Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 22:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f431180be0c7c4357491476ed94d7b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0f431180be0c7c4357491476ed94d7b0_NeikiAnalytics.exe
-
Size
76KB
-
MD5
0f431180be0c7c4357491476ed94d7b0
-
SHA1
d29a54b7f083747ce10a2aa1d9abbd2b4c631457
-
SHA256
9e7863abb5f571df1ac60202680f845c9234f85da7b98c803c3e927a1393031d
-
SHA512
c6642addb027413ea286b503fb45ce704917718093a6275d5ac6f706ded3506251b3948c9f321b88a1d4fa80b0ecfeec0ab0139bdbcb9dbad8e382f567be36d3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrAP:ymb3NkkiQ3mdBjFIIp9L9QrrAP
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/2472-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1296-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-43-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2260-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3444-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1340-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/336-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3332-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
btbbnn.exellxrffr.exe1htnhh.exejjppv.exexlxrlff.exetnnhnt.exe7jjdv.exevvddv.exefxlfffx.exenhthhh.exedjjjd.exexffflxf.exehnhhbb.exe5pvjd.exe1xflffx.exe3bbttb.exeppjdd.exexxxrrrl.exennnnht.exe9jpdv.exefflffll.exebttnhh.exejdjvd.exexrrrrrl.exetnhhtt.exe3pjjd.exexrrffff.exetnbbtt.exedpjjv.exexffllrl.exexrxxrrl.exe5vvpj.exefxrrfrl.exe1nnhnt.exeppdvv.exepvjpp.exelrxlxxl.exehbbbbb.exedvjdd.exeffxrrfr.exehhtntn.exe1bnnnn.exe1dpdj.exe9llfffx.exeflffxxx.exenhnnnn.exejvdjd.exefrlfxxr.exetnttbb.exe7vvvp.exejddvp.exerrrrxxf.exenhnhtt.exepjjjd.exedpjdv.exe5lxxffr.exentbbtt.exe9jvvj.exejpjpp.exelxxrlff.exe7bnntt.exenbbttt.exe1pvvp.exexrfxxrr.exepid process 2184 btbbnn.exe 1296 llxrffr.exe 2568 1htnhh.exe 4576 jjppv.exe 2260 xlxrlff.exe 3444 tnnhnt.exe 3616 7jjdv.exe 4456 vvddv.exe 4616 fxlfffx.exe 4628 nhthhh.exe 1272 djjjd.exe 4436 xffflxf.exe 1340 hnhhbb.exe 2164 5pvjd.exe 872 1xflffx.exe 1868 3bbttb.exe 2484 ppjdd.exe 5000 xxxrrrl.exe 1812 nnnnht.exe 1064 9jpdv.exe 2280 fflffll.exe 336 bttnhh.exe 3684 jdjvd.exe 4332 xrrrrrl.exe 1492 tnhhtt.exe 4400 3pjjd.exe 2612 xrrffff.exe 1212 tnbbtt.exe 3332 dpjjv.exe 908 xffllrl.exe 1428 xrxxrrl.exe 3212 5vvpj.exe 1736 fxrrfrl.exe 1880 1nnhnt.exe 2260 ppdvv.exe 3004 pvjpp.exe 3300 lrxlxxl.exe 2132 hbbbbb.exe 2052 dvjdd.exe 3600 ffxrrfr.exe 924 hhtntn.exe 1816 1bnnnn.exe 1896 1dpdj.exe 2540 9llfffx.exe 4640 flffxxx.exe 3864 nhnnnn.exe 4152 jvdjd.exe 4644 frlfxxr.exe 3256 tnttbb.exe 3200 7vvvp.exe 1684 jddvp.exe 4348 rrrrxxf.exe 1200 nhnhtt.exe 784 pjjjd.exe 1644 dpjdv.exe 5072 5lxxffr.exe 2804 ntbbtt.exe 4720 9jvvj.exe 3772 jpjpp.exe 4448 lxxrlff.exe 4444 7bnntt.exe 4808 nbbttt.exe 4396 1pvvp.exe 3636 xrfxxrr.exe -
Processes:
resource yara_rule behavioral2/memory/2472-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/336-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3332-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-224-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0f431180be0c7c4357491476ed94d7b0_NeikiAnalytics.exebtbbnn.exellxrffr.exe1htnhh.exejjppv.exexlxrlff.exetnnhnt.exe7jjdv.exevvddv.exefxlfffx.exenhthhh.exedjjjd.exexffflxf.exehnhhbb.exe5pvjd.exe1xflffx.exe3bbttb.exeppjdd.exexxxrrrl.exennnnht.exe9jpdv.exefflffll.exedescription pid process target process PID 2472 wrote to memory of 2184 2472 0f431180be0c7c4357491476ed94d7b0_NeikiAnalytics.exe btbbnn.exe PID 2472 wrote to memory of 2184 2472 0f431180be0c7c4357491476ed94d7b0_NeikiAnalytics.exe btbbnn.exe PID 2472 wrote to memory of 2184 2472 0f431180be0c7c4357491476ed94d7b0_NeikiAnalytics.exe btbbnn.exe PID 2184 wrote to memory of 1296 2184 btbbnn.exe llxrffr.exe PID 2184 wrote to memory of 1296 2184 btbbnn.exe llxrffr.exe PID 2184 wrote to memory of 1296 2184 btbbnn.exe llxrffr.exe PID 1296 wrote to memory of 2568 1296 llxrffr.exe 1htnhh.exe PID 1296 wrote to memory of 2568 1296 llxrffr.exe 1htnhh.exe PID 1296 wrote to memory of 2568 1296 llxrffr.exe 1htnhh.exe PID 2568 wrote to memory of 4576 2568 1htnhh.exe jjppv.exe PID 2568 wrote to memory of 4576 2568 1htnhh.exe jjppv.exe PID 2568 wrote to memory of 4576 2568 1htnhh.exe jjppv.exe PID 4576 wrote to memory of 2260 4576 jjppv.exe xlxrlff.exe PID 4576 wrote to memory of 2260 4576 jjppv.exe xlxrlff.exe PID 4576 wrote to memory of 2260 4576 jjppv.exe xlxrlff.exe PID 2260 wrote to memory of 3444 2260 xlxrlff.exe tnnhnt.exe PID 2260 wrote to memory of 3444 2260 xlxrlff.exe tnnhnt.exe PID 2260 wrote to memory of 3444 2260 xlxrlff.exe tnnhnt.exe PID 3444 wrote to memory of 3616 3444 tnnhnt.exe 7jjdv.exe PID 3444 wrote to memory of 3616 3444 tnnhnt.exe 7jjdv.exe PID 3444 wrote to memory of 3616 3444 tnnhnt.exe 7jjdv.exe PID 3616 wrote to memory of 4456 3616 7jjdv.exe vvddv.exe PID 3616 wrote to memory of 4456 3616 7jjdv.exe vvddv.exe PID 3616 wrote to memory of 4456 3616 7jjdv.exe vvddv.exe PID 4456 wrote to memory of 4616 4456 vvddv.exe fxlfffx.exe PID 4456 wrote to memory of 4616 4456 vvddv.exe fxlfffx.exe PID 4456 wrote to memory of 4616 4456 vvddv.exe fxlfffx.exe PID 4616 wrote to memory of 4628 4616 fxlfffx.exe nhthhh.exe PID 4616 wrote to memory of 4628 4616 fxlfffx.exe nhthhh.exe PID 4616 wrote to memory of 4628 4616 fxlfffx.exe nhthhh.exe PID 4628 wrote to memory of 1272 4628 nhthhh.exe djjjd.exe PID 4628 wrote to memory of 1272 4628 nhthhh.exe djjjd.exe PID 4628 wrote to memory of 1272 4628 nhthhh.exe djjjd.exe PID 1272 wrote to memory of 4436 1272 djjjd.exe xffflxf.exe PID 1272 wrote to memory of 4436 1272 djjjd.exe xffflxf.exe PID 1272 wrote to memory of 4436 1272 djjjd.exe xffflxf.exe PID 4436 wrote to memory of 1340 4436 xffflxf.exe hnhhbb.exe PID 4436 wrote to memory of 1340 4436 xffflxf.exe hnhhbb.exe PID 4436 wrote to memory of 1340 4436 xffflxf.exe hnhhbb.exe PID 1340 wrote to memory of 2164 1340 hnhhbb.exe 5pvjd.exe PID 1340 wrote to memory of 2164 1340 hnhhbb.exe 5pvjd.exe PID 1340 wrote to memory of 2164 1340 hnhhbb.exe 5pvjd.exe PID 2164 wrote to memory of 872 2164 5pvjd.exe 1xflffx.exe PID 2164 wrote to memory of 872 2164 5pvjd.exe 1xflffx.exe PID 2164 wrote to memory of 872 2164 5pvjd.exe 1xflffx.exe PID 872 wrote to memory of 1868 872 1xflffx.exe 3bbttb.exe PID 872 wrote to memory of 1868 872 1xflffx.exe 3bbttb.exe PID 872 wrote to memory of 1868 872 1xflffx.exe 3bbttb.exe PID 1868 wrote to memory of 2484 1868 3bbttb.exe ppjdd.exe PID 1868 wrote to memory of 2484 1868 3bbttb.exe ppjdd.exe PID 1868 wrote to memory of 2484 1868 3bbttb.exe ppjdd.exe PID 2484 wrote to memory of 5000 2484 ppjdd.exe xxxrrrl.exe PID 2484 wrote to memory of 5000 2484 ppjdd.exe xxxrrrl.exe PID 2484 wrote to memory of 5000 2484 ppjdd.exe xxxrrrl.exe PID 5000 wrote to memory of 1812 5000 xxxrrrl.exe nnnnht.exe PID 5000 wrote to memory of 1812 5000 xxxrrrl.exe nnnnht.exe PID 5000 wrote to memory of 1812 5000 xxxrrrl.exe nnnnht.exe PID 1812 wrote to memory of 1064 1812 nnnnht.exe 9jpdv.exe PID 1812 wrote to memory of 1064 1812 nnnnht.exe 9jpdv.exe PID 1812 wrote to memory of 1064 1812 nnnnht.exe 9jpdv.exe PID 1064 wrote to memory of 2280 1064 9jpdv.exe fflffll.exe PID 1064 wrote to memory of 2280 1064 9jpdv.exe fflffll.exe PID 1064 wrote to memory of 2280 1064 9jpdv.exe fflffll.exe PID 2280 wrote to memory of 336 2280 fflffll.exe bttnhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f431180be0c7c4357491476ed94d7b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f431180be0c7c4357491476ed94d7b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\btbbnn.exec:\btbbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\llxrffr.exec:\llxrffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\1htnhh.exec:\1htnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\jjppv.exec:\jjppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\xlxrlff.exec:\xlxrlff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\tnnhnt.exec:\tnnhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\7jjdv.exec:\7jjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\vvddv.exec:\vvddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\fxlfffx.exec:\fxlfffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\nhthhh.exec:\nhthhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\djjjd.exec:\djjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\xffflxf.exec:\xffflxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\hnhhbb.exec:\hnhhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\5pvjd.exec:\5pvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\1xflffx.exec:\1xflffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\3bbttb.exec:\3bbttb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\ppjdd.exec:\ppjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\nnnnht.exec:\nnnnht.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\9jpdv.exec:\9jpdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\fflffll.exec:\fflffll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\bttnhh.exec:\bttnhh.exe23⤵
- Executes dropped EXE
PID:336 -
\??\c:\jdjvd.exec:\jdjvd.exe24⤵
- Executes dropped EXE
PID:3684 -
\??\c:\xrrrrrl.exec:\xrrrrrl.exe25⤵
- Executes dropped EXE
PID:4332 -
\??\c:\tnhhtt.exec:\tnhhtt.exe26⤵
- Executes dropped EXE
PID:1492 -
\??\c:\3pjjd.exec:\3pjjd.exe27⤵
- Executes dropped EXE
PID:4400 -
\??\c:\xrrffff.exec:\xrrffff.exe28⤵
- Executes dropped EXE
PID:2612 -
\??\c:\tnbbtt.exec:\tnbbtt.exe29⤵
- Executes dropped EXE
PID:1212 -
\??\c:\dpjjv.exec:\dpjjv.exe30⤵
- Executes dropped EXE
PID:3332 -
\??\c:\xffllrl.exec:\xffllrl.exe31⤵
- Executes dropped EXE
PID:908 -
\??\c:\xrxxrrl.exec:\xrxxrrl.exe32⤵
- Executes dropped EXE
PID:1428 -
\??\c:\5vvpj.exec:\5vvpj.exe33⤵
- Executes dropped EXE
PID:3212 -
\??\c:\fxrrfrl.exec:\fxrrfrl.exe34⤵
- Executes dropped EXE
PID:1736 -
\??\c:\1nnhnt.exec:\1nnhnt.exe35⤵
- Executes dropped EXE
PID:1880 -
\??\c:\ppdvv.exec:\ppdvv.exe36⤵
- Executes dropped EXE
PID:2260 -
\??\c:\pvjpp.exec:\pvjpp.exe37⤵
- Executes dropped EXE
PID:3004 -
\??\c:\lrxlxxl.exec:\lrxlxxl.exe38⤵
- Executes dropped EXE
PID:3300 -
\??\c:\hbbbbb.exec:\hbbbbb.exe39⤵
- Executes dropped EXE
PID:2132 -
\??\c:\dvjdd.exec:\dvjdd.exe40⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ffxrrfr.exec:\ffxrrfr.exe41⤵
- Executes dropped EXE
PID:3600 -
\??\c:\hhtntn.exec:\hhtntn.exe42⤵
- Executes dropped EXE
PID:924 -
\??\c:\1bnnnn.exec:\1bnnnn.exe43⤵
- Executes dropped EXE
PID:1816 -
\??\c:\1dpdj.exec:\1dpdj.exe44⤵
- Executes dropped EXE
PID:1896 -
\??\c:\9llfffx.exec:\9llfffx.exe45⤵
- Executes dropped EXE
PID:2540 -
\??\c:\flffxxx.exec:\flffxxx.exe46⤵
- Executes dropped EXE
PID:4640 -
\??\c:\nhnnnn.exec:\nhnnnn.exe47⤵
- Executes dropped EXE
PID:3864 -
\??\c:\jvdjd.exec:\jvdjd.exe48⤵
- Executes dropped EXE
PID:4152 -
\??\c:\frlfxxr.exec:\frlfxxr.exe49⤵
- Executes dropped EXE
PID:4644 -
\??\c:\tnttbb.exec:\tnttbb.exe50⤵
- Executes dropped EXE
PID:3256 -
\??\c:\7vvvp.exec:\7vvvp.exe51⤵
- Executes dropped EXE
PID:3200 -
\??\c:\jddvp.exec:\jddvp.exe52⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rrrrxxf.exec:\rrrrxxf.exe53⤵
- Executes dropped EXE
PID:4348 -
\??\c:\nhnhtt.exec:\nhnhtt.exe54⤵
- Executes dropped EXE
PID:1200 -
\??\c:\pjjjd.exec:\pjjjd.exe55⤵
- Executes dropped EXE
PID:784 -
\??\c:\dpjdv.exec:\dpjdv.exe56⤵
- Executes dropped EXE
PID:1644 -
\??\c:\5lxxffr.exec:\5lxxffr.exe57⤵
- Executes dropped EXE
PID:5072 -
\??\c:\ntbbtt.exec:\ntbbtt.exe58⤵
- Executes dropped EXE
PID:2804 -
\??\c:\9jvvj.exec:\9jvvj.exe59⤵
- Executes dropped EXE
PID:4720 -
\??\c:\jpjpp.exec:\jpjpp.exe60⤵
- Executes dropped EXE
PID:3772 -
\??\c:\lxxrlff.exec:\lxxrlff.exe61⤵
- Executes dropped EXE
PID:4448 -
\??\c:\7bnntt.exec:\7bnntt.exe62⤵
- Executes dropped EXE
PID:4444 -
\??\c:\nbbttt.exec:\nbbttt.exe63⤵
- Executes dropped EXE
PID:4808 -
\??\c:\1pvvp.exec:\1pvvp.exe64⤵
- Executes dropped EXE
PID:4396 -
\??\c:\xrfxxrr.exec:\xrfxxrr.exe65⤵
- Executes dropped EXE
PID:3636 -
\??\c:\bbtbbt.exec:\bbtbbt.exe66⤵PID:184
-
\??\c:\3jjdv.exec:\3jjdv.exe67⤵PID:4796
-
\??\c:\vpdvp.exec:\vpdvp.exe68⤵PID:2568
-
\??\c:\rlxrllf.exec:\rlxrllf.exe69⤵PID:1736
-
\??\c:\xrxffff.exec:\xrxffff.exe70⤵PID:3776
-
\??\c:\7nbhhn.exec:\7nbhhn.exe71⤵PID:948
-
\??\c:\bhbbbb.exec:\bhbbbb.exe72⤵PID:884
-
\??\c:\3pdpj.exec:\3pdpj.exe73⤵PID:2436
-
\??\c:\lfrllff.exec:\lfrllff.exe74⤵PID:4028
-
\??\c:\1ttttt.exec:\1ttttt.exe75⤵PID:2592
-
\??\c:\btbnhh.exec:\btbnhh.exe76⤵PID:4452
-
\??\c:\jppvj.exec:\jppvj.exe77⤵PID:3040
-
\??\c:\lfxlfrf.exec:\lfxlfrf.exe78⤵PID:728
-
\??\c:\3nhtnn.exec:\3nhtnn.exe79⤵PID:4472
-
\??\c:\jjvjp.exec:\jjvjp.exe80⤵PID:3276
-
\??\c:\jjjpj.exec:\jjjpj.exe81⤵PID:4208
-
\??\c:\bnhnbt.exec:\bnhnbt.exe82⤵PID:4248
-
\??\c:\btthbh.exec:\btthbh.exe83⤵PID:3936
-
\??\c:\9jvpd.exec:\9jvpd.exe84⤵PID:4152
-
\??\c:\rflfrrr.exec:\rflfrrr.exe85⤵PID:752
-
\??\c:\hhhbtn.exec:\hhhbtn.exe86⤵PID:1152
-
\??\c:\jvjjp.exec:\jvjjp.exe87⤵PID:3200
-
\??\c:\frlxrrx.exec:\frlxrrx.exe88⤵PID:3328
-
\??\c:\tttnnn.exec:\tttnnn.exe89⤵PID:4348
-
\??\c:\3ddvp.exec:\3ddvp.exe90⤵PID:208
-
\??\c:\ntthnh.exec:\ntthnh.exe91⤵PID:784
-
\??\c:\nbbttt.exec:\nbbttt.exe92⤵PID:556
-
\??\c:\1dpvp.exec:\1dpvp.exe93⤵PID:2804
-
\??\c:\rlxxrll.exec:\rlxxrll.exe94⤵PID:4024
-
\??\c:\tbhhhh.exec:\tbhhhh.exe95⤵PID:2612
-
\??\c:\nbbbbb.exec:\nbbbbb.exe96⤵PID:4116
-
\??\c:\9djdp.exec:\9djdp.exe97⤵PID:4308
-
\??\c:\9rffrxr.exec:\9rffrxr.exe98⤵PID:2184
-
\??\c:\1tbnbt.exec:\1tbnbt.exe99⤵PID:3380
-
\??\c:\jdjdj.exec:\jdjdj.exe100⤵PID:2996
-
\??\c:\jdjdv.exec:\jdjdv.exe101⤵PID:1956
-
\??\c:\5tbhhn.exec:\5tbhhn.exe102⤵PID:2416
-
\??\c:\jddvp.exec:\jddvp.exe103⤵PID:4624
-
\??\c:\vvdvp.exec:\vvdvp.exe104⤵PID:3776
-
\??\c:\frxxrxf.exec:\frxxrxf.exe105⤵PID:2712
-
\??\c:\nhtbtt.exec:\nhtbtt.exe106⤵PID:884
-
\??\c:\vppjj.exec:\vppjj.exe107⤵PID:2436
-
\??\c:\vjjpj.exec:\vjjpj.exe108⤵PID:1524
-
\??\c:\fxxrfff.exec:\fxxrfff.exe109⤵PID:2592
-
\??\c:\7htttb.exec:\7htttb.exe110⤵PID:4436
-
\??\c:\htbbbn.exec:\htbbbn.exe111⤵PID:1448
-
\??\c:\9pddv.exec:\9pddv.exe112⤵PID:2540
-
\??\c:\pjppj.exec:\pjppj.exe113⤵PID:4072
-
\??\c:\xxxrllf.exec:\xxxrllf.exe114⤵PID:896
-
\??\c:\lllffff.exec:\lllffff.exe115⤵PID:2476
-
\??\c:\tthbhn.exec:\tthbhn.exe116⤵PID:1104
-
\??\c:\nbnbbb.exec:\nbnbbb.exe117⤵PID:3936
-
\??\c:\vjddd.exec:\vjddd.exe118⤵PID:632
-
\??\c:\rxffxxr.exec:\rxffxxr.exe119⤵PID:2892
-
\??\c:\nnthhn.exec:\nnthhn.exe120⤵PID:1388
-
\??\c:\vjpjd.exec:\vjpjd.exe121⤵PID:4976
-
\??\c:\djvvj.exec:\djvvj.exe122⤵PID:112
-
\??\c:\1rffxlf.exec:\1rffxlf.exe123⤵PID:336
-
\??\c:\fflfxxx.exec:\fflfxxx.exe124⤵PID:1644
-
\??\c:\hbbtbb.exec:\hbbtbb.exe125⤵PID:4372
-
\??\c:\tnbthh.exec:\tnbthh.exe126⤵PID:3772
-
\??\c:\jdjdv.exec:\jdjdv.exe127⤵PID:4024
-
\??\c:\vvpvj.exec:\vvpvj.exe128⤵PID:216
-
\??\c:\fxffxxx.exec:\fxffxxx.exe129⤵PID:1860
-
\??\c:\lflrxll.exec:\lflrxll.exe130⤵PID:2492
-
\??\c:\tnbbtt.exec:\tnbbtt.exe131⤵PID:1972
-
\??\c:\1jjpj.exec:\1jjpj.exe132⤵PID:4968
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe133⤵PID:1184
-
\??\c:\xxfffff.exec:\xxfffff.exe134⤵PID:2052
-
\??\c:\llllflf.exec:\llllflf.exe135⤵PID:1692
-
\??\c:\hnbbbb.exec:\hnbbbb.exe136⤵PID:1524
-
\??\c:\hbtttt.exec:\hbtttt.exe137⤵PID:1272
-
\??\c:\vvdjp.exec:\vvdjp.exe138⤵PID:1340
-
\??\c:\vjvdj.exec:\vjvdj.exe139⤵PID:3204
-
\??\c:\flfflxr.exec:\flfflxr.exe140⤵PID:2540
-
\??\c:\hbnnhh.exec:\hbnnhh.exe141⤵PID:4072
-
\??\c:\bhhhtn.exec:\bhhhtn.exe142⤵PID:2888
-
\??\c:\jdddp.exec:\jdddp.exe143⤵PID:4800
-
\??\c:\xlxxllf.exec:\xlxxllf.exe144⤵PID:2484
-
\??\c:\xrrrxrf.exec:\xrrrxrf.exe145⤵PID:2632
-
\??\c:\9nttbh.exec:\9nttbh.exe146⤵PID:3200
-
\??\c:\hhnhbb.exec:\hhnhbb.exe147⤵PID:1684
-
\??\c:\nhtthh.exec:\nhtthh.exe148⤵PID:4548
-
\??\c:\vvvjv.exec:\vvvjv.exe149⤵PID:784
-
\??\c:\9flfxff.exec:\9flfxff.exe150⤵PID:1644
-
\??\c:\rrrffff.exec:\rrrffff.exe151⤵PID:4372
-
\??\c:\htbbtn.exec:\htbbtn.exe152⤵PID:3188
-
\??\c:\tnnhtt.exec:\tnnhtt.exe153⤵PID:1872
-
\??\c:\vpvvv.exec:\vpvvv.exe154⤵PID:2908
-
\??\c:\pvddv.exec:\pvddv.exe155⤵PID:1860
-
\??\c:\ffxrlxr.exec:\ffxrlxr.exe156⤵PID:1736
-
\??\c:\xrrrfrl.exec:\xrrrfrl.exe157⤵PID:1788
-
\??\c:\5btnhb.exec:\5btnhb.exe158⤵PID:3624
-
\??\c:\tbnbbn.exec:\tbnbbn.exe159⤵PID:1184
-
\??\c:\7jjdd.exec:\7jjdd.exe160⤵PID:1584
-
\??\c:\3ppjd.exec:\3ppjd.exe161⤵PID:3180
-
\??\c:\lffffff.exec:\lffffff.exe162⤵PID:4204
-
\??\c:\tnnntb.exec:\tnnntb.exe163⤵PID:3812
-
\??\c:\jjdjp.exec:\jjdjp.exe164⤵PID:1448
-
\??\c:\vppdd.exec:\vppdd.exe165⤵PID:896
-
\??\c:\frrrllf.exec:\frrrllf.exe166⤵PID:3044
-
\??\c:\xfxlxll.exec:\xfxlxll.exe167⤵PID:752
-
\??\c:\tntnhh.exec:\tntnhh.exe168⤵PID:3964
-
\??\c:\bhtnhh.exec:\bhtnhh.exe169⤵PID:2520
-
\??\c:\jjpjp.exec:\jjpjp.exe170⤵PID:3328
-
\??\c:\1dvvv.exec:\1dvvv.exe171⤵PID:112
-
\??\c:\lffxxxr.exec:\lffxxxr.exe172⤵PID:208
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe173⤵PID:2936
-
\??\c:\btttnb.exec:\btttnb.exe174⤵PID:5024
-
\??\c:\jvpvj.exec:\jvpvj.exe175⤵PID:2612
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe176⤵PID:4372
-
\??\c:\frxfxxx.exec:\frxfxxx.exe177⤵PID:3188
-
\??\c:\ddjvp.exec:\ddjvp.exe178⤵PID:4532
-
\??\c:\rfrrrfx.exec:\rfrrrfx.exe179⤵PID:1452
-
\??\c:\tbbtnh.exec:\tbbtnh.exe180⤵PID:2568
-
\??\c:\dvvpd.exec:\dvvpd.exe181⤵PID:1640
-
\??\c:\lffrrff.exec:\lffrrff.exe182⤵PID:3956
-
\??\c:\tbnnhb.exec:\tbnnhb.exe183⤵PID:1016
-
\??\c:\vvddv.exec:\vvddv.exe184⤵PID:2788
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe185⤵PID:3244
-
\??\c:\hnhbtb.exec:\hnhbtb.exe186⤵PID:2696
-
\??\c:\9rfxflf.exec:\9rfxflf.exe187⤵PID:3000
-
\??\c:\rlxxxfx.exec:\rlxxxfx.exe188⤵PID:4640
-
\??\c:\hbhnbt.exec:\hbhnbt.exe189⤵PID:2164
-
\??\c:\7pdvp.exec:\7pdvp.exe190⤵PID:4072
-
\??\c:\vvjjv.exec:\vvjjv.exe191⤵PID:2888
-
\??\c:\thnnnh.exec:\thnnnh.exe192⤵PID:5108
-
\??\c:\vdjjv.exec:\vdjjv.exe193⤵PID:1032
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe194⤵PID:1528
-
\??\c:\xxllffx.exec:\xxllffx.exe195⤵PID:1504
-
\??\c:\hbhhbb.exec:\hbhhbb.exe196⤵PID:1988
-
\??\c:\tbbbnt.exec:\tbbbnt.exe197⤵PID:1056
-
\??\c:\7pppj.exec:\7pppj.exe198⤵PID:4832
-
\??\c:\jvdjp.exec:\jvdjp.exe199⤵PID:372
-
\??\c:\rxlfflf.exec:\rxlfflf.exe200⤵PID:4272
-
\??\c:\bnnnhh.exec:\bnnnhh.exe201⤵PID:4024
-
\??\c:\djvpj.exec:\djvpj.exe202⤵PID:4112
-
\??\c:\1ddvp.exec:\1ddvp.exe203⤵PID:3164
-
\??\c:\9llfffx.exec:\9llfffx.exe204⤵PID:1452
-
\??\c:\nhbtnn.exec:\nhbtnn.exe205⤵PID:4968
-
\??\c:\jppdd.exec:\jppdd.exe206⤵PID:2236
-
\??\c:\lfxfxlr.exec:\lfxfxlr.exe207⤵PID:1288
-
\??\c:\5hnnnb.exec:\5hnnnb.exe208⤵PID:1692
-
\??\c:\thnbtb.exec:\thnbtb.exe209⤵PID:2592
-
\??\c:\7pdvp.exec:\7pdvp.exe210⤵PID:4436
-
\??\c:\vvdjv.exec:\vvdjv.exe211⤵PID:2560
-
\??\c:\7flfffx.exec:\7flfffx.exe212⤵PID:3000
-
\??\c:\nhhbbh.exec:\nhhbbh.exe213⤵PID:1448
-
\??\c:\btttnn.exec:\btttnn.exe214⤵PID:2164
-
\??\c:\dppvp.exec:\dppvp.exe215⤵PID:4072
-
\??\c:\pdjjd.exec:\pdjjd.exe216⤵PID:1668
-
\??\c:\1llfxxr.exec:\1llfxxr.exe217⤵PID:1152
-
\??\c:\xrxxfff.exec:\xrxxfff.exe218⤵PID:2632
-
\??\c:\9bthhh.exec:\9bthhh.exe219⤵PID:2564
-
\??\c:\vppjd.exec:\vppjd.exe220⤵PID:4508
-
\??\c:\dvvvj.exec:\dvvvj.exe221⤵PID:1988
-
\??\c:\pjjpj.exec:\pjjpj.exe222⤵PID:4548
-
\??\c:\lfxrffx.exec:\lfxrffx.exe223⤵PID:1212
-
\??\c:\bhnnhh.exec:\bhnnhh.exe224⤵PID:3772
-
\??\c:\htbbtt.exec:\htbbtt.exe225⤵PID:4572
-
\??\c:\vvjvp.exec:\vvjvp.exe226⤵PID:3240
-
\??\c:\1rrrrrr.exec:\1rrrrrr.exe227⤵PID:1736
-
\??\c:\xlrrlll.exec:\xlrrlll.exe228⤵PID:2568
-
\??\c:\bnnnnn.exec:\bnnnnn.exe229⤵PID:4452
-
\??\c:\btnhhh.exec:\btnhhh.exe230⤵PID:1584
-
\??\c:\vpdvp.exec:\vpdvp.exe231⤵PID:3040
-
\??\c:\5xrlffx.exec:\5xrlffx.exe232⤵PID:4404
-
\??\c:\xllllll.exec:\xllllll.exe233⤵PID:4588
-
\??\c:\1bhtnn.exec:\1bhtnn.exe234⤵PID:2848
-
\??\c:\ntbbtb.exec:\ntbbtb.exe235⤵PID:3000
-
\??\c:\vpddj.exec:\vpddj.exe236⤵PID:3008
-
\??\c:\rllfffx.exec:\rllfffx.exe237⤵PID:1072
-
\??\c:\3llfxxr.exec:\3llfxxr.exe238⤵PID:3936
-
\??\c:\bnnntt.exec:\bnnntt.exe239⤵PID:1892
-
\??\c:\3hnhbb.exec:\3hnhbb.exe240⤵PID:1912
-
\??\c:\djvvp.exec:\djvvp.exe241⤵PID:4208
-
\??\c:\vpjdj.exec:\vpjdj.exe242⤵PID:1764