Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 05:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86bb743dcd4965f3587c9d736a9dd660_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
86bb743dcd4965f3587c9d736a9dd660_NeikiAnalytics.exe
-
Size
64KB
-
MD5
86bb743dcd4965f3587c9d736a9dd660
-
SHA1
f826759064746a2e8b74ab7b2db37e6aef5937c5
-
SHA256
f009f8375abde1c5967c027b2800fc80cd60b20e82ca696cbbb98f92cdf97ceb
-
SHA512
e50495db271829268c64c37e4016e6f9a03a5975addfd50260e9336db7198dd2c62de669a160a0ebc73fa27072b383fddc410bbf329a8d2ea00378ab559b217d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+Luvd0:ymb3NkkiQ3mdBjF0yMl1
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral2/memory/2812-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/860-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1284-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7xxlxrl.exennnhhb.exe1jdpd.exerrlxlfr.exexrfxfxr.exe7bhtbb.exe5nnbnh.exevdjpd.exelfxrfxr.exehnnhtt.exedvpdv.exevjdvj.exe7xxrxrf.exebtbnnh.exejjvpv.exe5vvvj.exelrrlffx.exexfflxrl.exenbnntt.exejdvpd.exexrrflxl.exelxrlfxx.exennnntt.exetbbbtt.exevpvpp.exevvvpd.exeflfxxxx.exehbhhhh.exebtnntb.exevvjdj.exedpppv.exefxrrllf.exetnbthh.exehthntn.exejddvp.exejpdvp.exeflllxrf.exelxxfxxr.exe9ttnhh.exe1pjvp.exe7rxrxxr.exefxxxxll.exehtbbbb.exetntntt.exeddvvp.exe1ppjd.exe5frrxxf.exebnnhhb.exe5vvpj.exelflfrrr.exefrrrllf.exennhhbb.exe1bnnhh.exejvvpp.exe5pvpd.exexxrlxxx.exerlfxrrl.exe5frrxxx.exethtbtt.exentbttt.exe9vddd.exeddjdd.exe5rxxlff.exerrlxrlr.exepid process 2556 7xxlxrl.exe 3404 nnnhhb.exe 2400 1jdpd.exe 2116 rrlxlfr.exe 2212 xrfxfxr.exe 1692 7bhtbb.exe 4788 5nnbnh.exe 1904 vdjpd.exe 3816 lfxrfxr.exe 2380 hnnhtt.exe 4392 dvpdv.exe 2588 vjdvj.exe 1776 7xxrxrf.exe 4536 btbnnh.exe 556 jjvpv.exe 1872 5vvvj.exe 5108 lrrlffx.exe 1344 xfflxrl.exe 912 nbnntt.exe 1016 jdvpd.exe 3960 xrrflxl.exe 1000 lxrlfxx.exe 4564 nnnntt.exe 2388 tbbbtt.exe 860 vpvpp.exe 772 vvvpd.exe 3124 flfxxxx.exe 3224 hbhhhh.exe 740 btnntb.exe 1284 vvjdj.exe 2900 dpppv.exe 4736 fxrrllf.exe 2616 tnbthh.exe 4404 hthntn.exe 3516 jddvp.exe 4396 jpdvp.exe 4180 flllxrf.exe 3236 lxxfxxr.exe 4332 9ttnhh.exe 4952 1pjvp.exe 3588 7rxrxxr.exe 1544 fxxxxll.exe 2700 htbbbb.exe 2308 tntntt.exe 448 ddvvp.exe 4636 1ppjd.exe 596 5frrxxf.exe 4568 bnnhhb.exe 4336 5vvpj.exe 4576 lflfrrr.exe 1964 frrrllf.exe 5040 nnhhbb.exe 3752 1bnnhh.exe 3780 jvvpp.exe 2444 5pvpd.exe 3156 xxrlxxx.exe 3936 rlfxrrl.exe 4312 5frrxxx.exe 4356 thtbtt.exe 2544 ntbttt.exe 4460 9vddd.exe 4588 ddjdd.exe 4500 5rxxlff.exe 1912 rrlxrlr.exe -
Processes:
resource yara_rule behavioral2/memory/2812-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4392-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/860-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
86bb743dcd4965f3587c9d736a9dd660_NeikiAnalytics.exe7xxlxrl.exennnhhb.exe1jdpd.exerrlxlfr.exexrfxfxr.exe7bhtbb.exe5nnbnh.exevdjpd.exelfxrfxr.exehnnhtt.exedvpdv.exevjdvj.exe7xxrxrf.exebtbnnh.exejjvpv.exe5vvvj.exelrrlffx.exexfflxrl.exenbnntt.exejdvpd.exexrrflxl.exedescription pid process target process PID 2812 wrote to memory of 2556 2812 86bb743dcd4965f3587c9d736a9dd660_NeikiAnalytics.exe 7xxlxrl.exe PID 2812 wrote to memory of 2556 2812 86bb743dcd4965f3587c9d736a9dd660_NeikiAnalytics.exe 7xxlxrl.exe PID 2812 wrote to memory of 2556 2812 86bb743dcd4965f3587c9d736a9dd660_NeikiAnalytics.exe 7xxlxrl.exe PID 2556 wrote to memory of 3404 2556 7xxlxrl.exe nnnhhb.exe PID 2556 wrote to memory of 3404 2556 7xxlxrl.exe nnnhhb.exe PID 2556 wrote to memory of 3404 2556 7xxlxrl.exe nnnhhb.exe PID 3404 wrote to memory of 2400 3404 nnnhhb.exe 1jdpd.exe PID 3404 wrote to memory of 2400 3404 nnnhhb.exe 1jdpd.exe PID 3404 wrote to memory of 2400 3404 nnnhhb.exe 1jdpd.exe PID 2400 wrote to memory of 2116 2400 1jdpd.exe rrlxlfr.exe PID 2400 wrote to memory of 2116 2400 1jdpd.exe rrlxlfr.exe PID 2400 wrote to memory of 2116 2400 1jdpd.exe rrlxlfr.exe PID 2116 wrote to memory of 2212 2116 rrlxlfr.exe xrfxfxr.exe PID 2116 wrote to memory of 2212 2116 rrlxlfr.exe xrfxfxr.exe PID 2116 wrote to memory of 2212 2116 rrlxlfr.exe xrfxfxr.exe PID 2212 wrote to memory of 1692 2212 xrfxfxr.exe 7bhtbb.exe PID 2212 wrote to memory of 1692 2212 xrfxfxr.exe 7bhtbb.exe PID 2212 wrote to memory of 1692 2212 xrfxfxr.exe 7bhtbb.exe PID 1692 wrote to memory of 4788 1692 7bhtbb.exe 5nnbnh.exe PID 1692 wrote to memory of 4788 1692 7bhtbb.exe 5nnbnh.exe PID 1692 wrote to memory of 4788 1692 7bhtbb.exe 5nnbnh.exe PID 4788 wrote to memory of 1904 4788 5nnbnh.exe vdjpd.exe PID 4788 wrote to memory of 1904 4788 5nnbnh.exe vdjpd.exe PID 4788 wrote to memory of 1904 4788 5nnbnh.exe vdjpd.exe PID 1904 wrote to memory of 3816 1904 vdjpd.exe lfxrfxr.exe PID 1904 wrote to memory of 3816 1904 vdjpd.exe lfxrfxr.exe PID 1904 wrote to memory of 3816 1904 vdjpd.exe lfxrfxr.exe PID 3816 wrote to memory of 2380 3816 lfxrfxr.exe hnnhtt.exe PID 3816 wrote to memory of 2380 3816 lfxrfxr.exe hnnhtt.exe PID 3816 wrote to memory of 2380 3816 lfxrfxr.exe hnnhtt.exe PID 2380 wrote to memory of 4392 2380 hnnhtt.exe dvpdv.exe PID 2380 wrote to memory of 4392 2380 hnnhtt.exe dvpdv.exe PID 2380 wrote to memory of 4392 2380 hnnhtt.exe dvpdv.exe PID 4392 wrote to memory of 2588 4392 dvpdv.exe vjdvj.exe PID 4392 wrote to memory of 2588 4392 dvpdv.exe vjdvj.exe PID 4392 wrote to memory of 2588 4392 dvpdv.exe vjdvj.exe PID 2588 wrote to memory of 1776 2588 vjdvj.exe 7xxrxrf.exe PID 2588 wrote to memory of 1776 2588 vjdvj.exe 7xxrxrf.exe PID 2588 wrote to memory of 1776 2588 vjdvj.exe 7xxrxrf.exe PID 1776 wrote to memory of 4536 1776 7xxrxrf.exe btbnnh.exe PID 1776 wrote to memory of 4536 1776 7xxrxrf.exe btbnnh.exe PID 1776 wrote to memory of 4536 1776 7xxrxrf.exe btbnnh.exe PID 4536 wrote to memory of 556 4536 btbnnh.exe jjvpv.exe PID 4536 wrote to memory of 556 4536 btbnnh.exe jjvpv.exe PID 4536 wrote to memory of 556 4536 btbnnh.exe jjvpv.exe PID 556 wrote to memory of 1872 556 jjvpv.exe 5vvvj.exe PID 556 wrote to memory of 1872 556 jjvpv.exe 5vvvj.exe PID 556 wrote to memory of 1872 556 jjvpv.exe 5vvvj.exe PID 1872 wrote to memory of 5108 1872 5vvvj.exe lrrlffx.exe PID 1872 wrote to memory of 5108 1872 5vvvj.exe lrrlffx.exe PID 1872 wrote to memory of 5108 1872 5vvvj.exe lrrlffx.exe PID 5108 wrote to memory of 1344 5108 lrrlffx.exe xfflxrl.exe PID 5108 wrote to memory of 1344 5108 lrrlffx.exe xfflxrl.exe PID 5108 wrote to memory of 1344 5108 lrrlffx.exe xfflxrl.exe PID 1344 wrote to memory of 912 1344 xfflxrl.exe nbnntt.exe PID 1344 wrote to memory of 912 1344 xfflxrl.exe nbnntt.exe PID 1344 wrote to memory of 912 1344 xfflxrl.exe nbnntt.exe PID 912 wrote to memory of 1016 912 nbnntt.exe jdvpd.exe PID 912 wrote to memory of 1016 912 nbnntt.exe jdvpd.exe PID 912 wrote to memory of 1016 912 nbnntt.exe jdvpd.exe PID 1016 wrote to memory of 3960 1016 jdvpd.exe xrrflxl.exe PID 1016 wrote to memory of 3960 1016 jdvpd.exe xrrflxl.exe PID 1016 wrote to memory of 3960 1016 jdvpd.exe xrrflxl.exe PID 3960 wrote to memory of 1000 3960 xrrflxl.exe lxrlfxx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\86bb743dcd4965f3587c9d736a9dd660_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\86bb743dcd4965f3587c9d736a9dd660_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\7xxlxrl.exec:\7xxlxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\nnnhhb.exec:\nnnhhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\1jdpd.exec:\1jdpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\rrlxlfr.exec:\rrlxlfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\xrfxfxr.exec:\xrfxfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\7bhtbb.exec:\7bhtbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\5nnbnh.exec:\5nnbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\vdjpd.exec:\vdjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\lfxrfxr.exec:\lfxrfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\hnnhtt.exec:\hnnhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\dvpdv.exec:\dvpdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\vjdvj.exec:\vjdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\7xxrxrf.exec:\7xxrxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\btbnnh.exec:\btbnnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\jjvpv.exec:\jjvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\5vvvj.exec:\5vvvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\lrrlffx.exec:\lrrlffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\xfflxrl.exec:\xfflxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\nbnntt.exec:\nbnntt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\jdvpd.exec:\jdvpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\xrrflxl.exec:\xrrflxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\lxrlfxx.exec:\lxrlfxx.exe23⤵
- Executes dropped EXE
PID:1000 -
\??\c:\nnnntt.exec:\nnnntt.exe24⤵
- Executes dropped EXE
PID:4564 -
\??\c:\tbbbtt.exec:\tbbbtt.exe25⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vpvpp.exec:\vpvpp.exe26⤵
- Executes dropped EXE
PID:860 -
\??\c:\vvvpd.exec:\vvvpd.exe27⤵
- Executes dropped EXE
PID:772 -
\??\c:\flfxxxx.exec:\flfxxxx.exe28⤵
- Executes dropped EXE
PID:3124 -
\??\c:\hbhhhh.exec:\hbhhhh.exe29⤵
- Executes dropped EXE
PID:3224 -
\??\c:\btnntb.exec:\btnntb.exe30⤵
- Executes dropped EXE
PID:740 -
\??\c:\vvjdj.exec:\vvjdj.exe31⤵
- Executes dropped EXE
PID:1284 -
\??\c:\dpppv.exec:\dpppv.exe32⤵
- Executes dropped EXE
PID:2900 -
\??\c:\fxrrllf.exec:\fxrrllf.exe33⤵
- Executes dropped EXE
PID:4736 -
\??\c:\tnbthh.exec:\tnbthh.exe34⤵
- Executes dropped EXE
PID:2616 -
\??\c:\hthntn.exec:\hthntn.exe35⤵
- Executes dropped EXE
PID:4404 -
\??\c:\jddvp.exec:\jddvp.exe36⤵
- Executes dropped EXE
PID:3516 -
\??\c:\jpdvp.exec:\jpdvp.exe37⤵
- Executes dropped EXE
PID:4396 -
\??\c:\flllxrf.exec:\flllxrf.exe38⤵
- Executes dropped EXE
PID:4180 -
\??\c:\lxxfxxr.exec:\lxxfxxr.exe39⤵
- Executes dropped EXE
PID:3236 -
\??\c:\9ttnhh.exec:\9ttnhh.exe40⤵
- Executes dropped EXE
PID:4332 -
\??\c:\1pjvp.exec:\1pjvp.exe41⤵
- Executes dropped EXE
PID:4952 -
\??\c:\7rxrxxr.exec:\7rxrxxr.exe42⤵
- Executes dropped EXE
PID:3588 -
\??\c:\fxxxxll.exec:\fxxxxll.exe43⤵
- Executes dropped EXE
PID:1544 -
\??\c:\htbbbb.exec:\htbbbb.exe44⤵
- Executes dropped EXE
PID:2700 -
\??\c:\tntntt.exec:\tntntt.exe45⤵
- Executes dropped EXE
PID:2308 -
\??\c:\ddvvp.exec:\ddvvp.exe46⤵
- Executes dropped EXE
PID:448 -
\??\c:\1ppjd.exec:\1ppjd.exe47⤵
- Executes dropped EXE
PID:4636 -
\??\c:\5frrxxf.exec:\5frrxxf.exe48⤵
- Executes dropped EXE
PID:596 -
\??\c:\bnnhhb.exec:\bnnhhb.exe49⤵
- Executes dropped EXE
PID:4568 -
\??\c:\5vvpj.exec:\5vvpj.exe50⤵
- Executes dropped EXE
PID:4336 -
\??\c:\lflfrrr.exec:\lflfrrr.exe51⤵
- Executes dropped EXE
PID:4576 -
\??\c:\frrrllf.exec:\frrrllf.exe52⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nnhhbb.exec:\nnhhbb.exe53⤵
- Executes dropped EXE
PID:5040 -
\??\c:\1bnnhh.exec:\1bnnhh.exe54⤵
- Executes dropped EXE
PID:3752 -
\??\c:\jvvpp.exec:\jvvpp.exe55⤵
- Executes dropped EXE
PID:3780 -
\??\c:\5pvpd.exec:\5pvpd.exe56⤵
- Executes dropped EXE
PID:2444 -
\??\c:\xxrlxxx.exec:\xxrlxxx.exe57⤵
- Executes dropped EXE
PID:3156 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe58⤵
- Executes dropped EXE
PID:3936 -
\??\c:\5frrxxx.exec:\5frrxxx.exe59⤵
- Executes dropped EXE
PID:4312 -
\??\c:\thtbtt.exec:\thtbtt.exe60⤵
- Executes dropped EXE
PID:4356 -
\??\c:\ntbttt.exec:\ntbttt.exe61⤵
- Executes dropped EXE
PID:2544 -
\??\c:\9vddd.exec:\9vddd.exe62⤵
- Executes dropped EXE
PID:4460 -
\??\c:\ddjdd.exec:\ddjdd.exe63⤵
- Executes dropped EXE
PID:4588 -
\??\c:\5rxxlff.exec:\5rxxlff.exe64⤵
- Executes dropped EXE
PID:4500 -
\??\c:\rrlxrlr.exec:\rrlxrlr.exe65⤵
- Executes dropped EXE
PID:1912 -
\??\c:\hnbtnh.exec:\hnbtnh.exe66⤵PID:4032
-
\??\c:\pppjd.exec:\pppjd.exe67⤵PID:748
-
\??\c:\vppjd.exec:\vppjd.exe68⤵PID:3168
-
\??\c:\3lfrxrf.exec:\3lfrxrf.exe69⤵PID:3036
-
\??\c:\5lfxlfx.exec:\5lfxlfx.exe70⤵PID:808
-
\??\c:\1tbbtt.exec:\1tbbtt.exe71⤵PID:4480
-
\??\c:\bntthh.exec:\bntthh.exe72⤵PID:860
-
\??\c:\7nthbn.exec:\7nthbn.exe73⤵PID:1824
-
\??\c:\1ppdp.exec:\1ppdp.exe74⤵PID:2232
-
\??\c:\dvpdj.exec:\dvpdj.exe75⤵PID:660
-
\??\c:\xrrrxxf.exec:\xrrrxxf.exe76⤵PID:4380
-
\??\c:\lrlxlfr.exec:\lrlxlfr.exe77⤵PID:4852
-
\??\c:\5nbthh.exec:\5nbthh.exe78⤵PID:3056
-
\??\c:\3bbntn.exec:\3bbntn.exe79⤵PID:4876
-
\??\c:\pdvdv.exec:\pdvdv.exe80⤵PID:4940
-
\??\c:\vpdpd.exec:\vpdpd.exe81⤵PID:4736
-
\??\c:\lllxlxr.exec:\lllxlxr.exe82⤵PID:4752
-
\??\c:\3hbtht.exec:\3hbtht.exe83⤵PID:2036
-
\??\c:\thhtbt.exec:\thhtbt.exe84⤵PID:368
-
\??\c:\vjdpv.exec:\vjdpv.exe85⤵PID:4396
-
\??\c:\xxfrfxr.exec:\xxfrfxr.exe86⤵PID:3592
-
\??\c:\hnbthb.exec:\hnbthb.exe87⤵PID:700
-
\??\c:\ttnbnn.exec:\ttnbnn.exe88⤵PID:4368
-
\??\c:\1nbtht.exec:\1nbtht.exe89⤵PID:1852
-
\??\c:\vppvj.exec:\vppvj.exe90⤵PID:3588
-
\??\c:\pvvjv.exec:\pvvjv.exe91⤵PID:3524
-
\??\c:\rxlxflr.exec:\rxlxflr.exe92⤵PID:2700
-
\??\c:\1lffrlf.exec:\1lffrlf.exe93⤵PID:2152
-
\??\c:\btnhtb.exec:\btnhtb.exe94⤵PID:4408
-
\??\c:\hhbthb.exec:\hhbthb.exe95⤵PID:1472
-
\??\c:\pjdpv.exec:\pjdpv.exe96⤵PID:1172
-
\??\c:\pjvvj.exec:\pjvvj.exe97⤵PID:1692
-
\??\c:\llxrfxf.exec:\llxrfxf.exe98⤵PID:4540
-
\??\c:\5xfffxf.exec:\5xfffxf.exe99⤵PID:2120
-
\??\c:\bnthbt.exec:\bnthbt.exe100⤵PID:964
-
\??\c:\5nnbnn.exec:\5nnbnn.exe101⤵PID:2580
-
\??\c:\pdpdp.exec:\pdpdp.exe102⤵PID:5024
-
\??\c:\lrfrflx.exec:\lrfrflx.exe103⤵PID:1352
-
\??\c:\7ffxxrf.exec:\7ffxxrf.exe104⤵PID:2912
-
\??\c:\tnbnbb.exec:\tnbnbb.exe105⤵PID:3780
-
\??\c:\hnnbnb.exec:\hnnbnb.exe106⤵PID:1972
-
\??\c:\pvdvp.exec:\pvdvp.exe107⤵PID:4960
-
\??\c:\jvdvv.exec:\jvdvv.exe108⤵PID:4188
-
\??\c:\frrfrlx.exec:\frrfrlx.exe109⤵PID:4776
-
\??\c:\nbbnhb.exec:\nbbnhb.exe110⤵PID:3084
-
\??\c:\dpjpj.exec:\dpjpj.exe111⤵PID:1988
-
\??\c:\dpdpp.exec:\dpdpp.exe112⤵PID:1344
-
\??\c:\lxrflfx.exec:\lxrflfx.exe113⤵PID:4456
-
\??\c:\xffrfxr.exec:\xffrfxr.exe114⤵PID:1748
-
\??\c:\tnbhnt.exec:\tnbhnt.exe115⤵PID:5080
-
\??\c:\ththbt.exec:\ththbt.exe116⤵PID:3960
-
\??\c:\9vjvj.exec:\9vjvj.exe117⤵PID:3168
-
\??\c:\lfffxxr.exec:\lfffxxr.exe118⤵PID:4376
-
\??\c:\9nhtht.exec:\9nhtht.exe119⤵PID:2352
-
\??\c:\tbthnb.exec:\tbthnb.exe120⤵PID:4136
-
\??\c:\jpjvj.exec:\jpjvj.exe121⤵PID:4820
-
\??\c:\9dpdj.exec:\9dpdj.exe122⤵PID:1828
-
\??\c:\7xrlrlx.exec:\7xrlrlx.exe123⤵PID:4348
-
\??\c:\hbttht.exec:\hbttht.exe124⤵PID:4912
-
\??\c:\bnntht.exec:\bnntht.exe125⤵PID:5048
-
\??\c:\dvjdv.exec:\dvjdv.exe126⤵PID:3776
-
\??\c:\dpjjv.exec:\dpjjv.exe127⤵PID:4008
-
\??\c:\pdvvd.exec:\pdvvd.exe128⤵PID:4364
-
\??\c:\xrrfrlx.exec:\xrrfrlx.exe129⤵PID:3264
-
\??\c:\nnhbnh.exec:\nnhbnh.exe130⤵PID:2268
-
\??\c:\nbtnbt.exec:\nbtnbt.exe131⤵PID:2532
-
\??\c:\pjdvd.exec:\pjdvd.exe132⤵PID:4760
-
\??\c:\ddjdv.exec:\ddjdv.exe133⤵PID:4320
-
\??\c:\frxxlfx.exec:\frxxlfx.exe134⤵PID:700
-
\??\c:\fffrllx.exec:\fffrllx.exe135⤵PID:4368
-
\??\c:\3nhtnh.exec:\3nhtnh.exe136⤵PID:1852
-
\??\c:\btnbbn.exec:\btnbbn.exe137⤵PID:1364
-
\??\c:\bnbnbt.exec:\bnbnbt.exe138⤵PID:1968
-
\??\c:\xxfffxx.exec:\xxfffxx.exe139⤵PID:2308
-
\??\c:\bnhbnh.exec:\bnhbnh.exe140⤵PID:4260
-
\??\c:\jppjj.exec:\jppjj.exe141⤵PID:2540
-
\??\c:\9vpjd.exec:\9vpjd.exe142⤵PID:4892
-
\??\c:\ffrlffx.exec:\ffrlffx.exe143⤵PID:4268
-
\??\c:\xxxxrrx.exec:\xxxxrrx.exe144⤵PID:1132
-
\??\c:\hhhhhn.exec:\hhhhhn.exe145⤵PID:4576
-
\??\c:\hhnhbb.exec:\hhnhbb.exe146⤵PID:516
-
\??\c:\pjvpj.exec:\pjvpj.exe147⤵PID:4860
-
\??\c:\jdddv.exec:\jdddv.exe148⤵PID:4624
-
\??\c:\rxlfrrr.exec:\rxlfrrr.exe149⤵PID:436
-
\??\c:\xrrllll.exec:\xrrllll.exe150⤵PID:1552
-
\??\c:\nnbtnn.exec:\nnbtnn.exe151⤵PID:3780
-
\??\c:\thnhtt.exec:\thnhtt.exe152⤵PID:4416
-
\??\c:\jjvvv.exec:\jjvvv.exe153⤵PID:4960
-
\??\c:\jdjdp.exec:\jdjdp.exe154⤵PID:828
-
\??\c:\fffxrrr.exec:\fffxrrr.exe155⤵PID:2544
-
\??\c:\lfxlxlf.exec:\lfxlxlf.exe156⤵PID:3652
-
\??\c:\xrfrrlr.exec:\xrfrrlr.exe157⤵PID:4588
-
\??\c:\ttttth.exec:\ttttth.exe158⤵PID:264
-
\??\c:\bhbbbb.exec:\bhbbbb.exe159⤵PID:3796
-
\??\c:\vjppj.exec:\vjppj.exe160⤵PID:748
-
\??\c:\fflrrrx.exec:\fflrrrx.exe161⤵PID:1640
-
\??\c:\lrrxrlf.exec:\lrrxrlf.exe162⤵PID:1456
-
\??\c:\9hhtnb.exec:\9hhtnb.exe163⤵PID:860
-
\??\c:\tntnht.exec:\tntnht.exe164⤵PID:2880
-
\??\c:\pppjj.exec:\pppjj.exe165⤵PID:4328
-
\??\c:\7jjdv.exec:\7jjdv.exe166⤵PID:1284
-
\??\c:\ffffrfl.exec:\ffffrfl.exe167⤵PID:3348
-
\??\c:\xrxrrlf.exec:\xrxrrlf.exe168⤵PID:5048
-
\??\c:\ttnthn.exec:\ttnthn.exe169⤵PID:2616
-
\??\c:\tntttt.exec:\tntttt.exe170⤵PID:3848
-
\??\c:\bbhnbh.exec:\bbhnbh.exe171⤵PID:4180
-
\??\c:\ddjpd.exec:\ddjpd.exe172⤵PID:1684
-
\??\c:\ppvpv.exec:\ppvpv.exe173⤵PID:4760
-
\??\c:\lxlrlll.exec:\lxlrlll.exe174⤵PID:2696
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe175⤵PID:700
-
\??\c:\3bbbtt.exec:\3bbbtt.exe176⤵PID:2408
-
\??\c:\hbnhhh.exec:\hbnhhh.exe177⤵PID:3524
-
\??\c:\jpvvv.exec:\jpvvv.exe178⤵PID:3424
-
\??\c:\ffffrxr.exec:\ffffrxr.exe179⤵PID:5116
-
\??\c:\ntbbtb.exec:\ntbbtb.exe180⤵PID:2264
-
\??\c:\bbhbtt.exec:\bbhbtt.exe181⤵PID:1780
-
\??\c:\ddvdd.exec:\ddvdd.exe182⤵PID:5020
-
\??\c:\dvdvd.exec:\dvdvd.exe183⤵PID:4540
-
\??\c:\lfllllr.exec:\lfllllr.exe184⤵PID:3820
-
\??\c:\frxffff.exec:\frxffff.exe185⤵PID:1044
-
\??\c:\tnbbhn.exec:\tnbbhn.exe186⤵PID:2580
-
\??\c:\nnntth.exec:\nnntth.exe187⤵PID:4392
-
\??\c:\vpddv.exec:\vpddv.exe188⤵PID:1724
-
\??\c:\vppjv.exec:\vppjv.exe189⤵PID:5052
-
\??\c:\frxrlrl.exec:\frxrlrl.exe190⤵PID:1776
-
\??\c:\3frrllr.exec:\3frrllr.exe191⤵PID:2848
-
\??\c:\ttnhhh.exec:\ttnhhh.exe192⤵PID:4132
-
\??\c:\btthtn.exec:\btthtn.exe193⤵PID:2412
-
\??\c:\5djdd.exec:\5djdd.exe194⤵PID:520
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe195⤵PID:2544
-
\??\c:\nhhhhn.exec:\nhhhhn.exe196⤵PID:3652
-
\??\c:\dvvvj.exec:\dvvvj.exe197⤵PID:4588
-
\??\c:\jjjjv.exec:\jjjjv.exe198⤵PID:1016
-
\??\c:\fxxrxxx.exec:\fxxrxxx.exe199⤵PID:2852
-
\??\c:\rxxxfll.exec:\rxxxfll.exe200⤵PID:440
-
\??\c:\lllxlff.exec:\lllxlff.exe201⤵PID:4524
-
\??\c:\3hntbb.exec:\3hntbb.exe202⤵PID:1456
-
\??\c:\ntbbbb.exec:\ntbbbb.exe203⤵PID:4432
-
\??\c:\vpppp.exec:\vpppp.exe204⤵PID:452
-
\??\c:\jppjv.exec:\jppjv.exe205⤵PID:4328
-
\??\c:\rlrlffx.exec:\rlrlffx.exe206⤵PID:3760
-
\??\c:\7xffxxl.exec:\7xffxxl.exe207⤵PID:1360
-
\??\c:\btbtnt.exec:\btbtnt.exe208⤵PID:1196
-
\??\c:\jdvvv.exec:\jdvvv.exe209⤵PID:2036
-
\??\c:\fxxrllf.exec:\fxxrllf.exe210⤵PID:3848
-
\??\c:\5frrlrr.exec:\5frrlrr.exe211⤵PID:4180
-
\??\c:\hbbbbt.exec:\hbbbbt.exe212⤵PID:3592
-
\??\c:\pjjpj.exec:\pjjpj.exe213⤵PID:4760
-
\??\c:\jpvjp.exec:\jpvjp.exe214⤵PID:1516
-
\??\c:\1fffxxx.exec:\1fffxxx.exe215⤵PID:992
-
\??\c:\3xffffl.exec:\3xffffl.exe216⤵PID:2408
-
\??\c:\tttnbt.exec:\tttnbt.exe217⤵PID:2152
-
\??\c:\bbhhtt.exec:\bbhhtt.exe218⤵PID:3424
-
\??\c:\djdpj.exec:\djdpj.exe219⤵PID:4260
-
\??\c:\1llfrxr.exec:\1llfrxr.exe220⤵PID:2264
-
\??\c:\rllfxxr.exec:\rllfxxr.exe221⤵PID:4788
-
\??\c:\tttttt.exec:\tttttt.exe222⤵PID:5020
-
\??\c:\vvdvj.exec:\vvdvj.exe223⤵PID:2120
-
\??\c:\jddvp.exec:\jddvp.exe224⤵PID:2380
-
\??\c:\rxxlrfx.exec:\rxxlrfx.exe225⤵PID:5000
-
\??\c:\bththh.exec:\bththh.exe226⤵PID:1352
-
\??\c:\hnhbtt.exec:\hnhbtt.exe227⤵PID:5112
-
\??\c:\dvppp.exec:\dvppp.exe228⤵PID:3728
-
\??\c:\vpvpj.exec:\vpvpj.exe229⤵PID:744
-
\??\c:\fxfflll.exec:\fxfflll.exe230⤵PID:2364
-
\??\c:\xxlflxx.exec:\xxlflxx.exe231⤵PID:3388
-
\??\c:\btbttn.exec:\btbttn.exe232⤵PID:1272
-
\??\c:\hbbbnt.exec:\hbbbnt.exe233⤵PID:4532
-
\??\c:\pjddj.exec:\pjddj.exe234⤵PID:4460
-
\??\c:\pvddd.exec:\pvddd.exe235⤵PID:1296
-
\??\c:\9flfxxx.exec:\9flfxxx.exe236⤵PID:1180
-
\??\c:\rflllrr.exec:\rflllrr.exe237⤵PID:4720
-
\??\c:\thhbtt.exec:\thhbtt.exe238⤵PID:264
-
\??\c:\hbtttt.exec:\hbtttt.exe239⤵PID:772
-
\??\c:\jjvpv.exec:\jjvpv.exe240⤵PID:860
-
\??\c:\pvpjd.exec:\pvpjd.exe241⤵PID:740
-
\??\c:\rfrlllx.exec:\rfrlllx.exe242⤵PID:452