Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 06:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe
-
Size
965KB
-
MD5
920bd5a31fb16db574c6c96d2dc8ef10
-
SHA1
9df56953ab3ecc413b51a0ddcf207d4aa9e317d3
-
SHA256
8e2238d677a88937997e2c45d5a75a2091519bf9dad1fbb5fc020b46c8a9692b
-
SHA512
23a92169530cdc13d311f6d95c6eebaa66a042eb0090786886c3190412a37f6431cfb56fd54c884ff23a2b5cbde3920a07126eea1cd00477204a17517cb693b0
-
SSDEEP
12288:n3C9ytvngQjy3C9I3YEWpYe+GalTLfOX+I3C9S3C9ytvngQj65syLr9fuWpZ:SgdnJVwLgdnJq9fuw
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2320-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1348-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/968-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpvdv.exebnhbhn.exepdppd.exerlfrfrf.exehhnntn.exe9htttb.exevpdpd.exexlllxfx.exe7tbhtt.exetnhnhn.exevvvdv.exeddjjd.exe5rlrxfr.exelfrxfrf.exenbtbth.exehnhnbh.exe9vjdp.exexfrllrx.exenhhbth.exe5tbbht.exerrflrxl.exehnhtnt.exerxfrrlf.exe9vjpj.exelrrllfl.exehhhnbt.exebnttnt.exedvjpv.exe5xllffl.exethttbb.exerfxfllx.exevvvjv.exebhttbb.exe5rflrrx.exethbntt.exeddpvp.exe5fxflfl.exebbtbnt.exejvdjv.exelfrrffl.exetnbntb.exe1djpp.exe7lflxfr.exebnbhtb.exepjjpd.exellxflfr.exenhhhnn.exettntnn.exepjjdv.exelfllxxl.exe3hbhbn.exevpddp.exe1fxxfxf.exe3nttbt.exepvjvp.exerrxrxxl.exe3bnhtt.exe9jppj.exerlfflrf.exenhhnhn.exedvpvj.exexlxlxxl.exenhtbhh.exepjppd.exepid process 1936 vpvdv.exe 2128 bnhbhn.exe 2076 pdppd.exe 2792 rlfrfrf.exe 1652 hhnntn.exe 2876 9htttb.exe 2716 vpdpd.exe 2560 xlllxfx.exe 2100 7tbhtt.exe 2844 tnhnhn.exe 2868 vvvdv.exe 2556 ddjjd.exe 744 5rlrxfr.exe 2040 lfrxfrf.exe 1608 nbtbth.exe 2756 hnhnbh.exe 1804 9vjdp.exe 1332 xfrllrx.exe 2024 nhhbth.exe 768 5tbbht.exe 1640 rrflrxl.exe 3040 hnhtnt.exe 1692 rxfrrlf.exe 1324 9vjpj.exe 1732 lrrllfl.exe 1348 hhhnbt.exe 2432 bnttnt.exe 968 dvjpv.exe 2580 5xllffl.exe 2052 thttbb.exe 608 rfxfllx.exe 2124 vvvjv.exe 1712 bhttbb.exe 2392 5rflrrx.exe 2252 thbntt.exe 2280 ddpvp.exe 2932 5fxflfl.exe 2800 bbtbnt.exe 2500 jvdjv.exe 2652 lfrrffl.exe 2520 tnbntb.exe 2608 1djpp.exe 2504 7lflxfr.exe 2716 bnbhtb.exe 2260 pjjpd.exe 2388 llxflfr.exe 2100 nhhhnn.exe 2852 ttntnn.exe 2908 pjjdv.exe 2468 lfllxxl.exe 1784 3hbhbn.exe 2212 vpddp.exe 2176 1fxxfxf.exe 2736 3nttbt.exe 3016 pvjvp.exe 1448 rrxrxxl.exe 820 3bnhtt.exe 2084 9jppj.exe 1984 rlfflrf.exe 996 nhhnhn.exe 2112 dvpvj.exe 2248 xlxlxxl.exe 408 nhtbhh.exe 2380 pjppd.exe -
Processes:
resource yara_rule behavioral1/memory/2320-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1348-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/968-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-296-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exevpvdv.exebnhbhn.exepdppd.exerlfrfrf.exehhnntn.exe9htttb.exevpdpd.exexlllxfx.exe7tbhtt.exetnhnhn.exevvvdv.exeddjjd.exe5rlrxfr.exelfrxfrf.exenbtbth.exedescription pid process target process PID 2320 wrote to memory of 1936 2320 920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe vpvdv.exe PID 2320 wrote to memory of 1936 2320 920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe vpvdv.exe PID 2320 wrote to memory of 1936 2320 920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe vpvdv.exe PID 2320 wrote to memory of 1936 2320 920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe vpvdv.exe PID 1936 wrote to memory of 2128 1936 vpvdv.exe bnhbhn.exe PID 1936 wrote to memory of 2128 1936 vpvdv.exe bnhbhn.exe PID 1936 wrote to memory of 2128 1936 vpvdv.exe bnhbhn.exe PID 1936 wrote to memory of 2128 1936 vpvdv.exe bnhbhn.exe PID 2128 wrote to memory of 2076 2128 bnhbhn.exe pdppd.exe PID 2128 wrote to memory of 2076 2128 bnhbhn.exe pdppd.exe PID 2128 wrote to memory of 2076 2128 bnhbhn.exe pdppd.exe PID 2128 wrote to memory of 2076 2128 bnhbhn.exe pdppd.exe PID 2076 wrote to memory of 2792 2076 pdppd.exe rlfrfrf.exe PID 2076 wrote to memory of 2792 2076 pdppd.exe rlfrfrf.exe PID 2076 wrote to memory of 2792 2076 pdppd.exe rlfrfrf.exe PID 2076 wrote to memory of 2792 2076 pdppd.exe rlfrfrf.exe PID 2792 wrote to memory of 1652 2792 rlfrfrf.exe hhnntn.exe PID 2792 wrote to memory of 1652 2792 rlfrfrf.exe hhnntn.exe PID 2792 wrote to memory of 1652 2792 rlfrfrf.exe hhnntn.exe PID 2792 wrote to memory of 1652 2792 rlfrfrf.exe hhnntn.exe PID 1652 wrote to memory of 2876 1652 hhnntn.exe 9htttb.exe PID 1652 wrote to memory of 2876 1652 hhnntn.exe 9htttb.exe PID 1652 wrote to memory of 2876 1652 hhnntn.exe 9htttb.exe PID 1652 wrote to memory of 2876 1652 hhnntn.exe 9htttb.exe PID 2876 wrote to memory of 2716 2876 9htttb.exe vpdpd.exe PID 2876 wrote to memory of 2716 2876 9htttb.exe vpdpd.exe PID 2876 wrote to memory of 2716 2876 9htttb.exe vpdpd.exe PID 2876 wrote to memory of 2716 2876 9htttb.exe vpdpd.exe PID 2716 wrote to memory of 2560 2716 vpdpd.exe xlllxfx.exe PID 2716 wrote to memory of 2560 2716 vpdpd.exe xlllxfx.exe PID 2716 wrote to memory of 2560 2716 vpdpd.exe xlllxfx.exe PID 2716 wrote to memory of 2560 2716 vpdpd.exe xlllxfx.exe PID 2560 wrote to memory of 2100 2560 xlllxfx.exe 7tbhtt.exe PID 2560 wrote to memory of 2100 2560 xlllxfx.exe 7tbhtt.exe PID 2560 wrote to memory of 2100 2560 xlllxfx.exe 7tbhtt.exe PID 2560 wrote to memory of 2100 2560 xlllxfx.exe 7tbhtt.exe PID 2100 wrote to memory of 2844 2100 7tbhtt.exe tnhnhn.exe PID 2100 wrote to memory of 2844 2100 7tbhtt.exe tnhnhn.exe PID 2100 wrote to memory of 2844 2100 7tbhtt.exe tnhnhn.exe PID 2100 wrote to memory of 2844 2100 7tbhtt.exe tnhnhn.exe PID 2844 wrote to memory of 2868 2844 tnhnhn.exe vvvdv.exe PID 2844 wrote to memory of 2868 2844 tnhnhn.exe vvvdv.exe PID 2844 wrote to memory of 2868 2844 tnhnhn.exe vvvdv.exe PID 2844 wrote to memory of 2868 2844 tnhnhn.exe vvvdv.exe PID 2868 wrote to memory of 2556 2868 vvvdv.exe ddjjd.exe PID 2868 wrote to memory of 2556 2868 vvvdv.exe ddjjd.exe PID 2868 wrote to memory of 2556 2868 vvvdv.exe ddjjd.exe PID 2868 wrote to memory of 2556 2868 vvvdv.exe ddjjd.exe PID 2556 wrote to memory of 744 2556 ddjjd.exe 5rlrxfr.exe PID 2556 wrote to memory of 744 2556 ddjjd.exe 5rlrxfr.exe PID 2556 wrote to memory of 744 2556 ddjjd.exe 5rlrxfr.exe PID 2556 wrote to memory of 744 2556 ddjjd.exe 5rlrxfr.exe PID 744 wrote to memory of 2040 744 5rlrxfr.exe lfrxfrf.exe PID 744 wrote to memory of 2040 744 5rlrxfr.exe lfrxfrf.exe PID 744 wrote to memory of 2040 744 5rlrxfr.exe lfrxfrf.exe PID 744 wrote to memory of 2040 744 5rlrxfr.exe lfrxfrf.exe PID 2040 wrote to memory of 1608 2040 lfrxfrf.exe nbtbth.exe PID 2040 wrote to memory of 1608 2040 lfrxfrf.exe nbtbth.exe PID 2040 wrote to memory of 1608 2040 lfrxfrf.exe nbtbth.exe PID 2040 wrote to memory of 1608 2040 lfrxfrf.exe nbtbth.exe PID 1608 wrote to memory of 2756 1608 nbtbth.exe hnhnbh.exe PID 1608 wrote to memory of 2756 1608 nbtbth.exe hnhnbh.exe PID 1608 wrote to memory of 2756 1608 nbtbth.exe hnhnbh.exe PID 1608 wrote to memory of 2756 1608 nbtbth.exe hnhnbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\vpvdv.exec:\vpvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\bnhbhn.exec:\bnhbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\pdppd.exec:\pdppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\rlfrfrf.exec:\rlfrfrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\hhnntn.exec:\hhnntn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\9htttb.exec:\9htttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\vpdpd.exec:\vpdpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\xlllxfx.exec:\xlllxfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\7tbhtt.exec:\7tbhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\tnhnhn.exec:\tnhnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\vvvdv.exec:\vvvdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\ddjjd.exec:\ddjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\5rlrxfr.exec:\5rlrxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\lfrxfrf.exec:\lfrxfrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\nbtbth.exec:\nbtbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\hnhnbh.exec:\hnhnbh.exe17⤵
- Executes dropped EXE
PID:2756 -
\??\c:\9vjdp.exec:\9vjdp.exe18⤵
- Executes dropped EXE
PID:1804 -
\??\c:\xfrllrx.exec:\xfrllrx.exe19⤵
- Executes dropped EXE
PID:1332 -
\??\c:\nhhbth.exec:\nhhbth.exe20⤵
- Executes dropped EXE
PID:2024 -
\??\c:\5tbbht.exec:\5tbbht.exe21⤵
- Executes dropped EXE
PID:768 -
\??\c:\rrflrxl.exec:\rrflrxl.exe22⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hnhtnt.exec:\hnhtnt.exe23⤵
- Executes dropped EXE
PID:3040 -
\??\c:\rxfrrlf.exec:\rxfrrlf.exe24⤵
- Executes dropped EXE
PID:1692 -
\??\c:\9vjpj.exec:\9vjpj.exe25⤵
- Executes dropped EXE
PID:1324 -
\??\c:\lrrllfl.exec:\lrrllfl.exe26⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hhhnbt.exec:\hhhnbt.exe27⤵
- Executes dropped EXE
PID:1348 -
\??\c:\bnttnt.exec:\bnttnt.exe28⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dvjpv.exec:\dvjpv.exe29⤵
- Executes dropped EXE
PID:968 -
\??\c:\5xllffl.exec:\5xllffl.exe30⤵
- Executes dropped EXE
PID:2580 -
\??\c:\thttbb.exec:\thttbb.exe31⤵
- Executes dropped EXE
PID:2052 -
\??\c:\rfxfllx.exec:\rfxfllx.exe32⤵
- Executes dropped EXE
PID:608 -
\??\c:\vvvjv.exec:\vvvjv.exe33⤵
- Executes dropped EXE
PID:2124 -
\??\c:\bhttbb.exec:\bhttbb.exe34⤵
- Executes dropped EXE
PID:1712 -
\??\c:\5rflrrx.exec:\5rflrrx.exe35⤵
- Executes dropped EXE
PID:2392 -
\??\c:\thbntt.exec:\thbntt.exe36⤵
- Executes dropped EXE
PID:2252 -
\??\c:\ddpvp.exec:\ddpvp.exe37⤵
- Executes dropped EXE
PID:2280 -
\??\c:\5fxflfl.exec:\5fxflfl.exe38⤵
- Executes dropped EXE
PID:2932 -
\??\c:\bbtbnt.exec:\bbtbnt.exe39⤵
- Executes dropped EXE
PID:2800 -
\??\c:\jvdjv.exec:\jvdjv.exe40⤵
- Executes dropped EXE
PID:2500 -
\??\c:\lfrrffl.exec:\lfrrffl.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\tnbntb.exec:\tnbntb.exe42⤵
- Executes dropped EXE
PID:2520 -
\??\c:\1djpp.exec:\1djpp.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\7lflxfr.exec:\7lflxfr.exe44⤵
- Executes dropped EXE
PID:2504 -
\??\c:\bnbhtb.exec:\bnbhtb.exe45⤵
- Executes dropped EXE
PID:2716 -
\??\c:\pjjpd.exec:\pjjpd.exe46⤵
- Executes dropped EXE
PID:2260 -
\??\c:\llxflfr.exec:\llxflfr.exe47⤵
- Executes dropped EXE
PID:2388 -
\??\c:\nhhhnn.exec:\nhhhnn.exe48⤵
- Executes dropped EXE
PID:2100 -
\??\c:\ttntnn.exec:\ttntnn.exe49⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pjjdv.exec:\pjjdv.exe50⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lfllxxl.exec:\lfllxxl.exe51⤵
- Executes dropped EXE
PID:2468 -
\??\c:\3hbhbn.exec:\3hbhbn.exe52⤵
- Executes dropped EXE
PID:1784 -
\??\c:\vpddp.exec:\vpddp.exe53⤵
- Executes dropped EXE
PID:2212 -
\??\c:\1fxxfxf.exec:\1fxxfxf.exe54⤵
- Executes dropped EXE
PID:2176 -
\??\c:\3nttbt.exec:\3nttbt.exe55⤵
- Executes dropped EXE
PID:2736 -
\??\c:\pvjvp.exec:\pvjvp.exe56⤵
- Executes dropped EXE
PID:3016 -
\??\c:\rrxrxxl.exec:\rrxrxxl.exe57⤵
- Executes dropped EXE
PID:1448 -
\??\c:\3bnhtt.exec:\3bnhtt.exe58⤵
- Executes dropped EXE
PID:820 -
\??\c:\9jppj.exec:\9jppj.exe59⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rlfflrf.exec:\rlfflrf.exe60⤵
- Executes dropped EXE
PID:1984 -
\??\c:\nhhnhn.exec:\nhhnhn.exe61⤵
- Executes dropped EXE
PID:996 -
\??\c:\dvpvj.exec:\dvpvj.exe62⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xlxlxxl.exec:\xlxlxxl.exe63⤵
- Executes dropped EXE
PID:2248 -
\??\c:\nhtbhh.exec:\nhtbhh.exe64⤵
- Executes dropped EXE
PID:408 -
\??\c:\pjppd.exec:\pjppd.exe65⤵
- Executes dropped EXE
PID:2380 -
\??\c:\fxxrxxr.exec:\fxxrxxr.exe66⤵PID:1772
-
\??\c:\7tbthb.exec:\7tbthb.exe67⤵PID:1060
-
\??\c:\pjjdj.exec:\pjjdj.exe68⤵PID:604
-
\??\c:\9rxrrlx.exec:\9rxrrlx.exe69⤵PID:2104
-
\??\c:\rfxxrxf.exec:\rfxxrxf.exe70⤵PID:2432
-
\??\c:\nhthtt.exec:\nhthtt.exe71⤵PID:2576
-
\??\c:\9dppj.exec:\9dppj.exe72⤵PID:2580
-
\??\c:\1lffllr.exec:\1lffllr.exe73⤵PID:1684
-
\??\c:\hnhhhn.exec:\hnhhhn.exe74⤵PID:2328
-
\??\c:\3dvvj.exec:\3dvvj.exe75⤵PID:1928
-
\??\c:\7thbnt.exec:\7thbnt.exe76⤵PID:1600
-
\??\c:\pjvvp.exec:\pjvvp.exe77⤵PID:2028
-
\??\c:\fxrxfll.exec:\fxrxfll.exe78⤵PID:2820
-
\??\c:\fxllffx.exec:\fxllffx.exe79⤵PID:2916
-
\??\c:\tnhnbb.exec:\tnhnbb.exe80⤵PID:2132
-
\??\c:\dvddp.exec:\dvddp.exe81⤵PID:2932
-
\??\c:\rlrrllf.exec:\rlrrllf.exe82⤵PID:2628
-
\??\c:\btbnbb.exec:\btbnbb.exe83⤵PID:2656
-
\??\c:\7jpvj.exec:\7jpvj.exe84⤵PID:2224
-
\??\c:\1frlxrx.exec:\1frlxrx.exe85⤵PID:2796
-
\??\c:\9hbbnn.exec:\9hbbnn.exe86⤵PID:2524
-
\??\c:\vvppv.exec:\vvppv.exe87⤵PID:2504
-
\??\c:\5ffllll.exec:\5ffllll.exe88⤵PID:2716
-
\??\c:\nhtbtb.exec:\nhtbtb.exe89⤵PID:2260
-
\??\c:\jdpvd.exec:\jdpvd.exe90⤵PID:2864
-
\??\c:\3rllrrf.exec:\3rllrrf.exe91⤵PID:2100
-
\??\c:\nhtthh.exec:\nhtthh.exe92⤵PID:1632
-
\??\c:\vdpvp.exec:\vdpvp.exe93⤵PID:828
-
\??\c:\ffrrxxr.exec:\ffrrxxr.exe94⤵PID:1064
-
\??\c:\thhbbn.exec:\thhbbn.exe95⤵PID:1784
-
\??\c:\ddpdv.exec:\ddpdv.exe96⤵PID:2212
-
\??\c:\xrfxfll.exec:\xrfxfll.exe97⤵PID:2176
-
\??\c:\tnbhbh.exec:\tnbhbh.exe98⤵PID:2736
-
\??\c:\bthhtb.exec:\bthhtb.exe99⤵PID:3016
-
\??\c:\7dpjd.exec:\7dpjd.exe100⤵PID:1248
-
\??\c:\5fxfrxx.exec:\5fxfrxx.exe101⤵PID:2304
-
\??\c:\thnthh.exec:\thnthh.exe102⤵PID:664
-
\??\c:\1jpjj.exec:\1jpjj.exe103⤵PID:1984
-
\??\c:\rfxrrll.exec:\rfxrrll.exe104⤵PID:628
-
\??\c:\thhbht.exec:\thhbht.exe105⤵PID:3040
-
\??\c:\dvppd.exec:\dvppd.exe106⤵PID:2228
-
\??\c:\xxflrxl.exec:\xxflrxl.exe107⤵PID:408
-
\??\c:\7llfrxf.exec:\7llfrxf.exe108⤵PID:1364
-
\??\c:\nbntht.exec:\nbntht.exe109⤵PID:948
-
\??\c:\jdvvd.exec:\jdvvd.exe110⤵PID:1348
-
\??\c:\9lffxxx.exec:\9lffxxx.exe111⤵PID:316
-
\??\c:\hhthbh.exec:\hhthbh.exe112⤵PID:2292
-
\??\c:\3pvvj.exec:\3pvvj.exe113⤵PID:2432
-
\??\c:\7lxxffl.exec:\7lxxffl.exe114⤵PID:2036
-
\??\c:\5htbnh.exec:\5htbnh.exe115⤵PID:1492
-
\??\c:\jjvvd.exec:\jjvvd.exe116⤵PID:2340
-
\??\c:\rflffff.exec:\rflffff.exe117⤵PID:1948
-
\??\c:\hthhtb.exec:\hthhtb.exe118⤵PID:1740
-
\??\c:\3jvvd.exec:\3jvvd.exe119⤵PID:2364
-
\??\c:\lfrrrrf.exec:\lfrrrrf.exe120⤵PID:2044
-
\??\c:\nhhbtn.exec:\nhhbtn.exe121⤵PID:1936
-
\??\c:\1pdvj.exec:\1pdvj.exe122⤵PID:2820
-
\??\c:\rflffxl.exec:\rflffxl.exe123⤵PID:2916
-
\??\c:\nnbbnt.exec:\nnbbnt.exe124⤵PID:2368
-
\??\c:\7vjpv.exec:\7vjpv.exe125⤵PID:2932
-
\??\c:\lfxxffl.exec:\lfxxffl.exe126⤵PID:2628
-
\??\c:\xxrrffx.exec:\xxrrffx.exe127⤵PID:2656
-
\??\c:\5bnnbb.exec:\5bnnbb.exe128⤵PID:2660
-
\??\c:\jvddd.exec:\jvddd.exe129⤵PID:1668
-
\??\c:\rfrrlfr.exec:\rfrrlfr.exe130⤵PID:2664
-
\??\c:\bnbhtn.exec:\bnbhtn.exe131⤵PID:1824
-
\??\c:\vpppd.exec:\vpppd.exe132⤵PID:1072
-
\??\c:\rlrllrx.exec:\rlrllrx.exe133⤵PID:2860
-
\??\c:\ttnnbb.exec:\ttnnbb.exe134⤵PID:2884
-
\??\c:\vpvvp.exec:\vpvvp.exe135⤵PID:2596
-
\??\c:\lflfrxf.exec:\lflfrxf.exe136⤵PID:2988
-
\??\c:\bbhtbt.exec:\bbhtbt.exe137⤵PID:828
-
\??\c:\9jjvp.exec:\9jjvp.exe138⤵PID:1092
-
\??\c:\xfxrxrf.exec:\xfxrxrf.exe139⤵PID:1200
-
\??\c:\bbntht.exec:\bbntht.exe140⤵PID:2772
-
\??\c:\9pjjp.exec:\9pjjp.exe141⤵PID:3056
-
\??\c:\xrffflx.exec:\xrffflx.exe142⤵PID:832
-
\??\c:\thtbnh.exec:\thtbnh.exe143⤵PID:3036
-
\??\c:\1ppdj.exec:\1ppdj.exe144⤵PID:536
-
\??\c:\1llxrlr.exec:\1llxrlr.exe145⤵PID:1160
-
\??\c:\bntbbb.exec:\bntbbb.exe146⤵PID:584
-
\??\c:\jvjdj.exec:\jvjdj.exe147⤵PID:1376
-
\??\c:\vjjjv.exec:\vjjjv.exe148⤵PID:3048
-
\??\c:\frxfrxf.exec:\frxfrxf.exe149⤵PID:1320
-
\??\c:\bthnnb.exec:\bthnnb.exe150⤵PID:468
-
\??\c:\1pddj.exec:\1pddj.exe151⤵PID:1960
-
\??\c:\flffrrl.exec:\flffrrl.exe152⤵PID:1868
-
\??\c:\tbbbnb.exec:\tbbbnb.exe153⤵PID:948
-
\??\c:\ppjvp.exec:\ppjvp.exe154⤵PID:912
-
\??\c:\fxrxlfx.exec:\fxrxlfx.exe155⤵PID:1116
-
\??\c:\htttbh.exec:\htttbh.exe156⤵PID:560
-
\??\c:\9dvpj.exec:\9dvpj.exe157⤵PID:2052
-
\??\c:\fxlflll.exec:\fxlflll.exe158⤵PID:2036
-
\??\c:\1bbbth.exec:\1bbbth.exe159⤵PID:608
-
\??\c:\hbtthn.exec:\hbtthn.exe160⤵PID:2332
-
\??\c:\7dvvd.exec:\7dvvd.exe161⤵PID:2428
-
\??\c:\xrxxxrf.exec:\xrxxxrf.exe162⤵PID:2448
-
\??\c:\tnhnbh.exec:\tnhnbh.exe163⤵PID:2392
-
\??\c:\vpdjv.exec:\vpdjv.exe164⤵PID:2200
-
\??\c:\xxflfxf.exec:\xxflfxf.exe165⤵PID:2636
-
\??\c:\1nhhbb.exec:\1nhhbb.exe166⤵PID:2704
-
\??\c:\5vjdv.exec:\5vjdv.exe167⤵PID:2944
-
\??\c:\fxlfrxl.exec:\fxlfrxl.exe168⤵PID:2788
-
\??\c:\9tntbb.exec:\9tntbb.exe169⤵PID:2812
-
\??\c:\jdjpd.exec:\jdjpd.exe170⤵PID:2496
-
\??\c:\rxflrxx.exec:\rxflrxx.exe171⤵PID:2680
-
\??\c:\ffxllll.exec:\ffxllll.exe172⤵PID:2548
-
\??\c:\5btnht.exec:\5btnht.exe173⤵PID:2096
-
\??\c:\pppvj.exec:\pppvj.exe174⤵PID:2824
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe175⤵PID:1824
-
\??\c:\3bhnhh.exec:\3bhnhh.exe176⤵PID:2844
-
\??\c:\dvjjp.exec:\dvjjp.exe177⤵PID:2892
-
\??\c:\ffrxfll.exec:\ffrxfll.exe178⤵PID:884
-
\??\c:\3hbhbb.exec:\3hbhbb.exe179⤵PID:2596
-
\??\c:\vvvjp.exec:\vvvjp.exe180⤵PID:1952
-
\??\c:\rlffrrf.exec:\rlffrrf.exe181⤵PID:828
-
\??\c:\nbttnn.exec:\nbttnn.exe182⤵PID:2748
-
\??\c:\3vvvd.exec:\3vvvd.exe183⤵PID:2724
-
\??\c:\ppvvj.exec:\ppvvj.exe184⤵PID:2756
-
\??\c:\xrxxfxx.exec:\xrxxfxx.exe185⤵PID:816
-
\??\c:\bbtbtn.exec:\bbtbtn.exe186⤵PID:264
-
\??\c:\1djpv.exec:\1djpv.exe187⤵PID:2088
-
\??\c:\xrllrfr.exec:\xrllrfr.exe188⤵PID:484
-
\??\c:\bthhbt.exec:\bthhbt.exe189⤵PID:1488
-
\??\c:\vpvdp.exec:\vpvdp.exe190⤵PID:2460
-
\??\c:\xrflxlx.exec:\xrflxlx.exe191⤵PID:1856
-
\??\c:\1bbtbh.exec:\1bbtbh.exe192⤵PID:448
-
\??\c:\dvppp.exec:\dvppp.exe193⤵PID:2380
-
\??\c:\lfxflxl.exec:\lfxflxl.exe194⤵PID:844
-
\??\c:\3dvvd.exec:\3dvvd.exe195⤵PID:2168
-
\??\c:\tnbntt.exec:\tnbntt.exe196⤵PID:604
-
\??\c:\dpjdp.exec:\dpjdp.exe197⤵PID:544
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe198⤵PID:1556
-
\??\c:\7bhnbb.exec:\7bhnbb.exe199⤵PID:2576
-
\??\c:\7thhtb.exec:\7thhtb.exe200⤵PID:2580
-
\??\c:\jdpjp.exec:\jdpjp.exe201⤵PID:2052
-
\??\c:\xrffrrf.exec:\xrffrrf.exe202⤵PID:2236
-
\??\c:\hbtbbh.exec:\hbtbbh.exe203⤵PID:1592
-
\??\c:\jdvvd.exec:\jdvvd.exe204⤵PID:2920
-
\??\c:\rrxxfxf.exec:\rrxxfxf.exe205⤵PID:2160
-
\??\c:\bttbbt.exec:\bttbbt.exe206⤵PID:300
-
\??\c:\vvddp.exec:\vvddp.exe207⤵PID:2348
-
\??\c:\rxllflr.exec:\rxllflr.exe208⤵PID:2640
-
\??\c:\nbtbnn.exec:\nbtbnn.exe209⤵PID:2636
-
\??\c:\3jddd.exec:\3jddd.exe210⤵PID:2704
-
\??\c:\frlflfl.exec:\frlflfl.exe211⤵PID:2784
-
\??\c:\tnbbnt.exec:\tnbbnt.exe212⤵PID:2500
-
\??\c:\vjjdd.exec:\vjjdd.exe213⤵PID:2876
-
\??\c:\jjvdv.exec:\jjvdv.exe214⤵PID:2496
-
\??\c:\xlrxfff.exec:\xlrxfff.exe215⤵PID:2508
-
\??\c:\thbnbh.exec:\thbnbh.exe216⤵PID:2568
-
\??\c:\dvppd.exec:\dvppd.exe217⤵PID:2032
-
\??\c:\rrfxlfl.exec:\rrfxlfl.exe218⤵PID:2780
-
\??\c:\5tnntb.exec:\5tnntb.exe219⤵PID:2688
-
\??\c:\vpddd.exec:\vpddd.exe220⤵PID:1520
-
\??\c:\3xrxxfl.exec:\3xrxxfl.exe221⤵PID:2868
-
\??\c:\nnhbtb.exec:\nnhbtb.exe222⤵PID:1832
-
\??\c:\btttbt.exec:\btttbt.exe223⤵PID:1752
-
\??\c:\vjvjv.exec:\vjvjv.exe224⤵PID:2768
-
\??\c:\xrfflrx.exec:\xrfflrx.exe225⤵PID:1444
-
\??\c:\nhtthh.exec:\nhtthh.exe226⤵PID:1580
-
\??\c:\pjppp.exec:\pjppp.exe227⤵PID:2308
-
\??\c:\frxxlll.exec:\frxxlll.exe228⤵PID:2756
-
\??\c:\hhhnbn.exec:\hhhnbn.exe229⤵PID:1300
-
\??\c:\jjpjv.exec:\jjpjv.exe230⤵PID:1500
-
\??\c:\xrlrffr.exec:\xrlrffr.exe231⤵PID:664
-
\??\c:\btnthb.exec:\btnthb.exe232⤵PID:1984
-
\??\c:\pdvvd.exec:\pdvvd.exe233⤵PID:1488
-
\??\c:\frflxrf.exec:\frflxrf.exe234⤵PID:692
-
\??\c:\hnnnbt.exec:\hnnnbt.exe235⤵PID:896
-
\??\c:\ppjpd.exec:\ppjpd.exe236⤵PID:408
-
\??\c:\xlxxffl.exec:\xlxxffl.exe237⤵PID:1772
-
\??\c:\5bnhhh.exec:\5bnhhh.exe238⤵PID:1288
-
\??\c:\jjvvj.exec:\jjvvj.exe239⤵PID:1820
-
\??\c:\vjddp.exec:\vjddp.exe240⤵PID:904
-
\??\c:\xrlfrrx.exec:\xrlfrrx.exe241⤵PID:2976
-
\??\c:\3bttnn.exec:\3bttnn.exe242⤵PID:2432