Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 22:22
Behavioral task
behavioral1
Sample
4a91aab8b6c98959eb5665cfc530cac0_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4a91aab8b6c98959eb5665cfc530cac0_NeikiAnalytics.exe
-
Size
75KB
-
MD5
4a91aab8b6c98959eb5665cfc530cac0
-
SHA1
b54642b5f5b2d504a53144c6fcd29d811faf659c
-
SHA256
96c6983c0798505f329be9d4d49e301e834aa4aa8f7a7878737733311843e416
-
SHA512
b04e2b52b903e60b17e19f14d0697bdd3e570d98d1a845617bfbcc68b7b4e90d50fb7c3ebc991b0b1b20b26c8adbc6c8fb8555e5416ecf686041776320f04f57
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWoFLAxZhMDzE8H:9hOmTsF93UYfwC6GIoutz5yLpOSDl
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
Processes:
resource yara_rule behavioral1/memory/2220-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1036-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1868-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-344-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2740-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/592-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1788-136-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2672-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1752-421-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/624-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1752-466-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1840-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1552-476-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2912-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/944-549-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-624-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/404-666-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-702-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1548-705-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-724-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1532-890-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2520-892-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1512-1010-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/904-1067-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpjjj.exellxrrrr.exebntnbt.exedvvdj.exexrrllrx.exexrffrxf.exebnbhtn.exebbntht.exe3jddj.exexlxrxrr.exerlxflrx.exe5rlxxfl.exenbnttn.exe9ttntb.exe9pppd.exepjddd.exelfrrllx.exe5fxrxxx.exethnntt.exettbnnt.exe7dvjj.exejdvdd.exerlflrrx.exe1rlxxrx.exe3hbbhh.exehbtnth.exedvppv.exevjdjj.exe5xllxfl.exefxrxfrr.exettnhbh.exe5ntbhh.exe9dpdp.exepjvjj.exe9flrflr.exefrxlrxl.exe9nhbtn.exe1hntnn.exe9vpdj.exevjpvd.exe5pdpp.exelfrxllf.exefxfxxrl.exebbhnnn.exe1thhhb.exevjvvv.exevjppp.exexrffffl.exelrxffll.exe1bnntb.exevpjjv.exelrrxflx.exeflrllxx.exetnbttt.exepddjd.exelxllllx.exethnhtt.exelllfxff.exe1bnbnh.exevpdvj.exerrlxrfl.exexrrxfff.exehhntnt.exetntnhh.exepid process 2900 vpjjj.exe 2524 llxrrrr.exe 2740 bntnbt.exe 2732 dvvdj.exe 2404 xrrllrx.exe 2304 xrffrxf.exe 2408 bnbhtn.exe 2816 bbntht.exe 1564 3jddj.exe 1036 xlxrxrr.exe 2672 rlxflrx.exe 1772 5rlxxfl.exe 108 nbnttn.exe 1788 9ttntb.exe 2308 9pppd.exe 2284 pjddd.exe 2316 lfrrllx.exe 2020 5fxrxxx.exe 2416 thnntt.exe 2168 ttbnnt.exe 1868 7dvjj.exe 680 jdvdd.exe 592 rlflrrx.exe 1720 1rlxxrx.exe 2148 3hbbhh.exe 1700 hbtnth.exe 1544 dvppv.exe 792 vjdjj.exe 1136 5xllxfl.exe 1984 fxrxfrr.exe 2072 ttnhbh.exe 3028 5ntbhh.exe 2240 9dpdp.exe 2348 pjvjj.exe 2840 9flrflr.exe 2576 frxlrxl.exe 1524 9nhbtn.exe 1900 1hntnn.exe 2604 9vpdj.exe 2740 vjpvd.exe 2400 5pdpp.exe 2548 lfrxllf.exe 2372 fxfxxrl.exe 2456 bbhnnn.exe 2408 1thhhb.exe 2988 vjvvv.exe 1356 vjppp.exe 2612 xrffffl.exe 2876 lrxffll.exe 1244 1bnntb.exe 1580 vpjjv.exe 1752 lrrxflx.exe 1560 flrllxx.exe 624 tnbttt.exe 2044 pddjd.exe 2024 lxllllx.exe 2316 thnhtt.exe 2016 lllfxff.exe 2064 1bnbnh.exe 1840 vpdvj.exe 1552 rrlxrfl.exe 540 xrrxfff.exe 2468 hhntnt.exe 1172 tntnhh.exe -
Processes:
resource yara_rule behavioral1/memory/2220-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2220-3-0x0000000000430000-0x0000000000457000-memory.dmp upx C:\vpjjj.exe upx behavioral1/memory/2220-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llxrrrr.exe upx behavioral1/memory/2524-28-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bntnbt.exe upx behavioral1/memory/2740-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2740-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvvdj.exe upx behavioral1/memory/2732-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2732-48-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrrllrx.exe upx behavioral1/memory/2404-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrffrxf.exe upx behavioral1/memory/2304-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2304-67-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnbhtn.exe upx C:\bbntht.exe upx behavioral1/memory/2408-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-86-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3jddj.exe upx \??\c:\xlxrxrr.exe upx behavioral1/memory/1036-97-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlxflrx.exe upx \??\c:\nbnttn.exe upx \??\c:\9ttntb.exe upx C:\9pppd.exe upx behavioral1/memory/2316-155-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5fxrxxx.exe upx behavioral1/memory/2020-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1868-192-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rlflrrx.exe upx \??\c:\3hbbhh.exe upx \??\c:\hbtnth.exe upx behavioral1/memory/1700-234-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvppv.exe upx C:\5xllxfl.exe upx C:\fxrxfrr.exe upx \??\c:\5ntbhh.exe upx behavioral1/memory/2840-304-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2740-336-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1524-317-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2372-357-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2740-343-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2240-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2408-376-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2988-377-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2072-276-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ttnhbh.exe upx behavioral1/memory/1356-384-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1984-273-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vjdjj.exe upx \??\c:\1rlxxrx.exe upx behavioral1/memory/592-216-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdvdd.exe upx \??\c:\7dvjj.exe upx behavioral1/memory/2168-190-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ttbnnt.exe upx behavioral1/memory/2416-181-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\thnntt.exe upx behavioral1/memory/2416-172-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfrrllx.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4a91aab8b6c98959eb5665cfc530cac0_NeikiAnalytics.exevpjjj.exellxrrrr.exebntnbt.exedvvdj.exexrrllrx.exexrffrxf.exebnbhtn.exebbntht.exe3jddj.exexlxrxrr.exerlxflrx.exe5rlxxfl.exenbnttn.exe9ttntb.exe9pppd.exedescription pid process target process PID 2220 wrote to memory of 2900 2220 4a91aab8b6c98959eb5665cfc530cac0_NeikiAnalytics.exe vpjjj.exe PID 2220 wrote to memory of 2900 2220 4a91aab8b6c98959eb5665cfc530cac0_NeikiAnalytics.exe vpjjj.exe PID 2220 wrote to memory of 2900 2220 4a91aab8b6c98959eb5665cfc530cac0_NeikiAnalytics.exe vpjjj.exe PID 2220 wrote to memory of 2900 2220 4a91aab8b6c98959eb5665cfc530cac0_NeikiAnalytics.exe vpjjj.exe PID 2900 wrote to memory of 2524 2900 vpjjj.exe llxrrrr.exe PID 2900 wrote to memory of 2524 2900 vpjjj.exe llxrrrr.exe PID 2900 wrote to memory of 2524 2900 vpjjj.exe llxrrrr.exe PID 2900 wrote to memory of 2524 2900 vpjjj.exe llxrrrr.exe PID 2524 wrote to memory of 2740 2524 llxrrrr.exe bntnbt.exe PID 2524 wrote to memory of 2740 2524 llxrrrr.exe bntnbt.exe PID 2524 wrote to memory of 2740 2524 llxrrrr.exe bntnbt.exe PID 2524 wrote to memory of 2740 2524 llxrrrr.exe bntnbt.exe PID 2740 wrote to memory of 2732 2740 bntnbt.exe dvvdj.exe PID 2740 wrote to memory of 2732 2740 bntnbt.exe dvvdj.exe PID 2740 wrote to memory of 2732 2740 bntnbt.exe dvvdj.exe PID 2740 wrote to memory of 2732 2740 bntnbt.exe dvvdj.exe PID 2732 wrote to memory of 2404 2732 dvvdj.exe xrrllrx.exe PID 2732 wrote to memory of 2404 2732 dvvdj.exe xrrllrx.exe PID 2732 wrote to memory of 2404 2732 dvvdj.exe xrrllrx.exe PID 2732 wrote to memory of 2404 2732 dvvdj.exe xrrllrx.exe PID 2404 wrote to memory of 2304 2404 xrrllrx.exe xrffrxf.exe PID 2404 wrote to memory of 2304 2404 xrrllrx.exe xrffrxf.exe PID 2404 wrote to memory of 2304 2404 xrrllrx.exe xrffrxf.exe PID 2404 wrote to memory of 2304 2404 xrrllrx.exe xrffrxf.exe PID 2304 wrote to memory of 2408 2304 xrffrxf.exe 1thhhb.exe PID 2304 wrote to memory of 2408 2304 xrffrxf.exe 1thhhb.exe PID 2304 wrote to memory of 2408 2304 xrffrxf.exe 1thhhb.exe PID 2304 wrote to memory of 2408 2304 xrffrxf.exe 1thhhb.exe PID 2408 wrote to memory of 2816 2408 bnbhtn.exe bbntht.exe PID 2408 wrote to memory of 2816 2408 bnbhtn.exe bbntht.exe PID 2408 wrote to memory of 2816 2408 bnbhtn.exe bbntht.exe PID 2408 wrote to memory of 2816 2408 bnbhtn.exe bbntht.exe PID 2816 wrote to memory of 1564 2816 bbntht.exe 3jddj.exe PID 2816 wrote to memory of 1564 2816 bbntht.exe 3jddj.exe PID 2816 wrote to memory of 1564 2816 bbntht.exe 3jddj.exe PID 2816 wrote to memory of 1564 2816 bbntht.exe 3jddj.exe PID 1564 wrote to memory of 1036 1564 3jddj.exe xlxrxrr.exe PID 1564 wrote to memory of 1036 1564 3jddj.exe xlxrxrr.exe PID 1564 wrote to memory of 1036 1564 3jddj.exe xlxrxrr.exe PID 1564 wrote to memory of 1036 1564 3jddj.exe xlxrxrr.exe PID 1036 wrote to memory of 2672 1036 xlxrxrr.exe rlxflrx.exe PID 1036 wrote to memory of 2672 1036 xlxrxrr.exe rlxflrx.exe PID 1036 wrote to memory of 2672 1036 xlxrxrr.exe rlxflrx.exe PID 1036 wrote to memory of 2672 1036 xlxrxrr.exe rlxflrx.exe PID 2672 wrote to memory of 1772 2672 rlxflrx.exe 5rlxxfl.exe PID 2672 wrote to memory of 1772 2672 rlxflrx.exe 5rlxxfl.exe PID 2672 wrote to memory of 1772 2672 rlxflrx.exe 5rlxxfl.exe PID 2672 wrote to memory of 1772 2672 rlxflrx.exe 5rlxxfl.exe PID 1772 wrote to memory of 108 1772 5rlxxfl.exe nbnttn.exe PID 1772 wrote to memory of 108 1772 5rlxxfl.exe nbnttn.exe PID 1772 wrote to memory of 108 1772 5rlxxfl.exe nbnttn.exe PID 1772 wrote to memory of 108 1772 5rlxxfl.exe nbnttn.exe PID 108 wrote to memory of 1788 108 nbnttn.exe 9ttntb.exe PID 108 wrote to memory of 1788 108 nbnttn.exe 9ttntb.exe PID 108 wrote to memory of 1788 108 nbnttn.exe 9ttntb.exe PID 108 wrote to memory of 1788 108 nbnttn.exe 9ttntb.exe PID 1788 wrote to memory of 2308 1788 9ttntb.exe 9pppd.exe PID 1788 wrote to memory of 2308 1788 9ttntb.exe 9pppd.exe PID 1788 wrote to memory of 2308 1788 9ttntb.exe 9pppd.exe PID 1788 wrote to memory of 2308 1788 9ttntb.exe 9pppd.exe PID 2308 wrote to memory of 2284 2308 9pppd.exe pjddd.exe PID 2308 wrote to memory of 2284 2308 9pppd.exe pjddd.exe PID 2308 wrote to memory of 2284 2308 9pppd.exe pjddd.exe PID 2308 wrote to memory of 2284 2308 9pppd.exe pjddd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a91aab8b6c98959eb5665cfc530cac0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4a91aab8b6c98959eb5665cfc530cac0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\vpjjj.exec:\vpjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\llxrrrr.exec:\llxrrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\bntnbt.exec:\bntnbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\dvvdj.exec:\dvvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\xrrllrx.exec:\xrrllrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\xrffrxf.exec:\xrffrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\bnbhtn.exec:\bnbhtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\bbntht.exec:\bbntht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\3jddj.exec:\3jddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\xlxrxrr.exec:\xlxrxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\rlxflrx.exec:\rlxflrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\5rlxxfl.exec:\5rlxxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\nbnttn.exec:\nbnttn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\9ttntb.exec:\9ttntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\9pppd.exec:\9pppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\pjddd.exec:\pjddd.exe17⤵
- Executes dropped EXE
PID:2284 -
\??\c:\lfrrllx.exec:\lfrrllx.exe18⤵
- Executes dropped EXE
PID:2316 -
\??\c:\5fxrxxx.exec:\5fxrxxx.exe19⤵
- Executes dropped EXE
PID:2020 -
\??\c:\thnntt.exec:\thnntt.exe20⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ttbnnt.exec:\ttbnnt.exe21⤵
- Executes dropped EXE
PID:2168 -
\??\c:\7dvjj.exec:\7dvjj.exe22⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jdvdd.exec:\jdvdd.exe23⤵
- Executes dropped EXE
PID:680 -
\??\c:\rlflrrx.exec:\rlflrrx.exe24⤵
- Executes dropped EXE
PID:592 -
\??\c:\1rlxxrx.exec:\1rlxxrx.exe25⤵
- Executes dropped EXE
PID:1720 -
\??\c:\3hbbhh.exec:\3hbbhh.exe26⤵
- Executes dropped EXE
PID:2148 -
\??\c:\hbtnth.exec:\hbtnth.exe27⤵
- Executes dropped EXE
PID:1700 -
\??\c:\dvppv.exec:\dvppv.exe28⤵
- Executes dropped EXE
PID:1544 -
\??\c:\vjdjj.exec:\vjdjj.exe29⤵
- Executes dropped EXE
PID:792 -
\??\c:\5xllxfl.exec:\5xllxfl.exe30⤵
- Executes dropped EXE
PID:1136 -
\??\c:\fxrxfrr.exec:\fxrxfrr.exe31⤵
- Executes dropped EXE
PID:1984 -
\??\c:\ttnhbh.exec:\ttnhbh.exe32⤵
- Executes dropped EXE
PID:2072 -
\??\c:\5ntbhh.exec:\5ntbhh.exe33⤵
- Executes dropped EXE
PID:3028 -
\??\c:\9dpdp.exec:\9dpdp.exe34⤵
- Executes dropped EXE
PID:2240 -
\??\c:\pjvjj.exec:\pjvjj.exe35⤵
- Executes dropped EXE
PID:2348 -
\??\c:\9flrflr.exec:\9flrflr.exe36⤵
- Executes dropped EXE
PID:2840 -
\??\c:\frxlrxl.exec:\frxlrxl.exe37⤵
- Executes dropped EXE
PID:2576 -
\??\c:\9nhbtn.exec:\9nhbtn.exe38⤵
- Executes dropped EXE
PID:1524 -
\??\c:\1hntnn.exec:\1hntnn.exe39⤵
- Executes dropped EXE
PID:1900 -
\??\c:\9vpdj.exec:\9vpdj.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\vjpvd.exec:\vjpvd.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\5pdpp.exec:\5pdpp.exe42⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lfrxllf.exec:\lfrxllf.exe43⤵
- Executes dropped EXE
PID:2548 -
\??\c:\fxfxxrl.exec:\fxfxxrl.exe44⤵
- Executes dropped EXE
PID:2372 -
\??\c:\bbhnnn.exec:\bbhnnn.exe45⤵
- Executes dropped EXE
PID:2456 -
\??\c:\1thhhb.exec:\1thhhb.exe46⤵
- Executes dropped EXE
PID:2408 -
\??\c:\vjvvv.exec:\vjvvv.exe47⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vjppp.exec:\vjppp.exe48⤵
- Executes dropped EXE
PID:1356 -
\??\c:\xrffffl.exec:\xrffffl.exe49⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lrxffll.exec:\lrxffll.exe50⤵
- Executes dropped EXE
PID:2876 -
\??\c:\1bnntb.exec:\1bnntb.exe51⤵
- Executes dropped EXE
PID:1244 -
\??\c:\vpjjv.exec:\vpjjv.exe52⤵
- Executes dropped EXE
PID:1580 -
\??\c:\lrrxflx.exec:\lrrxflx.exe53⤵
- Executes dropped EXE
PID:1752 -
\??\c:\flrllxx.exec:\flrllxx.exe54⤵
- Executes dropped EXE
PID:1560 -
\??\c:\tnbttt.exec:\tnbttt.exe55⤵
- Executes dropped EXE
PID:624 -
\??\c:\pddjd.exec:\pddjd.exe56⤵
- Executes dropped EXE
PID:2044 -
\??\c:\lxllllx.exec:\lxllllx.exe57⤵
- Executes dropped EXE
PID:2024 -
\??\c:\thnhtt.exec:\thnhtt.exe58⤵
- Executes dropped EXE
PID:2316 -
\??\c:\lllfxff.exec:\lllfxff.exe59⤵
- Executes dropped EXE
PID:2016 -
\??\c:\1bnbnh.exec:\1bnbnh.exe60⤵
- Executes dropped EXE
PID:2064 -
\??\c:\vpdvj.exec:\vpdvj.exe61⤵
- Executes dropped EXE
PID:1840 -
\??\c:\rrlxrfl.exec:\rrlxrfl.exe62⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xrrxfff.exec:\xrrxfff.exe63⤵
- Executes dropped EXE
PID:540 -
\??\c:\hhntnt.exec:\hhntnt.exe64⤵
- Executes dropped EXE
PID:2468 -
\??\c:\tntnhh.exec:\tntnhh.exe65⤵
- Executes dropped EXE
PID:1172 -
\??\c:\dvdvv.exec:\dvdvv.exe66⤵PID:908
-
\??\c:\jdppv.exec:\jdppv.exe67⤵PID:2912
-
\??\c:\frxffxx.exec:\frxffxx.exe68⤵PID:1892
-
\??\c:\rfrxxfl.exec:\rfrxxfl.exe69⤵PID:2160
-
\??\c:\ddppp.exec:\ddppp.exe70⤵PID:2248
-
\??\c:\ffrfrfl.exec:\ffrfrfl.exe71⤵PID:832
-
\??\c:\xlxxxlx.exec:\xlxxxlx.exe72⤵PID:792
-
\??\c:\hhhtnb.exec:\hhhtnb.exe73⤵PID:2296
-
\??\c:\5hnttt.exec:\5hnttt.exe74⤵PID:944
-
\??\c:\jpvpp.exec:\jpvpp.exe75⤵PID:1956
-
\??\c:\vdjjj.exec:\vdjjj.exe76⤵PID:2176
-
\??\c:\rfrrlff.exec:\rfrrlff.exe77⤵PID:1872
-
\??\c:\xfrrxxf.exec:\xfrrxxf.exe78⤵PID:2892
-
\??\c:\7nhttb.exec:\7nhttb.exe79⤵PID:2244
-
\??\c:\pvvvd.exec:\pvvvd.exe80⤵PID:2720
-
\??\c:\9pdjp.exec:\9pdjp.exe81⤵PID:2840
-
\??\c:\xrfrllr.exec:\xrfrllr.exe82⤵PID:1536
-
\??\c:\lrfffff.exec:\lrfffff.exe83⤵PID:2984
-
\??\c:\9tbnhn.exec:\9tbnhn.exe84⤵PID:292
-
\??\c:\bbhhnt.exec:\bbhhnt.exe85⤵PID:2572
-
\??\c:\vjvjd.exec:\vjvjd.exe86⤵PID:2540
-
\??\c:\3djpp.exec:\3djpp.exe87⤵PID:2732
-
\??\c:\lxfxxrx.exec:\lxfxxrx.exe88⤵PID:2480
-
\??\c:\3xrxrxr.exec:\3xrxrxr.exe89⤵PID:2440
-
\??\c:\1hhtnh.exec:\1hhtnh.exe90⤵PID:3048
-
\??\c:\hbnntt.exec:\hbnntt.exe91⤵PID:2812
-
\??\c:\7djjv.exec:\7djjv.exe92⤵PID:1264
-
\??\c:\ppjdv.exec:\ppjdv.exe93⤵PID:404
-
\??\c:\3xxrxrx.exec:\3xxrxrx.exe94⤵PID:1036
-
\??\c:\ffllrrr.exec:\ffllrrr.exe95⤵PID:1360
-
\??\c:\1fflrrf.exec:\1fflrrf.exe96⤵PID:2556
-
\??\c:\thnhtt.exec:\thnhtt.exe97⤵PID:1584
-
\??\c:\bnhhhb.exec:\bnhhhb.exe98⤵PID:2344
-
\??\c:\pdvdd.exec:\pdvdd.exe99⤵PID:1548
-
\??\c:\jjddj.exec:\jjddj.exe100⤵PID:1512
-
\??\c:\frfxflr.exec:\frfxflr.exe101⤵PID:1516
-
\??\c:\lxlllfl.exec:\lxlllfl.exe102⤵PID:2032
-
\??\c:\hthhtb.exec:\hthhtb.exe103⤵PID:2040
-
\??\c:\bnbbtb.exec:\bnbbtb.exe104⤵PID:1796
-
\??\c:\dvvjv.exec:\dvvjv.exe105⤵PID:1456
-
\??\c:\vpddj.exec:\vpddj.exe106⤵PID:2196
-
\??\c:\1fxrrlr.exec:\1fxrrlr.exe107⤵PID:1508
-
\??\c:\lxfllll.exec:\lxfllll.exe108⤵PID:768
-
\??\c:\lfxxrxr.exec:\lfxxrxr.exe109⤵PID:324
-
\??\c:\7hthhh.exec:\7hthhh.exe110⤵PID:1268
-
\??\c:\hbhtnt.exec:\hbhtnt.exe111⤵PID:2468
-
\??\c:\vpvdj.exec:\vpvdj.exe112⤵PID:2924
-
\??\c:\dvddv.exec:\dvddv.exe113⤵PID:684
-
\??\c:\3lrfxxx.exec:\3lrfxxx.exe114⤵PID:1292
-
\??\c:\xrllflr.exec:\xrllflr.exe115⤵PID:1892
-
\??\c:\nhhhnn.exec:\nhhhnn.exe116⤵PID:2160
-
\??\c:\thbntt.exec:\thbntt.exe117⤵PID:2248
-
\??\c:\pjpvd.exec:\pjpvd.exe118⤵PID:1432
-
\??\c:\jpjpj.exec:\jpjpj.exe119⤵PID:1136
-
\??\c:\xlrrlfl.exec:\xlrrlfl.exe120⤵PID:1736
-
\??\c:\rxlrlll.exec:\rxlrlll.exe121⤵PID:3068
-
\??\c:\hbnnnt.exec:\hbnnnt.exe122⤵PID:1180
-
\??\c:\bthntt.exec:\bthntt.exe123⤵PID:2072
-
\??\c:\nbtttn.exec:\nbtttn.exe124⤵PID:1872
-
\??\c:\dvvdj.exec:\dvvdj.exe125⤵PID:2348
-
\??\c:\jvppp.exec:\jvppp.exe126⤵PID:1012
-
\??\c:\fxfrrrx.exec:\fxfrrrx.exe127⤵PID:1288
-
\??\c:\1ffflfr.exec:\1ffflfr.exe128⤵PID:1532
-
\??\c:\nthtnn.exec:\nthtnn.exe129⤵PID:2520
-
\??\c:\7djjj.exec:\7djjj.exe130⤵PID:1900
-
\??\c:\9jvjv.exec:\9jvjv.exe131⤵PID:2088
-
\??\c:\rlfllrx.exec:\rlfllrx.exe132⤵PID:2484
-
\??\c:\rxxrxrr.exec:\rxxrxrr.exe133⤵PID:2400
-
\??\c:\5xlrrrx.exec:\5xlrrrx.exe134⤵PID:2376
-
\??\c:\9bhttt.exec:\9bhttt.exe135⤵PID:2428
-
\??\c:\9ntbnn.exec:\9ntbnn.exe136⤵PID:2420
-
\??\c:\pjvjd.exec:\pjvjd.exe137⤵PID:2108
-
\??\c:\jvvdv.exec:\jvvdv.exe138⤵PID:1364
-
\??\c:\1lffffl.exec:\1lffffl.exe139⤵PID:1264
-
\??\c:\fxrlxxf.exec:\fxrlxxf.exe140⤵PID:2444
-
\??\c:\hntntt.exec:\hntntt.exe141⤵PID:2672
-
\??\c:\bthbhn.exec:\bthbhn.exe142⤵PID:2096
-
\??\c:\vjppp.exec:\vjppp.exe143⤵PID:2676
-
\??\c:\jjpvv.exec:\jjpvv.exe144⤵PID:2116
-
\??\c:\rrxlxfx.exec:\rrxlxfx.exe145⤵PID:2112
-
\??\c:\rfrlrlr.exec:\rfrlrlr.exe146⤵PID:2312
-
\??\c:\3nhnbh.exec:\3nhnbh.exe147⤵PID:1512
-
\??\c:\bnbbtt.exec:\bnbbtt.exe148⤵PID:1516
-
\??\c:\pjjjp.exec:\pjjjp.exe149⤵PID:2024
-
\??\c:\9pppp.exec:\9pppp.exe150⤵PID:240
-
\??\c:\9ffrlxl.exec:\9ffrlxl.exe151⤵PID:2016
-
\??\c:\5frrlrx.exec:\5frrlrx.exe152⤵PID:2064
-
\??\c:\9bbbbb.exec:\9bbbbb.exe153⤵PID:1840
-
\??\c:\thttbt.exec:\thttbt.exe154⤵PID:1552
-
\??\c:\pjppd.exec:\pjppd.exe155⤵PID:540
-
\??\c:\jdppj.exec:\jdppj.exe156⤵PID:2036
-
\??\c:\3rxxxlr.exec:\3rxxxlr.exe157⤵PID:904
-
\??\c:\llllxrl.exec:\llllxrl.exe158⤵PID:952
-
\??\c:\9thbnh.exec:\9thbnh.exe159⤵PID:1484
-
\??\c:\3thntb.exec:\3thntb.exe160⤵PID:296
-
\??\c:\5jjvd.exec:\5jjvd.exe161⤵PID:1684
-
\??\c:\jdjdp.exec:\jdjdp.exe162⤵PID:1544
-
\??\c:\fxlxffr.exec:\fxlxffr.exe163⤵PID:2280
-
\??\c:\xxrrfll.exec:\xxrrfll.exe164⤵PID:284
-
\??\c:\hhtbtt.exec:\hhtbtt.exe165⤵PID:572
-
\??\c:\9ttbnt.exec:\9ttbnt.exe166⤵PID:2744
-
\??\c:\dvvjd.exec:\dvvjd.exe167⤵PID:1724
-
\??\c:\vvpvd.exec:\vvpvd.exe168⤵PID:2980
-
\??\c:\frfxllr.exec:\frfxllr.exe169⤵PID:2240
-
\??\c:\7lffxlf.exec:\7lffxlf.exe170⤵PID:2252
-
\??\c:\9xllrrx.exec:\9xllrrx.exe171⤵PID:2564
-
\??\c:\nhntbb.exec:\nhntbb.exe172⤵PID:1932
-
\??\c:\hhnhnt.exec:\hhnhnt.exe173⤵PID:2584
-
\??\c:\btbhbh.exec:\btbhbh.exe174⤵PID:1524
-
\??\c:\pjpdv.exec:\pjpdv.exe175⤵PID:2608
-
\??\c:\ppddv.exec:\ppddv.exe176⤵PID:2984
-
\??\c:\pjjdp.exec:\pjjdp.exe177⤵PID:2412
-
\??\c:\1rflllr.exec:\1rflllr.exe178⤵PID:2852
-
\??\c:\lxxfrlf.exec:\lxxfrlf.exe179⤵PID:2732
-
\??\c:\thnbhh.exec:\thnbhh.exe180⤵PID:2404
-
\??\c:\1tntth.exec:\1tntth.exe181⤵PID:2552
-
\??\c:\3hbbhh.exec:\3hbbhh.exe182⤵PID:1324
-
\??\c:\9dvjv.exec:\9dvjv.exe183⤵PID:2560
-
\??\c:\vpdpv.exec:\vpdpv.exe184⤵PID:2816
-
\??\c:\7vvdp.exec:\7vvdp.exe185⤵PID:2692
-
\??\c:\xxxxxlx.exec:\xxxxxlx.exe186⤵PID:756
-
\??\c:\rllllrx.exec:\rllllrx.exe187⤵PID:2388
-
\??\c:\1flrxxl.exec:\1flrxxl.exe188⤵PID:2820
-
\??\c:\tthnbt.exec:\tthnbt.exe189⤵PID:1576
-
\??\c:\tntthh.exec:\tntthh.exe190⤵PID:2144
-
\??\c:\1bttnn.exec:\1bttnn.exe191⤵PID:1860
-
\??\c:\ddvpd.exec:\ddvpd.exe192⤵PID:2112
-
\??\c:\ddpdp.exec:\ddpdp.exe193⤵PID:2712
-
\??\c:\3rxlxxl.exec:\3rxlxxl.exe194⤵PID:3036
-
\??\c:\lxllrrf.exec:\lxllrrf.exe195⤵PID:2944
-
\??\c:\xrfrrrr.exec:\xrfrrrr.exe196⤵PID:1688
-
\??\c:\thttbn.exec:\thttbn.exe197⤵PID:240
-
\??\c:\7bbthh.exec:\7bbthh.exe198⤵PID:2192
-
\??\c:\dvpjv.exec:\dvpjv.exe199⤵PID:1796
-
\??\c:\pjpvp.exec:\pjpvp.exe200⤵PID:1840
-
\??\c:\jdppd.exec:\jdppd.exe201⤵PID:1552
-
\??\c:\lfrrflr.exec:\lfrrflr.exe202⤵PID:592
-
\??\c:\7lxlrrx.exec:\7lxlrrx.exe203⤵PID:1172
-
\??\c:\9htbbb.exec:\9htbbb.exe204⤵PID:2360
-
\??\c:\ttbbtt.exec:\ttbbtt.exe205⤵PID:2172
-
\??\c:\hhtnth.exec:\hhtnth.exe206⤵PID:1292
-
\??\c:\vvdjj.exec:\vvdjj.exe207⤵PID:2948
-
\??\c:\xfxrrll.exec:\xfxrrll.exe208⤵PID:928
-
\??\c:\fxflrrr.exec:\fxflrrr.exe209⤵PID:832
-
\??\c:\lfrfrlx.exec:\lfrfrlx.exe210⤵PID:2748
-
\??\c:\bntttt.exec:\bntttt.exe211⤵PID:1132
-
\??\c:\bntbbh.exec:\bntbbh.exe212⤵PID:1736
-
\??\c:\htbbhb.exec:\htbbhb.exe213⤵PID:3068
-
\??\c:\pjpvv.exec:\pjpvv.exe214⤵PID:1444
-
\??\c:\vvjdv.exec:\vvjdv.exe215⤵PID:1612
-
\??\c:\jvdvp.exec:\jvdvp.exe216⤵PID:1872
-
\??\c:\xlxffxf.exec:\xlxffxf.exe217⤵PID:2720
-
\??\c:\bnbbhb.exec:\bnbbhb.exe218⤵PID:2900
-
\??\c:\thnntb.exec:\thnntb.exe219⤵PID:1288
-
\??\c:\5hbtbb.exec:\5hbtbb.exe220⤵PID:2524
-
\??\c:\dpvvd.exec:\dpvvd.exe221⤵PID:2648
-
\??\c:\pjddj.exec:\pjddj.exe222⤵PID:1476
-
\??\c:\5frrlfl.exec:\5frrlfl.exe223⤵PID:2088
-
\??\c:\lxxxxff.exec:\lxxxxff.exe224⤵PID:2652
-
\??\c:\3lrllfl.exec:\3lrllfl.exe225⤵PID:2400
-
\??\c:\httttt.exec:\httttt.exe226⤵PID:1924
-
\??\c:\tnbnnh.exec:\tnbnnh.exe227⤵PID:1660
-
\??\c:\tbnthb.exec:\tbnthb.exe228⤵PID:2408
-
\??\c:\pdppp.exec:\pdppp.exe229⤵PID:1656
-
\??\c:\jvjdv.exec:\jvjdv.exe230⤵PID:1372
-
\??\c:\dvvvv.exec:\dvvvv.exe231⤵PID:2824
-
\??\c:\rffrrlr.exec:\rffrrlr.exe232⤵PID:2444
-
\??\c:\lxxxxxf.exec:\lxxxxxf.exe233⤵PID:1036
-
\??\c:\5frlfxx.exec:\5frlfxx.exe234⤵PID:1604
-
\??\c:\ttthtb.exec:\ttthtb.exe235⤵PID:2556
-
\??\c:\bthttb.exec:\bthttb.exe236⤵PID:1576
-
\??\c:\bnbnnn.exec:\bnbnnn.exe237⤵PID:2144
-
\??\c:\ddpdp.exec:\ddpdp.exe238⤵PID:1860
-
\??\c:\9pddv.exec:\9pddv.exe239⤵PID:2112
-
\??\c:\lflxrxf.exec:\lflxrxf.exe240⤵PID:2712
-
\??\c:\rfllfll.exec:\rfllfll.exe241⤵PID:2704
-
\??\c:\lllxrxr.exec:\lllxrxr.exe242⤵PID:2944