Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe
-
Size
64KB
-
MD5
4d80bf26a8ae547018e5c490af88de90
-
SHA1
f422ccb67549a6b09c231a9dd1976b155f769b29
-
SHA256
9434a81b9e30ac69a3a97272fb7951c58e1a327b833945a7711fccbf523fba7f
-
SHA512
a8b56f797ecb7885d21422dafbc184a7b3cde0841d25bb387e19163631d0a01585aa3f9919a64146b89cd96a36f9944c244644ce514827757ce8ed37c2443982
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvdK:ymb3NkkiQ3mdBjF0yMlv
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/1328-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4188-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-815-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
3vvvp.exefflllrr.exebnnnnt.exevddvv.exexfllffr.exentnntb.exenntbtt.exevjdpd.exefrxxrxf.exepdvpj.exevvjjj.exenhhbbb.exettbnnh.exeddjdv.exe3lrllrr.exebthhnn.exettbbtt.exevdvpv.exexxxfflr.exehnbtth.exebhbnhh.exevjvjj.exeflllrrx.exetbtbhb.exeddpdp.exefrxxfrl.exebbhntb.exenbtnnn.exedpvdj.exejvvdj.exellxlfll.exehhhnnn.exenhbhtb.exe1dddp.exepjvvp.exellrrrxx.exehthbbb.exennhhhn.exejjjjd.exellrlllx.exelflllrr.exennnthn.exebtbbbb.exenbhhhn.exejjddd.exe9pvdv.exerlrrlll.exehhhnnt.exennnhbb.exevvjjp.exeppvvv.exexlrlfll.exetttttt.exe7bnttt.exevpvvp.exerlrllll.exe3lllflf.exehhttnn.exenhbtnt.exe5pdvp.exexxfrlrl.exelffxrll.exebbhhhh.exenttbnn.exepid process 4188 3vvvp.exe 2476 fflllrr.exe 1180 bnnnnt.exe 4912 vddvv.exe 3472 xfllffr.exe 3572 ntnntb.exe 3012 nntbtt.exe 2408 vjdpd.exe 2956 frxxrxf.exe 1520 pdvpj.exe 4940 vvjjj.exe 1332 nhhbbb.exe 1072 ttbnnh.exe 2992 ddjdv.exe 5036 3lrllrr.exe 5028 bthhnn.exe 4572 ttbbtt.exe 1956 vdvpv.exe 4656 xxxfflr.exe 4564 hnbtth.exe 4244 bhbnhh.exe 4036 vjvjj.exe 1400 flllrrx.exe 3688 tbtbhb.exe 4848 ddpdp.exe 2276 frxxfrl.exe 5044 bbhntb.exe 1884 nbtnnn.exe 4060 dpvdj.exe 4840 jvvdj.exe 3312 llxlfll.exe 3316 hhhnnn.exe 3388 nhbhtb.exe 4592 1dddp.exe 4968 pjvvp.exe 3580 llrrrxx.exe 5116 hthbbb.exe 2492 nnhhhn.exe 4028 jjjjd.exe 1544 llrlllx.exe 4788 lflllrr.exe 2964 nnnthn.exe 4728 btbbbb.exe 636 nbhhhn.exe 5020 jjddd.exe 2720 9pvdv.exe 5000 rlrrlll.exe 1140 hhhnnt.exe 1656 nnnhbb.exe 4168 vvjjp.exe 4444 ppvvv.exe 2408 xlrlfll.exe 4236 tttttt.exe 2488 7bnttt.exe 2972 vpvvp.exe 4528 rlrllll.exe 184 3lllflf.exe 1492 hhttnn.exe 1072 nhbtnt.exe 2088 5pdvp.exe 1016 xxfrlrl.exe 5036 lffxrll.exe 4576 bbhhhh.exe 3256 nttbnn.exe -
Processes:
resource yara_rule behavioral2/memory/1328-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4188-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1884-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-815-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe3vvvp.exefflllrr.exebnnnnt.exevddvv.exexfllffr.exentnntb.exenntbtt.exevjdpd.exefrxxrxf.exepdvpj.exevvjjj.exenhhbbb.exettbnnh.exeddjdv.exe3lrllrr.exebthhnn.exettbbtt.exevdvpv.exexxxfflr.exehnbtth.exebhbnhh.exedescription pid process target process PID 1328 wrote to memory of 4188 1328 4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe 3vvvp.exe PID 1328 wrote to memory of 4188 1328 4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe 3vvvp.exe PID 1328 wrote to memory of 4188 1328 4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe 3vvvp.exe PID 4188 wrote to memory of 2476 4188 3vvvp.exe fflllrr.exe PID 4188 wrote to memory of 2476 4188 3vvvp.exe fflllrr.exe PID 4188 wrote to memory of 2476 4188 3vvvp.exe fflllrr.exe PID 2476 wrote to memory of 1180 2476 fflllrr.exe bnnnnt.exe PID 2476 wrote to memory of 1180 2476 fflllrr.exe bnnnnt.exe PID 2476 wrote to memory of 1180 2476 fflllrr.exe bnnnnt.exe PID 1180 wrote to memory of 4912 1180 bnnnnt.exe vddvv.exe PID 1180 wrote to memory of 4912 1180 bnnnnt.exe vddvv.exe PID 1180 wrote to memory of 4912 1180 bnnnnt.exe vddvv.exe PID 4912 wrote to memory of 3472 4912 vddvv.exe xfllffr.exe PID 4912 wrote to memory of 3472 4912 vddvv.exe xfllffr.exe PID 4912 wrote to memory of 3472 4912 vddvv.exe xfllffr.exe PID 3472 wrote to memory of 3572 3472 xfllffr.exe ntnntb.exe PID 3472 wrote to memory of 3572 3472 xfllffr.exe ntnntb.exe PID 3472 wrote to memory of 3572 3472 xfllffr.exe ntnntb.exe PID 3572 wrote to memory of 3012 3572 ntnntb.exe nntbtt.exe PID 3572 wrote to memory of 3012 3572 ntnntb.exe nntbtt.exe PID 3572 wrote to memory of 3012 3572 ntnntb.exe nntbtt.exe PID 3012 wrote to memory of 2408 3012 nntbtt.exe vjdpd.exe PID 3012 wrote to memory of 2408 3012 nntbtt.exe vjdpd.exe PID 3012 wrote to memory of 2408 3012 nntbtt.exe vjdpd.exe PID 2408 wrote to memory of 2956 2408 vjdpd.exe frxxrxf.exe PID 2408 wrote to memory of 2956 2408 vjdpd.exe frxxrxf.exe PID 2408 wrote to memory of 2956 2408 vjdpd.exe frxxrxf.exe PID 2956 wrote to memory of 1520 2956 frxxrxf.exe pdvpj.exe PID 2956 wrote to memory of 1520 2956 frxxrxf.exe pdvpj.exe PID 2956 wrote to memory of 1520 2956 frxxrxf.exe pdvpj.exe PID 1520 wrote to memory of 4940 1520 pdvpj.exe vvjjj.exe PID 1520 wrote to memory of 4940 1520 pdvpj.exe vvjjj.exe PID 1520 wrote to memory of 4940 1520 pdvpj.exe vvjjj.exe PID 4940 wrote to memory of 1332 4940 vvjjj.exe nhhbbb.exe PID 4940 wrote to memory of 1332 4940 vvjjj.exe nhhbbb.exe PID 4940 wrote to memory of 1332 4940 vvjjj.exe nhhbbb.exe PID 1332 wrote to memory of 1072 1332 nhhbbb.exe ttbnnh.exe PID 1332 wrote to memory of 1072 1332 nhhbbb.exe ttbnnh.exe PID 1332 wrote to memory of 1072 1332 nhhbbb.exe ttbnnh.exe PID 1072 wrote to memory of 2992 1072 ttbnnh.exe ddjdv.exe PID 1072 wrote to memory of 2992 1072 ttbnnh.exe ddjdv.exe PID 1072 wrote to memory of 2992 1072 ttbnnh.exe ddjdv.exe PID 2992 wrote to memory of 5036 2992 ddjdv.exe 3lrllrr.exe PID 2992 wrote to memory of 5036 2992 ddjdv.exe 3lrllrr.exe PID 2992 wrote to memory of 5036 2992 ddjdv.exe 3lrllrr.exe PID 5036 wrote to memory of 5028 5036 3lrllrr.exe bthhnn.exe PID 5036 wrote to memory of 5028 5036 3lrllrr.exe bthhnn.exe PID 5036 wrote to memory of 5028 5036 3lrllrr.exe bthhnn.exe PID 5028 wrote to memory of 4572 5028 bthhnn.exe ttbbtt.exe PID 5028 wrote to memory of 4572 5028 bthhnn.exe ttbbtt.exe PID 5028 wrote to memory of 4572 5028 bthhnn.exe ttbbtt.exe PID 4572 wrote to memory of 1956 4572 ttbbtt.exe vdvpv.exe PID 4572 wrote to memory of 1956 4572 ttbbtt.exe vdvpv.exe PID 4572 wrote to memory of 1956 4572 ttbbtt.exe vdvpv.exe PID 1956 wrote to memory of 4656 1956 vdvpv.exe xxxfflr.exe PID 1956 wrote to memory of 4656 1956 vdvpv.exe xxxfflr.exe PID 1956 wrote to memory of 4656 1956 vdvpv.exe xxxfflr.exe PID 4656 wrote to memory of 4564 4656 xxxfflr.exe hnbtth.exe PID 4656 wrote to memory of 4564 4656 xxxfflr.exe hnbtth.exe PID 4656 wrote to memory of 4564 4656 xxxfflr.exe hnbtth.exe PID 4564 wrote to memory of 4244 4564 hnbtth.exe bhbnhh.exe PID 4564 wrote to memory of 4244 4564 hnbtth.exe bhbnhh.exe PID 4564 wrote to memory of 4244 4564 hnbtth.exe bhbnhh.exe PID 4244 wrote to memory of 4036 4244 bhbnhh.exe vjvjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\3vvvp.exec:\3vvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\fflllrr.exec:\fflllrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\bnnnnt.exec:\bnnnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\vddvv.exec:\vddvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\xfllffr.exec:\xfllffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\ntnntb.exec:\ntnntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\nntbtt.exec:\nntbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\vjdpd.exec:\vjdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\frxxrxf.exec:\frxxrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\pdvpj.exec:\pdvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\vvjjj.exec:\vvjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\nhhbbb.exec:\nhhbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\ttbnnh.exec:\ttbnnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\ddjdv.exec:\ddjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\3lrllrr.exec:\3lrllrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\bthhnn.exec:\bthhnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\ttbbtt.exec:\ttbbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\vdvpv.exec:\vdvpv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\xxxfflr.exec:\xxxfflr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\hnbtth.exec:\hnbtth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\bhbnhh.exec:\bhbnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\vjvjj.exec:\vjvjj.exe23⤵
- Executes dropped EXE
PID:4036 -
\??\c:\flllrrx.exec:\flllrrx.exe24⤵
- Executes dropped EXE
PID:1400 -
\??\c:\tbtbhb.exec:\tbtbhb.exe25⤵
- Executes dropped EXE
PID:3688 -
\??\c:\ddpdp.exec:\ddpdp.exe26⤵
- Executes dropped EXE
PID:4848 -
\??\c:\frxxfrl.exec:\frxxfrl.exe27⤵
- Executes dropped EXE
PID:2276 -
\??\c:\bbhntb.exec:\bbhntb.exe28⤵
- Executes dropped EXE
PID:5044 -
\??\c:\nbtnnn.exec:\nbtnnn.exe29⤵
- Executes dropped EXE
PID:1884 -
\??\c:\dpvdj.exec:\dpvdj.exe30⤵
- Executes dropped EXE
PID:4060 -
\??\c:\jvvdj.exec:\jvvdj.exe31⤵
- Executes dropped EXE
PID:4840 -
\??\c:\llxlfll.exec:\llxlfll.exe32⤵
- Executes dropped EXE
PID:3312 -
\??\c:\hhhnnn.exec:\hhhnnn.exe33⤵
- Executes dropped EXE
PID:3316 -
\??\c:\nhbhtb.exec:\nhbhtb.exe34⤵
- Executes dropped EXE
PID:3388 -
\??\c:\1dddp.exec:\1dddp.exe35⤵
- Executes dropped EXE
PID:4592 -
\??\c:\pjvvp.exec:\pjvvp.exe36⤵
- Executes dropped EXE
PID:4968 -
\??\c:\llrrrxx.exec:\llrrrxx.exe37⤵
- Executes dropped EXE
PID:3580 -
\??\c:\hthbbb.exec:\hthbbb.exe38⤵
- Executes dropped EXE
PID:5116 -
\??\c:\nnhhhn.exec:\nnhhhn.exe39⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jjjjd.exec:\jjjjd.exe40⤵
- Executes dropped EXE
PID:4028 -
\??\c:\llrlllx.exec:\llrlllx.exe41⤵
- Executes dropped EXE
PID:1544 -
\??\c:\lflllrr.exec:\lflllrr.exe42⤵
- Executes dropped EXE
PID:4788 -
\??\c:\nnnthn.exec:\nnnthn.exe43⤵
- Executes dropped EXE
PID:2964 -
\??\c:\btbbbb.exec:\btbbbb.exe44⤵
- Executes dropped EXE
PID:4728 -
\??\c:\nbhhhn.exec:\nbhhhn.exe45⤵
- Executes dropped EXE
PID:636 -
\??\c:\jjddd.exec:\jjddd.exe46⤵
- Executes dropped EXE
PID:5020 -
\??\c:\9pvdv.exec:\9pvdv.exe47⤵
- Executes dropped EXE
PID:2720 -
\??\c:\rlrrlll.exec:\rlrrlll.exe48⤵
- Executes dropped EXE
PID:5000 -
\??\c:\hhhnnt.exec:\hhhnnt.exe49⤵
- Executes dropped EXE
PID:1140 -
\??\c:\nnnhbb.exec:\nnnhbb.exe50⤵
- Executes dropped EXE
PID:1656 -
\??\c:\vvjjp.exec:\vvjjp.exe51⤵
- Executes dropped EXE
PID:4168 -
\??\c:\ppvvv.exec:\ppvvv.exe52⤵
- Executes dropped EXE
PID:4444 -
\??\c:\xlrlfll.exec:\xlrlfll.exe53⤵
- Executes dropped EXE
PID:2408 -
\??\c:\tttttt.exec:\tttttt.exe54⤵
- Executes dropped EXE
PID:4236 -
\??\c:\7bnttt.exec:\7bnttt.exe55⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vpvvp.exec:\vpvvp.exe56⤵
- Executes dropped EXE
PID:2972 -
\??\c:\rlrllll.exec:\rlrllll.exe57⤵
- Executes dropped EXE
PID:4528 -
\??\c:\3lllflf.exec:\3lllflf.exe58⤵
- Executes dropped EXE
PID:184 -
\??\c:\hhttnn.exec:\hhttnn.exe59⤵
- Executes dropped EXE
PID:1492 -
\??\c:\nhbtnt.exec:\nhbtnt.exe60⤵
- Executes dropped EXE
PID:1072 -
\??\c:\5pdvp.exec:\5pdvp.exe61⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xxfrlrl.exec:\xxfrlrl.exe62⤵
- Executes dropped EXE
PID:1016 -
\??\c:\lffxrll.exec:\lffxrll.exe63⤵
- Executes dropped EXE
PID:5036 -
\??\c:\bbhhhh.exec:\bbhhhh.exe64⤵
- Executes dropped EXE
PID:4576 -
\??\c:\nttbnn.exec:\nttbnn.exe65⤵
- Executes dropped EXE
PID:3256 -
\??\c:\hhbbhn.exec:\hhbbhn.exe66⤵PID:1992
-
\??\c:\5djjp.exec:\5djjp.exe67⤵PID:4872
-
\??\c:\jvppd.exec:\jvppd.exe68⤵PID:4964
-
\??\c:\xxrlrxx.exec:\xxrlrxx.exe69⤵PID:1864
-
\??\c:\3nbttb.exec:\3nbttb.exe70⤵PID:5108
-
\??\c:\7nbbbh.exec:\7nbbbh.exe71⤵PID:3132
-
\??\c:\hbtbnn.exec:\hbtbnn.exe72⤵PID:1400
-
\??\c:\pdjjp.exec:\pdjjp.exe73⤵PID:4312
-
\??\c:\xrrrlll.exec:\xrrrlll.exe74⤵PID:1612
-
\??\c:\lfxxxff.exec:\lfxxxff.exe75⤵PID:1412
-
\??\c:\tttttn.exec:\tttttn.exe76⤵PID:4548
-
\??\c:\tthhbh.exec:\tthhbh.exe77⤵PID:1540
-
\??\c:\9vpdv.exec:\9vpdv.exe78⤵PID:4372
-
\??\c:\rlrrrff.exec:\rlrrrff.exe79⤵PID:2224
-
\??\c:\9fxxrxx.exec:\9fxxrxx.exe80⤵PID:4828
-
\??\c:\bbhhhn.exec:\bbhhhn.exe81⤵PID:3232
-
\??\c:\pjppv.exec:\pjppv.exe82⤵PID:3308
-
\??\c:\vvjvv.exec:\vvjvv.exe83⤵PID:3600
-
\??\c:\xrffllr.exec:\xrffllr.exe84⤵PID:4072
-
\??\c:\7nttnn.exec:\7nttnn.exe85⤵PID:2536
-
\??\c:\djjdd.exec:\djjdd.exe86⤵PID:2348
-
\??\c:\9xfrxlr.exec:\9xfrxlr.exe87⤵PID:656
-
\??\c:\frrlfxl.exec:\frrlfxl.exe88⤵PID:824
-
\??\c:\nhtttt.exec:\nhtttt.exe89⤵PID:3580
-
\??\c:\ppvvj.exec:\ppvvj.exe90⤵PID:560
-
\??\c:\dppjd.exec:\dppjd.exe91⤵PID:4448
-
\??\c:\5xfxrlf.exec:\5xfxrlf.exe92⤵PID:1688
-
\??\c:\rlrlllr.exec:\rlrlllr.exe93⤵PID:4472
-
\??\c:\thhnhh.exec:\thhnhh.exe94⤵PID:4476
-
\??\c:\1hhtnn.exec:\1hhtnn.exe95⤵PID:2260
-
\??\c:\dvppp.exec:\dvppp.exe96⤵PID:636
-
\??\c:\1xxrffr.exec:\1xxrffr.exe97⤵PID:5020
-
\??\c:\9bnhhh.exec:\9bnhhh.exe98⤵PID:2720
-
\??\c:\tbhhbt.exec:\tbhhbt.exe99⤵PID:1348
-
\??\c:\dvdvj.exec:\dvdvj.exe100⤵PID:2516
-
\??\c:\pjjdv.exec:\pjjdv.exe101⤵PID:1656
-
\??\c:\rlfrllf.exec:\rlfrllf.exe102⤵PID:2328
-
\??\c:\nbtnht.exec:\nbtnht.exe103⤵PID:568
-
\??\c:\hbhbtt.exec:\hbhbtt.exe104⤵PID:4384
-
\??\c:\ffxrlrl.exec:\ffxrlrl.exe105⤵PID:2956
-
\??\c:\5rrlllf.exec:\5rrlllf.exe106⤵PID:2916
-
\??\c:\vppjd.exec:\vppjd.exe107⤵PID:3856
-
\??\c:\lxxrrxr.exec:\lxxrrxr.exe108⤵PID:1068
-
\??\c:\frrrfxx.exec:\frrrfxx.exe109⤵PID:2508
-
\??\c:\1bhbbb.exec:\1bhbbb.exe110⤵PID:2136
-
\??\c:\djjdv.exec:\djjdv.exe111⤵PID:3540
-
\??\c:\fxxxrlf.exec:\fxxxrlf.exe112⤵PID:4836
-
\??\c:\hhhtnh.exec:\hhhtnh.exe113⤵PID:4492
-
\??\c:\htbthh.exec:\htbthh.exe114⤵PID:4576
-
\??\c:\jdppd.exec:\jdppd.exe115⤵PID:5084
-
\??\c:\vpddj.exec:\vpddj.exe116⤵PID:1872
-
\??\c:\3xxrffl.exec:\3xxrffl.exe117⤵PID:4032
-
\??\c:\xrfffll.exec:\xrfffll.exe118⤵PID:444
-
\??\c:\1nnhbh.exec:\1nnhbh.exe119⤵PID:4896
-
\??\c:\pjdvp.exec:\pjdvp.exe120⤵PID:2676
-
\??\c:\dvpdv.exec:\dvpdv.exe121⤵PID:5060
-
\??\c:\frxxllf.exec:\frxxllf.exe122⤵PID:2352
-
\??\c:\nntbbb.exec:\nntbbb.exe123⤵PID:1580
-
\??\c:\xrrxxlf.exec:\xrrxxlf.exe124⤵PID:2200
-
\??\c:\rxfffxf.exec:\rxfffxf.exe125⤵PID:2188
-
\??\c:\bnbttn.exec:\bnbttn.exe126⤵PID:4776
-
\??\c:\bbntnt.exec:\bbntnt.exe127⤵PID:2548
-
\??\c:\3vjvp.exec:\3vjvp.exe128⤵PID:1660
-
\??\c:\7rrlxxr.exec:\7rrlxxr.exe129⤵PID:2612
-
\??\c:\lxxrrlx.exec:\lxxrrlx.exe130⤵PID:3740
-
\??\c:\hhhtnh.exec:\hhhtnh.exe131⤵PID:3920
-
\??\c:\jdpvj.exec:\jdpvj.exe132⤵PID:3316
-
\??\c:\vpjvp.exec:\vpjvp.exe133⤵PID:1036
-
\??\c:\lxfrllf.exec:\lxfrllf.exe134⤵PID:4864
-
\??\c:\rlxxllf.exec:\rlxxllf.exe135⤵PID:4888
-
\??\c:\nnhtht.exec:\nnhtht.exe136⤵PID:5116
-
\??\c:\nhnhhb.exec:\nhnhhb.exe137⤵PID:2492
-
\??\c:\ddpjj.exec:\ddpjj.exe138⤵PID:2096
-
\??\c:\3dpjp.exec:\3dpjp.exe139⤵PID:3212
-
\??\c:\9xrfrlr.exec:\9xrfrlr.exe140⤵PID:4768
-
\??\c:\flrrrlf.exec:\flrrrlf.exe141⤵PID:4728
-
\??\c:\5hbtnh.exec:\5hbtnh.exe142⤵PID:624
-
\??\c:\pvpjd.exec:\pvpjd.exe143⤵PID:736
-
\??\c:\pvdpv.exec:\pvdpv.exe144⤵PID:4404
-
\??\c:\7fxrlxl.exec:\7fxrlxl.exe145⤵PID:4600
-
\??\c:\xllfrfl.exec:\xllfrfl.exe146⤵PID:3572
-
\??\c:\nhbhhn.exec:\nhbhhn.exe147⤵PID:3944
-
\??\c:\5bnbtn.exec:\5bnbtn.exe148⤵PID:2208
-
\??\c:\ppvdv.exec:\ppvdv.exe149⤵PID:4444
-
\??\c:\3flfxxr.exec:\3flfxxr.exe150⤵PID:804
-
\??\c:\rllffrl.exec:\rllffrl.exe151⤵PID:1664
-
\??\c:\hnbbnt.exec:\hnbbnt.exe152⤵PID:4384
-
\??\c:\nhnhbh.exec:\nhnhbh.exe153⤵PID:2956
-
\??\c:\ppddd.exec:\ppddd.exe154⤵PID:3856
-
\??\c:\ffrrflr.exec:\ffrrflr.exe155⤵PID:1292
-
\??\c:\frxxrrf.exec:\frxxrrf.exe156⤵PID:1072
-
\??\c:\tntttt.exec:\tntttt.exe157⤵PID:3236
-
\??\c:\hbtbnb.exec:\hbtbnb.exe158⤵PID:1016
-
\??\c:\5ntntt.exec:\5ntntt.exe159⤵PID:5028
-
\??\c:\djjjd.exec:\djjjd.exe160⤵PID:2412
-
\??\c:\lllffll.exec:\lllffll.exe161⤵PID:2852
-
\??\c:\frlffxx.exec:\frlffxx.exe162⤵PID:3412
-
\??\c:\9nhtnn.exec:\9nhtnn.exe163⤵PID:1724
-
\??\c:\vvvpj.exec:\vvvpj.exe164⤵PID:224
-
\??\c:\jvdvp.exec:\jvdvp.exe165⤵PID:4896
-
\??\c:\frlflfr.exec:\frlflfr.exe166⤵PID:1276
-
\??\c:\lrrlfll.exec:\lrrlfll.exe167⤵PID:2352
-
\??\c:\7nbbtt.exec:\7nbbtt.exe168⤵PID:3356
-
\??\c:\bbhbnn.exec:\bbhbnn.exe169⤵PID:1708
-
\??\c:\vpjdv.exec:\vpjdv.exe170⤵PID:484
-
\??\c:\frlfrrl.exec:\frlfrrl.exe171⤵PID:1268
-
\??\c:\fxxxrlf.exec:\fxxxrlf.exe172⤵PID:4828
-
\??\c:\btttbb.exec:\btttbb.exe173⤵PID:3740
-
\??\c:\5bbtnn.exec:\5bbtnn.exe174⤵PID:3600
-
\??\c:\jppjd.exec:\jppjd.exe175⤵PID:432
-
\??\c:\lflfrxf.exec:\lflfrxf.exe176⤵PID:556
-
\??\c:\lflfrrl.exec:\lflfrrl.exe177⤵PID:3580
-
\??\c:\thnnhn.exec:\thnnhn.exe178⤵PID:5116
-
\??\c:\djpjv.exec:\djpjv.exe179⤵PID:2492
-
\??\c:\1vvpv.exec:\1vvpv.exe180⤵PID:2096
-
\??\c:\rxxrllx.exec:\rxxrllx.exe181⤵PID:2964
-
\??\c:\hbtbnn.exec:\hbtbnn.exe182⤵PID:4476
-
\??\c:\9jdpj.exec:\9jdpj.exe183⤵PID:4024
-
\??\c:\pdvpj.exec:\pdvpj.exe184⤵PID:1180
-
\??\c:\9rxrrfl.exec:\9rxrrfl.exe185⤵PID:3624
-
\??\c:\xrlfxxl.exec:\xrlfxxl.exe186⤵PID:1868
-
\??\c:\5hhnnb.exec:\5hhnnb.exe187⤵PID:644
-
\??\c:\bbnhbb.exec:\bbnhbb.exe188⤵PID:3344
-
\??\c:\dvjvv.exec:\dvjvv.exe189⤵PID:4916
-
\??\c:\7lxrlff.exec:\7lxrlff.exe190⤵PID:4444
-
\??\c:\ththhn.exec:\ththhn.exe191⤵PID:3528
-
\??\c:\1pppd.exec:\1pppd.exe192⤵PID:4236
-
\??\c:\5xxlffx.exec:\5xxlffx.exe193⤵PID:1664
-
\??\c:\ntbbtt.exec:\ntbbtt.exe194⤵PID:2452
-
\??\c:\1dpjd.exec:\1dpjd.exe195⤵PID:1068
-
\??\c:\dvvpd.exec:\dvvpd.exe196⤵PID:2632
-
\??\c:\xffxxrr.exec:\xffxxrr.exe197⤵PID:1292
-
\??\c:\nhhhbh.exec:\nhhhbh.exe198⤵PID:2812
-
\??\c:\ddpvd.exec:\ddpvd.exe199⤵PID:3236
-
\??\c:\hbnhhb.exec:\hbnhhb.exe200⤵PID:1016
-
\??\c:\5ppjd.exec:\5ppjd.exe201⤵PID:4644
-
\??\c:\rrfxllx.exec:\rrfxllx.exe202⤵PID:1992
-
\??\c:\hhntnb.exec:\hhntnb.exe203⤵PID:2852
-
\??\c:\pjjjp.exec:\pjjjp.exe204⤵PID:3364
-
\??\c:\djjdv.exec:\djjdv.exe205⤵PID:1628
-
\??\c:\xxxffxr.exec:\xxxffxr.exe206⤵PID:4652
-
\??\c:\bbbttt.exec:\bbbttt.exe207⤵PID:4752
-
\??\c:\1jjdv.exec:\1jjdv.exe208⤵PID:4364
-
\??\c:\1rfxxxf.exec:\1rfxxxf.exe209⤵PID:3288
-
\??\c:\1bhbtt.exec:\1bhbtt.exe210⤵PID:3696
-
\??\c:\1ntnnt.exec:\1ntnnt.exe211⤵PID:3444
-
\??\c:\pjjjd.exec:\pjjjd.exe212⤵PID:2552
-
\??\c:\xfxxxxf.exec:\xfxxxxf.exe213⤵PID:1124
-
\??\c:\7nttbh.exec:\7nttbh.exe214⤵PID:3680
-
\??\c:\ttnhhn.exec:\ttnhhn.exe215⤵PID:2888
-
\??\c:\vpppd.exec:\vpppd.exe216⤵PID:4864
-
\??\c:\frxxflx.exec:\frxxflx.exe217⤵PID:116
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe218⤵PID:3588
-
\??\c:\7hnnnn.exec:\7hnnnn.exe219⤵PID:4448
-
\??\c:\ntntnt.exec:\ntntnt.exe220⤵PID:1544
-
\??\c:\jppjp.exec:\jppjp.exe221⤵PID:4472
-
\??\c:\rxfxxrr.exec:\rxfxxrr.exe222⤵PID:4800
-
\??\c:\bttbth.exec:\bttbth.exe223⤵PID:4728
-
\??\c:\nnnhbt.exec:\nnnhbt.exe224⤵PID:4504
-
\??\c:\dddpj.exec:\dddpj.exe225⤵PID:5020
-
\??\c:\5pddv.exec:\5pddv.exe226⤵PID:3488
-
\??\c:\xrfxxlr.exec:\xrfxxlr.exe227⤵PID:4600
-
\??\c:\nthhnt.exec:\nthhnt.exe228⤵PID:1656
-
\??\c:\vjdjp.exec:\vjdjp.exe229⤵PID:1220
-
\??\c:\dvddd.exec:\dvddd.exe230⤵PID:2076
-
\??\c:\llxflrr.exec:\llxflrr.exe231⤵PID:568
-
\??\c:\nhhhbh.exec:\nhhhbh.exe232⤵PID:2488
-
\??\c:\nhhttt.exec:\nhhttt.exe233⤵PID:968
-
\??\c:\pjvvd.exec:\pjvvd.exe234⤵PID:2452
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe235⤵PID:2632
-
\??\c:\flxxllr.exec:\flxxllr.exe236⤵PID:3276
-
\??\c:\btbbhh.exec:\btbbhh.exe237⤵PID:4772
-
\??\c:\btnbhh.exec:\btnbhh.exe238⤵PID:3236
-
\??\c:\vjvdj.exec:\vjvdj.exe239⤵PID:3256
-
\??\c:\fxrrlll.exec:\fxrrlll.exe240⤵PID:4872
-
\??\c:\fflllrr.exec:\fflllrr.exe241⤵PID:4964
-
\??\c:\nnbbhh.exec:\nnbbhh.exe242⤵PID:216