Analysis
-
max time kernel
149s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 02:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe
-
Size
59KB
-
MD5
96cf1073e1fdaa134d1e12fad5a493c0
-
SHA1
24fcdae0065ddc8b7c3dbc6d1cdda9f5a433e956
-
SHA256
fdc5b000c41842926c4339fe20edd31b86f3cbd0ac4d93ab608338801bd37c0b
-
SHA512
7c8f4bb6124089b062ef45ecf5b78f7fdf76e43ea0804790973724322f094a07d231f5cd6697c3f9f5b4b075214e3d887677b4bb0a023fa314f6237302690961
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9Li:ymb3NkkiQ3mdBjFI9m
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/4788-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bttnnb.exe5lrlfff.exellxrrrr.exehbnnhh.exefffffll.exebtbbnn.exetnbbnb.exevpjpd.exexrrrrrl.exenbhbtt.exevjppj.exe5lfxllf.exennnnhb.exejdvpj.exeffffxrr.exerffffxx.exetthhbh.exepvjvj.exefllllll.exebnnbnb.exejvvpj.exepjvvp.exerxxxrrl.exebtnhbb.exe5vvpj.exexlxrllf.exebttnbb.exevpvvd.exerlxxxxf.exefxrffll.exentnhbn.exepdjdv.exerxfrlrl.exethhtnh.exe1btnhh.exedvpjv.exepjdjd.exelfxrllf.exetntnnt.exedjppj.exeflxffff.exexflllff.exe1ttnhh.exeppppj.exedvpvp.exe3lxrlrr.exebtbttt.exetbhhhn.exejpppd.exefllfxxr.exefflllrx.exe7bthbb.exeppddv.exexfxlxxx.exelxxxllf.exeppddd.exe5rrfxxr.exebtnhhn.exe5ntnhn.exe1hnnbb.exe7jjdp.exedpjdv.exeffrxlrf.exetnhbtt.exepid process 1416 bttnnb.exe 3884 5lrlfff.exe 3380 llxrrrr.exe 4856 hbnnhh.exe 4132 fffffll.exe 2844 btbbnn.exe 4888 tnbbnb.exe 2132 vpjpd.exe 3392 xrrrrrl.exe 4152 nbhbtt.exe 672 vjppj.exe 988 5lfxllf.exe 3280 nnnnhb.exe 4628 jdvpj.exe 4940 ffffxrr.exe 3104 rffffxx.exe 3000 tthhbh.exe 3520 pvjvj.exe 2524 fllllll.exe 2980 bnnbnb.exe 740 jvvpj.exe 952 pjvvp.exe 3012 rxxxrrl.exe 5096 btnhbb.exe 2036 5vvpj.exe 5112 xlxrllf.exe 3944 bttnbb.exe 4380 vpvvd.exe 4644 rlxxxxf.exe 1624 fxrffll.exe 2820 ntnhbn.exe 3968 pdjdv.exe 3180 rxfrlrl.exe 2348 thhtnh.exe 2312 1btnhh.exe 8 dvpjv.exe 1156 pjdjd.exe 4936 lfxrllf.exe 4328 tntnnt.exe 1168 djppj.exe 2724 flxffff.exe 3128 xflllff.exe 116 1ttnhh.exe 3456 ppppj.exe 2900 dvpvp.exe 4856 3lxrlrr.exe 3168 btbttt.exe 1404 tbhhhn.exe 4804 jpppd.exe 5100 fllfxxr.exe 2052 fflllrx.exe 5072 7bthbb.exe 3724 ppddv.exe 2604 xfxlxxx.exe 4908 lxxxllf.exe 1092 ppddd.exe 2668 5rrfxxr.exe 3448 btnhhn.exe 3644 5ntnhn.exe 3000 1hnnbb.exe 2308 7jjdp.exe 1508 dpjdv.exe 2612 ffrxlrf.exe 1524 tnhbtt.exe -
Processes:
resource yara_rule behavioral2/memory/4788-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3884-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exebttnnb.exe5lrlfff.exellxrrrr.exehbnnhh.exefffffll.exebtbbnn.exetnbbnb.exevpjpd.exexrrrrrl.exenbhbtt.exevjppj.exe5lfxllf.exennnnhb.exejdvpj.exeffffxrr.exerffffxx.exetthhbh.exepvjvj.exefllllll.exebnnbnb.exejvvpj.exedescription pid process target process PID 4788 wrote to memory of 1416 4788 96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe bttnnb.exe PID 4788 wrote to memory of 1416 4788 96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe bttnnb.exe PID 4788 wrote to memory of 1416 4788 96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe bttnnb.exe PID 1416 wrote to memory of 3884 1416 bttnnb.exe 5lrlfff.exe PID 1416 wrote to memory of 3884 1416 bttnnb.exe 5lrlfff.exe PID 1416 wrote to memory of 3884 1416 bttnnb.exe 5lrlfff.exe PID 3884 wrote to memory of 3380 3884 5lrlfff.exe llxrrrr.exe PID 3884 wrote to memory of 3380 3884 5lrlfff.exe llxrrrr.exe PID 3884 wrote to memory of 3380 3884 5lrlfff.exe llxrrrr.exe PID 3380 wrote to memory of 4856 3380 llxrrrr.exe hbnnhh.exe PID 3380 wrote to memory of 4856 3380 llxrrrr.exe hbnnhh.exe PID 3380 wrote to memory of 4856 3380 llxrrrr.exe hbnnhh.exe PID 4856 wrote to memory of 4132 4856 hbnnhh.exe fffffll.exe PID 4856 wrote to memory of 4132 4856 hbnnhh.exe fffffll.exe PID 4856 wrote to memory of 4132 4856 hbnnhh.exe fffffll.exe PID 4132 wrote to memory of 2844 4132 fffffll.exe btbbnn.exe PID 4132 wrote to memory of 2844 4132 fffffll.exe btbbnn.exe PID 4132 wrote to memory of 2844 4132 fffffll.exe btbbnn.exe PID 2844 wrote to memory of 4888 2844 btbbnn.exe tnbbnb.exe PID 2844 wrote to memory of 4888 2844 btbbnn.exe tnbbnb.exe PID 2844 wrote to memory of 4888 2844 btbbnn.exe tnbbnb.exe PID 4888 wrote to memory of 2132 4888 tnbbnb.exe vpjpd.exe PID 4888 wrote to memory of 2132 4888 tnbbnb.exe vpjpd.exe PID 4888 wrote to memory of 2132 4888 tnbbnb.exe vpjpd.exe PID 2132 wrote to memory of 3392 2132 vpjpd.exe xrrrrrl.exe PID 2132 wrote to memory of 3392 2132 vpjpd.exe xrrrrrl.exe PID 2132 wrote to memory of 3392 2132 vpjpd.exe xrrrrrl.exe PID 3392 wrote to memory of 4152 3392 xrrrrrl.exe nbhbtt.exe PID 3392 wrote to memory of 4152 3392 xrrrrrl.exe nbhbtt.exe PID 3392 wrote to memory of 4152 3392 xrrrrrl.exe nbhbtt.exe PID 4152 wrote to memory of 672 4152 nbhbtt.exe vjppj.exe PID 4152 wrote to memory of 672 4152 nbhbtt.exe vjppj.exe PID 4152 wrote to memory of 672 4152 nbhbtt.exe vjppj.exe PID 672 wrote to memory of 988 672 vjppj.exe 5lfxllf.exe PID 672 wrote to memory of 988 672 vjppj.exe 5lfxllf.exe PID 672 wrote to memory of 988 672 vjppj.exe 5lfxllf.exe PID 988 wrote to memory of 3280 988 5lfxllf.exe nnnnhb.exe PID 988 wrote to memory of 3280 988 5lfxllf.exe nnnnhb.exe PID 988 wrote to memory of 3280 988 5lfxllf.exe nnnnhb.exe PID 3280 wrote to memory of 4628 3280 nnnnhb.exe jdvpj.exe PID 3280 wrote to memory of 4628 3280 nnnnhb.exe jdvpj.exe PID 3280 wrote to memory of 4628 3280 nnnnhb.exe jdvpj.exe PID 4628 wrote to memory of 4940 4628 jdvpj.exe ffffxrr.exe PID 4628 wrote to memory of 4940 4628 jdvpj.exe ffffxrr.exe PID 4628 wrote to memory of 4940 4628 jdvpj.exe ffffxrr.exe PID 4940 wrote to memory of 3104 4940 ffffxrr.exe rffffxx.exe PID 4940 wrote to memory of 3104 4940 ffffxrr.exe rffffxx.exe PID 4940 wrote to memory of 3104 4940 ffffxrr.exe rffffxx.exe PID 3104 wrote to memory of 3000 3104 rffffxx.exe tthhbh.exe PID 3104 wrote to memory of 3000 3104 rffffxx.exe tthhbh.exe PID 3104 wrote to memory of 3000 3104 rffffxx.exe tthhbh.exe PID 3000 wrote to memory of 3520 3000 tthhbh.exe pvjvj.exe PID 3000 wrote to memory of 3520 3000 tthhbh.exe pvjvj.exe PID 3000 wrote to memory of 3520 3000 tthhbh.exe pvjvj.exe PID 3520 wrote to memory of 2524 3520 pvjvj.exe fllllll.exe PID 3520 wrote to memory of 2524 3520 pvjvj.exe fllllll.exe PID 3520 wrote to memory of 2524 3520 pvjvj.exe fllllll.exe PID 2524 wrote to memory of 2980 2524 fllllll.exe bnnbnb.exe PID 2524 wrote to memory of 2980 2524 fllllll.exe bnnbnb.exe PID 2524 wrote to memory of 2980 2524 fllllll.exe bnnbnb.exe PID 2980 wrote to memory of 740 2980 bnnbnb.exe jvvpj.exe PID 2980 wrote to memory of 740 2980 bnnbnb.exe jvvpj.exe PID 2980 wrote to memory of 740 2980 bnnbnb.exe jvvpj.exe PID 740 wrote to memory of 952 740 jvvpj.exe pjvvp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\96cf1073e1fdaa134d1e12fad5a493c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\bttnnb.exec:\bttnnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\5lrlfff.exec:\5lrlfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\llxrrrr.exec:\llxrrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\hbnnhh.exec:\hbnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\fffffll.exec:\fffffll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\btbbnn.exec:\btbbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\tnbbnb.exec:\tnbbnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\vpjpd.exec:\vpjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\xrrrrrl.exec:\xrrrrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\nbhbtt.exec:\nbhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\vjppj.exec:\vjppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\5lfxllf.exec:\5lfxllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\nnnnhb.exec:\nnnnhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\jdvpj.exec:\jdvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\ffffxrr.exec:\ffffxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\rffffxx.exec:\rffffxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\tthhbh.exec:\tthhbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\pvjvj.exec:\pvjvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\fllllll.exec:\fllllll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\bnnbnb.exec:\bnnbnb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\jvvpj.exec:\jvvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\pjvvp.exec:\pjvvp.exe23⤵
- Executes dropped EXE
PID:952 -
\??\c:\rxxxrrl.exec:\rxxxrrl.exe24⤵
- Executes dropped EXE
PID:3012 -
\??\c:\btnhbb.exec:\btnhbb.exe25⤵
- Executes dropped EXE
PID:5096 -
\??\c:\5vvpj.exec:\5vvpj.exe26⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xlxrllf.exec:\xlxrllf.exe27⤵
- Executes dropped EXE
PID:5112 -
\??\c:\bttnbb.exec:\bttnbb.exe28⤵
- Executes dropped EXE
PID:3944 -
\??\c:\vpvvd.exec:\vpvvd.exe29⤵
- Executes dropped EXE
PID:4380 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe30⤵
- Executes dropped EXE
PID:4644 -
\??\c:\fxrffll.exec:\fxrffll.exe31⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ntnhbn.exec:\ntnhbn.exe32⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pdjdv.exec:\pdjdv.exe33⤵
- Executes dropped EXE
PID:3968 -
\??\c:\rxfrlrl.exec:\rxfrlrl.exe34⤵
- Executes dropped EXE
PID:3180 -
\??\c:\thhtnh.exec:\thhtnh.exe35⤵
- Executes dropped EXE
PID:2348 -
\??\c:\1btnhh.exec:\1btnhh.exe36⤵
- Executes dropped EXE
PID:2312 -
\??\c:\dvpjv.exec:\dvpjv.exe37⤵
- Executes dropped EXE
PID:8 -
\??\c:\pjdjd.exec:\pjdjd.exe38⤵
- Executes dropped EXE
PID:1156 -
\??\c:\lfxrllf.exec:\lfxrllf.exe39⤵
- Executes dropped EXE
PID:4936 -
\??\c:\tntnnt.exec:\tntnnt.exe40⤵
- Executes dropped EXE
PID:4328 -
\??\c:\djppj.exec:\djppj.exe41⤵
- Executes dropped EXE
PID:1168 -
\??\c:\flxffff.exec:\flxffff.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xflllff.exec:\xflllff.exe43⤵
- Executes dropped EXE
PID:3128 -
\??\c:\1ttnhh.exec:\1ttnhh.exe44⤵
- Executes dropped EXE
PID:116 -
\??\c:\ppppj.exec:\ppppj.exe45⤵
- Executes dropped EXE
PID:3456 -
\??\c:\dvpvp.exec:\dvpvp.exe46⤵
- Executes dropped EXE
PID:2900 -
\??\c:\3lxrlrr.exec:\3lxrlrr.exe47⤵
- Executes dropped EXE
PID:4856 -
\??\c:\btbttt.exec:\btbttt.exe48⤵
- Executes dropped EXE
PID:3168 -
\??\c:\tbhhhn.exec:\tbhhhn.exe49⤵
- Executes dropped EXE
PID:1404 -
\??\c:\jpppd.exec:\jpppd.exe50⤵
- Executes dropped EXE
PID:4804 -
\??\c:\fllfxxr.exec:\fllfxxr.exe51⤵
- Executes dropped EXE
PID:5100 -
\??\c:\fflllrx.exec:\fflllrx.exe52⤵
- Executes dropped EXE
PID:2052 -
\??\c:\7bthbb.exec:\7bthbb.exe53⤵
- Executes dropped EXE
PID:5072 -
\??\c:\ppddv.exec:\ppddv.exe54⤵
- Executes dropped EXE
PID:3724 -
\??\c:\xfxlxxx.exec:\xfxlxxx.exe55⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lxxxllf.exec:\lxxxllf.exe56⤵
- Executes dropped EXE
PID:4908 -
\??\c:\ppddd.exec:\ppddd.exe57⤵
- Executes dropped EXE
PID:1092 -
\??\c:\5rrfxxr.exec:\5rrfxxr.exe58⤵
- Executes dropped EXE
PID:2668 -
\??\c:\btnhhn.exec:\btnhhn.exe59⤵
- Executes dropped EXE
PID:3448 -
\??\c:\5ntnhn.exec:\5ntnhn.exe60⤵
- Executes dropped EXE
PID:3644 -
\??\c:\1hnnbb.exec:\1hnnbb.exe61⤵
- Executes dropped EXE
PID:3000 -
\??\c:\7jjdp.exec:\7jjdp.exe62⤵
- Executes dropped EXE
PID:2308 -
\??\c:\dpjdv.exec:\dpjdv.exe63⤵
- Executes dropped EXE
PID:1508 -
\??\c:\ffrxlrf.exec:\ffrxlrf.exe64⤵
- Executes dropped EXE
PID:2612 -
\??\c:\tnhbtt.exec:\tnhbtt.exe65⤵
- Executes dropped EXE
PID:1524 -
\??\c:\bthbtt.exec:\bthbtt.exe66⤵PID:3376
-
\??\c:\jdvvj.exec:\jdvvj.exe67⤵PID:740
-
\??\c:\dvdjj.exec:\dvdjj.exe68⤵PID:4304
-
\??\c:\xflllfr.exec:\xflllfr.exe69⤵PID:2700
-
\??\c:\rxrrrrl.exec:\rxrrrrl.exe70⤵PID:2240
-
\??\c:\5ntbbb.exec:\5ntbbb.exe71⤵PID:3664
-
\??\c:\tbhnnb.exec:\tbhnnb.exe72⤵PID:2036
-
\??\c:\vpdjp.exec:\vpdjp.exe73⤵PID:2924
-
\??\c:\pjvjd.exec:\pjvjd.exe74⤵PID:1068
-
\??\c:\flxfrrr.exec:\flxfrrr.exe75⤵PID:4072
-
\??\c:\xrrlffl.exec:\xrrlffl.exe76⤵PID:3600
-
\??\c:\htbtbb.exec:\htbtbb.exe77⤵PID:2276
-
\??\c:\bbttnn.exec:\bbttnn.exe78⤵PID:2248
-
\??\c:\pjdjd.exec:\pjdjd.exe79⤵PID:1968
-
\??\c:\vpvdd.exec:\vpvdd.exe80⤵PID:4932
-
\??\c:\lflfxff.exec:\lflfxff.exe81⤵PID:3192
-
\??\c:\7hnhbh.exec:\7hnhbh.exe82⤵PID:3180
-
\??\c:\nhhbnt.exec:\nhhbnt.exe83⤵PID:2348
-
\??\c:\pjdvv.exec:\pjdvv.exe84⤵PID:1420
-
\??\c:\dvdvp.exec:\dvdvp.exe85⤵PID:3824
-
\??\c:\lfxrllf.exec:\lfxrllf.exe86⤵PID:1484
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe87⤵PID:1240
-
\??\c:\nhhhbb.exec:\nhhhbb.exe88⤵PID:4320
-
\??\c:\ttbhth.exec:\ttbhth.exe89⤵PID:4512
-
\??\c:\jpvvv.exec:\jpvvv.exe90⤵PID:2020
-
\??\c:\jdppj.exec:\jdppj.exe91⤵PID:2000
-
\??\c:\lfxxxxx.exec:\lfxxxxx.exe92⤵PID:624
-
\??\c:\llflllr.exec:\llflllr.exe93⤵PID:1016
-
\??\c:\nhnhhh.exec:\nhnhhh.exe94⤵PID:936
-
\??\c:\bttnhn.exec:\bttnhn.exe95⤵PID:2064
-
\??\c:\vpvvv.exec:\vpvvv.exe96⤵PID:3920
-
\??\c:\frrlxxx.exec:\frrlxxx.exe97⤵PID:1444
-
\??\c:\xrrflxf.exec:\xrrflxf.exe98⤵PID:1980
-
\??\c:\nnnttt.exec:\nnnttt.exe99⤵PID:3216
-
\??\c:\5dpjj.exec:\5dpjj.exe100⤵PID:3124
-
\??\c:\ddjjj.exec:\ddjjj.exe101⤵PID:2864
-
\??\c:\frlfxxx.exec:\frlfxxx.exe102⤵PID:1692
-
\??\c:\3fllrrx.exec:\3fllrrx.exe103⤵PID:1092
-
\??\c:\lfrxrrr.exec:\lfrxrrr.exe104⤵PID:4872
-
\??\c:\bhttnn.exec:\bhttnn.exe105⤵PID:3644
-
\??\c:\thbnnn.exec:\thbnnn.exe106⤵PID:3000
-
\??\c:\vpjdv.exec:\vpjdv.exe107⤵PID:4484
-
\??\c:\dvvpp.exec:\dvvpp.exe108⤵PID:2980
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe109⤵PID:5032
-
\??\c:\nttttt.exec:\nttttt.exe110⤵PID:900
-
\??\c:\thhbbn.exec:\thhbbn.exe111⤵PID:3384
-
\??\c:\jjjvd.exec:\jjjvd.exe112⤵PID:5044
-
\??\c:\jpvjp.exec:\jpvjp.exe113⤵PID:3664
-
\??\c:\xxxllfx.exec:\xxxllfx.exe114⤵PID:4412
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe115⤵PID:1900
-
\??\c:\vdpdd.exec:\vdpdd.exe116⤵PID:2852
-
\??\c:\xrxxffr.exec:\xrxxffr.exe117⤵PID:1612
-
\??\c:\tttnhb.exec:\tttnhb.exe118⤵PID:1912
-
\??\c:\llrlxxr.exec:\llrlxxr.exe119⤵PID:2248
-
\??\c:\hbhbbt.exec:\hbhbbt.exe120⤵PID:3968
-
\??\c:\jdppv.exec:\jdppv.exe121⤵PID:2856
-
\??\c:\rxflfxf.exec:\rxflfxf.exe122⤵PID:4812
-
\??\c:\1flrflr.exec:\1flrflr.exe123⤵PID:3196
-
\??\c:\nnhnhb.exec:\nnhnhb.exe124⤵PID:8
-
\??\c:\jjjjp.exec:\jjjjp.exe125⤵PID:3360
-
\??\c:\jddjd.exec:\jddjd.exe126⤵PID:4352
-
\??\c:\xrrllfx.exec:\xrrllfx.exe127⤵PID:4788
-
\??\c:\fxffrxr.exec:\fxffrxr.exe128⤵PID:1032
-
\??\c:\nhthbh.exec:\nhthbh.exe129⤵PID:3264
-
\??\c:\tnbnbb.exec:\tnbnbb.exe130⤵PID:3128
-
\??\c:\djjpd.exec:\djjpd.exe131⤵PID:1836
-
\??\c:\jvjjv.exec:\jvjjv.exe132⤵PID:1040
-
\??\c:\rfllfff.exec:\rfllfff.exe133⤵PID:3348
-
\??\c:\pvddv.exec:\pvddv.exe134⤵PID:940
-
\??\c:\xxrlllx.exec:\xxrlllx.exe135⤵PID:4868
-
\??\c:\lfffxfx.exec:\lfffxfx.exe136⤵PID:2148
-
\??\c:\ttbbnn.exec:\ttbbnn.exe137⤵PID:4876
-
\??\c:\7llffff.exec:\7llffff.exe138⤵PID:1800
-
\??\c:\ntbhhh.exec:\ntbhhh.exe139⤵PID:544
-
\??\c:\jjpjv.exec:\jjpjv.exe140⤵PID:3724
-
\??\c:\7djdv.exec:\7djdv.exe141⤵PID:4908
-
\??\c:\lxrlflf.exec:\lxrlflf.exe142⤵PID:4848
-
\??\c:\bhnhhb.exec:\bhnhhb.exe143⤵PID:4988
-
\??\c:\jdvdj.exec:\jdvdj.exe144⤵PID:4680
-
\??\c:\xrffrxx.exec:\xrffrxx.exe145⤵PID:3644
-
\??\c:\9ttbbb.exec:\9ttbbb.exe146⤵PID:3516
-
\??\c:\vpjjj.exec:\vpjjj.exe147⤵PID:4384
-
\??\c:\xffllll.exec:\xffllll.exe148⤵PID:740
-
\??\c:\flxxflf.exec:\flxxflf.exe149⤵PID:2636
-
\??\c:\nnnnnn.exec:\nnnnnn.exe150⤵PID:900
-
\??\c:\xlxxxxx.exec:\xlxxxxx.exe151⤵PID:4300
-
\??\c:\bthhbb.exec:\bthhbb.exe152⤵PID:5112
-
\??\c:\xrrlfff.exec:\xrrlfff.exe153⤵PID:4432
-
\??\c:\hhtnbb.exec:\hhtnbb.exe154⤵PID:4456
-
\??\c:\hbbbnn.exec:\hbbbnn.exe155⤵PID:3624
-
\??\c:\ppddd.exec:\ppddd.exe156⤵PID:3600
-
\??\c:\lxrxlfl.exec:\lxrxlfl.exe157⤵PID:1612
-
\??\c:\7xxxxxr.exec:\7xxxxxr.exe158⤵PID:528
-
\??\c:\tttnhn.exec:\tttnhn.exe159⤵PID:2340
-
\??\c:\nhnnnn.exec:\nhnnnn.exe160⤵PID:2388
-
\??\c:\5jvpp.exec:\5jvpp.exe161⤵PID:2792
-
\??\c:\jdjdv.exec:\jdjdv.exe162⤵PID:4672
-
\??\c:\5xxrrll.exec:\5xxrrll.exe163⤵PID:2652
-
\??\c:\ffrxflx.exec:\ffrxflx.exe164⤵PID:3148
-
\??\c:\3hnnhh.exec:\3hnnhh.exe165⤵PID:4944
-
\??\c:\dpppp.exec:\dpppp.exe166⤵PID:2960
-
\??\c:\jvdpp.exec:\jvdpp.exe167⤵PID:2068
-
\??\c:\pjjdp.exec:\pjjdp.exe168⤵PID:212
-
\??\c:\rflfxfx.exec:\rflfxfx.exe169⤵PID:1836
-
\??\c:\bntbbh.exec:\bntbbh.exe170⤵PID:2844
-
\??\c:\bhhbnt.exec:\bhhbnt.exe171⤵PID:3348
-
\??\c:\vpjjd.exec:\vpjjd.exe172⤵PID:4108
-
\??\c:\jpppj.exec:\jpppj.exe173⤵PID:3920
-
\??\c:\5rfrfrf.exec:\5rfrfrf.exe174⤵PID:5100
-
\??\c:\xlllffx.exec:\xlllffx.exe175⤵PID:4876
-
\??\c:\hhnnbh.exec:\hhnnbh.exe176⤵PID:672
-
\??\c:\pdvvp.exec:\pdvvp.exe177⤵PID:3812
-
\??\c:\vjppj.exec:\vjppj.exe178⤵PID:3724
-
\??\c:\fxfxrxx.exec:\fxfxrxx.exe179⤵PID:4908
-
\??\c:\flllffx.exec:\flllffx.exe180⤵PID:4652
-
\??\c:\hbttnn.exec:\hbttnn.exe181⤵PID:2648
-
\??\c:\pvvjj.exec:\pvvjj.exe182⤵PID:3820
-
\??\c:\vvvvp.exec:\vvvvp.exe183⤵PID:3140
-
\??\c:\fffxrrr.exec:\fffxrrr.exe184⤵PID:2980
-
\??\c:\rfxxrxr.exec:\rfxxrxr.exe185⤵PID:5032
-
\??\c:\hhttnn.exec:\hhttnn.exe186⤵PID:1548
-
\??\c:\9vjvd.exec:\9vjvd.exe187⤵PID:1268
-
\??\c:\pdvpd.exec:\pdvpd.exe188⤵PID:3980
-
\??\c:\frrlffx.exec:\frrlffx.exe189⤵PID:228
-
\??\c:\nhbbtn.exec:\nhbbtn.exe190⤵PID:4424
-
\??\c:\dvpjd.exec:\dvpjd.exe191⤵PID:3120
-
\??\c:\jdpvv.exec:\jdpvv.exe192⤵PID:1804
-
\??\c:\frrlxrl.exec:\frrlxrl.exe193⤵PID:1624
-
\??\c:\bhhhtt.exec:\bhhhtt.exe194⤵PID:1912
-
\??\c:\3hhhtn.exec:\3hhhtn.exe195⤵PID:5108
-
\??\c:\jdjjd.exec:\jdjjd.exe196⤵PID:3632
-
\??\c:\vpddj.exec:\vpddj.exe197⤵PID:2388
-
\??\c:\ffflflf.exec:\ffflflf.exe198⤵PID:1696
-
\??\c:\5flffxr.exec:\5flffxr.exe199⤵PID:964
-
\??\c:\thtnnn.exec:\thtnnn.exe200⤵PID:1620
-
\??\c:\pjdvp.exec:\pjdvp.exe201⤵PID:4084
-
\??\c:\pdjdp.exec:\pdjdp.exe202⤵PID:3496
-
\??\c:\rfxrfxx.exec:\rfxrfxx.exe203⤵PID:3456
-
\??\c:\lrxxrrx.exec:\lrxxrrx.exe204⤵PID:2892
-
\??\c:\5bnhnh.exec:\5bnhnh.exe205⤵PID:2444
-
\??\c:\hthhth.exec:\hthhth.exe206⤵PID:2900
-
\??\c:\httnhh.exec:\httnhh.exe207⤵PID:3240
-
\??\c:\vpdvp.exec:\vpdvp.exe208⤵PID:2064
-
\??\c:\dvpdv.exec:\dvpdv.exe209⤵PID:4804
-
\??\c:\xllfxrf.exec:\xllfxrf.exe210⤵PID:5100
-
\??\c:\rxrrrrr.exec:\rxrrrrr.exe211⤵PID:544
-
\??\c:\bttnhb.exec:\bttnhb.exe212⤵PID:3932
-
\??\c:\bhttnh.exec:\bhttnh.exe213⤵PID:2564
-
\??\c:\pjddv.exec:\pjddv.exe214⤵PID:4872
-
\??\c:\htnbht.exec:\htnbht.exe215⤵PID:3092
-
\??\c:\bbbnbt.exec:\bbbnbt.exe216⤵PID:4652
-
\??\c:\vjppj.exec:\vjppj.exe217⤵PID:2648
-
\??\c:\jjvvp.exec:\jjvvp.exe218⤵PID:3376
-
\??\c:\frrrlff.exec:\frrrlff.exe219⤵PID:4484
-
\??\c:\lxxrlxr.exec:\lxxrlxr.exe220⤵PID:2112
-
\??\c:\nhtnhh.exec:\nhtnhh.exe221⤵PID:4304
-
\??\c:\jdjdv.exec:\jdjdv.exe222⤵PID:1616
-
\??\c:\dvddp.exec:\dvddp.exe223⤵PID:3740
-
\??\c:\xflfxxr.exec:\xflfxxr.exe224⤵PID:1384
-
\??\c:\flfxrlf.exec:\flfxrlf.exe225⤵PID:3796
-
\??\c:\bbnbbt.exec:\bbnbbt.exe226⤵PID:2392
-
\??\c:\hnnnnn.exec:\hnnnnn.exe227⤵PID:2004
-
\??\c:\vdpvp.exec:\vdpvp.exe228⤵PID:4560
-
\??\c:\ddvpj.exec:\ddvpj.exe229⤵PID:5016
-
\??\c:\xxxxxll.exec:\xxxxxll.exe230⤵PID:1912
-
\??\c:\lfffxrr.exec:\lfffxrr.exe231⤵PID:3196
-
\??\c:\5ntthh.exec:\5ntthh.exe232⤵PID:1988
-
\??\c:\9hbnnh.exec:\9hbnnh.exe233⤵PID:2388
-
\??\c:\dvdvd.exec:\dvdvd.exe234⤵PID:4352
-
\??\c:\pjjdp.exec:\pjjdp.exe235⤵PID:2724
-
\??\c:\rrrrlll.exec:\rrrrlll.exe236⤵PID:3548
-
\??\c:\nhbtnn.exec:\nhbtnn.exe237⤵PID:4936
-
\??\c:\nhnhbn.exec:\nhnhbn.exe238⤵PID:3080
-
\??\c:\ddvpd.exec:\ddvpd.exe239⤵PID:4512
-
\??\c:\djjpp.exec:\djjpp.exe240⤵PID:2960
-
\??\c:\rlxfxxr.exec:\rlxfxxr.exe241⤵PID:4844
-
\??\c:\hbbhtn.exec:\hbbhtn.exe242⤵PID:3168