Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 11:28
Behavioral task
behavioral1
Sample
d1f2b8c9619e089fa381d9814276b500_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
d1f2b8c9619e089fa381d9814276b500_NeikiAnalytics.exe
-
Size
495KB
-
MD5
d1f2b8c9619e089fa381d9814276b500
-
SHA1
d6175e6323ddef12f6b4fec0f2d341dd083f1162
-
SHA256
dafbdb5a5a4bc6459add8098972d18f2a96020088e7c953dfc6270145016cedb
-
SHA512
e7b99866b7b41a7fe14f95481b0046f9c83c635fb2602f6bb1f5c46b3f0711c60384fe14213706e68bda84c5b04b4da6797356826a3a3308314347109d11df1e
-
SSDEEP
12288:S4wFHoSyoS3ebeFmFVvlrmwcT4wpteFmFTxP:0KFmFVtrRcFEFmFV
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/2196-8-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2956-17-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2700-30-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2660-39-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2752-51-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2636-53-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2636-60-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2876-71-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1524-80-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1524-79-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2592-93-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1184-171-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2484-225-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1292-318-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1596-340-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2920-362-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2552-369-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2472-411-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1252-438-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/760-483-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2720-499-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2476-514-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/944-534-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1980-580-0x00000000772B0000-0x00000000773CF000-memory.dmp family_blackmoon behavioral1/memory/1980-581-0x00000000773D0000-0x00000000774CA000-memory.dmp family_blackmoon behavioral1/memory/1740-605-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1048-535-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1048-542-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1076-521-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1076-520-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1852-506-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2720-494-0x0000000000220000-0x00000000002A4000-memory.dmp family_blackmoon behavioral1/memory/2720-491-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1476-490-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1308-476-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1996-463-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/288-437-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1664-430-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2020-404-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2528-397-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2876-390-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2692-383-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2408-376-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2664-355-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2288-347-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1596-334-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2112-332-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/3048-325-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/376-308-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2152-298-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2200-289-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2200-283-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/900-279-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/340-269-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1908-260-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1328-251-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1140-241-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2484-232-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2116-222-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/584-212-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/664-203-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2260-186-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1184-177-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2736-167-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2956 3jddp.exe 2700 llfxllx.exe 2660 ffrrllx.exe 2752 hhbntb.exe 2636 9frrflf.exe 2876 hhhhtb.exe 1524 pjvpd.exe 2592 llfrffr.exe 3004 hhtbhn.exe 2856 ppjpp.exe 2976 5rfxfll.exe 548 7jdpj.exe 1716 fxffllr.exe 1752 vpvvd.exe 800 1rxfflx.exe 2736 tthnnt.exe 1184 1pjpp.exe 2260 nhbbht.exe 2916 xrxflll.exe 664 btnbhn.exe 584 dvvdp.exe 2116 fflxlrf.exe 2484 nhtnhh.exe 1140 llxfrfl.exe 1328 tnbnbh.exe 1908 3djpv.exe 340 bnhtbb.exe 900 5dpdv.exe 2200 lxrrffr.exe 2152 pjvvj.exe 376 3lxxxfl.exe 1292 thtnnn.exe 3048 xlffxlx.exe 2112 nbhnbb.exe 1596 vpdjv.exe 2288 lxxxfxl.exe 2664 hthttn.exe 2920 3jjpv.exe 2552 ttnhnb.exe 2408 djddp.exe 2692 xrxrrrx.exe 2876 9dvvv.exe 2528 1lfrxxl.exe 2020 hhtthn.exe 2472 xxllrrx.exe 2856 hbbhtt.exe 1748 rfxfllx.exe 1664 9nnbtb.exe 288 vpvdv.exe 1252 nnhnbh.exe 3016 5dvjv.exe 2556 lfrxlfr.exe 1996 fxllrxf.exe 1964 nnhtth.exe 1308 pvdvp.exe 760 7lxxflx.exe 1476 hbnhtt.exe 2720 7vjpv.exe 1852 pppdp.exe 2476 fxrfllx.exe 1076 nhhnbh.exe 1640 3jdjv.exe 944 xxrfrxr.exe 1048 tnhhnt.exe -
resource yara_rule behavioral1/memory/2196-0-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x001000000001226b-6.dat upx behavioral1/memory/2956-11-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2196-8-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2956-17-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0035000000015c7f-19.dat upx behavioral1/memory/2700-21-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2700-24-0x0000000000310000-0x0000000000394000-memory.dmp upx behavioral1/memory/2700-30-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0008000000015cc7-27.dat upx behavioral1/memory/2660-33-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2752-43-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0007000000015ccf-41.dat upx behavioral1/memory/2660-39-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2752-48-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2752-49-0x0000000000320000-0x00000000003A4000-memory.dmp upx behavioral1/memory/2752-51-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0007000000015ce3-50.dat upx behavioral1/memory/2636-53-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0007000000015cf0-63.dat upx behavioral1/memory/2876-62-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2636-60-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2636-59-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0007000000015d02-68.dat upx behavioral1/memory/2876-71-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1524-74-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2876-70-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0008000000015d19-83.dat upx behavioral1/memory/2592-82-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1524-80-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x000800000001663f-94.dat upx behavioral1/memory/3004-96-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2592-93-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0035000000015c93-104.dat upx behavioral1/files/0x000600000001686d-112.dat upx behavioral1/memory/2976-114-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/548-124-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000016c56-133.dat upx behavioral1/files/0x0006000000016c71-142.dat upx behavioral1/files/0x0006000000016c7a-151.dat upx behavioral1/files/0x0006000000016cc3-160.dat upx behavioral1/memory/1184-171-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000016d2c-188.dat upx behavioral1/files/0x0006000000016d3d-205.dat upx behavioral1/files/0x0006000000016d4e-223.dat upx behavioral1/memory/2484-225-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000016d61-234.dat upx behavioral1/memory/1328-245-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000016d71-262.dat upx behavioral1/files/0x0006000000016dde-281.dat upx behavioral1/files/0x0006000000016de7-291.dat upx behavioral1/memory/1292-318-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1596-340-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2920-362-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2552-369-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2472-411-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1252-438-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/760-483-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2720-499-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2476-514-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/944-534-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1980-580-0x00000000772B0000-0x00000000773CF000-memory.dmp upx behavioral1/memory/1588-593-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1048-535-0x0000000000400000-0x0000000000484000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2956 2196 d1f2b8c9619e089fa381d9814276b500_NeikiAnalytics.exe 28 PID 2196 wrote to memory of 2956 2196 d1f2b8c9619e089fa381d9814276b500_NeikiAnalytics.exe 28 PID 2196 wrote to memory of 2956 2196 d1f2b8c9619e089fa381d9814276b500_NeikiAnalytics.exe 28 PID 2196 wrote to memory of 2956 2196 d1f2b8c9619e089fa381d9814276b500_NeikiAnalytics.exe 28 PID 2956 wrote to memory of 2700 2956 3jddp.exe 29 PID 2956 wrote to memory of 2700 2956 3jddp.exe 29 PID 2956 wrote to memory of 2700 2956 3jddp.exe 29 PID 2956 wrote to memory of 2700 2956 3jddp.exe 29 PID 2700 wrote to memory of 2660 2700 llfxllx.exe 30 PID 2700 wrote to memory of 2660 2700 llfxllx.exe 30 PID 2700 wrote to memory of 2660 2700 llfxllx.exe 30 PID 2700 wrote to memory of 2660 2700 llfxllx.exe 30 PID 2660 wrote to memory of 2752 2660 ffrrllx.exe 31 PID 2660 wrote to memory of 2752 2660 ffrrllx.exe 31 PID 2660 wrote to memory of 2752 2660 ffrrllx.exe 31 PID 2660 wrote to memory of 2752 2660 ffrrllx.exe 31 PID 2752 wrote to memory of 2636 2752 hhbntb.exe 32 PID 2752 wrote to memory of 2636 2752 hhbntb.exe 32 PID 2752 wrote to memory of 2636 2752 hhbntb.exe 32 PID 2752 wrote to memory of 2636 2752 hhbntb.exe 32 PID 2636 wrote to memory of 2876 2636 9frrflf.exe 69 PID 2636 wrote to memory of 2876 2636 9frrflf.exe 69 PID 2636 wrote to memory of 2876 2636 9frrflf.exe 69 PID 2636 wrote to memory of 2876 2636 9frrflf.exe 69 PID 2876 wrote to memory of 1524 2876 hhhhtb.exe 34 PID 2876 wrote to memory of 1524 2876 hhhhtb.exe 34 PID 2876 wrote to memory of 1524 2876 hhhhtb.exe 34 PID 2876 wrote to memory of 1524 2876 hhhhtb.exe 34 PID 1524 wrote to memory of 2592 1524 pjvpd.exe 35 PID 1524 wrote to memory of 2592 1524 pjvpd.exe 35 PID 1524 wrote to memory of 2592 1524 pjvpd.exe 35 PID 1524 wrote to memory of 2592 1524 pjvpd.exe 35 PID 2592 wrote to memory of 3004 2592 llfrffr.exe 36 PID 2592 wrote to memory of 3004 2592 llfrffr.exe 36 PID 2592 wrote to memory of 3004 2592 llfrffr.exe 36 PID 2592 wrote to memory of 3004 2592 llfrffr.exe 36 PID 3004 wrote to memory of 2856 3004 hhtbhn.exe 73 PID 3004 wrote to memory of 2856 3004 hhtbhn.exe 73 PID 3004 wrote to memory of 2856 3004 hhtbhn.exe 73 PID 3004 wrote to memory of 2856 3004 hhtbhn.exe 73 PID 2856 wrote to memory of 2976 2856 ppjpp.exe 38 PID 2856 wrote to memory of 2976 2856 ppjpp.exe 38 PID 2856 wrote to memory of 2976 2856 ppjpp.exe 38 PID 2856 wrote to memory of 2976 2856 ppjpp.exe 38 PID 2976 wrote to memory of 548 2976 5rfxfll.exe 39 PID 2976 wrote to memory of 548 2976 5rfxfll.exe 39 PID 2976 wrote to memory of 548 2976 5rfxfll.exe 39 PID 2976 wrote to memory of 548 2976 5rfxfll.exe 39 PID 548 wrote to memory of 1716 548 7jdpj.exe 40 PID 548 wrote to memory of 1716 548 7jdpj.exe 40 PID 548 wrote to memory of 1716 548 7jdpj.exe 40 PID 548 wrote to memory of 1716 548 7jdpj.exe 40 PID 1716 wrote to memory of 1752 1716 fxffllr.exe 41 PID 1716 wrote to memory of 1752 1716 fxffllr.exe 41 PID 1716 wrote to memory of 1752 1716 fxffllr.exe 41 PID 1716 wrote to memory of 1752 1716 fxffllr.exe 41 PID 1752 wrote to memory of 800 1752 vpvvd.exe 42 PID 1752 wrote to memory of 800 1752 vpvvd.exe 42 PID 1752 wrote to memory of 800 1752 vpvvd.exe 42 PID 1752 wrote to memory of 800 1752 vpvvd.exe 42 PID 800 wrote to memory of 2736 800 1rxfflx.exe 43 PID 800 wrote to memory of 2736 800 1rxfflx.exe 43 PID 800 wrote to memory of 2736 800 1rxfflx.exe 43 PID 800 wrote to memory of 2736 800 1rxfflx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1f2b8c9619e089fa381d9814276b500_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d1f2b8c9619e089fa381d9814276b500_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\3jddp.exec:\3jddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\llfxllx.exec:\llfxllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\ffrrllx.exec:\ffrrllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\hhbntb.exec:\hhbntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\9frrflf.exec:\9frrflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\hhhhtb.exec:\hhhhtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\pjvpd.exec:\pjvpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\llfrffr.exec:\llfrffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\hhtbhn.exec:\hhtbhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\ppjpp.exec:\ppjpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\5rfxfll.exec:\5rfxfll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\7jdpj.exec:\7jdpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\fxffllr.exec:\fxffllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\vpvvd.exec:\vpvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\1rxfflx.exec:\1rxfflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\tthnnt.exec:\tthnnt.exe17⤵
- Executes dropped EXE
PID:2736 -
\??\c:\1pjpp.exec:\1pjpp.exe18⤵
- Executes dropped EXE
PID:1184 -
\??\c:\nhbbht.exec:\nhbbht.exe19⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xrxflll.exec:\xrxflll.exe20⤵
- Executes dropped EXE
PID:2916 -
\??\c:\btnbhn.exec:\btnbhn.exe21⤵
- Executes dropped EXE
PID:664 -
\??\c:\dvvdp.exec:\dvvdp.exe22⤵
- Executes dropped EXE
PID:584 -
\??\c:\fflxlrf.exec:\fflxlrf.exe23⤵
- Executes dropped EXE
PID:2116 -
\??\c:\nhtnhh.exec:\nhtnhh.exe24⤵
- Executes dropped EXE
PID:2484 -
\??\c:\llxfrfl.exec:\llxfrfl.exe25⤵
- Executes dropped EXE
PID:1140 -
\??\c:\tnbnbh.exec:\tnbnbh.exe26⤵
- Executes dropped EXE
PID:1328 -
\??\c:\3djpv.exec:\3djpv.exe27⤵
- Executes dropped EXE
PID:1908 -
\??\c:\bnhtbb.exec:\bnhtbb.exe28⤵
- Executes dropped EXE
PID:340 -
\??\c:\5dpdv.exec:\5dpdv.exe29⤵
- Executes dropped EXE
PID:900 -
\??\c:\lxrrffr.exec:\lxrrffr.exe30⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pjvvj.exec:\pjvvj.exe31⤵
- Executes dropped EXE
PID:2152 -
\??\c:\3lxxxfl.exec:\3lxxxfl.exe32⤵
- Executes dropped EXE
PID:376 -
\??\c:\thtnnn.exec:\thtnnn.exe33⤵
- Executes dropped EXE
PID:1292 -
\??\c:\xlffxlx.exec:\xlffxlx.exe34⤵
- Executes dropped EXE
PID:3048 -
\??\c:\nbhnbb.exec:\nbhnbb.exe35⤵
- Executes dropped EXE
PID:2112 -
\??\c:\vpdjv.exec:\vpdjv.exe36⤵
- Executes dropped EXE
PID:1596 -
\??\c:\lxxxfxl.exec:\lxxxfxl.exe37⤵
- Executes dropped EXE
PID:2288 -
\??\c:\hthttn.exec:\hthttn.exe38⤵
- Executes dropped EXE
PID:2664 -
\??\c:\3jjpv.exec:\3jjpv.exe39⤵
- Executes dropped EXE
PID:2920 -
\??\c:\ttnhnb.exec:\ttnhnb.exe40⤵
- Executes dropped EXE
PID:2552 -
\??\c:\djddp.exec:\djddp.exe41⤵
- Executes dropped EXE
PID:2408 -
\??\c:\xrxrrrx.exec:\xrxrrrx.exe42⤵
- Executes dropped EXE
PID:2692 -
\??\c:\9dvvv.exec:\9dvvv.exe43⤵
- Executes dropped EXE
PID:2876 -
\??\c:\1lfrxxl.exec:\1lfrxxl.exe44⤵
- Executes dropped EXE
PID:2528 -
\??\c:\hhtthn.exec:\hhtthn.exe45⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xxllrrx.exec:\xxllrrx.exe46⤵
- Executes dropped EXE
PID:2472 -
\??\c:\hbbhtt.exec:\hbbhtt.exe47⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rfxfllx.exec:\rfxfllx.exe48⤵
- Executes dropped EXE
PID:1748 -
\??\c:\9nnbtb.exec:\9nnbtb.exe49⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vpvdv.exec:\vpvdv.exe50⤵
- Executes dropped EXE
PID:288 -
\??\c:\nnhnbh.exec:\nnhnbh.exe51⤵
- Executes dropped EXE
PID:1252 -
\??\c:\5dvjv.exec:\5dvjv.exe52⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lfrxlfr.exec:\lfrxlfr.exe53⤵
- Executes dropped EXE
PID:2556 -
\??\c:\fxllrxf.exec:\fxllrxf.exe54⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nnhtth.exec:\nnhtth.exe55⤵
- Executes dropped EXE
PID:1964 -
\??\c:\pvdvp.exec:\pvdvp.exe56⤵
- Executes dropped EXE
PID:1308 -
\??\c:\7lxxflx.exec:\7lxxflx.exe57⤵
- Executes dropped EXE
PID:760 -
\??\c:\hbnhtt.exec:\hbnhtt.exe58⤵
- Executes dropped EXE
PID:1476 -
\??\c:\7vjpv.exec:\7vjpv.exe59⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pppdp.exec:\pppdp.exe60⤵
- Executes dropped EXE
PID:1852 -
\??\c:\fxrfllx.exec:\fxrfllx.exe61⤵
- Executes dropped EXE
PID:2476 -
\??\c:\nhhnbh.exec:\nhhnbh.exe62⤵
- Executes dropped EXE
PID:1076 -
\??\c:\3jdjv.exec:\3jdjv.exe63⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xxrfrxr.exec:\xxrfrxr.exe64⤵
- Executes dropped EXE
PID:944 -
\??\c:\tnhhnt.exec:\tnhhnt.exe65⤵
- Executes dropped EXE
PID:1048 -
\??\c:\ppdvd.exec:\ppdvd.exe66⤵PID:2060
-
\??\c:\ppdjp.exec:\ppdjp.exe67⤵PID:2068
-
\??\c:\rllxxlr.exec:\rllxxlr.exe68⤵PID:1028
-
\??\c:\thhbbb.exec:\thhbbb.exe69⤵PID:1992
-
\??\c:\vpjvd.exec:\vpjvd.exe70⤵PID:888
-
\??\c:\lxllxxl.exec:\lxllxxl.exe71⤵PID:320
-
\??\c:\3bthtb.exec:\3bthtb.exe72⤵PID:1980
-
\??\c:\5pdpp.exec:\5pdpp.exe73⤵PID:2960
-
\??\c:\fxxfrfx.exec:\fxxfrfx.exe74⤵PID:1588
-
\??\c:\nnhtbn.exec:\nnhtbn.exe75⤵PID:2240
-
\??\c:\hhbhbb.exec:\hhbhbb.exe76⤵PID:1740
-
\??\c:\fxllxlr.exec:\fxllxlr.exe77⤵PID:2676
-
\??\c:\bnhhhh.exec:\bnhhhh.exe78⤵PID:2552
-
\??\c:\btntbb.exec:\btntbb.exe79⤵PID:2808
-
\??\c:\ppjvp.exec:\ppjvp.exe80⤵PID:2544
-
\??\c:\rrlxllx.exec:\rrlxllx.exe81⤵PID:2708
-
\??\c:\thtnht.exec:\thtnht.exe82⤵PID:2528
-
\??\c:\jdppv.exec:\jdppv.exe83⤵PID:2640
-
\??\c:\xxrlfrf.exec:\xxrlfrf.exe84⤵PID:3004
-
\??\c:\hbnnbb.exec:\hbnnbb.exe85⤵PID:2988
-
\??\c:\vdpvd.exec:\vdpvd.exe86⤵PID:1988
-
\??\c:\xrlxllf.exec:\xrlxllf.exe87⤵PID:2276
-
\??\c:\5thhnt.exec:\5thhnt.exe88⤵PID:2980
-
\??\c:\7jdpd.exec:\7jdpd.exe89⤵PID:2832
-
\??\c:\dvjvv.exec:\dvjvv.exe90⤵PID:2404
-
\??\c:\9rrxlxl.exec:\9rrxlxl.exe91⤵PID:1900
-
\??\c:\jpdpp.exec:\jpdpp.exe92⤵PID:1548
-
\??\c:\fxrxflx.exec:\fxrxflx.exe93⤵PID:2316
-
\??\c:\ddvvj.exec:\ddvvj.exe94⤵PID:3020
-
\??\c:\5xfrrfl.exec:\5xfrrfl.exe95⤵PID:2320
-
\??\c:\hhbntt.exec:\hhbntt.exe96⤵PID:1768
-
\??\c:\ddvvj.exec:\ddvvj.exe97⤵PID:2104
-
\??\c:\1rlxllx.exec:\1rlxllx.exe98⤵PID:1792
-
\??\c:\tnhhtt.exec:\tnhhtt.exe99⤵PID:2400
-
\??\c:\7pdpv.exec:\7pdpv.exe100⤵PID:652
-
\??\c:\7thhtn.exec:\7thhtn.exe101⤵PID:2204
-
\??\c:\vvpdp.exec:\vvpdp.exe102⤵PID:692
-
\??\c:\ddpvj.exec:\ddpvj.exe103⤵PID:1812
-
\??\c:\btnthh.exec:\btnthh.exe104⤵PID:1132
-
\??\c:\bthhnn.exec:\bthhnn.exe105⤵PID:2268
-
\??\c:\jdpvd.exec:\jdpvd.exe106⤵PID:1044
-
\??\c:\xlrxllf.exec:\xlrxllf.exe107⤵PID:1352
-
\??\c:\tthntt.exec:\tthntt.exe108⤵PID:2396
-
\??\c:\vpvdv.exec:\vpvdv.exe109⤵PID:1048
-
\??\c:\lrflrrf.exec:\lrflrrf.exe110⤵PID:2264
-
\??\c:\bthnnt.exec:\bthnnt.exe111⤵PID:2924
-
\??\c:\vjdjv.exec:\vjdjv.exe112⤵PID:2228
-
\??\c:\rrlxrlx.exec:\rrlxrlx.exe113⤵PID:2212
-
\??\c:\1lfflxl.exec:\1lfflxl.exe114⤵PID:2252
-
\??\c:\nhhhtb.exec:\nhhhtb.exe115⤵PID:1556
-
\??\c:\dvdvj.exec:\dvdvj.exe116⤵PID:1360
-
\??\c:\xrfrffl.exec:\xrfrffl.exe117⤵PID:2448
-
\??\c:\lxrffxl.exec:\lxrffxl.exe118⤵PID:2112
-
\??\c:\btnbhn.exec:\btnbhn.exe119⤵PID:1588
-
\??\c:\pjjpd.exec:\pjjpd.exe120⤵PID:1776
-
\??\c:\7rfrxfx.exec:\7rfrxfx.exe121⤵PID:2076
-
\??\c:\ttthtb.exec:\ttthtb.exe122⤵PID:2660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-