3bhbbt.exehbnbbt.exejpppj.exe1dvjj.exexrlfxrl.exe1xrlxrl.exebnbbtt.exehtnhbt.exe1jdvp.exe3jjvj.exeflfxfrl.exefxxrrlf.exe1hnbnb.exentbtbb.exe1dvpj.exedescription pid process target process PID 2368 wrote to memory of 2424 2368 a77c938bd7b212b1ad31ee67e19f2730_NeikiAnalytics.exe jdjjv.exe PID 2368 wrote to memory of 2424 2368 a77c938bd7b212b1ad31ee67e19f2730_NeikiAnalytics.exe jdjjv.exe PID 2368 wrote to memory of 2424 2368 a77c938bd7b212b1ad31ee67e19f2730_NeikiAnalytics.exe jdjjv.exe PID 2424 wrote to memory of 2820 2424 jdjjv.exe 5flrxxx.exe PID 2424 wrote to memory of 2820 2424 jdjjv.exe 5flrxxx.exe PID 2424 wrote to memory of 2820 2424 jdjjv.exe 5flrxxx.exe PID 2820 wrote to memory of 2888 2820 5flrxxx.exe nbnhbt.exe PID 2820 wrote to memory of 2888 2820 5flrxxx.exe nbnhbt.exe PID 2820 wrote to memory of 2888 2820 5flrxxx.exe nbnhbt.exe PID 2888 wrote to memory of 1676 2888 nbnhbt.exe vpvpv.exe PID 2888 wrote to memory of 1676 2888 nbnhbt.exe vpvpv.exe PID 2888 wrote to memory of 1676 2888 nbnhbt.exe vpvpv.exe PID 1676 wrote to memory of 4092 1676 vpvpv.exe djvdd.exe PID 1676 wrote to memory of 4092 1676 vpvpv.exe djvdd.exe PID 1676 wrote to memory of 4092 1676 vpvpv.exe djvdd.exe PID 4092 wrote to memory of 1852 4092 djvdd.exe lflflff.exe PID 4092 wrote to memory of 1852 4092 djvdd.exe lflflff.exe PID 4092 wrote to memory of 1852 4092 djvdd.exe lflflff.exe PID 1852 wrote to memory of 748 1852 lflflff.exe 3bhbbt.exe PID 1852 wrote to memory of 748 1852 lflflff.exe 3bhbbt.exe PID 1852 wrote to memory of 748 1852 lflflff.exe 3bhbbt.exe PID 748 wrote to memory of 744 748 3bhbbt.exe hbnbbt.exe PID 748 wrote to memory of 744 748 3bhbbt.exe hbnbbt.exe PID 748 wrote to memory of 744 748 3bhbbt.exe hbnbbt.exe PID 744 wrote to memory of 2844 744 hbnbbt.exe jpppj.exe PID 744 wrote to memory of 2844 744 hbnbbt.exe jpppj.exe PID 744 wrote to memory of 2844 744 hbnbbt.exe jpppj.exe PID 2844 wrote to memory of 4820 2844 jpppj.exe 1dvjj.exe PID 2844 wrote to memory of 4820 2844 jpppj.exe 1dvjj.exe PID 2844 wrote to memory of 4820 2844 jpppj.exe 1dvjj.exe PID 4820 wrote to memory of 224 4820 1dvjj.exe xrlfxrl.exe PID 4820 wrote to memory of 224 4820 1dvjj.exe xrlfxrl.exe PID 4820 wrote to memory of 224 4820 1dvjj.exe xrlfxrl.exe PID 224 wrote to memory of 3160 224 xrlfxrl.exe 1xrlxrl.exe PID 224 wrote to memory of 3160 224 xrlfxrl.exe 1xrlxrl.exe PID 224 wrote to memory of 3160 224 xrlfxrl.exe 1xrlxrl.exe PID 3160 wrote to memory of 4420 3160 1xrlxrl.exe bnbbtt.exe PID 3160 wrote to memory of 4420 3160 1xrlxrl.exe bnbbtt.exe PID 3160 wrote to memory of 4420 3160 1xrlxrl.exe bnbbtt.exe PID 4420 wrote to memory of 4412 4420 bnbbtt.exe htnhbt.exe PID 4420 wrote to memory of 4412 4420 bnbbtt.exe htnhbt.exe PID 4420 wrote to memory of 4412 4420 bnbbtt.exe htnhbt.exe PID 4412 wrote to memory of 1312 4412 htnhbt.exe 1jdvp.exe PID 4412 wrote to memory of 1312 4412 htnhbt.exe 1jdvp.exe PID 4412 wrote to memory of 1312 4412 htnhbt.exe 1jdvp.exe PID 1312 wrote to memory of 3980 1312 1jdvp.exe 3jjvj.exe PID 1312 wrote to memory of 3980 1312 1jdvp.exe 3jjvj.exe PID 1312 wrote to memory of 3980 1312 1jdvp.exe 3jjvj.exe PID 3980 wrote to memory of 1560 3980 3jjvj.exe flfxfrl.exe PID 3980 wrote to memory of 1560 3980 3jjvj.exe flfxfrl.exe PID 3980 wrote to memory of 1560 3980 3jjvj.exe flfxfrl.exe PID 1560 wrote to memory of 4944 1560 flfxfrl.exe fxxrrlf.exe PID 1560 wrote to memory of 4944 1560 flfxfrl.exe fxxrrlf.exe PID 1560 wrote to memory of 4944 1560 flfxfrl.exe fxxrrlf.exe PID 4944 wrote to memory of 3420 4944 fxxrrlf.exe 1hnbnb.exe PID 4944 wrote to memory of 3420 4944 fxxrrlf.exe 1hnbnb.exe PID 4944 wrote to memory of 3420 4944 fxxrrlf.exe 1hnbnb.exe PID 3420 wrote to memory of 1652 3420 1hnbnb.exe ntbtbb.exe PID 3420 wrote to memory of 1652 3420 1hnbnb.exe ntbtbb.exe PID 3420 wrote to memory of 1652 3420 1hnbnb.exe ntbtbb.exe PID 1652 wrote to memory of 976 1652 ntbtbb.exe 1dvpj.exe PID 1652 wrote to memory of 976 1652 ntbtbb.exe 1dvpj.exe PID 1652 wrote to memory of 976 1652 ntbtbb.exe 1dvpj.exe PID 976 wrote to memory of 1328 976 1dvpj.exe xflfrrf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a77c938bd7b212b1ad31ee67e19f2730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a77c938bd7b212b1ad31ee67e19f2730_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\jdjjv.exec:\jdjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\5flrxxx.exec:\5flrxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\nbnhbt.exec:\nbnhbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\vpvpv.exec:\vpvpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\djvdd.exec:\djvdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\lflflff.exec:\lflflff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\3bhbbt.exec:\3bhbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\hbnbbt.exec:\hbnbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\jpppj.exec:\jpppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\1dvjj.exec:\1dvjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\1xrlxrl.exec:\1xrlxrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\bnbbtt.exec:\bnbbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\htnhbt.exec:\htnhbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\1jdvp.exec:\1jdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\3jjvj.exec:\3jjvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\flfxfrl.exec:\flfxfrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\fxxrrlf.exec:\fxxrrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\1hnbnb.exec:\1hnbnb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\ntbtbb.exec:\ntbtbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\1dvpj.exec:\1dvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\xflfrrf.exec:\xflfrrf.exe23⤵
- Executes dropped EXE
PID:1328 -
\??\c:\lfxrlrl.exec:\lfxrlrl.exe24⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nhnhnh.exec:\nhnhnh.exe25⤵
- Executes dropped EXE
PID:4956 -
\??\c:\9tbtnh.exec:\9tbtnh.exe26⤵
- Executes dropped EXE
PID:4768 -
\??\c:\5pjdv.exec:\5pjdv.exe27⤵
- Executes dropped EXE
PID:3400 -
\??\c:\9jjdj.exec:\9jjdj.exe28⤵
- Executes dropped EXE
PID:464 -
\??\c:\xfrfrlf.exec:\xfrfrlf.exe29⤵
- Executes dropped EXE
PID:3096 -
\??\c:\3hbhtn.exec:\3hbhtn.exe30⤵
- Executes dropped EXE
PID:2428 -
\??\c:\vddpd.exec:\vddpd.exe31⤵
- Executes dropped EXE
PID:608 -
\??\c:\rfxrlfx.exec:\rfxrlfx.exe32⤵
- Executes dropped EXE
PID:5072 -
\??\c:\hhtbnt.exec:\hhtbnt.exe33⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vjdvj.exec:\vjdvj.exe34⤵
- Executes dropped EXE
PID:4576 -
\??\c:\1frlxxr.exec:\1frlxxr.exe35⤵
- Executes dropped EXE
PID:4344 -
\??\c:\fllfrfr.exec:\fllfrfr.exe36⤵
- Executes dropped EXE
PID:1104 -
\??\c:\3tnhtb.exec:\3tnhtb.exe37⤵
- Executes dropped EXE
PID:3416 -
\??\c:\thtnhh.exec:\thtnhh.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\ppppj.exec:\ppppj.exe39⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lfxlffx.exec:\lfxlffx.exe40⤵
- Executes dropped EXE
PID:4028 -
\??\c:\xllfrrl.exec:\xllfrrl.exe41⤵
- Executes dropped EXE
PID:4264 -
\??\c:\nthnhn.exec:\nthnhn.exe42⤵
- Executes dropped EXE
PID:2096 -
\??\c:\vjvpp.exec:\vjvpp.exe43⤵
- Executes dropped EXE
PID:3668 -
\??\c:\ppjdj.exec:\ppjdj.exe44⤵
- Executes dropped EXE
PID:3116 -
\??\c:\fxrfrfl.exec:\fxrfrfl.exe45⤵
- Executes dropped EXE
PID:2728 -
\??\c:\5thbtn.exec:\5thbtn.exe46⤵
- Executes dropped EXE
PID:2524 -
\??\c:\bnhbtn.exec:\bnhbtn.exe47⤵
- Executes dropped EXE
PID:2736 -
\??\c:\httnnt.exec:\httnnt.exe48⤵
- Executes dropped EXE
PID:4076 -
\??\c:\vjppp.exec:\vjppp.exe49⤵
- Executes dropped EXE
PID:5012 -
\??\c:\1lfrlfr.exec:\1lfrlfr.exe50⤵
- Executes dropped EXE
PID:1000 -
\??\c:\bttnhb.exec:\bttnhb.exe51⤵
- Executes dropped EXE
PID:4652 -
\??\c:\htbtnh.exec:\htbtnh.exe52⤵
- Executes dropped EXE
PID:1592 -
\??\c:\pvvpp.exec:\pvvpp.exe53⤵
- Executes dropped EXE
PID:4172 -
\??\c:\xrfrlrr.exec:\xrfrlrr.exe54⤵
- Executes dropped EXE
PID:2544 -
\??\c:\lfxlxlr.exec:\lfxlxlr.exe55⤵
- Executes dropped EXE
PID:4920 -
\??\c:\nbbttt.exec:\nbbttt.exe56⤵
- Executes dropped EXE
PID:896 -
\??\c:\tbtnhb.exec:\tbtnhb.exe57⤵
- Executes dropped EXE
PID:2664 -
\??\c:\dvjdp.exec:\dvjdp.exe58⤵
- Executes dropped EXE
PID:2840 -
\??\c:\vjjvd.exec:\vjjvd.exe59⤵
- Executes dropped EXE
PID:4936 -
\??\c:\rxxlxlf.exec:\rxxlxlf.exe60⤵
- Executes dropped EXE
PID:4148 -
\??\c:\5xfrxrx.exec:\5xfrxrx.exe61⤵
- Executes dropped EXE
PID:4624 -
\??\c:\9bthnn.exec:\9bthnn.exe62⤵
- Executes dropped EXE
PID:4972 -
\??\c:\7pjvj.exec:\7pjvj.exe63⤵
- Executes dropped EXE
PID:3868 -
\??\c:\dvjvp.exec:\dvjvp.exe64⤵
- Executes dropped EXE
PID:3084 -
\??\c:\5frfrlf.exec:\5frfrlf.exe65⤵
- Executes dropped EXE
PID:928 -
\??\c:\3lrfflr.exec:\3lrfflr.exe66⤵PID:4956
-
\??\c:\9nhbnn.exec:\9nhbnn.exe67⤵PID:1772
-
\??\c:\hbtnbt.exec:\hbtnbt.exe68⤵PID:4736
-
\??\c:\pjpjv.exec:\pjpjv.exe69⤵PID:536
-
\??\c:\jpvpp.exec:\jpvpp.exe70⤵PID:3108
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe71⤵PID:3952
-
\??\c:\rrrrlrl.exec:\rrrrlrl.exe72⤵PID:3092
-
\??\c:\5tnhbt.exec:\5tnhbt.exe73⤵PID:4232
-
\??\c:\9bhtbt.exec:\9bhtbt.exe74⤵PID:2592
-
\??\c:\jdvjd.exec:\jdvjd.exe75⤵PID:688
-
\??\c:\jppjd.exec:\jppjd.exe76⤵PID:960
-
\??\c:\jdjjp.exec:\jdjjp.exe77⤵PID:2352
-
\??\c:\xrlxlfx.exec:\xrlxlfx.exe78⤵PID:4020
-
\??\c:\nhbthh.exec:\nhbthh.exe79⤵PID:3124
-
\??\c:\tbhhhh.exec:\tbhhhh.exe80⤵PID:4332
-
\??\c:\httbbn.exec:\httbbn.exe81⤵PID:1836
-
\??\c:\7jdvv.exec:\7jdvv.exe82⤵PID:1960
-
\??\c:\7jddj.exec:\7jddj.exe83⤵PID:4048
-
\??\c:\flfxrrf.exec:\flfxrrf.exe84⤵PID:760
-
\??\c:\7lxrlrl.exec:\7lxrlrl.exe85⤵PID:716
-
\??\c:\ntbtnn.exec:\ntbtnn.exe86⤵PID:4584
-
\??\c:\3nttnh.exec:\3nttnh.exe87⤵PID:4852
-
\??\c:\vdvpv.exec:\vdvpv.exe88⤵PID:2216
-
\??\c:\jjjdp.exec:\jjjdp.exe89⤵PID:3972
-
\??\c:\rlfxllx.exec:\rlfxllx.exe90⤵PID:2312
-
\??\c:\1rrlxxl.exec:\1rrlxxl.exe91⤵PID:3088
-
\??\c:\thnhbb.exec:\thnhbb.exe92⤵PID:4600
-
\??\c:\1bbtnn.exec:\1bbtnn.exe93⤵PID:3508
-
\??\c:\jpjdp.exec:\jpjdp.exe94⤵PID:4392
-
\??\c:\7rffrlx.exec:\7rffrlx.exe95⤵PID:2196
-
\??\c:\rfxxrlf.exec:\rfxxrlf.exe96⤵PID:4224
-
\??\c:\pdvjd.exec:\pdvjd.exe97⤵PID:2076
-
\??\c:\pjvpd.exec:\pjvpd.exe98⤵PID:3320
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe99⤵PID:4992
-
\??\c:\xxxrffr.exec:\xxxrffr.exe100⤵PID:1020
-
\??\c:\bbbtht.exec:\bbbtht.exe101⤵PID:4176
-
\??\c:\vjdvp.exec:\vjdvp.exe102⤵PID:1768
-
\??\c:\jvpdp.exec:\jvpdp.exe103⤵PID:1560
-
\??\c:\xffffxr.exec:\xffffxr.exe104⤵PID:4944
-
\??\c:\9htntb.exec:\9htntb.exe105⤵PID:840
-
\??\c:\jvvjp.exec:\jvvjp.exe106⤵PID:4148
-
\??\c:\vvvpj.exec:\vvvpj.exe107⤵PID:4560
-
\??\c:\5xfxfxr.exec:\5xfxfxr.exe108⤵PID:3268
-
\??\c:\7nnbnn.exec:\7nnbnn.exe109⤵PID:3028
-
\??\c:\pdpjj.exec:\pdpjj.exe110⤵PID:4388
-
\??\c:\dpvjd.exec:\dpvjd.exe111⤵PID:4956
-
\??\c:\fllxlfx.exec:\fllxlfx.exe112⤵PID:4768
-
\??\c:\xfllffx.exec:\xfllffx.exe113⤵PID:3136
-
\??\c:\nthbtt.exec:\nthbtt.exe114⤵PID:3660
-
\??\c:\jvvdd.exec:\jvvdd.exe115⤵PID:4564
-
\??\c:\rrrlxrl.exec:\rrrlxrl.exe116⤵PID:2652
-
\??\c:\9nhbnn.exec:\9nhbnn.exe117⤵PID:848
-
\??\c:\bbnnhb.exec:\bbnnhb.exe118⤵PID:436
-
\??\c:\1jjvj.exec:\1jjvj.exe119⤵PID:1028
-
\??\c:\jddvp.exec:\jddvp.exe120⤵PID:2836
-
\??\c:\rflxxlx.exec:\rflxxlx.exe121⤵PID:1180
-
\??\c:\hnnbtt.exec:\hnnbtt.exe122⤵PID:3628
-
\??\c:\7tnbnh.exec:\7tnbnh.exe123⤵PID:2648
-
\??\c:\vjjdd.exec:\vjjdd.exe124⤵PID:4580
-
\??\c:\rxxrllx.exec:\rxxrllx.exe125⤵PID:4480
-
\??\c:\3lfxlll.exec:\3lfxlll.exe126⤵PID:428
-
\??\c:\bttnnt.exec:\bttnnt.exe127⤵PID:2424
-
\??\c:\3vvpd.exec:\3vvpd.exe128⤵PID:2848
-
\??\c:\jpjdv.exec:\jpjdv.exe129⤵PID:1452
-
\??\c:\xrxrffx.exec:\xrxrffx.exe130⤵PID:3724
-
\??\c:\9ffxrlf.exec:\9ffxrlf.exe131⤵PID:1872
-
\??\c:\tththn.exec:\tththn.exe132⤵PID:4444
-
\??\c:\nhthtt.exec:\nhthtt.exe133⤵PID:3116
-
\??\c:\jpjjv.exec:\jpjjv.exe134⤵PID:2616
-
\??\c:\xlfrrlf.exec:\xlfrrlf.exe135⤵PID:4816
-
\??\c:\9xlfxxl.exec:\9xlfxxl.exe136⤵PID:4132
-
\??\c:\9hhhbt.exec:\9hhhbt.exe137⤵PID:224
-
\??\c:\dpjvp.exec:\dpjvp.exe138⤵PID:4888
-
\??\c:\9vpjd.exec:\9vpjd.exe139⤵PID:632
-
\??\c:\lxlxrrl.exec:\lxlxrrl.exe140⤵PID:4492
-
\??\c:\jvddj.exec:\jvddj.exe141⤵PID:5076
-
\??\c:\rxxrrlf.exec:\rxxrrlf.exe142⤵PID:1312
-
\??\c:\ffxrrlx.exec:\ffxrrlx.exe143⤵PID:1020
-
\??\c:\nhnhbb.exec:\nhnhbb.exe144⤵PID:1768
-
\??\c:\bnthnn.exec:\bnthnn.exe145⤵PID:796
-
\??\c:\1jpvj.exec:\1jpvj.exe146⤵PID:1692
-
\??\c:\llfxrrl.exec:\llfxrrl.exe147⤵PID:4624
-
\??\c:\3nbtnt.exec:\3nbtnt.exe148⤵PID:3868
-
\??\c:\bthbhn.exec:\bthbhn.exe149⤵PID:4716
-
\??\c:\pdvpj.exec:\pdvpj.exe150⤵PID:2552
-
\??\c:\jjjdp.exec:\jjjdp.exe151⤵PID:4768
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe152⤵PID:4500
-
\??\c:\bhhnbb.exec:\bhhnbb.exe153⤵PID:3016
-
\??\c:\thbtht.exec:\thbtht.exe154⤵PID:1468
-
\??\c:\jvjvp.exec:\jvjvp.exe155⤵PID:388
-
\??\c:\7vddv.exec:\7vddv.exe156⤵PID:1928
-
\??\c:\rfrfrlf.exec:\rfrfrlf.exe157⤵PID:4636
-
\??\c:\hhbthb.exec:\hhbthb.exe158⤵PID:5072
-
\??\c:\btnhbb.exec:\btnhbb.exe159⤵PID:392
-
\??\c:\5pjdp.exec:\5pjdp.exe160⤵PID:2168
-
\??\c:\flxffrl.exec:\flxffrl.exe161⤵PID:2648
-
\??\c:\rflfxxl.exec:\rflfxxl.exe162⤵PID:4192
-
\??\c:\hbhbtn.exec:\hbhbtn.exe163⤵PID:4480
-
\??\c:\jppjd.exec:\jppjd.exe164⤵PID:428
-
\??\c:\jjdjp.exec:\jjdjp.exe165⤵PID:2888
-
\??\c:\rlfxfrf.exec:\rlfxfrf.exe166⤵PID:4028
-
\??\c:\djpvv.exec:\djpvv.exe167⤵PID:4852
-
\??\c:\xlxxxxr.exec:\xlxxxxr.exe168⤵PID:3724
-
\??\c:\1llfxrf.exec:\1llfxrf.exe169⤵PID:1872
-
\??\c:\nhnnhn.exec:\nhnnhn.exe170⤵PID:4444
-
\??\c:\nnnntn.exec:\nnnntn.exe171⤵PID:3116
-
\??\c:\jdddv.exec:\jdddv.exe172⤵PID:4268
-
\??\c:\ffrxrxl.exec:\ffrxrxl.exe173⤵PID:4816
-
\??\c:\bnntbt.exec:\bnntbt.exe174⤵PID:3508
-
\??\c:\tbhbbh.exec:\tbhbbh.exe175⤵PID:224
-
\??\c:\1pjdv.exec:\1pjdv.exe176⤵PID:4856
-
\??\c:\3llfrlf.exec:\3llfrlf.exe177⤵PID:632
-
\??\c:\lrlffxr.exec:\lrlffxr.exe178⤵PID:3984
-
\??\c:\ppjjd.exec:\ppjjd.exe179⤵PID:5076
-
\??\c:\pdvpp.exec:\pdvpp.exe180⤵PID:1312
-
\??\c:\htttth.exec:\htttth.exe181⤵PID:896
-
\??\c:\3vppj.exec:\3vppj.exe182⤵PID:2236
-
\??\c:\lffxllr.exec:\lffxllr.exe183⤵PID:3500
-
\??\c:\bhnhbt.exec:\bhnhbt.exe184⤵PID:1692
-
\??\c:\dddvp.exec:\dddvp.exe185⤵PID:5004
-
\??\c:\xrlflxr.exec:\xrlflxr.exe186⤵PID:3268
-
\??\c:\nhbtnn.exec:\nhbtnn.exe187⤵PID:3444
-
\??\c:\dvddj.exec:\dvddj.exe188⤵PID:3260
-
\??\c:\jpdvp.exec:\jpdvp.exe189⤵PID:4768
-
\??\c:\xxlrlxr.exec:\xxlrlxr.exe190⤵PID:3896
-
\??\c:\tntbnb.exec:\tntbnb.exe191⤵PID:3092
-
\??\c:\ttbnbt.exec:\ttbnbt.exe192⤵PID:848
-
\??\c:\3pddj.exec:\3pddj.exe193⤵PID:4340
-
\??\c:\pjdvp.exec:\pjdvp.exe194⤵PID:2792
-
\??\c:\rxxxlxr.exec:\rxxxlxr.exe195⤵PID:1180
-
\??\c:\fxxflxx.exec:\fxxflxx.exe196⤵PID:1964
-
\??\c:\nbttnt.exec:\nbttnt.exe197⤵PID:4316
-
\??\c:\nbhbtn.exec:\nbhbtn.exe198⤵PID:3860
-
\??\c:\vvdvp.exec:\vvdvp.exe199⤵PID:1436
-
\??\c:\7vjdj.exec:\7vjdj.exe200⤵PID:4580
-
\??\c:\flllfxr.exec:\flllfxr.exe201⤵PID:2408
-
\??\c:\xlxrfxr.exec:\xlxrfxr.exe202⤵PID:2540
-
\??\c:\bbtbbt.exec:\bbtbbt.exe203⤵PID:3620
-
\??\c:\9tnhbt.exec:\9tnhbt.exe204⤵PID:1676
-
\??\c:\7jjdv.exec:\7jjdv.exe205⤵PID:3308
-
\??\c:\frfxrrl.exec:\frfxrrl.exe206⤵PID:3052
-
\??\c:\hhhhbb.exec:\hhhhbb.exe207⤵PID:744
-
\??\c:\bthbtb.exec:\bthbtb.exe208⤵PID:4444
-
\??\c:\1pjvd.exec:\1pjvd.exe209⤵PID:3116
-
\??\c:\jjjpp.exec:\jjjpp.exe210⤵PID:4268
-
\??\c:\xfxlxfr.exec:\xfxlxfr.exe211⤵PID:5012
-
\??\c:\frrlxxl.exec:\frrlxxl.exe212⤵PID:4324
-
\??\c:\hbhtnb.exec:\hbhtnb.exe213⤵PID:224
-
\??\c:\thbntt.exec:\thbntt.exe214⤵PID:4628
-
\??\c:\jvjdd.exec:\jvjdd.exe215⤵PID:4348
-
\??\c:\xrllrrf.exec:\xrllrrf.exe216⤵PID:4732
-
\??\c:\fllxxlf.exec:\fllxxlf.exe217⤵PID:4460
-
\??\c:\hnttbb.exec:\hnttbb.exe218⤵PID:3272
-
\??\c:\tnnnnn.exec:\tnnnnn.exe219⤵PID:896
-
\??\c:\7jjdv.exec:\7jjdv.exe220⤵PID:2236
-
\??\c:\jpjvj.exec:\jpjvj.exe221⤵PID:4560
-
\??\c:\xfxrffr.exec:\xfxrffr.exe222⤵PID:1580
-
\??\c:\3tthbt.exec:\3tthbt.exe223⤵PID:5004
-
\??\c:\bhbthb.exec:\bhbthb.exe224⤵PID:3268
-
\??\c:\dvpjd.exec:\dvpjd.exe225⤵PID:3444
-
\??\c:\vvdvp.exec:\vvdvp.exe226⤵PID:2552
-
\??\c:\pjvjv.exec:\pjvjv.exe227⤵PID:2828
-
\??\c:\xxxrlfr.exec:\xxxrlfr.exe228⤵PID:3896
-
\??\c:\xfxrllf.exec:\xfxrllf.exe229⤵PID:3092
-
\??\c:\bnnttb.exec:\bnnttb.exe230⤵PID:1876
-
\??\c:\vvpdv.exec:\vvpdv.exe231⤵PID:3732
-
\??\c:\3jpvj.exec:\3jpvj.exe232⤵PID:2792
-
\??\c:\9xfxrrf.exec:\9xfxrrf.exe233⤵PID:1180
-
\??\c:\3rffllf.exec:\3rffllf.exe234⤵PID:1964
-
\??\c:\bnbthb.exec:\bnbthb.exe235⤵PID:1608
-
\??\c:\nntnbb.exec:\nntnbb.exe236⤵PID:3860
-
\??\c:\pvdvj.exec:\pvdvj.exe237⤵PID:1436
-
\??\c:\xxxxlrx.exec:\xxxxlrx.exe238⤵PID:428
-
\??\c:\flxxxxx.exec:\flxxxxx.exe239⤵PID:2408
-
\??\c:\nhnhtt.exec:\nhnhtt.exe240⤵PID:4264
-
\??\c:\hbhbbb.exec:\hbhbbb.exe241⤵PID:4852
-
\??\c:\dddvd.exec:\dddvd.exe242⤵PID:1212