Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 08:27
Behavioral task
behavioral1
Sample
df4a2f0950fd5fd0232ebafb11bc79f0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
df4a2f0950fd5fd0232ebafb11bc79f0_NeikiAnalytics.exe
-
Size
190KB
-
MD5
df4a2f0950fd5fd0232ebafb11bc79f0
-
SHA1
c7d9216b255bf48a667a7ffe05134b7954527a70
-
SHA256
296aba48d67da8c2fd5637e13c8636a0c56acfaa8e899e4ed9ea2f75ccbe1369
-
SHA512
3af1ee0096c24f07239bccb54fc2bd37de1ebf6594f52b3c2e75b75701c705b8249a43efc92bf1174923e4c222b61a57cdf2c56b7073f1359b45a175cedc6e73
-
SSDEEP
3072:YhOmTsF93UYfwC6GIoutLmxHxae5yLpcgDE4JBuItR8pTsgnKbQFe3+k:Ycm4FmowdHoSLEaTBftapTsyFeOk
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2576-5-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3292-14-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3476-36-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1868-30-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1864-42-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2872-18-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1744-11-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2060-60-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2316-65-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1672-72-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4964-82-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4788-87-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3052-92-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4720-99-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4604-102-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/884-107-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4444-117-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2012-129-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2104-131-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4496-146-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4040-152-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3784-160-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4320-156-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4716-176-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2848-178-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1784-183-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1928-188-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4392-199-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3752-209-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4368-216-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/752-219-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2960-226-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3044-231-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3960-240-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/396-250-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/376-257-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4024-261-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4964-274-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3244-281-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1032-288-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2180-305-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/732-326-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4240-336-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3668-338-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4152-344-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1340-348-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3236-352-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1644-361-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3276-373-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1792-398-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/5060-402-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4708-437-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1732-447-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2432-492-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2636-496-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2436-515-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3760-616-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4392-617-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/5056-672-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1456-731-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/396-783-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/784-848-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4796-938-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2360-978-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0007000000023305-3.dat family_berbew behavioral2/files/0x0008000000023488-9.dat family_berbew behavioral2/files/0x000700000002348c-13.dat family_berbew behavioral2/files/0x000700000002348d-23.dat family_berbew behavioral2/files/0x000700000002348e-28.dat family_berbew behavioral2/files/0x000700000002348f-33.dat family_berbew behavioral2/files/0x0007000000023492-45.dat family_berbew behavioral2/files/0x0007000000023493-51.dat family_berbew behavioral2/files/0x0007000000023490-40.dat family_berbew behavioral2/files/0x0007000000023494-57.dat family_berbew behavioral2/files/0x0007000000023495-62.dat family_berbew behavioral2/files/0x0007000000023496-69.dat family_berbew behavioral2/files/0x0007000000023497-76.dat family_berbew behavioral2/files/0x0007000000023498-79.dat family_berbew behavioral2/files/0x0007000000023499-85.dat family_berbew behavioral2/files/0x000700000002349a-91.dat family_berbew behavioral2/files/0x000700000002349b-97.dat family_berbew behavioral2/files/0x000700000002349c-104.dat family_berbew behavioral2/files/0x0008000000023489-111.dat family_berbew behavioral2/files/0x000700000002349d-115.dat family_berbew behavioral2/files/0x000700000002349e-121.dat family_berbew behavioral2/files/0x000700000002349f-126.dat family_berbew behavioral2/files/0x00070000000234a0-134.dat family_berbew behavioral2/files/0x00070000000234a2-139.dat family_berbew behavioral2/files/0x00070000000234a3-143.dat family_berbew behavioral2/files/0x00070000000234a4-150.dat family_berbew behavioral2/files/0x00070000000234a5-158.dat family_berbew behavioral2/files/0x00070000000234a6-162.dat family_berbew behavioral2/files/0x00070000000234a7-167.dat family_berbew behavioral2/files/0x00070000000234a9-181.dat family_berbew behavioral2/files/0x00070000000234a8-173.dat family_berbew behavioral2/files/0x00070000000234aa-186.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1744 86048.exe 3292 48288.exe 2872 pdpvd.exe 2056 2402840.exe 1868 6680828.exe 3476 u260640.exe 1864 nhhbtt.exe 1072 ntnhtt.exe 2060 6666840.exe 5064 ddjdv.exe 2316 pddvp.exe 1672 6644446.exe 4964 xrrlfxl.exe 4788 lrrllff.exe 3052 llrllxx.exe 4720 008082.exe 4604 bntbtn.exe 884 dvdvd.exe 4444 fxrrlxx.exe 1700 5pjdd.exe 2012 06822.exe 2104 nhhbhh.exe 3324 2620422.exe 4496 hnnbtn.exe 4040 bbnnhn.exe 4320 dpppv.exe 3784 00066.exe 5052 fffxflr.exe 4716 ddjjj.exe 2848 46408.exe 1784 5tttnh.exe 1928 6000488.exe 4476 jvpdv.exe 4392 862206.exe 216 a6642.exe 1172 ppvvj.exe 3724 hhnnnn.exe 3752 hbhnnh.exe 4368 408664.exe 752 4802288.exe 3020 3ttbth.exe 4848 28004.exe 2960 jddpj.exe 3044 tbbbht.exe 2192 vjpjd.exe 3960 42600.exe 1676 lffrxlr.exe 4536 pdvvv.exe 396 hhtthn.exe 492 pjvpv.exe 376 tbntnn.exe 4024 flffxxx.exe 1288 8860422.exe 3808 dpvvp.exe 5084 24004.exe 4964 nntbbn.exe 4212 008482.exe 3244 802040.exe 3240 nhtnnn.exe 1032 026446.exe 2820 660606.exe 2836 44480.exe 2952 488066.exe 1556 66466.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2576 wrote to memory of 1744 2576 df4a2f0950fd5fd0232ebafb11bc79f0_NeikiAnalytics.exe 83 PID 2576 wrote to memory of 1744 2576 df4a2f0950fd5fd0232ebafb11bc79f0_NeikiAnalytics.exe 83 PID 2576 wrote to memory of 1744 2576 df4a2f0950fd5fd0232ebafb11bc79f0_NeikiAnalytics.exe 83 PID 1744 wrote to memory of 3292 1744 86048.exe 84 PID 1744 wrote to memory of 3292 1744 86048.exe 84 PID 1744 wrote to memory of 3292 1744 86048.exe 84 PID 3292 wrote to memory of 2872 3292 48288.exe 85 PID 3292 wrote to memory of 2872 3292 48288.exe 85 PID 3292 wrote to memory of 2872 3292 48288.exe 85 PID 2872 wrote to memory of 2056 2872 pdpvd.exe 86 PID 2872 wrote to memory of 2056 2872 pdpvd.exe 86 PID 2872 wrote to memory of 2056 2872 pdpvd.exe 86 PID 2056 wrote to memory of 1868 2056 2402840.exe 87 PID 2056 wrote to memory of 1868 2056 2402840.exe 87 PID 2056 wrote to memory of 1868 2056 2402840.exe 87 PID 1868 wrote to memory of 3476 1868 6680828.exe 88 PID 1868 wrote to memory of 3476 1868 6680828.exe 88 PID 1868 wrote to memory of 3476 1868 6680828.exe 88 PID 3476 wrote to memory of 1864 3476 u260640.exe 89 PID 3476 wrote to memory of 1864 3476 u260640.exe 89 PID 3476 wrote to memory of 1864 3476 u260640.exe 89 PID 1864 wrote to memory of 1072 1864 nhhbtt.exe 90 PID 1864 wrote to memory of 1072 1864 nhhbtt.exe 90 PID 1864 wrote to memory of 1072 1864 nhhbtt.exe 90 PID 1072 wrote to memory of 2060 1072 ntnhtt.exe 91 PID 1072 wrote to memory of 2060 1072 ntnhtt.exe 91 PID 1072 wrote to memory of 2060 1072 ntnhtt.exe 91 PID 2060 wrote to memory of 5064 2060 6666840.exe 92 PID 2060 wrote to memory of 5064 2060 6666840.exe 92 PID 2060 wrote to memory of 5064 2060 6666840.exe 92 PID 5064 wrote to memory of 2316 5064 ddjdv.exe 93 PID 5064 wrote to memory of 2316 5064 ddjdv.exe 93 PID 5064 wrote to memory of 2316 5064 ddjdv.exe 93 PID 2316 wrote to memory of 1672 2316 pddvp.exe 94 PID 2316 wrote to memory of 1672 2316 pddvp.exe 94 PID 2316 wrote to memory of 1672 2316 pddvp.exe 94 PID 1672 wrote to memory of 4964 1672 6644446.exe 95 PID 1672 wrote to memory of 4964 1672 6644446.exe 95 PID 1672 wrote to memory of 4964 1672 6644446.exe 95 PID 4964 wrote to memory of 4788 4964 xrrlfxl.exe 96 PID 4964 wrote to memory of 4788 4964 xrrlfxl.exe 96 PID 4964 wrote to memory of 4788 4964 xrrlfxl.exe 96 PID 4788 wrote to memory of 3052 4788 lrrllff.exe 97 PID 4788 wrote to memory of 3052 4788 lrrllff.exe 97 PID 4788 wrote to memory of 3052 4788 lrrllff.exe 97 PID 3052 wrote to memory of 4720 3052 llrllxx.exe 98 PID 3052 wrote to memory of 4720 3052 llrllxx.exe 98 PID 3052 wrote to memory of 4720 3052 llrllxx.exe 98 PID 4720 wrote to memory of 4604 4720 008082.exe 99 PID 4720 wrote to memory of 4604 4720 008082.exe 99 PID 4720 wrote to memory of 4604 4720 008082.exe 99 PID 4604 wrote to memory of 884 4604 bntbtn.exe 100 PID 4604 wrote to memory of 884 4604 bntbtn.exe 100 PID 4604 wrote to memory of 884 4604 bntbtn.exe 100 PID 884 wrote to memory of 4444 884 dvdvd.exe 101 PID 884 wrote to memory of 4444 884 dvdvd.exe 101 PID 884 wrote to memory of 4444 884 dvdvd.exe 101 PID 4444 wrote to memory of 1700 4444 fxrrlxx.exe 102 PID 4444 wrote to memory of 1700 4444 fxrrlxx.exe 102 PID 4444 wrote to memory of 1700 4444 fxrrlxx.exe 102 PID 1700 wrote to memory of 2012 1700 5pjdd.exe 103 PID 1700 wrote to memory of 2012 1700 5pjdd.exe 103 PID 1700 wrote to memory of 2012 1700 5pjdd.exe 103 PID 2012 wrote to memory of 2104 2012 06822.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\df4a2f0950fd5fd0232ebafb11bc79f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\df4a2f0950fd5fd0232ebafb11bc79f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\86048.exec:\86048.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\48288.exec:\48288.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\pdpvd.exec:\pdpvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\2402840.exec:\2402840.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\6680828.exec:\6680828.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\u260640.exec:\u260640.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\nhhbtt.exec:\nhhbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\ntnhtt.exec:\ntnhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\6666840.exec:\6666840.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\ddjdv.exec:\ddjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\pddvp.exec:\pddvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\6644446.exec:\6644446.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\xrrlfxl.exec:\xrrlfxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\lrrllff.exec:\lrrllff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\llrllxx.exec:\llrllxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\008082.exec:\008082.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\bntbtn.exec:\bntbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\dvdvd.exec:\dvdvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\fxrrlxx.exec:\fxrrlxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\5pjdd.exec:\5pjdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\06822.exec:\06822.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\nhhbhh.exec:\nhhbhh.exe23⤵
- Executes dropped EXE
PID:2104 -
\??\c:\2620422.exec:\2620422.exe24⤵
- Executes dropped EXE
PID:3324 -
\??\c:\hnnbtn.exec:\hnnbtn.exe25⤵
- Executes dropped EXE
PID:4496 -
\??\c:\bbnnhn.exec:\bbnnhn.exe26⤵
- Executes dropped EXE
PID:4040 -
\??\c:\dpppv.exec:\dpppv.exe27⤵
- Executes dropped EXE
PID:4320 -
\??\c:\00066.exec:\00066.exe28⤵
- Executes dropped EXE
PID:3784 -
\??\c:\fffxflr.exec:\fffxflr.exe29⤵
- Executes dropped EXE
PID:5052 -
\??\c:\ddjjj.exec:\ddjjj.exe30⤵
- Executes dropped EXE
PID:4716 -
\??\c:\46408.exec:\46408.exe31⤵
- Executes dropped EXE
PID:2848 -
\??\c:\5tttnh.exec:\5tttnh.exe32⤵
- Executes dropped EXE
PID:1784 -
\??\c:\6000488.exec:\6000488.exe33⤵
- Executes dropped EXE
PID:1928 -
\??\c:\jvpdv.exec:\jvpdv.exe34⤵
- Executes dropped EXE
PID:4476 -
\??\c:\862206.exec:\862206.exe35⤵
- Executes dropped EXE
PID:4392 -
\??\c:\a6642.exec:\a6642.exe36⤵
- Executes dropped EXE
PID:216 -
\??\c:\ppvvj.exec:\ppvvj.exe37⤵
- Executes dropped EXE
PID:1172 -
\??\c:\hhnnnn.exec:\hhnnnn.exe38⤵
- Executes dropped EXE
PID:3724 -
\??\c:\hbhnnh.exec:\hbhnnh.exe39⤵
- Executes dropped EXE
PID:3752 -
\??\c:\408664.exec:\408664.exe40⤵
- Executes dropped EXE
PID:4368 -
\??\c:\4802288.exec:\4802288.exe41⤵
- Executes dropped EXE
PID:752 -
\??\c:\3ttbth.exec:\3ttbth.exe42⤵
- Executes dropped EXE
PID:3020 -
\??\c:\28004.exec:\28004.exe43⤵
- Executes dropped EXE
PID:4848 -
\??\c:\jddpj.exec:\jddpj.exe44⤵
- Executes dropped EXE
PID:2960 -
\??\c:\tbbbht.exec:\tbbbht.exe45⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vjpjd.exec:\vjpjd.exe46⤵
- Executes dropped EXE
PID:2192 -
\??\c:\42600.exec:\42600.exe47⤵
- Executes dropped EXE
PID:3960 -
\??\c:\lffrxlr.exec:\lffrxlr.exe48⤵
- Executes dropped EXE
PID:1676 -
\??\c:\pdvvv.exec:\pdvvv.exe49⤵
- Executes dropped EXE
PID:4536 -
\??\c:\hhtthn.exec:\hhtthn.exe50⤵
- Executes dropped EXE
PID:396 -
\??\c:\pjvpv.exec:\pjvpv.exe51⤵
- Executes dropped EXE
PID:492 -
\??\c:\tbntnn.exec:\tbntnn.exe52⤵
- Executes dropped EXE
PID:376 -
\??\c:\flffxxx.exec:\flffxxx.exe53⤵
- Executes dropped EXE
PID:4024 -
\??\c:\8860422.exec:\8860422.exe54⤵
- Executes dropped EXE
PID:1288 -
\??\c:\dpvvp.exec:\dpvvp.exe55⤵
- Executes dropped EXE
PID:3808 -
\??\c:\24004.exec:\24004.exe56⤵
- Executes dropped EXE
PID:5084 -
\??\c:\nntbbn.exec:\nntbbn.exe57⤵
- Executes dropped EXE
PID:4964 -
\??\c:\008482.exec:\008482.exe58⤵
- Executes dropped EXE
PID:4212 -
\??\c:\802040.exec:\802040.exe59⤵
- Executes dropped EXE
PID:3244 -
\??\c:\nhtnnn.exec:\nhtnnn.exe60⤵
- Executes dropped EXE
PID:3240 -
\??\c:\026446.exec:\026446.exe61⤵
- Executes dropped EXE
PID:1032 -
\??\c:\660606.exec:\660606.exe62⤵
- Executes dropped EXE
PID:2820 -
\??\c:\44480.exec:\44480.exe63⤵
- Executes dropped EXE
PID:2836 -
\??\c:\488066.exec:\488066.exe64⤵
- Executes dropped EXE
PID:2952 -
\??\c:\66466.exec:\66466.exe65⤵
- Executes dropped EXE
PID:1556 -
\??\c:\nttnnn.exec:\nttnnn.exe66⤵PID:2180
-
\??\c:\xxxxrlf.exec:\xxxxrlf.exe67⤵PID:1432
-
\??\c:\422208.exec:\422208.exe68⤵PID:2012
-
\??\c:\8866206.exec:\8866206.exe69⤵PID:1156
-
\??\c:\1hbhbh.exec:\1hbhbh.exe70⤵PID:976
-
\??\c:\fflfffx.exec:\fflfffx.exe71⤵PID:4596
-
\??\c:\2244888.exec:\2244888.exe72⤵PID:732
-
\??\c:\jpvpj.exec:\jpvpj.exe73⤵PID:3904
-
\??\c:\bbhbbh.exec:\bbhbbh.exe74⤵PID:4620
-
\??\c:\bbtntn.exec:\bbtntn.exe75⤵PID:4240
-
\??\c:\thtntb.exec:\thtntb.exe76⤵PID:3668
-
\??\c:\vjpjj.exec:\vjpjj.exe77⤵PID:4152
-
\??\c:\44648.exec:\44648.exe78⤵PID:1340
-
\??\c:\btttnn.exec:\btttnn.exe79⤵PID:3236
-
\??\c:\2248006.exec:\2248006.exe80⤵PID:4412
-
\??\c:\lrrxflf.exec:\lrrxflf.exe81⤵PID:1644
-
\??\c:\40282.exec:\40282.exe82⤵PID:4076
-
\??\c:\flfxrrf.exec:\flfxrrf.exe83⤵PID:2912
-
\??\c:\hthbtb.exec:\hthbtb.exe84⤵PID:2360
-
\??\c:\1vppp.exec:\1vppp.exe85⤵PID:3276
-
\??\c:\xrxfffl.exec:\xrxfffl.exe86⤵PID:1692
-
\??\c:\ttnhhh.exec:\ttnhhh.exe87⤵PID:1560
-
\??\c:\8244880.exec:\8244880.exe88⤵PID:4176
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe89⤵PID:2576
-
\??\c:\pdjdd.exec:\pdjdd.exe90⤵PID:2788
-
\??\c:\20822.exec:\20822.exe91⤵PID:448
-
\??\c:\xfrrlfx.exec:\xfrrlfx.exe92⤵PID:2980
-
\??\c:\ttnbbh.exec:\ttnbbh.exe93⤵PID:1792
-
\??\c:\688822.exec:\688822.exe94⤵PID:5060
-
\??\c:\622004.exec:\622004.exe95⤵PID:3476
-
\??\c:\vdjpv.exec:\vdjpv.exe96⤵PID:2988
-
\??\c:\4844888.exec:\4844888.exe97⤵PID:3632
-
\??\c:\682664.exec:\682664.exe98⤵PID:2928
-
\??\c:\602422.exec:\602422.exe99⤵PID:5064
-
\??\c:\bbtnhh.exec:\bbtnhh.exe100⤵PID:1736
-
\??\c:\q28622.exec:\q28622.exe101⤵PID:4024
-
\??\c:\66222.exec:\66222.exe102⤵PID:2396
-
\??\c:\04846.exec:\04846.exe103⤵PID:2244
-
\??\c:\tnbbbn.exec:\tnbbbn.exe104⤵PID:4940
-
\??\c:\42860.exec:\42860.exe105⤵PID:4708
-
\??\c:\jvvvp.exec:\jvvvp.exe106⤵PID:4788
-
\??\c:\frrlffx.exec:\frrlffx.exe107⤵PID:4872
-
\??\c:\80282.exec:\80282.exe108⤵PID:2800
-
\??\c:\6640600.exec:\6640600.exe109⤵PID:1732
-
\??\c:\3xrxxxr.exec:\3xrxxxr.exe110⤵PID:4196
-
\??\c:\jppvd.exec:\jppvd.exe111⤵PID:2952
-
\??\c:\llllfrr.exec:\llllfrr.exe112⤵PID:4616
-
\??\c:\llffrxf.exec:\llffrxf.exe113⤵PID:1996
-
\??\c:\tthbbb.exec:\tthbbb.exe114⤵PID:4988
-
\??\c:\84400.exec:\84400.exe115⤵PID:2208
-
\??\c:\frrlffx.exec:\frrlffx.exe116⤵PID:4408
-
\??\c:\hnbthb.exec:\hnbthb.exe117⤵PID:4040
-
\??\c:\u442648.exec:\u442648.exe118⤵PID:3088
-
\??\c:\4260480.exec:\4260480.exe119⤵PID:384
-
\??\c:\64268.exec:\64268.exe120⤵PID:3408
-
\??\c:\tttnhb.exec:\tttnhb.exe121⤵PID:1340
-
\??\c:\llxrffx.exec:\llxrffx.exe122⤵PID:2432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-