Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d5a10b61d149715a486ac88ed95683f0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d5a10b61d149715a486ac88ed95683f0_NeikiAnalytics.exe
-
Size
57KB
-
MD5
d5a10b61d149715a486ac88ed95683f0
-
SHA1
d4e9f4b1a4c8a1da55b0ac15dc8deae948ab492f
-
SHA256
dcb6cada3493d7c18a05e16ebde07b7aef003dd27fa7817759ac3c9c7e1e3806
-
SHA512
dd656ee59c3eea62726312be601aae234558540bbc68cd01d4d5d6e72679404c5540090146287ebcb71deb5e8db77c5492111526f4dff5490bcf084f35fc8e34
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuSwFN7:ymb3NkkiQ3mdBjFIvIFN7
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/2280-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/656-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1596-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3148-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dvddv.exexrxrlll.exelxxfxxl.exethtnbt.exedjjvj.exexfxlxrl.exe9rlfrlf.exebbtnhh.exevdjdv.exexllfrrf.exebtbbnh.exebtnhbb.exedvjdv.exexrfrrrx.exenbtnbh.exetbtntt.exevvvvj.exeflllrlf.exexlrffxf.exehhhbhh.exethhbtn.exejdvjv.exelrrlxxr.exellrlxrl.exe1thhbb.exejjdvp.exe9vpdp.exexflrfxr.exebhbbth.exethhtbt.exevjddp.exellfxxfl.exebnhbnh.exepdjvp.exe5dvpv.exerfrfrlf.exetttnbt.exehnbbnn.exevpdvj.exe7ddvp.exerxxlxrl.exehbnhtn.exe5tthtn.exepvpjj.exeppjvj.exefxrlxrl.exe5hhbnh.exebnnbtn.exedjjvp.exejpjvj.exe7rxlxrl.exelrfrlfr.exehtnhbb.exehtnhtt.exe1ddpv.exevppdv.exexllfrlf.exe9rlfrfx.exenttnhh.exe3bbhbt.exedjpjd.exexxlfxrl.exe9rxrfxr.exebhnbnh.exepid process 3384 dvddv.exe 4472 xrxrlll.exe 1888 lxxfxxl.exe 2444 thtnbt.exe 656 djjvj.exe 1596 xfxlxrl.exe 1272 9rlfrlf.exe 2820 bbtnhh.exe 2424 vdjdv.exe 2816 xllfrrf.exe 2656 btbbnh.exe 2296 btnhbb.exe 4640 dvjdv.exe 3240 xrfrrrx.exe 3884 nbtnbh.exe 4416 tbtntt.exe 3148 vvvvj.exe 3952 flllrlf.exe 1188 xlrffxf.exe 2752 hhhbhh.exe 2612 thhbtn.exe 548 jdvjv.exe 2288 lrrlxxr.exe 4912 llrlxrl.exe 2464 1thhbb.exe 3484 jjdvp.exe 316 9vpdp.exe 448 xflrfxr.exe 528 bhbbth.exe 4248 thhtbt.exe 4072 vjddp.exe 3364 llfxxfl.exe 4352 bnhbnh.exe 4904 pdjvp.exe 2420 5dvpv.exe 2456 rfrfrlf.exe 2900 tttnbt.exe 3488 hnbbnn.exe 4408 vpdvj.exe 3436 7ddvp.exe 4648 rxxlxrl.exe 4472 hbnhtn.exe 2032 5tthtn.exe 4832 pvpjj.exe 1800 ppjvj.exe 1000 fxrlxrl.exe 1852 5hhbnh.exe 1580 bnnbtn.exe 2308 djjvp.exe 3392 jpjvj.exe 2960 7rxlxrl.exe 5084 lrfrlfr.exe 2832 htnhbb.exe 4876 htnhtt.exe 808 1ddpv.exe 1356 vppdv.exe 1488 xllfrlf.exe 3172 9rlfrfx.exe 3128 nttnhh.exe 3148 3bbhbt.exe 4456 djpjd.exe 2668 xxlfxrl.exe 896 9rxrfxr.exe 2228 bhnbnh.exe -
Processes:
resource yara_rule behavioral2/memory/2280-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/656-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1596-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3884-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d5a10b61d149715a486ac88ed95683f0_NeikiAnalytics.exedvddv.exexrxrlll.exelxxfxxl.exethtnbt.exedjjvj.exexfxlxrl.exe9rlfrlf.exebbtnhh.exevdjdv.exexllfrrf.exebtbbnh.exebtnhbb.exedvjdv.exexrfrrrx.exenbtnbh.exetbtntt.exevvvvj.exeflllrlf.exexlrffxf.exehhhbhh.exethhbtn.exedescription pid process target process PID 2280 wrote to memory of 3384 2280 d5a10b61d149715a486ac88ed95683f0_NeikiAnalytics.exe dvddv.exe PID 2280 wrote to memory of 3384 2280 d5a10b61d149715a486ac88ed95683f0_NeikiAnalytics.exe dvddv.exe PID 2280 wrote to memory of 3384 2280 d5a10b61d149715a486ac88ed95683f0_NeikiAnalytics.exe dvddv.exe PID 3384 wrote to memory of 4472 3384 dvddv.exe xrxrlll.exe PID 3384 wrote to memory of 4472 3384 dvddv.exe xrxrlll.exe PID 3384 wrote to memory of 4472 3384 dvddv.exe xrxrlll.exe PID 4472 wrote to memory of 1888 4472 xrxrlll.exe lxxfxxl.exe PID 4472 wrote to memory of 1888 4472 xrxrlll.exe lxxfxxl.exe PID 4472 wrote to memory of 1888 4472 xrxrlll.exe lxxfxxl.exe PID 1888 wrote to memory of 2444 1888 lxxfxxl.exe thtnbt.exe PID 1888 wrote to memory of 2444 1888 lxxfxxl.exe thtnbt.exe PID 1888 wrote to memory of 2444 1888 lxxfxxl.exe thtnbt.exe PID 2444 wrote to memory of 656 2444 thtnbt.exe djjvj.exe PID 2444 wrote to memory of 656 2444 thtnbt.exe djjvj.exe PID 2444 wrote to memory of 656 2444 thtnbt.exe djjvj.exe PID 656 wrote to memory of 1596 656 djjvj.exe xfxlxrl.exe PID 656 wrote to memory of 1596 656 djjvj.exe xfxlxrl.exe PID 656 wrote to memory of 1596 656 djjvj.exe xfxlxrl.exe PID 1596 wrote to memory of 1272 1596 xfxlxrl.exe 9rlfrlf.exe PID 1596 wrote to memory of 1272 1596 xfxlxrl.exe 9rlfrlf.exe PID 1596 wrote to memory of 1272 1596 xfxlxrl.exe 9rlfrlf.exe PID 1272 wrote to memory of 2820 1272 9rlfrlf.exe bbtnhh.exe PID 1272 wrote to memory of 2820 1272 9rlfrlf.exe bbtnhh.exe PID 1272 wrote to memory of 2820 1272 9rlfrlf.exe bbtnhh.exe PID 2820 wrote to memory of 2424 2820 bbtnhh.exe vdjdv.exe PID 2820 wrote to memory of 2424 2820 bbtnhh.exe vdjdv.exe PID 2820 wrote to memory of 2424 2820 bbtnhh.exe vdjdv.exe PID 2424 wrote to memory of 2816 2424 vdjdv.exe xllfrrf.exe PID 2424 wrote to memory of 2816 2424 vdjdv.exe xllfrrf.exe PID 2424 wrote to memory of 2816 2424 vdjdv.exe xllfrrf.exe PID 2816 wrote to memory of 2656 2816 xllfrrf.exe btbbnh.exe PID 2816 wrote to memory of 2656 2816 xllfrrf.exe btbbnh.exe PID 2816 wrote to memory of 2656 2816 xllfrrf.exe btbbnh.exe PID 2656 wrote to memory of 2296 2656 btbbnh.exe btnhbb.exe PID 2656 wrote to memory of 2296 2656 btbbnh.exe btnhbb.exe PID 2656 wrote to memory of 2296 2656 btbbnh.exe btnhbb.exe PID 2296 wrote to memory of 4640 2296 btnhbb.exe dvjdv.exe PID 2296 wrote to memory of 4640 2296 btnhbb.exe dvjdv.exe PID 2296 wrote to memory of 4640 2296 btnhbb.exe dvjdv.exe PID 4640 wrote to memory of 3240 4640 dvjdv.exe xrfrrrx.exe PID 4640 wrote to memory of 3240 4640 dvjdv.exe xrfrrrx.exe PID 4640 wrote to memory of 3240 4640 dvjdv.exe xrfrrrx.exe PID 3240 wrote to memory of 3884 3240 xrfrrrx.exe nbtnbh.exe PID 3240 wrote to memory of 3884 3240 xrfrrrx.exe nbtnbh.exe PID 3240 wrote to memory of 3884 3240 xrfrrrx.exe nbtnbh.exe PID 3884 wrote to memory of 4416 3884 nbtnbh.exe tbtntt.exe PID 3884 wrote to memory of 4416 3884 nbtnbh.exe tbtntt.exe PID 3884 wrote to memory of 4416 3884 nbtnbh.exe tbtntt.exe PID 4416 wrote to memory of 3148 4416 tbtntt.exe vvvvj.exe PID 4416 wrote to memory of 3148 4416 tbtntt.exe vvvvj.exe PID 4416 wrote to memory of 3148 4416 tbtntt.exe vvvvj.exe PID 3148 wrote to memory of 3952 3148 vvvvj.exe flllrlf.exe PID 3148 wrote to memory of 3952 3148 vvvvj.exe flllrlf.exe PID 3148 wrote to memory of 3952 3148 vvvvj.exe flllrlf.exe PID 3952 wrote to memory of 1188 3952 flllrlf.exe xlrffxf.exe PID 3952 wrote to memory of 1188 3952 flllrlf.exe xlrffxf.exe PID 3952 wrote to memory of 1188 3952 flllrlf.exe xlrffxf.exe PID 1188 wrote to memory of 2752 1188 xlrffxf.exe hhhbhh.exe PID 1188 wrote to memory of 2752 1188 xlrffxf.exe hhhbhh.exe PID 1188 wrote to memory of 2752 1188 xlrffxf.exe hhhbhh.exe PID 2752 wrote to memory of 2612 2752 hhhbhh.exe thhbtn.exe PID 2752 wrote to memory of 2612 2752 hhhbhh.exe thhbtn.exe PID 2752 wrote to memory of 2612 2752 hhhbhh.exe thhbtn.exe PID 2612 wrote to memory of 548 2612 thhbtn.exe jdvjv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5a10b61d149715a486ac88ed95683f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d5a10b61d149715a486ac88ed95683f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\dvddv.exec:\dvddv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\xrxrlll.exec:\xrxrlll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\lxxfxxl.exec:\lxxfxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\thtnbt.exec:\thtnbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\djjvj.exec:\djjvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\xfxlxrl.exec:\xfxlxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\9rlfrlf.exec:\9rlfrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\bbtnhh.exec:\bbtnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\vdjdv.exec:\vdjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\xllfrrf.exec:\xllfrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\btbbnh.exec:\btbbnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\btnhbb.exec:\btnhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\dvjdv.exec:\dvjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\xrfrrrx.exec:\xrfrrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\nbtnbh.exec:\nbtnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\tbtntt.exec:\tbtntt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\vvvvj.exec:\vvvvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\flllrlf.exec:\flllrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\xlrffxf.exec:\xlrffxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\hhhbhh.exec:\hhhbhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\thhbtn.exec:\thhbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\jdvjv.exec:\jdvjv.exe23⤵
- Executes dropped EXE
PID:548 -
\??\c:\lrrlxxr.exec:\lrrlxxr.exe24⤵
- Executes dropped EXE
PID:2288 -
\??\c:\llrlxrl.exec:\llrlxrl.exe25⤵
- Executes dropped EXE
PID:4912 -
\??\c:\1thhbb.exec:\1thhbb.exe26⤵
- Executes dropped EXE
PID:2464 -
\??\c:\jjdvp.exec:\jjdvp.exe27⤵
- Executes dropped EXE
PID:3484 -
\??\c:\9vpdp.exec:\9vpdp.exe28⤵
- Executes dropped EXE
PID:316 -
\??\c:\xflrfxr.exec:\xflrfxr.exe29⤵
- Executes dropped EXE
PID:448 -
\??\c:\bhbbth.exec:\bhbbth.exe30⤵
- Executes dropped EXE
PID:528 -
\??\c:\thhtbt.exec:\thhtbt.exe31⤵
- Executes dropped EXE
PID:4248 -
\??\c:\vjddp.exec:\vjddp.exe32⤵
- Executes dropped EXE
PID:4072 -
\??\c:\llfxxfl.exec:\llfxxfl.exe33⤵
- Executes dropped EXE
PID:3364 -
\??\c:\bnhbnh.exec:\bnhbnh.exe34⤵
- Executes dropped EXE
PID:4352 -
\??\c:\pdjvp.exec:\pdjvp.exe35⤵
- Executes dropped EXE
PID:4904 -
\??\c:\5dvpv.exec:\5dvpv.exe36⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rfrfrlf.exec:\rfrfrlf.exe37⤵
- Executes dropped EXE
PID:2456 -
\??\c:\tttnbt.exec:\tttnbt.exe38⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hnbbnn.exec:\hnbbnn.exe39⤵
- Executes dropped EXE
PID:3488 -
\??\c:\vpdvj.exec:\vpdvj.exe40⤵
- Executes dropped EXE
PID:4408 -
\??\c:\7ddvp.exec:\7ddvp.exe41⤵
- Executes dropped EXE
PID:3436 -
\??\c:\rxxlxrl.exec:\rxxlxrl.exe42⤵
- Executes dropped EXE
PID:4648 -
\??\c:\hbnhtn.exec:\hbnhtn.exe43⤵
- Executes dropped EXE
PID:4472 -
\??\c:\5tthtn.exec:\5tthtn.exe44⤵
- Executes dropped EXE
PID:2032 -
\??\c:\pvpjj.exec:\pvpjj.exe45⤵
- Executes dropped EXE
PID:4832 -
\??\c:\ppjvj.exec:\ppjvj.exe46⤵
- Executes dropped EXE
PID:1800 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe47⤵
- Executes dropped EXE
PID:1000 -
\??\c:\5hhbnh.exec:\5hhbnh.exe48⤵
- Executes dropped EXE
PID:1852 -
\??\c:\bnnbtn.exec:\bnnbtn.exe49⤵
- Executes dropped EXE
PID:1580 -
\??\c:\djjvp.exec:\djjvp.exe50⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jpjvj.exec:\jpjvj.exe51⤵
- Executes dropped EXE
PID:3392 -
\??\c:\7rxlxrl.exec:\7rxlxrl.exe52⤵
- Executes dropped EXE
PID:2960 -
\??\c:\lrfrlfr.exec:\lrfrlfr.exe53⤵
- Executes dropped EXE
PID:5084 -
\??\c:\htnhbb.exec:\htnhbb.exe54⤵
- Executes dropped EXE
PID:2832 -
\??\c:\htnhtt.exec:\htnhtt.exe55⤵
- Executes dropped EXE
PID:4876 -
\??\c:\1ddpv.exec:\1ddpv.exe56⤵
- Executes dropped EXE
PID:808 -
\??\c:\vppdv.exec:\vppdv.exe57⤵
- Executes dropped EXE
PID:1356 -
\??\c:\xllfrlf.exec:\xllfrlf.exe58⤵
- Executes dropped EXE
PID:1488 -
\??\c:\9rlfrfx.exec:\9rlfrfx.exe59⤵
- Executes dropped EXE
PID:3172 -
\??\c:\nttnhh.exec:\nttnhh.exe60⤵
- Executes dropped EXE
PID:3128 -
\??\c:\3bbhbt.exec:\3bbhbt.exe61⤵
- Executes dropped EXE
PID:3148 -
\??\c:\djpjd.exec:\djpjd.exe62⤵
- Executes dropped EXE
PID:4456 -
\??\c:\xxlfxrl.exec:\xxlfxrl.exe63⤵
- Executes dropped EXE
PID:2668 -
\??\c:\9rxrfxr.exec:\9rxrfxr.exe64⤵
- Executes dropped EXE
PID:896 -
\??\c:\bhnbnh.exec:\bhnbnh.exe65⤵
- Executes dropped EXE
PID:2228 -
\??\c:\7jjdp.exec:\7jjdp.exe66⤵PID:3948
-
\??\c:\pjvpd.exec:\pjvpd.exe67⤵PID:400
-
\??\c:\frrlxrl.exec:\frrlxrl.exe68⤵PID:4780
-
\??\c:\5lrlfxl.exec:\5lrlfxl.exe69⤵PID:4656
-
\??\c:\5bbtnh.exec:\5bbtnh.exe70⤵PID:4776
-
\??\c:\jvjdp.exec:\jvjdp.exe71⤵PID:3572
-
\??\c:\vvdvj.exec:\vvdvj.exe72⤵PID:3484
-
\??\c:\lfrrxlr.exec:\lfrrxlr.exe73⤵PID:1484
-
\??\c:\tbbtnn.exec:\tbbtnn.exe74⤵PID:508
-
\??\c:\nhnbbn.exec:\nhnbbn.exe75⤵PID:3720
-
\??\c:\pddvj.exec:\pddvj.exe76⤵PID:720
-
\??\c:\pjpjv.exec:\pjpjv.exe77⤵PID:4248
-
\??\c:\xxlffff.exec:\xxlffff.exe78⤵PID:4072
-
\??\c:\rffxrlf.exec:\rffxrlf.exe79⤵PID:2100
-
\??\c:\bnhbtn.exec:\bnhbtn.exe80⤵PID:2356
-
\??\c:\5hnhhb.exec:\5hnhhb.exe81⤵PID:2432
-
\??\c:\jjppj.exec:\jjppj.exe82⤵PID:3648
-
\??\c:\1frlxrl.exec:\1frlxrl.exe83⤵PID:2888
-
\??\c:\5frlxxr.exec:\5frlxxr.exe84⤵PID:1576
-
\??\c:\hbhhhb.exec:\hbhhhb.exe85⤵PID:2408
-
\??\c:\dvjdd.exec:\dvjdd.exe86⤵PID:1284
-
\??\c:\fxxxxrf.exec:\fxxxxrf.exe87⤵PID:4784
-
\??\c:\rflxllx.exec:\rflxllx.exe88⤵PID:4252
-
\??\c:\bnntnt.exec:\bnntnt.exe89⤵PID:1788
-
\??\c:\9thbnn.exec:\9thbnn.exe90⤵PID:3308
-
\??\c:\3ppjp.exec:\3ppjp.exe91⤵PID:2116
-
\??\c:\pddpv.exec:\pddpv.exe92⤵PID:3928
-
\??\c:\xlrfxrf.exec:\xlrfxrf.exe93⤵PID:2016
-
\??\c:\thhbtn.exec:\thhbtn.exe94⤵PID:2784
-
\??\c:\nhnbtn.exec:\nhnbtn.exe95⤵PID:4036
-
\??\c:\djdjv.exec:\djdjv.exe96⤵PID:2876
-
\??\c:\3jppj.exec:\3jppj.exe97⤵PID:2716
-
\??\c:\xxlxrfx.exec:\xxlxrfx.exe98⤵PID:4128
-
\??\c:\7lrlxxl.exec:\7lrlxxl.exe99⤵PID:2296
-
\??\c:\1hhbtt.exec:\1hhbtt.exe100⤵PID:5036
-
\??\c:\5hhtnh.exec:\5hhtnh.exe101⤵PID:4876
-
\??\c:\pvjdp.exec:\pvjdp.exe102⤵PID:4956
-
\??\c:\fxfxlfx.exec:\fxfxlfx.exe103⤵PID:668
-
\??\c:\1xlfxxr.exec:\1xlfxxr.exe104⤵PID:4464
-
\??\c:\3vdvv.exec:\3vdvv.exe105⤵PID:2700
-
\??\c:\jdjdj.exec:\jdjdj.exe106⤵PID:4688
-
\??\c:\1rrlffl.exec:\1rrlffl.exe107⤵PID:4016
-
\??\c:\1lxrxrf.exec:\1lxrxrf.exe108⤵PID:3196
-
\??\c:\9tbthh.exec:\9tbthh.exe109⤵PID:2988
-
\??\c:\jpdvv.exec:\jpdvv.exe110⤵PID:4604
-
\??\c:\5dvpd.exec:\5dvpd.exe111⤵PID:5100
-
\??\c:\rxffrrf.exec:\rxffrrf.exe112⤵PID:2000
-
\??\c:\hnhbtn.exec:\hnhbtn.exe113⤵PID:4960
-
\??\c:\tnbnbt.exec:\tnbnbt.exe114⤵PID:2044
-
\??\c:\jpjdp.exec:\jpjdp.exe115⤵PID:2300
-
\??\c:\1jjvd.exec:\1jjvd.exe116⤵PID:3472
-
\??\c:\rrrfffx.exec:\rrrfffx.exe117⤵PID:3572
-
\??\c:\rffxrrl.exec:\rffxrrl.exe118⤵PID:4860
-
\??\c:\bnnhbb.exec:\bnnhbb.exe119⤵PID:4524
-
\??\c:\tnhthb.exec:\tnhthb.exe120⤵PID:508
-
\??\c:\pddpv.exec:\pddpv.exe121⤵PID:1896
-
\??\c:\dvvjd.exec:\dvvjd.exe122⤵PID:720
-
\??\c:\5rllfrl.exec:\5rllfrl.exe123⤵PID:2824
-
\??\c:\rrflfrl.exec:\rrflfrl.exe124⤵PID:1648
-
\??\c:\5tthtn.exec:\5tthtn.exe125⤵PID:1084
-
\??\c:\nbnhhh.exec:\nbnhhh.exe126⤵PID:1452
-
\??\c:\vjpjp.exec:\vjpjp.exe127⤵PID:1124
-
\??\c:\pdpdd.exec:\pdpdd.exe128⤵PID:4452
-
\??\c:\vddvp.exec:\vddvp.exe129⤵PID:4364
-
\??\c:\rfrrrll.exec:\rfrrrll.exe130⤵PID:1668
-
\??\c:\tbhbtn.exec:\tbhbtn.exe131⤵PID:4520
-
\??\c:\htnhtn.exec:\htnhtn.exe132⤵PID:4252
-
\??\c:\7dvpj.exec:\7dvpj.exe133⤵PID:5000
-
\??\c:\dvjvj.exec:\dvjvj.exe134⤵PID:3308
-
\??\c:\xlfrfxx.exec:\xlfrfxx.exe135⤵PID:2116
-
\??\c:\lxxlffr.exec:\lxxlffr.exe136⤵PID:2904
-
\??\c:\btbttn.exec:\btbttn.exe137⤵PID:1860
-
\??\c:\7bthtn.exec:\7bthtn.exe138⤵PID:5080
-
\??\c:\httnbt.exec:\httnbt.exe139⤵PID:5104
-
\??\c:\dvpdp.exec:\dvpdp.exe140⤵PID:2716
-
\??\c:\rfxrffr.exec:\rfxrffr.exe141⤵PID:5068
-
\??\c:\tbhhbt.exec:\tbhhbt.exe142⤵PID:2980
-
\??\c:\vvjpv.exec:\vvjpv.exe143⤵PID:4152
-
\??\c:\dpvpd.exec:\dpvpd.exe144⤵PID:444
-
\??\c:\1lffrff.exec:\1lffrff.exe145⤵PID:3172
-
\??\c:\rrxlflx.exec:\rrxlflx.exe146⤵PID:3128
-
\??\c:\1llxlfx.exec:\1llxlfx.exe147⤵PID:4688
-
\??\c:\9nnhbt.exec:\9nnhbt.exe148⤵PID:3644
-
\??\c:\hbthbt.exec:\hbthbt.exe149⤵PID:2752
-
\??\c:\ppddj.exec:\ppddj.exe150⤵PID:4564
-
\??\c:\dvvpp.exec:\dvvpp.exe151⤵PID:400
-
\??\c:\xxrfrlx.exec:\xxrfrlx.exe152⤵PID:3400
-
\??\c:\lxrlfxx.exec:\lxrlfxx.exe153⤵PID:4132
-
\??\c:\tbttbt.exec:\tbttbt.exe154⤵PID:628
-
\??\c:\nbthnh.exec:\nbthnh.exe155⤵PID:3448
-
\??\c:\hbbttn.exec:\hbbttn.exe156⤵PID:316
-
\??\c:\pjpjd.exec:\pjpjd.exe157⤵PID:1736
-
\??\c:\jdvpd.exec:\jdvpd.exe158⤵PID:3720
-
\??\c:\frrlfll.exec:\frrlfll.exe159⤵PID:4556
-
\??\c:\9btnhh.exec:\9btnhh.exe160⤵PID:2956
-
\??\c:\bbbtnh.exec:\bbbtnh.exe161⤵PID:4352
-
\??\c:\jddpj.exec:\jddpj.exe162⤵PID:944
-
\??\c:\pjpjv.exec:\pjpjv.exe163⤵PID:3336
-
\??\c:\pppjp.exec:\pppjp.exe164⤵PID:3648
-
\??\c:\frffllx.exec:\frffllx.exe165⤵PID:3488
-
\??\c:\7lffxrr.exec:\7lffxrr.exe166⤵PID:4852
-
\??\c:\9hnhnh.exec:\9hnhnh.exe167⤵PID:3284
-
\??\c:\tnhttn.exec:\tnhttn.exe168⤵PID:60
-
\??\c:\nbbnhb.exec:\nbbnhb.exe169⤵PID:3972
-
\??\c:\1vpjv.exec:\1vpjv.exe170⤵PID:1560
-
\??\c:\3pvpd.exec:\3pvpd.exe171⤵PID:2164
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe172⤵PID:388
-
\??\c:\nhbnbt.exec:\nhbnbt.exe173⤵PID:1000
-
\??\c:\7bhbnh.exec:\7bhbnh.exe174⤵PID:1852
-
\??\c:\dddvp.exec:\dddvp.exe175⤵PID:1580
-
\??\c:\djdpv.exec:\djdpv.exe176⤵PID:3152
-
\??\c:\frlxlfr.exec:\frlxlfr.exe177⤵PID:940
-
\??\c:\xxrrfxr.exec:\xxrrfxr.exe178⤵PID:4432
-
\??\c:\lllfrll.exec:\lllfrll.exe179⤵PID:5068
-
\??\c:\tbbnhh.exec:\tbbnhh.exe180⤵PID:2980
-
\??\c:\dppjp.exec:\dppjp.exe181⤵PID:4416
-
\??\c:\vjdvj.exec:\vjdvj.exe182⤵PID:1120
-
\??\c:\9ppdp.exec:\9ppdp.exe183⤵PID:4264
-
\??\c:\lxxllxf.exec:\lxxllxf.exe184⤵PID:220
-
\??\c:\xrxrrll.exec:\xrxrrll.exe185⤵PID:896
-
\??\c:\hnnhbt.exec:\hnnhbt.exe186⤵PID:1352
-
\??\c:\9nbbnh.exec:\9nbbnh.exe187⤵PID:4912
-
\??\c:\pjjpj.exec:\pjjpj.exe188⤵PID:2044
-
\??\c:\pjdpj.exec:\pjdpj.exe189⤵PID:5116
-
\??\c:\lfxlxfx.exec:\lfxlxfx.exe190⤵PID:1640
-
\??\c:\rfrxlfx.exec:\rfrxlfx.exe191⤵PID:4860
-
\??\c:\bnbtht.exec:\bnbtht.exe192⤵PID:540
-
\??\c:\5hthtn.exec:\5hthtn.exe193⤵PID:2672
-
\??\c:\pjjjp.exec:\pjjjp.exe194⤵PID:4764
-
\??\c:\llrffff.exec:\llrffff.exe195⤵PID:3592
-
\??\c:\fffxrlx.exec:\fffxrlx.exe196⤵PID:4072
-
\??\c:\1lfrlfx.exec:\1lfrlfx.exe197⤵PID:4576
-
\??\c:\hbnhtn.exec:\hbnhtn.exe198⤵PID:1452
-
\??\c:\btbbtb.exec:\btbbtb.exe199⤵PID:1652
-
\??\c:\1vdpp.exec:\1vdpp.exe200⤵PID:3648
-
\??\c:\tbhtbb.exec:\tbhtbb.exe201⤵PID:3488
-
\??\c:\7pvjp.exec:\7pvjp.exe202⤵PID:2092
-
\??\c:\hbhbnn.exec:\hbhbnn.exe203⤵PID:3284
-
\??\c:\ddjjv.exec:\ddjjv.exe204⤵PID:892
-
\??\c:\fxxxlff.exec:\fxxxlff.exe205⤵PID:3972
-
\??\c:\tbhhhh.exec:\tbhhhh.exe206⤵PID:3308
-
\??\c:\1bnbnn.exec:\1bnbnn.exe207⤵PID:2056
-
\??\c:\jvjdp.exec:\jvjdp.exe208⤵PID:4536
-
\??\c:\ppjdp.exec:\ppjdp.exe209⤵PID:1860
-
\??\c:\rllxlfr.exec:\rllxlfr.exe210⤵PID:1852
-
\??\c:\5bbnbt.exec:\5bbnbt.exe211⤵PID:4500
-
\??\c:\7nnhhn.exec:\7nnhhn.exe212⤵PID:5084
-
\??\c:\3pdvp.exec:\3pdvp.exe213⤵PID:4640
-
\??\c:\fllfrrl.exec:\fllfrrl.exe214⤵PID:2036
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe215⤵PID:1980
-
\??\c:\hbbnhb.exec:\hbbnhb.exe216⤵PID:2840
-
\??\c:\nbhthb.exec:\nbhthb.exe217⤵PID:912
-
\??\c:\jdvjd.exec:\jdvjd.exe218⤵PID:1780
-
\??\c:\7pvpd.exec:\7pvpd.exe219⤵PID:3976
-
\??\c:\1xxlxrf.exec:\1xxlxrf.exe220⤵PID:384
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe221⤵PID:4100
-
\??\c:\tbhthb.exec:\tbhthb.exe222⤵PID:4776
-
\??\c:\bnhnbt.exec:\bnhnbt.exe223⤵PID:1772
-
\??\c:\dvvpj.exec:\dvvpj.exe224⤵PID:3472
-
\??\c:\3vdpv.exec:\3vdpv.exe225⤵PID:3448
-
\??\c:\rxxlxxl.exec:\rxxlxxl.exe226⤵PID:3144
-
\??\c:\7frlfxr.exec:\7frlfxr.exe227⤵PID:1896
-
\??\c:\7htnbb.exec:\7htnbb.exe228⤵PID:2672
-
\??\c:\hbbttn.exec:\hbbttn.exe229⤵PID:4764
-
\??\c:\ddjjj.exec:\ddjjj.exe230⤵PID:4616
-
\??\c:\ddjvj.exec:\ddjvj.exe231⤵PID:4352
-
\??\c:\lxlfxrf.exec:\lxlfxrf.exe232⤵PID:2900
-
\??\c:\lxfrrll.exec:\lxfrrll.exe233⤵PID:4084
-
\??\c:\lffxfxl.exec:\lffxfxl.exe234⤵PID:3648
-
\??\c:\nbhbnn.exec:\nbhbnn.exe235⤵PID:4480
-
\??\c:\thbnhb.exec:\thbnhb.exe236⤵PID:900
-
\??\c:\7ppjv.exec:\7ppjv.exe237⤵PID:4788
-
\??\c:\djjdp.exec:\djjdp.exe238⤵PID:5000
-
\??\c:\frrlrlx.exec:\frrlrlx.exe239⤵PID:4460
-
\??\c:\fllxrlf.exec:\fllxrlf.exe240⤵PID:1660
-
\??\c:\htttnn.exec:\htttnn.exe241⤵PID:64
-
\??\c:\bhhthb.exec:\bhhthb.exe242⤵PID:3612