Analysis
-
max time kernel
150s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 21:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
016b4780ce21e159c54f8105c6a3b8a0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
016b4780ce21e159c54f8105c6a3b8a0_NeikiAnalytics.exe
-
Size
54KB
-
MD5
016b4780ce21e159c54f8105c6a3b8a0
-
SHA1
2930be7948378c9d75d6678ef7214ac5eead133a
-
SHA256
0d91655b7895e4f473846a2918f1d89aad678da4919c23e5cb33ff60cef22f68
-
SHA512
ac412bf3d3dac0e5c380fc34eb54229871d37dab44835a71dc169491ccbe6e2d597cf23b8b87fdae074fd6c6b4a9873aaa1b414c586a2aa18c05255ba6229408
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFz:ymb3NkkiQ3mdBjFIFz
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/2984-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1428-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/952-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1844-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3868-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hhnhnh.exejdjdv.exefxllrrx.exelfxlfxl.exennbtnn.exehnbnhh.exepddvj.exerxxlfxr.exehthnhb.exejpjvj.exe5lfrffr.exenbbnht.exehbnnhb.exedpvpj.exexlfrffr.exebtnhbn.exehbtntt.exedvjjv.exelrrlrrl.exexrlfxfx.exehbhnhb.exe9vppd.exepddpd.exefxrllll.exenhtnhb.exethhbbt.exe1dvpd.exe3ddpp.exefxxlfxr.exehttthn.exejjdjd.exefffxrrr.exe9hhbtn.exe9btnhh.exe5vpjj.exejvpdp.exerrlrlff.exetnbthh.exe3vpjp.exedpjdp.exe5llfrlf.exeflllxxr.exetntttn.exe9jjdj.exellfxlrl.exerrllfxr.exe7ttnbh.exebtbtbt.exevpjdv.exedvpjp.exe7rlfffx.exerfxrlff.exe1hhtnb.exedjjdp.exepjdvv.exerxlfllx.exebtbbbt.exentnbnh.exepjdvj.exejvdpp.exelflxrrr.exefrxxxxx.exerfxrfxr.exe1bthbt.exepid process 1428 hhnhnh.exe 952 jdjdv.exe 4988 fxllrrx.exe 4784 lfxlfxl.exe 2080 nnbtnn.exe 3136 hnbnhh.exe 2280 pddvj.exe 2552 rxxlfxr.exe 2108 hthnhb.exe 2812 jpjvj.exe 1844 5lfrffr.exe 3192 nbbnht.exe 4984 hbnnhb.exe 4904 dpvpj.exe 924 xlfrffr.exe 3904 btnhbn.exe 4632 hbtntt.exe 4440 dvjjv.exe 1692 lrrlrrl.exe 3868 xrlfxfx.exe 3992 hbhnhb.exe 988 9vppd.exe 2256 pddpd.exe 2808 fxrllll.exe 1796 nhtnhb.exe 4564 thhbbt.exe 5088 1dvpd.exe 4004 3ddpp.exe 4852 fxxlfxr.exe 2740 httthn.exe 1920 jjdjd.exe 228 fffxrrr.exe 1240 9hhbtn.exe 3188 9btnhh.exe 4336 5vpjj.exe 3876 jvpdp.exe 4772 rrlrlff.exe 3920 tnbthh.exe 1392 3vpjp.exe 1580 dpjdp.exe 2520 5llfrlf.exe 2392 flllxxr.exe 1628 tntttn.exe 2116 9jjdj.exe 1572 llfxlrl.exe 1848 rrllfxr.exe 400 7ttnbh.exe 8 btbtbt.exe 4888 vpjdv.exe 5108 dvpjp.exe 1700 7rlfffx.exe 3428 rfxrlff.exe 4372 1hhtnb.exe 820 djjdp.exe 3720 pjdvv.exe 4452 rxlfllx.exe 3968 btbbbt.exe 2888 ntnbnh.exe 4872 pjdvj.exe 5080 jvdpp.exe 3804 lflxrrr.exe 488 frxxxxx.exe 336 rfxrfxr.exe 3620 1bthbt.exe -
Processes:
resource yara_rule behavioral2/memory/2984-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/952-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2552-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3868-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
016b4780ce21e159c54f8105c6a3b8a0_NeikiAnalytics.exehhnhnh.exejdjdv.exefxllrrx.exelfxlfxl.exennbtnn.exehnbnhh.exepddvj.exerxxlfxr.exehthnhb.exejpjvj.exe5lfrffr.exenbbnht.exehbnnhb.exedpvpj.exexlfrffr.exebtnhbn.exehbtntt.exedvjjv.exelrrlrrl.exexrlfxfx.exehbhnhb.exedescription pid process target process PID 2984 wrote to memory of 1428 2984 016b4780ce21e159c54f8105c6a3b8a0_NeikiAnalytics.exe hhnhnh.exe PID 2984 wrote to memory of 1428 2984 016b4780ce21e159c54f8105c6a3b8a0_NeikiAnalytics.exe hhnhnh.exe PID 2984 wrote to memory of 1428 2984 016b4780ce21e159c54f8105c6a3b8a0_NeikiAnalytics.exe hhnhnh.exe PID 1428 wrote to memory of 952 1428 hhnhnh.exe jdjdv.exe PID 1428 wrote to memory of 952 1428 hhnhnh.exe jdjdv.exe PID 1428 wrote to memory of 952 1428 hhnhnh.exe jdjdv.exe PID 952 wrote to memory of 4988 952 jdjdv.exe fxllrrx.exe PID 952 wrote to memory of 4988 952 jdjdv.exe fxllrrx.exe PID 952 wrote to memory of 4988 952 jdjdv.exe fxllrrx.exe PID 4988 wrote to memory of 4784 4988 fxllrrx.exe lfxlfxl.exe PID 4988 wrote to memory of 4784 4988 fxllrrx.exe lfxlfxl.exe PID 4988 wrote to memory of 4784 4988 fxllrrx.exe lfxlfxl.exe PID 4784 wrote to memory of 2080 4784 lfxlfxl.exe nnbtnn.exe PID 4784 wrote to memory of 2080 4784 lfxlfxl.exe nnbtnn.exe PID 4784 wrote to memory of 2080 4784 lfxlfxl.exe nnbtnn.exe PID 2080 wrote to memory of 3136 2080 nnbtnn.exe hnbnhh.exe PID 2080 wrote to memory of 3136 2080 nnbtnn.exe hnbnhh.exe PID 2080 wrote to memory of 3136 2080 nnbtnn.exe hnbnhh.exe PID 3136 wrote to memory of 2280 3136 hnbnhh.exe pddvj.exe PID 3136 wrote to memory of 2280 3136 hnbnhh.exe pddvj.exe PID 3136 wrote to memory of 2280 3136 hnbnhh.exe pddvj.exe PID 2280 wrote to memory of 2552 2280 pddvj.exe rxxlfxr.exe PID 2280 wrote to memory of 2552 2280 pddvj.exe rxxlfxr.exe PID 2280 wrote to memory of 2552 2280 pddvj.exe rxxlfxr.exe PID 2552 wrote to memory of 2108 2552 rxxlfxr.exe hthnhb.exe PID 2552 wrote to memory of 2108 2552 rxxlfxr.exe hthnhb.exe PID 2552 wrote to memory of 2108 2552 rxxlfxr.exe hthnhb.exe PID 2108 wrote to memory of 2812 2108 hthnhb.exe jpjvj.exe PID 2108 wrote to memory of 2812 2108 hthnhb.exe jpjvj.exe PID 2108 wrote to memory of 2812 2108 hthnhb.exe jpjvj.exe PID 2812 wrote to memory of 1844 2812 jpjvj.exe 5lfrffr.exe PID 2812 wrote to memory of 1844 2812 jpjvj.exe 5lfrffr.exe PID 2812 wrote to memory of 1844 2812 jpjvj.exe 5lfrffr.exe PID 1844 wrote to memory of 3192 1844 5lfrffr.exe nbbnht.exe PID 1844 wrote to memory of 3192 1844 5lfrffr.exe nbbnht.exe PID 1844 wrote to memory of 3192 1844 5lfrffr.exe nbbnht.exe PID 3192 wrote to memory of 4984 3192 nbbnht.exe hbnnhb.exe PID 3192 wrote to memory of 4984 3192 nbbnht.exe hbnnhb.exe PID 3192 wrote to memory of 4984 3192 nbbnht.exe hbnnhb.exe PID 4984 wrote to memory of 4904 4984 hbnnhb.exe dpvpj.exe PID 4984 wrote to memory of 4904 4984 hbnnhb.exe dpvpj.exe PID 4984 wrote to memory of 4904 4984 hbnnhb.exe dpvpj.exe PID 4904 wrote to memory of 924 4904 dpvpj.exe xlfrffr.exe PID 4904 wrote to memory of 924 4904 dpvpj.exe xlfrffr.exe PID 4904 wrote to memory of 924 4904 dpvpj.exe xlfrffr.exe PID 924 wrote to memory of 3904 924 xlfrffr.exe btnhbn.exe PID 924 wrote to memory of 3904 924 xlfrffr.exe btnhbn.exe PID 924 wrote to memory of 3904 924 xlfrffr.exe btnhbn.exe PID 3904 wrote to memory of 4632 3904 btnhbn.exe hbtntt.exe PID 3904 wrote to memory of 4632 3904 btnhbn.exe hbtntt.exe PID 3904 wrote to memory of 4632 3904 btnhbn.exe hbtntt.exe PID 4632 wrote to memory of 4440 4632 hbtntt.exe dvjjv.exe PID 4632 wrote to memory of 4440 4632 hbtntt.exe dvjjv.exe PID 4632 wrote to memory of 4440 4632 hbtntt.exe dvjjv.exe PID 4440 wrote to memory of 1692 4440 dvjjv.exe lrrlrrl.exe PID 4440 wrote to memory of 1692 4440 dvjjv.exe lrrlrrl.exe PID 4440 wrote to memory of 1692 4440 dvjjv.exe lrrlrrl.exe PID 1692 wrote to memory of 3868 1692 lrrlrrl.exe xrlfxfx.exe PID 1692 wrote to memory of 3868 1692 lrrlrrl.exe xrlfxfx.exe PID 1692 wrote to memory of 3868 1692 lrrlrrl.exe xrlfxfx.exe PID 3868 wrote to memory of 3992 3868 xrlfxfx.exe hbhnhb.exe PID 3868 wrote to memory of 3992 3868 xrlfxfx.exe hbhnhb.exe PID 3868 wrote to memory of 3992 3868 xrlfxfx.exe hbhnhb.exe PID 3992 wrote to memory of 988 3992 hbhnhb.exe 9vppd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\016b4780ce21e159c54f8105c6a3b8a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\016b4780ce21e159c54f8105c6a3b8a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\hhnhnh.exec:\hhnhnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\jdjdv.exec:\jdjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\fxllrrx.exec:\fxllrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\lfxlfxl.exec:\lfxlfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\nnbtnn.exec:\nnbtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\hnbnhh.exec:\hnbnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\pddvj.exec:\pddvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\rxxlfxr.exec:\rxxlfxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\hthnhb.exec:\hthnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\jpjvj.exec:\jpjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\5lfrffr.exec:\5lfrffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\nbbnht.exec:\nbbnht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\hbnnhb.exec:\hbnnhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\dpvpj.exec:\dpvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\xlfrffr.exec:\xlfrffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\btnhbn.exec:\btnhbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\hbtntt.exec:\hbtntt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\dvjjv.exec:\dvjjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\lrrlrrl.exec:\lrrlrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\xrlfxfx.exec:\xrlfxfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\hbhnhb.exec:\hbhnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\9vppd.exec:\9vppd.exe23⤵
- Executes dropped EXE
PID:988 -
\??\c:\pddpd.exec:\pddpd.exe24⤵
- Executes dropped EXE
PID:2256 -
\??\c:\fxrllll.exec:\fxrllll.exe25⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nhtnhb.exec:\nhtnhb.exe26⤵
- Executes dropped EXE
PID:1796 -
\??\c:\thhbbt.exec:\thhbbt.exe27⤵
- Executes dropped EXE
PID:4564 -
\??\c:\1dvpd.exec:\1dvpd.exe28⤵
- Executes dropped EXE
PID:5088 -
\??\c:\3ddpp.exec:\3ddpp.exe29⤵
- Executes dropped EXE
PID:4004 -
\??\c:\fxxlfxr.exec:\fxxlfxr.exe30⤵
- Executes dropped EXE
PID:4852 -
\??\c:\httthn.exec:\httthn.exe31⤵
- Executes dropped EXE
PID:2740 -
\??\c:\jjdjd.exec:\jjdjd.exe32⤵
- Executes dropped EXE
PID:1920 -
\??\c:\fffxrrr.exec:\fffxrrr.exe33⤵
- Executes dropped EXE
PID:228 -
\??\c:\9hhbtn.exec:\9hhbtn.exe34⤵
- Executes dropped EXE
PID:1240 -
\??\c:\9btnhh.exec:\9btnhh.exe35⤵
- Executes dropped EXE
PID:3188 -
\??\c:\5vpjj.exec:\5vpjj.exe36⤵
- Executes dropped EXE
PID:4336 -
\??\c:\jvpdp.exec:\jvpdp.exe37⤵
- Executes dropped EXE
PID:3876 -
\??\c:\rrlrlff.exec:\rrlrlff.exe38⤵
- Executes dropped EXE
PID:4772 -
\??\c:\5ffxxrl.exec:\5ffxxrl.exe39⤵PID:1428
-
\??\c:\tnbthh.exec:\tnbthh.exe40⤵
- Executes dropped EXE
PID:3920 -
\??\c:\3vpjp.exec:\3vpjp.exe41⤵
- Executes dropped EXE
PID:1392 -
\??\c:\dpjdp.exec:\dpjdp.exe42⤵
- Executes dropped EXE
PID:1580 -
\??\c:\5llfrlf.exec:\5llfrlf.exe43⤵
- Executes dropped EXE
PID:2520 -
\??\c:\flllxxr.exec:\flllxxr.exe44⤵
- Executes dropped EXE
PID:2392 -
\??\c:\tntttn.exec:\tntttn.exe45⤵
- Executes dropped EXE
PID:1628 -
\??\c:\9jjdj.exec:\9jjdj.exe46⤵
- Executes dropped EXE
PID:2116 -
\??\c:\llfxlrl.exec:\llfxlrl.exe47⤵
- Executes dropped EXE
PID:1572 -
\??\c:\rrllfxr.exec:\rrllfxr.exe48⤵
- Executes dropped EXE
PID:1848 -
\??\c:\7ttnbh.exec:\7ttnbh.exe49⤵
- Executes dropped EXE
PID:400 -
\??\c:\btbtbt.exec:\btbtbt.exe50⤵
- Executes dropped EXE
PID:8 -
\??\c:\vpjdv.exec:\vpjdv.exe51⤵
- Executes dropped EXE
PID:4888 -
\??\c:\dvpjp.exec:\dvpjp.exe52⤵
- Executes dropped EXE
PID:5108 -
\??\c:\7rlfffx.exec:\7rlfffx.exe53⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rfxrlff.exec:\rfxrlff.exe54⤵
- Executes dropped EXE
PID:3428 -
\??\c:\1hhtnb.exec:\1hhtnb.exe55⤵
- Executes dropped EXE
PID:4372 -
\??\c:\djjdp.exec:\djjdp.exe56⤵
- Executes dropped EXE
PID:820 -
\??\c:\pjdvv.exec:\pjdvv.exe57⤵
- Executes dropped EXE
PID:3720 -
\??\c:\rxlfllx.exec:\rxlfllx.exe58⤵
- Executes dropped EXE
PID:4452 -
\??\c:\btbbbt.exec:\btbbbt.exe59⤵
- Executes dropped EXE
PID:3968 -
\??\c:\ntnbnh.exec:\ntnbnh.exe60⤵
- Executes dropped EXE
PID:2888 -
\??\c:\pjdvj.exec:\pjdvj.exe61⤵
- Executes dropped EXE
PID:4872 -
\??\c:\jvdpp.exec:\jvdpp.exe62⤵
- Executes dropped EXE
PID:5080 -
\??\c:\lflxrrr.exec:\lflxrrr.exe63⤵
- Executes dropped EXE
PID:3804 -
\??\c:\frxxxxx.exec:\frxxxxx.exe64⤵
- Executes dropped EXE
PID:488 -
\??\c:\rfxrfxr.exec:\rfxrfxr.exe65⤵
- Executes dropped EXE
PID:336 -
\??\c:\1bthbt.exec:\1bthbt.exe66⤵
- Executes dropped EXE
PID:3620 -
\??\c:\vjjdp.exec:\vjjdp.exe67⤵PID:2568
-
\??\c:\pdvjp.exec:\pdvjp.exe68⤵PID:1796
-
\??\c:\lrrlrrl.exec:\lrrlrrl.exe69⤵PID:3700
-
\??\c:\rllfxrl.exec:\rllfxrl.exe70⤵PID:4132
-
\??\c:\tntnbb.exec:\tntnbb.exe71⤵PID:4992
-
\??\c:\httnbb.exec:\httnbb.exe72⤵PID:2024
-
\??\c:\pvdpd.exec:\pvdpd.exe73⤵PID:5064
-
\??\c:\dpvdd.exec:\dpvdd.exe74⤵PID:3364
-
\??\c:\5fxllff.exec:\5fxllff.exe75⤵PID:2740
-
\??\c:\fllxfxx.exec:\fllxfxx.exe76⤵PID:1920
-
\??\c:\nnnhtn.exec:\nnnhtn.exe77⤵PID:2496
-
\??\c:\hhnhtn.exec:\hhnhtn.exe78⤵PID:4516
-
\??\c:\dvpdd.exec:\dvpdd.exe79⤵PID:4028
-
\??\c:\dppjp.exec:\dppjp.exe80⤵PID:4328
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe81⤵PID:3616
-
\??\c:\bhnntb.exec:\bhnntb.exe82⤵PID:2200
-
\??\c:\vvjdv.exec:\vvjdv.exe83⤵PID:1648
-
\??\c:\xrlllff.exec:\xrlllff.exe84⤵PID:3696
-
\??\c:\bnnbhb.exec:\bnnbhb.exe85⤵PID:1096
-
\??\c:\bhnhbt.exec:\bhnhbt.exe86⤵PID:5032
-
\??\c:\pjppd.exec:\pjppd.exe87⤵PID:1380
-
\??\c:\9djjj.exec:\9djjj.exe88⤵PID:436
-
\??\c:\lfrlxrf.exec:\lfrlxrf.exe89⤵PID:4660
-
\??\c:\llfllxr.exec:\llfllxr.exe90⤵PID:4168
-
\??\c:\bnnbnb.exec:\bnnbnb.exe91⤵PID:4456
-
\??\c:\dvjvv.exec:\dvjvv.exe92⤵PID:2456
-
\??\c:\dvdpd.exec:\dvdpd.exe93⤵PID:2052
-
\??\c:\lxrflfx.exec:\lxrflfx.exe94⤵PID:1848
-
\??\c:\htbtnt.exec:\htbtnt.exe95⤵PID:400
-
\??\c:\5thttt.exec:\5thttt.exe96⤵PID:4892
-
\??\c:\pjjjp.exec:\pjjjp.exe97⤵PID:4476
-
\??\c:\7vddv.exec:\7vddv.exe98⤵PID:2648
-
\??\c:\lrxxrrr.exec:\lrxxrrr.exe99⤵PID:3120
-
\??\c:\lxffxxx.exec:\lxffxxx.exe100⤵PID:4904
-
\??\c:\nnhbtb.exec:\nnhbtb.exe101⤵PID:2064
-
\??\c:\bnnhhh.exec:\bnnhhh.exe102⤵PID:4076
-
\??\c:\1jjdv.exec:\1jjdv.exe103⤵PID:3720
-
\??\c:\pdvjp.exec:\pdvjp.exe104⤵PID:3972
-
\??\c:\rlxrlff.exec:\rlxrlff.exe105⤵PID:2172
-
\??\c:\fxxxlxf.exec:\fxxxlxf.exe106⤵PID:1364
-
\??\c:\nhbtbn.exec:\nhbtbn.exe107⤵PID:2884
-
\??\c:\9pjjj.exec:\9pjjj.exe108⤵PID:4584
-
\??\c:\ppjdp.exec:\ppjdp.exe109⤵PID:2900
-
\??\c:\lfxrllf.exec:\lfxrllf.exe110⤵PID:4464
-
\??\c:\rxrxfrr.exec:\rxrxfrr.exe111⤵PID:2256
-
\??\c:\ttbtnn.exec:\ttbtnn.exe112⤵PID:3620
-
\??\c:\thtnbb.exec:\thtnbb.exe113⤵PID:1796
-
\??\c:\dvvdv.exec:\dvvdv.exe114⤵PID:4060
-
\??\c:\jvddv.exec:\jvddv.exe115⤵PID:4012
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe116⤵PID:4672
-
\??\c:\lrrlfff.exec:\lrrlfff.exe117⤵PID:4852
-
\??\c:\bbnnbb.exec:\bbnnbb.exe118⤵PID:5064
-
\??\c:\bbhbht.exec:\bbhbht.exe119⤵PID:1420
-
\??\c:\vvdpp.exec:\vvdpp.exe120⤵PID:2740
-
\??\c:\rlrlffx.exec:\rlrlffx.exe121⤵PID:2944
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe122⤵PID:2496
-
\??\c:\bbhhnn.exec:\bbhhnn.exe123⤵PID:4308
-
\??\c:\nhhnnh.exec:\nhhnnh.exe124⤵PID:4336
-
\??\c:\9ppjd.exec:\9ppjd.exe125⤵PID:2984
-
\??\c:\jppdp.exec:\jppdp.exe126⤵PID:2824
-
\??\c:\xrxllfr.exec:\xrxllfr.exe127⤵PID:3616
-
\??\c:\tnnhtt.exec:\tnnhtt.exe128⤵PID:4264
-
\??\c:\5ttnhh.exec:\5ttnhh.exe129⤵PID:3696
-
\??\c:\btnhnn.exec:\btnhnn.exe130⤵PID:1276
-
\??\c:\pvdvv.exec:\pvdvv.exe131⤵PID:1184
-
\??\c:\1vvpj.exec:\1vvpj.exe132⤵PID:2520
-
\??\c:\xllfxlf.exec:\xllfxlf.exe133⤵PID:3440
-
\??\c:\httbtt.exec:\httbtt.exe134⤵PID:2280
-
\??\c:\tnhnbb.exec:\tnhnbb.exe135⤵PID:4192
-
\??\c:\3hhbtn.exec:\3hhbtn.exe136⤵PID:5028
-
\??\c:\jdppp.exec:\jdppp.exe137⤵PID:2552
-
\??\c:\bbhnhb.exec:\bbhnhb.exe138⤵PID:3172
-
\??\c:\tbthnb.exec:\tbthnb.exe139⤵PID:2812
-
\??\c:\pjjpd.exec:\pjjpd.exe140⤵PID:2972
-
\??\c:\9jpjd.exec:\9jpjd.exe141⤵PID:4488
-
\??\c:\ffxlflx.exec:\ffxlflx.exe142⤵PID:4344
-
\??\c:\btntht.exec:\btntht.exe143⤵PID:4828
-
\??\c:\hhhntn.exec:\hhhntn.exe144⤵PID:456
-
\??\c:\1jjdp.exec:\1jjdp.exe145⤵PID:5076
-
\??\c:\pddjv.exec:\pddjv.exe146⤵PID:3956
-
\??\c:\rlfxfxl.exec:\rlfxfxl.exe147⤵PID:3968
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe148⤵PID:1692
-
\??\c:\hnthnt.exec:\hnthnt.exe149⤵PID:3820
-
\??\c:\bhtthh.exec:\bhtthh.exe150⤵PID:2416
-
\??\c:\jdvvp.exec:\jdvvp.exe151⤵PID:2396
-
\??\c:\flrrffx.exec:\flrrffx.exe152⤵PID:3560
-
\??\c:\nnthbt.exec:\nnthbt.exe153⤵PID:4608
-
\??\c:\tbhbhh.exec:\tbhbhh.exe154⤵PID:2808
-
\??\c:\djpjp.exec:\djpjp.exe155⤵PID:3780
-
\??\c:\dvdvv.exec:\dvdvv.exe156⤵PID:2964
-
\??\c:\pdjdp.exec:\pdjdp.exe157⤵PID:2892
-
\??\c:\lffxrfx.exec:\lffxrfx.exe158⤵PID:1280
-
\??\c:\bnbttt.exec:\bnbttt.exe159⤵PID:4820
-
\??\c:\tnhhtt.exec:\tnhhtt.exe160⤵PID:2024
-
\??\c:\dpvjj.exec:\dpvjj.exe161⤵PID:4124
-
\??\c:\jvvpp.exec:\jvvpp.exe162⤵PID:5056
-
\??\c:\fflllxx.exec:\fflllxx.exe163⤵PID:4972
-
\??\c:\xrxfffl.exec:\xrxfffl.exe164⤵PID:4908
-
\??\c:\ttbtbt.exec:\ttbtbt.exe165⤵PID:4220
-
\??\c:\vjjdd.exec:\vjjdd.exe166⤵PID:1860
-
\??\c:\vddvv.exec:\vddvv.exe167⤵PID:3884
-
\??\c:\3ffrffx.exec:\3ffrffx.exe168⤵PID:4884
-
\??\c:\rlrrxrx.exec:\rlrrxrx.exe169⤵PID:1428
-
\??\c:\hthnth.exec:\hthnth.exe170⤵PID:3568
-
\??\c:\tnhbnn.exec:\tnhbnn.exe171⤵PID:496
-
\??\c:\dpjdj.exec:\dpjdj.exe172⤵PID:3452
-
\??\c:\pddpd.exec:\pddpd.exe173⤵PID:4332
-
\??\c:\9lrrrfr.exec:\9lrrrfr.exe174⤵PID:2028
-
\??\c:\xrrlffx.exec:\xrrlffx.exe175⤵PID:2364
-
\??\c:\bbttnt.exec:\bbttnt.exe176⤵PID:372
-
\??\c:\tnthht.exec:\tnthht.exe177⤵PID:4456
-
\??\c:\3jjjd.exec:\3jjjd.exe178⤵PID:1760
-
\??\c:\rflxlfl.exec:\rflxlfl.exe179⤵PID:4900
-
\??\c:\3fffxrl.exec:\3fffxrl.exe180⤵PID:3640
-
\??\c:\tnnbnh.exec:\tnnbnh.exe181⤵PID:3172
-
\??\c:\bnbthb.exec:\bnbthb.exe182⤵PID:4892
-
\??\c:\ddpjv.exec:\ddpjv.exe183⤵PID:4288
-
\??\c:\vvpdj.exec:\vvpdj.exe184⤵PID:4084
-
\??\c:\hbtthb.exec:\hbtthb.exe185⤵PID:4412
-
\??\c:\tbbbtt.exec:\tbbbtt.exe186⤵PID:4372
-
\??\c:\vvdvp.exec:\vvdvp.exe187⤵PID:644
-
\??\c:\xxlxflf.exec:\xxlxflf.exe188⤵PID:5076
-
\??\c:\nbnbht.exec:\nbnbht.exe189⤵PID:3284
-
\??\c:\bhbthh.exec:\bhbthh.exe190⤵PID:2604
-
\??\c:\7ppjv.exec:\7ppjv.exe191⤵PID:3988
-
\??\c:\jjpdp.exec:\jjpdp.exe192⤵PID:940
-
\??\c:\xrlfxlf.exec:\xrlfxlf.exe193⤵PID:3804
-
\??\c:\lxrrllf.exec:\lxrrllf.exe194⤵PID:2396
-
\??\c:\thhbnb.exec:\thhbnb.exe195⤵PID:492
-
\??\c:\pvppp.exec:\pvppp.exe196⤵PID:4608
-
\??\c:\pdjdv.exec:\pdjdv.exe197⤵PID:4340
-
\??\c:\jvpdp.exec:\jvpdp.exe198⤵PID:2196
-
\??\c:\xxfxlfx.exec:\xxfxlfx.exe199⤵PID:4004
-
\??\c:\3llxrll.exec:\3llxrll.exe200⤵PID:4524
-
\??\c:\nbhbbt.exec:\nbhbbt.exe201⤵PID:1224
-
\??\c:\tbbtnn.exec:\tbbtnn.exe202⤵PID:2728
-
\??\c:\pvdvj.exec:\pvdvj.exe203⤵PID:568
-
\??\c:\pppdv.exec:\pppdv.exe204⤵PID:600
-
\??\c:\lffxffx.exec:\lffxffx.exe205⤵PID:228
-
\??\c:\rlffxlr.exec:\rlffxlr.exe206⤵PID:4388
-
\??\c:\nhhbhb.exec:\nhhbhb.exe207⤵PID:4220
-
\??\c:\bhhbhh.exec:\bhhbhh.exe208⤵PID:3492
-
\??\c:\nhtbnt.exec:\nhtbnt.exe209⤵PID:4620
-
\??\c:\jpjjv.exec:\jpjjv.exe210⤵PID:1428
-
\??\c:\vpdpd.exec:\vpdpd.exe211⤵PID:2124
-
\??\c:\xlrrllx.exec:\xlrrllx.exe212⤵PID:2920
-
\??\c:\rlffxrr.exec:\rlffxrr.exe213⤵PID:3136
-
\??\c:\7rxrrlf.exec:\7rxrrlf.exe214⤵PID:3220
-
\??\c:\tnbtnh.exec:\tnbtnh.exe215⤵PID:4192
-
\??\c:\nbnhbb.exec:\nbnhbb.exe216⤵PID:5028
-
\??\c:\vjjdp.exec:\vjjdp.exe217⤵PID:2980
-
\??\c:\jvjdv.exec:\jvjdv.exe218⤵PID:5020
-
\??\c:\rlrfrrf.exec:\rlrfrrf.exe219⤵PID:3304
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe220⤵PID:4392
-
\??\c:\hbhbtt.exec:\hbhbtt.exe221⤵PID:4288
-
\??\c:\bbtthb.exec:\bbtthb.exe222⤵PID:3120
-
\??\c:\pddvp.exec:\pddvp.exe223⤵PID:4612
-
\??\c:\ddppd.exec:\ddppd.exe224⤵PID:3836
-
\??\c:\llllffx.exec:\llllffx.exe225⤵PID:1896
-
\??\c:\hbhbtn.exec:\hbhbtn.exe226⤵PID:3968
-
\??\c:\jpjpv.exec:\jpjpv.exe227⤵PID:4872
-
\??\c:\rfrxxlx.exec:\rfrxxlx.exe228⤵PID:3820
-
\??\c:\7xrlfxr.exec:\7xrlfxr.exe229⤵PID:2968
-
\??\c:\hnhbth.exec:\hnhbth.exe230⤵PID:1772
-
\??\c:\jvvjj.exec:\jvvjj.exe231⤵PID:1640
-
\??\c:\vdpdp.exec:\vdpdp.exe232⤵PID:4464
-
\??\c:\vjppj.exec:\vjppj.exe233⤵PID:5008
-
\??\c:\9lfxxrf.exec:\9lfxxrf.exe234⤵PID:4564
-
\??\c:\lxxrxrr.exec:\lxxrxrr.exe235⤵PID:3500
-
\??\c:\ttbnhh.exec:\ttbnhh.exe236⤵PID:3512
-
\??\c:\pddvj.exec:\pddvj.exe237⤵PID:1564
-
\??\c:\pjddv.exec:\pjddv.exe238⤵PID:1888
-
\??\c:\xrrfxxx.exec:\xrrfxxx.exe239⤵PID:2700
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe240⤵PID:1656
-
\??\c:\7nnhtn.exec:\7nnhtn.exe241⤵PID:1420
-
\??\c:\nhnnhn.exec:\nhnnhn.exe242⤵PID:1100