Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 23:21
Behavioral task
behavioral1
Sample
21a6af3e0b390f5f081eb0aa813afad0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
21a6af3e0b390f5f081eb0aa813afad0_NeikiAnalytics.exe
-
Size
338KB
-
MD5
21a6af3e0b390f5f081eb0aa813afad0
-
SHA1
1d4efdbcd21a705a6b9d4acf70f8c9d645f9624f
-
SHA256
d49149d599777b22ccec073e1bc1ecf6da0998267915d247da5000f2324a9de3
-
SHA512
fadb133ecbe773279f5db416d0071bfb8c692df3950059460c66514f3c68a5836227cd9efb964141b20d80e9ac2fa73531c9de84a8fe4324240acadf3da7b263
-
SSDEEP
6144:Kcm4FmowdHoSKAszBd+aQz0192lTk1ycUkpCnAUo0Leu2tZGnOiQ3jiDQIZbdVnU:U4wFHoSK1zBjA892lY196AUo0LX2tZqi
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
Processes:
resource yara_rule behavioral1/memory/2724-10-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2484-20-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2524-32-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2592-30-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2648-41-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1660-59-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2388-68-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2136-89-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2436-105-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1252-116-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2352-141-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2312-143-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1760-218-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1680-286-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/908-299-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1540-312-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2496-313-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2812-369-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1940-376-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2668-389-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2384-350-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1012-253-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/108-233-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1080-209-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/688-207-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1252-124-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2716-107-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2512-76-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2352-432-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3020-448-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/1144-483-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/688-490-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1852-534-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2632-598-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2632-605-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1056-740-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/3064-754-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/544-779-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1420-805-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2256-1090-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/3012-1113-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2148-1337-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \??\c:\1xrxlfl.exe family_berbew \??\c:\nhthtn.exe family_berbew \??\c:\hhtthh.exe family_berbew \??\c:\hbnnbt.exe family_berbew C:\ffllxlr.exe family_berbew \??\c:\vvpvd.exe family_berbew C:\hhthnt.exe family_berbew \??\c:\dpvvd.exe family_berbew C:\3lrxlrr.exe family_berbew \??\c:\hbhhnn.exe family_berbew C:\5pdjv.exe family_berbew C:\1llxxrr.exe family_berbew C:\pjdvj.exe family_berbew \??\c:\dddjv.exe family_berbew \??\c:\flflxxf.exe family_berbew \??\c:\pjdpv.exe family_berbew C:\lrrxrxx.exe family_berbew \??\c:\nnhthn.exe family_berbew \??\c:\vpvjp.exe family_berbew \??\c:\fffllff.exe family_berbew \??\c:\1ppvd.exe family_berbew C:\flflfxl.exe family_berbew C:\1nbbbh.exe family_berbew C:\1bhhnt.exe family_berbew C:\ddvpj.exe family_berbew C:\xrxfrrf.exe family_berbew \??\c:\hnhbth.exe family_berbew \??\c:\3xfrfxx.exe family_berbew \??\c:\pvvjp.exe family_berbew \??\c:\ntbtbn.exe family_berbew \??\c:\1nnbtb.exe family_berbew \??\c:\bbthth.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
1xrxlfl.exenhthtn.exehhtthh.exehbnnbt.exevvpvd.exeffllxlr.exehhthnt.exedpvvd.exe3lrxlrr.exehbhhnn.exe5pdjv.exe1llxxrr.exebbthth.exepjdvj.exedddjv.exeflflxxf.exepjdpv.exelrrxrxx.exe1nnbtb.exennhthn.exevpvjp.exefffllff.exentbtbn.exe1ppvd.exeflflfxl.exe1nbbbh.exepvvjp.exe3xfrfxx.exe1bhhnt.exehnhbth.exeddvpj.exexrxfrrf.exetnbnbt.exejjdvj.exerxlxlfr.exettnbnn.exehthbtn.exejpdvp.exe9rlrxxf.exe5rrxrff.exe1hhbht.exetttttb.exedvjvj.exefxlxffl.exe3xrxflx.exebbhntb.exe7dppd.exedvdvj.exe1lxrrrr.exe9nhntn.exehnbnbb.exefrfrxfr.exe9hbhnh.exevpjdv.exexrflrxf.exenhtbhn.exevjvvd.exefxllrxf.exe3dpdv.exerlrxfll.exerrrffrl.exetbbnht.exevdppj.exerfrflxf.exepid process 2484 1xrxlfl.exe 2592 nhthtn.exe 2524 hhtthh.exe 2648 hbnnbt.exe 1660 vvpvd.exe 2388 ffllxlr.exe 2512 hhthnt.exe 3036 dpvvd.exe 2136 3lrxlrr.exe 2436 hbhhnn.exe 2716 5pdjv.exe 1252 1llxxrr.exe 1948 bbthth.exe 2352 pjdvj.exe 2312 dddjv.exe 2292 flflxxf.exe 1468 pjdpv.exe 2028 lrrxrxx.exe 3064 1nnbtb.exe 2372 nnhthn.exe 2332 vpvjp.exe 688 fffllff.exe 1080 ntbtbn.exe 1760 1ppvd.exe 108 flflfxl.exe 2176 1nbbbh.exe 2968 pvvjp.exe 1012 3xfrfxx.exe 800 1bhhnt.exe 2720 hnhbth.exe 628 ddvpj.exe 1680 xrxfrrf.exe 908 tnbnbt.exe 1628 jjdvj.exe 1540 rxlxlfr.exe 2496 ttnbnn.exe 2548 hthbtn.exe 2536 jpdvp.exe 2664 9rlrxxf.exe 2544 5rrxrff.exe 2648 1hhbht.exe 2384 tttttb.exe 872 dvjvj.exe 2812 fxlxffl.exe 2816 3xrxflx.exe 1940 bbhntb.exe 1568 7dppd.exe 2668 dvdvj.exe 2320 1lxrrrr.exe 1732 9nhntn.exe 276 hnbnbb.exe 2308 frfrxfr.exe 1948 9hbhnh.exe 2352 vpjdv.exe 2704 xrflrxf.exe 2856 nhtbhn.exe 3020 vjvvd.exe 2088 fxllrxf.exe 1380 3dpdv.exe 1696 rlrxfll.exe 2080 rrrffrl.exe 2372 tbbnht.exe 1144 vdppj.exe 688 rfrflxf.exe -
Processes:
resource yara_rule behavioral1/memory/2724-0-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2724-10-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2484-12-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\1xrxlfl.exe upx \??\c:\nhthtn.exe upx behavioral1/memory/2592-21-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2484-20-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2524-32-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\hhtthh.exe upx behavioral1/memory/2592-30-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2648-41-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\hbnnbt.exe upx behavioral1/memory/1660-59-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\ffllxlr.exe upx \??\c:\vvpvd.exe upx behavioral1/memory/2388-68-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\hhthnt.exe upx behavioral1/memory/1660-49-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\dpvvd.exe upx behavioral1/memory/3036-79-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\3lrxlrr.exe upx behavioral1/memory/2136-89-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\hbhhnn.exe upx C:\5pdjv.exe upx behavioral1/memory/2436-105-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\1llxxrr.exe upx behavioral1/memory/1252-116-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\pjdvj.exe upx behavioral1/memory/2352-141-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2312-143-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\dddjv.exe upx \??\c:\flflxxf.exe upx \??\c:\pjdpv.exe upx C:\lrrxrxx.exe upx \??\c:\nnhthn.exe upx \??\c:\vpvjp.exe upx \??\c:\fffllff.exe upx \??\c:\1ppvd.exe upx behavioral1/memory/1760-218-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\flflfxl.exe upx C:\1nbbbh.exe upx C:\1bhhnt.exe upx C:\ddvpj.exe upx C:\xrxfrrf.exe upx behavioral1/memory/1680-286-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/908-299-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1540-312-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2496-313-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2812-369-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1940-376-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2668-389-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2384-350-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\hnhbth.exe upx behavioral1/memory/1012-253-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\3xfrfxx.exe upx \??\c:\pvvjp.exe upx behavioral1/memory/108-233-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1080-209-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\ntbtbn.exe upx behavioral1/memory/688-207-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\1nnbtb.exe upx \??\c:\bbthth.exe upx behavioral1/memory/1252-124-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2716-107-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
21a6af3e0b390f5f081eb0aa813afad0_NeikiAnalytics.exe1xrxlfl.exenhthtn.exehhtthh.exehbnnbt.exevvpvd.exeffllxlr.exehhthnt.exedpvvd.exe3lrxlrr.exehbhhnn.exe5pdjv.exe1llxxrr.exebbthth.exepjdvj.exedddjv.exedescription pid process target process PID 2724 wrote to memory of 2484 2724 21a6af3e0b390f5f081eb0aa813afad0_NeikiAnalytics.exe 1xrxlfl.exe PID 2724 wrote to memory of 2484 2724 21a6af3e0b390f5f081eb0aa813afad0_NeikiAnalytics.exe 1xrxlfl.exe PID 2724 wrote to memory of 2484 2724 21a6af3e0b390f5f081eb0aa813afad0_NeikiAnalytics.exe 1xrxlfl.exe PID 2724 wrote to memory of 2484 2724 21a6af3e0b390f5f081eb0aa813afad0_NeikiAnalytics.exe 1xrxlfl.exe PID 2484 wrote to memory of 2592 2484 1xrxlfl.exe nhthtn.exe PID 2484 wrote to memory of 2592 2484 1xrxlfl.exe nhthtn.exe PID 2484 wrote to memory of 2592 2484 1xrxlfl.exe nhthtn.exe PID 2484 wrote to memory of 2592 2484 1xrxlfl.exe nhthtn.exe PID 2592 wrote to memory of 2524 2592 nhthtn.exe hhtthh.exe PID 2592 wrote to memory of 2524 2592 nhthtn.exe hhtthh.exe PID 2592 wrote to memory of 2524 2592 nhthtn.exe hhtthh.exe PID 2592 wrote to memory of 2524 2592 nhthtn.exe hhtthh.exe PID 2524 wrote to memory of 2648 2524 hhtthh.exe 1hhbht.exe PID 2524 wrote to memory of 2648 2524 hhtthh.exe 1hhbht.exe PID 2524 wrote to memory of 2648 2524 hhtthh.exe 1hhbht.exe PID 2524 wrote to memory of 2648 2524 hhtthh.exe 1hhbht.exe PID 2648 wrote to memory of 1660 2648 hbnnbt.exe vvpvd.exe PID 2648 wrote to memory of 1660 2648 hbnnbt.exe vvpvd.exe PID 2648 wrote to memory of 1660 2648 hbnnbt.exe vvpvd.exe PID 2648 wrote to memory of 1660 2648 hbnnbt.exe vvpvd.exe PID 1660 wrote to memory of 2388 1660 vvpvd.exe ffllxlr.exe PID 1660 wrote to memory of 2388 1660 vvpvd.exe ffllxlr.exe PID 1660 wrote to memory of 2388 1660 vvpvd.exe ffllxlr.exe PID 1660 wrote to memory of 2388 1660 vvpvd.exe ffllxlr.exe PID 2388 wrote to memory of 2512 2388 ffllxlr.exe hhthnt.exe PID 2388 wrote to memory of 2512 2388 ffllxlr.exe hhthnt.exe PID 2388 wrote to memory of 2512 2388 ffllxlr.exe hhthnt.exe PID 2388 wrote to memory of 2512 2388 ffllxlr.exe hhthnt.exe PID 2512 wrote to memory of 3036 2512 hhthnt.exe dpvvd.exe PID 2512 wrote to memory of 3036 2512 hhthnt.exe dpvvd.exe PID 2512 wrote to memory of 3036 2512 hhthnt.exe dpvvd.exe PID 2512 wrote to memory of 3036 2512 hhthnt.exe dpvvd.exe PID 3036 wrote to memory of 2136 3036 dpvvd.exe 3lrxlrr.exe PID 3036 wrote to memory of 2136 3036 dpvvd.exe 3lrxlrr.exe PID 3036 wrote to memory of 2136 3036 dpvvd.exe 3lrxlrr.exe PID 3036 wrote to memory of 2136 3036 dpvvd.exe 3lrxlrr.exe PID 2136 wrote to memory of 2436 2136 3lrxlrr.exe hbhhnn.exe PID 2136 wrote to memory of 2436 2136 3lrxlrr.exe hbhhnn.exe PID 2136 wrote to memory of 2436 2136 3lrxlrr.exe hbhhnn.exe PID 2136 wrote to memory of 2436 2136 3lrxlrr.exe hbhhnn.exe PID 2436 wrote to memory of 2716 2436 hbhhnn.exe 5pdjv.exe PID 2436 wrote to memory of 2716 2436 hbhhnn.exe 5pdjv.exe PID 2436 wrote to memory of 2716 2436 hbhhnn.exe 5pdjv.exe PID 2436 wrote to memory of 2716 2436 hbhhnn.exe 5pdjv.exe PID 2716 wrote to memory of 1252 2716 5pdjv.exe 1llxxrr.exe PID 2716 wrote to memory of 1252 2716 5pdjv.exe 1llxxrr.exe PID 2716 wrote to memory of 1252 2716 5pdjv.exe 1llxxrr.exe PID 2716 wrote to memory of 1252 2716 5pdjv.exe 1llxxrr.exe PID 1252 wrote to memory of 1948 1252 1llxxrr.exe 9hbhnh.exe PID 1252 wrote to memory of 1948 1252 1llxxrr.exe 9hbhnh.exe PID 1252 wrote to memory of 1948 1252 1llxxrr.exe 9hbhnh.exe PID 1252 wrote to memory of 1948 1252 1llxxrr.exe 9hbhnh.exe PID 1948 wrote to memory of 2352 1948 bbthth.exe pjdvj.exe PID 1948 wrote to memory of 2352 1948 bbthth.exe pjdvj.exe PID 1948 wrote to memory of 2352 1948 bbthth.exe pjdvj.exe PID 1948 wrote to memory of 2352 1948 bbthth.exe pjdvj.exe PID 2352 wrote to memory of 2312 2352 pjdvj.exe dddjv.exe PID 2352 wrote to memory of 2312 2352 pjdvj.exe dddjv.exe PID 2352 wrote to memory of 2312 2352 pjdvj.exe dddjv.exe PID 2352 wrote to memory of 2312 2352 pjdvj.exe dddjv.exe PID 2312 wrote to memory of 2292 2312 dddjv.exe flflxxf.exe PID 2312 wrote to memory of 2292 2312 dddjv.exe flflxxf.exe PID 2312 wrote to memory of 2292 2312 dddjv.exe flflxxf.exe PID 2312 wrote to memory of 2292 2312 dddjv.exe flflxxf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21a6af3e0b390f5f081eb0aa813afad0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\21a6af3e0b390f5f081eb0aa813afad0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\1xrxlfl.exec:\1xrxlfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\nhthtn.exec:\nhthtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\hhtthh.exec:\hhtthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\hbnnbt.exec:\hbnnbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\vvpvd.exec:\vvpvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\ffllxlr.exec:\ffllxlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\hhthnt.exec:\hhthnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\dpvvd.exec:\dpvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\3lrxlrr.exec:\3lrxlrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\hbhhnn.exec:\hbhhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\5pdjv.exec:\5pdjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\1llxxrr.exec:\1llxxrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\bbthth.exec:\bbthth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\pjdvj.exec:\pjdvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\dddjv.exec:\dddjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\flflxxf.exec:\flflxxf.exe17⤵
- Executes dropped EXE
PID:2292 -
\??\c:\pjdpv.exec:\pjdpv.exe18⤵
- Executes dropped EXE
PID:1468 -
\??\c:\lrrxrxx.exec:\lrrxrxx.exe19⤵
- Executes dropped EXE
PID:2028 -
\??\c:\1nnbtb.exec:\1nnbtb.exe20⤵
- Executes dropped EXE
PID:3064 -
\??\c:\nnhthn.exec:\nnhthn.exe21⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vpvjp.exec:\vpvjp.exe22⤵
- Executes dropped EXE
PID:2332 -
\??\c:\fffllff.exec:\fffllff.exe23⤵
- Executes dropped EXE
PID:688 -
\??\c:\ntbtbn.exec:\ntbtbn.exe24⤵
- Executes dropped EXE
PID:1080 -
\??\c:\1ppvd.exec:\1ppvd.exe25⤵
- Executes dropped EXE
PID:1760 -
\??\c:\flflfxl.exec:\flflfxl.exe26⤵
- Executes dropped EXE
PID:108 -
\??\c:\1nbbbh.exec:\1nbbbh.exe27⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pvvjp.exec:\pvvjp.exe28⤵
- Executes dropped EXE
PID:2968 -
\??\c:\3xfrfxx.exec:\3xfrfxx.exe29⤵
- Executes dropped EXE
PID:1012 -
\??\c:\1bhhnt.exec:\1bhhnt.exe30⤵
- Executes dropped EXE
PID:800 -
\??\c:\hnhbth.exec:\hnhbth.exe31⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ddvpj.exec:\ddvpj.exe32⤵
- Executes dropped EXE
PID:628 -
\??\c:\xrxfrrf.exec:\xrxfrrf.exe33⤵
- Executes dropped EXE
PID:1680 -
\??\c:\tnbnbt.exec:\tnbnbt.exe34⤵
- Executes dropped EXE
PID:908 -
\??\c:\jjdvj.exec:\jjdvj.exe35⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rxlxlfr.exec:\rxlxlfr.exe36⤵
- Executes dropped EXE
PID:1540 -
\??\c:\ttnbnn.exec:\ttnbnn.exe37⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hthbtn.exec:\hthbtn.exe38⤵
- Executes dropped EXE
PID:2548 -
\??\c:\jpdvp.exec:\jpdvp.exe39⤵
- Executes dropped EXE
PID:2536 -
\??\c:\9rlrxxf.exec:\9rlrxxf.exe40⤵
- Executes dropped EXE
PID:2664 -
\??\c:\5rrxrff.exec:\5rrxrff.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\1hhbht.exec:\1hhbht.exe42⤵
- Executes dropped EXE
PID:2648 -
\??\c:\tttttb.exec:\tttttb.exe43⤵
- Executes dropped EXE
PID:2384 -
\??\c:\dvjvj.exec:\dvjvj.exe44⤵
- Executes dropped EXE
PID:872 -
\??\c:\fxlxffl.exec:\fxlxffl.exe45⤵
- Executes dropped EXE
PID:2812 -
\??\c:\3xrxflx.exec:\3xrxflx.exe46⤵
- Executes dropped EXE
PID:2816 -
\??\c:\bbhntb.exec:\bbhntb.exe47⤵
- Executes dropped EXE
PID:1940 -
\??\c:\7dppd.exec:\7dppd.exe48⤵
- Executes dropped EXE
PID:1568 -
\??\c:\dvdvj.exec:\dvdvj.exe49⤵
- Executes dropped EXE
PID:2668 -
\??\c:\1lxrrrr.exec:\1lxrrrr.exe50⤵
- Executes dropped EXE
PID:2320 -
\??\c:\9nhntn.exec:\9nhntn.exe51⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hnbnbb.exec:\hnbnbb.exe52⤵
- Executes dropped EXE
PID:276 -
\??\c:\frfrxfr.exec:\frfrxfr.exe53⤵
- Executes dropped EXE
PID:2308 -
\??\c:\9hbhnh.exec:\9hbhnh.exe54⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vpjdv.exec:\vpjdv.exe55⤵
- Executes dropped EXE
PID:2352 -
\??\c:\xrflrxf.exec:\xrflrxf.exe56⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nhtbhn.exec:\nhtbhn.exe57⤵
- Executes dropped EXE
PID:2856 -
\??\c:\vjvvd.exec:\vjvvd.exe58⤵
- Executes dropped EXE
PID:3020 -
\??\c:\fxllrxf.exec:\fxllrxf.exe59⤵
- Executes dropped EXE
PID:2088 -
\??\c:\3dpdv.exec:\3dpdv.exe60⤵
- Executes dropped EXE
PID:1380 -
\??\c:\rlrxfll.exec:\rlrxfll.exe61⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rrrffrl.exec:\rrrffrl.exe62⤵
- Executes dropped EXE
PID:2080 -
\??\c:\tbbnht.exec:\tbbnht.exe63⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vdppj.exec:\vdppj.exe64⤵
- Executes dropped EXE
PID:1144 -
\??\c:\rfrflxf.exec:\rfrflxf.exe65⤵
- Executes dropped EXE
PID:688 -
\??\c:\hbhnbh.exec:\hbhnbh.exe66⤵PID:1800
-
\??\c:\pvdjp.exec:\pvdjp.exe67⤵PID:2156
-
\??\c:\3xffxfx.exec:\3xffxfx.exe68⤵PID:668
-
\??\c:\nnttbh.exec:\nnttbh.exe69⤵PID:1556
-
\??\c:\9vjdp.exec:\9vjdp.exe70⤵PID:1448
-
\??\c:\jjvdp.exec:\jjvdp.exe71⤵PID:1852
-
\??\c:\rfxlrfx.exec:\rfxlrfx.exe72⤵PID:2952
-
\??\c:\bthnbn.exec:\bthnbn.exe73⤵PID:2764
-
\??\c:\jjjvv.exec:\jjjvv.exe74⤵PID:1552
-
\??\c:\ffxrlrx.exec:\ffxrlrx.exe75⤵PID:2980
-
\??\c:\bhnhtt.exec:\bhnhtt.exe76⤵PID:1676
-
\??\c:\nhthtn.exec:\nhthtn.exe77⤵PID:1808
-
\??\c:\jvpvj.exec:\jvpvj.exe78⤵PID:2476
-
\??\c:\lfxllrx.exec:\lfxllrx.exe79⤵PID:908
-
\??\c:\nbtntn.exec:\nbtntn.exe80⤵PID:1628
-
\??\c:\ddjvj.exec:\ddjvj.exe81⤵PID:1540
-
\??\c:\vdpjp.exec:\vdpjp.exe82⤵PID:2632
-
\??\c:\xrxlxfr.exec:\xrxlxfr.exe83⤵PID:2908
-
\??\c:\ttntnh.exec:\ttntnh.exe84⤵PID:2520
-
\??\c:\3dpvv.exec:\3dpvv.exe85⤵PID:2964
-
\??\c:\1frflrf.exec:\1frflrf.exe86⤵PID:2636
-
\??\c:\bnbttt.exec:\bnbttt.exe87⤵PID:2564
-
\??\c:\1jdpp.exec:\1jdpp.exe88⤵PID:2608
-
\??\c:\jvjjv.exec:\jvjjv.exe89⤵PID:1664
-
\??\c:\rxllrff.exec:\rxllrff.exe90⤵PID:3016
-
\??\c:\nnnnbb.exec:\nnnnbb.exe91⤵PID:2468
-
\??\c:\vdpjd.exec:\vdpjd.exe92⤵PID:2456
-
\??\c:\rllxfxr.exec:\rllxfxr.exe93⤵PID:2628
-
\??\c:\bnhbnb.exec:\bnhbnb.exe94⤵PID:280
-
\??\c:\dvvvd.exec:\dvvvd.exe95⤵PID:1756
-
\??\c:\llfrxlx.exec:\llfrxlx.exe96⤵PID:2716
-
\??\c:\9lfrflr.exec:\9lfrflr.exe97⤵PID:784
-
\??\c:\1thnnn.exec:\1thnnn.exe98⤵PID:2300
-
\??\c:\1tbhnn.exec:\1tbhnn.exe99⤵PID:2828
-
\??\c:\pvvvd.exec:\pvvvd.exe100⤵PID:1948
-
\??\c:\lrrfxxr.exec:\lrrfxxr.exe101⤵PID:1456
-
\??\c:\xrxxflf.exec:\xrxxflf.exe102⤵PID:1376
-
\??\c:\nnbhtb.exec:\nnbhtb.exe103⤵PID:2140
-
\??\c:\jjdjp.exec:\jjdjp.exe104⤵PID:1056
-
\??\c:\rfxlfff.exec:\rfxlfff.exe105⤵PID:2088
-
\??\c:\9hbbnt.exec:\9hbbnt.exe106⤵PID:3064
-
\??\c:\nbbnbh.exec:\nbbnbh.exe107⤵PID:1268
-
\??\c:\vvjpv.exec:\vvjpv.exe108⤵PID:488
-
\??\c:\7fxrfxl.exec:\7fxrfxl.exe109⤵PID:544
-
\??\c:\3htbnh.exec:\3htbnh.exe110⤵PID:584
-
\??\c:\btbbhh.exec:\btbbhh.exe111⤵PID:2012
-
\??\c:\ddjjp.exec:\ddjjp.exe112⤵PID:1760
-
\??\c:\llxfllr.exec:\llxfllr.exe113⤵PID:1420
-
\??\c:\bbnthh.exec:\bbnthh.exe114⤵PID:356
-
\??\c:\dvdjp.exec:\dvdjp.exe115⤵PID:2244
-
\??\c:\vpdjp.exec:\vpdjp.exe116⤵PID:112
-
\??\c:\rlflxxf.exec:\rlflxxf.exe117⤵PID:2776
-
\??\c:\nbnhnh.exec:\nbnhnh.exe118⤵PID:1232
-
\??\c:\1pvdp.exec:\1pvdp.exe119⤵PID:800
-
\??\c:\frffllr.exec:\frffllr.exe120⤵PID:1444
-
\??\c:\9rfxffr.exec:\9rfxffr.exe121⤵PID:2052
-
\??\c:\hhtbhh.exec:\hhtbhh.exe122⤵PID:604
-
\??\c:\pddpp.exec:\pddpp.exe123⤵PID:1536
-
\??\c:\xrfrfrx.exec:\xrfrfrx.exe124⤵PID:2660
-
\??\c:\bttbnt.exec:\bttbnt.exe125⤵PID:2484
-
\??\c:\jdpdp.exec:\jdpdp.exe126⤵PID:1912
-
\??\c:\xrfxffl.exec:\xrfxffl.exe127⤵PID:2532
-
\??\c:\hbnnbh.exec:\hbnnbh.exe128⤵PID:2652
-
\??\c:\vpdpd.exec:\vpdpd.exe129⤵PID:2744
-
\??\c:\pjvdj.exec:\pjvdj.exe130⤵PID:2556
-
\??\c:\7rlflxl.exec:\7rlflxl.exe131⤵PID:2452
-
\??\c:\nnbbhh.exec:\nnbbhh.exe132⤵PID:2564
-
\??\c:\bttbtb.exec:\bttbtb.exe133⤵PID:2624
-
\??\c:\djvpd.exec:\djvpd.exe134⤵PID:2804
-
\??\c:\rfrfxff.exec:\rfrfxff.exe135⤵PID:1616
-
\??\c:\hbbnhh.exec:\hbbnhh.exe136⤵PID:1940
-
\??\c:\hbthnt.exec:\hbthnt.exe137⤵PID:2456
-
\??\c:\vjppp.exec:\vjppp.exe138⤵PID:292
-
\??\c:\fxxflrx.exec:\fxxflrx.exe139⤵PID:2000
-
\??\c:\9lrlxlr.exec:\9lrlxlr.exe140⤵PID:1756
-
\??\c:\hbnbnn.exec:\hbnbnn.exe141⤵PID:1720
-
\??\c:\jdpdp.exec:\jdpdp.exe142⤵PID:784
-
\??\c:\vvpvj.exec:\vvpvj.exe143⤵PID:1572
-
\??\c:\fxrxrrf.exec:\fxrxrrf.exe144⤵PID:1604
-
\??\c:\fxlxflr.exec:\fxlxflr.exe145⤵PID:2280
-
\??\c:\bthbnt.exec:\bthbnt.exe146⤵PID:1284
-
\??\c:\thbhbn.exec:\thbhbn.exe147⤵PID:3020
-
\??\c:\vjvvd.exec:\vjvvd.exe148⤵PID:2140
-
\??\c:\fxxxlll.exec:\fxxxlll.exe149⤵PID:1056
-
\??\c:\nhhnbb.exec:\nhhnbb.exe150⤵PID:2120
-
\??\c:\bbntbh.exec:\bbntbh.exe151⤵PID:324
-
\??\c:\djvjd.exec:\djvjd.exe152⤵PID:2372
-
\??\c:\rlrfxfx.exec:\rlrfxfx.exe153⤵PID:2332
-
\??\c:\5htbbh.exec:\5htbbh.exe154⤵PID:1416
-
\??\c:\jvdpv.exec:\jvdpv.exe155⤵PID:2676
-
\??\c:\ddjvv.exec:\ddjvv.exe156⤵PID:496
-
\??\c:\3xllrff.exec:\3xllrff.exe157⤵PID:2928
-
\??\c:\tbbnnn.exec:\tbbnnn.exe158⤵PID:2256
-
\??\c:\dvdpd.exec:\dvdpd.exe159⤵PID:288
-
\??\c:\ddpdj.exec:\ddpdj.exe160⤵PID:1868
-
\??\c:\fffxrxr.exec:\fffxrxr.exe161⤵PID:3040
-
\??\c:\tthntb.exec:\tthntb.exe162⤵PID:3012
-
\??\c:\hntntt.exec:\hntntt.exe163⤵PID:964
-
\??\c:\jvppv.exec:\jvppv.exe164⤵PID:3008
-
\??\c:\jdjdj.exec:\jdjdj.exe165⤵PID:1916
-
\??\c:\xxxfrff.exec:\xxxfrff.exe166⤵PID:1680
-
\??\c:\nnbhnh.exec:\nnbhnh.exe167⤵PID:2268
-
\??\c:\vjvpd.exec:\vjvpd.exe168⤵PID:1516
-
\??\c:\vvvdv.exec:\vvvdv.exe169⤵PID:1596
-
\??\c:\rrlxxlx.exec:\rrlxxlx.exe170⤵PID:2584
-
\??\c:\hnnbnb.exec:\hnnbnb.exe171⤵PID:1872
-
\??\c:\jpvvp.exec:\jpvvp.exe172⤵PID:2424
-
\??\c:\vpdvd.exec:\vpdvd.exe173⤵PID:2884
-
\??\c:\llfrxrx.exec:\llfrxrx.exe174⤵PID:2532
-
\??\c:\tnhthh.exec:\tnhthh.exe175⤵PID:2580
-
\??\c:\pppjv.exec:\pppjv.exe176⤵PID:2544
-
\??\c:\5jjjj.exec:\5jjjj.exe177⤵PID:2516
-
\??\c:\llxxfxl.exec:\llxxfxl.exe178⤵PID:2400
-
\??\c:\fxxlfrf.exec:\fxxlfrf.exe179⤵PID:2608
-
\??\c:\nththh.exec:\nththh.exe180⤵PID:872
-
\??\c:\pjpdd.exec:\pjpdd.exe181⤵PID:2804
-
\??\c:\xrffxxf.exec:\xrffxxf.exe182⤵PID:2672
-
\??\c:\flxrffr.exec:\flxrffr.exe183⤵PID:1748
-
\??\c:\bbtbtb.exec:\bbtbtb.exe184⤵PID:2456
-
\??\c:\bthhtt.exec:\bthhtt.exe185⤵PID:1548
-
\??\c:\jjddd.exec:\jjddd.exe186⤵PID:2000
-
\??\c:\rrlrllf.exec:\rrlrllf.exe187⤵PID:820
-
\??\c:\lllxlxl.exec:\lllxlxl.exe188⤵PID:320
-
\??\c:\nnntnh.exec:\nnntnh.exe189⤵PID:1944
-
\??\c:\ppjdp.exec:\ppjdp.exe190⤵PID:2352
-
\??\c:\ppddj.exec:\ppddj.exe191⤵PID:1604
-
\??\c:\frrxflr.exec:\frrxflr.exe192⤵PID:2292
-
\??\c:\hhhtnb.exec:\hhhtnb.exe193⤵PID:1284
-
\??\c:\bbtbnt.exec:\bbtbnt.exe194⤵PID:3020
-
\??\c:\jjvdp.exec:\jjvdp.exe195⤵PID:2140
-
\??\c:\ddvpd.exec:\ddvpd.exe196⤵PID:1056
-
\??\c:\tbtbnb.exec:\tbtbnb.exe197⤵PID:2148
-
\??\c:\tnhnbh.exec:\tnhnbh.exe198⤵PID:608
-
\??\c:\3vjpp.exec:\3vjpp.exe199⤵PID:1328
-
\??\c:\xxxffrl.exec:\xxxffrl.exe200⤵PID:688
-
\??\c:\hbnbnn.exec:\hbnbnn.exe201⤵PID:1800
-
\??\c:\hhbhtb.exec:\hhbhtb.exe202⤵PID:2156
-
\??\c:\pjdpd.exec:\pjdpd.exe203⤵PID:2748
-
\??\c:\llxfrrx.exec:\llxfrrx.exe204⤵PID:1304
-
\??\c:\lfflxll.exec:\lfflxll.exe205⤵PID:944
-
\??\c:\nnbhhh.exec:\nnbhhh.exe206⤵PID:1168
-
\??\c:\5pdvd.exec:\5pdvd.exe207⤵PID:1852
-
\??\c:\pdjpp.exec:\pdjpp.exe208⤵PID:2764
-
\??\c:\llrfrrf.exec:\llrfrrf.exe209⤵PID:2904
-
\??\c:\nnthbn.exec:\nnthbn.exe210⤵PID:800
-
\??\c:\pddvd.exec:\pddvd.exe211⤵PID:1676
-
\??\c:\lfxlrxf.exec:\lfxlrxf.exe212⤵PID:2052
-
\??\c:\rlxlrxl.exec:\rlxlrxl.exe213⤵PID:1544
-
\??\c:\nhnnhn.exec:\nhnnhn.exe214⤵PID:2724
-
\??\c:\vdjvv.exec:\vdjvv.exe215⤵PID:908
-
\??\c:\jdvvj.exec:\jdvvj.exe216⤵PID:2484
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe217⤵PID:2604
-
\??\c:\hnbhbb.exec:\hnbhbb.exe218⤵PID:2196
-
\??\c:\btbhnt.exec:\btbhnt.exe219⤵PID:2524
-
\??\c:\jdvdv.exec:\jdvdv.exe220⤵PID:2692
-
\??\c:\5fxfxlf.exec:\5fxfxlf.exe221⤵PID:2416
-
\??\c:\nbhnbb.exec:\nbhnbb.exe222⤵PID:2428
-
\??\c:\3ttbnt.exec:\3ttbnt.exe223⤵PID:2408
-
\??\c:\vpdvd.exec:\vpdvd.exe224⤵PID:2556
-
\??\c:\llrrxfl.exec:\llrrxfl.exe225⤵PID:2560
-
\??\c:\5lrlfrf.exec:\5lrlfrf.exe226⤵PID:3016
-
\??\c:\ttthhn.exec:\ttthhn.exe227⤵PID:872
-
\??\c:\dvjvd.exec:\dvjvd.exe228⤵PID:2804
-
\??\c:\ppdvd.exec:\ppdvd.exe229⤵PID:1940
-
\??\c:\rrfrlxl.exec:\rrfrlxl.exe230⤵PID:2688
-
\??\c:\7nbbbh.exec:\7nbbbh.exe231⤵PID:2320
-
\??\c:\ntntnb.exec:\ntntnb.exe232⤵PID:1732
-
\??\c:\5vdjj.exec:\5vdjj.exe233⤵PID:1756
-
\??\c:\flxrrrl.exec:\flxrrrl.exe234⤵PID:1720
-
\??\c:\xrxflrx.exec:\xrxflrx.exe235⤵PID:784
-
\??\c:\1thhhh.exec:\1thhhh.exe236⤵PID:1572
-
\??\c:\7djjj.exec:\7djjj.exe237⤵PID:2828
-
\??\c:\ppdvj.exec:\ppdvj.exe238⤵PID:1484
-
\??\c:\1frxffr.exec:\1frxffr.exe239⤵PID:1500
-
\??\c:\hnthhn.exec:\hnthhn.exe240⤵PID:1752
-
\??\c:\dvdvd.exec:\dvdvd.exe241⤵PID:2488
-
\??\c:\djpvd.exec:\djpvd.exe242⤵PID:2072