Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d5a10b61d149715a486ac88ed95683f0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d5a10b61d149715a486ac88ed95683f0_NeikiAnalytics.exe
-
Size
57KB
-
MD5
d5a10b61d149715a486ac88ed95683f0
-
SHA1
d4e9f4b1a4c8a1da55b0ac15dc8deae948ab492f
-
SHA256
dcb6cada3493d7c18a05e16ebde07b7aef003dd27fa7817759ac3c9c7e1e3806
-
SHA512
dd656ee59c3eea62726312be601aae234558540bbc68cd01d4d5d6e72679404c5540090146287ebcb71deb5e8db77c5492111526f4dff5490bcf084f35fc8e34
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuSwFN7:ymb3NkkiQ3mdBjFIvIFN7
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2200-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/852-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1rxrrlx.exexxlxrfl.exejvpdd.exellxflff.exexlxllrx.exenbhhnh.exedpddj.exepjddj.exefxllrxf.exe1bbhth.exehhtthh.exepjvvj.exe5vvvj.exerlfrxff.exe1hhbbb.exehnttbt.exe9pdpp.exe3pjdj.exelfxrrrf.exe7ntbhh.exe9htbhb.exedpvvd.exe5vjdj.exexrxxffl.exeflrrrrf.exehbhnhn.exevjvvj.exe5vjvp.exe1rfxxrx.exebthtbb.exe3tbtbb.exedvjpv.exejvdjj.exe3xrrflr.exe3lfxxxf.exe3bbbnn.exedpppd.exepdppp.exerlxxxxf.exe9lffffl.exexrlllll.exe5bnhtn.exe1pdpv.exedpdpv.exexflfxrr.exelxrxrxx.exerfflxxl.exenbhnth.exehhthhh.exepjdjv.exevjppp.exe1frlfrr.exe1xrxffr.exe5bnbhb.exe5nnbnt.exe9pjjj.exedvjvj.exerflfrlr.exerlflfff.exe9tbbhb.exejjvjd.exe9xffflx.exefrfffxl.exetnttbn.exepid process 2520 1rxrrlx.exe 2968 xxlxrfl.exe 2736 jvpdd.exe 2444 llxflff.exe 2788 xlxllrx.exe 2664 nbhhnh.exe 2492 dpddj.exe 1912 pjddj.exe 2676 fxllrxf.exe 2756 1bbhth.exe 2192 hhtthh.exe 2368 pjvvj.exe 320 5vvvj.exe 1972 rlfrxff.exe 2380 1hhbbb.exe 1028 hnttbt.exe 852 9pdpp.exe 2304 3pjdj.exe 2848 lfxrrrf.exe 1160 7ntbhh.exe 540 9htbhb.exe 812 dpvvd.exe 2984 5vjdj.exe 1924 xrxxffl.exe 2084 flrrrrf.exe 2840 hbhnhn.exe 2372 vjvvj.exe 2280 5vjvp.exe 2168 1rfxxrx.exe 888 bthtbb.exe 3068 3tbtbb.exe 2768 dvjpv.exe 2288 jvdjj.exe 2568 3xrrflr.exe 2824 3lfxxxf.exe 2648 3bbbnn.exe 2816 dpppd.exe 2888 pdppp.exe 2660 rlxxxxf.exe 2436 9lffffl.exe 2664 xrlllll.exe 2916 5bnhtn.exe 1984 1pdpv.exe 2680 dpdpv.exe 2676 xflfxrr.exe 2256 lxrxrxx.exe 1036 rfflxxl.exe 2012 nbhnth.exe 2028 hhthhh.exe 2228 pjdjv.exe 548 vjppp.exe 556 1frlfrr.exe 884 1xrxffr.exe 1644 5bnbhb.exe 2088 5nnbnt.exe 2536 9pjjj.exe 2224 dvjvj.exe 1708 rflfrlr.exe 2308 rlflfff.exe 112 9tbbhb.exe 1508 jjvjd.exe 968 9xffflx.exe 908 frfffxl.exe 1344 tnttbn.exe -
Processes:
resource yara_rule behavioral1/memory/2200-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/852-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-297-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-305-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d5a10b61d149715a486ac88ed95683f0_NeikiAnalytics.exe1rxrrlx.exexxlxrfl.exejvpdd.exellxflff.exexlxllrx.exenbhhnh.exedpddj.exepjddj.exefxllrxf.exe1bbhth.exehhtthh.exepjvvj.exe5vvvj.exerlfrxff.exe1hhbbb.exedescription pid process target process PID 2200 wrote to memory of 2520 2200 d5a10b61d149715a486ac88ed95683f0_NeikiAnalytics.exe 1rxrrlx.exe PID 2200 wrote to memory of 2520 2200 d5a10b61d149715a486ac88ed95683f0_NeikiAnalytics.exe 1rxrrlx.exe PID 2200 wrote to memory of 2520 2200 d5a10b61d149715a486ac88ed95683f0_NeikiAnalytics.exe 1rxrrlx.exe PID 2200 wrote to memory of 2520 2200 d5a10b61d149715a486ac88ed95683f0_NeikiAnalytics.exe 1rxrrlx.exe PID 2520 wrote to memory of 2968 2520 1rxrrlx.exe xxlxrfl.exe PID 2520 wrote to memory of 2968 2520 1rxrrlx.exe xxlxrfl.exe PID 2520 wrote to memory of 2968 2520 1rxrrlx.exe xxlxrfl.exe PID 2520 wrote to memory of 2968 2520 1rxrrlx.exe xxlxrfl.exe PID 2968 wrote to memory of 2736 2968 xxlxrfl.exe jvpdd.exe PID 2968 wrote to memory of 2736 2968 xxlxrfl.exe jvpdd.exe PID 2968 wrote to memory of 2736 2968 xxlxrfl.exe jvpdd.exe PID 2968 wrote to memory of 2736 2968 xxlxrfl.exe jvpdd.exe PID 2736 wrote to memory of 2444 2736 jvpdd.exe llxflff.exe PID 2736 wrote to memory of 2444 2736 jvpdd.exe llxflff.exe PID 2736 wrote to memory of 2444 2736 jvpdd.exe llxflff.exe PID 2736 wrote to memory of 2444 2736 jvpdd.exe llxflff.exe PID 2444 wrote to memory of 2788 2444 llxflff.exe xlxllrx.exe PID 2444 wrote to memory of 2788 2444 llxflff.exe xlxllrx.exe PID 2444 wrote to memory of 2788 2444 llxflff.exe xlxllrx.exe PID 2444 wrote to memory of 2788 2444 llxflff.exe xlxllrx.exe PID 2788 wrote to memory of 2664 2788 xlxllrx.exe nbhhnh.exe PID 2788 wrote to memory of 2664 2788 xlxllrx.exe nbhhnh.exe PID 2788 wrote to memory of 2664 2788 xlxllrx.exe nbhhnh.exe PID 2788 wrote to memory of 2664 2788 xlxllrx.exe nbhhnh.exe PID 2664 wrote to memory of 2492 2664 nbhhnh.exe dpddj.exe PID 2664 wrote to memory of 2492 2664 nbhhnh.exe dpddj.exe PID 2664 wrote to memory of 2492 2664 nbhhnh.exe dpddj.exe PID 2664 wrote to memory of 2492 2664 nbhhnh.exe dpddj.exe PID 2492 wrote to memory of 1912 2492 dpddj.exe pjddj.exe PID 2492 wrote to memory of 1912 2492 dpddj.exe pjddj.exe PID 2492 wrote to memory of 1912 2492 dpddj.exe pjddj.exe PID 2492 wrote to memory of 1912 2492 dpddj.exe pjddj.exe PID 1912 wrote to memory of 2676 1912 pjddj.exe fxllrxf.exe PID 1912 wrote to memory of 2676 1912 pjddj.exe fxllrxf.exe PID 1912 wrote to memory of 2676 1912 pjddj.exe fxllrxf.exe PID 1912 wrote to memory of 2676 1912 pjddj.exe fxllrxf.exe PID 2676 wrote to memory of 2756 2676 fxllrxf.exe 1bbhth.exe PID 2676 wrote to memory of 2756 2676 fxllrxf.exe 1bbhth.exe PID 2676 wrote to memory of 2756 2676 fxllrxf.exe 1bbhth.exe PID 2676 wrote to memory of 2756 2676 fxllrxf.exe 1bbhth.exe PID 2756 wrote to memory of 2192 2756 1bbhth.exe hhtthh.exe PID 2756 wrote to memory of 2192 2756 1bbhth.exe hhtthh.exe PID 2756 wrote to memory of 2192 2756 1bbhth.exe hhtthh.exe PID 2756 wrote to memory of 2192 2756 1bbhth.exe hhtthh.exe PID 2192 wrote to memory of 2368 2192 hhtthh.exe pjvvj.exe PID 2192 wrote to memory of 2368 2192 hhtthh.exe pjvvj.exe PID 2192 wrote to memory of 2368 2192 hhtthh.exe pjvvj.exe PID 2192 wrote to memory of 2368 2192 hhtthh.exe pjvvj.exe PID 2368 wrote to memory of 320 2368 pjvvj.exe 5vvvj.exe PID 2368 wrote to memory of 320 2368 pjvvj.exe 5vvvj.exe PID 2368 wrote to memory of 320 2368 pjvvj.exe 5vvvj.exe PID 2368 wrote to memory of 320 2368 pjvvj.exe 5vvvj.exe PID 320 wrote to memory of 1972 320 5vvvj.exe rlfrxff.exe PID 320 wrote to memory of 1972 320 5vvvj.exe rlfrxff.exe PID 320 wrote to memory of 1972 320 5vvvj.exe rlfrxff.exe PID 320 wrote to memory of 1972 320 5vvvj.exe rlfrxff.exe PID 1972 wrote to memory of 2380 1972 rlfrxff.exe 1hhbbb.exe PID 1972 wrote to memory of 2380 1972 rlfrxff.exe 1hhbbb.exe PID 1972 wrote to memory of 2380 1972 rlfrxff.exe 1hhbbb.exe PID 1972 wrote to memory of 2380 1972 rlfrxff.exe 1hhbbb.exe PID 2380 wrote to memory of 1028 2380 1hhbbb.exe hnttbt.exe PID 2380 wrote to memory of 1028 2380 1hhbbb.exe hnttbt.exe PID 2380 wrote to memory of 1028 2380 1hhbbb.exe hnttbt.exe PID 2380 wrote to memory of 1028 2380 1hhbbb.exe hnttbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5a10b61d149715a486ac88ed95683f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d5a10b61d149715a486ac88ed95683f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\1rxrrlx.exec:\1rxrrlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\xxlxrfl.exec:\xxlxrfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\jvpdd.exec:\jvpdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\llxflff.exec:\llxflff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\xlxllrx.exec:\xlxllrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\nbhhnh.exec:\nbhhnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\dpddj.exec:\dpddj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\pjddj.exec:\pjddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\fxllrxf.exec:\fxllrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\1bbhth.exec:\1bbhth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\hhtthh.exec:\hhtthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\pjvvj.exec:\pjvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\5vvvj.exec:\5vvvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\rlfrxff.exec:\rlfrxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\1hhbbb.exec:\1hhbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\hnttbt.exec:\hnttbt.exe17⤵
- Executes dropped EXE
PID:1028 -
\??\c:\9pdpp.exec:\9pdpp.exe18⤵
- Executes dropped EXE
PID:852 -
\??\c:\3pjdj.exec:\3pjdj.exe19⤵
- Executes dropped EXE
PID:2304 -
\??\c:\lfxrrrf.exec:\lfxrrrf.exe20⤵
- Executes dropped EXE
PID:2848 -
\??\c:\7ntbhh.exec:\7ntbhh.exe21⤵
- Executes dropped EXE
PID:1160 -
\??\c:\9htbhb.exec:\9htbhb.exe22⤵
- Executes dropped EXE
PID:540 -
\??\c:\dpvvd.exec:\dpvvd.exe23⤵
- Executes dropped EXE
PID:812 -
\??\c:\5vjdj.exec:\5vjdj.exe24⤵
- Executes dropped EXE
PID:2984 -
\??\c:\xrxxffl.exec:\xrxxffl.exe25⤵
- Executes dropped EXE
PID:1924 -
\??\c:\flrrrrf.exec:\flrrrrf.exe26⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hbhnhn.exec:\hbhnhn.exe27⤵
- Executes dropped EXE
PID:2840 -
\??\c:\vjvvj.exec:\vjvvj.exe28⤵
- Executes dropped EXE
PID:2372 -
\??\c:\5vjvp.exec:\5vjvp.exe29⤵
- Executes dropped EXE
PID:2280 -
\??\c:\1rfxxrx.exec:\1rfxxrx.exe30⤵
- Executes dropped EXE
PID:2168 -
\??\c:\bthtbb.exec:\bthtbb.exe31⤵
- Executes dropped EXE
PID:888 -
\??\c:\3tbtbb.exec:\3tbtbb.exe32⤵
- Executes dropped EXE
PID:3068 -
\??\c:\dvjpv.exec:\dvjpv.exe33⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jvdjj.exec:\jvdjj.exe34⤵
- Executes dropped EXE
PID:2288 -
\??\c:\3xrrflr.exec:\3xrrflr.exe35⤵
- Executes dropped EXE
PID:2568 -
\??\c:\3lfxxxf.exec:\3lfxxxf.exe36⤵
- Executes dropped EXE
PID:2824 -
\??\c:\3bbbnn.exec:\3bbbnn.exe37⤵
- Executes dropped EXE
PID:2648 -
\??\c:\dpppd.exec:\dpppd.exe38⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pdppp.exec:\pdppp.exe39⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe40⤵
- Executes dropped EXE
PID:2660 -
\??\c:\9lffffl.exec:\9lffffl.exe41⤵
- Executes dropped EXE
PID:2436 -
\??\c:\xrlllll.exec:\xrlllll.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\5bnhtn.exec:\5bnhtn.exe43⤵
- Executes dropped EXE
PID:2916 -
\??\c:\1pdpv.exec:\1pdpv.exe44⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dpdpv.exec:\dpdpv.exe45⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xflfxrr.exec:\xflfxrr.exe46⤵
- Executes dropped EXE
PID:2676 -
\??\c:\lxrxrxx.exec:\lxrxrxx.exe47⤵
- Executes dropped EXE
PID:2256 -
\??\c:\rfflxxl.exec:\rfflxxl.exe48⤵
- Executes dropped EXE
PID:1036 -
\??\c:\nbhnth.exec:\nbhnth.exe49⤵
- Executes dropped EXE
PID:2012 -
\??\c:\hhthhh.exec:\hhthhh.exe50⤵
- Executes dropped EXE
PID:2028 -
\??\c:\pjdjv.exec:\pjdjv.exe51⤵
- Executes dropped EXE
PID:2228 -
\??\c:\vjppp.exec:\vjppp.exe52⤵
- Executes dropped EXE
PID:548 -
\??\c:\1frlfrr.exec:\1frlfrr.exe53⤵
- Executes dropped EXE
PID:556 -
\??\c:\1xrxffr.exec:\1xrxffr.exe54⤵
- Executes dropped EXE
PID:884 -
\??\c:\5bnbhb.exec:\5bnbhb.exe55⤵
- Executes dropped EXE
PID:1644 -
\??\c:\5nnbnt.exec:\5nnbnt.exe56⤵
- Executes dropped EXE
PID:2088 -
\??\c:\9pjjj.exec:\9pjjj.exe57⤵
- Executes dropped EXE
PID:2536 -
\??\c:\dvjvj.exec:\dvjvj.exe58⤵
- Executes dropped EXE
PID:2224 -
\??\c:\rflfrlr.exec:\rflfrlr.exe59⤵
- Executes dropped EXE
PID:1708 -
\??\c:\rlflfff.exec:\rlflfff.exe60⤵
- Executes dropped EXE
PID:2308 -
\??\c:\9tbbhb.exec:\9tbbhb.exe61⤵
- Executes dropped EXE
PID:112 -
\??\c:\jjvjd.exec:\jjvjd.exe62⤵
- Executes dropped EXE
PID:1508 -
\??\c:\9xffflx.exec:\9xffflx.exe63⤵
- Executes dropped EXE
PID:968 -
\??\c:\frfffxl.exec:\frfffxl.exe64⤵
- Executes dropped EXE
PID:908 -
\??\c:\tnttbn.exec:\tnttbn.exe65⤵
- Executes dropped EXE
PID:1344 -
\??\c:\tnbnth.exec:\tnbnth.exe66⤵PID:912
-
\??\c:\jdjpd.exec:\jdjpd.exe67⤵PID:960
-
\??\c:\3vdpv.exec:\3vdpv.exe68⤵PID:2172
-
\??\c:\xflrflx.exec:\xflrflx.exe69⤵PID:3024
-
\??\c:\rlfflfl.exec:\rlfflfl.exe70⤵PID:1252
-
\??\c:\nbhhnn.exec:\nbhhnn.exe71⤵PID:2144
-
\??\c:\9bthtt.exec:\9bthtt.exe72⤵PID:876
-
\??\c:\pjpjv.exec:\pjpjv.exe73⤵PID:1304
-
\??\c:\jvppv.exec:\jvppv.exe74⤵PID:1600
-
\??\c:\lxlrrrx.exec:\lxlrrrx.exe75⤵PID:1728
-
\??\c:\5tnntn.exec:\5tnntn.exe76⤵PID:2532
-
\??\c:\7bhnnt.exec:\7bhnnt.exe77⤵PID:2264
-
\??\c:\bntbnb.exec:\bntbnb.exe78⤵PID:2548
-
\??\c:\dvjjp.exec:\dvjjp.exe79⤵PID:2564
-
\??\c:\pddvd.exec:\pddvd.exe80⤵PID:2816
-
\??\c:\lxlrfrx.exec:\lxlrfrx.exe81⤵PID:2616
-
\??\c:\frxfxfl.exec:\frxfxfl.exe82⤵PID:2452
-
\??\c:\tnbhbb.exec:\tnbhbb.exe83⤵PID:2512
-
\??\c:\thnnhh.exec:\thnnhh.exe84⤵PID:2484
-
\??\c:\5jpjp.exec:\5jpjp.exe85⤵PID:2700
-
\??\c:\3vdpp.exec:\3vdpp.exe86⤵PID:1840
-
\??\c:\flllrrx.exec:\flllrrx.exe87⤵PID:2688
-
\??\c:\nhbthn.exec:\nhbthn.exe88⤵PID:1948
-
\??\c:\tnhhnn.exec:\tnhhnn.exe89⤵PID:2332
-
\??\c:\pdppp.exec:\pdppp.exe90⤵PID:1036
-
\??\c:\1pddj.exec:\1pddj.exe91⤵PID:1032
-
\??\c:\rlffflx.exec:\rlffflx.exe92⤵PID:1888
-
\??\c:\rllrffl.exec:\rllrffl.exe93⤵PID:1220
-
\??\c:\hbbbnn.exec:\hbbbnn.exe94⤵PID:2380
-
\??\c:\bntttn.exec:\bntttn.exe95⤵PID:2360
-
\??\c:\pjdjp.exec:\pjdjp.exe96⤵PID:308
-
\??\c:\vjppd.exec:\vjppd.exe97⤵PID:2324
-
\??\c:\lfrrflr.exec:\lfrrflr.exe98⤵PID:1164
-
\??\c:\9rflxxr.exec:\9rflxxr.exe99⤵PID:2796
-
\??\c:\hbtbhn.exec:\hbtbhn.exe100⤵PID:608
-
\??\c:\1tntnn.exec:\1tntnn.exe101⤵PID:540
-
\??\c:\jdppd.exec:\jdppd.exe102⤵PID:2308
-
\??\c:\vpjjv.exec:\vpjjv.exe103⤵PID:2792
-
\??\c:\rfrxrxl.exec:\rfrxrxl.exe104⤵PID:1828
-
\??\c:\5lffffl.exec:\5lffffl.exe105⤵PID:412
-
\??\c:\bnthnt.exec:\bnthnt.exe106⤵PID:908
-
\??\c:\9jppp.exec:\9jppp.exe107⤵PID:280
-
\??\c:\ppjpj.exec:\ppjpj.exe108⤵PID:2164
-
\??\c:\5rllflr.exec:\5rllflr.exe109⤵PID:2000
-
\??\c:\rrxlxff.exec:\rrxlxff.exe110⤵PID:2280
-
\??\c:\9htthh.exec:\9htthh.exe111⤵PID:2340
-
\??\c:\btnhnn.exec:\btnhnn.exe112⤵PID:2064
-
\??\c:\pjvvj.exec:\pjvvj.exe113⤵PID:2176
-
\??\c:\vpdjj.exec:\vpdjj.exe114⤵PID:876
-
\??\c:\rlrfffl.exec:\rlrfffl.exe115⤵PID:2056
-
\??\c:\rflfrrx.exec:\rflfrrx.exe116⤵PID:2068
-
\??\c:\nthnhb.exec:\nthnhb.exe117⤵PID:2592
-
\??\c:\tnhhbb.exec:\tnhhbb.exe118⤵PID:2652
-
\??\c:\ppvpp.exec:\ppvpp.exe119⤵PID:2728
-
\??\c:\jdpdd.exec:\jdpdd.exe120⤵PID:2556
-
\??\c:\xfflxxx.exec:\xfflxxx.exe121⤵PID:2552
-
\??\c:\lxllxfl.exec:\lxllxfl.exe122⤵PID:2816
-
\??\c:\hhttnb.exec:\hhttnb.exe123⤵PID:2560
-
\??\c:\btthtb.exec:\btthtb.exe124⤵PID:2220
-
\??\c:\1vppp.exec:\1vppp.exe125⤵PID:2948
-
\??\c:\jvvvj.exec:\jvvvj.exe126⤵PID:1984
-
\??\c:\rlxrxrr.exec:\rlxrxrr.exe127⤵PID:2528
-
\??\c:\lxrlflf.exec:\lxrlflf.exe128⤵PID:2704
-
\??\c:\9bthhb.exec:\9bthhb.exe129⤵PID:2908
-
\??\c:\tnthnt.exec:\tnthnt.exe130⤵PID:1988
-
\??\c:\nhtbtb.exec:\nhtbtb.exe131⤵PID:2040
-
\??\c:\jjvdd.exec:\jjvdd.exe132⤵PID:1036
-
\??\c:\pvvvd.exec:\pvvvd.exe133⤵PID:1900
-
\??\c:\xlllflx.exec:\xlllflx.exe134⤵PID:1604
-
\??\c:\7fxxflr.exec:\7fxxflr.exe135⤵PID:1444
-
\??\c:\hntbhn.exec:\hntbhn.exe136⤵PID:2380
-
\??\c:\nhnnbb.exec:\nhnnbb.exe137⤵PID:1660
-
\??\c:\djjdj.exec:\djjdj.exe138⤵PID:2624
-
\??\c:\pjppv.exec:\pjppv.exe139⤵PID:2832
-
\??\c:\fxrxflr.exec:\fxrxflr.exe140⤵PID:1880
-
\??\c:\frxrxxx.exec:\frxrxxx.exe141⤵PID:600
-
\??\c:\fxrfllr.exec:\fxrfllr.exe142⤵PID:608
-
\??\c:\7thhbh.exec:\7thhbh.exe143⤵PID:1500
-
\??\c:\btnnbt.exec:\btnnbt.exe144⤵PID:2784
-
\??\c:\9vjjj.exec:\9vjjj.exe145⤵PID:2984
-
\??\c:\dpdpp.exec:\dpdpp.exe146⤵PID:1096
-
\??\c:\rlflrxl.exec:\rlflrxl.exe147⤵PID:1376
-
\??\c:\xlxxffr.exec:\xlxxffr.exe148⤵PID:892
-
\??\c:\7bttbh.exec:\7bttbh.exe149⤵PID:572
-
\??\c:\jvjdd.exec:\jvjdd.exe150⤵PID:2172
-
\??\c:\3pdjp.exec:\3pdjp.exe151⤵PID:1204
-
\??\c:\frlllrf.exec:\frlllrf.exe152⤵PID:2204
-
\??\c:\7xllrlr.exec:\7xllrlr.exe153⤵PID:1968
-
\??\c:\nbhnbb.exec:\nbhnbb.exe154⤵PID:1628
-
\??\c:\nhtbhh.exec:\nhtbhh.exe155⤵PID:2176
-
\??\c:\1dppp.exec:\1dppp.exe156⤵PID:876
-
\??\c:\jvdvp.exec:\jvdvp.exe157⤵PID:2344
-
\??\c:\lfxxrxl.exec:\lfxxrxl.exe158⤵PID:836
-
\??\c:\lfllxxl.exec:\lfllxxl.exe159⤵PID:2724
-
\??\c:\rfrxxff.exec:\rfrxxff.exe160⤵PID:2548
-
\??\c:\nbnntn.exec:\nbnntn.exe161⤵PID:2760
-
\??\c:\bthnhb.exec:\bthnhb.exe162⤵PID:2888
-
\??\c:\pjvdd.exec:\pjvdd.exe163⤵PID:2788
-
\??\c:\vdjvp.exec:\vdjvp.exe164⤵PID:2456
-
\??\c:\rfrlrrx.exec:\rfrlrrx.exe165⤵PID:2920
-
\??\c:\fllrflx.exec:\fllrflx.exe166⤵PID:2916
-
\??\c:\9hbnhh.exec:\9hbnhh.exe167⤵PID:2024
-
\??\c:\dvpdj.exec:\dvpdj.exe168⤵PID:2752
-
\??\c:\pjppd.exec:\pjppd.exe169⤵PID:896
-
\??\c:\xfxrxrx.exec:\xfxrxrx.exe170⤵PID:2020
-
\??\c:\3xrllfr.exec:\3xrllfr.exe171⤵PID:472
-
\??\c:\tnbbhh.exec:\tnbbhh.exe172⤵PID:1680
-
\??\c:\nhthht.exec:\nhthht.exe173⤵PID:2028
-
\??\c:\ddjvv.exec:\ddjvv.exe174⤵PID:780
-
\??\c:\3dddj.exec:\3dddj.exe175⤵PID:1972
-
\??\c:\7flrlrl.exec:\7flrlrl.exe176⤵PID:1704
-
\??\c:\1btnbb.exec:\1btnbb.exe177⤵PID:884
-
\??\c:\nhtbnt.exec:\nhtbnt.exe178⤵PID:2380
-
\??\c:\vpdvj.exec:\vpdvj.exe179⤵PID:2960
-
\??\c:\jjdjp.exec:\jjdjp.exe180⤵PID:2848
-
\??\c:\xlxffxf.exec:\xlxffxf.exe181⤵PID:592
-
\??\c:\1frxxfl.exec:\1frxxfl.exe182⤵PID:2296
-
\??\c:\nhtntt.exec:\nhtntt.exe183⤵PID:688
-
\??\c:\vpvjj.exec:\vpvjj.exe184⤵PID:608
-
\??\c:\jvjjp.exec:\jvjjp.exe185⤵PID:1772
-
\??\c:\pjvpp.exec:\pjvpp.exe186⤵PID:1924
-
\??\c:\frrxrlx.exec:\frrxrlx.exe187⤵PID:2984
-
\??\c:\htbhhn.exec:\htbhhn.exe188⤵PID:1344
-
\??\c:\hbnnnn.exec:\hbnnnn.exe189⤵PID:2260
-
\??\c:\bbnnbh.exec:\bbnnbh.exe190⤵PID:1776
-
\??\c:\djjvd.exec:\djjvd.exe191⤵PID:2112
-
\??\c:\vpvvj.exec:\vpvvj.exe192⤵PID:848
-
\??\c:\xrxrxxl.exec:\xrxrxxl.exe193⤵PID:624
-
\??\c:\xrxxrrx.exec:\xrxxrrx.exe194⤵PID:2204
-
\??\c:\nhttnh.exec:\nhttnh.exe195⤵PID:2972
-
\??\c:\bbnhtt.exec:\bbnhtt.exe196⤵PID:2768
-
\??\c:\pvjjp.exec:\pvjjp.exe197⤵PID:1600
-
\??\c:\1vjjp.exec:\1vjjp.exe198⤵PID:2288
-
\??\c:\lxllxxf.exec:\lxllxxf.exe199⤵PID:2584
-
\??\c:\5fflxfx.exec:\5fflxfx.exe200⤵PID:2716
-
\??\c:\hbnntt.exec:\hbnntt.exe201⤵PID:1584
-
\??\c:\dvvjd.exec:\dvvjd.exe202⤵PID:2464
-
\??\c:\ddvjd.exec:\ddvjd.exe203⤵PID:2576
-
\??\c:\rlrrflf.exec:\rlrrflf.exe204⤵PID:2616
-
\??\c:\nthhhn.exec:\nthhhn.exe205⤵PID:2452
-
\??\c:\jjpvj.exec:\jjpvj.exe206⤵PID:2456
-
\??\c:\lfxlxll.exec:\lfxlxll.exe207⤵PID:2684
-
\??\c:\lfrxxxf.exec:\lfrxxxf.exe208⤵PID:2492
-
\??\c:\tnthhn.exec:\tnthhn.exe209⤵PID:2676
-
\??\c:\tttttb.exec:\tttttb.exe210⤵PID:2776
-
\??\c:\vvvjp.exec:\vvvjp.exe211⤵PID:1948
-
\??\c:\pddjp.exec:\pddjp.exe212⤵PID:1832
-
\??\c:\dvpjd.exec:\dvpjd.exe213⤵PID:2476
-
\??\c:\9lflxxl.exec:\9lflxxl.exe214⤵PID:2352
-
\??\c:\rlflxfl.exec:\rlflxfl.exe215⤵PID:1060
-
\??\c:\thnnbt.exec:\thnnbt.exe216⤵PID:1256
-
\??\c:\btbbnt.exec:\btbbnt.exe217⤵PID:2364
-
\??\c:\vjjjp.exec:\vjjjp.exe218⤵PID:1656
-
\??\c:\dvppv.exec:\dvppv.exe219⤵PID:2320
-
\??\c:\xxfrxxx.exec:\xxfrxxx.exe220⤵PID:2324
-
\??\c:\lfxfxrx.exec:\lfxfxrx.exe221⤵PID:2224
-
\??\c:\tntbnh.exec:\tntbnh.exe222⤵PID:1880
-
\??\c:\btbhtb.exec:\btbhtb.exe223⤵PID:1336
-
\??\c:\pdddj.exec:\pdddj.exe224⤵PID:1332
-
\??\c:\vpvvv.exec:\vpvvv.exe225⤵PID:1116
-
\??\c:\lxlflxl.exec:\lxlflxl.exe226⤵PID:240
-
\??\c:\9lflrrx.exec:\9lflrrx.exe227⤵PID:452
-
\??\c:\7btnbb.exec:\7btnbb.exe228⤵PID:2976
-
\??\c:\bhhtth.exec:\bhhtth.exe229⤵PID:912
-
\??\c:\9dppp.exec:\9dppp.exe230⤵PID:2268
-
\??\c:\5vpdj.exec:\5vpdj.exe231⤵PID:704
-
\??\c:\xfllrxf.exec:\xfllrxf.exe232⤵PID:1776
-
\??\c:\rllrffr.exec:\rllrffr.exe233⤵PID:1528
-
\??\c:\hbhntb.exec:\hbhntb.exe234⤵PID:2280
-
\??\c:\bnbtbb.exec:\bnbtbb.exe235⤵PID:2064
-
\??\c:\bnbbhh.exec:\bnbbhh.exe236⤵PID:2200
-
\??\c:\dpddj.exec:\dpddj.exe237⤵PID:2544
-
\??\c:\7ppdp.exec:\7ppdp.exe238⤵PID:2640
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe239⤵PID:2804
-
\??\c:\fxfllll.exec:\fxfllll.exe240⤵PID:3040
-
\??\c:\hbthnt.exec:\hbthnt.exe241⤵PID:2820
-
\??\c:\hbhnnt.exec:\hbhnnt.exe242⤵PID:2648