Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 03:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a5f436ade0ef59fdb5d68f1b6151a5b0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a5f436ade0ef59fdb5d68f1b6151a5b0_NeikiAnalytics.exe
-
Size
76KB
-
MD5
a5f436ade0ef59fdb5d68f1b6151a5b0
-
SHA1
473d3e52ec3fa1c7e9376ddaa8fcd250f88f3fd6
-
SHA256
be3a8c8b238b335cbf8fb183728f2847c49928072e85c34fcb9fcaeb4a2674c9
-
SHA512
a1c88a3c99bb0ebcadf74681c56ed22f4b4f98c51db3a6a471ddeb8f57e073ee63edb253551253f2e9e295e2f4aadf25b5add85a4227b47b2ef1e286f9ca5fbe
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqKM:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqKM
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral1/memory/1368-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1368-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-62-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/688-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/608-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/692-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hhtbnt.exepjjdj.exe1dvdd.exehtthhn.exe7pddj.exerfxfffl.exebthnbn.exe3vjdj.exelfxlrrx.exelxllrrx.exetnhntt.exeppjjp.exevjpjj.exexlxxffl.exehnhbbb.exe7nbnnn.exejddpp.exepjvdj.exexrfflrx.exe7bthnb.exe9pddj.exevpjpp.exe5xxrffl.exebbtbht.exepjddv.exevpjpp.exe5llxflr.exenhtbnh.exevvpjd.exerrfrffl.exellxxxfr.exehbbbhn.exe3ddjv.exejdpdd.exexxrxrxl.exenhnthn.exe9bnhhh.exedvjpv.exejjvvp.exexrlfrrx.exennnbnt.exe1tbtbb.exejjdpd.exe9ppvp.exeffrfxlr.exefrxrfxf.exennhttb.exenbhnbh.exe5dppv.exejddjp.exelflrfrf.exefxlfrxf.exe3bnnhn.exepvdpd.exedpvdj.exe5fflxxr.exexxrlflr.exe5bnnnn.exenbhhhh.exevpjvd.exexrflllr.exe7hhnbh.exehbhhnb.exe9dvvp.exepid process 2412 hhtbnt.exe 2296 pjjdj.exe 2664 1dvdd.exe 2796 htthhn.exe 2960 7pddj.exe 2552 rfxfffl.exe 2692 bthnbn.exe 2568 3vjdj.exe 2148 lfxlrrx.exe 2184 lxllrrx.exe 2892 tnhntt.exe 3036 ppjjp.exe 688 vjpjj.exe 1572 xlxxffl.exe 1828 hnhbbb.exe 764 7nbnnn.exe 1912 jddpp.exe 1540 pjvdj.exe 2044 xrfflrx.exe 2328 7bthnb.exe 1076 9pddj.exe 1948 vpjpp.exe 2072 5xxrffl.exe 1044 bbtbht.exe 2376 pjddv.exe 1536 vpjpp.exe 608 5llxflr.exe 1652 nhtbnh.exe 692 vvpjd.exe 1768 rrfrffl.exe 1276 llxxxfr.exe 2316 hbbbhn.exe 2320 3ddjv.exe 1704 jdpdd.exe 496 xxrxrxl.exe 2152 nhnthn.exe 1380 9bnhhh.exe 2616 dvjpv.exe 2664 jjvvp.exe 2096 xrlfrrx.exe 2808 nnnbnt.exe 1316 1tbtbb.exe 2572 jjdpd.exe 2544 9ppvp.exe 3048 ffrfxlr.exe 1688 frxrfxf.exe 2148 nnhttb.exe 2708 nbhnbh.exe 2876 5dppv.exe 3064 jddjp.exe 1676 lflrfrf.exe 1460 fxlfrxf.exe 1572 3bnnhn.exe 2592 pvdpd.exe 2840 dpvdj.exe 1632 5fflxxr.exe 1516 xxrlflr.exe 1716 5bnnnn.exe 2044 nbhhhh.exe 2084 vpjvd.exe 2244 xrflllr.exe 380 7hhnbh.exe 996 hbhhnb.exe 2072 9dvvp.exe -
Processes:
resource yara_rule behavioral1/memory/1368-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/688-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/608-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/692-274-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a5f436ade0ef59fdb5d68f1b6151a5b0_NeikiAnalytics.exehhtbnt.exepjjdj.exe1dvdd.exehtthhn.exe7pddj.exerfxfffl.exebthnbn.exe3vjdj.exelfxlrrx.exelxllrrx.exetnhntt.exeppjjp.exevjpjj.exexlxxffl.exehnhbbb.exedescription pid process target process PID 1368 wrote to memory of 2412 1368 a5f436ade0ef59fdb5d68f1b6151a5b0_NeikiAnalytics.exe hhtbnt.exe PID 1368 wrote to memory of 2412 1368 a5f436ade0ef59fdb5d68f1b6151a5b0_NeikiAnalytics.exe hhtbnt.exe PID 1368 wrote to memory of 2412 1368 a5f436ade0ef59fdb5d68f1b6151a5b0_NeikiAnalytics.exe hhtbnt.exe PID 1368 wrote to memory of 2412 1368 a5f436ade0ef59fdb5d68f1b6151a5b0_NeikiAnalytics.exe hhtbnt.exe PID 2412 wrote to memory of 2296 2412 hhtbnt.exe pjjdj.exe PID 2412 wrote to memory of 2296 2412 hhtbnt.exe pjjdj.exe PID 2412 wrote to memory of 2296 2412 hhtbnt.exe pjjdj.exe PID 2412 wrote to memory of 2296 2412 hhtbnt.exe pjjdj.exe PID 2296 wrote to memory of 2664 2296 pjjdj.exe 1dvdd.exe PID 2296 wrote to memory of 2664 2296 pjjdj.exe 1dvdd.exe PID 2296 wrote to memory of 2664 2296 pjjdj.exe 1dvdd.exe PID 2296 wrote to memory of 2664 2296 pjjdj.exe 1dvdd.exe PID 2664 wrote to memory of 2796 2664 1dvdd.exe htthhn.exe PID 2664 wrote to memory of 2796 2664 1dvdd.exe htthhn.exe PID 2664 wrote to memory of 2796 2664 1dvdd.exe htthhn.exe PID 2664 wrote to memory of 2796 2664 1dvdd.exe htthhn.exe PID 2796 wrote to memory of 2960 2796 htthhn.exe 7pddj.exe PID 2796 wrote to memory of 2960 2796 htthhn.exe 7pddj.exe PID 2796 wrote to memory of 2960 2796 htthhn.exe 7pddj.exe PID 2796 wrote to memory of 2960 2796 htthhn.exe 7pddj.exe PID 2960 wrote to memory of 2552 2960 7pddj.exe rfxfffl.exe PID 2960 wrote to memory of 2552 2960 7pddj.exe rfxfffl.exe PID 2960 wrote to memory of 2552 2960 7pddj.exe rfxfffl.exe PID 2960 wrote to memory of 2552 2960 7pddj.exe rfxfffl.exe PID 2552 wrote to memory of 2692 2552 rfxfffl.exe bthnbn.exe PID 2552 wrote to memory of 2692 2552 rfxfffl.exe bthnbn.exe PID 2552 wrote to memory of 2692 2552 rfxfffl.exe bthnbn.exe PID 2552 wrote to memory of 2692 2552 rfxfffl.exe bthnbn.exe PID 2692 wrote to memory of 2568 2692 bthnbn.exe 3vjdj.exe PID 2692 wrote to memory of 2568 2692 bthnbn.exe 3vjdj.exe PID 2692 wrote to memory of 2568 2692 bthnbn.exe 3vjdj.exe PID 2692 wrote to memory of 2568 2692 bthnbn.exe 3vjdj.exe PID 2568 wrote to memory of 2148 2568 3vjdj.exe lfxlrrx.exe PID 2568 wrote to memory of 2148 2568 3vjdj.exe lfxlrrx.exe PID 2568 wrote to memory of 2148 2568 3vjdj.exe lfxlrrx.exe PID 2568 wrote to memory of 2148 2568 3vjdj.exe lfxlrrx.exe PID 2148 wrote to memory of 2184 2148 lfxlrrx.exe lxllrrx.exe PID 2148 wrote to memory of 2184 2148 lfxlrrx.exe lxllrrx.exe PID 2148 wrote to memory of 2184 2148 lfxlrrx.exe lxllrrx.exe PID 2148 wrote to memory of 2184 2148 lfxlrrx.exe lxllrrx.exe PID 2184 wrote to memory of 2892 2184 lxllrrx.exe tnhntt.exe PID 2184 wrote to memory of 2892 2184 lxllrrx.exe tnhntt.exe PID 2184 wrote to memory of 2892 2184 lxllrrx.exe tnhntt.exe PID 2184 wrote to memory of 2892 2184 lxllrrx.exe tnhntt.exe PID 2892 wrote to memory of 3036 2892 tnhntt.exe ppjjp.exe PID 2892 wrote to memory of 3036 2892 tnhntt.exe ppjjp.exe PID 2892 wrote to memory of 3036 2892 tnhntt.exe ppjjp.exe PID 2892 wrote to memory of 3036 2892 tnhntt.exe ppjjp.exe PID 3036 wrote to memory of 688 3036 ppjjp.exe vjpjj.exe PID 3036 wrote to memory of 688 3036 ppjjp.exe vjpjj.exe PID 3036 wrote to memory of 688 3036 ppjjp.exe vjpjj.exe PID 3036 wrote to memory of 688 3036 ppjjp.exe vjpjj.exe PID 688 wrote to memory of 1572 688 vjpjj.exe xlxxffl.exe PID 688 wrote to memory of 1572 688 vjpjj.exe xlxxffl.exe PID 688 wrote to memory of 1572 688 vjpjj.exe xlxxffl.exe PID 688 wrote to memory of 1572 688 vjpjj.exe xlxxffl.exe PID 1572 wrote to memory of 1828 1572 xlxxffl.exe hnhbbb.exe PID 1572 wrote to memory of 1828 1572 xlxxffl.exe hnhbbb.exe PID 1572 wrote to memory of 1828 1572 xlxxffl.exe hnhbbb.exe PID 1572 wrote to memory of 1828 1572 xlxxffl.exe hnhbbb.exe PID 1828 wrote to memory of 764 1828 hnhbbb.exe 7nbnnn.exe PID 1828 wrote to memory of 764 1828 hnhbbb.exe 7nbnnn.exe PID 1828 wrote to memory of 764 1828 hnhbbb.exe 7nbnnn.exe PID 1828 wrote to memory of 764 1828 hnhbbb.exe 7nbnnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5f436ade0ef59fdb5d68f1b6151a5b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a5f436ade0ef59fdb5d68f1b6151a5b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\hhtbnt.exec:\hhtbnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\pjjdj.exec:\pjjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\1dvdd.exec:\1dvdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\htthhn.exec:\htthhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\7pddj.exec:\7pddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\rfxfffl.exec:\rfxfffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\bthnbn.exec:\bthnbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\3vjdj.exec:\3vjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\lfxlrrx.exec:\lfxlrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\lxllrrx.exec:\lxllrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\tnhntt.exec:\tnhntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\ppjjp.exec:\ppjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\vjpjj.exec:\vjpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\xlxxffl.exec:\xlxxffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\hnhbbb.exec:\hnhbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\7nbnnn.exec:\7nbnnn.exe17⤵
- Executes dropped EXE
PID:764 -
\??\c:\jddpp.exec:\jddpp.exe18⤵
- Executes dropped EXE
PID:1912 -
\??\c:\pjvdj.exec:\pjvdj.exe19⤵
- Executes dropped EXE
PID:1540 -
\??\c:\xrfflrx.exec:\xrfflrx.exe20⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7bthnb.exec:\7bthnb.exe21⤵
- Executes dropped EXE
PID:2328 -
\??\c:\9pddj.exec:\9pddj.exe22⤵
- Executes dropped EXE
PID:1076 -
\??\c:\vpjpp.exec:\vpjpp.exe23⤵
- Executes dropped EXE
PID:1948 -
\??\c:\5xxrffl.exec:\5xxrffl.exe24⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bbtbht.exec:\bbtbht.exe25⤵
- Executes dropped EXE
PID:1044 -
\??\c:\pjddv.exec:\pjddv.exe26⤵
- Executes dropped EXE
PID:2376 -
\??\c:\vpjpp.exec:\vpjpp.exe27⤵
- Executes dropped EXE
PID:1536 -
\??\c:\5llxflr.exec:\5llxflr.exe28⤵
- Executes dropped EXE
PID:608 -
\??\c:\nhtbnh.exec:\nhtbnh.exe29⤵
- Executes dropped EXE
PID:1652 -
\??\c:\vvpjd.exec:\vvpjd.exe30⤵
- Executes dropped EXE
PID:692 -
\??\c:\rrfrffl.exec:\rrfrffl.exe31⤵
- Executes dropped EXE
PID:1768 -
\??\c:\llxxxfr.exec:\llxxxfr.exe32⤵
- Executes dropped EXE
PID:1276 -
\??\c:\hbbbhn.exec:\hbbbhn.exe33⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3ddjv.exec:\3ddjv.exe34⤵
- Executes dropped EXE
PID:2320 -
\??\c:\jdpdd.exec:\jdpdd.exe35⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xxrxrxl.exec:\xxrxrxl.exe36⤵
- Executes dropped EXE
PID:496 -
\??\c:\nhnthn.exec:\nhnthn.exe37⤵
- Executes dropped EXE
PID:2152 -
\??\c:\9bnhhh.exec:\9bnhhh.exe38⤵
- Executes dropped EXE
PID:1380 -
\??\c:\dvjpv.exec:\dvjpv.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jjvvp.exec:\jjvvp.exe40⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xrlfrrx.exec:\xrlfrrx.exe41⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nnnbnt.exec:\nnnbnt.exe42⤵
- Executes dropped EXE
PID:2808 -
\??\c:\1tbtbb.exec:\1tbtbb.exe43⤵
- Executes dropped EXE
PID:1316 -
\??\c:\jjdpd.exec:\jjdpd.exe44⤵
- Executes dropped EXE
PID:2572 -
\??\c:\9ppvp.exec:\9ppvp.exe45⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ffrfxlr.exec:\ffrfxlr.exe46⤵
- Executes dropped EXE
PID:3048 -
\??\c:\frxrfxf.exec:\frxrfxf.exe47⤵
- Executes dropped EXE
PID:1688 -
\??\c:\nnhttb.exec:\nnhttb.exe48⤵
- Executes dropped EXE
PID:2148 -
\??\c:\nbhnbh.exec:\nbhnbh.exe49⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5dppv.exec:\5dppv.exe50⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jddjp.exec:\jddjp.exe51⤵
- Executes dropped EXE
PID:3064 -
\??\c:\lflrfrf.exec:\lflrfrf.exe52⤵
- Executes dropped EXE
PID:1676 -
\??\c:\fxlfrxf.exec:\fxlfrxf.exe53⤵
- Executes dropped EXE
PID:1460 -
\??\c:\3bnnhn.exec:\3bnnhn.exe54⤵
- Executes dropped EXE
PID:1572 -
\??\c:\pvdpd.exec:\pvdpd.exe55⤵
- Executes dropped EXE
PID:2592 -
\??\c:\dpvdj.exec:\dpvdj.exe56⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5fflxxr.exec:\5fflxxr.exe57⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xxrlflr.exec:\xxrlflr.exe58⤵
- Executes dropped EXE
PID:1516 -
\??\c:\5bnnnn.exec:\5bnnnn.exe59⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nbhhhh.exec:\nbhhhh.exe60⤵
- Executes dropped EXE
PID:2044 -
\??\c:\vpjvd.exec:\vpjvd.exe61⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xrflllr.exec:\xrflllr.exe62⤵
- Executes dropped EXE
PID:2244 -
\??\c:\7hhnbh.exec:\7hhnbh.exe63⤵
- Executes dropped EXE
PID:380 -
\??\c:\hbhhnb.exec:\hbhhnb.exe64⤵
- Executes dropped EXE
PID:996 -
\??\c:\9dvvp.exec:\9dvvp.exe65⤵
- Executes dropped EXE
PID:2072 -
\??\c:\vvpvd.exec:\vvpvd.exe66⤵PID:564
-
\??\c:\frxrxrr.exec:\frxrxrr.exe67⤵PID:2376
-
\??\c:\nntnth.exec:\nntnth.exe68⤵PID:1536
-
\??\c:\ttntnn.exec:\ttntnn.exe69⤵PID:1656
-
\??\c:\tnhnth.exec:\tnhnth.exe70⤵PID:1140
-
\??\c:\vppvd.exec:\vppvd.exe71⤵PID:2428
-
\??\c:\fflllxf.exec:\fflllxf.exe72⤵PID:612
-
\??\c:\ffrflxl.exec:\ffrflxl.exe73⤵PID:2108
-
\??\c:\hnhtbb.exec:\hnhtbb.exe74⤵PID:884
-
\??\c:\btnbnb.exec:\btnbnb.exe75⤵PID:1944
-
\??\c:\dddjj.exec:\dddjj.exe76⤵PID:2944
-
\??\c:\jjvvd.exec:\jjvvd.exe77⤵PID:2164
-
\??\c:\rlrxfrf.exec:\rlrxfrf.exe78⤵PID:2356
-
\??\c:\tthnbn.exec:\tthnbn.exe79⤵PID:2128
-
\??\c:\nnbtth.exec:\nnbtth.exe80⤵PID:2672
-
\??\c:\pppjv.exec:\pppjv.exe81⤵PID:2776
-
\??\c:\dpppd.exec:\dpppd.exe82⤵PID:2648
-
\??\c:\3rlfrfr.exec:\3rlfrfr.exe83⤵PID:2560
-
\??\c:\rrfllrx.exec:\rrfllrx.exe84⤵PID:2960
-
\??\c:\nntbnt.exec:\nntbnt.exe85⤵PID:2688
-
\??\c:\nhtbnt.exec:\nhtbnt.exe86⤵PID:2724
-
\??\c:\vpppp.exec:\vpppp.exe87⤵PID:2600
-
\??\c:\3vpvv.exec:\3vpvv.exe88⤵PID:2576
-
\??\c:\fffrlxl.exec:\fffrlxl.exe89⤵PID:468
-
\??\c:\ffxlrlx.exec:\ffxlrlx.exe90⤵PID:2932
-
\??\c:\hnhbbn.exec:\hnhbbn.exe91⤵PID:2904
-
\??\c:\btbbhn.exec:\btbbhn.exe92⤵PID:1972
-
\??\c:\dvddp.exec:\dvddp.exe93⤵PID:3036
-
\??\c:\dvppd.exec:\dvppd.exe94⤵PID:1616
-
\??\c:\lfxxlrf.exec:\lfxxlrf.exe95⤵PID:2764
-
\??\c:\ffxlxff.exec:\ffxlxff.exe96⤵PID:1628
-
\??\c:\hbnbhn.exec:\hbnbhn.exe97⤵PID:2852
-
\??\c:\tnhntb.exec:\tnhntb.exe98⤵PID:2624
-
\??\c:\vvvjp.exec:\vvvjp.exe99⤵PID:2104
-
\??\c:\xlrrrxr.exec:\xlrrrxr.exe100⤵PID:2116
-
\??\c:\xrrxflx.exec:\xrrxflx.exe101⤵PID:1064
-
\??\c:\tthhtt.exec:\tthhtt.exe102⤵PID:1508
-
\??\c:\9pjjv.exec:\9pjjv.exe103⤵PID:2976
-
\??\c:\ddvdd.exec:\ddvdd.exe104⤵PID:264
-
\??\c:\3ffrfrf.exec:\3ffrfrf.exe105⤵PID:984
-
\??\c:\rlrrllr.exec:\rlrrllr.exe106⤵PID:284
-
\??\c:\tnthhh.exec:\tnthhh.exe107⤵PID:1488
-
\??\c:\tttbhb.exec:\tttbhb.exe108⤵PID:980
-
\??\c:\jdvvd.exec:\jdvvd.exe109⤵PID:1804
-
\??\c:\jdpdp.exec:\jdpdp.exe110⤵PID:1612
-
\??\c:\rlxfffl.exec:\rlxfffl.exe111⤵PID:900
-
\??\c:\3rrxfrf.exec:\3rrxfrf.exe112⤵PID:1640
-
\??\c:\nhnntt.exec:\nhnntt.exe113⤵PID:2232
-
\??\c:\ttttbb.exec:\ttttbb.exe114⤵PID:2480
-
\??\c:\jdppj.exec:\jdppj.exe115⤵PID:2360
-
\??\c:\ppdvd.exec:\ppdvd.exe116⤵PID:1964
-
\??\c:\3llxlxr.exec:\3llxlxr.exe117⤵PID:2316
-
\??\c:\rlfllrf.exec:\rlfllrf.exe118⤵PID:1196
-
\??\c:\btntbh.exec:\btntbh.exe119⤵PID:1592
-
\??\c:\nnhntn.exec:\nnhntn.exe120⤵PID:496
-
\??\c:\jjjpd.exec:\jjjpd.exe121⤵PID:2628
-
\??\c:\vpjpj.exec:\vpjpj.exe122⤵PID:2740
-
\??\c:\7frrflf.exec:\7frrflf.exe123⤵PID:2668
-
\??\c:\fxxxlfr.exec:\fxxxlfr.exe124⤵PID:2796
-
\??\c:\hbntbn.exec:\hbntbn.exe125⤵PID:2788
-
\??\c:\7bbbtn.exec:\7bbbtn.exe126⤵PID:2760
-
\??\c:\pjvdp.exec:\pjvdp.exe127⤵PID:2792
-
\??\c:\jddjp.exec:\jddjp.exe128⤵PID:2572
-
\??\c:\1lflxlx.exec:\1lflxlx.exe129⤵PID:2556
-
\??\c:\ffxfffr.exec:\ffxfffr.exe130⤵PID:1072
-
\??\c:\ttnhbh.exec:\ttnhbh.exe131⤵PID:1880
-
\??\c:\bnbhhh.exec:\bnbhhh.exe132⤵PID:2184
-
\??\c:\3vjpp.exec:\3vjpp.exe133⤵PID:2896
-
\??\c:\1jdpv.exec:\1jdpv.exe134⤵PID:2876
-
\??\c:\jdvpp.exec:\jdvpp.exe135⤵PID:2564
-
\??\c:\llxxllf.exec:\llxxllf.exe136⤵PID:1676
-
\??\c:\hhbbnn.exec:\hhbbnn.exe137⤵PID:1680
-
\??\c:\bbbbnt.exec:\bbbbnt.exe138⤵PID:1572
-
\??\c:\vdjjd.exec:\vdjjd.exe139⤵PID:1820
-
\??\c:\dvdjp.exec:\dvdjp.exe140⤵PID:1912
-
\??\c:\lfxlfrx.exec:\lfxlfrx.exe141⤵PID:1520
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe142⤵PID:1696
-
\??\c:\hhbhnn.exec:\hhbhnn.exe143⤵PID:2980
-
\??\c:\jjvdv.exec:\jjvdv.exe144⤵PID:2900
-
\??\c:\5xllrxl.exec:\5xllrxl.exe145⤵PID:2752
-
\??\c:\nhhnbh.exec:\nhhnbh.exe146⤵PID:2348
-
\??\c:\tnhntn.exec:\tnhntn.exe147⤵PID:484
-
\??\c:\3nnbnn.exec:\3nnbnn.exe148⤵PID:588
-
\??\c:\jdvvd.exec:\jdvvd.exe149⤵PID:1620
-
\??\c:\ffxfxlx.exec:\ffxfxlx.exe150⤵PID:1548
-
\??\c:\rxfxxlf.exec:\rxfxxlf.exe151⤵PID:1344
-
\??\c:\hhtntb.exec:\hhtntb.exe152⤵PID:772
-
\??\c:\hhbhnt.exec:\hhbhnt.exe153⤵PID:1656
-
\??\c:\1vpvj.exec:\1vpvj.exe154⤵PID:2272
-
\??\c:\vppvv.exec:\vppvv.exe155⤵PID:2208
-
\??\c:\7rrxflr.exec:\7rrxflr.exe156⤵PID:2100
-
\??\c:\7fflrxl.exec:\7fflrxl.exe157⤵PID:1768
-
\??\c:\1tnbhn.exec:\1tnbhn.exe158⤵PID:3008
-
\??\c:\nhhnbh.exec:\nhhnbh.exe159⤵PID:1600
-
\??\c:\pjdjd.exec:\pjdjd.exe160⤵PID:2604
-
\??\c:\1vjpv.exec:\1vjpv.exe161⤵PID:2476
-
\??\c:\5fxfxlx.exec:\5fxfxlx.exe162⤵PID:2412
-
\??\c:\3lxlllr.exec:\3lxlllr.exe163⤵PID:2296
-
\??\c:\btbnnt.exec:\btbnnt.exe164⤵PID:2372
-
\??\c:\tnbhnn.exec:\tnbhnn.exe165⤵PID:2780
-
\??\c:\9vvdp.exec:\9vvdp.exe166⤵PID:2964
-
\??\c:\vpddj.exec:\vpddj.exe167⤵PID:2804
-
\??\c:\xrrllfl.exec:\xrrllfl.exe168⤵PID:2696
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe169⤵PID:2540
-
\??\c:\1thttb.exec:\1thttb.exe170⤵PID:2524
-
\??\c:\tnhnbb.exec:\tnhnbb.exe171⤵PID:2568
-
\??\c:\dvjjv.exec:\dvjjv.exe172⤵PID:1360
-
\??\c:\9jvvv.exec:\9jvvv.exe173⤵PID:2864
-
\??\c:\frfxxfr.exec:\frfxxfr.exe174⤵PID:2932
-
\??\c:\3rrrffr.exec:\3rrrffr.exe175⤵PID:2904
-
\??\c:\ttnthn.exec:\ttnthn.exe176⤵PID:2876
-
\??\c:\hnhnth.exec:\hnhnth.exe177⤵PID:288
-
\??\c:\9vpjp.exec:\9vpjp.exe178⤵PID:2756
-
\??\c:\dddjp.exec:\dddjp.exe179⤵PID:1980
-
\??\c:\xxxlfrx.exec:\xxxlfrx.exe180⤵PID:2848
-
\??\c:\5lxlxll.exec:\5lxlxll.exe181⤵PID:2620
-
\??\c:\9bbbbb.exec:\9bbbbb.exe182⤵PID:2624
-
\??\c:\nhtbbh.exec:\nhtbbh.exe183⤵PID:1212
-
\??\c:\dddjj.exec:\dddjj.exe184⤵PID:1876
-
\??\c:\vppvp.exec:\vppvp.exe185⤵PID:2056
-
\??\c:\7xlllrl.exec:\7xlllrl.exe186⤵PID:1508
-
\??\c:\rrfxrlr.exec:\rrfxrlr.exe187⤵PID:780
-
\??\c:\hbbtnt.exec:\hbbtnt.exe188⤵PID:560
-
\??\c:\pjdpv.exec:\pjdpv.exe189⤵PID:2508
-
\??\c:\jpvdp.exec:\jpvdp.exe190⤵PID:2304
-
\??\c:\lfrfxxl.exec:\lfrfxxl.exe191⤵PID:1816
-
\??\c:\lfrlxrx.exec:\lfrlxrx.exe192⤵PID:980
-
\??\c:\bbbhbb.exec:\bbbhbb.exe193⤵PID:608
-
\??\c:\htnbbh.exec:\htnbbh.exe194⤵PID:2432
-
\??\c:\jjddj.exec:\jjddj.exe195⤵PID:900
-
\??\c:\xrrrflr.exec:\xrrrflr.exe196⤵PID:692
-
\??\c:\lxfrxxr.exec:\lxfrxxr.exe197⤵PID:2232
-
\??\c:\fxrfxrf.exec:\fxrfxrf.exe198⤵PID:1720
-
\??\c:\tnhnhn.exec:\tnhnhn.exe199⤵PID:2360
-
\??\c:\nnntht.exec:\nnntht.exe200⤵PID:1964
-
\??\c:\1vjpv.exec:\1vjpv.exe201⤵PID:2316
-
\??\c:\jdpdj.exec:\jdpdj.exe202⤵PID:2196
-
\??\c:\rrrfrxr.exec:\rrrfrxr.exe203⤵PID:1592
-
\??\c:\7flxfrr.exec:\7flxfrr.exe204⤵PID:3068
-
\??\c:\nhbnhh.exec:\nhbnhh.exe205⤵PID:2628
-
\??\c:\dddpj.exec:\dddpj.exe206⤵PID:2632
-
\??\c:\jdpjj.exec:\jdpjj.exe207⤵PID:2668
-
\??\c:\fxrfrfr.exec:\fxrfrfr.exe208⤵PID:2712
-
\??\c:\3rflrrx.exec:\3rflrrx.exe209⤵PID:2788
-
\??\c:\bnhhnn.exec:\bnhhnn.exe210⤵PID:2760
-
\??\c:\ttnbnt.exec:\ttnbnt.exe211⤵PID:2792
-
\??\c:\pjddj.exec:\pjddj.exe212⤵PID:2588
-
\??\c:\vpdjp.exec:\vpdjp.exe213⤵PID:3056
-
\??\c:\rrrxllx.exec:\rrrxllx.exe214⤵PID:2888
-
\??\c:\flfrrfr.exec:\flfrrfr.exe215⤵PID:2832
-
\??\c:\htbhhh.exec:\htbhhh.exe216⤵PID:2772
-
\??\c:\bttbhn.exec:\bttbhn.exe217⤵PID:2708
-
\??\c:\dvpjv.exec:\dvpjv.exe218⤵PID:2904
-
\??\c:\jdpvv.exec:\jdpvv.exe219⤵PID:304
-
\??\c:\lxlfllr.exec:\lxlfllr.exe220⤵PID:1960
-
\??\c:\tttthb.exec:\tttthb.exe221⤵PID:1680
-
\??\c:\htnnnh.exec:\htnnnh.exe222⤵PID:1828
-
\??\c:\3djdd.exec:\3djdd.exe223⤵PID:1820
-
\??\c:\jdpdv.exec:\jdpdv.exe224⤵PID:1584
-
\??\c:\rfrlrrx.exec:\rfrlrrx.exe225⤵PID:2260
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe226⤵PID:2024
-
\??\c:\9hnhnh.exec:\9hnhnh.exe227⤵PID:2328
-
\??\c:\1vpdj.exec:\1vpdj.exe228⤵PID:2044
-
\??\c:\ddpvd.exec:\ddpvd.exe229⤵PID:796
-
\??\c:\frxrxxl.exec:\frxrxxl.exe230⤵PID:1100
-
\??\c:\htnntn.exec:\htnntn.exe231⤵PID:484
-
\??\c:\nhnnbb.exec:\nhnnbb.exe232⤵PID:1044
-
\??\c:\pjdjj.exec:\pjdjj.exe233⤵PID:948
-
\??\c:\jdvdj.exec:\jdvdj.exe234⤵PID:352
-
\??\c:\3rxxxrl.exec:\3rxxxrl.exe235⤵PID:1332
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe236⤵PID:908
-
\??\c:\nbtbtb.exec:\nbtbtb.exe237⤵PID:1236
-
\??\c:\7thtbb.exec:\7thtbb.exe238⤵PID:1652
-
\??\c:\jdppp.exec:\jdppp.exe239⤵PID:2452
-
\??\c:\pdvvd.exec:\pdvvd.exe240⤵PID:832
-
\??\c:\xxllfll.exec:\xxllfll.exe241⤵PID:2100
-
\??\c:\lfrxflr.exec:\lfrxflr.exe242⤵PID:1588