Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 06:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad_NeikiAnalytics.exe
-
Size
70KB
-
MD5
1488de7775fdcf49c50f2fee54027730
-
SHA1
3cdeecdf8b8d06c2c3ade21a9cb0f0154adfdff0
-
SHA256
0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad
-
SHA512
ce56818471e9499ac8deb7d828eb8711f8275d578d447897bbf3ad5db1514a9c460c0cf66458f3389cf1597c31cb6d202b168cea425e9fdc617a3757cc2f5d35
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgyYrv:ymb3NkkiQ3mdBjFo73thYD
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/4080-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-31-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-42-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2236-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3868-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bhhbbb.exedjdvv.exerlxxlrf.exexxffllr.exennhhnn.exethnnnn.exeddddd.exe9rxxlll.exe5jjdd.exerrfxxxr.exebnthhn.exepddpj.exerxxxrxx.exexrrlllf.exevjddj.exerffrxff.exehnnhbh.exevdpvd.exexfxxxxx.exethntnn.exedvddd.exexxrlxff.exenbntnn.exejpvpp.exe9djdv.exexllrxrf.exe1llrrff.exehhhbtn.exevdpvv.exelflfrrl.exe3nnnhh.exebnhnnh.exejpdpd.exefxxlrxf.exe5bhbbh.exepdjdp.exepjjdv.exelxlxxrf.exehhbhbt.exe3nbbnn.exepjpvp.exefxlrlrl.exefrrrrxx.exentbbbb.exehbbbtt.exepvjdj.exefxllrrx.exe9nhbhn.exeddvvd.exepjvpj.exeflfxxfl.exetnnhtn.exenhttbb.exevdvpp.exe1ffxllf.exelffflrf.exe7bbbnt.exenhnnhh.exenhnnnt.exejvdpj.exe7jppp.exexrlrxfl.exexlllffx.exetntttb.exepid process 3680 bhhbbb.exe 3836 djdvv.exe 964 rlxxlrf.exe 936 xxffllr.exe 2996 nnhhnn.exe 2236 thnnnn.exe 2712 ddddd.exe 4584 9rxxlll.exe 2460 5jjdd.exe 2888 rrfxxxr.exe 3280 bnthhn.exe 3840 pddpj.exe 3612 rxxxrxx.exe 3400 xrrlllf.exe 1716 vjddj.exe 1912 rffrxff.exe 1348 hnnhbh.exe 3500 vdpvd.exe 2516 xfxxxxx.exe 5048 thntnn.exe 1272 dvddd.exe 4836 xxrlxff.exe 3868 nbntnn.exe 1276 jpvpp.exe 4140 9djdv.exe 1788 xllrxrf.exe 4736 1llrrff.exe 3988 hhhbtn.exe 2240 vdpvv.exe 2704 lflfrrl.exe 5028 3nnnhh.exe 5076 bnhnnh.exe 4728 jpdpd.exe 4220 fxxlrxf.exe 1328 5bhbbh.exe 3376 pdjdp.exe 5108 pjjdv.exe 3944 lxlxxrf.exe 3916 hhbhbt.exe 1384 3nbbnn.exe 4484 pjpvp.exe 3660 fxlrlrl.exe 4144 frrrrxx.exe 1352 ntbbbb.exe 3012 hbbbtt.exe 936 pvjdj.exe 1720 fxllrrx.exe 2996 9nhbhn.exe 1468 ddvvd.exe 1008 pjvpj.exe 4112 flfxxfl.exe 4960 tnnhtn.exe 2672 nhttbb.exe 3068 vdvpp.exe 3044 1ffxllf.exe 4948 lffflrf.exe 3840 7bbbnt.exe 4984 nhnnhh.exe 3612 nhnnnt.exe 3400 jvdpj.exe 2084 7jppp.exe 4360 xrlrxfl.exe 4048 xlllffx.exe 1348 tntttb.exe -
Processes:
resource yara_rule behavioral2/memory/4080-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3868-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1276-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad_NeikiAnalytics.exebhhbbb.exedjdvv.exerlxxlrf.exexxffllr.exennhhnn.exethnnnn.exeddddd.exe9rxxlll.exe5jjdd.exerrfxxxr.exebnthhn.exepddpj.exerxxxrxx.exexrrlllf.exevjddj.exerffrxff.exehnnhbh.exevdpvd.exexfxxxxx.exethntnn.exedvddd.exedescription pid process target process PID 4080 wrote to memory of 3680 4080 0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad_NeikiAnalytics.exe bhhbbb.exe PID 4080 wrote to memory of 3680 4080 0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad_NeikiAnalytics.exe bhhbbb.exe PID 4080 wrote to memory of 3680 4080 0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad_NeikiAnalytics.exe bhhbbb.exe PID 3680 wrote to memory of 3836 3680 bhhbbb.exe djdvv.exe PID 3680 wrote to memory of 3836 3680 bhhbbb.exe djdvv.exe PID 3680 wrote to memory of 3836 3680 bhhbbb.exe djdvv.exe PID 3836 wrote to memory of 964 3836 djdvv.exe rlxxlrf.exe PID 3836 wrote to memory of 964 3836 djdvv.exe rlxxlrf.exe PID 3836 wrote to memory of 964 3836 djdvv.exe rlxxlrf.exe PID 964 wrote to memory of 936 964 rlxxlrf.exe xxffllr.exe PID 964 wrote to memory of 936 964 rlxxlrf.exe xxffllr.exe PID 964 wrote to memory of 936 964 rlxxlrf.exe xxffllr.exe PID 936 wrote to memory of 2996 936 xxffllr.exe nnhhnn.exe PID 936 wrote to memory of 2996 936 xxffllr.exe nnhhnn.exe PID 936 wrote to memory of 2996 936 xxffllr.exe nnhhnn.exe PID 2996 wrote to memory of 2236 2996 nnhhnn.exe thnnnn.exe PID 2996 wrote to memory of 2236 2996 nnhhnn.exe thnnnn.exe PID 2996 wrote to memory of 2236 2996 nnhhnn.exe thnnnn.exe PID 2236 wrote to memory of 2712 2236 thnnnn.exe ddddd.exe PID 2236 wrote to memory of 2712 2236 thnnnn.exe ddddd.exe PID 2236 wrote to memory of 2712 2236 thnnnn.exe ddddd.exe PID 2712 wrote to memory of 4584 2712 ddddd.exe 9rxxlll.exe PID 2712 wrote to memory of 4584 2712 ddddd.exe 9rxxlll.exe PID 2712 wrote to memory of 4584 2712 ddddd.exe 9rxxlll.exe PID 4584 wrote to memory of 2460 4584 9rxxlll.exe 5jjdd.exe PID 4584 wrote to memory of 2460 4584 9rxxlll.exe 5jjdd.exe PID 4584 wrote to memory of 2460 4584 9rxxlll.exe 5jjdd.exe PID 2460 wrote to memory of 2888 2460 5jjdd.exe rrfxxxr.exe PID 2460 wrote to memory of 2888 2460 5jjdd.exe rrfxxxr.exe PID 2460 wrote to memory of 2888 2460 5jjdd.exe rrfxxxr.exe PID 2888 wrote to memory of 3280 2888 rrfxxxr.exe bnthhn.exe PID 2888 wrote to memory of 3280 2888 rrfxxxr.exe bnthhn.exe PID 2888 wrote to memory of 3280 2888 rrfxxxr.exe bnthhn.exe PID 3280 wrote to memory of 3840 3280 bnthhn.exe pddpj.exe PID 3280 wrote to memory of 3840 3280 bnthhn.exe pddpj.exe PID 3280 wrote to memory of 3840 3280 bnthhn.exe pddpj.exe PID 3840 wrote to memory of 3612 3840 pddpj.exe rxxxrxx.exe PID 3840 wrote to memory of 3612 3840 pddpj.exe rxxxrxx.exe PID 3840 wrote to memory of 3612 3840 pddpj.exe rxxxrxx.exe PID 3612 wrote to memory of 3400 3612 rxxxrxx.exe xrrlllf.exe PID 3612 wrote to memory of 3400 3612 rxxxrxx.exe xrrlllf.exe PID 3612 wrote to memory of 3400 3612 rxxxrxx.exe xrrlllf.exe PID 3400 wrote to memory of 1716 3400 xrrlllf.exe vjddj.exe PID 3400 wrote to memory of 1716 3400 xrrlllf.exe vjddj.exe PID 3400 wrote to memory of 1716 3400 xrrlllf.exe vjddj.exe PID 1716 wrote to memory of 1912 1716 vjddj.exe rffrxff.exe PID 1716 wrote to memory of 1912 1716 vjddj.exe rffrxff.exe PID 1716 wrote to memory of 1912 1716 vjddj.exe rffrxff.exe PID 1912 wrote to memory of 1348 1912 rffrxff.exe hnnhbh.exe PID 1912 wrote to memory of 1348 1912 rffrxff.exe hnnhbh.exe PID 1912 wrote to memory of 1348 1912 rffrxff.exe hnnhbh.exe PID 1348 wrote to memory of 3500 1348 hnnhbh.exe vdpvd.exe PID 1348 wrote to memory of 3500 1348 hnnhbh.exe vdpvd.exe PID 1348 wrote to memory of 3500 1348 hnnhbh.exe vdpvd.exe PID 3500 wrote to memory of 2516 3500 vdpvd.exe xfxxxxx.exe PID 3500 wrote to memory of 2516 3500 vdpvd.exe xfxxxxx.exe PID 3500 wrote to memory of 2516 3500 vdpvd.exe xfxxxxx.exe PID 2516 wrote to memory of 5048 2516 xfxxxxx.exe thntnn.exe PID 2516 wrote to memory of 5048 2516 xfxxxxx.exe thntnn.exe PID 2516 wrote to memory of 5048 2516 xfxxxxx.exe thntnn.exe PID 5048 wrote to memory of 1272 5048 thntnn.exe dvddd.exe PID 5048 wrote to memory of 1272 5048 thntnn.exe dvddd.exe PID 5048 wrote to memory of 1272 5048 thntnn.exe dvddd.exe PID 1272 wrote to memory of 4836 1272 dvddd.exe xxrlxff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0ea57f855bd5ce895bc87519588edeacfbcdd859f2acfea278013bd17f68b0ad_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\bhhbbb.exec:\bhhbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\djdvv.exec:\djdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\rlxxlrf.exec:\rlxxlrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\xxffllr.exec:\xxffllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\nnhhnn.exec:\nnhhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\thnnnn.exec:\thnnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\ddddd.exec:\ddddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\9rxxlll.exec:\9rxxlll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\5jjdd.exec:\5jjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\rrfxxxr.exec:\rrfxxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\bnthhn.exec:\bnthhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\pddpj.exec:\pddpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\rxxxrxx.exec:\rxxxrxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\xrrlllf.exec:\xrrlllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\vjddj.exec:\vjddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\rffrxff.exec:\rffrxff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\hnnhbh.exec:\hnnhbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\vdpvd.exec:\vdpvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\xfxxxxx.exec:\xfxxxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\thntnn.exec:\thntnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\dvddd.exec:\dvddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\xxrlxff.exec:\xxrlxff.exe23⤵
- Executes dropped EXE
PID:4836 -
\??\c:\nbntnn.exec:\nbntnn.exe24⤵
- Executes dropped EXE
PID:3868 -
\??\c:\jpvpp.exec:\jpvpp.exe25⤵
- Executes dropped EXE
PID:1276 -
\??\c:\9djdv.exec:\9djdv.exe26⤵
- Executes dropped EXE
PID:4140 -
\??\c:\xllrxrf.exec:\xllrxrf.exe27⤵
- Executes dropped EXE
PID:1788 -
\??\c:\1llrrff.exec:\1llrrff.exe28⤵
- Executes dropped EXE
PID:4736 -
\??\c:\hhhbtn.exec:\hhhbtn.exe29⤵
- Executes dropped EXE
PID:3988 -
\??\c:\vdpvv.exec:\vdpvv.exe30⤵
- Executes dropped EXE
PID:2240 -
\??\c:\lflfrrl.exec:\lflfrrl.exe31⤵
- Executes dropped EXE
PID:2704 -
\??\c:\3nnnhh.exec:\3nnnhh.exe32⤵
- Executes dropped EXE
PID:5028 -
\??\c:\bnhnnh.exec:\bnhnnh.exe33⤵
- Executes dropped EXE
PID:5076 -
\??\c:\jpdpd.exec:\jpdpd.exe34⤵
- Executes dropped EXE
PID:4728 -
\??\c:\fxxlrxf.exec:\fxxlrxf.exe35⤵
- Executes dropped EXE
PID:4220 -
\??\c:\5bhbbh.exec:\5bhbbh.exe36⤵
- Executes dropped EXE
PID:1328 -
\??\c:\pdjdp.exec:\pdjdp.exe37⤵
- Executes dropped EXE
PID:3376 -
\??\c:\pjjdv.exec:\pjjdv.exe38⤵
- Executes dropped EXE
PID:5108 -
\??\c:\lxlxxrf.exec:\lxlxxrf.exe39⤵
- Executes dropped EXE
PID:3944 -
\??\c:\hhbhbt.exec:\hhbhbt.exe40⤵
- Executes dropped EXE
PID:3916 -
\??\c:\3nbbnn.exec:\3nbbnn.exe41⤵
- Executes dropped EXE
PID:1384 -
\??\c:\pjpvp.exec:\pjpvp.exe42⤵
- Executes dropped EXE
PID:4484 -
\??\c:\fxlrlrl.exec:\fxlrlrl.exe43⤵
- Executes dropped EXE
PID:3660 -
\??\c:\frrrrxx.exec:\frrrrxx.exe44⤵
- Executes dropped EXE
PID:4144 -
\??\c:\ntbbbb.exec:\ntbbbb.exe45⤵
- Executes dropped EXE
PID:1352 -
\??\c:\hbbbtt.exec:\hbbbtt.exe46⤵
- Executes dropped EXE
PID:3012 -
\??\c:\pvjdj.exec:\pvjdj.exe47⤵
- Executes dropped EXE
PID:936 -
\??\c:\fxllrrx.exec:\fxllrrx.exe48⤵
- Executes dropped EXE
PID:1720 -
\??\c:\9nhbhn.exec:\9nhbhn.exe49⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ddvvd.exec:\ddvvd.exe50⤵
- Executes dropped EXE
PID:1468 -
\??\c:\pjvpj.exec:\pjvpj.exe51⤵
- Executes dropped EXE
PID:1008 -
\??\c:\flfxxfl.exec:\flfxxfl.exe52⤵
- Executes dropped EXE
PID:4112 -
\??\c:\tnnhtn.exec:\tnnhtn.exe53⤵
- Executes dropped EXE
PID:4960 -
\??\c:\nhttbb.exec:\nhttbb.exe54⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vdvpp.exec:\vdvpp.exe55⤵
- Executes dropped EXE
PID:3068 -
\??\c:\1ffxllf.exec:\1ffxllf.exe56⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lffflrf.exec:\lffflrf.exe57⤵
- Executes dropped EXE
PID:4948 -
\??\c:\7bbbnt.exec:\7bbbnt.exe58⤵
- Executes dropped EXE
PID:3840 -
\??\c:\nhnnhh.exec:\nhnnhh.exe59⤵
- Executes dropped EXE
PID:4984 -
\??\c:\nhnnnt.exec:\nhnnnt.exe60⤵
- Executes dropped EXE
PID:3612 -
\??\c:\jvdpj.exec:\jvdpj.exe61⤵
- Executes dropped EXE
PID:3400 -
\??\c:\7jppp.exec:\7jppp.exe62⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe63⤵
- Executes dropped EXE
PID:4360 -
\??\c:\xlllffx.exec:\xlllffx.exe64⤵
- Executes dropped EXE
PID:4048 -
\??\c:\tntttb.exec:\tntttb.exe65⤵
- Executes dropped EXE
PID:1348 -
\??\c:\hnhtbh.exec:\hnhtbh.exe66⤵PID:3928
-
\??\c:\5pjdv.exec:\5pjdv.exe67⤵PID:2520
-
\??\c:\ppdvp.exec:\ppdvp.exe68⤵PID:1784
-
\??\c:\rlxrlxr.exec:\rlxrlxr.exe69⤵PID:464
-
\??\c:\lrrrlll.exec:\lrrrlll.exe70⤵PID:1412
-
\??\c:\nbhnnt.exec:\nbhnnt.exe71⤵PID:4304
-
\??\c:\hbbttn.exec:\hbbttn.exe72⤵PID:976
-
\??\c:\dpvpj.exec:\dpvpj.exe73⤵PID:5064
-
\??\c:\ddvpj.exec:\ddvpj.exe74⤵PID:2608
-
\??\c:\3fllffx.exec:\3fllffx.exe75⤵PID:1380
-
\??\c:\nbnhhh.exec:\nbnhhh.exe76⤵PID:1776
-
\??\c:\bntnnn.exec:\bntnnn.exe77⤵PID:2348
-
\??\c:\thnnnn.exec:\thnnnn.exe78⤵PID:2352
-
\??\c:\vvvvp.exec:\vvvvp.exe79⤵PID:1268
-
\??\c:\5vpjj.exec:\5vpjj.exe80⤵PID:4548
-
\??\c:\7lrlffx.exec:\7lrlffx.exe81⤵PID:2404
-
\??\c:\rlxfxfx.exec:\rlxfxfx.exe82⤵PID:1520
-
\??\c:\5tbhhb.exec:\5tbhhb.exe83⤵PID:2360
-
\??\c:\thnnnt.exec:\thnnnt.exe84⤵PID:1916
-
\??\c:\5jjdv.exec:\5jjdv.exe85⤵PID:1832
-
\??\c:\jdjdp.exec:\jdjdp.exe86⤵PID:1328
-
\??\c:\fxxxrll.exec:\fxxxrll.exe87⤵PID:3376
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe88⤵PID:4604
-
\??\c:\tthhhh.exec:\tthhhh.exe89⤵PID:3852
-
\??\c:\5jpjd.exec:\5jpjd.exe90⤵PID:3944
-
\??\c:\vjpjp.exec:\vjpjp.exe91⤵PID:1384
-
\??\c:\hnnttt.exec:\hnnttt.exe92⤵PID:4484
-
\??\c:\btnhtt.exec:\btnhtt.exe93⤵PID:1312
-
\??\c:\jppvd.exec:\jppvd.exe94⤵PID:3836
-
\??\c:\vvjdd.exec:\vvjdd.exe95⤵PID:2376
-
\??\c:\flfxrrf.exec:\flfxrrf.exe96⤵PID:4300
-
\??\c:\thhhhb.exec:\thhhhb.exe97⤵PID:1112
-
\??\c:\vdjdd.exec:\vdjdd.exe98⤵PID:1408
-
\??\c:\pdjjp.exec:\pdjjp.exe99⤵PID:1652
-
\??\c:\3flfxfx.exec:\3flfxfx.exe100⤵PID:864
-
\??\c:\bhtttt.exec:\bhtttt.exe101⤵PID:4328
-
\??\c:\nhnhbt.exec:\nhnhbt.exe102⤵PID:3892
-
\??\c:\9jppj.exec:\9jppj.exe103⤵PID:1364
-
\??\c:\jpddv.exec:\jpddv.exe104⤵PID:2888
-
\??\c:\flfllll.exec:\flfllll.exe105⤵PID:4748
-
\??\c:\bttthn.exec:\bttthn.exe106⤵PID:2344
-
\??\c:\thhhbn.exec:\thhhbn.exe107⤵PID:4840
-
\??\c:\pdjdv.exec:\pdjdv.exe108⤵PID:3196
-
\??\c:\jdjvd.exec:\jdjvd.exe109⤵PID:4984
-
\??\c:\9lrllrr.exec:\9lrllrr.exe110⤵PID:4212
-
\??\c:\hntntt.exec:\hntntt.exe111⤵PID:2520
-
\??\c:\vjjpp.exec:\vjjpp.exe112⤵PID:2820
-
\??\c:\pjppv.exec:\pjppv.exe113⤵PID:4836
-
\??\c:\fffxrrr.exec:\fffxrrr.exe114⤵PID:1824
-
\??\c:\5fxxrll.exec:\5fxxrll.exe115⤵PID:4852
-
\??\c:\nhbtnh.exec:\nhbtnh.exe116⤵PID:976
-
\??\c:\jdddv.exec:\jdddv.exe117⤵PID:1368
-
\??\c:\vdjpv.exec:\vdjpv.exe118⤵PID:8
-
\??\c:\fffxxll.exec:\fffxxll.exe119⤵PID:4736
-
\??\c:\xflfxxx.exec:\xflfxxx.exe120⤵PID:2240
-
\??\c:\nbbbhh.exec:\nbbbhh.exe121⤵PID:3084
-
\??\c:\ddjjj.exec:\ddjjj.exe122⤵PID:1268
-
\??\c:\lffxlll.exec:\lffxlll.exe123⤵PID:5028
-
\??\c:\hhhbtb.exec:\hhhbtb.exe124⤵PID:1508
-
\??\c:\jddvp.exec:\jddvp.exe125⤵PID:3956
-
\??\c:\vdvjv.exec:\vdvjv.exe126⤵PID:4220
-
\??\c:\fffflrr.exec:\fffflrr.exe127⤵PID:4540
-
\??\c:\hnhnhb.exec:\hnhnhb.exe128⤵PID:1168
-
\??\c:\pvpjd.exec:\pvpjd.exe129⤵PID:1448
-
\??\c:\rxrlxff.exec:\rxrlxff.exe130⤵PID:4832
-
\??\c:\7nhhhh.exec:\7nhhhh.exe131⤵PID:3852
-
\??\c:\1pjjd.exec:\1pjjd.exe132⤵PID:4468
-
\??\c:\pjddd.exec:\pjddd.exe133⤵PID:4356
-
\??\c:\rfllxff.exec:\rfllxff.exe134⤵PID:1160
-
\??\c:\rlllxrx.exec:\rlllxrx.exe135⤵PID:3836
-
\??\c:\nhnnbb.exec:\nhnnbb.exe136⤵PID:1560
-
\??\c:\thhnnn.exec:\thhnnn.exe137⤵PID:4300
-
\??\c:\9pvvp.exec:\9pvvp.exe138⤵PID:1720
-
\??\c:\jjppp.exec:\jjppp.exe139⤵PID:540
-
\??\c:\lfrllrx.exec:\lfrllrx.exe140⤵PID:2304
-
\??\c:\lrffrlf.exec:\lrffrlf.exe141⤵PID:2128
-
\??\c:\thtntt.exec:\thtntt.exe142⤵PID:2080
-
\??\c:\btnnhh.exec:\btnnhh.exe143⤵PID:4492
-
\??\c:\jvvjd.exec:\jvvjd.exe144⤵PID:3284
-
\??\c:\ppjjj.exec:\ppjjj.exe145⤵PID:4788
-
\??\c:\fflffff.exec:\fflffff.exe146⤵PID:1984
-
\??\c:\3fllllr.exec:\3fllllr.exe147⤵PID:3380
-
\??\c:\3nnhtt.exec:\3nnhtt.exe148⤵PID:4632
-
\??\c:\dvddd.exec:\dvddd.exe149⤵PID:1828
-
\??\c:\rlrrlfx.exec:\rlrrlfx.exe150⤵PID:3564
-
\??\c:\1nnhbb.exec:\1nnhbb.exe151⤵PID:4984
-
\??\c:\btbbhb.exec:\btbbhb.exe152⤵PID:740
-
\??\c:\vpvvv.exec:\vpvvv.exe153⤵PID:5048
-
\??\c:\frfxxxf.exec:\frfxxxf.exe154⤵PID:916
-
\??\c:\5hbhhb.exec:\5hbhhb.exe155⤵PID:4812
-
\??\c:\vdvvv.exec:\vdvvv.exe156⤵PID:868
-
\??\c:\pvdvp.exec:\pvdvp.exe157⤵PID:3844
-
\??\c:\ntbthh.exec:\ntbthh.exe158⤵PID:5008
-
\??\c:\lxfxxff.exec:\lxfxxff.exe159⤵PID:4140
-
\??\c:\jvvjj.exec:\jvvjj.exe160⤵PID:2036
-
\??\c:\tthbbn.exec:\tthbbn.exe161⤵PID:3584
-
\??\c:\pjdvp.exec:\pjdvp.exe162⤵PID:4412
-
\??\c:\jjpdv.exec:\jjpdv.exe163⤵PID:3780
-
\??\c:\llrllff.exec:\llrllff.exe164⤵PID:4404
-
\??\c:\tbbbnb.exec:\tbbbnb.exe165⤵PID:3628
-
\??\c:\bntbht.exec:\bntbht.exe166⤵PID:3948
-
\??\c:\jvjpd.exec:\jvjpd.exe167⤵PID:1260
-
\??\c:\rlrllff.exec:\rlrllff.exe168⤵PID:4648
-
\??\c:\rrrrllf.exec:\rrrrllf.exe169⤵PID:1388
-
\??\c:\hbtthh.exec:\hbtthh.exe170⤵PID:4200
-
\??\c:\vdvpj.exec:\vdvpj.exe171⤵PID:940
-
\??\c:\jddvp.exec:\jddvp.exe172⤵PID:4668
-
\??\c:\ffllfxr.exec:\ffllfxr.exe173⤵PID:3852
-
\??\c:\hthhbh.exec:\hthhbh.exe174⤵PID:4484
-
\??\c:\vjdpd.exec:\vjdpd.exe175⤵PID:4356
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe176⤵PID:2664
-
\??\c:\hbhttt.exec:\hbhttt.exe177⤵PID:3240
-
\??\c:\jpppj.exec:\jpppj.exe178⤵PID:392
-
\??\c:\nhtntt.exec:\nhtntt.exe179⤵PID:4724
-
\??\c:\xxrrlrl.exec:\xxrrlrl.exe180⤵PID:2808
-
\??\c:\jvddd.exec:\jvddd.exe181⤵PID:4960
-
\??\c:\9xxrfrf.exec:\9xxrfrf.exe182⤵PID:2672
-
\??\c:\bbnbhh.exec:\bbnbhh.exe183⤵PID:2828
-
\??\c:\btnbnt.exec:\btnbnt.exe184⤵PID:3452
-
\??\c:\jjjdp.exec:\jjjdp.exe185⤵PID:3196
-
\??\c:\7dpjp.exec:\7dpjp.exe186⤵PID:1812
-
\??\c:\frrfxfr.exec:\frrfxfr.exe187⤵PID:3400
-
\??\c:\nnbbnn.exec:\nnbbnn.exe188⤵PID:3692
-
\??\c:\9btttb.exec:\9btttb.exe189⤵PID:2176
-
\??\c:\vdpjv.exec:\vdpjv.exe190⤵PID:3008
-
\??\c:\7rrrlll.exec:\7rrrlll.exe191⤵PID:2916
-
\??\c:\rlllfll.exec:\rlllfll.exe192⤵PID:2860
-
\??\c:\7btbbb.exec:\7btbbb.exe193⤵PID:4544
-
\??\c:\htttbn.exec:\htttbn.exe194⤵PID:2400
-
\??\c:\jjpjd.exec:\jjpjd.exe195⤵PID:1696
-
\??\c:\flrfxll.exec:\flrfxll.exe196⤵PID:532
-
\??\c:\rlxrlll.exec:\rlxrlll.exe197⤵PID:2388
-
\??\c:\tnnhbb.exec:\tnnhbb.exe198⤵PID:1788
-
\??\c:\ppppj.exec:\ppppj.exe199⤵PID:4264
-
\??\c:\5vdjd.exec:\5vdjd.exe200⤵PID:208
-
\??\c:\xfrxrrr.exec:\xfrxrrr.exe201⤵PID:3920
-
\??\c:\llrrrrl.exec:\llrrrrl.exe202⤵PID:2352
-
\??\c:\tnhbbh.exec:\tnhbbh.exe203⤵PID:3652
-
\??\c:\1jjjd.exec:\1jjjd.exe204⤵PID:5004
-
\??\c:\vjpvv.exec:\vjpvv.exe205⤵PID:5028
-
\??\c:\xflxxrr.exec:\xflxxrr.exe206⤵PID:1520
-
\??\c:\nbntbb.exec:\nbntbb.exe207⤵PID:1508
-
\??\c:\djvvv.exec:\djvvv.exe208⤵PID:2800
-
\??\c:\9rlfffx.exec:\9rlfffx.exe209⤵PID:4220
-
\??\c:\rfrllll.exec:\rfrllll.exe210⤵PID:4540
-
\??\c:\hhhhhh.exec:\hhhhhh.exe211⤵PID:4972
-
\??\c:\dvvvv.exec:\dvvvv.exe212⤵PID:1448
-
\??\c:\pdvvv.exec:\pdvvv.exe213⤵PID:4464
-
\??\c:\rrfxfrl.exec:\rrfxfrl.exe214⤵PID:3504
-
\??\c:\tbhtnn.exec:\tbhtnn.exe215⤵PID:4144
-
\??\c:\hhbnnb.exec:\hhbnnb.exe216⤵PID:60
-
\??\c:\pdvpv.exec:\pdvpv.exe217⤵PID:3572
-
\??\c:\pvjdv.exec:\pvjdv.exe218⤵PID:4004
-
\??\c:\rfxxlll.exec:\rfxxlll.exe219⤵PID:4300
-
\??\c:\hbbbbh.exec:\hbbbbh.exe220⤵PID:1652
-
\??\c:\bhttbb.exec:\bhttbb.exe221⤵PID:1364
-
\??\c:\pjjdv.exec:\pjjdv.exe222⤵PID:2128
-
\??\c:\3dddv.exec:\3dddv.exe223⤵PID:2180
-
\??\c:\nhhnbh.exec:\nhhnbh.exe224⤵PID:2320
-
\??\c:\nbbhhb.exec:\nbbhhb.exe225⤵PID:312
-
\??\c:\pjdvv.exec:\pjdvv.exe226⤵PID:4788
-
\??\c:\ddpjd.exec:\ddpjd.exe227⤵PID:404
-
\??\c:\5lllxxf.exec:\5lllxxf.exe228⤵PID:3324
-
\??\c:\tnnnnn.exec:\tnnnnn.exe229⤵PID:1872
-
\??\c:\hbbtnt.exec:\hbbtnt.exe230⤵PID:5088
-
\??\c:\vvpjd.exec:\vvpjd.exe231⤵PID:1908
-
\??\c:\xlfxrrr.exec:\xlfxrrr.exe232⤵PID:4848
-
\??\c:\flllfff.exec:\flllfff.exe233⤵PID:2820
-
\??\c:\bntnhb.exec:\bntnhb.exe234⤵PID:2588
-
\??\c:\jjdpp.exec:\jjdpp.exe235⤵PID:4836
-
\??\c:\dvpvp.exec:\dvpvp.exe236⤵PID:2816
-
\??\c:\5flflll.exec:\5flflll.exe237⤵PID:1060
-
\??\c:\bbhhbt.exec:\bbhhbt.exe238⤵PID:776
-
\??\c:\dvddj.exec:\dvddj.exe239⤵PID:8
-
\??\c:\dvddv.exec:\dvddv.exe240⤵PID:3288
-
\??\c:\rlllfxx.exec:\rlllfxx.exe241⤵PID:2348
-
\??\c:\thnhbb.exec:\thnhbb.exe242⤵PID:4768