Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 12:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c2c178eb40ce4937b88e9aca52631600_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
c2c178eb40ce4937b88e9aca52631600_NeikiAnalytics.exe
-
Size
77KB
-
MD5
c2c178eb40ce4937b88e9aca52631600
-
SHA1
aba96663342d5378e333c63f1bac77e230acef43
-
SHA256
b929f858287b950657c6df42075b23d12b38321351322bc4da60c4c7a58143cd
-
SHA512
ba3b962ece343b72764dd63608cce3f34672748d426505f9f49860e56648b1d59f728581a2fceaf9da500658680689cf35f16d6293ba0dc179100aea4d8f5018
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmBz:ymb3NkkiQ3mdBjFo73thgQ/wEkz
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/4316-5-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-27-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/780-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2600-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jdvpd.exerffxllf.exe3bbtnh.exe9ppdd.exerfrllll.exe7thbnt.exe3hbhbn.exeddjdj.exejvjdd.exe1xfflll.exennnbhb.exepjjdd.exerlrlffx.exelrxxflr.exebttnnn.exe5jpjd.exefffrrxl.exe5rlllff.exe7thbbb.exevvvvv.exevppjd.exelfllfxl.exenbthbn.exejdjdd.exejddvp.exerrxxxxr.exerrffrrl.exenhbhbh.exedvjjj.exevpdjv.exellffrrr.exe7ttttt.exehhbnnn.exe5htttt.exeddvpj.exelflflfr.exerlrrxfr.exefllfxxr.exe1ntttb.exejvddp.exerlxlxlr.exerlfffll.exe3bbbbb.exetntthn.exe7pddp.exe3vddv.exeffxrlll.exexxffrrl.exehbhhhh.exejpdpj.exerlllfff.exelffrlfx.exehbhhhh.exejpjpd.exevjjdd.exejdppj.exe9lfflrx.exexxxrxxx.exennhhnn.exevjjjj.exerlrlfff.exelfllfff.exennhbtb.exepjjdv.exepid process 3004 jdvpd.exe 3956 rffxllf.exe 4288 3bbtnh.exe 780 9ppdd.exe 1380 rfrllll.exe 1472 7thbnt.exe 4552 3hbhbn.exe 2008 ddjdj.exe 3576 jvjdd.exe 4260 1xfflll.exe 4908 nnnbhb.exe 2592 pjjdd.exe 4944 rlrlffx.exe 4756 lrxxflr.exe 2600 bttnnn.exe 1080 5jpjd.exe 4772 fffrrxl.exe 3012 5rlllff.exe 2496 7thbbb.exe 3024 vvvvv.exe 2176 vppjd.exe 888 lfllfxl.exe 2704 nbthbn.exe 3748 jdjdd.exe 5080 jddvp.exe 2244 rrxxxxr.exe 3316 rrffrrl.exe 2184 nhbhbh.exe 5040 dvjjj.exe 2324 vpdjv.exe 4000 llffrrr.exe 1708 7ttttt.exe 3696 hhbnnn.exe 4700 5htttt.exe 424 ddvpj.exe 5104 lflflfr.exe 3740 rlrrxfr.exe 4940 fllfxxr.exe 3128 1ntttb.exe 392 jvddp.exe 1876 rlxlxlr.exe 3004 rlfffll.exe 4980 3bbbbb.exe 4912 tntthn.exe 1924 7pddp.exe 4560 3vddv.exe 3108 ffxrlll.exe 3884 xxffrrl.exe 3736 hbhhhh.exe 3044 jpdpj.exe 2968 rlllfff.exe 1644 lffrlfx.exe 1584 hbhhhh.exe 1864 jpjpd.exe 1660 vjjdd.exe 2592 jdppj.exe 1368 9lfflrx.exe 3192 xxxrxxx.exe 1060 nnhhnn.exe 868 vjjjj.exe 4452 rlrlfff.exe 660 lfllfff.exe 2496 nnhbtb.exe 3024 pjjdv.exe -
Processes:
resource yara_rule behavioral2/memory/4316-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/780-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/780-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2600-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c2c178eb40ce4937b88e9aca52631600_NeikiAnalytics.exejdvpd.exerffxllf.exe3bbtnh.exe9ppdd.exerfrllll.exe7thbnt.exe3hbhbn.exeddjdj.exejvjdd.exe1xfflll.exennnbhb.exepjjdd.exerlrlffx.exelrxxflr.exebttnnn.exe5jpjd.exefffrrxl.exe5rlllff.exe7thbbb.exevvvvv.exevppjd.exedescription pid process target process PID 4316 wrote to memory of 3004 4316 c2c178eb40ce4937b88e9aca52631600_NeikiAnalytics.exe jdvpd.exe PID 4316 wrote to memory of 3004 4316 c2c178eb40ce4937b88e9aca52631600_NeikiAnalytics.exe jdvpd.exe PID 4316 wrote to memory of 3004 4316 c2c178eb40ce4937b88e9aca52631600_NeikiAnalytics.exe jdvpd.exe PID 3004 wrote to memory of 3956 3004 jdvpd.exe rffxllf.exe PID 3004 wrote to memory of 3956 3004 jdvpd.exe rffxllf.exe PID 3004 wrote to memory of 3956 3004 jdvpd.exe rffxllf.exe PID 3956 wrote to memory of 4288 3956 rffxllf.exe 3bbtnh.exe PID 3956 wrote to memory of 4288 3956 rffxllf.exe 3bbtnh.exe PID 3956 wrote to memory of 4288 3956 rffxllf.exe 3bbtnh.exe PID 4288 wrote to memory of 780 4288 3bbtnh.exe 9ppdd.exe PID 4288 wrote to memory of 780 4288 3bbtnh.exe 9ppdd.exe PID 4288 wrote to memory of 780 4288 3bbtnh.exe 9ppdd.exe PID 780 wrote to memory of 1380 780 9ppdd.exe rfrllll.exe PID 780 wrote to memory of 1380 780 9ppdd.exe rfrllll.exe PID 780 wrote to memory of 1380 780 9ppdd.exe rfrllll.exe PID 1380 wrote to memory of 1472 1380 rfrllll.exe 7thbnt.exe PID 1380 wrote to memory of 1472 1380 rfrllll.exe 7thbnt.exe PID 1380 wrote to memory of 1472 1380 rfrllll.exe 7thbnt.exe PID 1472 wrote to memory of 4552 1472 7thbnt.exe 3hbhbn.exe PID 1472 wrote to memory of 4552 1472 7thbnt.exe 3hbhbn.exe PID 1472 wrote to memory of 4552 1472 7thbnt.exe 3hbhbn.exe PID 4552 wrote to memory of 2008 4552 3hbhbn.exe ddjdj.exe PID 4552 wrote to memory of 2008 4552 3hbhbn.exe ddjdj.exe PID 4552 wrote to memory of 2008 4552 3hbhbn.exe ddjdj.exe PID 2008 wrote to memory of 3576 2008 ddjdj.exe jvjdd.exe PID 2008 wrote to memory of 3576 2008 ddjdj.exe jvjdd.exe PID 2008 wrote to memory of 3576 2008 ddjdj.exe jvjdd.exe PID 3576 wrote to memory of 4260 3576 jvjdd.exe 1xfflll.exe PID 3576 wrote to memory of 4260 3576 jvjdd.exe 1xfflll.exe PID 3576 wrote to memory of 4260 3576 jvjdd.exe 1xfflll.exe PID 4260 wrote to memory of 4908 4260 1xfflll.exe nnnbhb.exe PID 4260 wrote to memory of 4908 4260 1xfflll.exe nnnbhb.exe PID 4260 wrote to memory of 4908 4260 1xfflll.exe nnnbhb.exe PID 4908 wrote to memory of 2592 4908 nnnbhb.exe pjjdd.exe PID 4908 wrote to memory of 2592 4908 nnnbhb.exe pjjdd.exe PID 4908 wrote to memory of 2592 4908 nnnbhb.exe pjjdd.exe PID 2592 wrote to memory of 4944 2592 pjjdd.exe rlrlffx.exe PID 2592 wrote to memory of 4944 2592 pjjdd.exe rlrlffx.exe PID 2592 wrote to memory of 4944 2592 pjjdd.exe rlrlffx.exe PID 4944 wrote to memory of 4756 4944 rlrlffx.exe lrxxflr.exe PID 4944 wrote to memory of 4756 4944 rlrlffx.exe lrxxflr.exe PID 4944 wrote to memory of 4756 4944 rlrlffx.exe lrxxflr.exe PID 4756 wrote to memory of 2600 4756 lrxxflr.exe bttnnn.exe PID 4756 wrote to memory of 2600 4756 lrxxflr.exe bttnnn.exe PID 4756 wrote to memory of 2600 4756 lrxxflr.exe bttnnn.exe PID 2600 wrote to memory of 1080 2600 bttnnn.exe 5jpjd.exe PID 2600 wrote to memory of 1080 2600 bttnnn.exe 5jpjd.exe PID 2600 wrote to memory of 1080 2600 bttnnn.exe 5jpjd.exe PID 1080 wrote to memory of 4772 1080 5jpjd.exe fffrrxl.exe PID 1080 wrote to memory of 4772 1080 5jpjd.exe fffrrxl.exe PID 1080 wrote to memory of 4772 1080 5jpjd.exe fffrrxl.exe PID 4772 wrote to memory of 3012 4772 fffrrxl.exe 5rlllff.exe PID 4772 wrote to memory of 3012 4772 fffrrxl.exe 5rlllff.exe PID 4772 wrote to memory of 3012 4772 fffrrxl.exe 5rlllff.exe PID 3012 wrote to memory of 2496 3012 5rlllff.exe 7thbbb.exe PID 3012 wrote to memory of 2496 3012 5rlllff.exe 7thbbb.exe PID 3012 wrote to memory of 2496 3012 5rlllff.exe 7thbbb.exe PID 2496 wrote to memory of 3024 2496 7thbbb.exe vvvvv.exe PID 2496 wrote to memory of 3024 2496 7thbbb.exe vvvvv.exe PID 2496 wrote to memory of 3024 2496 7thbbb.exe vvvvv.exe PID 3024 wrote to memory of 2176 3024 vvvvv.exe vppjd.exe PID 3024 wrote to memory of 2176 3024 vvvvv.exe vppjd.exe PID 3024 wrote to memory of 2176 3024 vvvvv.exe vppjd.exe PID 2176 wrote to memory of 888 2176 vppjd.exe lfllfxl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2c178eb40ce4937b88e9aca52631600_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c2c178eb40ce4937b88e9aca52631600_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\jdvpd.exec:\jdvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\rffxllf.exec:\rffxllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\3bbtnh.exec:\3bbtnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\9ppdd.exec:\9ppdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\rfrllll.exec:\rfrllll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\7thbnt.exec:\7thbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\3hbhbn.exec:\3hbhbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\ddjdj.exec:\ddjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\jvjdd.exec:\jvjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\1xfflll.exec:\1xfflll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\nnnbhb.exec:\nnnbhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\pjjdd.exec:\pjjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rlrlffx.exec:\rlrlffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\lrxxflr.exec:\lrxxflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\bttnnn.exec:\bttnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\5jpjd.exec:\5jpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\fffrrxl.exec:\fffrrxl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\5rlllff.exec:\5rlllff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\7thbbb.exec:\7thbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\vvvvv.exec:\vvvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\vppjd.exec:\vppjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\lfllfxl.exec:\lfllfxl.exe23⤵
- Executes dropped EXE
PID:888 -
\??\c:\nbthbn.exec:\nbthbn.exe24⤵
- Executes dropped EXE
PID:2704 -
\??\c:\jdjdd.exec:\jdjdd.exe25⤵
- Executes dropped EXE
PID:3748 -
\??\c:\jddvp.exec:\jddvp.exe26⤵
- Executes dropped EXE
PID:5080 -
\??\c:\rrxxxxr.exec:\rrxxxxr.exe27⤵
- Executes dropped EXE
PID:2244 -
\??\c:\rrffrrl.exec:\rrffrrl.exe28⤵
- Executes dropped EXE
PID:3316 -
\??\c:\nhbhbh.exec:\nhbhbh.exe29⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dvjjj.exec:\dvjjj.exe30⤵
- Executes dropped EXE
PID:5040 -
\??\c:\vpdjv.exec:\vpdjv.exe31⤵
- Executes dropped EXE
PID:2324 -
\??\c:\llffrrr.exec:\llffrrr.exe32⤵
- Executes dropped EXE
PID:4000 -
\??\c:\7ttttt.exec:\7ttttt.exe33⤵
- Executes dropped EXE
PID:1708 -
\??\c:\hhbnnn.exec:\hhbnnn.exe34⤵
- Executes dropped EXE
PID:3696 -
\??\c:\5htttt.exec:\5htttt.exe35⤵
- Executes dropped EXE
PID:4700 -
\??\c:\ddvpj.exec:\ddvpj.exe36⤵
- Executes dropped EXE
PID:424 -
\??\c:\lflflfr.exec:\lflflfr.exe37⤵
- Executes dropped EXE
PID:5104 -
\??\c:\rlrrxfr.exec:\rlrrxfr.exe38⤵
- Executes dropped EXE
PID:3740 -
\??\c:\fllfxxr.exec:\fllfxxr.exe39⤵
- Executes dropped EXE
PID:4940 -
\??\c:\1ntttb.exec:\1ntttb.exe40⤵
- Executes dropped EXE
PID:3128 -
\??\c:\jvddp.exec:\jvddp.exe41⤵
- Executes dropped EXE
PID:392 -
\??\c:\rlxlxlr.exec:\rlxlxlr.exe42⤵
- Executes dropped EXE
PID:1876 -
\??\c:\rlfffll.exec:\rlfffll.exe43⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3bbbbb.exec:\3bbbbb.exe44⤵
- Executes dropped EXE
PID:4980 -
\??\c:\tntthn.exec:\tntthn.exe45⤵
- Executes dropped EXE
PID:4912 -
\??\c:\7pddp.exec:\7pddp.exe46⤵
- Executes dropped EXE
PID:1924 -
\??\c:\3vddv.exec:\3vddv.exe47⤵
- Executes dropped EXE
PID:4560 -
\??\c:\ffxrlll.exec:\ffxrlll.exe48⤵
- Executes dropped EXE
PID:3108 -
\??\c:\xxffrrl.exec:\xxffrrl.exe49⤵
- Executes dropped EXE
PID:3884 -
\??\c:\hbhhhh.exec:\hbhhhh.exe50⤵
- Executes dropped EXE
PID:3736 -
\??\c:\jpdpj.exec:\jpdpj.exe51⤵
- Executes dropped EXE
PID:3044 -
\??\c:\rlllfff.exec:\rlllfff.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\lffrlfx.exec:\lffrlfx.exe53⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hbhhhh.exec:\hbhhhh.exe54⤵
- Executes dropped EXE
PID:1584 -
\??\c:\jpjpd.exec:\jpjpd.exe55⤵
- Executes dropped EXE
PID:1864 -
\??\c:\vjjdd.exec:\vjjdd.exe56⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jdppj.exec:\jdppj.exe57⤵
- Executes dropped EXE
PID:2592 -
\??\c:\9lfflrx.exec:\9lfflrx.exe58⤵
- Executes dropped EXE
PID:1368 -
\??\c:\xxxrxxx.exec:\xxxrxxx.exe59⤵
- Executes dropped EXE
PID:3192 -
\??\c:\nnhhnn.exec:\nnhhnn.exe60⤵
- Executes dropped EXE
PID:1060 -
\??\c:\vjjjj.exec:\vjjjj.exe61⤵
- Executes dropped EXE
PID:868 -
\??\c:\rlrlfff.exec:\rlrlfff.exe62⤵
- Executes dropped EXE
PID:4452 -
\??\c:\lfllfff.exec:\lfllfff.exe63⤵
- Executes dropped EXE
PID:660 -
\??\c:\nnhbtb.exec:\nnhbtb.exe64⤵
- Executes dropped EXE
PID:2496 -
\??\c:\pjjdv.exec:\pjjdv.exe65⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5djdv.exec:\5djdv.exe66⤵PID:2784
-
\??\c:\lfrllrf.exec:\lfrllrf.exe67⤵PID:3860
-
\??\c:\rxffffx.exec:\rxffffx.exe68⤵PID:1468
-
\??\c:\hhhhbb.exec:\hhhhbb.exe69⤵PID:1856
-
\??\c:\bbhbbb.exec:\bbhbbb.exe70⤵PID:1764
-
\??\c:\jddvd.exec:\jddvd.exe71⤵PID:1544
-
\??\c:\vvdjp.exec:\vvdjp.exe72⤵PID:2440
-
\??\c:\9lxrffx.exec:\9lxrffx.exe73⤵PID:3172
-
\??\c:\5lrxxff.exec:\5lrxxff.exe74⤵PID:4132
-
\??\c:\tnbbbh.exec:\tnbbbh.exe75⤵PID:3872
-
\??\c:\nhhbtt.exec:\nhhbtt.exe76⤵PID:3436
-
\??\c:\dvvpp.exec:\dvvpp.exe77⤵PID:3836
-
\??\c:\jvvvd.exec:\jvvvd.exe78⤵PID:2324
-
\??\c:\vpvvv.exec:\vpvvv.exe79⤵PID:4412
-
\??\c:\3rxxrrr.exec:\3rxxrrr.exe80⤵PID:4344
-
\??\c:\3xffrrl.exec:\3xffrrl.exe81⤵PID:1708
-
\??\c:\nthnbb.exec:\nthnbb.exe82⤵PID:4704
-
\??\c:\5bhhbh.exec:\5bhhbh.exe83⤵PID:4352
-
\??\c:\vddvd.exec:\vddvd.exe84⤵PID:2492
-
\??\c:\pdjjj.exec:\pdjjj.exe85⤵PID:4464
-
\??\c:\xrlffxx.exec:\xrlffxx.exe86⤵PID:4296
-
\??\c:\rrrxrxx.exec:\rrrxrxx.exe87⤵PID:3100
-
\??\c:\5nhhbb.exec:\5nhhbb.exe88⤵PID:2476
-
\??\c:\hhttbb.exec:\hhttbb.exe89⤵PID:228
-
\??\c:\pjdvv.exec:\pjdvv.exe90⤵PID:220
-
\??\c:\jdppj.exec:\jdppj.exe91⤵PID:3216
-
\??\c:\vjjjd.exec:\vjjjd.exe92⤵PID:3644
-
\??\c:\fffxrrr.exec:\fffxrrr.exe93⤵PID:1276
-
\??\c:\bbhnbb.exec:\bbhnbb.exe94⤵PID:2404
-
\??\c:\nthbtt.exec:\nthbtt.exe95⤵PID:5012
-
\??\c:\jppvp.exec:\jppvp.exe96⤵PID:2752
-
\??\c:\dvvvj.exec:\dvvvj.exe97⤵PID:1428
-
\??\c:\fffxrrr.exec:\fffxrrr.exe98⤵PID:3928
-
\??\c:\fflrfff.exec:\fflrfff.exe99⤵PID:3716
-
\??\c:\ttbhtt.exec:\ttbhtt.exe100⤵PID:3612
-
\??\c:\vpddv.exec:\vpddv.exe101⤵PID:4640
-
\??\c:\xxflrlx.exec:\xxflrlx.exe102⤵PID:4988
-
\??\c:\bbbbbh.exec:\bbbbbh.exe103⤵PID:4020
-
\??\c:\tnthhn.exec:\tnthhn.exe104⤵PID:2364
-
\??\c:\bbhntb.exec:\bbhntb.exe105⤵PID:3588
-
\??\c:\dvjjj.exec:\dvjjj.exe106⤵PID:2600
-
\??\c:\djjjj.exec:\djjjj.exe107⤵PID:3972
-
\??\c:\ffflllx.exec:\ffflllx.exe108⤵PID:1592
-
\??\c:\lfllllr.exec:\lfllllr.exe109⤵PID:3248
-
\??\c:\nhnhhn.exec:\nhnhhn.exe110⤵PID:3864
-
\??\c:\1nnnhn.exec:\1nnnhn.exe111⤵PID:4264
-
\??\c:\ddppp.exec:\ddppp.exe112⤵PID:972
-
\??\c:\pvvvp.exec:\pvvvp.exe113⤵PID:3324
-
\??\c:\flrrfff.exec:\flrrfff.exe114⤵PID:2260
-
\??\c:\rxfflll.exec:\rxfflll.exe115⤵PID:2152
-
\??\c:\nhttbb.exec:\nhttbb.exe116⤵PID:3724
-
\??\c:\hhthhn.exec:\hhthhn.exe117⤵PID:964
-
\??\c:\5hhbbb.exec:\5hhbbb.exe118⤵PID:4880
-
\??\c:\vpvvv.exec:\vpvvv.exe119⤵PID:3276
-
\??\c:\5vvpj.exec:\5vvpj.exe120⤵PID:4140
-
\??\c:\rxxxxll.exec:\rxxxxll.exe121⤵PID:3092
-
\??\c:\9rxrlfx.exec:\9rxrlfx.exe122⤵PID:3908
-
\??\c:\hbbhbb.exec:\hbbhbb.exe123⤵PID:1248
-
\??\c:\tbthtn.exec:\tbthtn.exe124⤵PID:4456
-
\??\c:\jpdvj.exec:\jpdvj.exe125⤵PID:1376
-
\??\c:\jvpjd.exec:\jvpjd.exe126⤵PID:1096
-
\??\c:\xrlxrfx.exec:\xrlxrfx.exe127⤵PID:688
-
\??\c:\fxrlfxl.exec:\fxrlfxl.exe128⤵PID:4484
-
\??\c:\nbhbnh.exec:\nbhbnh.exe129⤵PID:700
-
\??\c:\pvpvj.exec:\pvpvj.exe130⤵PID:4568
-
\??\c:\7vvjj.exec:\7vvjj.exe131⤵PID:4360
-
\??\c:\5flfrrr.exec:\5flfrrr.exe132⤵PID:3320
-
\??\c:\1bhbbt.exec:\1bhbbt.exe133⤵PID:4292
-
\??\c:\5ttnbt.exec:\5ttnbt.exe134⤵PID:2792
-
\??\c:\ddjdp.exec:\ddjdp.exe135⤵PID:4980
-
\??\c:\vpvjd.exec:\vpvjd.exe136⤵PID:3216
-
\??\c:\9xrffxx.exec:\9xrffxx.exe137⤵PID:3644
-
\??\c:\3rrrxxx.exec:\3rrrxxx.exe138⤵PID:1276
-
\??\c:\nhhbhh.exec:\nhhbhh.exe139⤵PID:2404
-
\??\c:\pdppj.exec:\pdppj.exe140⤵PID:3492
-
\??\c:\pdvpj.exec:\pdvpj.exe141⤵PID:4004
-
\??\c:\djvdp.exec:\djvdp.exe142⤵PID:1888
-
\??\c:\xfffxrl.exec:\xfffxrl.exe143⤵PID:1040
-
\??\c:\3xfxrfx.exec:\3xfxrfx.exe144⤵PID:4260
-
\??\c:\3ttnhb.exec:\3ttnhb.exe145⤵PID:1644
-
\??\c:\bnnhtt.exec:\bnnhtt.exe146⤵PID:5020
-
\??\c:\dpvpj.exec:\dpvpj.exe147⤵PID:3112
-
\??\c:\dpjvj.exec:\dpjvj.exe148⤵PID:676
-
\??\c:\llrfrlf.exec:\llrfrlf.exe149⤵PID:1716
-
\??\c:\rffxlfx.exec:\rffxlfx.exe150⤵PID:3164
-
\??\c:\9pjdv.exec:\9pjdv.exe151⤵PID:448
-
\??\c:\7jpjp.exec:\7jpjp.exe152⤵PID:868
-
\??\c:\xflxlfx.exec:\xflxlfx.exe153⤵PID:2692
-
\??\c:\tbntbt.exec:\tbntbt.exe154⤵PID:1200
-
\??\c:\hbhbtn.exec:\hbhbtn.exe155⤵PID:3056
-
\??\c:\bnnnhb.exec:\bnnnhb.exe156⤵PID:4528
-
\??\c:\vjdvj.exec:\vjdvj.exe157⤵PID:2152
-
\??\c:\7flfrxf.exec:\7flfrxf.exe158⤵PID:4884
-
\??\c:\rrllfxl.exec:\rrllfxl.exe159⤵PID:4880
-
\??\c:\lffxrrl.exec:\lffxrrl.exe160⤵PID:3104
-
\??\c:\5nnhhb.exec:\5nnhhb.exe161⤵PID:1316
-
\??\c:\nhhbtt.exec:\nhhbtt.exe162⤵PID:872
-
\??\c:\pvvvv.exec:\pvvvv.exe163⤵PID:784
-
\??\c:\vjvjd.exec:\vjvjd.exe164⤵PID:828
-
\??\c:\flrlxfr.exec:\flrlxfr.exe165⤵PID:1068
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe166⤵PID:3288
-
\??\c:\hbtnbt.exec:\hbtnbt.exe167⤵PID:1092
-
\??\c:\hbhthb.exec:\hbhthb.exe168⤵PID:4328
-
\??\c:\vvjpd.exec:\vvjpd.exe169⤵PID:4296
-
\??\c:\llxfrrl.exec:\llxfrrl.exe170⤵PID:4444
-
\??\c:\xrfxfff.exec:\xrfxfff.exe171⤵PID:816
-
\??\c:\bthhbh.exec:\bthhbh.exe172⤵PID:3020
-
\??\c:\jjppp.exec:\jjppp.exe173⤵PID:2792
-
\??\c:\jpdpp.exec:\jpdpp.exe174⤵PID:4912
-
\??\c:\9xrlfxf.exec:\9xrlfxf.exe175⤵PID:3216
-
\??\c:\xlrrlll.exec:\xlrrlll.exe176⤵PID:4692
-
\??\c:\bhnnht.exec:\bhnnht.exe177⤵PID:3300
-
\??\c:\jpjvv.exec:\jpjvv.exe178⤵PID:3736
-
\??\c:\nhnhht.exec:\nhnhht.exe179⤵PID:1472
-
\??\c:\pdvpd.exec:\pdvpd.exe180⤵PID:2712
-
\??\c:\djjvj.exec:\djjvj.exe181⤵PID:2188
-
\??\c:\xrrlfff.exec:\xrrlfff.exe182⤵PID:3612
-
\??\c:\9pppd.exec:\9pppd.exe183⤵PID:4260
-
\??\c:\frlflfx.exec:\frlflfx.exe184⤵PID:1644
-
\??\c:\thnhnn.exec:\thnhnn.exe185⤵PID:5020
-
\??\c:\dpvvj.exec:\dpvvj.exe186⤵PID:3112
-
\??\c:\9xfrrlf.exec:\9xfrrlf.exe187⤵PID:676
-
\??\c:\djjdd.exec:\djjdd.exe188⤵PID:1080
-
\??\c:\jvvpv.exec:\jvvpv.exe189⤵PID:3412
-
\??\c:\lxxxlfx.exec:\lxxxlfx.exe190⤵PID:3248
-
\??\c:\nhhbbb.exec:\nhhbbb.exe191⤵PID:3340
-
\??\c:\tntnhh.exec:\tntnhh.exe192⤵PID:4452
-
\??\c:\jddpj.exec:\jddpj.exe193⤵PID:2196
-
\??\c:\7rxrlff.exec:\7rxrlff.exe194⤵PID:1764
-
\??\c:\fxrxlfx.exec:\fxrxlfx.exe195⤵PID:3724
-
\??\c:\7jvjp.exec:\7jvjp.exe196⤵PID:2440
-
\??\c:\rfxrlfl.exec:\rfxrlfl.exe197⤵PID:1760
-
\??\c:\flxrlfx.exec:\flxrlfx.exe198⤵PID:3436
-
\??\c:\xxffxxl.exec:\xxffxxl.exe199⤵PID:4412
-
\??\c:\hbbtnh.exec:\hbbtnh.exe200⤵PID:5008
-
\??\c:\vvvpv.exec:\vvvpv.exe201⤵PID:3820
-
\??\c:\pdvpd.exec:\pdvpd.exe202⤵PID:1708
-
\??\c:\jddpj.exec:\jddpj.exe203⤵PID:4688
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe204⤵PID:4372
-
\??\c:\rlrfxxr.exec:\rlrfxxr.exe205⤵PID:1352
-
\??\c:\tbbtnn.exec:\tbbtnn.exe206⤵PID:2116
-
\??\c:\btbtbt.exec:\btbtbt.exe207⤵PID:2476
-
\??\c:\btbttn.exec:\btbttn.exe208⤵PID:960
-
\??\c:\vppdp.exec:\vppdp.exe209⤵PID:4376
-
\??\c:\jpjdv.exec:\jpjdv.exe210⤵PID:4912
-
\??\c:\fllxlfx.exec:\fllxlfx.exe211⤵PID:3992
-
\??\c:\5lrrffr.exec:\5lrrffr.exe212⤵PID:3884
-
\??\c:\tnnttb.exec:\tnnttb.exe213⤵PID:3332
-
\??\c:\1tttnn.exec:\1tttnn.exe214⤵PID:2752
-
\??\c:\pjpjv.exec:\pjpjv.exe215⤵PID:4740
-
\??\c:\ppppd.exec:\ppppd.exe216⤵PID:3008
-
\??\c:\xllxrlx.exec:\xllxrlx.exe217⤵PID:3604
-
\??\c:\frlfrll.exec:\frlfrll.exe218⤵PID:3576
-
\??\c:\nhbtnn.exec:\nhbtnn.exe219⤵PID:3184
-
\??\c:\tnhbnh.exec:\tnhbnh.exe220⤵PID:1852
-
\??\c:\nbthtn.exec:\nbthtn.exe221⤵PID:1188
-
\??\c:\jdvpj.exec:\jdvpj.exe222⤵PID:1268
-
\??\c:\frrrlll.exec:\frrrlll.exe223⤵PID:2408
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe224⤵PID:3164
-
\??\c:\xxxrrrx.exec:\xxxrrrx.exe225⤵PID:2964
-
\??\c:\hnhbnh.exec:\hnhbnh.exe226⤵PID:3248
-
\??\c:\hthbhh.exec:\hthbhh.exe227⤵PID:972
-
\??\c:\dpppd.exec:\dpppd.exe228⤵PID:4264
-
\??\c:\jppjv.exec:\jppjv.exe229⤵PID:5044
-
\??\c:\1fxlxrl.exec:\1fxlxrl.exe230⤵PID:1544
-
\??\c:\rrlfxrr.exec:\rrlfxrr.exe231⤵PID:4724
-
\??\c:\bthbbb.exec:\bthbbb.exe232⤵PID:2424
-
\??\c:\vpvpp.exec:\vpvpp.exe233⤵PID:2172
-
\??\c:\dddvp.exec:\dddvp.exe234⤵PID:4000
-
\??\c:\xrlxrlx.exec:\xrlxrlx.exe235⤵PID:4424
-
\??\c:\rlfxrlx.exec:\rlfxrlx.exe236⤵PID:5008
-
\??\c:\hbbhbh.exec:\hbbhbh.exe237⤵PID:3528
-
\??\c:\tbbhbb.exec:\tbbhbb.exe238⤵PID:1708
-
\??\c:\vjppp.exec:\vjppp.exe239⤵PID:4688
-
\??\c:\jddpj.exec:\jddpj.exe240⤵PID:4984
-
\??\c:\xlxrffr.exec:\xlxrffr.exe241⤵PID:452
-
\??\c:\lfrrlfx.exec:\lfrrlfx.exe242⤵PID:392