Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d4fc4182c3eb642461b64c107ecc3200_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d4fc4182c3eb642461b64c107ecc3200_NeikiAnalytics.exe
-
Size
122KB
-
MD5
d4fc4182c3eb642461b64c107ecc3200
-
SHA1
3fefe16296f825cf7c9e8ef9a485f99ef6aa8967
-
SHA256
aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b
-
SHA512
6faf5009c7d489ae52c932f09c13c74ae9a324bce146a3bac1454729914f5aa020d288a3c8c306ce8283961ca09439ecc4630323d6d7b0709ecd272e9fbaca12
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHvmQ+EZMYX90Ifcr:n3C9BRW0j/uVEZFmIkr
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2768-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-77-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-87-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1232-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/108-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/692-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/912-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rlxfrrx.exe1tntnn.exedpdjj.exerfrrxxf.exetnbbtb.exedvvpv.exexlrrxxf.exe5xxrxrr.exebttntn.exeddpdj.exejdpdp.exexllllrx.exenhtbht.exe1hhnhh.exejjddp.exedpdjj.exefrxxxrr.exelxxrfxl.exe1bnttb.exenttbtt.exe9pvvj.exefxllxxf.exerlxlrfl.exelxrrfxr.exennhnbb.exeddjjv.exelxrrxxr.exe7xrxrrf.exe3nbbhh.exedpdjd.exefffxfxl.exerlxxflr.exehtbttn.exe9ntbbb.exe9vjdj.exejvvdj.exefrlfxrl.exexlrrrlx.exebhhbth.exehtbtbb.exetnttnn.exedvjdv.exe1lrxfff.exelrllllr.exebtthbn.exenbtnht.exejjpdj.exe1dvdv.exerxxrlxx.exexrllfll.exexllrrlr.exenbbbbb.exepjpvv.exevjdjd.exedpvdd.exerrrrrxr.exe7xllrrr.exehthbbt.exe5nnhhb.exejvdjp.exepjpjp.exefrxxrrx.exe7rlllff.exenhnttt.exepid process 2188 rlxfrrx.exe 2480 1tntnn.exe 2592 dpdjj.exe 2152 rfrrxxf.exe 2624 tnbbtb.exe 2684 dvvpv.exe 2452 xlrrxxf.exe 1232 5xxrxrr.exe 632 bttntn.exe 840 ddpdj.exe 108 jdpdp.exe 2164 xllllrx.exe 2312 nhtbht.exe 1576 1hhnhh.exe 1520 jjddp.exe 2032 dpdjj.exe 2036 frxxxrr.exe 2852 lxxrfxl.exe 2872 1bnttb.exe 1884 nttbtt.exe 2112 9pvvj.exe 692 fxllxxf.exe 1396 rlxlrfl.exe 1732 lxrrfxr.exe 912 nnhnbb.exe 348 ddjjv.exe 580 lxrrxxr.exe 2260 7xrxrrf.exe 1796 3nbbhh.exe 2940 dpdjd.exe 1580 fffxfxl.exe 2768 rlxxflr.exe 1740 htbttn.exe 3048 9ntbbb.exe 2936 9vjdj.exe 2540 jvvdj.exe 2396 frlfxrl.exe 2552 xlrrrlx.exe 2608 bhhbth.exe 2388 htbtbb.exe 2556 tnttnn.exe 2460 dvjdv.exe 2876 1lrxfff.exe 2880 lrllllr.exe 856 btthbn.exe 2652 nbtnht.exe 2204 jjpdj.exe 2316 1dvdv.exe 2648 rxxrlxx.exe 2136 xrllfll.exe 1564 xllrrlr.exe 996 nbbbbb.exe 2028 pjpvv.exe 2024 vjdjd.exe 2752 dpvdd.exe 1684 rrrrrxr.exe 1956 7xllrrr.exe 2484 hthbbt.exe 488 5nnhhb.exe 1412 jvdjp.exe 2492 pjpjp.exe 1172 frxxrrx.exe 1432 7rlllff.exe 3012 nhnttt.exe -
Processes:
resource yara_rule behavioral1/memory/2768-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/108-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/692-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/912-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/348-255-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d4fc4182c3eb642461b64c107ecc3200_NeikiAnalytics.exerlxfrrx.exe1tntnn.exedpdjj.exerfrrxxf.exetnbbtb.exedvvpv.exexlrrxxf.exe5xxrxrr.exebttntn.exeddpdj.exejdpdp.exexllllrx.exenhtbht.exe1hhnhh.exejjddp.exedescription pid process target process PID 2768 wrote to memory of 2188 2768 d4fc4182c3eb642461b64c107ecc3200_NeikiAnalytics.exe rlxfrrx.exe PID 2768 wrote to memory of 2188 2768 d4fc4182c3eb642461b64c107ecc3200_NeikiAnalytics.exe rlxfrrx.exe PID 2768 wrote to memory of 2188 2768 d4fc4182c3eb642461b64c107ecc3200_NeikiAnalytics.exe rlxfrrx.exe PID 2768 wrote to memory of 2188 2768 d4fc4182c3eb642461b64c107ecc3200_NeikiAnalytics.exe rlxfrrx.exe PID 2188 wrote to memory of 2480 2188 rlxfrrx.exe 1tntnn.exe PID 2188 wrote to memory of 2480 2188 rlxfrrx.exe 1tntnn.exe PID 2188 wrote to memory of 2480 2188 rlxfrrx.exe 1tntnn.exe PID 2188 wrote to memory of 2480 2188 rlxfrrx.exe 1tntnn.exe PID 2480 wrote to memory of 2592 2480 1tntnn.exe dpdjj.exe PID 2480 wrote to memory of 2592 2480 1tntnn.exe dpdjj.exe PID 2480 wrote to memory of 2592 2480 1tntnn.exe dpdjj.exe PID 2480 wrote to memory of 2592 2480 1tntnn.exe dpdjj.exe PID 2592 wrote to memory of 2152 2592 dpdjj.exe rfrrxxf.exe PID 2592 wrote to memory of 2152 2592 dpdjj.exe rfrrxxf.exe PID 2592 wrote to memory of 2152 2592 dpdjj.exe rfrrxxf.exe PID 2592 wrote to memory of 2152 2592 dpdjj.exe rfrrxxf.exe PID 2152 wrote to memory of 2624 2152 rfrrxxf.exe tnbbtb.exe PID 2152 wrote to memory of 2624 2152 rfrrxxf.exe tnbbtb.exe PID 2152 wrote to memory of 2624 2152 rfrrxxf.exe tnbbtb.exe PID 2152 wrote to memory of 2624 2152 rfrrxxf.exe tnbbtb.exe PID 2624 wrote to memory of 2684 2624 tnbbtb.exe dvvpv.exe PID 2624 wrote to memory of 2684 2624 tnbbtb.exe dvvpv.exe PID 2624 wrote to memory of 2684 2624 tnbbtb.exe dvvpv.exe PID 2624 wrote to memory of 2684 2624 tnbbtb.exe dvvpv.exe PID 2684 wrote to memory of 2452 2684 dvvpv.exe xlrrxxf.exe PID 2684 wrote to memory of 2452 2684 dvvpv.exe xlrrxxf.exe PID 2684 wrote to memory of 2452 2684 dvvpv.exe xlrrxxf.exe PID 2684 wrote to memory of 2452 2684 dvvpv.exe xlrrxxf.exe PID 2452 wrote to memory of 1232 2452 xlrrxxf.exe 5xxrxrr.exe PID 2452 wrote to memory of 1232 2452 xlrrxxf.exe 5xxrxrr.exe PID 2452 wrote to memory of 1232 2452 xlrrxxf.exe 5xxrxrr.exe PID 2452 wrote to memory of 1232 2452 xlrrxxf.exe 5xxrxrr.exe PID 1232 wrote to memory of 632 1232 5xxrxrr.exe bttntn.exe PID 1232 wrote to memory of 632 1232 5xxrxrr.exe bttntn.exe PID 1232 wrote to memory of 632 1232 5xxrxrr.exe bttntn.exe PID 1232 wrote to memory of 632 1232 5xxrxrr.exe bttntn.exe PID 632 wrote to memory of 840 632 bttntn.exe ddpdj.exe PID 632 wrote to memory of 840 632 bttntn.exe ddpdj.exe PID 632 wrote to memory of 840 632 bttntn.exe ddpdj.exe PID 632 wrote to memory of 840 632 bttntn.exe ddpdj.exe PID 840 wrote to memory of 108 840 ddpdj.exe jdpdp.exe PID 840 wrote to memory of 108 840 ddpdj.exe jdpdp.exe PID 840 wrote to memory of 108 840 ddpdj.exe jdpdp.exe PID 840 wrote to memory of 108 840 ddpdj.exe jdpdp.exe PID 108 wrote to memory of 2164 108 jdpdp.exe xllllrx.exe PID 108 wrote to memory of 2164 108 jdpdp.exe xllllrx.exe PID 108 wrote to memory of 2164 108 jdpdp.exe xllllrx.exe PID 108 wrote to memory of 2164 108 jdpdp.exe xllllrx.exe PID 2164 wrote to memory of 2312 2164 xllllrx.exe nhtbht.exe PID 2164 wrote to memory of 2312 2164 xllllrx.exe nhtbht.exe PID 2164 wrote to memory of 2312 2164 xllllrx.exe nhtbht.exe PID 2164 wrote to memory of 2312 2164 xllllrx.exe nhtbht.exe PID 2312 wrote to memory of 1576 2312 nhtbht.exe 1hhnhh.exe PID 2312 wrote to memory of 1576 2312 nhtbht.exe 1hhnhh.exe PID 2312 wrote to memory of 1576 2312 nhtbht.exe 1hhnhh.exe PID 2312 wrote to memory of 1576 2312 nhtbht.exe 1hhnhh.exe PID 1576 wrote to memory of 1520 1576 1hhnhh.exe jjddp.exe PID 1576 wrote to memory of 1520 1576 1hhnhh.exe jjddp.exe PID 1576 wrote to memory of 1520 1576 1hhnhh.exe jjddp.exe PID 1576 wrote to memory of 1520 1576 1hhnhh.exe jjddp.exe PID 1520 wrote to memory of 2032 1520 jjddp.exe dpdjj.exe PID 1520 wrote to memory of 2032 1520 jjddp.exe dpdjj.exe PID 1520 wrote to memory of 2032 1520 jjddp.exe dpdjj.exe PID 1520 wrote to memory of 2032 1520 jjddp.exe dpdjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4fc4182c3eb642461b64c107ecc3200_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d4fc4182c3eb642461b64c107ecc3200_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\1tntnn.exec:\1tntnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\dpdjj.exec:\dpdjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\tnbbtb.exec:\tnbbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\dvvpv.exec:\dvvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\xlrrxxf.exec:\xlrrxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\5xxrxrr.exec:\5xxrxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\bttntn.exec:\bttntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\ddpdj.exec:\ddpdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\jdpdp.exec:\jdpdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\xllllrx.exec:\xllllrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\nhtbht.exec:\nhtbht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\1hhnhh.exec:\1hhnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\jjddp.exec:\jjddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\dpdjj.exec:\dpdjj.exe17⤵
- Executes dropped EXE
PID:2032 -
\??\c:\frxxxrr.exec:\frxxxrr.exe18⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lxxrfxl.exec:\lxxrfxl.exe19⤵
- Executes dropped EXE
PID:2852 -
\??\c:\1bnttb.exec:\1bnttb.exe20⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nttbtt.exec:\nttbtt.exe21⤵
- Executes dropped EXE
PID:1884 -
\??\c:\9pvvj.exec:\9pvvj.exe22⤵
- Executes dropped EXE
PID:2112 -
\??\c:\fxllxxf.exec:\fxllxxf.exe23⤵
- Executes dropped EXE
PID:692 -
\??\c:\rlxlrfl.exec:\rlxlrfl.exe24⤵
- Executes dropped EXE
PID:1396 -
\??\c:\lxrrfxr.exec:\lxrrfxr.exe25⤵
- Executes dropped EXE
PID:1732 -
\??\c:\nnhnbb.exec:\nnhnbb.exe26⤵
- Executes dropped EXE
PID:912 -
\??\c:\ddjjv.exec:\ddjjv.exe27⤵
- Executes dropped EXE
PID:348 -
\??\c:\lxrrxxr.exec:\lxrrxxr.exe28⤵
- Executes dropped EXE
PID:580 -
\??\c:\7xrxrrf.exec:\7xrxrrf.exe29⤵
- Executes dropped EXE
PID:2260 -
\??\c:\3nbbhh.exec:\3nbbhh.exe30⤵
- Executes dropped EXE
PID:1796 -
\??\c:\dpdjd.exec:\dpdjd.exe31⤵
- Executes dropped EXE
PID:2940 -
\??\c:\fffxfxl.exec:\fffxfxl.exe32⤵
- Executes dropped EXE
PID:1580 -
\??\c:\rlxxflr.exec:\rlxxflr.exe33⤵
- Executes dropped EXE
PID:2768 -
\??\c:\htbttn.exec:\htbttn.exe34⤵
- Executes dropped EXE
PID:1740 -
\??\c:\9ntbbb.exec:\9ntbbb.exe35⤵
- Executes dropped EXE
PID:3048 -
\??\c:\9vjdj.exec:\9vjdj.exe36⤵
- Executes dropped EXE
PID:2936 -
\??\c:\jvvdj.exec:\jvvdj.exe37⤵
- Executes dropped EXE
PID:2540 -
\??\c:\frlfxrl.exec:\frlfxrl.exe38⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xlrrrlx.exec:\xlrrrlx.exe39⤵
- Executes dropped EXE
PID:2552 -
\??\c:\bhhbth.exec:\bhhbth.exe40⤵
- Executes dropped EXE
PID:2608 -
\??\c:\htbtbb.exec:\htbtbb.exe41⤵
- Executes dropped EXE
PID:2388 -
\??\c:\tnttnn.exec:\tnttnn.exe42⤵
- Executes dropped EXE
PID:2556 -
\??\c:\dvjdv.exec:\dvjdv.exe43⤵
- Executes dropped EXE
PID:2460 -
\??\c:\1lrxfff.exec:\1lrxfff.exe44⤵
- Executes dropped EXE
PID:2876 -
\??\c:\lrllllr.exec:\lrllllr.exe45⤵
- Executes dropped EXE
PID:2880 -
\??\c:\btthbn.exec:\btthbn.exe46⤵
- Executes dropped EXE
PID:856 -
\??\c:\nbtnht.exec:\nbtnht.exe47⤵
- Executes dropped EXE
PID:2652 -
\??\c:\jjpdj.exec:\jjpdj.exe48⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1dvdv.exec:\1dvdv.exe49⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rxxrlxx.exec:\rxxrlxx.exe50⤵
- Executes dropped EXE
PID:2648 -
\??\c:\xrllfll.exec:\xrllfll.exe51⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xllrrlr.exec:\xllrrlr.exe52⤵
- Executes dropped EXE
PID:1564 -
\??\c:\nbbbbb.exec:\nbbbbb.exe53⤵
- Executes dropped EXE
PID:996 -
\??\c:\pjpvv.exec:\pjpvv.exe54⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vjdjd.exec:\vjdjd.exe55⤵
- Executes dropped EXE
PID:2024 -
\??\c:\dpvdd.exec:\dpvdd.exe56⤵
- Executes dropped EXE
PID:2752 -
\??\c:\rrrrrxr.exec:\rrrrrxr.exe57⤵
- Executes dropped EXE
PID:1684 -
\??\c:\7xllrrr.exec:\7xllrrr.exe58⤵
- Executes dropped EXE
PID:1956 -
\??\c:\hthbbt.exec:\hthbbt.exe59⤵
- Executes dropped EXE
PID:2484 -
\??\c:\5nnhhb.exec:\5nnhhb.exe60⤵
- Executes dropped EXE
PID:488 -
\??\c:\jvdjp.exec:\jvdjp.exe61⤵
- Executes dropped EXE
PID:1412 -
\??\c:\pjpjp.exec:\pjpjp.exe62⤵
- Executes dropped EXE
PID:2492 -
\??\c:\frxxrrx.exec:\frxxrrx.exe63⤵
- Executes dropped EXE
PID:1172 -
\??\c:\7rlllff.exec:\7rlllff.exe64⤵
- Executes dropped EXE
PID:1432 -
\??\c:\nhnttt.exec:\nhnttt.exe65⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nbbttt.exec:\nbbttt.exe66⤵PID:904
-
\??\c:\vjjpv.exec:\vjjpv.exe67⤵PID:1612
-
\??\c:\vdddd.exec:\vdddd.exe68⤵PID:2232
-
\??\c:\1frllxx.exec:\1frllxx.exe69⤵PID:1196
-
\??\c:\9rrxxfl.exec:\9rrxxfl.exe70⤵PID:2916
-
\??\c:\3hntbb.exec:\3hntbb.exe71⤵PID:992
-
\??\c:\hthbbb.exec:\hthbbb.exe72⤵PID:2784
-
\??\c:\7pddv.exec:\7pddv.exe73⤵PID:620
-
\??\c:\jdpvj.exec:\jdpvj.exe74⤵PID:1636
-
\??\c:\jdjvd.exec:\jdjvd.exe75⤵PID:2252
-
\??\c:\rlxxlxf.exec:\rlxxlxf.exe76⤵PID:2960
-
\??\c:\frrrxlr.exec:\frrrxlr.exe77⤵PID:2604
-
\??\c:\nbtnhh.exec:\nbtnhh.exe78⤵PID:2612
-
\??\c:\bnnnhb.exec:\bnnnhb.exe79⤵PID:2544
-
\??\c:\9tbhhb.exec:\9tbhhb.exe80⤵PID:2416
-
\??\c:\vdjdp.exec:\vdjdp.exe81⤵PID:2720
-
\??\c:\dpvjj.exec:\dpvjj.exe82⤵PID:2384
-
\??\c:\frrlfll.exec:\frrlfll.exe83⤵PID:1348
-
\??\c:\flrrrrr.exec:\flrrrrr.exe84⤵PID:2944
-
\??\c:\tbtnbn.exec:\tbtnbn.exe85⤵PID:2912
-
\??\c:\btthbb.exec:\btthbb.exe86⤵PID:2436
-
\??\c:\jpvdj.exec:\jpvdj.exe87⤵PID:1244
-
\??\c:\pdvpp.exec:\pdvpp.exe88⤵PID:1248
-
\??\c:\1jpjd.exec:\1jpjd.exe89⤵PID:2156
-
\??\c:\lxrrffl.exec:\lxrrffl.exe90⤵PID:1444
-
\??\c:\rlrllfl.exec:\rlrllfl.exe91⤵PID:1236
-
\??\c:\bntntn.exec:\bntntn.exe92⤵PID:764
-
\??\c:\nbhhhh.exec:\nbhhhh.exe93⤵PID:356
-
\??\c:\9jdvv.exec:\9jdvv.exe94⤵PID:2276
-
\??\c:\dpdjd.exec:\dpdjd.exe95⤵PID:996
-
\??\c:\frxfxrr.exec:\frxfxrr.exe96⤵PID:2740
-
\??\c:\5xffllr.exec:\5xffllr.exe97⤵PID:2012
-
\??\c:\5lxrrlr.exec:\5lxrrlr.exe98⤵PID:2852
-
\??\c:\nbnnnt.exec:\nbnnnt.exe99⤵PID:1952
-
\??\c:\9nhhnn.exec:\9nhhnn.exe100⤵PID:268
-
\??\c:\jppjj.exec:\jppjj.exe101⤵PID:792
-
\??\c:\vjppd.exec:\vjppd.exe102⤵PID:600
-
\??\c:\rffffff.exec:\rffffff.exe103⤵PID:612
-
\??\c:\lfffllr.exec:\lfffllr.exe104⤵PID:1780
-
\??\c:\nhtbbb.exec:\nhtbbb.exe105⤵PID:1136
-
\??\c:\tnbbhb.exec:\tnbbhb.exe106⤵PID:1416
-
\??\c:\hbnhnn.exec:\hbnhnn.exe107⤵PID:952
-
\??\c:\jvvvv.exec:\jvvvv.exe108⤵PID:2116
-
\??\c:\ddjvp.exec:\ddjvp.exe109⤵PID:2148
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe110⤵PID:776
-
\??\c:\lfrxfff.exec:\lfrxfff.exe111⤵PID:2264
-
\??\c:\7ntbtb.exec:\7ntbtb.exe112⤵PID:984
-
\??\c:\bnbtbt.exec:\bnbtbt.exe113⤵PID:2816
-
\??\c:\7vvjj.exec:\7vvjj.exe114⤵PID:1920
-
\??\c:\9pdjp.exec:\9pdjp.exe115⤵PID:1848
-
\??\c:\jvddv.exec:\jvddv.exe116⤵PID:1616
-
\??\c:\rflffxf.exec:\rflffxf.exe117⤵PID:2596
-
\??\c:\bttbnb.exec:\bttbnb.exe118⤵PID:2932
-
\??\c:\nbbtnh.exec:\nbbtnh.exe119⤵PID:2592
-
\??\c:\1dddv.exec:\1dddv.exe120⤵PID:2612
-
\??\c:\3vjdv.exec:\3vjdv.exe121⤵PID:2424
-
\??\c:\5dpvv.exec:\5dpvv.exe122⤵PID:2692
-
\??\c:\xlrlllf.exec:\xlrlllf.exe123⤵PID:2720
-
\??\c:\3xrrrlr.exec:\3xrrrlr.exe124⤵PID:2512
-
\??\c:\frllrll.exec:\frllrll.exe125⤵PID:1032
-
\??\c:\nhbbhb.exec:\nhbbhb.exe126⤵PID:2856
-
\??\c:\7pvpj.exec:\7pvpj.exe127⤵PID:1256
-
\??\c:\vjppj.exec:\vjppj.exe128⤵PID:632
-
\??\c:\rlfxflr.exec:\rlfxflr.exe129⤵PID:1344
-
\??\c:\frrrrrr.exec:\frrrrrr.exe130⤵PID:2568
-
\??\c:\hbttnt.exec:\hbttnt.exe131⤵PID:1772
-
\??\c:\bnnhnh.exec:\bnnhnh.exe132⤵PID:320
-
\??\c:\1jvdv.exec:\1jvdv.exe133⤵PID:1236
-
\??\c:\xxlfrlr.exec:\xxlfrlr.exe134⤵PID:2304
-
\??\c:\9xfffxx.exec:\9xfffxx.exe135⤵PID:1448
-
\??\c:\thnhhb.exec:\thnhhb.exe136⤵PID:1180
-
\??\c:\7ntnhb.exec:\7ntnhb.exe137⤵PID:2680
-
\??\c:\vjpjp.exec:\vjpjp.exe138⤵PID:2736
-
\??\c:\rflflfl.exec:\rflflfl.exe139⤵PID:2336
-
\??\c:\xfrxlfl.exec:\xfrxlfl.exe140⤵PID:1908
-
\??\c:\thbnnt.exec:\thbnnt.exe141⤵PID:540
-
\??\c:\5nhbth.exec:\5nhbth.exe142⤵PID:880
-
\??\c:\1dddd.exec:\1dddd.exe143⤵PID:792
-
\??\c:\vjjdv.exec:\vjjdv.exe144⤵PID:1028
-
\??\c:\rfrllfl.exec:\rfrllfl.exe145⤵PID:2340
-
\??\c:\rlrrlff.exec:\rlrrlff.exe146⤵PID:1780
-
\??\c:\tbtttn.exec:\tbtttn.exe147⤵PID:1320
-
\??\c:\nbnnnb.exec:\nbnnnb.exe148⤵PID:1652
-
\??\c:\pdddv.exec:\pdddv.exe149⤵PID:932
-
\??\c:\5dddv.exec:\5dddv.exe150⤵PID:1460
-
\??\c:\lxrxrlf.exec:\lxrxrlf.exe151⤵PID:2260
-
\??\c:\lrrlfrr.exec:\lrrlfrr.exe152⤵PID:1796
-
\??\c:\ntnttn.exec:\ntnttn.exe153⤵PID:892
-
\??\c:\hthhhb.exec:\hthhhb.exe154⤵PID:888
-
\??\c:\vjvdv.exec:\vjvdv.exe155⤵PID:1524
-
\??\c:\dpvpv.exec:\dpvpv.exe156⤵PID:1640
-
\??\c:\1xfxrlf.exec:\1xfxrlf.exe157⤵PID:2188
-
\??\c:\frrrrxl.exec:\frrrrxl.exe158⤵PID:2088
-
\??\c:\nttnnn.exec:\nttnnn.exe159⤵PID:2584
-
\??\c:\3hbttt.exec:\3hbttt.exe160⤵PID:2540
-
\??\c:\9jjdd.exec:\9jjdd.exe161⤵PID:2524
-
\??\c:\vjjvd.exec:\vjjvd.exe162⤵PID:2508
-
\??\c:\fxfxxff.exec:\fxfxxff.exe163⤵PID:2412
-
\??\c:\xlxfffl.exec:\xlxfffl.exe164⤵PID:2420
-
\??\c:\bnbhhh.exec:\bnbhhh.exe165⤵PID:2864
-
\??\c:\7bhbbn.exec:\7bhbbn.exe166⤵PID:2684
-
\??\c:\dvjdj.exec:\dvjdj.exe167⤵PID:1232
-
\??\c:\djjjj.exec:\djjjj.exe168⤵PID:328
-
\??\c:\xxrfffl.exec:\xxrfffl.exe169⤵PID:2668
-
\??\c:\xrxxxxl.exec:\xrxxxxl.exe170⤵PID:632
-
\??\c:\7bhnnh.exec:\7bhnnh.exe171⤵PID:2448
-
\??\c:\ttbhbh.exec:\ttbhbh.exe172⤵PID:1584
-
\??\c:\dpvvd.exec:\dpvvd.exe173⤵PID:1772
-
\??\c:\jppdd.exec:\jppdd.exe174⤵PID:360
-
\??\c:\1dpvp.exec:\1dpvp.exe175⤵PID:1360
-
\??\c:\9fllfxx.exec:\9fllfxx.exe176⤵PID:1576
-
\??\c:\lxrrffr.exec:\lxrrffr.exe177⤵PID:1448
-
\??\c:\tnbbhh.exec:\tnbbhh.exe178⤵PID:2868
-
\??\c:\dpjdj.exec:\dpjdj.exe179⤵PID:2760
-
\??\c:\vjvjj.exec:\vjvjj.exe180⤵PID:2128
-
\??\c:\frxrrrx.exec:\frxrrrx.exe181⤵PID:2052
-
\??\c:\lxfxxfl.exec:\lxfxxfl.exe182⤵PID:2120
-
\??\c:\7flxxfl.exec:\7flxxfl.exe183⤵PID:788
-
\??\c:\7tttbn.exec:\7tttbn.exe184⤵PID:692
-
\??\c:\nhhntn.exec:\nhhntn.exe185⤵PID:2664
-
\??\c:\pddpj.exec:\pddpj.exe186⤵PID:1028
-
\??\c:\vjpvv.exec:\vjpvv.exe187⤵PID:2340
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe188⤵PID:852
-
\??\c:\9frrrll.exec:\9frrrll.exe189⤵PID:2236
-
\??\c:\bnbbhh.exec:\bnbbhh.exe190⤵PID:580
-
\??\c:\9tbttn.exec:\9tbttn.exe191⤵PID:848
-
\??\c:\3vddv.exec:\3vddv.exe192⤵PID:1692
-
\??\c:\jvvpp.exec:\jvvpp.exe193⤵PID:616
-
\??\c:\nbbttn.exec:\nbbttn.exe194⤵PID:2824
-
\??\c:\nhbbtt.exec:\nhbbtt.exe195⤵PID:2784
-
\??\c:\thhhhb.exec:\thhhhb.exe196⤵PID:2288
-
\??\c:\7vdvd.exec:\7vdvd.exe197⤵PID:1588
-
\??\c:\pvjdv.exec:\pvjdv.exe198⤵PID:1640
-
\??\c:\rrflllr.exec:\rrflllr.exe199⤵PID:2220
-
\??\c:\xllrrrl.exec:\xllrrrl.exe200⤵PID:2088
-
\??\c:\9nbbnn.exec:\9nbbnn.exe201⤵PID:2636
-
\??\c:\tntnhb.exec:\tntnhb.exe202⤵PID:2696
-
\??\c:\pddvp.exec:\pddvp.exe203⤵PID:2528
-
\??\c:\vpvdj.exec:\vpvdj.exe204⤵PID:2608
-
\??\c:\frrllfr.exec:\frrllfr.exe205⤵PID:2624
-
\??\c:\xrrxxxx.exec:\xrrxxxx.exe206⤵PID:2408
-
\??\c:\7lxrrrr.exec:\7lxrrrr.exe207⤵PID:1264
-
\??\c:\bnbbbh.exec:\bnbbbh.exe208⤵PID:1060
-
\??\c:\thnhnn.exec:\thnhnn.exe209⤵PID:2436
-
\??\c:\jdppp.exec:\jdppp.exe210⤵PID:2476
-
\??\c:\jvpvv.exec:\jvpvv.exe211⤵PID:1604
-
\??\c:\rlxxxrx.exec:\rlxxxrx.exe212⤵PID:2676
-
\??\c:\5xxfflr.exec:\5xxfflr.exe213⤵PID:1472
-
\??\c:\hhnnnn.exec:\hhnnnn.exe214⤵PID:1016
-
\??\c:\jvdjj.exec:\jvdjj.exe215⤵PID:2280
-
\??\c:\fxfrlxx.exec:\fxfrlxx.exe216⤵PID:356
-
\??\c:\xrrlffl.exec:\xrrlffl.exe217⤵PID:2304
-
\??\c:\9bbtbt.exec:\9bbtbt.exe218⤵PID:812
-
\??\c:\htbbbh.exec:\htbbbh.exe219⤵PID:1928
-
\??\c:\1jvvd.exec:\1jvvd.exe220⤵PID:1968
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe221⤵PID:1896
-
\??\c:\lrffffx.exec:\lrffffx.exe222⤵PID:3024
-
\??\c:\3bnttn.exec:\3bnttn.exe223⤵PID:2484
-
\??\c:\httbbb.exec:\httbbb.exe224⤵PID:2972
-
\??\c:\vpvdj.exec:\vpvdj.exe225⤵PID:680
-
\??\c:\jvvvv.exec:\jvvvv.exe226⤵PID:568
-
\??\c:\pjddd.exec:\pjddd.exe227⤵PID:3008
-
\??\c:\xrfflll.exec:\xrfflll.exe228⤵PID:1128
-
\??\c:\1frffxx.exec:\1frffxx.exe229⤵PID:1416
-
\??\c:\1tbhnn.exec:\1tbhnn.exe230⤵PID:1544
-
\??\c:\thntth.exec:\thntth.exe231⤵PID:1704
-
\??\c:\vpdpp.exec:\vpdpp.exe232⤵PID:580
-
\??\c:\vppjp.exec:\vppjp.exe233⤵PID:776
-
\??\c:\vpddv.exec:\vpddv.exe234⤵PID:1692
-
\??\c:\5xlrxrr.exec:\5xlrxrr.exe235⤵PID:984
-
\??\c:\3fxrxxx.exec:\3fxrxxx.exe236⤵PID:2816
-
\??\c:\nhnttn.exec:\nhnttn.exe237⤵PID:1580
-
\??\c:\5httnn.exec:\5httnn.exe238⤵PID:620
-
\??\c:\jpppd.exec:\jpppd.exe239⤵PID:2712
-
\??\c:\1dpvp.exec:\1dpvp.exe240⤵PID:2480
-
\??\c:\1xlffff.exec:\1xlffff.exe241⤵PID:2548
-
\??\c:\lfflflr.exec:\lfflflr.exe242⤵PID:2792