Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 16:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ec8298402bc1c199f240b5df36018760_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
ec8298402bc1c199f240b5df36018760_NeikiAnalytics.exe
-
Size
127KB
-
MD5
ec8298402bc1c199f240b5df36018760
-
SHA1
4c2a2ce2f345655c309e528d9890204793492617
-
SHA256
264b7ae25ef559c4240ca2a3262d28708528c286998710c672e154f656d19621
-
SHA512
ca39db8a1ae29419c7a9226bffdcc7f8f91adb6baf4e50c9fe3a6a7e9904be1f886da0b65e8b6c738333344c034ca9e4cc22627a45cf1fde93745975f0724eb4
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afodnmm9Ao98h3dktX4/JL:n3C9BRW0j/tmm9nwytIN
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/1836-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2672-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1364-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-82-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3356-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/984-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1192-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
flfffxx.exellfffxx.exehtttbb.exetthhbb.exe1pjdv.exe1frxllf.exe5rrrlfx.exetnttbb.exenhtntt.exepvdvp.exeffxrrll.exexrxrrxr.exebtnnhh.exe3dpjd.exepdjdd.exexxlflfr.exexrlfxxx.exe7bbhbt.exe1jvpv.exe5pppv.exefrxrrrl.exefxrrffx.exennnntb.exehhbbtt.exejdjdv.exexflfxrr.exe1lffxxr.exetntnnn.exethnhbb.exe1pvpd.exe7rxrrrr.exeffxxffl.exe5nhhbb.exetnnhhh.exepjpjp.exeddjvd.exelxxrllf.exenhnhnn.exenbnntn.exevjddv.exepdjvp.exelfxrlrr.exetnhbnh.exe9ddvv.exepvddp.exexffxllf.exebnnhtn.exehbtnhb.exe5vpdd.exelxlxlfr.exe3xffxxr.exehhhtht.exebnnbnh.exedppjd.exevvvpj.exerlxrlfx.exelxfflfl.exennhhtn.exenhtnbt.exe9dpdd.exe3xxxlfx.exe5fllfxr.exetnhbbb.exe5tnhtn.exepid process 1936 flfffxx.exe 4928 llfffxx.exe 1928 htttbb.exe 2104 tthhbb.exe 1364 1pjdv.exe 2672 1frxllf.exe 2772 5rrrlfx.exe 5056 tnttbb.exe 3688 nhtntt.exe 2680 pvdvp.exe 2992 ffxrrll.exe 4772 xrxrrxr.exe 3356 btnnhh.exe 3020 3dpjd.exe 3060 pdjdd.exe 2700 xxlflfr.exe 1016 xrlfxxx.exe 984 7bbhbt.exe 2288 1jvpv.exe 1460 5pppv.exe 5020 frxrrrl.exe 3692 fxrrffx.exe 2568 nnnntb.exe 3560 hhbbtt.exe 1192 jdjdv.exe 1280 xflfxrr.exe 4336 1lffxxr.exe 3544 tntnnn.exe 2928 thnhbb.exe 4368 1pvpd.exe 4528 7rxrrrr.exe 5036 ffxxffl.exe 4476 5nhhbb.exe 3272 tnnhhh.exe 4364 pjpjp.exe 1232 ddjvd.exe 4916 lxxrllf.exe 1928 nhnhnn.exe 4980 nbnntn.exe 4512 vjddv.exe 2328 pdjvp.exe 4596 lfxrlrr.exe 2900 tnhbnh.exe 3176 9ddvv.exe 2124 pvddp.exe 3580 xffxllf.exe 3688 bnnhtn.exe 2680 hbtnhb.exe 4088 5vpdd.exe 1256 lxlxlfr.exe 3132 3xffxxr.exe 3216 hhhtht.exe 2412 bnnbnh.exe 2080 dppjd.exe 4444 vvvpj.exe 2988 rlxrlfx.exe 4012 lxfflfl.exe 4216 nnhhtn.exe 784 nhtnbt.exe 984 9dpdd.exe 3784 3xxxlfx.exe 4744 5fllfxr.exe 3148 tnhbbb.exe 2792 5tnhtn.exe -
Processes:
resource yara_rule behavioral2/memory/1836-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2672-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2672-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2672-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1364-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/984-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1192-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ec8298402bc1c199f240b5df36018760_NeikiAnalytics.exeflfffxx.exellfffxx.exehtttbb.exetthhbb.exe1pjdv.exe1frxllf.exe5rrrlfx.exetnttbb.exenhtntt.exepvdvp.exeffxrrll.exexrxrrxr.exebtnnhh.exe3dpjd.exepdjdd.exexxlflfr.exexrlfxxx.exe7bbhbt.exe1jvpv.exe5pppv.exefrxrrrl.exedescription pid process target process PID 1836 wrote to memory of 1936 1836 ec8298402bc1c199f240b5df36018760_NeikiAnalytics.exe flfffxx.exe PID 1836 wrote to memory of 1936 1836 ec8298402bc1c199f240b5df36018760_NeikiAnalytics.exe flfffxx.exe PID 1836 wrote to memory of 1936 1836 ec8298402bc1c199f240b5df36018760_NeikiAnalytics.exe flfffxx.exe PID 1936 wrote to memory of 4928 1936 flfffxx.exe llfffxx.exe PID 1936 wrote to memory of 4928 1936 flfffxx.exe llfffxx.exe PID 1936 wrote to memory of 4928 1936 flfffxx.exe llfffxx.exe PID 4928 wrote to memory of 1928 4928 llfffxx.exe nhnhnn.exe PID 4928 wrote to memory of 1928 4928 llfffxx.exe nhnhnn.exe PID 4928 wrote to memory of 1928 4928 llfffxx.exe nhnhnn.exe PID 1928 wrote to memory of 2104 1928 htttbb.exe tthhbb.exe PID 1928 wrote to memory of 2104 1928 htttbb.exe tthhbb.exe PID 1928 wrote to memory of 2104 1928 htttbb.exe tthhbb.exe PID 2104 wrote to memory of 1364 2104 tthhbb.exe 1pjdv.exe PID 2104 wrote to memory of 1364 2104 tthhbb.exe 1pjdv.exe PID 2104 wrote to memory of 1364 2104 tthhbb.exe 1pjdv.exe PID 1364 wrote to memory of 2672 1364 1pjdv.exe 1frxllf.exe PID 1364 wrote to memory of 2672 1364 1pjdv.exe 1frxllf.exe PID 1364 wrote to memory of 2672 1364 1pjdv.exe 1frxllf.exe PID 2672 wrote to memory of 2772 2672 1frxllf.exe 5rrrlfx.exe PID 2672 wrote to memory of 2772 2672 1frxllf.exe 5rrrlfx.exe PID 2672 wrote to memory of 2772 2672 1frxllf.exe 5rrrlfx.exe PID 2772 wrote to memory of 5056 2772 5rrrlfx.exe tnttbb.exe PID 2772 wrote to memory of 5056 2772 5rrrlfx.exe tnttbb.exe PID 2772 wrote to memory of 5056 2772 5rrrlfx.exe tnttbb.exe PID 5056 wrote to memory of 3688 5056 tnttbb.exe bnnhtn.exe PID 5056 wrote to memory of 3688 5056 tnttbb.exe bnnhtn.exe PID 5056 wrote to memory of 3688 5056 tnttbb.exe bnnhtn.exe PID 3688 wrote to memory of 2680 3688 nhtntt.exe hbtnhb.exe PID 3688 wrote to memory of 2680 3688 nhtntt.exe hbtnhb.exe PID 3688 wrote to memory of 2680 3688 nhtntt.exe hbtnhb.exe PID 2680 wrote to memory of 2992 2680 pvdvp.exe ffxrrll.exe PID 2680 wrote to memory of 2992 2680 pvdvp.exe ffxrrll.exe PID 2680 wrote to memory of 2992 2680 pvdvp.exe ffxrrll.exe PID 2992 wrote to memory of 4772 2992 ffxrrll.exe xrxrrxr.exe PID 2992 wrote to memory of 4772 2992 ffxrrll.exe xrxrrxr.exe PID 2992 wrote to memory of 4772 2992 ffxrrll.exe xrxrrxr.exe PID 4772 wrote to memory of 3356 4772 xrxrrxr.exe btnnhh.exe PID 4772 wrote to memory of 3356 4772 xrxrrxr.exe btnnhh.exe PID 4772 wrote to memory of 3356 4772 xrxrrxr.exe btnnhh.exe PID 3356 wrote to memory of 3020 3356 btnnhh.exe 3dpjd.exe PID 3356 wrote to memory of 3020 3356 btnnhh.exe 3dpjd.exe PID 3356 wrote to memory of 3020 3356 btnnhh.exe 3dpjd.exe PID 3020 wrote to memory of 3060 3020 3dpjd.exe pdjdd.exe PID 3020 wrote to memory of 3060 3020 3dpjd.exe pdjdd.exe PID 3020 wrote to memory of 3060 3020 3dpjd.exe pdjdd.exe PID 3060 wrote to memory of 2700 3060 pdjdd.exe xxlflfr.exe PID 3060 wrote to memory of 2700 3060 pdjdd.exe xxlflfr.exe PID 3060 wrote to memory of 2700 3060 pdjdd.exe xxlflfr.exe PID 2700 wrote to memory of 1016 2700 xxlflfr.exe xrlfxxx.exe PID 2700 wrote to memory of 1016 2700 xxlflfr.exe xrlfxxx.exe PID 2700 wrote to memory of 1016 2700 xxlflfr.exe xrlfxxx.exe PID 1016 wrote to memory of 984 1016 xrlfxxx.exe 9dpdd.exe PID 1016 wrote to memory of 984 1016 xrlfxxx.exe 9dpdd.exe PID 1016 wrote to memory of 984 1016 xrlfxxx.exe 9dpdd.exe PID 984 wrote to memory of 2288 984 7bbhbt.exe 1jvpv.exe PID 984 wrote to memory of 2288 984 7bbhbt.exe 1jvpv.exe PID 984 wrote to memory of 2288 984 7bbhbt.exe 1jvpv.exe PID 2288 wrote to memory of 1460 2288 1jvpv.exe 5pppv.exe PID 2288 wrote to memory of 1460 2288 1jvpv.exe 5pppv.exe PID 2288 wrote to memory of 1460 2288 1jvpv.exe 5pppv.exe PID 1460 wrote to memory of 5020 1460 5pppv.exe frxrrrl.exe PID 1460 wrote to memory of 5020 1460 5pppv.exe frxrrrl.exe PID 1460 wrote to memory of 5020 1460 5pppv.exe frxrrrl.exe PID 5020 wrote to memory of 3692 5020 frxrrrl.exe fxrrffx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec8298402bc1c199f240b5df36018760_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ec8298402bc1c199f240b5df36018760_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\flfffxx.exec:\flfffxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\llfffxx.exec:\llfffxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\htttbb.exec:\htttbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\tthhbb.exec:\tthhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\1pjdv.exec:\1pjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\1frxllf.exec:\1frxllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\5rrrlfx.exec:\5rrrlfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\tnttbb.exec:\tnttbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\nhtntt.exec:\nhtntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\pvdvp.exec:\pvdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\ffxrrll.exec:\ffxrrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\xrxrrxr.exec:\xrxrrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\btnnhh.exec:\btnnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\3dpjd.exec:\3dpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\pdjdd.exec:\pdjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\xxlflfr.exec:\xxlflfr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\xrlfxxx.exec:\xrlfxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\7bbhbt.exec:\7bbhbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\1jvpv.exec:\1jvpv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\5pppv.exec:\5pppv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\frxrrrl.exec:\frxrrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\fxrrffx.exec:\fxrrffx.exe23⤵
- Executes dropped EXE
PID:3692 -
\??\c:\nnnntb.exec:\nnnntb.exe24⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hhbbtt.exec:\hhbbtt.exe25⤵
- Executes dropped EXE
PID:3560 -
\??\c:\jdjdv.exec:\jdjdv.exe26⤵
- Executes dropped EXE
PID:1192 -
\??\c:\xflfxrr.exec:\xflfxrr.exe27⤵
- Executes dropped EXE
PID:1280 -
\??\c:\1lffxxr.exec:\1lffxxr.exe28⤵
- Executes dropped EXE
PID:4336 -
\??\c:\tntnnn.exec:\tntnnn.exe29⤵
- Executes dropped EXE
PID:3544 -
\??\c:\thnhbb.exec:\thnhbb.exe30⤵
- Executes dropped EXE
PID:2928 -
\??\c:\1pvpd.exec:\1pvpd.exe31⤵
- Executes dropped EXE
PID:4368 -
\??\c:\7rxrrrr.exec:\7rxrrrr.exe32⤵
- Executes dropped EXE
PID:4528 -
\??\c:\ffxxffl.exec:\ffxxffl.exe33⤵
- Executes dropped EXE
PID:5036 -
\??\c:\5nhhbb.exec:\5nhhbb.exe34⤵
- Executes dropped EXE
PID:4476 -
\??\c:\tnnhhh.exec:\tnnhhh.exe35⤵
- Executes dropped EXE
PID:3272 -
\??\c:\pjpjp.exec:\pjpjp.exe36⤵
- Executes dropped EXE
PID:4364 -
\??\c:\ddjvd.exec:\ddjvd.exe37⤵
- Executes dropped EXE
PID:1232 -
\??\c:\lxxrllf.exec:\lxxrllf.exe38⤵
- Executes dropped EXE
PID:4916 -
\??\c:\nhnhnn.exec:\nhnhnn.exe39⤵
- Executes dropped EXE
PID:1928 -
\??\c:\nbnntn.exec:\nbnntn.exe40⤵
- Executes dropped EXE
PID:4980 -
\??\c:\vjddv.exec:\vjddv.exe41⤵
- Executes dropped EXE
PID:4512 -
\??\c:\pdjvp.exec:\pdjvp.exe42⤵
- Executes dropped EXE
PID:2328 -
\??\c:\lfxrlrr.exec:\lfxrlrr.exe43⤵
- Executes dropped EXE
PID:4596 -
\??\c:\tnhbnh.exec:\tnhbnh.exe44⤵
- Executes dropped EXE
PID:2900 -
\??\c:\9ddvv.exec:\9ddvv.exe45⤵
- Executes dropped EXE
PID:3176 -
\??\c:\pvddp.exec:\pvddp.exe46⤵
- Executes dropped EXE
PID:2124 -
\??\c:\xffxllf.exec:\xffxllf.exe47⤵
- Executes dropped EXE
PID:3580 -
\??\c:\bnnhtn.exec:\bnnhtn.exe48⤵
- Executes dropped EXE
PID:3688 -
\??\c:\hbtnhb.exec:\hbtnhb.exe49⤵
- Executes dropped EXE
PID:2680 -
\??\c:\5vpdd.exec:\5vpdd.exe50⤵
- Executes dropped EXE
PID:4088 -
\??\c:\lxlxlfr.exec:\lxlxlfr.exe51⤵
- Executes dropped EXE
PID:1256 -
\??\c:\3xffxxr.exec:\3xffxxr.exe52⤵
- Executes dropped EXE
PID:3132 -
\??\c:\hhhtht.exec:\hhhtht.exe53⤵
- Executes dropped EXE
PID:3216 -
\??\c:\bnnbnh.exec:\bnnbnh.exe54⤵
- Executes dropped EXE
PID:2412 -
\??\c:\dppjd.exec:\dppjd.exe55⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vvvpj.exec:\vvvpj.exe56⤵
- Executes dropped EXE
PID:4444 -
\??\c:\rlxrlfx.exec:\rlxrlfx.exe57⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lxfflfl.exec:\lxfflfl.exe58⤵
- Executes dropped EXE
PID:4012 -
\??\c:\nnhhtn.exec:\nnhhtn.exe59⤵
- Executes dropped EXE
PID:4216 -
\??\c:\nhtnbt.exec:\nhtnbt.exe60⤵
- Executes dropped EXE
PID:784 -
\??\c:\9dpdd.exec:\9dpdd.exe61⤵
- Executes dropped EXE
PID:984 -
\??\c:\3xxxlfx.exec:\3xxxlfx.exe62⤵
- Executes dropped EXE
PID:3784 -
\??\c:\5fllfxr.exec:\5fllfxr.exe63⤵
- Executes dropped EXE
PID:4744 -
\??\c:\tnhbbb.exec:\tnhbbb.exe64⤵
- Executes dropped EXE
PID:3148 -
\??\c:\5tnhtn.exec:\5tnhtn.exe65⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pvpjd.exec:\pvpjd.exe66⤵PID:544
-
\??\c:\vpvpj.exec:\vpvpj.exe67⤵PID:2568
-
\??\c:\1xrfrlx.exec:\1xrfrlx.exe68⤵PID:2244
-
\??\c:\rfxrxrx.exec:\rfxrxrx.exe69⤵PID:1464
-
\??\c:\3hbnbt.exec:\3hbnbt.exe70⤵PID:3928
-
\??\c:\nbtnhb.exec:\nbtnhb.exe71⤵PID:3488
-
\??\c:\ddpdj.exec:\ddpdj.exe72⤵PID:5040
-
\??\c:\ddvpj.exec:\ddvpj.exe73⤵PID:4336
-
\??\c:\fxrllff.exec:\fxrllff.exe74⤵PID:3100
-
\??\c:\lxxrllf.exec:\lxxrllf.exe75⤵PID:1452
-
\??\c:\hbhbtn.exec:\hbhbtn.exe76⤵PID:2500
-
\??\c:\nntthh.exec:\nntthh.exe77⤵PID:4852
-
\??\c:\3pjvj.exec:\3pjvj.exe78⤵PID:2388
-
\??\c:\vdjjv.exec:\vdjjv.exe79⤵PID:5092
-
\??\c:\xllfxlf.exec:\xllfxlf.exe80⤵PID:4840
-
\??\c:\lxrlxlf.exec:\lxrlxlf.exe81⤵PID:1836
-
\??\c:\hhnbnh.exec:\hhnbnh.exe82⤵PID:2140
-
\??\c:\nhhtnb.exec:\nhhtnb.exe83⤵PID:1936
-
\??\c:\pdjjp.exec:\pdjjp.exe84⤵PID:528
-
\??\c:\pvppv.exec:\pvppv.exe85⤵PID:1368
-
\??\c:\xlfrfrl.exec:\xlfrfrl.exe86⤵PID:2872
-
\??\c:\lffrlxr.exec:\lffrlxr.exe87⤵PID:2300
-
\??\c:\nnhhbb.exec:\nnhhbb.exe88⤵PID:916
-
\??\c:\nhhttn.exec:\nhhttn.exe89⤵PID:5104
-
\??\c:\jpjvp.exec:\jpjvp.exe90⤵PID:2392
-
\??\c:\pjdvv.exec:\pjdvv.exe91⤵PID:4144
-
\??\c:\5flrlrl.exec:\5flrlrl.exe92⤵PID:2340
-
\??\c:\rxfrfxr.exec:\rxfrfxr.exe93⤵PID:1912
-
\??\c:\lrxfrlf.exec:\lrxfrlf.exe94⤵PID:4316
-
\??\c:\hnhtnb.exec:\hnhtnb.exe95⤵PID:2848
-
\??\c:\vjjjv.exec:\vjjjv.exe96⤵PID:3360
-
\??\c:\rfxxffl.exec:\rfxxffl.exe97⤵PID:2608
-
\??\c:\dpppj.exec:\dpppj.exe98⤵PID:1256
-
\??\c:\frrlxrl.exec:\frrlxrl.exe99⤵PID:2840
-
\??\c:\nnnnnn.exec:\nnnnnn.exe100⤵PID:3216
-
\??\c:\pdjjp.exec:\pdjjp.exe101⤵PID:4900
-
\??\c:\vdddj.exec:\vdddj.exe102⤵PID:2080
-
\??\c:\frrfrlf.exec:\frrfrlf.exe103⤵PID:3960
-
\??\c:\hnnhtt.exec:\hnnhtt.exe104⤵PID:2988
-
\??\c:\thbbnt.exec:\thbbnt.exe105⤵PID:4012
-
\??\c:\pdjvp.exec:\pdjvp.exe106⤵PID:4224
-
\??\c:\xxrrrrf.exec:\xxrrrrf.exe107⤵PID:2288
-
\??\c:\hnnhnh.exec:\hnnhnh.exe108⤵PID:984
-
\??\c:\pvvjv.exec:\pvvjv.exe109⤵PID:3784
-
\??\c:\dvjvj.exec:\dvjvj.exe110⤵PID:3872
-
\??\c:\xflxfxx.exec:\xflxfxx.exe111⤵PID:3148
-
\??\c:\nhhhhh.exec:\nhhhhh.exe112⤵PID:2792
-
\??\c:\vvdpp.exec:\vvdpp.exe113⤵PID:544
-
\??\c:\vdjvj.exec:\vdjvj.exe114⤵PID:1328
-
\??\c:\xfffxxl.exec:\xfffxxl.exe115⤵PID:2244
-
\??\c:\hbnbbt.exec:\hbnbbt.exe116⤵PID:1464
-
\??\c:\djddp.exec:\djddp.exe117⤵PID:1184
-
\??\c:\1flfffx.exec:\1flfffx.exe118⤵PID:3488
-
\??\c:\nhhbth.exec:\nhhbth.exe119⤵PID:5040
-
\??\c:\djjjj.exec:\djjjj.exe120⤵PID:4336
-
\??\c:\jpjjv.exec:\jpjjv.exe121⤵PID:3188
-
\??\c:\fxfxlll.exec:\fxfxlll.exe122⤵PID:1468
-
\??\c:\vpjpp.exec:\vpjpp.exe123⤵PID:5024
-
\??\c:\nhhbtb.exec:\nhhbtb.exe124⤵PID:372
-
\??\c:\thtttt.exec:\thtttt.exe125⤵PID:2388
-
\??\c:\dvdvj.exec:\dvdvj.exe126⤵PID:5092
-
\??\c:\frrlflf.exec:\frrlflf.exe127⤵PID:3272
-
\??\c:\7hnnbb.exec:\7hnnbb.exe128⤵PID:3940
-
\??\c:\9pjjd.exec:\9pjjd.exe129⤵PID:1624
-
\??\c:\xxllfff.exec:\xxllfff.exe130⤵PID:1936
-
\??\c:\jvppj.exec:\jvppj.exe131⤵PID:3956
-
\??\c:\nbbtnn.exec:\nbbtnn.exe132⤵PID:4504
-
\??\c:\dvdpp.exec:\dvdpp.exe133⤵PID:2104
-
\??\c:\llxxlrx.exec:\llxxlrx.exe134⤵PID:1116
-
\??\c:\7hnhnn.exec:\7hnhnn.exe135⤵PID:760
-
\??\c:\djjjd.exec:\djjjd.exe136⤵PID:2672
-
\??\c:\1bnnnb.exec:\1bnnnb.exe137⤵PID:4872
-
\??\c:\xrrlxxx.exec:\xrrlxxx.exe138⤵PID:1480
-
\??\c:\3frlfxr.exec:\3frlfxr.exe139⤵PID:2340
-
\??\c:\nnhhhh.exec:\nnhhhh.exe140⤵PID:4724
-
\??\c:\pppjj.exec:\pppjj.exe141⤵PID:4100
-
\??\c:\llllxxx.exec:\llllxxx.exe142⤵PID:2420
-
\??\c:\9rxxfff.exec:\9rxxfff.exe143⤵PID:3260
-
\??\c:\hbttnn.exec:\hbttnn.exe144⤵PID:4260
-
\??\c:\7ttnbb.exec:\7ttnbb.exe145⤵PID:2240
-
\??\c:\5vddv.exec:\5vddv.exe146⤵PID:996
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe147⤵PID:2204
-
\??\c:\rfxflll.exec:\rfxflll.exe148⤵PID:1432
-
\??\c:\btbtnn.exec:\btbtnn.exe149⤵PID:1592
-
\??\c:\jvdvp.exec:\jvdvp.exe150⤵PID:2736
-
\??\c:\vvdvd.exec:\vvdvd.exe151⤵PID:2012
-
\??\c:\fffxffl.exec:\fffxffl.exe152⤵PID:4644
-
\??\c:\btttnt.exec:\btttnt.exe153⤵PID:1576
-
\??\c:\tnhbtt.exec:\tnhbtt.exe154⤵PID:1676
-
\??\c:\dvjdj.exec:\dvjdj.exe155⤵PID:1352
-
\??\c:\ppppd.exec:\ppppd.exe156⤵PID:2136
-
\??\c:\1rrfllr.exec:\1rrfllr.exe157⤵PID:2844
-
\??\c:\rflrfxr.exec:\rflrfxr.exe158⤵PID:2628
-
\??\c:\bnnhbb.exec:\bnnhbb.exe159⤵PID:1888
-
\??\c:\5tbnhn.exec:\5tbnhn.exe160⤵PID:3560
-
\??\c:\5vvpd.exec:\5vvpd.exe161⤵PID:3928
-
\??\c:\pjvvd.exec:\pjvvd.exe162⤵PID:4232
-
\??\c:\fflrrlf.exec:\fflrrlf.exe163⤵PID:3684
-
\??\c:\bttnnn.exec:\bttnnn.exe164⤵PID:5040
-
\??\c:\vvddv.exec:\vvddv.exe165⤵PID:4336
-
\??\c:\djpvp.exec:\djpvp.exe166⤵PID:3624
-
\??\c:\xlllfff.exec:\xlllfff.exe167⤵PID:4780
-
\??\c:\hbbtnt.exec:\hbbtnt.exe168⤵PID:3540
-
\??\c:\jvppp.exec:\jvppp.exe169⤵PID:2208
-
\??\c:\vjppj.exec:\vjppj.exe170⤵PID:4536
-
\??\c:\rfffflf.exec:\rfffflf.exe171⤵PID:1496
-
\??\c:\3xxxrrl.exec:\3xxxrrl.exe172⤵PID:3500
-
\??\c:\5hbbbb.exec:\5hbbbb.exe173⤵PID:3324
-
\??\c:\tbhbtn.exec:\tbhbtn.exe174⤵PID:2008
-
\??\c:\7vdvp.exec:\7vdvp.exe175⤵PID:1372
-
\??\c:\jjjvj.exec:\jjjvj.exe176⤵PID:4916
-
\??\c:\flrffxx.exec:\flrffxx.exe177⤵PID:528
-
\??\c:\tnbnbt.exec:\tnbnbt.exe178⤵PID:1936
-
\??\c:\hbbnbn.exec:\hbbnbn.exe179⤵PID:2872
-
\??\c:\vpppd.exec:\vpppd.exe180⤵PID:4984
-
\??\c:\9jddd.exec:\9jddd.exe181⤵PID:2104
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe182⤵PID:3436
-
\??\c:\xfrrrrx.exec:\xfrrrrx.exe183⤵PID:1516
-
\??\c:\hhnnht.exec:\hhnnht.exe184⤵PID:5056
-
\??\c:\nbnnhn.exec:\nbnnhn.exe185⤵PID:4872
-
\??\c:\1pdjd.exec:\1pdjd.exe186⤵PID:1480
-
\??\c:\dvpjd.exec:\dvpjd.exe187⤵PID:4316
-
\??\c:\flrlxfx.exec:\flrlxfx.exe188⤵PID:4876
-
\??\c:\tbbttt.exec:\tbbttt.exe189⤵PID:2588
-
\??\c:\nhhhhn.exec:\nhhhhn.exe190⤵PID:2296
-
\??\c:\9pjjv.exec:\9pjjv.exe191⤵PID:4668
-
\??\c:\1djdp.exec:\1djdp.exe192⤵PID:3252
-
\??\c:\fxfxlxr.exec:\fxfxlxr.exe193⤵PID:4728
-
\??\c:\xxxxlxr.exec:\xxxxlxr.exe194⤵PID:3060
-
\??\c:\htthbt.exec:\htthbt.exe195⤵PID:1360
-
\??\c:\nhbtnt.exec:\nhbtnt.exe196⤵PID:1432
-
\??\c:\9ppvp.exec:\9ppvp.exe197⤵PID:4216
-
\??\c:\rrlrlfr.exec:\rrlrlfr.exe198⤵PID:1120
-
\??\c:\lfxlfrl.exec:\lfxlfrl.exe199⤵PID:3908
-
\??\c:\lxlfrlx.exec:\lxlfrlx.exe200⤵PID:4180
-
\??\c:\7hnhtn.exec:\7hnhtn.exe201⤵PID:2304
-
\??\c:\9vjdp.exec:\9vjdp.exe202⤵PID:4076
-
\??\c:\7pdpd.exec:\7pdpd.exe203⤵PID:5084
-
\??\c:\xxxlfxr.exec:\xxxlfxr.exe204⤵PID:4736
-
\??\c:\fxxffxx.exec:\fxxffxx.exe205⤵PID:3560
-
\??\c:\3hhbtn.exec:\3hhbtn.exe206⤵PID:1184
-
\??\c:\tbnhnh.exec:\tbnhnh.exe207⤵PID:312
-
\??\c:\tththb.exec:\tththb.exe208⤵PID:4368
-
\??\c:\vjdjp.exec:\vjdjp.exe209⤵PID:1468
-
\??\c:\pvdvp.exec:\pvdvp.exe210⤵PID:4464
-
\??\c:\rlfxlfx.exec:\rlfxlfx.exe211⤵PID:3540
-
\??\c:\xxrlxrl.exec:\xxrlxrl.exe212⤵PID:2208
-
\??\c:\tbtnhb.exec:\tbtnhb.exe213⤵PID:2592
-
\??\c:\9rrllll.exec:\9rrllll.exe214⤵PID:3484
-
\??\c:\bbttnb.exec:\bbttnb.exe215⤵PID:4176
-
\??\c:\1vjdv.exec:\1vjdv.exe216⤵PID:2532
-
\??\c:\vddpv.exec:\vddpv.exe217⤵PID:4920
-
\??\c:\rfxxrrx.exec:\rfxxrrx.exe218⤵PID:4928
-
\??\c:\btnnnh.exec:\btnnnh.exe219⤵PID:4964
-
\??\c:\ntbhht.exec:\ntbhht.exe220⤵PID:3084
-
\??\c:\jvjvd.exec:\jvjvd.exe221⤵PID:1824
-
\??\c:\fxxllrf.exec:\fxxllrf.exe222⤵PID:2224
-
\??\c:\flxlxrl.exec:\flxlxrl.exe223⤵PID:4596
-
\??\c:\9nhhbb.exec:\9nhhbb.exe224⤵PID:2900
-
\??\c:\jdpjj.exec:\jdpjj.exe225⤵PID:4704
-
\??\c:\vppdv.exec:\vppdv.exe226⤵PID:1984
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe227⤵PID:3700
-
\??\c:\xfxrfrl.exec:\xfxrfrl.exe228⤵PID:3056
-
\??\c:\9thbnn.exec:\9thbnn.exe229⤵PID:2832
-
\??\c:\pjdpj.exec:\pjdpj.exe230⤵PID:2992
-
\??\c:\pdvvp.exec:\pdvvp.exe231⤵PID:4864
-
\??\c:\5lrlffr.exec:\5lrlffr.exe232⤵PID:3132
-
\??\c:\hhhbtn.exec:\hhhbtn.exe233⤵PID:1832
-
\??\c:\3bbthh.exec:\3bbthh.exe234⤵PID:2240
-
\??\c:\3tnbnh.exec:\3tnbnh.exe235⤵PID:3140
-
\??\c:\5djdp.exec:\5djdp.exe236⤵PID:1412
-
\??\c:\vjvjd.exec:\vjvjd.exe237⤵PID:2200
-
\??\c:\lffrxrr.exec:\lffrxrr.exe238⤵PID:3412
-
\??\c:\rxlxlfr.exec:\rxlxlfr.exe239⤵PID:2556
-
\??\c:\htnbnh.exec:\htnbnh.exe240⤵PID:4072
-
\??\c:\5hnbtn.exec:\5hnbtn.exe241⤵PID:1576
-
\??\c:\vdpdp.exec:\vdpdp.exe242⤵PID:3784