Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 05:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0928cd59f3b9e66a2ef9c56444b9b45806d003b64b69bb3c1481faca7e975d10_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0928cd59f3b9e66a2ef9c56444b9b45806d003b64b69bb3c1481faca7e975d10_NeikiAnalytics.exe
-
Size
94KB
-
MD5
a0c1a45bab40a6d4a33f982eedceeaa0
-
SHA1
56eda343adc4870ed1639bd276c70622be055d21
-
SHA256
0928cd59f3b9e66a2ef9c56444b9b45806d003b64b69bb3c1481faca7e975d10
-
SHA512
b3701d4e039fad03d980820f88d058a6774134234a8314c3054f854882305cd83ac405668ada90c0119b4224cae169f4ab302be22f59eae98923f66ab49c1e5a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTrY:ymb3NkkiQ3mdBjFIj+qNhvZuHQYfw4i
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/2792-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/720-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3336-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pjjvd.exelllxrlf.exebtbbtb.exenbtthh.exepjvdd.exexxrfxlf.exehttnhn.exepjvpv.exepjddd.exefxrfrlf.exevvjdv.exerfffxff.exetnbbtt.exevpppj.exefrfllxl.exepddvv.exeddppp.exerlfxfff.exennbtbb.exe5jddv.exe1fxxrxx.exebthhtt.exe1dvvp.exe3fllfll.exerxfxxll.exebnnnhh.exedvpjv.exefrxffff.exe3nbtbb.exejjddd.exejvjjv.exerrlllrr.exehttttt.exe1jpvj.exefrrrrxx.exexlrlfff.exennnnbb.exejddvv.exelffrfrf.exerxxffff.exe1ttnth.exe7ffrllf.exerffffff.exebhbttt.exedvddv.exelffffff.exelfrrrxr.exetbtttb.exepvpvv.exe9vdpj.exerfxfxll.exehntntb.exe1dvdd.exevjvvv.exexxrfxfr.exehhnntn.exehnttnn.exevppjj.exeflfllfl.exefffffff.exebntttb.exejddvv.exeppvpd.exelxlrllx.exepid process 1852 pjjvd.exe 3592 lllxrlf.exe 1116 btbbtb.exe 1580 nbtthh.exe 3412 pjvdd.exe 636 xxrfxlf.exe 1604 httnhn.exe 4348 pjvpv.exe 2844 pjddd.exe 4556 fxrfrlf.exe 2284 vvjdv.exe 1424 rfffxff.exe 720 tnbbtt.exe 3336 vpppj.exe 2244 frfllxl.exe 2260 pddvv.exe 1624 ddppp.exe 4792 rlfxfff.exe 3960 nnbtbb.exe 3888 5jddv.exe 4272 1fxxrxx.exe 2608 bthhtt.exe 4240 1dvvp.exe 4328 3fllfll.exe 3724 rxfxxll.exe 396 bnnnhh.exe 116 dvpjv.exe 4396 frxffff.exe 2180 3nbtbb.exe 4056 jjddd.exe 5052 jvjjv.exe 540 rrlllrr.exe 4460 httttt.exe 4316 1jpvj.exe 4728 frrrrxx.exe 3828 xlrlfff.exe 2532 nnnnbb.exe 2036 jddvv.exe 4348 lffrfrf.exe 1304 rxxffff.exe 716 1ttnth.exe 2060 7ffrllf.exe 3688 rffffff.exe 5060 bhbttt.exe 1424 dvddv.exe 3880 lffffff.exe 4928 lfrrrxr.exe 5092 tbtttb.exe 1996 pvpvv.exe 4712 9vdpj.exe 4604 rfxfxll.exe 1992 hntntb.exe 3024 1dvdd.exe 3888 vjvvv.exe 3740 xxrfxfr.exe 3004 hhnntn.exe 4676 hnttnn.exe 3284 vppjj.exe 2856 flfllfl.exe 4384 fffffff.exe 4388 bntttb.exe 3492 jddvv.exe 2692 ppvpd.exe 4748 lxlrllx.exe -
Processes:
resource yara_rule behavioral2/memory/2792-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/720-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3336-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0928cd59f3b9e66a2ef9c56444b9b45806d003b64b69bb3c1481faca7e975d10_NeikiAnalytics.exepjjvd.exelllxrlf.exebtbbtb.exenbtthh.exepjvdd.exexxrfxlf.exehttnhn.exepjvpv.exepjddd.exefxrfrlf.exevvjdv.exerfffxff.exetnbbtt.exevpppj.exefrfllxl.exepddvv.exeddppp.exerlfxfff.exennbtbb.exe5jddv.exe1fxxrxx.exedescription pid process target process PID 2792 wrote to memory of 1852 2792 0928cd59f3b9e66a2ef9c56444b9b45806d003b64b69bb3c1481faca7e975d10_NeikiAnalytics.exe pjjvd.exe PID 2792 wrote to memory of 1852 2792 0928cd59f3b9e66a2ef9c56444b9b45806d003b64b69bb3c1481faca7e975d10_NeikiAnalytics.exe pjjvd.exe PID 2792 wrote to memory of 1852 2792 0928cd59f3b9e66a2ef9c56444b9b45806d003b64b69bb3c1481faca7e975d10_NeikiAnalytics.exe pjjvd.exe PID 1852 wrote to memory of 3592 1852 pjjvd.exe lllxrlf.exe PID 1852 wrote to memory of 3592 1852 pjjvd.exe lllxrlf.exe PID 1852 wrote to memory of 3592 1852 pjjvd.exe lllxrlf.exe PID 3592 wrote to memory of 1116 3592 lllxrlf.exe btbbtb.exe PID 3592 wrote to memory of 1116 3592 lllxrlf.exe btbbtb.exe PID 3592 wrote to memory of 1116 3592 lllxrlf.exe btbbtb.exe PID 1116 wrote to memory of 1580 1116 btbbtb.exe nbtthh.exe PID 1116 wrote to memory of 1580 1116 btbbtb.exe nbtthh.exe PID 1116 wrote to memory of 1580 1116 btbbtb.exe nbtthh.exe PID 1580 wrote to memory of 3412 1580 nbtthh.exe pjvdd.exe PID 1580 wrote to memory of 3412 1580 nbtthh.exe pjvdd.exe PID 1580 wrote to memory of 3412 1580 nbtthh.exe pjvdd.exe PID 3412 wrote to memory of 636 3412 pjvdd.exe xxrfxlf.exe PID 3412 wrote to memory of 636 3412 pjvdd.exe xxrfxlf.exe PID 3412 wrote to memory of 636 3412 pjvdd.exe xxrfxlf.exe PID 636 wrote to memory of 1604 636 xxrfxlf.exe httnhn.exe PID 636 wrote to memory of 1604 636 xxrfxlf.exe httnhn.exe PID 636 wrote to memory of 1604 636 xxrfxlf.exe httnhn.exe PID 1604 wrote to memory of 4348 1604 httnhn.exe pjvpv.exe PID 1604 wrote to memory of 4348 1604 httnhn.exe pjvpv.exe PID 1604 wrote to memory of 4348 1604 httnhn.exe pjvpv.exe PID 4348 wrote to memory of 2844 4348 pjvpv.exe pjddd.exe PID 4348 wrote to memory of 2844 4348 pjvpv.exe pjddd.exe PID 4348 wrote to memory of 2844 4348 pjvpv.exe pjddd.exe PID 2844 wrote to memory of 4556 2844 pjddd.exe fxrfrlf.exe PID 2844 wrote to memory of 4556 2844 pjddd.exe fxrfrlf.exe PID 2844 wrote to memory of 4556 2844 pjddd.exe fxrfrlf.exe PID 4556 wrote to memory of 2284 4556 fxrfrlf.exe vvjdv.exe PID 4556 wrote to memory of 2284 4556 fxrfrlf.exe vvjdv.exe PID 4556 wrote to memory of 2284 4556 fxrfrlf.exe vvjdv.exe PID 2284 wrote to memory of 1424 2284 vvjdv.exe rfffxff.exe PID 2284 wrote to memory of 1424 2284 vvjdv.exe rfffxff.exe PID 2284 wrote to memory of 1424 2284 vvjdv.exe rfffxff.exe PID 1424 wrote to memory of 720 1424 rfffxff.exe tnbbtt.exe PID 1424 wrote to memory of 720 1424 rfffxff.exe tnbbtt.exe PID 1424 wrote to memory of 720 1424 rfffxff.exe tnbbtt.exe PID 720 wrote to memory of 3336 720 tnbbtt.exe vpppj.exe PID 720 wrote to memory of 3336 720 tnbbtt.exe vpppj.exe PID 720 wrote to memory of 3336 720 tnbbtt.exe vpppj.exe PID 3336 wrote to memory of 2244 3336 vpppj.exe frfllxl.exe PID 3336 wrote to memory of 2244 3336 vpppj.exe frfllxl.exe PID 3336 wrote to memory of 2244 3336 vpppj.exe frfllxl.exe PID 2244 wrote to memory of 2260 2244 frfllxl.exe pddvv.exe PID 2244 wrote to memory of 2260 2244 frfllxl.exe pddvv.exe PID 2244 wrote to memory of 2260 2244 frfllxl.exe pddvv.exe PID 2260 wrote to memory of 1624 2260 pddvv.exe ddppp.exe PID 2260 wrote to memory of 1624 2260 pddvv.exe ddppp.exe PID 2260 wrote to memory of 1624 2260 pddvv.exe ddppp.exe PID 1624 wrote to memory of 4792 1624 ddppp.exe rlfxfff.exe PID 1624 wrote to memory of 4792 1624 ddppp.exe rlfxfff.exe PID 1624 wrote to memory of 4792 1624 ddppp.exe rlfxfff.exe PID 4792 wrote to memory of 3960 4792 rlfxfff.exe nnbtbb.exe PID 4792 wrote to memory of 3960 4792 rlfxfff.exe nnbtbb.exe PID 4792 wrote to memory of 3960 4792 rlfxfff.exe nnbtbb.exe PID 3960 wrote to memory of 3888 3960 nnbtbb.exe 5jddv.exe PID 3960 wrote to memory of 3888 3960 nnbtbb.exe 5jddv.exe PID 3960 wrote to memory of 3888 3960 nnbtbb.exe 5jddv.exe PID 3888 wrote to memory of 4272 3888 5jddv.exe 1fxxrxx.exe PID 3888 wrote to memory of 4272 3888 5jddv.exe 1fxxrxx.exe PID 3888 wrote to memory of 4272 3888 5jddv.exe 1fxxrxx.exe PID 4272 wrote to memory of 2608 4272 1fxxrxx.exe bthhtt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0928cd59f3b9e66a2ef9c56444b9b45806d003b64b69bb3c1481faca7e975d10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0928cd59f3b9e66a2ef9c56444b9b45806d003b64b69bb3c1481faca7e975d10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pjjvd.exec:\pjjvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\lllxrlf.exec:\lllxrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\btbbtb.exec:\btbbtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\nbtthh.exec:\nbtthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\pjvdd.exec:\pjvdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\xxrfxlf.exec:\xxrfxlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\httnhn.exec:\httnhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\pjvpv.exec:\pjvpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\pjddd.exec:\pjddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\fxrfrlf.exec:\fxrfrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\vvjdv.exec:\vvjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\rfffxff.exec:\rfffxff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\tnbbtt.exec:\tnbbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\vpppj.exec:\vpppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\frfllxl.exec:\frfllxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\pddvv.exec:\pddvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\ddppp.exec:\ddppp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\rlfxfff.exec:\rlfxfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\nnbtbb.exec:\nnbtbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\5jddv.exec:\5jddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\1fxxrxx.exec:\1fxxrxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\bthhtt.exec:\bthhtt.exe23⤵
- Executes dropped EXE
PID:2608 -
\??\c:\1dvvp.exec:\1dvvp.exe24⤵
- Executes dropped EXE
PID:4240 -
\??\c:\3fllfll.exec:\3fllfll.exe25⤵
- Executes dropped EXE
PID:4328 -
\??\c:\rxfxxll.exec:\rxfxxll.exe26⤵
- Executes dropped EXE
PID:3724 -
\??\c:\bnnnhh.exec:\bnnnhh.exe27⤵
- Executes dropped EXE
PID:396 -
\??\c:\dvpjv.exec:\dvpjv.exe28⤵
- Executes dropped EXE
PID:116 -
\??\c:\frxffff.exec:\frxffff.exe29⤵
- Executes dropped EXE
PID:4396 -
\??\c:\3nbtbb.exec:\3nbtbb.exe30⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jjddd.exec:\jjddd.exe31⤵
- Executes dropped EXE
PID:4056 -
\??\c:\jvjjv.exec:\jvjjv.exe32⤵
- Executes dropped EXE
PID:5052 -
\??\c:\rrlllrr.exec:\rrlllrr.exe33⤵
- Executes dropped EXE
PID:540 -
\??\c:\httttt.exec:\httttt.exe34⤵
- Executes dropped EXE
PID:4460 -
\??\c:\1jpvj.exec:\1jpvj.exe35⤵
- Executes dropped EXE
PID:4316 -
\??\c:\frrrrxx.exec:\frrrrxx.exe36⤵
- Executes dropped EXE
PID:4728 -
\??\c:\xlrlfff.exec:\xlrlfff.exe37⤵
- Executes dropped EXE
PID:3828 -
\??\c:\nnnnbb.exec:\nnnnbb.exe38⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jddvv.exec:\jddvv.exe39⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lffrfrf.exec:\lffrfrf.exe40⤵
- Executes dropped EXE
PID:4348 -
\??\c:\rxxffff.exec:\rxxffff.exe41⤵
- Executes dropped EXE
PID:1304 -
\??\c:\1ttnth.exec:\1ttnth.exe42⤵
- Executes dropped EXE
PID:716 -
\??\c:\7ffrllf.exec:\7ffrllf.exe43⤵
- Executes dropped EXE
PID:2060 -
\??\c:\rffffff.exec:\rffffff.exe44⤵
- Executes dropped EXE
PID:3688 -
\??\c:\bhbttt.exec:\bhbttt.exe45⤵
- Executes dropped EXE
PID:5060 -
\??\c:\dvddv.exec:\dvddv.exe46⤵
- Executes dropped EXE
PID:1424 -
\??\c:\lffffff.exec:\lffffff.exe47⤵
- Executes dropped EXE
PID:3880 -
\??\c:\lfrrrxr.exec:\lfrrrxr.exe48⤵
- Executes dropped EXE
PID:4928 -
\??\c:\tbtttb.exec:\tbtttb.exe49⤵
- Executes dropped EXE
PID:5092 -
\??\c:\pvpvv.exec:\pvpvv.exe50⤵
- Executes dropped EXE
PID:1996 -
\??\c:\9vdpj.exec:\9vdpj.exe51⤵
- Executes dropped EXE
PID:4712 -
\??\c:\rfxfxll.exec:\rfxfxll.exe52⤵
- Executes dropped EXE
PID:4604 -
\??\c:\hntntb.exec:\hntntb.exe53⤵
- Executes dropped EXE
PID:1992 -
\??\c:\1dvdd.exec:\1dvdd.exe54⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vjvvv.exec:\vjvvv.exe55⤵
- Executes dropped EXE
PID:3888 -
\??\c:\xxrfxfr.exec:\xxrfxfr.exe56⤵
- Executes dropped EXE
PID:3740 -
\??\c:\hhnntn.exec:\hhnntn.exe57⤵
- Executes dropped EXE
PID:3004 -
\??\c:\hnttnn.exec:\hnttnn.exe58⤵
- Executes dropped EXE
PID:4676 -
\??\c:\vppjj.exec:\vppjj.exe59⤵
- Executes dropped EXE
PID:3284 -
\??\c:\flfllfl.exec:\flfllfl.exe60⤵
- Executes dropped EXE
PID:2856 -
\??\c:\fffffff.exec:\fffffff.exe61⤵
- Executes dropped EXE
PID:4384 -
\??\c:\bntttb.exec:\bntttb.exe62⤵
- Executes dropped EXE
PID:4388 -
\??\c:\jddvv.exec:\jddvv.exe63⤵
- Executes dropped EXE
PID:3492 -
\??\c:\ppvpd.exec:\ppvpd.exe64⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lxlrllx.exec:\lxlrllx.exe65⤵
- Executes dropped EXE
PID:4748 -
\??\c:\9rxxxxf.exec:\9rxxxxf.exe66⤵PID:812
-
\??\c:\nnnhbh.exec:\nnnhbh.exe67⤵PID:3412
-
\??\c:\dvvpj.exec:\dvvpj.exe68⤵PID:2356
-
\??\c:\ppdvj.exec:\ppdvj.exe69⤵PID:4580
-
\??\c:\flllllf.exec:\flllllf.exe70⤵PID:4856
-
\??\c:\rrrrrlf.exec:\rrrrrlf.exe71⤵PID:3828
-
\??\c:\hbbnhb.exec:\hbbnhb.exe72⤵PID:3256
-
\??\c:\bnnttt.exec:\bnnttt.exe73⤵PID:2036
-
\??\c:\jjddp.exec:\jjddp.exe74⤵PID:4348
-
\??\c:\ddjdv.exec:\ddjdv.exe75⤵PID:1304
-
\??\c:\lxrlxlr.exec:\lxrlxlr.exe76⤵PID:3324
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe77⤵PID:3636
-
\??\c:\nhnnnn.exec:\nhnnnn.exe78⤵PID:3688
-
\??\c:\pvpvp.exec:\pvpvp.exe79⤵PID:4284
-
\??\c:\vddjp.exec:\vddjp.exe80⤵PID:1424
-
\??\c:\lxlxrxx.exec:\lxlxrxx.exe81⤵PID:3880
-
\??\c:\xlllffx.exec:\xlllffx.exe82⤵PID:4104
-
\??\c:\hhbbbt.exec:\hhbbbt.exe83⤵PID:4832
-
\??\c:\thnhbb.exec:\thnhbb.exe84⤵PID:1996
-
\??\c:\1dvjd.exec:\1dvjd.exe85⤵PID:3016
-
\??\c:\1xxrrrr.exec:\1xxrrrr.exe86⤵PID:3172
-
\??\c:\3lrrxff.exec:\3lrrxff.exe87⤵PID:1280
-
\??\c:\tnntnt.exec:\tnntnt.exe88⤵PID:3444
-
\??\c:\jdppp.exec:\jdppp.exe89⤵PID:4344
-
\??\c:\xlrxxfx.exec:\xlrxxfx.exe90⤵PID:2764
-
\??\c:\llffxff.exec:\llffxff.exe91⤵PID:1216
-
\??\c:\1nnnhh.exec:\1nnnhh.exe92⤵PID:2468
-
\??\c:\1pvvv.exec:\1pvvv.exe93⤵PID:5104
-
\??\c:\ddpjv.exec:\ddpjv.exe94⤵PID:5024
-
\??\c:\xllfxrr.exec:\xllfxrr.exe95⤵PID:2020
-
\??\c:\bhbtnn.exec:\bhbtnn.exe96⤵PID:1004
-
\??\c:\ppdjp.exec:\ppdjp.exe97⤵PID:4448
-
\??\c:\rllffxx.exec:\rllffxx.exe98⤵PID:5100
-
\??\c:\rlrxxll.exec:\rlrxxll.exe99⤵PID:4436
-
\??\c:\hbnttb.exec:\hbnttb.exe100⤵PID:2168
-
\??\c:\3ppjd.exec:\3ppjd.exe101⤵PID:4032
-
\??\c:\jpdjj.exec:\jpdjj.exe102⤵PID:4460
-
\??\c:\xlxxfrx.exec:\xlxxfrx.exe103⤵PID:4316
-
\??\c:\hnhttn.exec:\hnhttn.exe104⤵PID:2220
-
\??\c:\dpvjj.exec:\dpvjj.exe105⤵PID:3048
-
\??\c:\vvjvp.exec:\vvjvp.exe106⤵PID:1972
-
\??\c:\xflrfll.exec:\xflrfll.exe107⤵PID:3164
-
\??\c:\hhthnb.exec:\hhthnb.exe108⤵PID:4644
-
\??\c:\bttttt.exec:\bttttt.exe109⤵PID:716
-
\??\c:\xlflxfr.exec:\xlflxfr.exe110⤵PID:2632
-
\??\c:\xrfffff.exec:\xrfffff.exe111⤵PID:2060
-
\??\c:\thtnht.exec:\thtnht.exe112⤵PID:1236
-
\??\c:\dvpvd.exec:\dvpvd.exe113⤵PID:720
-
\??\c:\dpdvp.exec:\dpdvp.exe114⤵PID:4564
-
\??\c:\lflffff.exec:\lflffff.exe115⤵PID:388
-
\??\c:\bthbht.exec:\bthbht.exe116⤵PID:1192
-
\??\c:\jvvpj.exec:\jvvpj.exe117⤵PID:1620
-
\??\c:\vvvvv.exec:\vvvvv.exe118⤵PID:1608
-
\??\c:\lfxlrfx.exec:\lfxlrfx.exe119⤵PID:2248
-
\??\c:\bbhhbb.exec:\bbhhbb.exe120⤵PID:4604
-
\??\c:\5tthtt.exec:\5tthtt.exe121⤵PID:4608
-
\??\c:\1jpjd.exec:\1jpjd.exe122⤵PID:1288
-
\??\c:\xlrllll.exec:\xlrllll.exe123⤵PID:4272
-
\??\c:\1pvpp.exec:\1pvpp.exe124⤵PID:3740
-
\??\c:\jdddd.exec:\jdddd.exe125⤵PID:4912
-
\??\c:\3rxflxx.exec:\3rxflxx.exe126⤵PID:2468
-
\??\c:\rffffll.exec:\rffffll.exe127⤵PID:1392
-
\??\c:\tthhtb.exec:\tthhtb.exe128⤵PID:4384
-
\??\c:\bhntbb.exec:\bhntbb.exe129⤵PID:4388
-
\??\c:\pppjj.exec:\pppjj.exe130⤵PID:3492
-
\??\c:\dpdpd.exec:\dpdpd.exe131⤵PID:4948
-
\??\c:\1xxxxff.exec:\1xxxxff.exe132⤵PID:4820
-
\??\c:\rfrxflr.exec:\rfrxflr.exe133⤵PID:2580
-
\??\c:\tbtbhb.exec:\tbtbhb.exe134⤵PID:2168
-
\??\c:\jpjjp.exec:\jpjjp.exe135⤵PID:4032
-
\??\c:\xllllrx.exec:\xllllrx.exe136⤵PID:4580
-
\??\c:\lfllllf.exec:\lfllllf.exe137⤵PID:4856
-
\??\c:\hnbbtt.exec:\hnbbtt.exe138⤵PID:4900
-
\??\c:\vdppp.exec:\vdppp.exe139⤵PID:3256
-
\??\c:\fxxlrll.exec:\fxxlrll.exe140⤵PID:1972
-
\??\c:\lllxrrf.exec:\lllxrrf.exe141⤵PID:2036
-
\??\c:\hbnttt.exec:\hbnttt.exe142⤵PID:4644
-
\??\c:\bhhbbb.exec:\bhhbbb.exe143⤵PID:3332
-
\??\c:\dpddv.exec:\dpddv.exe144⤵PID:3008
-
\??\c:\rllllrl.exec:\rllllrl.exe145⤵PID:2060
-
\??\c:\rrrrrrl.exec:\rrrrrrl.exe146⤵PID:2068
-
\??\c:\9xrrlrl.exec:\9xrrlrl.exe147⤵PID:720
-
\??\c:\tnnbnb.exec:\tnnbnb.exe148⤵PID:4564
-
\??\c:\dvjpj.exec:\dvjpj.exe149⤵PID:5092
-
\??\c:\rfrrlrx.exec:\rfrrlrx.exe150⤵PID:744
-
\??\c:\7btbbn.exec:\7btbbn.exe151⤵PID:2032
-
\??\c:\bnthnn.exec:\bnthnn.exe152⤵PID:1220
-
\??\c:\5djjp.exec:\5djjp.exe153⤵PID:1992
-
\??\c:\llrrxll.exec:\llrrxll.exe154⤵PID:3620
-
\??\c:\fxlfllf.exec:\fxlfllf.exe155⤵PID:324
-
\??\c:\1ttntn.exec:\1ttntn.exe156⤵PID:4888
-
\??\c:\7dvjd.exec:\7dvjd.exe157⤵PID:2156
-
\??\c:\1pjvj.exec:\1pjvj.exe158⤵PID:4392
-
\??\c:\lrfffrr.exec:\lrfffrr.exe159⤵PID:2468
-
\??\c:\nbtnbn.exec:\nbtnbn.exe160⤵PID:2860
-
\??\c:\nbbhnb.exec:\nbbhnb.exe161⤵PID:2180
-
\??\c:\jpdvj.exec:\jpdvj.exe162⤵PID:640
-
\??\c:\llfxflx.exec:\llfxflx.exe163⤵PID:3000
-
\??\c:\hnhbtt.exec:\hnhbtt.exe164⤵PID:4992
-
\??\c:\nhnhtt.exec:\nhnhtt.exe165⤵PID:5008
-
\??\c:\pjddv.exec:\pjddv.exe166⤵PID:3800
-
\??\c:\xxrrfff.exec:\xxrrfff.exe167⤵PID:2220
-
\??\c:\xxrllll.exec:\xxrllll.exe168⤵PID:3164
-
\??\c:\hhhnhn.exec:\hhhnhn.exe169⤵PID:3040
-
\??\c:\3nttnt.exec:\3nttnt.exe170⤵PID:4644
-
\??\c:\ddvvv.exec:\ddvvv.exe171⤵PID:3672
-
\??\c:\5pppp.exec:\5pppp.exe172⤵PID:4696
-
\??\c:\5fffxff.exec:\5fffxff.exe173⤵PID:1880
-
\??\c:\llrrrxl.exec:\llrrrxl.exe174⤵PID:3336
-
\??\c:\nhtbhh.exec:\nhtbhh.exe175⤵PID:4468
-
\??\c:\vpdpv.exec:\vpdpv.exe176⤵PID:4060
-
\??\c:\rlfffll.exec:\rlfffll.exe177⤵PID:4020
-
\??\c:\tnhnnb.exec:\tnhnnb.exe178⤵PID:772
-
\??\c:\bthttn.exec:\bthttn.exe179⤵PID:1448
-
\??\c:\rlrxffx.exec:\rlrxffx.exe180⤵PID:4308
-
\??\c:\hbtttt.exec:\hbtttt.exe181⤵PID:1612
-
\??\c:\nnhbbh.exec:\nnhbbh.exe182⤵PID:4240
-
\??\c:\vpvpp.exec:\vpvpp.exe183⤵PID:2764
-
\??\c:\ffffffl.exec:\ffffffl.exe184⤵PID:468
-
\??\c:\bthntb.exec:\bthntb.exe185⤵PID:4392
-
\??\c:\hhbbtt.exec:\hhbbtt.exe186⤵PID:4212
-
\??\c:\jjvpv.exec:\jjvpv.exe187⤵PID:2860
-
\??\c:\xrrrlll.exec:\xrrrlll.exe188⤵PID:2180
-
\??\c:\bhnttb.exec:\bhnttb.exe189⤵PID:640
-
\??\c:\nhnhtt.exec:\nhnhtt.exe190⤵PID:1600
-
\??\c:\9pvpj.exec:\9pvpj.exe191⤵PID:4992
-
\??\c:\fxfffxx.exec:\fxfffxx.exe192⤵PID:5008
-
\??\c:\5lrxxff.exec:\5lrxxff.exe193⤵PID:4908
-
\??\c:\ntntbh.exec:\ntntbh.exe194⤵PID:3788
-
\??\c:\nthhhh.exec:\nthhhh.exe195⤵PID:3324
-
\??\c:\jpjvv.exec:\jpjvv.exe196⤵PID:3304
-
\??\c:\jvpjj.exec:\jvpjj.exe197⤵PID:212
-
\??\c:\xfrxflr.exec:\xfrxflr.exe198⤵PID:1236
-
\??\c:\nnbtbn.exec:\nnbtbn.exe199⤵PID:720
-
\??\c:\hhhtth.exec:\hhhtth.exe200⤵PID:388
-
\??\c:\dppvj.exec:\dppvj.exe201⤵PID:1192
-
\??\c:\vjjdv.exec:\vjjdv.exe202⤵PID:4584
-
\??\c:\frrxxxr.exec:\frrxxxr.exe203⤵PID:3016
-
\??\c:\nnbbtt.exec:\nnbbtt.exe204⤵PID:4608
-
\??\c:\5bhnnt.exec:\5bhnnt.exe205⤵PID:3960
-
\??\c:\dvdvp.exec:\dvdvp.exe206⤵PID:4308
-
\??\c:\3pjjd.exec:\3pjjd.exe207⤵PID:4300
-
\??\c:\llllfff.exec:\llllfff.exe208⤵PID:4240
-
\??\c:\bbnhht.exec:\bbnhht.exe209⤵PID:4024
-
\??\c:\nbhntt.exec:\nbhntt.exe210⤵PID:468
-
\??\c:\flrrffl.exec:\flrrffl.exe211⤵PID:4268
-
\??\c:\xrrrlxx.exec:\xrrrlxx.exe212⤵PID:1892
-
\??\c:\dpvvv.exec:\dpvvv.exe213⤵PID:2860
-
\??\c:\lllffrr.exec:\lllffrr.exe214⤵PID:636
-
\??\c:\nhhhnt.exec:\nhhhnt.exe215⤵PID:4820
-
\??\c:\ffffflr.exec:\ffffflr.exe216⤵PID:1600
-
\??\c:\nthbnh.exec:\nthbnh.exe217⤵PID:1332
-
\??\c:\pddvv.exec:\pddvv.exe218⤵PID:3036
-
\??\c:\9fffxxx.exec:\9fffxxx.exe219⤵PID:3296
-
\??\c:\httbbt.exec:\httbbt.exe220⤵PID:3788
-
\??\c:\hnnntt.exec:\hnnntt.exe221⤵PID:4632
-
\??\c:\dpvvv.exec:\dpvvv.exe222⤵PID:4544
-
\??\c:\djjvp.exec:\djjvp.exe223⤵PID:732
-
\??\c:\flffxrx.exec:\flffxrx.exe224⤵PID:1420
-
\??\c:\bhttnn.exec:\bhttnn.exe225⤵PID:2932
-
\??\c:\thnnnn.exec:\thnnnn.exe226⤵PID:4468
-
\??\c:\dvvpj.exec:\dvvpj.exe227⤵PID:4548
-
\??\c:\vjvdd.exec:\vjvdd.exe228⤵PID:4812
-
\??\c:\5rxxxxx.exec:\5rxxxxx.exe229⤵PID:5032
-
\??\c:\xxfllfx.exec:\xxfllfx.exe230⤵PID:3068
-
\??\c:\7bntnn.exec:\7bntnn.exe231⤵PID:376
-
\??\c:\pvjdd.exec:\pvjdd.exe232⤵PID:1612
-
\??\c:\xrlfxlx.exec:\xrlfxlx.exe233⤵PID:4888
-
\??\c:\bhhbhh.exec:\bhhbhh.exe234⤵PID:4792
-
\??\c:\ppvpp.exec:\ppvpp.exe235⤵PID:5024
-
\??\c:\jjpdv.exec:\jjpdv.exe236⤵PID:468
-
\??\c:\7xrxxff.exec:\7xrxxff.exe237⤵PID:3184
-
\??\c:\ttbbbb.exec:\ttbbbb.exe238⤵PID:2580
-
\??\c:\jdddv.exec:\jdddv.exe239⤵PID:2384
-
\??\c:\ddjdj.exec:\ddjdj.exe240⤵PID:636
-
\??\c:\1rlllrx.exec:\1rlllrx.exe241⤵PID:4820
-
\??\c:\bttntb.exec:\bttntb.exe242⤵PID:5008