Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 11:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
efb9bd590faa892f6b16690c3902ebd0_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
efb9bd590faa892f6b16690c3902ebd0_NeikiAnalytics.exe
-
Size
90KB
-
MD5
efb9bd590faa892f6b16690c3902ebd0
-
SHA1
7d8bbc1181e2331ef37764e1fda97ff7ef7475a7
-
SHA256
52664a1a2e279e5d7921e879b20adfd929edfdc52dddf1e298455d175fa96140
-
SHA512
72e23627b02a715c05cb093ede646dac1c000b77e6646637f1427af7f64a3d70731701c5626141295e649fa68284bc7e2d162fcdda946402d27af29435dc14cf
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZaRB1:ymb3NkkiQ3mdBjFIVLd2hWZGreRCYB5
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/3076-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3164-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1420-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xxfllxl.exe7tnnhb.exerrrrfxl.exerlrffrl.exejdpjd.exerflfflr.exetnttnn.exejdpdp.exehthhbh.exejdjjp.exefxrlfrr.exethbtth.exeddppj.exe1lrfxrf.exetnnhbt.exevdjvp.exelfxrlxr.exethhtnb.exeppvpj.exerffxflf.exettnnbn.exevpjpv.exellrrlrl.exennthbb.exejddvv.exepddpd.exeffrfllf.exehhhbbh.exe5djjj.exevpvpp.exerlxxrfr.exe5hhbbb.exevppvj.exerlrrlfx.exefxlffxf.exe3hnttb.exevpvdj.exelffxlxf.exerflxlff.exebtbttt.exepdpdj.exejvjvj.exeflllxxx.exetntnnn.exe3nhtth.exedddjj.exelffxxxr.exehbbhhh.exejdvdv.exe5djpp.exerrfrfff.exelrrlffx.exetbhnhh.exehtbbhh.exevjpdd.exe5lffffx.exexffrrfx.exehhnttb.exetnthbn.exexxxxrxx.exerxxllfx.exenhhbhh.exejdppj.exefffxxlx.exepid process 3956 xxfllxl.exe 3920 7tnnhb.exe 3816 rrrrfxl.exe 868 rlrffrl.exe 1172 jdpjd.exe 1636 rflfflr.exe 2776 tnttnn.exe 5024 jdpdp.exe 1420 hthhbh.exe 4540 jdjjp.exe 1964 fxrlfrr.exe 4172 thbtth.exe 2608 ddppj.exe 2616 1lrfxrf.exe 4512 tnnhbt.exe 2060 vdjvp.exe 3916 lfxrlxr.exe 1944 thhtnb.exe 748 ppvpj.exe 3036 rffxflf.exe 3880 ttnnbn.exe 4860 vpjpv.exe 3276 llrrlrl.exe 4764 nnthbb.exe 2196 jddvv.exe 684 pddpd.exe 2036 ffrfllf.exe 4196 hhhbbh.exe 3216 5djjj.exe 3164 vpvpp.exe 4028 rlxxrfr.exe 1492 5hhbbb.exe 3532 vppvj.exe 4996 rlrrlfx.exe 2148 fxlffxf.exe 3256 3hnttb.exe 3300 vpvdj.exe 1948 lffxlxf.exe 868 rflxlff.exe 312 btbttt.exe 3976 pdpdj.exe 3692 jvjvj.exe 4424 flllxxx.exe 1452 tntnnn.exe 3776 3nhtth.exe 3820 dddjj.exe 3716 lffxxxr.exe 2356 hbbhhh.exe 4856 jdvdv.exe 2536 5djpp.exe 3884 rrfrfff.exe 2616 lrrlffx.exe 4188 tbhnhh.exe 4832 htbbhh.exe 4940 vjpdd.exe 1456 5lffffx.exe 408 xffrrfx.exe 1332 hhnttb.exe 5040 tnthbn.exe 1460 xxxxrxx.exe 404 rxxllfx.exe 4356 nhhbhh.exe 3136 jdppj.exe 4404 fffxxlx.exe -
Processes:
resource yara_rule behavioral2/memory/3076-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3164-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2608-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-23-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
efb9bd590faa892f6b16690c3902ebd0_NeikiAnalytics.exexxfllxl.exe7tnnhb.exerrrrfxl.exerlrffrl.exejdpjd.exerflfflr.exetnttnn.exejdpdp.exehthhbh.exejdjjp.exefxrlfrr.exethbtth.exeddppj.exe1lrfxrf.exetnnhbt.exevdjvp.exelfxrlxr.exethhtnb.exeppvpj.exerffxflf.exettnnbn.exedescription pid process target process PID 3076 wrote to memory of 3956 3076 efb9bd590faa892f6b16690c3902ebd0_NeikiAnalytics.exe xxfllxl.exe PID 3076 wrote to memory of 3956 3076 efb9bd590faa892f6b16690c3902ebd0_NeikiAnalytics.exe xxfllxl.exe PID 3076 wrote to memory of 3956 3076 efb9bd590faa892f6b16690c3902ebd0_NeikiAnalytics.exe xxfllxl.exe PID 3956 wrote to memory of 3920 3956 xxfllxl.exe 7tnnhb.exe PID 3956 wrote to memory of 3920 3956 xxfllxl.exe 7tnnhb.exe PID 3956 wrote to memory of 3920 3956 xxfllxl.exe 7tnnhb.exe PID 3920 wrote to memory of 3816 3920 7tnnhb.exe rrrrfxl.exe PID 3920 wrote to memory of 3816 3920 7tnnhb.exe rrrrfxl.exe PID 3920 wrote to memory of 3816 3920 7tnnhb.exe rrrrfxl.exe PID 3816 wrote to memory of 868 3816 rrrrfxl.exe rlrffrl.exe PID 3816 wrote to memory of 868 3816 rrrrfxl.exe rlrffrl.exe PID 3816 wrote to memory of 868 3816 rrrrfxl.exe rlrffrl.exe PID 868 wrote to memory of 1172 868 rlrffrl.exe jdpjd.exe PID 868 wrote to memory of 1172 868 rlrffrl.exe jdpjd.exe PID 868 wrote to memory of 1172 868 rlrffrl.exe jdpjd.exe PID 1172 wrote to memory of 1636 1172 jdpjd.exe rflfflr.exe PID 1172 wrote to memory of 1636 1172 jdpjd.exe rflfflr.exe PID 1172 wrote to memory of 1636 1172 jdpjd.exe rflfflr.exe PID 1636 wrote to memory of 2776 1636 rflfflr.exe tnttnn.exe PID 1636 wrote to memory of 2776 1636 rflfflr.exe tnttnn.exe PID 1636 wrote to memory of 2776 1636 rflfflr.exe tnttnn.exe PID 2776 wrote to memory of 5024 2776 tnttnn.exe jdpdp.exe PID 2776 wrote to memory of 5024 2776 tnttnn.exe jdpdp.exe PID 2776 wrote to memory of 5024 2776 tnttnn.exe jdpdp.exe PID 5024 wrote to memory of 1420 5024 jdpdp.exe hthhbh.exe PID 5024 wrote to memory of 1420 5024 jdpdp.exe hthhbh.exe PID 5024 wrote to memory of 1420 5024 jdpdp.exe hthhbh.exe PID 1420 wrote to memory of 4540 1420 hthhbh.exe jdjjp.exe PID 1420 wrote to memory of 4540 1420 hthhbh.exe jdjjp.exe PID 1420 wrote to memory of 4540 1420 hthhbh.exe jdjjp.exe PID 4540 wrote to memory of 1964 4540 jdjjp.exe 5djjj.exe PID 4540 wrote to memory of 1964 4540 jdjjp.exe 5djjj.exe PID 4540 wrote to memory of 1964 4540 jdjjp.exe 5djjj.exe PID 1964 wrote to memory of 4172 1964 fxrlfrr.exe thbtth.exe PID 1964 wrote to memory of 4172 1964 fxrlfrr.exe thbtth.exe PID 1964 wrote to memory of 4172 1964 fxrlfrr.exe thbtth.exe PID 4172 wrote to memory of 2608 4172 thbtth.exe ddppj.exe PID 4172 wrote to memory of 2608 4172 thbtth.exe ddppj.exe PID 4172 wrote to memory of 2608 4172 thbtth.exe ddppj.exe PID 2608 wrote to memory of 2616 2608 ddppj.exe 1lrfxrf.exe PID 2608 wrote to memory of 2616 2608 ddppj.exe 1lrfxrf.exe PID 2608 wrote to memory of 2616 2608 ddppj.exe 1lrfxrf.exe PID 2616 wrote to memory of 4512 2616 1lrfxrf.exe tnnhbt.exe PID 2616 wrote to memory of 4512 2616 1lrfxrf.exe tnnhbt.exe PID 2616 wrote to memory of 4512 2616 1lrfxrf.exe tnnhbt.exe PID 4512 wrote to memory of 2060 4512 tnnhbt.exe vdjvp.exe PID 4512 wrote to memory of 2060 4512 tnnhbt.exe vdjvp.exe PID 4512 wrote to memory of 2060 4512 tnnhbt.exe vdjvp.exe PID 2060 wrote to memory of 3916 2060 vdjvp.exe lfxrlxr.exe PID 2060 wrote to memory of 3916 2060 vdjvp.exe lfxrlxr.exe PID 2060 wrote to memory of 3916 2060 vdjvp.exe lfxrlxr.exe PID 3916 wrote to memory of 1944 3916 lfxrlxr.exe thhtnb.exe PID 3916 wrote to memory of 1944 3916 lfxrlxr.exe thhtnb.exe PID 3916 wrote to memory of 1944 3916 lfxrlxr.exe thhtnb.exe PID 1944 wrote to memory of 748 1944 thhtnb.exe ppvpj.exe PID 1944 wrote to memory of 748 1944 thhtnb.exe ppvpj.exe PID 1944 wrote to memory of 748 1944 thhtnb.exe ppvpj.exe PID 748 wrote to memory of 3036 748 ppvpj.exe rffxflf.exe PID 748 wrote to memory of 3036 748 ppvpj.exe rffxflf.exe PID 748 wrote to memory of 3036 748 ppvpj.exe rffxflf.exe PID 3036 wrote to memory of 3880 3036 rffxflf.exe ttnnbn.exe PID 3036 wrote to memory of 3880 3036 rffxflf.exe ttnnbn.exe PID 3036 wrote to memory of 3880 3036 rffxflf.exe ttnnbn.exe PID 3880 wrote to memory of 4860 3880 ttnnbn.exe vpjpv.exe
Processes
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\efb9bd590faa892f6b16690c3902ebd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\efb9bd590faa892f6b16690c3902ebd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\xxfllxl.exec:\xxfllxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\7tnnhb.exec:\7tnnhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\rrrrfxl.exec:\rrrrfxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\rlrffrl.exec:\rlrffrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\jdpjd.exec:\jdpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\rflfflr.exec:\rflfflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\tnttnn.exec:\tnttnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\jdpdp.exec:\jdpdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\hthhbh.exec:\hthhbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\jdjjp.exec:\jdjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\fxrlfrr.exec:\fxrlfrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\thbtth.exec:\thbtth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\ddppj.exec:\ddppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\1lrfxrf.exec:\1lrfxrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\tnnhbt.exec:\tnnhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\vdjvp.exec:\vdjvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\lfxrlxr.exec:\lfxrlxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\thhtnb.exec:\thhtnb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\ppvpj.exec:\ppvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\rffxflf.exec:\rffxflf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\ttnnbn.exec:\ttnnbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\vpjpv.exec:\vpjpv.exe23⤵
- Executes dropped EXE
PID:4860 -
\??\c:\llrrlrl.exec:\llrrlrl.exe24⤵
- Executes dropped EXE
PID:3276 -
\??\c:\nnthbb.exec:\nnthbb.exe25⤵
- Executes dropped EXE
PID:4764 -
\??\c:\jddvv.exec:\jddvv.exe26⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pddpd.exec:\pddpd.exe27⤵
- Executes dropped EXE
PID:684 -
\??\c:\ffrfllf.exec:\ffrfllf.exe28⤵
- Executes dropped EXE
PID:2036 -
\??\c:\hhhbbh.exec:\hhhbbh.exe29⤵
- Executes dropped EXE
PID:4196 -
\??\c:\5djjj.exec:\5djjj.exe30⤵
- Executes dropped EXE
PID:3216 -
\??\c:\vpvpp.exec:\vpvpp.exe31⤵
- Executes dropped EXE
PID:3164 -
\??\c:\rlxxrfr.exec:\rlxxrfr.exe32⤵
- Executes dropped EXE
PID:4028 -
\??\c:\5hhbbb.exec:\5hhbbb.exe33⤵
- Executes dropped EXE
PID:1492 -
\??\c:\vppvj.exec:\vppvj.exe34⤵
- Executes dropped EXE
PID:3532 -
\??\c:\rlrrlfx.exec:\rlrrlfx.exe35⤵
- Executes dropped EXE
PID:4996 -
\??\c:\fxlffxf.exec:\fxlffxf.exe36⤵
- Executes dropped EXE
PID:2148 -
\??\c:\3hnttb.exec:\3hnttb.exe37⤵
- Executes dropped EXE
PID:3256 -
\??\c:\vpvdj.exec:\vpvdj.exe38⤵
- Executes dropped EXE
PID:3300 -
\??\c:\lffxlxf.exec:\lffxlxf.exe39⤵
- Executes dropped EXE
PID:1948 -
\??\c:\rflxlff.exec:\rflxlff.exe40⤵
- Executes dropped EXE
PID:868 -
\??\c:\btbttt.exec:\btbttt.exe41⤵
- Executes dropped EXE
PID:312 -
\??\c:\pdpdj.exec:\pdpdj.exe42⤵
- Executes dropped EXE
PID:3976 -
\??\c:\jvjvj.exec:\jvjvj.exe43⤵
- Executes dropped EXE
PID:3692 -
\??\c:\flllxxx.exec:\flllxxx.exe44⤵
- Executes dropped EXE
PID:4424 -
\??\c:\tntnnn.exec:\tntnnn.exe45⤵
- Executes dropped EXE
PID:1452 -
\??\c:\3nhtth.exec:\3nhtth.exe46⤵
- Executes dropped EXE
PID:3776 -
\??\c:\dddjj.exec:\dddjj.exe47⤵
- Executes dropped EXE
PID:3820 -
\??\c:\lffxxxr.exec:\lffxxxr.exe48⤵
- Executes dropped EXE
PID:3716 -
\??\c:\hbbhhh.exec:\hbbhhh.exe49⤵
- Executes dropped EXE
PID:2356 -
\??\c:\jdvdv.exec:\jdvdv.exe50⤵
- Executes dropped EXE
PID:4856 -
\??\c:\5djpp.exec:\5djpp.exe51⤵
- Executes dropped EXE
PID:2536 -
\??\c:\rrfrfff.exec:\rrfrfff.exe52⤵
- Executes dropped EXE
PID:3884 -
\??\c:\lrrlffx.exec:\lrrlffx.exe53⤵
- Executes dropped EXE
PID:2616 -
\??\c:\tbhnhh.exec:\tbhnhh.exe54⤵
- Executes dropped EXE
PID:4188 -
\??\c:\htbbhh.exec:\htbbhh.exe55⤵
- Executes dropped EXE
PID:4832 -
\??\c:\vjpdd.exec:\vjpdd.exe56⤵
- Executes dropped EXE
PID:4940 -
\??\c:\5lffffx.exec:\5lffffx.exe57⤵
- Executes dropped EXE
PID:1456 -
\??\c:\xffrrfx.exec:\xffrrfx.exe58⤵
- Executes dropped EXE
PID:408 -
\??\c:\hhnttb.exec:\hhnttb.exe59⤵
- Executes dropped EXE
PID:1332 -
\??\c:\tnthbn.exec:\tnthbn.exe60⤵
- Executes dropped EXE
PID:5040 -
\??\c:\xxxxrxx.exec:\xxxxrxx.exe61⤵
- Executes dropped EXE
PID:1460 -
\??\c:\rxxllfx.exec:\rxxllfx.exe62⤵
- Executes dropped EXE
PID:404 -
\??\c:\nhhbhh.exec:\nhhbhh.exe63⤵
- Executes dropped EXE
PID:4356 -
\??\c:\jdppj.exec:\jdppj.exe64⤵
- Executes dropped EXE
PID:3136 -
\??\c:\fffxxlx.exec:\fffxxlx.exe65⤵
- Executes dropped EXE
PID:4404 -
\??\c:\lrrrrrr.exec:\lrrrrrr.exe66⤵PID:4544
-
\??\c:\ttnttb.exec:\ttnttb.exe67⤵PID:4764
-
\??\c:\dvppj.exec:\dvppj.exe68⤵PID:4412
-
\??\c:\pvdjj.exec:\pvdjj.exe69⤵PID:4396
-
\??\c:\frrlfxr.exec:\frrlfxr.exe70⤵PID:2044
-
\??\c:\lfxrffx.exec:\lfxrffx.exe71⤵PID:1656
-
\??\c:\bnnhbb.exec:\bnnhbb.exe72⤵PID:724
-
\??\c:\hhhhhh.exec:\hhhhhh.exe73⤵PID:4252
-
\??\c:\vdvpj.exec:\vdvpj.exe74⤵PID:3868
-
\??\c:\rfxrxrl.exec:\rfxrxrl.exe75⤵PID:4392
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe76⤵PID:4276
-
\??\c:\nnbbnh.exec:\nnbbnh.exe77⤵PID:3076
-
\??\c:\djpjj.exec:\djpjj.exe78⤵PID:2368
-
\??\c:\jpjdv.exec:\jpjdv.exe79⤵PID:2972
-
\??\c:\rrxrrll.exec:\rrxrrll.exe80⤵PID:4808
-
\??\c:\lxrrllf.exec:\lxrrllf.exe81⤵PID:3816
-
\??\c:\tnbthn.exec:\tnbthn.exe82⤵PID:2340
-
\??\c:\dvddd.exec:\dvddd.exe83⤵PID:2160
-
\??\c:\jjjpd.exec:\jjjpd.exe84⤵PID:2308
-
\??\c:\jjdvv.exec:\jjdvv.exe85⤵PID:1400
-
\??\c:\lflfxrr.exec:\lflfxrr.exe86⤵PID:4552
-
\??\c:\thtnbt.exec:\thtnbt.exe87⤵PID:2092
-
\??\c:\bttbnt.exec:\bttbnt.exe88⤵PID:3504
-
\??\c:\bttthh.exec:\bttthh.exe89⤵PID:3776
-
\??\c:\jvpjj.exec:\jvpjj.exe90⤵PID:3196
-
\??\c:\lflllfr.exec:\lflllfr.exe91⤵PID:4180
-
\??\c:\fllxrlf.exec:\fllxrlf.exe92⤵PID:4008
-
\??\c:\htnhnn.exec:\htnhnn.exe93⤵PID:4856
-
\??\c:\tttnbt.exec:\tttnbt.exe94⤵PID:2500
-
\??\c:\vdjjp.exec:\vdjjp.exe95⤵PID:2660
-
\??\c:\dvvvj.exec:\dvvvj.exe96⤵PID:2424
-
\??\c:\1llrlll.exec:\1llrlll.exe97⤵PID:772
-
\??\c:\rxlrrrl.exec:\rxlrrrl.exe98⤵PID:908
-
\??\c:\tbhthh.exec:\tbhthh.exe99⤵PID:5056
-
\??\c:\pvpvj.exec:\pvpvj.exe100⤵PID:4548
-
\??\c:\jdjdd.exec:\jdjdd.exe101⤵PID:4684
-
\??\c:\pjpvj.exec:\pjpvj.exe102⤵PID:1332
-
\??\c:\fxrfrlx.exec:\fxrfrlx.exe103⤵PID:5040
-
\??\c:\rrxxfxx.exec:\rrxxfxx.exe104⤵PID:1460
-
\??\c:\bnnhbn.exec:\bnnhbn.exe105⤵PID:404
-
\??\c:\vpdjj.exec:\vpdjj.exe106⤵PID:5036
-
\??\c:\jjjpp.exec:\jjjpp.exe107⤵PID:3136
-
\??\c:\xflrfff.exec:\xflrfff.exe108⤵PID:4404
-
\??\c:\lflfxxr.exec:\lflfxxr.exe109⤵PID:4544
-
\??\c:\nhbtnn.exec:\nhbtnn.exe110⤵PID:2196
-
\??\c:\djpdd.exec:\djpdd.exe111⤵PID:2540
-
\??\c:\pvdpj.exec:\pvdpj.exe112⤵PID:4604
-
\??\c:\bttnnn.exec:\bttnnn.exe113⤵PID:4468
-
\??\c:\dvvvj.exec:\dvvvj.exe114⤵PID:1404
-
\??\c:\jdpvv.exec:\jdpvv.exe115⤵PID:4508
-
\??\c:\1nbttt.exec:\1nbttt.exe116⤵PID:696
-
\??\c:\3tbhhh.exec:\3tbhhh.exe117⤵PID:4520
-
\??\c:\tnttnn.exec:\tnttnn.exe118⤵PID:1296
-
\??\c:\bhnhnh.exec:\bhnhnh.exe119⤵PID:2368
-
\??\c:\jvdjj.exec:\jvdjj.exe120⤵PID:3584
-
\??\c:\jdjdj.exec:\jdjdj.exe121⤵PID:4808
-
\??\c:\3rrlffx.exec:\3rrlffx.exe122⤵PID:3816
-
\??\c:\ffxfllr.exec:\ffxfllr.exe123⤵PID:2340
-
\??\c:\bthtnh.exec:\bthtnh.exe124⤵PID:312
-
\??\c:\nhnhbt.exec:\nhnhbt.exe125⤵PID:2308
-
\??\c:\vjvjv.exec:\vjvjv.exe126⤵PID:1400
-
\??\c:\jddvv.exec:\jddvv.exe127⤵PID:4552
-
\??\c:\lllllll.exec:\lllllll.exe128⤵PID:1868
-
\??\c:\9fxxffr.exec:\9fxxffr.exe129⤵PID:2028
-
\??\c:\llffxxx.exec:\llffxxx.exe130⤵PID:4540
-
\??\c:\tttnbn.exec:\tttnbn.exe131⤵PID:3196
-
\??\c:\nhhbhb.exec:\nhhbhb.exe132⤵PID:1204
-
\??\c:\pjpdv.exec:\pjpdv.exe133⤵PID:4008
-
\??\c:\9dddd.exec:\9dddd.exe134⤵PID:3932
-
\??\c:\flxxlll.exec:\flxxlll.exe135⤵PID:2500
-
\??\c:\fxxrxxr.exec:\fxxrxxr.exe136⤵PID:4512
-
\??\c:\bbnhnt.exec:\bbnhnt.exe137⤵PID:3348
-
\??\c:\tnnntt.exec:\tnnntt.exe138⤵PID:3648
-
\??\c:\9pvvp.exec:\9pvvp.exe139⤵PID:908
-
\??\c:\pdpdv.exec:\pdpdv.exe140⤵PID:5056
-
\??\c:\xffrxfx.exec:\xffrxfx.exe141⤵PID:4772
-
\??\c:\fffrlll.exec:\fffrlll.exe142⤵PID:3036
-
\??\c:\lrlrrll.exec:\lrlrrll.exe143⤵PID:1332
-
\??\c:\3bbtnn.exec:\3bbtnn.exe144⤵PID:2488
-
\??\c:\htnbbb.exec:\htnbbb.exe145⤵PID:1460
-
\??\c:\vvppd.exec:\vvppd.exe146⤵PID:404
-
\??\c:\7vpvp.exec:\7vpvp.exe147⤵PID:4516
-
\??\c:\jdjpp.exec:\jdjpp.exe148⤵PID:4592
-
\??\c:\lrrlffx.exec:\lrrlffx.exe149⤵PID:2756
-
\??\c:\5xxxffx.exec:\5xxxffx.exe150⤵PID:4544
-
\??\c:\ttbbht.exec:\ttbbht.exe151⤵PID:3548
-
\??\c:\nbtbbh.exec:\nbtbbh.exe152⤵PID:232
-
\??\c:\pdjdv.exec:\pdjdv.exe153⤵PID:720
-
\??\c:\jppjj.exec:\jppjj.exe154⤵PID:3216
-
\??\c:\ddppp.exec:\ddppp.exe155⤵PID:3960
-
\??\c:\lfllllr.exec:\lfllllr.exe156⤵PID:2800
-
\??\c:\xxfflll.exec:\xxfflll.exe157⤵PID:4452
-
\??\c:\thbbbb.exec:\thbbbb.exe158⤵PID:3296
-
\??\c:\1jvpv.exec:\1jvpv.exe159⤵PID:2972
-
\??\c:\ppdvj.exec:\ppdvj.exe160⤵PID:2084
-
\??\c:\tnbbtb.exec:\tnbbtb.exe161⤵PID:1636
-
\??\c:\bttbhn.exec:\bttbhn.exe162⤵PID:3976
-
\??\c:\htbtnn.exec:\htbtnn.exe163⤵PID:1784
-
\??\c:\jjjjp.exec:\jjjjp.exe164⤵PID:4436
-
\??\c:\pdjjd.exec:\pdjjd.exe165⤵PID:1452
-
\??\c:\fllfrrf.exec:\fllfrrf.exe166⤵PID:4444
-
\??\c:\frrrffx.exec:\frrrffx.exe167⤵PID:4812
-
\??\c:\bhhnnn.exec:\bhhnnn.exe168⤵PID:3196
-
\??\c:\thnnnn.exec:\thnnnn.exe169⤵PID:2096
-
\??\c:\pjddv.exec:\pjddv.exe170⤵PID:3512
-
\??\c:\djdvd.exec:\djdvd.exe171⤵PID:3560
-
\??\c:\xxlfrrf.exec:\xxlfrrf.exe172⤵PID:2060
-
\??\c:\hhhnhn.exec:\hhhnhn.exe173⤵PID:4832
-
\??\c:\nhnnhn.exec:\nhnnhn.exe174⤵PID:3496
-
\??\c:\jppdv.exec:\jppdv.exe175⤵PID:3240
-
\??\c:\pjvdp.exec:\pjvdp.exe176⤵PID:3308
-
\??\c:\ffxrrrr.exec:\ffxrrrr.exe177⤵PID:2328
-
\??\c:\bthbhn.exec:\bthbhn.exe178⤵PID:3384
-
\??\c:\thhtnn.exec:\thhtnn.exe179⤵PID:4352
-
\??\c:\bnthht.exec:\bnthht.exe180⤵PID:2524
-
\??\c:\jvdjd.exec:\jvdjd.exe181⤵PID:4184
-
\??\c:\lllffll.exec:\lllffll.exe182⤵PID:3228
-
\??\c:\lrfxrxf.exec:\lrfxrxf.exe183⤵PID:968
-
\??\c:\ttnhnn.exec:\ttnhnn.exe184⤵PID:2304
-
\??\c:\htttnn.exec:\htttnn.exe185⤵PID:4816
-
\??\c:\vvvvp.exec:\vvvvp.exe186⤵PID:4412
-
\??\c:\vvppp.exec:\vvppp.exe187⤵PID:4396
-
\??\c:\flxlxll.exec:\flxlxll.exe188⤵PID:840
-
\??\c:\nbnbhb.exec:\nbnbhb.exe189⤵PID:1836
-
\??\c:\tnhhhh.exec:\tnhhhh.exe190⤵PID:4228
-
\??\c:\vjjvj.exec:\vjjvj.exe191⤵PID:1492
-
\??\c:\jjjvv.exec:\jjjvv.exe192⤵PID:4276
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe193⤵PID:4324
-
\??\c:\lrrrrrr.exec:\lrrrrrr.exe194⤵PID:4700
-
\??\c:\5frffrx.exec:\5frffrx.exe195⤵PID:4584
-
\??\c:\nhbbbn.exec:\nhbbbn.exe196⤵PID:2168
-
\??\c:\7bttnt.exec:\7bttnt.exe197⤵PID:4612
-
\??\c:\dvddd.exec:\dvddd.exe198⤵PID:3736
-
\??\c:\9pdvv.exec:\9pdvv.exe199⤵PID:2596
-
\??\c:\rrlflfx.exec:\rrlflfx.exe200⤵PID:2052
-
\??\c:\flfrfff.exec:\flfrfff.exe201⤵PID:2356
-
\??\c:\ntthht.exec:\ntthht.exe202⤵PID:1916
-
\??\c:\9hbhbn.exec:\9hbhbn.exe203⤵PID:4008
-
\??\c:\5djdd.exec:\5djdd.exe204⤵PID:2804
-
\??\c:\pdpdp.exec:\pdpdp.exe205⤵PID:3260
-
\??\c:\dvddv.exec:\dvddv.exe206⤵PID:4380
-
\??\c:\rxrlrlr.exec:\rxrlrlr.exe207⤵PID:3896
-
\??\c:\3xxxxll.exec:\3xxxxll.exe208⤵PID:1456
-
\??\c:\bbhbtt.exec:\bbhbtt.exe209⤵PID:3240
-
\??\c:\dvppp.exec:\dvppp.exe210⤵PID:4772
-
\??\c:\vjppj.exec:\vjppj.exe211⤵PID:3036
-
\??\c:\dpdvj.exec:\dpdvj.exe212⤵PID:3244
-
\??\c:\1lxxffl.exec:\1lxxffl.exe213⤵PID:2488
-
\??\c:\fxllfrr.exec:\fxllfrr.exe214⤵PID:1460
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe215⤵PID:3728
-
\??\c:\ttbbnt.exec:\ttbbnt.exe216⤵PID:3276
-
\??\c:\btthtb.exec:\btthtb.exe217⤵PID:968
-
\??\c:\vppjj.exec:\vppjj.exe218⤵PID:404
-
\??\c:\jvpdv.exec:\jvpdv.exe219⤵PID:2036
-
\??\c:\xrrxrxr.exec:\xrrxrxr.exe220⤵PID:4412
-
\??\c:\ffxlrxx.exec:\ffxlrxx.exe221⤵PID:1156
-
\??\c:\hhbbhh.exec:\hhbbhh.exe222⤵PID:3164
-
\??\c:\bthhbb.exec:\bthhbb.exe223⤵PID:1836
-
\??\c:\thhntt.exec:\thhntt.exe224⤵PID:1932
-
\??\c:\jdjjd.exec:\jdjjd.exe225⤵PID:1492
-
\??\c:\vjppp.exec:\vjppp.exe226⤵PID:4276
-
\??\c:\rxlfxff.exec:\rxlfxff.exe227⤵PID:4324
-
\??\c:\lxrxlfx.exec:\lxrxlfx.exe228⤵PID:4700
-
\??\c:\llxrrfr.exec:\llxrrfr.exe229⤵PID:868
-
\??\c:\hbhtnn.exec:\hbhtnn.exe230⤵PID:1736
-
\??\c:\hhbnhb.exec:\hhbnhb.exe231⤵PID:4612
-
\??\c:\dvvvd.exec:\dvvvd.exe232⤵PID:1004
-
\??\c:\3pppp.exec:\3pppp.exe233⤵PID:4740
-
\??\c:\rrlfllr.exec:\rrlfllr.exe234⤵PID:1964
-
\??\c:\llrrlrx.exec:\llrrlrx.exe235⤵PID:2864
-
\??\c:\xflfxxr.exec:\xflfxxr.exe236⤵PID:4320
-
\??\c:\bnnntt.exec:\bnnntt.exe237⤵PID:2428
-
\??\c:\btttnn.exec:\btttnn.exe238⤵PID:4908
-
\??\c:\pdjpp.exec:\pdjpp.exe239⤵PID:4512
-
\??\c:\jpjpj.exec:\jpjpj.exe240⤵PID:3348
-
\??\c:\rlllffx.exec:\rlllffx.exe241⤵PID:3764
-
\??\c:\rrlrlrx.exec:\rrlrlrx.exe242⤵PID:4920