Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 15:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e9604c33d206896b8e95eed6ddbdf6a0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e9604c33d206896b8e95eed6ddbdf6a0_NeikiAnalytics.exe
-
Size
68KB
-
MD5
e9604c33d206896b8e95eed6ddbdf6a0
-
SHA1
82d511aa124217d79877bf892792ea5bb6e15366
-
SHA256
7807aaf131d8b965f75642209248f621018f94eedc4c14d237707942f3e6c745
-
SHA512
bfffcefad0dc1eae8b0efba46d2f82c1200778b9ab68e02b4d4801502c0e7b60df90c99d3cc4c4dbea0b6cecafb1ba5e434c927d9fe364076e4173734659f0b5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89+t:ymb3NkkiQ3mdBjFIvl358nLA89o
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/2996-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5496-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6040-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1076-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3344-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/848-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/616-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5516-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nbbtnt.exejppjv.exelffrlll.exehhttnn.exedpjvj.exexrllfxx.exejvddv.exelxxxrlr.exenttnhb.exe1ddpj.exellxrllf.exeththnt.exevpjdp.exe7jvpp.exerxlrrrr.exehbtttt.exejpjdv.exellrrllr.exefxxxrrr.exennhtnb.exedjvvp.exexfllfrx.exentnbbt.exevpdvd.exenhtthb.exerlrrllf.exe5xffxxr.exenhhbbb.exedjdvv.exefrrlffr.exehtnnnn.exebttbtb.exedppjd.exevvvvv.exe1lrlflf.exentbtnh.exe9dpjd.exeffllfrr.exexxrlflf.exetbbtnn.exetbbtth.exe5ddvp.exe9pvpj.exelffxrlf.exehtntnn.exe1bhhbh.exe7jppp.exejdvpv.exerrllllx.exennnhbb.exenhhhhh.exevvddv.exexlrlfff.exe5nnnhh.exebthttn.exe1btttb.exedjpjd.exexrrrflf.exebtttbt.exehntbtt.exe1dpjd.exe3ffxlll.exelxlfffx.exe3ttnhh.exepid process 2996 nbbtnt.exe 1804 jppjv.exe 5496 lffrlll.exe 3372 hhttnn.exe 3916 dpjvj.exe 936 xrllfxx.exe 6040 jvddv.exe 1216 lxxxrlr.exe 4988 nttnhb.exe 3904 1ddpj.exe 1416 llxrllf.exe 2144 ththnt.exe 5212 vpjdp.exe 1076 7jvpp.exe 4220 rxlrrrr.exe 1232 hbtttt.exe 1980 jpjdv.exe 3344 llrrllr.exe 4484 fxxxrrr.exe 848 nnhtnb.exe 1852 djvvp.exe 5088 xfllfrx.exe 4552 ntnbbt.exe 5704 vpdvd.exe 1408 nhtthb.exe 4216 rlrrllf.exe 392 5xffxxr.exe 616 nhhbbb.exe 2192 djdvv.exe 4352 frrlffr.exe 5516 htnnnn.exe 3656 bttbtb.exe 2872 dppjd.exe 2232 vvvvv.exe 5304 1lrlflf.exe 1528 ntbtnh.exe 2792 9dpjd.exe 5768 ffllfrr.exe 3100 xxrlflf.exe 2492 tbbtnn.exe 5364 tbbtth.exe 1184 5ddvp.exe 1904 9pvpj.exe 212 lffxrlf.exe 2812 htntnn.exe 1800 1bhhbh.exe 4872 7jppp.exe 3636 jdvpv.exe 2364 rrllllx.exe 5016 nnnhbb.exe 2056 nhhhhh.exe 2444 vvddv.exe 2984 xlrlfff.exe 2224 5nnnhh.exe 3236 bthttn.exe 2476 1btttb.exe 5288 djpjd.exe 6080 xrrrflf.exe 6112 btttbt.exe 5236 hntbtt.exe 5908 1dpjd.exe 6060 3ffxlll.exe 3584 lxlfffx.exe 2296 3ttnhh.exe -
Processes:
resource yara_rule behavioral2/memory/4712-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5496-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6040-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1076-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3344-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/848-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/616-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5516-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e9604c33d206896b8e95eed6ddbdf6a0_NeikiAnalytics.exenbbtnt.exejppjv.exelffrlll.exehhttnn.exedpjvj.exexrllfxx.exejvddv.exelxxxrlr.exenttnhb.exe1ddpj.exellxrllf.exeththnt.exevpjdp.exe7jvpp.exerxlrrrr.exehbtttt.exejpjdv.exellrrllr.exefxxxrrr.exennhtnb.exedjvvp.exedescription pid process target process PID 4712 wrote to memory of 2996 4712 e9604c33d206896b8e95eed6ddbdf6a0_NeikiAnalytics.exe nbbtnt.exe PID 4712 wrote to memory of 2996 4712 e9604c33d206896b8e95eed6ddbdf6a0_NeikiAnalytics.exe nbbtnt.exe PID 4712 wrote to memory of 2996 4712 e9604c33d206896b8e95eed6ddbdf6a0_NeikiAnalytics.exe nbbtnt.exe PID 2996 wrote to memory of 1804 2996 nbbtnt.exe jppjv.exe PID 2996 wrote to memory of 1804 2996 nbbtnt.exe jppjv.exe PID 2996 wrote to memory of 1804 2996 nbbtnt.exe jppjv.exe PID 1804 wrote to memory of 5496 1804 jppjv.exe lffrlll.exe PID 1804 wrote to memory of 5496 1804 jppjv.exe lffrlll.exe PID 1804 wrote to memory of 5496 1804 jppjv.exe lffrlll.exe PID 5496 wrote to memory of 3372 5496 lffrlll.exe hhttnn.exe PID 5496 wrote to memory of 3372 5496 lffrlll.exe hhttnn.exe PID 5496 wrote to memory of 3372 5496 lffrlll.exe hhttnn.exe PID 3372 wrote to memory of 3916 3372 hhttnn.exe dpjvj.exe PID 3372 wrote to memory of 3916 3372 hhttnn.exe dpjvj.exe PID 3372 wrote to memory of 3916 3372 hhttnn.exe dpjvj.exe PID 3916 wrote to memory of 936 3916 dpjvj.exe xrllfxx.exe PID 3916 wrote to memory of 936 3916 dpjvj.exe xrllfxx.exe PID 3916 wrote to memory of 936 3916 dpjvj.exe xrllfxx.exe PID 936 wrote to memory of 6040 936 xrllfxx.exe jvddv.exe PID 936 wrote to memory of 6040 936 xrllfxx.exe jvddv.exe PID 936 wrote to memory of 6040 936 xrllfxx.exe jvddv.exe PID 6040 wrote to memory of 1216 6040 jvddv.exe lxxxrlr.exe PID 6040 wrote to memory of 1216 6040 jvddv.exe lxxxrlr.exe PID 6040 wrote to memory of 1216 6040 jvddv.exe lxxxrlr.exe PID 1216 wrote to memory of 4988 1216 lxxxrlr.exe nttnhb.exe PID 1216 wrote to memory of 4988 1216 lxxxrlr.exe nttnhb.exe PID 1216 wrote to memory of 4988 1216 lxxxrlr.exe nttnhb.exe PID 4988 wrote to memory of 3904 4988 nttnhb.exe 1ddpj.exe PID 4988 wrote to memory of 3904 4988 nttnhb.exe 1ddpj.exe PID 4988 wrote to memory of 3904 4988 nttnhb.exe 1ddpj.exe PID 3904 wrote to memory of 1416 3904 1ddpj.exe llxrllf.exe PID 3904 wrote to memory of 1416 3904 1ddpj.exe llxrllf.exe PID 3904 wrote to memory of 1416 3904 1ddpj.exe llxrllf.exe PID 1416 wrote to memory of 2144 1416 llxrllf.exe ththnt.exe PID 1416 wrote to memory of 2144 1416 llxrllf.exe ththnt.exe PID 1416 wrote to memory of 2144 1416 llxrllf.exe ththnt.exe PID 2144 wrote to memory of 5212 2144 ththnt.exe vpjdp.exe PID 2144 wrote to memory of 5212 2144 ththnt.exe vpjdp.exe PID 2144 wrote to memory of 5212 2144 ththnt.exe vpjdp.exe PID 5212 wrote to memory of 1076 5212 vpjdp.exe 7jvpp.exe PID 5212 wrote to memory of 1076 5212 vpjdp.exe 7jvpp.exe PID 5212 wrote to memory of 1076 5212 vpjdp.exe 7jvpp.exe PID 1076 wrote to memory of 4220 1076 7jvpp.exe rxlrrrr.exe PID 1076 wrote to memory of 4220 1076 7jvpp.exe rxlrrrr.exe PID 1076 wrote to memory of 4220 1076 7jvpp.exe rxlrrrr.exe PID 4220 wrote to memory of 1232 4220 rxlrrrr.exe hbtttt.exe PID 4220 wrote to memory of 1232 4220 rxlrrrr.exe hbtttt.exe PID 4220 wrote to memory of 1232 4220 rxlrrrr.exe hbtttt.exe PID 1232 wrote to memory of 1980 1232 hbtttt.exe jpjdv.exe PID 1232 wrote to memory of 1980 1232 hbtttt.exe jpjdv.exe PID 1232 wrote to memory of 1980 1232 hbtttt.exe jpjdv.exe PID 1980 wrote to memory of 3344 1980 jpjdv.exe llrrllr.exe PID 1980 wrote to memory of 3344 1980 jpjdv.exe llrrllr.exe PID 1980 wrote to memory of 3344 1980 jpjdv.exe llrrllr.exe PID 3344 wrote to memory of 4484 3344 llrrllr.exe fxxxrrr.exe PID 3344 wrote to memory of 4484 3344 llrrllr.exe fxxxrrr.exe PID 3344 wrote to memory of 4484 3344 llrrllr.exe fxxxrrr.exe PID 4484 wrote to memory of 848 4484 fxxxrrr.exe nnhtnb.exe PID 4484 wrote to memory of 848 4484 fxxxrrr.exe nnhtnb.exe PID 4484 wrote to memory of 848 4484 fxxxrrr.exe nnhtnb.exe PID 848 wrote to memory of 1852 848 nnhtnb.exe djvvp.exe PID 848 wrote to memory of 1852 848 nnhtnb.exe djvvp.exe PID 848 wrote to memory of 1852 848 nnhtnb.exe djvvp.exe PID 1852 wrote to memory of 5088 1852 djvvp.exe xfllfrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9604c33d206896b8e95eed6ddbdf6a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e9604c33d206896b8e95eed6ddbdf6a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\nbbtnt.exec:\nbbtnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\jppjv.exec:\jppjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\lffrlll.exec:\lffrlll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
\??\c:\hhttnn.exec:\hhttnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\dpjvj.exec:\dpjvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\xrllfxx.exec:\xrllfxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\jvddv.exec:\jvddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
\??\c:\lxxxrlr.exec:\lxxxrlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\nttnhb.exec:\nttnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\1ddpj.exec:\1ddpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\llxrllf.exec:\llxrllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\ththnt.exec:\ththnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\vpjdp.exec:\vpjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
\??\c:\7jvpp.exec:\7jvpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\rxlrrrr.exec:\rxlrrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\hbtttt.exec:\hbtttt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\jpjdv.exec:\jpjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\llrrllr.exec:\llrrllr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\nnhtnb.exec:\nnhtnb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\djvvp.exec:\djvvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\xfllfrx.exec:\xfllfrx.exe23⤵
- Executes dropped EXE
PID:5088 -
\??\c:\ntnbbt.exec:\ntnbbt.exe24⤵
- Executes dropped EXE
PID:4552 -
\??\c:\vpdvd.exec:\vpdvd.exe25⤵
- Executes dropped EXE
PID:5704 -
\??\c:\nhtthb.exec:\nhtthb.exe26⤵
- Executes dropped EXE
PID:1408 -
\??\c:\rlrrllf.exec:\rlrrllf.exe27⤵
- Executes dropped EXE
PID:4216 -
\??\c:\5xffxxr.exec:\5xffxxr.exe28⤵
- Executes dropped EXE
PID:392 -
\??\c:\nhhbbb.exec:\nhhbbb.exe29⤵
- Executes dropped EXE
PID:616 -
\??\c:\djdvv.exec:\djdvv.exe30⤵
- Executes dropped EXE
PID:2192 -
\??\c:\frrlffr.exec:\frrlffr.exe31⤵
- Executes dropped EXE
PID:4352 -
\??\c:\htnnnn.exec:\htnnnn.exe32⤵
- Executes dropped EXE
PID:5516 -
\??\c:\bttbtb.exec:\bttbtb.exe33⤵
- Executes dropped EXE
PID:3656 -
\??\c:\dppjd.exec:\dppjd.exe34⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vvvvv.exec:\vvvvv.exe35⤵
- Executes dropped EXE
PID:2232 -
\??\c:\1lrlflf.exec:\1lrlflf.exe36⤵
- Executes dropped EXE
PID:5304 -
\??\c:\ntbtnh.exec:\ntbtnh.exe37⤵
- Executes dropped EXE
PID:1528 -
\??\c:\9dpjd.exec:\9dpjd.exe38⤵
- Executes dropped EXE
PID:2792 -
\??\c:\ffllfrr.exec:\ffllfrr.exe39⤵
- Executes dropped EXE
PID:5768 -
\??\c:\xxrlflf.exec:\xxrlflf.exe40⤵
- Executes dropped EXE
PID:3100 -
\??\c:\tbbtnn.exec:\tbbtnn.exe41⤵
- Executes dropped EXE
PID:2492 -
\??\c:\tbbtth.exec:\tbbtth.exe42⤵
- Executes dropped EXE
PID:5364 -
\??\c:\5ddvp.exec:\5ddvp.exe43⤵
- Executes dropped EXE
PID:1184 -
\??\c:\9pvpj.exec:\9pvpj.exe44⤵
- Executes dropped EXE
PID:1904 -
\??\c:\lffxrlf.exec:\lffxrlf.exe45⤵
- Executes dropped EXE
PID:212 -
\??\c:\htntnn.exec:\htntnn.exe46⤵
- Executes dropped EXE
PID:2812 -
\??\c:\1bhhbh.exec:\1bhhbh.exe47⤵
- Executes dropped EXE
PID:1800 -
\??\c:\7jppp.exec:\7jppp.exe48⤵
- Executes dropped EXE
PID:4872 -
\??\c:\jdvpv.exec:\jdvpv.exe49⤵
- Executes dropped EXE
PID:3636 -
\??\c:\rrllllx.exec:\rrllllx.exe50⤵
- Executes dropped EXE
PID:2364 -
\??\c:\nnnhbb.exec:\nnnhbb.exe51⤵
- Executes dropped EXE
PID:5016 -
\??\c:\nhhhhh.exec:\nhhhhh.exe52⤵
- Executes dropped EXE
PID:2056 -
\??\c:\vvddv.exec:\vvddv.exe53⤵
- Executes dropped EXE
PID:2444 -
\??\c:\xlrlfff.exec:\xlrlfff.exe54⤵
- Executes dropped EXE
PID:2984 -
\??\c:\5nnnhh.exec:\5nnnhh.exe55⤵
- Executes dropped EXE
PID:2224 -
\??\c:\bthttn.exec:\bthttn.exe56⤵
- Executes dropped EXE
PID:3236 -
\??\c:\1btttb.exec:\1btttb.exe57⤵
- Executes dropped EXE
PID:2476 -
\??\c:\djpjd.exec:\djpjd.exe58⤵
- Executes dropped EXE
PID:5288 -
\??\c:\xrrrflf.exec:\xrrrflf.exe59⤵
- Executes dropped EXE
PID:6080 -
\??\c:\btttbt.exec:\btttbt.exe60⤵
- Executes dropped EXE
PID:6112 -
\??\c:\hntbtt.exec:\hntbtt.exe61⤵
- Executes dropped EXE
PID:5236 -
\??\c:\1dpjd.exec:\1dpjd.exe62⤵
- Executes dropped EXE
PID:5908 -
\??\c:\3ffxlll.exec:\3ffxlll.exe63⤵
- Executes dropped EXE
PID:6060 -
\??\c:\lxlfffx.exec:\lxlfffx.exe64⤵
- Executes dropped EXE
PID:3584 -
\??\c:\3ttnhh.exec:\3ttnhh.exe65⤵
- Executes dropped EXE
PID:2296 -
\??\c:\pjpjv.exec:\pjpjv.exe66⤵PID:4136
-
\??\c:\rfllrrx.exec:\rfllrrx.exe67⤵PID:4416
-
\??\c:\rllffff.exec:\rllffff.exe68⤵PID:3284
-
\??\c:\bbtnnt.exec:\bbtnnt.exe69⤵PID:1804
-
\??\c:\hnhbtt.exec:\hnhbtt.exe70⤵PID:2408
-
\??\c:\vvpjd.exec:\vvpjd.exe71⤵PID:4800
-
\??\c:\rrllxxx.exec:\rrllxxx.exe72⤵PID:3372
-
\??\c:\frxxxfl.exec:\frxxxfl.exe73⤵PID:3916
-
\??\c:\hbtnhh.exec:\hbtnhh.exe74⤵PID:4868
-
\??\c:\dpjdd.exec:\dpjdd.exe75⤵PID:5628
-
\??\c:\dvjdp.exec:\dvjdp.exe76⤵PID:4176
-
\??\c:\vppjd.exec:\vppjd.exe77⤵PID:1216
-
\??\c:\rrxxffr.exec:\rrxxffr.exe78⤵PID:1832
-
\??\c:\hhnntt.exec:\hhnntt.exe79⤵PID:4556
-
\??\c:\thbttt.exec:\thbttt.exe80⤵PID:6012
-
\??\c:\vppjp.exec:\vppjp.exe81⤵PID:5376
-
\??\c:\vjjjd.exec:\vjjjd.exe82⤵PID:2144
-
\??\c:\7fflfll.exec:\7fflfll.exe83⤵PID:5220
-
\??\c:\rffffff.exec:\rffffff.exe84⤵PID:3632
-
\??\c:\bhtntt.exec:\bhtntt.exe85⤵PID:4424
-
\??\c:\5hhhbb.exec:\5hhhbb.exe86⤵PID:4092
-
\??\c:\9dpjj.exec:\9dpjj.exe87⤵PID:1896
-
\??\c:\1jpjd.exec:\1jpjd.exe88⤵PID:1980
-
\??\c:\rrxxrff.exec:\rrxxrff.exe89⤵PID:5032
-
\??\c:\flllfff.exec:\flllfff.exe90⤵PID:3620
-
\??\c:\hhtttt.exec:\hhtttt.exe91⤵PID:2764
-
\??\c:\btnhbb.exec:\btnhbb.exe92⤵PID:5340
-
\??\c:\ddjdd.exec:\ddjdd.exe93⤵PID:5100
-
\??\c:\7dvpj.exec:\7dvpj.exe94⤵PID:920
-
\??\c:\5lllfll.exec:\5lllfll.exe95⤵PID:3784
-
\??\c:\9fxrrrl.exec:\9fxrrrl.exe96⤵PID:4980
-
\??\c:\hbhhbb.exec:\hbhhbb.exe97⤵PID:1260
-
\??\c:\dpvdv.exec:\dpvdv.exe98⤵PID:1460
-
\??\c:\pjjdv.exec:\pjjdv.exe99⤵PID:4592
-
\??\c:\lxllfff.exec:\lxllfff.exe100⤵PID:1340
-
\??\c:\lrfffff.exec:\lrfffff.exe101⤵PID:392
-
\??\c:\3nhbtt.exec:\3nhbtt.exe102⤵PID:1624
-
\??\c:\bnttnn.exec:\bnttnn.exe103⤵PID:2148
-
\??\c:\3vpjv.exec:\3vpjv.exe104⤵PID:1844
-
\??\c:\pvjjp.exec:\pvjjp.exe105⤵PID:1152
-
\??\c:\lfrllll.exec:\lfrllll.exe106⤵PID:3616
-
\??\c:\lfrlrrl.exec:\lfrlrrl.exe107⤵PID:5760
-
\??\c:\hbhhtt.exec:\hbhhtt.exe108⤵PID:2848
-
\??\c:\hbtnhh.exec:\hbtnhh.exe109⤵PID:5004
-
\??\c:\djvpp.exec:\djvpp.exe110⤵PID:4152
-
\??\c:\jjvpj.exec:\jjvpj.exe111⤵PID:5504
-
\??\c:\fflllrr.exec:\fflllrr.exe112⤵PID:3968
-
\??\c:\tnnnnt.exec:\tnnnnt.exe113⤵PID:3456
-
\??\c:\1ntnhh.exec:\1ntnhh.exe114⤵PID:4076
-
\??\c:\vvpdv.exec:\vvpdv.exe115⤵PID:5284
-
\??\c:\jpppj.exec:\jpppj.exe116⤵PID:4888
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe117⤵PID:1388
-
\??\c:\5xrrllx.exec:\5xrrllx.exe118⤵PID:4388
-
\??\c:\bnnnbt.exec:\bnnnbt.exe119⤵PID:3796
-
\??\c:\djddv.exec:\djddv.exe120⤵PID:4696
-
\??\c:\djppv.exec:\djppv.exe121⤵PID:1800
-
\??\c:\lffxlll.exec:\lffxlll.exe122⤵PID:4872
-
\??\c:\7bnnht.exec:\7bnnht.exe123⤵PID:2136
-
\??\c:\5jjjv.exec:\5jjjv.exe124⤵PID:5008
-
\??\c:\5xxlfff.exec:\5xxlfff.exe125⤵PID:1384
-
\??\c:\fffrxll.exec:\fffrxll.exe126⤵PID:3028
-
\??\c:\thnnnt.exec:\thnnnt.exe127⤵PID:4428
-
\??\c:\5btnhn.exec:\5btnhn.exe128⤵PID:1496
-
\??\c:\9pppj.exec:\9pppj.exe129⤵PID:3148
-
\??\c:\pdddv.exec:\pdddv.exe130⤵PID:5028
-
\??\c:\7xlfxrr.exec:\7xlfxrr.exe131⤵PID:4516
-
\??\c:\xrrrrxx.exec:\xrrrrxx.exe132⤵PID:2020
-
\??\c:\5tbbtb.exec:\5tbbtb.exe133⤵PID:6096
-
\??\c:\jdpdp.exec:\jdpdp.exe134⤵PID:2844
-
\??\c:\lrxlrrf.exec:\lrxlrrf.exe135⤵PID:1332
-
\??\c:\9xxrxxf.exec:\9xxrxxf.exe136⤵PID:6124
-
\??\c:\hhhnhh.exec:\hhhnhh.exe137⤵PID:5556
-
\??\c:\jjjjd.exec:\jjjjd.exe138⤵PID:5936
-
\??\c:\vdjvd.exec:\vdjvd.exe139⤵PID:4488
-
\??\c:\rrlfrrl.exec:\rrlfrrl.exe140⤵PID:6084
-
\??\c:\xrllflr.exec:\xrllflr.exe141⤵PID:4608
-
\??\c:\thhbbb.exec:\thhbbb.exe142⤵PID:6088
-
\??\c:\jvdvv.exec:\jvdvv.exe143⤵PID:1576
-
\??\c:\jdjdp.exec:\jdjdp.exe144⤵PID:4412
-
\??\c:\flrllfx.exec:\flrllfx.exe145⤵PID:2748
-
\??\c:\xffxrrl.exec:\xffxrrl.exe146⤵PID:1492
-
\??\c:\hbnhht.exec:\hbnhht.exe147⤵PID:5952
-
\??\c:\dvpdv.exec:\dvpdv.exe148⤵PID:3076
-
\??\c:\dvvjd.exec:\dvvjd.exe149⤵PID:3104
-
\??\c:\7llfxxr.exec:\7llfxxr.exe150⤵PID:4300
-
\??\c:\7lrfxxr.exec:\7lrfxxr.exe151⤵PID:556
-
\??\c:\7tnhbn.exec:\7tnhbn.exe152⤵PID:4368
-
\??\c:\bttnhb.exec:\bttnhb.exe153⤵PID:4572
-
\??\c:\dppvd.exec:\dppvd.exe154⤵PID:1580
-
\??\c:\lflfxxr.exec:\lflfxxr.exe155⤵PID:4560
-
\??\c:\ffxlllf.exec:\ffxlllf.exe156⤵PID:484
-
\??\c:\nbtnht.exec:\nbtnht.exe157⤵PID:3632
-
\??\c:\bhnbth.exec:\bhnbth.exe158⤵PID:1232
-
\??\c:\pjdpj.exec:\pjdpj.exe159⤵PID:4504
-
\??\c:\pjddj.exec:\pjddj.exe160⤵PID:4992
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe161⤵PID:4348
-
\??\c:\3llrlrx.exec:\3llrlrx.exe162⤵PID:5488
-
\??\c:\bbbnth.exec:\bbbnth.exe163⤵PID:5612
-
\??\c:\tnbtth.exec:\tnbtth.exe164⤵PID:3088
-
\??\c:\jpppj.exec:\jpppj.exe165⤵PID:5584
-
\??\c:\fllrlxl.exec:\fllrlxl.exe166⤵PID:1220
-
\??\c:\xxllfrr.exec:\xxllfrr.exe167⤵PID:5688
-
\??\c:\tttnbt.exec:\tttnbt.exe168⤵PID:4552
-
\??\c:\dpddv.exec:\dpddv.exe169⤵PID:1128
-
\??\c:\9djjd.exec:\9djjd.exe170⤵PID:460
-
\??\c:\lllfxxf.exec:\lllfxxf.exe171⤵PID:6048
-
\??\c:\nhhbbt.exec:\nhhbbt.exe172⤵PID:4472
-
\??\c:\5btnnt.exec:\5btnnt.exe173⤵PID:1916
-
\??\c:\pvjjp.exec:\pvjjp.exe174⤵PID:4548
-
\??\c:\pjddv.exec:\pjddv.exe175⤵PID:572
-
\??\c:\rfffxrr.exec:\rfffxrr.exe176⤵PID:1624
-
\??\c:\lflllll.exec:\lflllll.exe177⤵PID:2236
-
\??\c:\ntttnt.exec:\ntttnt.exe178⤵PID:3212
-
\??\c:\9bhbnn.exec:\9bhbnn.exe179⤵PID:1012
-
\??\c:\jjvvp.exec:\jjvvp.exe180⤵PID:3552
-
\??\c:\vpvdd.exec:\vpvdd.exe181⤵PID:2848
-
\??\c:\7xxxrrl.exec:\7xxxrrl.exe182⤵PID:776
-
\??\c:\1rlrlxl.exec:\1rlrlxl.exe183⤵PID:2792
-
\??\c:\btbnht.exec:\btbnht.exe184⤵PID:3968
-
\??\c:\9nbntn.exec:\9nbntn.exe185⤵PID:3052
-
\??\c:\pjjjd.exec:\pjjjd.exe186⤵PID:2944
-
\??\c:\7pjvd.exec:\7pjvd.exe187⤵PID:3964
-
\??\c:\xxxrrff.exec:\xxxrrff.exe188⤵PID:4388
-
\??\c:\9fxlfrr.exec:\9fxlfrr.exe189⤵PID:1680
-
\??\c:\1bbbbb.exec:\1bbbbb.exe190⤵PID:2448
-
\??\c:\1dddp.exec:\1dddp.exe191⤵PID:3272
-
\??\c:\vvdvj.exec:\vvdvj.exe192⤵PID:2364
-
\??\c:\rfffrll.exec:\rfffrll.exe193⤵PID:3176
-
\??\c:\lrrrrrf.exec:\lrrrrrf.exe194⤵PID:2436
-
\??\c:\xxfxxxr.exec:\xxfxxxr.exe195⤵PID:2056
-
\??\c:\hbbbbb.exec:\hbbbbb.exe196⤵PID:2440
-
\??\c:\btnbth.exec:\btnbth.exe197⤵PID:2952
-
\??\c:\jdvpj.exec:\jdvpj.exe198⤵PID:3760
-
\??\c:\dpvpd.exec:\dpvpd.exe199⤵PID:5480
-
\??\c:\fffxrfx.exec:\fffxrfx.exe200⤵PID:3172
-
\??\c:\5fflfff.exec:\5fflfff.exe201⤵PID:1608
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe202⤵PID:4012
-
\??\c:\1nbtbn.exec:\1nbtbn.exe203⤵PID:2844
-
\??\c:\ppjdp.exec:\ppjdp.exe204⤵PID:2668
-
\??\c:\vpvpj.exec:\vpvpj.exe205⤵PID:6124
-
\??\c:\7rxxxll.exec:\7rxxxll.exe206⤵PID:4316
-
\??\c:\xflfrrl.exec:\xflfrrl.exe207⤵PID:3168
-
\??\c:\bbtnnn.exec:\bbtnnn.exe208⤵PID:5024
-
\??\c:\thbbbb.exec:\thbbbb.exe209⤵PID:4416
-
\??\c:\7jjvp.exec:\7jjvp.exe210⤵PID:3900
-
\??\c:\9jvpd.exec:\9jvpd.exe211⤵PID:4204
-
\??\c:\xfllxff.exec:\xfllxff.exe212⤵PID:1156
-
\??\c:\fxfxrxr.exec:\fxfxrxr.exe213⤵PID:6128
-
\??\c:\1hnnnn.exec:\1hnnnn.exe214⤵PID:3096
-
\??\c:\ttbttb.exec:\ttbttb.exe215⤵PID:5788
-
\??\c:\jvpjv.exec:\jvpjv.exe216⤵PID:5712
-
\??\c:\jpdjd.exec:\jpdjd.exe217⤵PID:3464
-
\??\c:\1xrxrfl.exec:\1xrxrfl.exe218⤵PID:4088
-
\??\c:\bnhbth.exec:\bnhbth.exe219⤵PID:1064
-
\??\c:\rlllllr.exec:\rlllllr.exe220⤵PID:1432
-
\??\c:\rlllfxr.exec:\rlllfxr.exe221⤵PID:1900
-
\??\c:\nnnhbn.exec:\nnnhbn.exe222⤵PID:820
-
\??\c:\bhbbbt.exec:\bhbbbt.exe223⤵PID:712
-
\??\c:\7dvpp.exec:\7dvpp.exe224⤵PID:1484
-
\??\c:\rrfrlff.exec:\rrfrlff.exe225⤵PID:444
-
\??\c:\xfllflf.exec:\xfllflf.exe226⤵PID:5644
-
\??\c:\tntbtt.exec:\tntbtt.exe227⤵PID:4584
-
\??\c:\tbnntt.exec:\tbnntt.exe228⤵PID:2472
-
\??\c:\jdvvp.exec:\jdvvp.exe229⤵PID:3716
-
\??\c:\1dpjd.exec:\1dpjd.exe230⤵PID:848
-
\??\c:\ffrlffl.exec:\ffrlffl.exe231⤵PID:5340
-
\??\c:\xffffff.exec:\xffffff.exe232⤵PID:1852
-
\??\c:\tbbbnn.exec:\tbbbnn.exe233⤵PID:5112
-
\??\c:\7vdvv.exec:\7vdvv.exe234⤵PID:5668
-
\??\c:\rrlrlrr.exec:\rrlrlrr.exe235⤵PID:1620
-
\??\c:\rlrrxxl.exec:\rlrrxxl.exe236⤵PID:4972
-
\??\c:\ntthhh.exec:\ntthhh.exe237⤵PID:3368
-
\??\c:\9nthtb.exec:\9nthtb.exe238⤵PID:2024
-
\??\c:\pjjjd.exec:\pjjjd.exe239⤵PID:1324
-
\??\c:\vpjdp.exec:\vpjdp.exe240⤵PID:4216
-
\??\c:\rrxxrfx.exec:\rrxxrfx.exe241⤵PID:5796
-
\??\c:\bttnhh.exec:\bttnhh.exe242⤵PID:1700