Analysis
-
max time kernel
149s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 19:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3a18372857c57e4b21fd07438f106a80_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3a18372857c57e4b21fd07438f106a80_NeikiAnalytics.exe
-
Size
118KB
-
MD5
3a18372857c57e4b21fd07438f106a80
-
SHA1
6f4f1dcf85f19a440ab59255c7b458e0091236c9
-
SHA256
8df7874c5d2b927771b9d0761b160fa20b8f5c200b2a63e426be494cf622f57c
-
SHA512
253b73d8030492cbdbe4f0989d300dbd8937dc7aad06b0c8b0331f980fc0002acb0600b2fa10a0c52aa4a5ff271b3aa08171f545a40430366152df99e438ca86
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDomRGApSuLAR2yPBCQ1nDFu1Q8sI:ymb3NkkiQ3mdBjFomR7UsyJC+n0GsgcX
Malware Config
Signatures
-
Detect Blackmoon payload 32 IoCs
Processes:
resource yara_rule behavioral2/memory/2996-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-43-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2340-51-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2024-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2688-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xxlrlrl.exenhhbtn.exe3nnhhb.exeppppp.exenbbbtb.exennnnhh.exepdppv.exelfrrlxr.exe3xffflx.exenhhnhh.exetntnnt.exefrllrrx.exelfrllll.exenhbbtt.exejjppp.exexxlflrx.exebbnntb.exedvjvv.exerrxxxfl.exebhhtnh.exennnnhn.exe1pjdv.exerrffllx.exenhnhtb.exeppjvd.exexllxrrl.exehhtnnn.exevvjdd.exelxxxxff.exebnthtt.exevpvpj.exexrlfrff.exehbhhbh.exevvpjd.exexfxfxrf.exerflllll.exetbnntb.exebtntht.exelrrfllx.exelffffff.exehbntbb.exejjjvp.exevppjd.exeffrlxxf.exebbtttt.exejpdpj.exevpvvv.exehhnntb.exenbbbtt.exe1pdpd.exe1vvvj.exe1flrlfl.exefxrrrrr.exennnhbb.exebbnnbb.exevppjj.exedddvv.exerrrxrxr.exeflffffl.exenbnbhn.exebtbbhh.exefxffllr.exerxxrxrx.exe9bhhhh.exepid process 4572 xxlrlrl.exe 2488 nhhbtn.exe 216 3nnhhb.exe 4004 ppppp.exe 4232 nbbbtb.exe 2340 nnnnhh.exe 2024 pdppv.exe 4780 lfrrlxr.exe 2832 3xffflx.exe 4600 nhhnhh.exe 4364 tntnnt.exe 3604 frllrrx.exe 1240 lfrllll.exe 4388 nhbbtt.exe 2284 jjppp.exe 4060 xxlflrx.exe 2688 bbnntb.exe 1264 dvjvv.exe 3940 rrxxxfl.exe 2956 bhhtnh.exe 3408 nnnnhn.exe 4720 1pjdv.exe 4468 rrffllx.exe 3948 nhnhtb.exe 1248 ppjvd.exe 3060 xllxrrl.exe 464 hhtnnn.exe 3636 vvjdd.exe 3064 lxxxxff.exe 1148 bnthtt.exe 1536 vpvpj.exe 552 xrlfrff.exe 4936 hbhhbh.exe 2764 vvpjd.exe 4968 xfxfxrf.exe 2040 rflllll.exe 1572 tbnntb.exe 4304 btntht.exe 4868 lrrfllx.exe 860 lffffff.exe 3252 hbntbb.exe 5104 jjjvp.exe 1308 vppjd.exe 3144 ffrlxxf.exe 3036 bbtttt.exe 1656 jpdpj.exe 1704 vpvvv.exe 3728 hhnntb.exe 2688 nbbbtt.exe 3496 1pdpd.exe 3940 1vvvj.exe 3968 1flrlfl.exe 4400 fxrrrrr.exe 2888 nnnhbb.exe 1604 bbnnbb.exe 4468 vppjj.exe 4396 dddvv.exe 2904 rrrxrxr.exe 3060 flffffl.exe 2316 nbnbhn.exe 3636 btbbhh.exe 2208 fxffllr.exe 1148 rxxrxrx.exe 5064 9bhhhh.exe -
Processes:
resource yara_rule behavioral2/memory/2996-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2688-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3a18372857c57e4b21fd07438f106a80_NeikiAnalytics.exexxlrlrl.exenhhbtn.exe3nnhhb.exeppppp.exenbbbtb.exennnnhh.exepdppv.exelfrrlxr.exe3xffflx.exenhhnhh.exetntnnt.exefrllrrx.exelfrllll.exenhbbtt.exejjppp.exexxlflrx.exebbnntb.exedvjvv.exerrxxxfl.exebhhtnh.exennnnhn.exedescription pid process target process PID 2996 wrote to memory of 4572 2996 3a18372857c57e4b21fd07438f106a80_NeikiAnalytics.exe xxlrlrl.exe PID 2996 wrote to memory of 4572 2996 3a18372857c57e4b21fd07438f106a80_NeikiAnalytics.exe xxlrlrl.exe PID 2996 wrote to memory of 4572 2996 3a18372857c57e4b21fd07438f106a80_NeikiAnalytics.exe xxlrlrl.exe PID 4572 wrote to memory of 2488 4572 xxlrlrl.exe nhhbtn.exe PID 4572 wrote to memory of 2488 4572 xxlrlrl.exe nhhbtn.exe PID 4572 wrote to memory of 2488 4572 xxlrlrl.exe nhhbtn.exe PID 2488 wrote to memory of 216 2488 nhhbtn.exe 3nnhhb.exe PID 2488 wrote to memory of 216 2488 nhhbtn.exe 3nnhhb.exe PID 2488 wrote to memory of 216 2488 nhhbtn.exe 3nnhhb.exe PID 216 wrote to memory of 4004 216 3nnhhb.exe ppppp.exe PID 216 wrote to memory of 4004 216 3nnhhb.exe ppppp.exe PID 216 wrote to memory of 4004 216 3nnhhb.exe ppppp.exe PID 4004 wrote to memory of 4232 4004 ppppp.exe nbbbtb.exe PID 4004 wrote to memory of 4232 4004 ppppp.exe nbbbtb.exe PID 4004 wrote to memory of 4232 4004 ppppp.exe nbbbtb.exe PID 4232 wrote to memory of 2340 4232 nbbbtb.exe nnnnhh.exe PID 4232 wrote to memory of 2340 4232 nbbbtb.exe nnnnhh.exe PID 4232 wrote to memory of 2340 4232 nbbbtb.exe nnnnhh.exe PID 2340 wrote to memory of 2024 2340 nnnnhh.exe pdppv.exe PID 2340 wrote to memory of 2024 2340 nnnnhh.exe pdppv.exe PID 2340 wrote to memory of 2024 2340 nnnnhh.exe pdppv.exe PID 2024 wrote to memory of 4780 2024 pdppv.exe lfrrlxr.exe PID 2024 wrote to memory of 4780 2024 pdppv.exe lfrrlxr.exe PID 2024 wrote to memory of 4780 2024 pdppv.exe lfrrlxr.exe PID 4780 wrote to memory of 2832 4780 lfrrlxr.exe 3xffflx.exe PID 4780 wrote to memory of 2832 4780 lfrrlxr.exe 3xffflx.exe PID 4780 wrote to memory of 2832 4780 lfrrlxr.exe 3xffflx.exe PID 2832 wrote to memory of 4600 2832 3xffflx.exe nhhnhh.exe PID 2832 wrote to memory of 4600 2832 3xffflx.exe nhhnhh.exe PID 2832 wrote to memory of 4600 2832 3xffflx.exe nhhnhh.exe PID 4600 wrote to memory of 4364 4600 nhhnhh.exe tntnnt.exe PID 4600 wrote to memory of 4364 4600 nhhnhh.exe tntnnt.exe PID 4600 wrote to memory of 4364 4600 nhhnhh.exe tntnnt.exe PID 4364 wrote to memory of 3604 4364 tntnnt.exe frllrrx.exe PID 4364 wrote to memory of 3604 4364 tntnnt.exe frllrrx.exe PID 4364 wrote to memory of 3604 4364 tntnnt.exe frllrrx.exe PID 3604 wrote to memory of 1240 3604 frllrrx.exe lfrllll.exe PID 3604 wrote to memory of 1240 3604 frllrrx.exe lfrllll.exe PID 3604 wrote to memory of 1240 3604 frllrrx.exe lfrllll.exe PID 1240 wrote to memory of 4388 1240 lfrllll.exe nhbbtt.exe PID 1240 wrote to memory of 4388 1240 lfrllll.exe nhbbtt.exe PID 1240 wrote to memory of 4388 1240 lfrllll.exe nhbbtt.exe PID 4388 wrote to memory of 2284 4388 nhbbtt.exe jjppp.exe PID 4388 wrote to memory of 2284 4388 nhbbtt.exe jjppp.exe PID 4388 wrote to memory of 2284 4388 nhbbtt.exe jjppp.exe PID 2284 wrote to memory of 4060 2284 jjppp.exe xxlflrx.exe PID 2284 wrote to memory of 4060 2284 jjppp.exe xxlflrx.exe PID 2284 wrote to memory of 4060 2284 jjppp.exe xxlflrx.exe PID 4060 wrote to memory of 2688 4060 xxlflrx.exe bbnntb.exe PID 4060 wrote to memory of 2688 4060 xxlflrx.exe bbnntb.exe PID 4060 wrote to memory of 2688 4060 xxlflrx.exe bbnntb.exe PID 2688 wrote to memory of 1264 2688 bbnntb.exe dvjvv.exe PID 2688 wrote to memory of 1264 2688 bbnntb.exe dvjvv.exe PID 2688 wrote to memory of 1264 2688 bbnntb.exe dvjvv.exe PID 1264 wrote to memory of 3940 1264 dvjvv.exe rrxxxfl.exe PID 1264 wrote to memory of 3940 1264 dvjvv.exe rrxxxfl.exe PID 1264 wrote to memory of 3940 1264 dvjvv.exe rrxxxfl.exe PID 3940 wrote to memory of 2956 3940 rrxxxfl.exe bhhtnh.exe PID 3940 wrote to memory of 2956 3940 rrxxxfl.exe bhhtnh.exe PID 3940 wrote to memory of 2956 3940 rrxxxfl.exe bhhtnh.exe PID 2956 wrote to memory of 3408 2956 bhhtnh.exe nnnnhn.exe PID 2956 wrote to memory of 3408 2956 bhhtnh.exe nnnnhn.exe PID 2956 wrote to memory of 3408 2956 bhhtnh.exe nnnnhn.exe PID 3408 wrote to memory of 4720 3408 nnnnhn.exe 1pjdv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a18372857c57e4b21fd07438f106a80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3a18372857c57e4b21fd07438f106a80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\xxlrlrl.exec:\xxlrlrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\nhhbtn.exec:\nhhbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\3nnhhb.exec:\3nnhhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\ppppp.exec:\ppppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\nbbbtb.exec:\nbbbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\nnnnhh.exec:\nnnnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\pdppv.exec:\pdppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\lfrrlxr.exec:\lfrrlxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\3xffflx.exec:\3xffflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\nhhnhh.exec:\nhhnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\tntnnt.exec:\tntnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\frllrrx.exec:\frllrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\lfrllll.exec:\lfrllll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\nhbbtt.exec:\nhbbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\jjppp.exec:\jjppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\xxlflrx.exec:\xxlflrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\bbnntb.exec:\bbnntb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\dvjvv.exec:\dvjvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\rrxxxfl.exec:\rrxxxfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\bhhtnh.exec:\bhhtnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\nnnnhn.exec:\nnnnhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\1pjdv.exec:\1pjdv.exe23⤵
- Executes dropped EXE
PID:4720 -
\??\c:\rrffllx.exec:\rrffllx.exe24⤵
- Executes dropped EXE
PID:4468 -
\??\c:\nhnhtb.exec:\nhnhtb.exe25⤵
- Executes dropped EXE
PID:3948 -
\??\c:\ppjvd.exec:\ppjvd.exe26⤵
- Executes dropped EXE
PID:1248 -
\??\c:\xllxrrl.exec:\xllxrrl.exe27⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hhtnnn.exec:\hhtnnn.exe28⤵
- Executes dropped EXE
PID:464 -
\??\c:\vvjdd.exec:\vvjdd.exe29⤵
- Executes dropped EXE
PID:3636 -
\??\c:\xrxrllf.exec:\xrxrllf.exe30⤵PID:4324
-
\??\c:\lxxxxff.exec:\lxxxxff.exe31⤵
- Executes dropped EXE
PID:3064 -
\??\c:\bnthtt.exec:\bnthtt.exe32⤵
- Executes dropped EXE
PID:1148 -
\??\c:\vpvpj.exec:\vpvpj.exe33⤵
- Executes dropped EXE
PID:1536 -
\??\c:\xrlfrff.exec:\xrlfrff.exe34⤵
- Executes dropped EXE
PID:552 -
\??\c:\hbhhbh.exec:\hbhhbh.exe35⤵
- Executes dropped EXE
PID:4936 -
\??\c:\vvpjd.exec:\vvpjd.exe36⤵
- Executes dropped EXE
PID:2764 -
\??\c:\xfxfxrf.exec:\xfxfxrf.exe37⤵
- Executes dropped EXE
PID:4968 -
\??\c:\rflllll.exec:\rflllll.exe38⤵
- Executes dropped EXE
PID:2040 -
\??\c:\tbnntb.exec:\tbnntb.exe39⤵
- Executes dropped EXE
PID:1572 -
\??\c:\btntht.exec:\btntht.exe40⤵
- Executes dropped EXE
PID:4304 -
\??\c:\lrrfllx.exec:\lrrfllx.exe41⤵
- Executes dropped EXE
PID:4868 -
\??\c:\lffffff.exec:\lffffff.exe42⤵
- Executes dropped EXE
PID:860 -
\??\c:\hbntbb.exec:\hbntbb.exe43⤵
- Executes dropped EXE
PID:3252 -
\??\c:\jjjvp.exec:\jjjvp.exe44⤵
- Executes dropped EXE
PID:5104 -
\??\c:\vppjd.exec:\vppjd.exe45⤵
- Executes dropped EXE
PID:1308 -
\??\c:\ffrlxxf.exec:\ffrlxxf.exe46⤵
- Executes dropped EXE
PID:3144 -
\??\c:\bbtttt.exec:\bbtttt.exe47⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jpdpj.exec:\jpdpj.exe48⤵
- Executes dropped EXE
PID:1656 -
\??\c:\vpvvv.exec:\vpvvv.exe49⤵
- Executes dropped EXE
PID:1704 -
\??\c:\hhnntb.exec:\hhnntb.exe50⤵
- Executes dropped EXE
PID:3728 -
\??\c:\nbbbtt.exec:\nbbbtt.exe51⤵
- Executes dropped EXE
PID:2688 -
\??\c:\1pdpd.exec:\1pdpd.exe52⤵
- Executes dropped EXE
PID:3496 -
\??\c:\1vvvj.exec:\1vvvj.exe53⤵
- Executes dropped EXE
PID:3940 -
\??\c:\1flrlfl.exec:\1flrlfl.exe54⤵
- Executes dropped EXE
PID:3968 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe55⤵
- Executes dropped EXE
PID:4400 -
\??\c:\nnnhbb.exec:\nnnhbb.exe56⤵
- Executes dropped EXE
PID:2888 -
\??\c:\bbnnbb.exec:\bbnnbb.exe57⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vppjj.exec:\vppjj.exe58⤵
- Executes dropped EXE
PID:4468 -
\??\c:\dddvv.exec:\dddvv.exe59⤵
- Executes dropped EXE
PID:4396 -
\??\c:\rrrxrxr.exec:\rrrxrxr.exe60⤵
- Executes dropped EXE
PID:2904 -
\??\c:\flffffl.exec:\flffffl.exe61⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nbnbhn.exec:\nbnbhn.exe62⤵
- Executes dropped EXE
PID:2316 -
\??\c:\btbbhh.exec:\btbbhh.exe63⤵
- Executes dropped EXE
PID:3636 -
\??\c:\djppj.exec:\djppj.exe64⤵PID:4384
-
\??\c:\fxffllr.exec:\fxffllr.exe65⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rxxrxrx.exec:\rxxrxrx.exe66⤵
- Executes dropped EXE
PID:1148 -
\??\c:\9bhhhh.exec:\9bhhhh.exe67⤵
- Executes dropped EXE
PID:5064 -
\??\c:\1tbtnn.exec:\1tbtnn.exe68⤵PID:1320
-
\??\c:\djdpp.exec:\djdpp.exe69⤵PID:4704
-
\??\c:\1lrrrxl.exec:\1lrrrxl.exe70⤵PID:2140
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe71⤵PID:4356
-
\??\c:\1ntnhh.exec:\1ntnhh.exe72⤵PID:3584
-
\??\c:\9pvpp.exec:\9pvpp.exe73⤵PID:1572
-
\??\c:\pjvpp.exec:\pjvpp.exe74⤵PID:4184
-
\??\c:\xxfxxff.exec:\xxfxxff.exe75⤵PID:952
-
\??\c:\nhtbbb.exec:\nhtbbb.exe76⤵PID:4236
-
\??\c:\vvpjp.exec:\vvpjp.exe77⤵PID:1192
-
\??\c:\vvjjd.exec:\vvjjd.exe78⤵PID:1424
-
\??\c:\vdjdd.exec:\vdjdd.exe79⤵PID:4600
-
\??\c:\9flffff.exec:\9flffff.exe80⤵PID:4588
-
\??\c:\9fllfff.exec:\9fllfff.exe81⤵PID:2972
-
\??\c:\tntnhh.exec:\tntnhh.exe82⤵PID:1084
-
\??\c:\jvdpp.exec:\jvdpp.exe83⤵PID:3632
-
\??\c:\xrfxrxr.exec:\xrfxrxr.exe84⤵PID:3460
-
\??\c:\bnttbt.exec:\bnttbt.exe85⤵PID:1848
-
\??\c:\bbbbbb.exec:\bbbbbb.exe86⤵PID:3496
-
\??\c:\djppp.exec:\djppp.exe87⤵PID:636
-
\??\c:\fllfxff.exec:\fllfxff.exe88⤵PID:3644
-
\??\c:\htbbbn.exec:\htbbbn.exe89⤵PID:4844
-
\??\c:\vjvpp.exec:\vjvpp.exe90⤵PID:4856
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe91⤵PID:4684
-
\??\c:\5rlrrrl.exec:\5rlrrrl.exe92⤵PID:3880
-
\??\c:\bnbbtn.exec:\bnbbtn.exe93⤵PID:2780
-
\??\c:\nbhhtb.exec:\nbhhtb.exe94⤵PID:4252
-
\??\c:\pvvdj.exec:\pvvdj.exe95⤵PID:2416
-
\??\c:\rllfxxx.exec:\rllfxxx.exe96⤵PID:4632
-
\??\c:\fllfrrr.exec:\fllfrrr.exe97⤵PID:4572
-
\??\c:\nbbnnh.exec:\nbbnnh.exe98⤵PID:2264
-
\??\c:\pjjjd.exec:\pjjjd.exe99⤵PID:2944
-
\??\c:\ddjdd.exec:\ddjdd.exe100⤵PID:4232
-
\??\c:\rllfxrl.exec:\rllfxrl.exe101⤵PID:1548
-
\??\c:\7tnnnn.exec:\7tnnnn.exe102⤵PID:2764
-
\??\c:\7bhhtb.exec:\7bhhtb.exe103⤵PID:4568
-
\??\c:\dvddp.exec:\dvddp.exe104⤵PID:1212
-
\??\c:\3rrrllr.exec:\3rrrllr.exe105⤵PID:1156
-
\??\c:\9ffxrrl.exec:\9ffxrrl.exe106⤵PID:1572
-
\??\c:\btthbn.exec:\btthbn.exe107⤵PID:2632
-
\??\c:\hthhhh.exec:\hthhhh.exe108⤵PID:3540
-
\??\c:\jjddd.exec:\jjddd.exe109⤵PID:4236
-
\??\c:\fxxxrff.exec:\fxxxrff.exe110⤵PID:2408
-
\??\c:\nhthnn.exec:\nhthnn.exe111⤵PID:4864
-
\??\c:\nnttth.exec:\nnttth.exe112⤵PID:1240
-
\??\c:\vjjjj.exec:\vjjjj.exe113⤵PID:4588
-
\??\c:\3jvpv.exec:\3jvpv.exe114⤵PID:3036
-
\??\c:\rxffrxx.exec:\rxffrxx.exe115⤵PID:3772
-
\??\c:\tnnnhh.exec:\tnnnhh.exe116⤵PID:5004
-
\??\c:\nnnttt.exec:\nnnttt.exe117⤵PID:4556
-
\??\c:\jdpjj.exec:\jdpjj.exe118⤵PID:2956
-
\??\c:\3djdv.exec:\3djdv.exe119⤵PID:3408
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe120⤵PID:3968
-
\??\c:\9xfllll.exec:\9xfllll.exe121⤵PID:5084
-
\??\c:\nhbbbh.exec:\nhbbbh.exe122⤵PID:3556
-
\??\c:\1djjj.exec:\1djjj.exe123⤵PID:2904
-
\??\c:\pjpjp.exec:\pjpjp.exe124⤵PID:1592
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe125⤵PID:5076
-
\??\c:\rrffrxl.exec:\rrffrxl.exe126⤵PID:2488
-
\??\c:\tbbbhh.exec:\tbbbhh.exe127⤵PID:1148
-
\??\c:\bnthth.exec:\bnthth.exe128⤵PID:1536
-
\??\c:\vpppj.exec:\vpppj.exe129⤵PID:1408
-
\??\c:\ddvpj.exec:\ddvpj.exe130⤵PID:4704
-
\??\c:\flxrlll.exec:\flxrlll.exe131⤵PID:2040
-
\??\c:\7bbbtb.exec:\7bbbtb.exe132⤵PID:1156
-
\??\c:\bhhbnn.exec:\bhhbnn.exe133⤵PID:3164
-
\??\c:\jdpjv.exec:\jdpjv.exe134⤵PID:4076
-
\??\c:\3ddvp.exec:\3ddvp.exe135⤵PID:4236
-
\??\c:\lxfrxxx.exec:\lxfrxxx.exe136⤵PID:4216
-
\??\c:\lrlllrx.exec:\lrlllrx.exe137⤵PID:4864
-
\??\c:\httnnn.exec:\httnnn.exe138⤵PID:4248
-
\??\c:\btnnhn.exec:\btnnhn.exe139⤵PID:1084
-
\??\c:\7pvpv.exec:\7pvpv.exe140⤵PID:4896
-
\??\c:\xlxrffl.exec:\xlxrffl.exe141⤵PID:2088
-
\??\c:\tnhnhh.exec:\tnhnhh.exe142⤵PID:3792
-
\??\c:\dvdvv.exec:\dvdvv.exe143⤵PID:2388
-
\??\c:\vpdvv.exec:\vpdvv.exe144⤵PID:3012
-
\??\c:\flfxrxx.exec:\flfxrxx.exe145⤵PID:4840
-
\??\c:\hbhbbn.exec:\hbhbbn.exe146⤵PID:888
-
\??\c:\9tnhhh.exec:\9tnhhh.exe147⤵PID:4372
-
\??\c:\jppvp.exec:\jppvp.exe148⤵PID:1492
-
\??\c:\7vjvd.exec:\7vjvd.exe149⤵PID:4384
-
\??\c:\ffffrrr.exec:\ffffrrr.exe150⤵PID:2208
-
\??\c:\nbtnhh.exec:\nbtnhh.exe151⤵PID:4492
-
\??\c:\jdddd.exec:\jdddd.exe152⤵PID:2944
-
\??\c:\lrfrrlf.exec:\lrfrrlf.exe153⤵PID:3316
-
\??\c:\1xlllrr.exec:\1xlllrr.exe154⤵PID:4568
-
\??\c:\nnnttt.exec:\nnnttt.exe155⤵PID:2684
-
\??\c:\vvvvd.exec:\vvvvd.exe156⤵PID:4648
-
\??\c:\xlffflr.exec:\xlffflr.exe157⤵PID:860
-
\??\c:\htbbnn.exec:\htbbnn.exe158⤵PID:4364
-
\??\c:\bbnnbb.exec:\bbnnbb.exe159⤵PID:1424
-
\??\c:\vvpjd.exec:\vvpjd.exe160⤵PID:4600
-
\??\c:\xxrrrrl.exec:\xxrrrrl.exe161⤵PID:2276
-
\??\c:\hbttbb.exec:\hbttbb.exe162⤵PID:4436
-
\??\c:\jvjvv.exec:\jvjvv.exe163⤵PID:4880
-
\??\c:\lxlfrfx.exec:\lxlfrfx.exe164⤵PID:3896
-
\??\c:\tnhbnh.exec:\tnhbnh.exe165⤵PID:1576
-
\??\c:\7frllll.exec:\7frllll.exe166⤵PID:2088
-
\??\c:\jvdpj.exec:\jvdpj.exe167⤵PID:3940
-
\??\c:\3vvdj.exec:\3vvdj.exe168⤵PID:2956
-
\??\c:\frflxrx.exec:\frflxrx.exe169⤵PID:3408
-
\??\c:\tttnnn.exec:\tttnnn.exe170⤵PID:4856
-
\??\c:\djppp.exec:\djppp.exe171⤵PID:1456
-
\??\c:\fffxxrr.exec:\fffxxrr.exe172⤵PID:692
-
\??\c:\hbbnhh.exec:\hbbnhh.exe173⤵PID:4540
-
\??\c:\jdjdv.exec:\jdjdv.exe174⤵PID:3492
-
\??\c:\ppjjj.exec:\ppjjj.exe175⤵PID:3436
-
\??\c:\lllfffx.exec:\lllfffx.exe176⤵PID:4492
-
\??\c:\thnhhb.exec:\thnhhb.exe177⤵PID:2964
-
\??\c:\thtnnt.exec:\thtnnt.exe178⤵PID:3316
-
\??\c:\9vvpv.exec:\9vvpv.exe179⤵PID:1572
-
\??\c:\5rlrlff.exec:\5rlrlff.exe180⤵PID:956
-
\??\c:\tbnnhh.exec:\tbnnhh.exe181⤵PID:3380
-
\??\c:\3nbthh.exec:\3nbthh.exe182⤵PID:2408
-
\??\c:\jdddd.exec:\jdddd.exe183⤵PID:2900
-
\??\c:\vdjdv.exec:\vdjdv.exe184⤵PID:1240
-
\??\c:\rfllrxx.exec:\rfllrxx.exe185⤵PID:2156
-
\??\c:\9xffxxf.exec:\9xffxxf.exe186⤵PID:3632
-
\??\c:\bnnnhh.exec:\bnnnhh.exe187⤵PID:3728
-
\??\c:\jjddd.exec:\jjddd.exe188⤵PID:1060
-
\??\c:\llrlrfr.exec:\llrlrfr.exe189⤵PID:3896
-
\??\c:\5lflllf.exec:\5lflllf.exe190⤵PID:1576
-
\??\c:\3hnnnt.exec:\3hnnnt.exe191⤵PID:3364
-
\??\c:\hhbttn.exec:\hhbttn.exe192⤵PID:920
-
\??\c:\jdvdv.exec:\jdvdv.exe193⤵PID:4892
-
\??\c:\llfxxfx.exec:\llfxxfx.exe194⤵PID:3060
-
\??\c:\5lrrrxr.exec:\5lrrrxr.exe195⤵PID:2316
-
\??\c:\nbnnnn.exec:\nbnnnn.exe196⤵PID:212
-
\??\c:\tnbbhh.exec:\tnbbhh.exe197⤵PID:5076
-
\??\c:\jddvp.exec:\jddvp.exe198⤵PID:4540
-
\??\c:\jjppv.exec:\jjppv.exe199⤵PID:3492
-
\??\c:\fxxrflf.exec:\fxxrflf.exe200⤵PID:3436
-
\??\c:\lfrlffx.exec:\lfrlffx.exe201⤵PID:1608
-
\??\c:\1nnnhh.exec:\1nnnhh.exe202⤵PID:1212
-
\??\c:\ppvvd.exec:\ppvvd.exe203⤵PID:3684
-
\??\c:\9ppjd.exec:\9ppjd.exe204⤵PID:4968
-
\??\c:\pjppj.exec:\pjppj.exe205⤵PID:860
-
\??\c:\fxfllxx.exec:\fxfllxx.exe206⤵PID:3604
-
\??\c:\hbbhhh.exec:\hbbhhh.exe207⤵PID:1128
-
\??\c:\3nbbhh.exec:\3nbbhh.exe208⤵PID:4588
-
\??\c:\pvdpp.exec:\pvdpp.exe209⤵PID:1084
-
\??\c:\pppvv.exec:\pppvv.exe210⤵PID:636
-
\??\c:\1rfxxxf.exec:\1rfxxxf.exe211⤵PID:2688
-
\??\c:\lfxffrx.exec:\lfxffrx.exe212⤵PID:3496
-
\??\c:\1tbbnn.exec:\1tbbnn.exe213⤵PID:4592
-
\??\c:\nntnbh.exec:\nntnbh.exe214⤵PID:408
-
\??\c:\vvvvv.exec:\vvvvv.exe215⤵PID:2956
-
\??\c:\vjjjj.exec:\vjjjj.exe216⤵PID:3968
-
\??\c:\ffxxlxx.exec:\ffxxlxx.exe217⤵PID:3408
-
\??\c:\xlrxxxx.exec:\xlrxxxx.exe218⤵PID:2904
-
\??\c:\9tbtnt.exec:\9tbtnt.exe219⤵PID:1368
-
\??\c:\jddvj.exec:\jddvj.exe220⤵PID:692
-
\??\c:\dvppp.exec:\dvppp.exe221⤵PID:4788
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe222⤵PID:1536
-
\??\c:\9xxxxxx.exec:\9xxxxxx.exe223⤵PID:1328
-
\??\c:\tnttbh.exec:\tnttbh.exe224⤵PID:1708
-
\??\c:\7jpvd.exec:\7jpvd.exe225⤵PID:2024
-
\??\c:\7vddv.exec:\7vddv.exe226⤵PID:2040
-
\??\c:\frlrlll.exec:\frlrlll.exe227⤵PID:4528
-
\??\c:\xxlllxx.exec:\xxlllxx.exe228⤵PID:5104
-
\??\c:\bhtttt.exec:\bhtttt.exe229⤵PID:4692
-
\??\c:\3bbbtt.exec:\3bbbtt.exe230⤵PID:2920
-
\??\c:\ddvpv.exec:\ddvpv.exe231⤵PID:2212
-
\??\c:\jdjjj.exec:\jdjjj.exe232⤵PID:2276
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe233⤵PID:3772
-
\??\c:\rrrllll.exec:\rrrllll.exe234⤵PID:3532
-
\??\c:\frfffll.exec:\frfffll.exe235⤵PID:1060
-
\??\c:\hbntnn.exec:\hbntnn.exe236⤵PID:4436
-
\??\c:\bthbbh.exec:\bthbbh.exe237⤵PID:4512
-
\??\c:\dpvvp.exec:\dpvvp.exe238⤵PID:3980
-
\??\c:\jdppp.exec:\jdppp.exe239⤵PID:1200
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe240⤵PID:4840
-
\??\c:\1xxrrrr.exec:\1xxrrrr.exe241⤵PID:4396
-
\??\c:\hhtthh.exec:\hhtthh.exe242⤵PID:4516