Analysis
-
max time kernel
149s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 00:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
38905f8e75a540a0d18bb8b24118a9a0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
38905f8e75a540a0d18bb8b24118a9a0_NeikiAnalytics.exe
-
Size
135KB
-
MD5
38905f8e75a540a0d18bb8b24118a9a0
-
SHA1
b38734bfcf761da79294047146901dbae273da4e
-
SHA256
6492e496cbc2dd5629ab6b552c85eb6208d911faff3a4bda110414da1be227e2
-
SHA512
f2a1872dfef39dc1269c9ba5567b1d9e960fd5f4aa4fb64a19cc9e811dfdd6e4ff5c62baf9985095d1229372c6f31f36aaab75cc29deae0c073be33348d2545b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHVpx+dGorw:n3C9BRW0j/1px+dGd
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/4856-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-22-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hthbbn.exenhtnnb.exepdjdv.exennnbhh.exejddvv.exefxflllr.exeppjjv.exexrxrllx.exepvjjp.exerfrrrrr.exenbhhnb.exevdjjd.exexrxrlll.exedjvvp.exellrxrll.exenhtthn.exevvvvd.exe3vjpd.exenntthh.exe7vvvv.exerflfxrl.exehbbbbb.exejjdjd.exexlrflfx.exevvjjj.exepjvpv.exennthbb.exe1pdjd.exerflllll.exexrxrflr.exenbbnhb.exepdddv.exefxrrlxr.exebtntnh.exe1pjdd.exevjddp.exerrxrxrx.exefxrlfxx.exe1bbtnn.exe5hhthh.exe9jdvp.exe5fxxrrl.exexrlffxr.exe5nnnhh.exebtbtht.exeppjdp.exejjvpp.exe5fxrrxx.exexlrfxrl.exetttnhh.exedppjd.exe1rlfxrl.exexxlfrrr.exe9bthht.exedjdvp.exerrfrllr.exe9nnnbt.exehbbhhh.exevppdp.exevvjjd.exebtthbt.exetbhbtt.exeppvpp.exerllfxlf.exepid process 4412 hthbbn.exe 3120 nhtnnb.exe 3264 pdjdv.exe 2836 nnnbhh.exe 4156 jddvv.exe 1528 fxflllr.exe 2824 ppjjv.exe 4648 xrxrllx.exe 4664 pvjjp.exe 1524 rfrrrrr.exe 1056 nbhhnb.exe 3236 vdjjd.exe 4504 xrxrlll.exe 988 djvvp.exe 980 llrxrll.exe 2636 nhtthn.exe 1112 vvvvd.exe 1328 3vjpd.exe 3576 nntthh.exe 3260 7vvvv.exe 1748 rflfxrl.exe 1620 hbbbbb.exe 3704 jjdjd.exe 2324 xlrflfx.exe 5004 vvjjj.exe 4028 pjvpv.exe 3344 nnthbb.exe 4652 1pdjd.exe 5096 rflllll.exe 3716 xrxrflr.exe 4972 nbbnhb.exe 4552 pdddv.exe 2444 fxrrlxr.exe 3736 btntnh.exe 4344 1pjdd.exe 1428 vjddp.exe 4412 rrxrxrx.exe 4408 fxrlfxx.exe 4888 1bbtnn.exe 5100 5hhthh.exe 1368 9jdvp.exe 3932 5fxxrrl.exe 3500 xrlffxr.exe 4596 5nnnhh.exe 3008 btbtht.exe 1744 ppjdp.exe 400 jjvpp.exe 4960 5fxrrxx.exe 4648 xlrfxrl.exe 3960 tttnhh.exe 1992 dppjd.exe 3564 1rlfxrl.exe 2064 xxlfrrr.exe 4976 9bthht.exe 740 djdvp.exe 4644 rrfrllr.exe 3928 9nnnbt.exe 1432 hbbhhh.exe 3460 vppdp.exe 2256 vvjjd.exe 1388 btthbt.exe 3576 tbhbtt.exe 1672 ppvpp.exe 1116 rllfxlf.exe -
Processes:
resource yara_rule behavioral2/memory/4856-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-214-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
38905f8e75a540a0d18bb8b24118a9a0_NeikiAnalytics.exehthbbn.exenhtnnb.exepdjdv.exennnbhh.exejddvv.exefxflllr.exeppjjv.exexrxrllx.exepvjjp.exerfrrrrr.exenbhhnb.exevdjjd.exexrxrlll.exedjvvp.exellrxrll.exenhtthn.exevvvvd.exe3vjpd.exenntthh.exe7vvvv.exerflfxrl.exedescription pid process target process PID 4856 wrote to memory of 4412 4856 38905f8e75a540a0d18bb8b24118a9a0_NeikiAnalytics.exe hthbbn.exe PID 4856 wrote to memory of 4412 4856 38905f8e75a540a0d18bb8b24118a9a0_NeikiAnalytics.exe hthbbn.exe PID 4856 wrote to memory of 4412 4856 38905f8e75a540a0d18bb8b24118a9a0_NeikiAnalytics.exe hthbbn.exe PID 4412 wrote to memory of 3120 4412 hthbbn.exe nhtnnb.exe PID 4412 wrote to memory of 3120 4412 hthbbn.exe nhtnnb.exe PID 4412 wrote to memory of 3120 4412 hthbbn.exe nhtnnb.exe PID 3120 wrote to memory of 3264 3120 nhtnnb.exe pdjdv.exe PID 3120 wrote to memory of 3264 3120 nhtnnb.exe pdjdv.exe PID 3120 wrote to memory of 3264 3120 nhtnnb.exe pdjdv.exe PID 3264 wrote to memory of 2836 3264 pdjdv.exe nnnbhh.exe PID 3264 wrote to memory of 2836 3264 pdjdv.exe nnnbhh.exe PID 3264 wrote to memory of 2836 3264 pdjdv.exe nnnbhh.exe PID 2836 wrote to memory of 4156 2836 nnnbhh.exe jddvv.exe PID 2836 wrote to memory of 4156 2836 nnnbhh.exe jddvv.exe PID 2836 wrote to memory of 4156 2836 nnnbhh.exe jddvv.exe PID 4156 wrote to memory of 1528 4156 jddvv.exe fxflllr.exe PID 4156 wrote to memory of 1528 4156 jddvv.exe fxflllr.exe PID 4156 wrote to memory of 1528 4156 jddvv.exe fxflllr.exe PID 1528 wrote to memory of 2824 1528 fxflllr.exe ppjjv.exe PID 1528 wrote to memory of 2824 1528 fxflllr.exe ppjjv.exe PID 1528 wrote to memory of 2824 1528 fxflllr.exe ppjjv.exe PID 2824 wrote to memory of 4648 2824 ppjjv.exe xrxrllx.exe PID 2824 wrote to memory of 4648 2824 ppjjv.exe xrxrllx.exe PID 2824 wrote to memory of 4648 2824 ppjjv.exe xrxrllx.exe PID 4648 wrote to memory of 4664 4648 xrxrllx.exe pvjjp.exe PID 4648 wrote to memory of 4664 4648 xrxrllx.exe pvjjp.exe PID 4648 wrote to memory of 4664 4648 xrxrllx.exe pvjjp.exe PID 4664 wrote to memory of 1524 4664 pvjjp.exe rfrrrrr.exe PID 4664 wrote to memory of 1524 4664 pvjjp.exe rfrrrrr.exe PID 4664 wrote to memory of 1524 4664 pvjjp.exe rfrrrrr.exe PID 1524 wrote to memory of 1056 1524 rfrrrrr.exe nbhhnb.exe PID 1524 wrote to memory of 1056 1524 rfrrrrr.exe nbhhnb.exe PID 1524 wrote to memory of 1056 1524 rfrrrrr.exe nbhhnb.exe PID 1056 wrote to memory of 3236 1056 nbhhnb.exe vdjjd.exe PID 1056 wrote to memory of 3236 1056 nbhhnb.exe vdjjd.exe PID 1056 wrote to memory of 3236 1056 nbhhnb.exe vdjjd.exe PID 3236 wrote to memory of 4504 3236 vdjjd.exe xrxrlll.exe PID 3236 wrote to memory of 4504 3236 vdjjd.exe xrxrlll.exe PID 3236 wrote to memory of 4504 3236 vdjjd.exe xrxrlll.exe PID 4504 wrote to memory of 988 4504 xrxrlll.exe djvvp.exe PID 4504 wrote to memory of 988 4504 xrxrlll.exe djvvp.exe PID 4504 wrote to memory of 988 4504 xrxrlll.exe djvvp.exe PID 988 wrote to memory of 980 988 djvvp.exe llrxrll.exe PID 988 wrote to memory of 980 988 djvvp.exe llrxrll.exe PID 988 wrote to memory of 980 988 djvvp.exe llrxrll.exe PID 980 wrote to memory of 2636 980 llrxrll.exe nhtthn.exe PID 980 wrote to memory of 2636 980 llrxrll.exe nhtthn.exe PID 980 wrote to memory of 2636 980 llrxrll.exe nhtthn.exe PID 2636 wrote to memory of 1112 2636 nhtthn.exe vvvvd.exe PID 2636 wrote to memory of 1112 2636 nhtthn.exe vvvvd.exe PID 2636 wrote to memory of 1112 2636 nhtthn.exe vvvvd.exe PID 1112 wrote to memory of 1328 1112 vvvvd.exe 3vjpd.exe PID 1112 wrote to memory of 1328 1112 vvvvd.exe 3vjpd.exe PID 1112 wrote to memory of 1328 1112 vvvvd.exe 3vjpd.exe PID 1328 wrote to memory of 3576 1328 3vjpd.exe nntthh.exe PID 1328 wrote to memory of 3576 1328 3vjpd.exe nntthh.exe PID 1328 wrote to memory of 3576 1328 3vjpd.exe nntthh.exe PID 3576 wrote to memory of 3260 3576 nntthh.exe 7vvvv.exe PID 3576 wrote to memory of 3260 3576 nntthh.exe 7vvvv.exe PID 3576 wrote to memory of 3260 3576 nntthh.exe 7vvvv.exe PID 3260 wrote to memory of 1748 3260 7vvvv.exe rflfxrl.exe PID 3260 wrote to memory of 1748 3260 7vvvv.exe rflfxrl.exe PID 3260 wrote to memory of 1748 3260 7vvvv.exe rflfxrl.exe PID 1748 wrote to memory of 1620 1748 rflfxrl.exe hbbbbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\38905f8e75a540a0d18bb8b24118a9a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\38905f8e75a540a0d18bb8b24118a9a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\hthbbn.exec:\hthbbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\nhtnnb.exec:\nhtnnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\pdjdv.exec:\pdjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\nnnbhh.exec:\nnnbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\jddvv.exec:\jddvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\fxflllr.exec:\fxflllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\ppjjv.exec:\ppjjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\xrxrllx.exec:\xrxrllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\pvjjp.exec:\pvjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\rfrrrrr.exec:\rfrrrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\nbhhnb.exec:\nbhhnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\vdjjd.exec:\vdjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\xrxrlll.exec:\xrxrlll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\djvvp.exec:\djvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\llrxrll.exec:\llrxrll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\nhtthn.exec:\nhtthn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\vvvvd.exec:\vvvvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\3vjpd.exec:\3vjpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\nntthh.exec:\nntthh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\7vvvv.exec:\7vvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\rflfxrl.exec:\rflfxrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\hbbbbb.exec:\hbbbbb.exe23⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jjdjd.exec:\jjdjd.exe24⤵
- Executes dropped EXE
PID:3704 -
\??\c:\xlrflfx.exec:\xlrflfx.exe25⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vvjjj.exec:\vvjjj.exe26⤵
- Executes dropped EXE
PID:5004 -
\??\c:\pjvpv.exec:\pjvpv.exe27⤵
- Executes dropped EXE
PID:4028 -
\??\c:\nnthbb.exec:\nnthbb.exe28⤵
- Executes dropped EXE
PID:3344 -
\??\c:\1pdjd.exec:\1pdjd.exe29⤵
- Executes dropped EXE
PID:4652 -
\??\c:\rflllll.exec:\rflllll.exe30⤵
- Executes dropped EXE
PID:5096 -
\??\c:\xrxrflr.exec:\xrxrflr.exe31⤵
- Executes dropped EXE
PID:3716 -
\??\c:\nbbnhb.exec:\nbbnhb.exe32⤵
- Executes dropped EXE
PID:4972 -
\??\c:\pdddv.exec:\pdddv.exe33⤵
- Executes dropped EXE
PID:4552 -
\??\c:\fxrrlxr.exec:\fxrrlxr.exe34⤵
- Executes dropped EXE
PID:2444 -
\??\c:\btntnh.exec:\btntnh.exe35⤵
- Executes dropped EXE
PID:3736 -
\??\c:\1pjdd.exec:\1pjdd.exe36⤵
- Executes dropped EXE
PID:4344 -
\??\c:\vjddp.exec:\vjddp.exe37⤵
- Executes dropped EXE
PID:1428 -
\??\c:\rrxrxrx.exec:\rrxrxrx.exe38⤵
- Executes dropped EXE
PID:4412 -
\??\c:\fxrlfxx.exec:\fxrlfxx.exe39⤵
- Executes dropped EXE
PID:4408 -
\??\c:\1bbtnn.exec:\1bbtnn.exe40⤵
- Executes dropped EXE
PID:4888 -
\??\c:\5hhthh.exec:\5hhthh.exe41⤵
- Executes dropped EXE
PID:5100 -
\??\c:\9jdvp.exec:\9jdvp.exe42⤵
- Executes dropped EXE
PID:1368 -
\??\c:\5fxxrrl.exec:\5fxxrrl.exe43⤵
- Executes dropped EXE
PID:3932 -
\??\c:\xrlffxr.exec:\xrlffxr.exe44⤵
- Executes dropped EXE
PID:3500 -
\??\c:\5nnnhh.exec:\5nnnhh.exe45⤵
- Executes dropped EXE
PID:4596 -
\??\c:\btbtht.exec:\btbtht.exe46⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ppjdp.exec:\ppjdp.exe47⤵
- Executes dropped EXE
PID:1744 -
\??\c:\jjvpp.exec:\jjvpp.exe48⤵
- Executes dropped EXE
PID:400 -
\??\c:\5fxrrxx.exec:\5fxrrxx.exe49⤵
- Executes dropped EXE
PID:4960 -
\??\c:\xlrfxrl.exec:\xlrfxrl.exe50⤵
- Executes dropped EXE
PID:4648 -
\??\c:\tttnhh.exec:\tttnhh.exe51⤵
- Executes dropped EXE
PID:3960 -
\??\c:\dppjd.exec:\dppjd.exe52⤵
- Executes dropped EXE
PID:1992 -
\??\c:\1rlfxrl.exec:\1rlfxrl.exe53⤵
- Executes dropped EXE
PID:3564 -
\??\c:\xxlfrrr.exec:\xxlfrrr.exe54⤵
- Executes dropped EXE
PID:2064 -
\??\c:\9bthht.exec:\9bthht.exe55⤵
- Executes dropped EXE
PID:4976 -
\??\c:\djdvp.exec:\djdvp.exe56⤵
- Executes dropped EXE
PID:740 -
\??\c:\rrfrllr.exec:\rrfrllr.exe57⤵
- Executes dropped EXE
PID:4644 -
\??\c:\9nnnbt.exec:\9nnnbt.exe58⤵
- Executes dropped EXE
PID:3928 -
\??\c:\hbbhhh.exec:\hbbhhh.exe59⤵
- Executes dropped EXE
PID:1432 -
\??\c:\vppdp.exec:\vppdp.exe60⤵
- Executes dropped EXE
PID:3460 -
\??\c:\vvjjd.exec:\vvjjd.exe61⤵
- Executes dropped EXE
PID:2256 -
\??\c:\btthbt.exec:\btthbt.exe62⤵
- Executes dropped EXE
PID:1388 -
\??\c:\tbhbtt.exec:\tbhbtt.exe63⤵
- Executes dropped EXE
PID:3576 -
\??\c:\ppvpp.exec:\ppvpp.exe64⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rllfxlf.exec:\rllfxlf.exe65⤵
- Executes dropped EXE
PID:1116 -
\??\c:\btbbtt.exec:\btbbtt.exe66⤵PID:1748
-
\??\c:\3tbbtb.exec:\3tbbtb.exe67⤵PID:4544
-
\??\c:\pjjdp.exec:\pjjdp.exe68⤵PID:1820
-
\??\c:\dpppj.exec:\dpppj.exe69⤵PID:1104
-
\??\c:\rlxrrrf.exec:\rlxrrrf.exe70⤵PID:4780
-
\??\c:\rffxrrr.exec:\rffxrrr.exe71⤵PID:3684
-
\??\c:\3bnnnn.exec:\3bnnnn.exe72⤵PID:3752
-
\??\c:\thhnhh.exec:\thhnhh.exe73⤵PID:1796
-
\??\c:\ddpdj.exec:\ddpdj.exe74⤵PID:3720
-
\??\c:\7rllrrl.exec:\7rllrrl.exe75⤵PID:1040
-
\??\c:\xxxrlll.exec:\xxxrlll.exe76⤵PID:4268
-
\??\c:\nhttnn.exec:\nhttnn.exe77⤵PID:4324
-
\??\c:\bhbhhh.exec:\bhbhhh.exe78⤵PID:3716
-
\??\c:\rlfxrll.exec:\rlfxrll.exe79⤵PID:2160
-
\??\c:\xlrrlxr.exec:\xlrrlxr.exe80⤵PID:3580
-
\??\c:\ttttnn.exec:\ttttnn.exe81⤵PID:4352
-
\??\c:\nhbhbh.exec:\nhbhbh.exe82⤵PID:4404
-
\??\c:\jppjd.exec:\jppjd.exe83⤵PID:3528
-
\??\c:\rfllxxl.exec:\rfllxxl.exe84⤵PID:1972
-
\??\c:\rlfxrll.exec:\rlfxrll.exe85⤵PID:896
-
\??\c:\7nbbtt.exec:\7nbbtt.exe86⤵PID:3188
-
\??\c:\ntbtnh.exec:\ntbtnh.exe87⤵PID:1288
-
\??\c:\dvddj.exec:\dvddj.exe88⤵PID:2448
-
\??\c:\rxxrxrl.exec:\rxxrxrl.exe89⤵PID:3324
-
\??\c:\9xxxfxf.exec:\9xxxfxf.exe90⤵PID:3712
-
\??\c:\nbttbb.exec:\nbttbb.exe91⤵PID:1464
-
\??\c:\nhttnh.exec:\nhttnh.exe92⤵PID:1528
-
\??\c:\vddvp.exec:\vddvp.exe93⤵PID:3008
-
\??\c:\frxrlfx.exec:\frxrlfx.exe94⤵PID:1744
-
\??\c:\rxlrlrr.exec:\rxlrlrr.exe95⤵PID:400
-
\??\c:\bhhbtt.exec:\bhhbtt.exe96⤵PID:692
-
\??\c:\thbnnn.exec:\thbnnn.exe97⤵PID:764
-
\??\c:\pdpjj.exec:\pdpjj.exe98⤵PID:4452
-
\??\c:\ppdvv.exec:\ppdvv.exe99⤵PID:2116
-
\??\c:\lxllrrx.exec:\lxllrrx.exe100⤵PID:2648
-
\??\c:\xrfxxff.exec:\xrfxxff.exe101⤵PID:2768
-
\??\c:\bntbth.exec:\bntbth.exe102⤵PID:2280
-
\??\c:\pjvjd.exec:\pjvjd.exe103⤵PID:3352
-
\??\c:\jppjd.exec:\jppjd.exe104⤵PID:1532
-
\??\c:\lfxrfxx.exec:\lfxrfxx.exe105⤵PID:4248
-
\??\c:\5bhbtb.exec:\5bhbtb.exe106⤵PID:3460
-
\??\c:\bttnhn.exec:\bttnhn.exe107⤵PID:1548
-
\??\c:\7jjjv.exec:\7jjjv.exe108⤵PID:1036
-
\??\c:\vjpjd.exec:\vjpjd.exe109⤵PID:1672
-
\??\c:\9rxrlll.exec:\9rxrlll.exe110⤵PID:5036
-
\??\c:\bnhhnt.exec:\bnhhnt.exe111⤵PID:2524
-
\??\c:\5btnnt.exec:\5btnnt.exe112⤵PID:5000
-
\??\c:\vpjjd.exec:\vpjjd.exe113⤵PID:4948
-
\??\c:\vpdvp.exec:\vpdvp.exe114⤵PID:1912
-
\??\c:\rfrlfxr.exec:\rfrlfxr.exe115⤵PID:4520
-
\??\c:\flrlffl.exec:\flrlffl.exe116⤵PID:4764
-
\??\c:\hnhbtt.exec:\hnhbtt.exe117⤵PID:4928
-
\??\c:\9jjdp.exec:\9jjdp.exe118⤵PID:5096
-
\??\c:\lllxrlx.exec:\lllxrlx.exe119⤵PID:2336
-
\??\c:\rxlflll.exec:\rxlflll.exe120⤵PID:2828
-
\??\c:\9nnhbh.exec:\9nnhbh.exe121⤵PID:3580
-
\??\c:\1ttbht.exec:\1ttbht.exe122⤵PID:1800
-
\??\c:\jdvpd.exec:\jdvpd.exe123⤵PID:1428
-
\??\c:\xrlllrx.exec:\xrlllrx.exe124⤵PID:4416
-
\??\c:\xrrlxrr.exec:\xrrlxrr.exe125⤵PID:896
-
\??\c:\bbnhbb.exec:\bbnhbb.exe126⤵PID:3188
-
\??\c:\vpjjj.exec:\vpjjj.exe127⤵PID:3940
-
\??\c:\9vdvv.exec:\9vdvv.exe128⤵PID:1832
-
\??\c:\rlfxrfx.exec:\rlfxrfx.exe129⤵PID:3500
-
\??\c:\bhhttt.exec:\bhhttt.exe130⤵PID:3036
-
\??\c:\vjvpp.exec:\vjvpp.exe131⤵PID:5048
-
\??\c:\vpdvp.exec:\vpdvp.exe132⤵PID:636
-
\??\c:\lflrxxr.exec:\lflrxxr.exe133⤵PID:4640
-
\??\c:\btttbb.exec:\btttbb.exe134⤵PID:3876
-
\??\c:\pvpjp.exec:\pvpjp.exe135⤵PID:4804
-
\??\c:\3frffll.exec:\3frffll.exe136⤵PID:3960
-
\??\c:\tnnnnt.exec:\tnnnnt.exe137⤵PID:884
-
\??\c:\ppdvp.exec:\ppdvp.exe138⤵PID:3236
-
\??\c:\xlfrllf.exec:\xlfrllf.exe139⤵PID:4492
-
\??\c:\tthhhh.exec:\tthhhh.exe140⤵PID:4504
-
\??\c:\jpdvp.exec:\jpdvp.exe141⤵PID:2512
-
\??\c:\flfflll.exec:\flfflll.exe142⤵PID:4996
-
\??\c:\nnbtbn.exec:\nnbtbn.exe143⤵PID:980
-
\??\c:\dpvpj.exec:\dpvpj.exe144⤵PID:1092
-
\??\c:\rlfrffx.exec:\rlfrffx.exe145⤵PID:2640
-
\??\c:\tthbhb.exec:\tthbhb.exe146⤵PID:4252
-
\??\c:\5pvpj.exec:\5pvpj.exe147⤵PID:2340
-
\??\c:\lllllll.exec:\lllllll.exe148⤵PID:1668
-
\??\c:\jpppj.exec:\jpppj.exe149⤵PID:1672
-
\??\c:\5jdvp.exec:\5jdvp.exe150⤵PID:4544
-
\??\c:\5xffxxx.exec:\5xffxxx.exe151⤵PID:1436
-
\??\c:\9hhntb.exec:\9hhntb.exe152⤵PID:5000
-
\??\c:\bttnnn.exec:\bttnnn.exe153⤵PID:4948
-
\??\c:\pvvvp.exec:\pvvvp.exe154⤵PID:2324
-
\??\c:\vjvpd.exec:\vjvpd.exe155⤵PID:3720
-
\??\c:\ffflffl.exec:\ffflffl.exe156⤵PID:4528
-
\??\c:\hhnnhn.exec:\hhnnhn.exe157⤵PID:4600
-
\??\c:\ntnnhb.exec:\ntnnhb.exe158⤵PID:3716
-
\??\c:\vjjpp.exec:\vjjpp.exe159⤵PID:4676
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe160⤵PID:1312
-
\??\c:\llrxxrr.exec:\llrxxrr.exe161⤵PID:4572
-
\??\c:\pdjdv.exec:\pdjdv.exe162⤵PID:3120
-
\??\c:\dvjdd.exec:\dvjdd.exe163⤵PID:3268
-
\??\c:\lrlllll.exec:\lrlllll.exe164⤵PID:2096
-
\??\c:\5btnnn.exec:\5btnnn.exe165⤵PID:1288
-
\??\c:\nnbthh.exec:\nnbthh.exe166⤵PID:2448
-
\??\c:\pjpvp.exec:\pjpvp.exe167⤵PID:1316
-
\??\c:\1dddp.exec:\1dddp.exe168⤵PID:2396
-
\??\c:\lxffrrr.exec:\lxffrrr.exe169⤵PID:2528
-
\??\c:\9rrxrlf.exec:\9rrxrlf.exe170⤵PID:828
-
\??\c:\btnhtt.exec:\btnhtt.exe171⤵PID:3824
-
\??\c:\pjjdv.exec:\pjjdv.exe172⤵PID:1392
-
\??\c:\1vdpj.exec:\1vdpj.exe173⤵PID:1564
-
\??\c:\lflfxxf.exec:\lflfxxf.exe174⤵PID:1768
-
\??\c:\lllxlrl.exec:\lllxlrl.exe175⤵PID:2492
-
\??\c:\hbbnbb.exec:\hbbnbb.exe176⤵PID:3212
-
\??\c:\hnnnhn.exec:\hnnnhn.exe177⤵PID:2648
-
\??\c:\7vvpd.exec:\7vvpd.exe178⤵PID:4732
-
\??\c:\vpdvd.exec:\vpdvd.exe179⤵PID:3780
-
\??\c:\xrrrllr.exec:\xrrrllr.exe180⤵PID:4108
-
\??\c:\xfllfff.exec:\xfllfff.exe181⤵PID:2208
-
\??\c:\bttbbb.exec:\bttbbb.exe182⤵PID:1736
-
\??\c:\7nnnhh.exec:\7nnnhh.exe183⤵PID:624
-
\??\c:\jjdvj.exec:\jjdvj.exe184⤵PID:3260
-
\??\c:\ddpvp.exec:\ddpvp.exe185⤵PID:5072
-
\??\c:\rxrllrr.exec:\rxrllrr.exe186⤵PID:3820
-
\??\c:\lxxrrrl.exec:\lxxrrrl.exe187⤵PID:2764
-
\??\c:\nbbntn.exec:\nbbntn.exe188⤵PID:3292
-
\??\c:\tnhnbb.exec:\tnhnbb.exe189⤵PID:1104
-
\??\c:\dvpjp.exec:\dvpjp.exe190⤵PID:1064
-
\??\c:\vvdvv.exec:\vvdvv.exe191⤵PID:4288
-
\??\c:\pvjvj.exec:\pvjvj.exe192⤵PID:4520
-
\??\c:\xxxxxxr.exec:\xxxxxxr.exe193⤵PID:4764
-
\??\c:\1fflllr.exec:\1fflllr.exe194⤵PID:3148
-
\??\c:\5nbttt.exec:\5nbttt.exe195⤵PID:4528
-
\??\c:\bnnhhb.exec:\bnnhhb.exe196⤵PID:4508
-
\??\c:\vjdpp.exec:\vjdpp.exe197⤵PID:4352
-
\??\c:\xrlfffl.exec:\xrlfffl.exe198⤵PID:4344
-
\??\c:\xfrlfxx.exec:\xfrlfxx.exe199⤵PID:1312
-
\??\c:\hthbtn.exec:\hthbtn.exe200⤵PID:4572
-
\??\c:\hbhbhh.exec:\hbhbhh.exe201⤵PID:4416
-
\??\c:\9vvpj.exec:\9vvpj.exe202⤵PID:3268
-
\??\c:\vpvpj.exec:\vpvpj.exe203⤵PID:4216
-
\??\c:\fffxlfx.exec:\fffxlfx.exe204⤵PID:1288
-
\??\c:\xffrlll.exec:\xffrlll.exe205⤵PID:2448
-
\??\c:\3ttthb.exec:\3ttthb.exe206⤵PID:1464
-
\??\c:\thnnbb.exec:\thnnbb.exe207⤵PID:2396
-
\??\c:\jdvdp.exec:\jdvdp.exe208⤵PID:4088
-
\??\c:\jvdpj.exec:\jvdpj.exe209⤵PID:1744
-
\??\c:\9rrlxxr.exec:\9rrlxxr.exe210⤵PID:2088
-
\??\c:\rxrlxfr.exec:\rxrlxfr.exe211⤵PID:1392
-
\??\c:\hbnntt.exec:\hbnntt.exe212⤵PID:1872
-
\??\c:\bntnnn.exec:\bntnnn.exe213⤵PID:428
-
\??\c:\vjjdp.exec:\vjjdp.exe214⤵PID:2492
-
\??\c:\djjdv.exec:\djjdv.exe215⤵PID:3280
-
\??\c:\fxxxlll.exec:\fxxxlll.exe216⤵PID:3608
-
\??\c:\9frrrrr.exec:\9frrrrr.exe217⤵PID:1304
-
\??\c:\thhbnn.exec:\thhbnn.exe218⤵PID:3620
-
\??\c:\hbnnbb.exec:\hbnnbb.exe219⤵PID:3328
-
\??\c:\jpvpd.exec:\jpvpd.exe220⤵PID:3352
-
\??\c:\pdvpj.exec:\pdvpj.exe221⤵PID:1996
-
\??\c:\fxrrlrr.exec:\fxrrlrr.exe222⤵PID:4388
-
\??\c:\frxrxxx.exec:\frxrxxx.exe223⤵PID:4812
-
\??\c:\hntnnn.exec:\hntnnn.exe224⤵PID:1272
-
\??\c:\1bnhbt.exec:\1bnhbt.exe225⤵PID:3588
-
\??\c:\dvvpv.exec:\dvvpv.exe226⤵PID:1748
-
\??\c:\dvddd.exec:\dvddd.exe227⤵PID:4544
-
\??\c:\llfrlxr.exec:\llfrlxr.exe228⤵PID:3196
-
\??\c:\fflfllr.exec:\fflfllr.exe229⤵PID:1064
-
\??\c:\bbhbhb.exec:\bbhbhb.exe230⤵PID:1068
-
\??\c:\5httnn.exec:\5httnn.exe231⤵PID:2616
-
\??\c:\dvpjp.exec:\dvpjp.exe232⤵PID:2412
-
\??\c:\vvpvv.exec:\vvpvv.exe233⤵PID:4972
-
\??\c:\xfrfllr.exec:\xfrfllr.exe234⤵PID:2336
-
\??\c:\hthbtb.exec:\hthbtb.exe235⤵PID:2828
-
\??\c:\dvvvp.exec:\dvvvp.exe236⤵PID:4232
-
\??\c:\rxxfffx.exec:\rxxfffx.exe237⤵PID:4344
-
\??\c:\vdvvd.exec:\vdvvd.exe238⤵PID:1972
-
\??\c:\9rllflf.exec:\9rllflf.exe239⤵PID:4408
-
\??\c:\nnhbtb.exec:\nnhbtb.exe240⤵PID:5100
-
\??\c:\vvdvv.exec:\vvdvv.exe241⤵PID:2688
-
\??\c:\ffrfxxf.exec:\ffrfxxf.exe242⤵PID:3932