Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 17:58
Behavioral task
behavioral1
Sample
0d66425ee0b32c8d7016d2d8d1f6e8e0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0d66425ee0b32c8d7016d2d8d1f6e8e0_NeikiAnalytics.exe
-
Size
401KB
-
MD5
0d66425ee0b32c8d7016d2d8d1f6e8e0
-
SHA1
025569f002dd9c8f198a51754cb4a57900b3bf52
-
SHA256
bf445d3408c8881faa710c0e436f9484c5b217b4b65ead5415e4f6dcdb008651
-
SHA512
935eaeae21ec4097813f91db18519faf3adfbed9fa17cff56f91887ce98717ccbb47c68b065d62e21cbcedf4e36c1ed045d7f774ef16deca8379f21068d07662
-
SSDEEP
6144:Jcm4FmowdHoSEubDcAkOCOu0EajNVBZr6y2WXxLO1UqW9E33:T4wFHoSEubD2P33
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
Processes:
resource yara_rule behavioral1/memory/2420-8-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2052-16-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2240-26-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2088-35-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2724-46-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2924-55-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2272-64-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2576-68-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2592-83-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2608-85-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2368-101-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2524-109-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2864-119-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/284-136-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2452-143-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1348-153-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1760-156-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2776-172-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2076-189-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2060-198-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2092-206-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/600-225-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1612-235-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1276-246-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1888-294-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1708-298-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2148-305-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2240-325-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2668-344-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1292-412-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2452-438-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1640-458-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1880-514-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1928-528-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2028-1220-0x00000000003D0000-0x00000000003F8000-memory.dmp family_blackmoon behavioral1/memory/2296-1411-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5rrfrxl.exe3bnnhb.exennbbhh.exepjjvd.exennhnbb.exe9vdpd.exefxlxrlr.exehhthnb.exerlflrrl.exehbbnbn.exerxfrlfl.exeddvdp.exelllrffx.exedjvvv.exe3llfrrf.exehbtthh.exeppjvd.exelfflrxf.exevvjpv.exelffrxxl.exe5jpjv.exerrlxflf.exethhnth.exevjdpd.exe9jpvd.exevpvjp.exe7htbtt.exexrflflx.exedddpd.exelrfxfrl.exetnbhtt.exedpvdd.exe7htnth.exettnbnn.exe5pjjd.exefxxfrrf.exerxrfrrl.exebttntb.exevvvdv.exe5rrfxfx.exe5ttnbb.exebnhttb.exevvpvj.exe3rrxflr.exexfxlxfx.exethbhtn.exe3dvvd.exe7pjpd.exefxlfllf.exenhbhtt.exenttnbh.exe1dvdj.exe1rrlrrx.exehnbhnt.exe7tnbbh.exedvjpv.exerfrfllr.exebhhhth.exeddvvj.exevpvdd.exerllrxfl.exe7bnnht.exe5ddpv.exelrllfxx.exepid process 2052 5rrfrxl.exe 2240 3bnnhb.exe 2088 nnbbhh.exe 2724 pjjvd.exe 2924 nnhnbb.exe 2272 9vdpd.exe 2576 fxlxrlr.exe 2592 hhthnb.exe 2608 rlflrrl.exe 2368 hbbnbn.exe 2524 rxfrlfl.exe 2864 ddvdp.exe 2992 lllrffx.exe 284 djvvv.exe 2452 3llfrrf.exe 1348 hbtthh.exe 1760 ppjvd.exe 2776 lfflrxf.exe 1592 vvjpv.exe 2076 lffrxxl.exe 2060 5jpjv.exe 2092 rrlxflf.exe 1264 thhnth.exe 600 vjdpd.exe 1612 9jpvd.exe 1400 vpvjp.exe 1276 7htbtt.exe 1672 xrflflx.exe 2964 dddpd.exe 852 lrfxfrl.exe 3036 tnbhtt.exe 1888 dpvdd.exe 1900 7htnth.exe 2148 ttnbnn.exe 1624 5pjjd.exe 2240 fxxfrrf.exe 2684 rxrfrrl.exe 2760 bttntb.exe 2668 vvvdv.exe 2812 5rrfxfx.exe 2740 5ttnbb.exe 2584 bnhttb.exe 2548 vvpvj.exe 2600 3rrxflr.exe 2188 xfxlxfx.exe 3028 thbhtn.exe 2424 3dvvd.exe 2860 7pjpd.exe 2896 fxlfllf.exe 1292 nhbhtt.exe 1332 nttnbh.exe 1680 1dvdj.exe 2004 1rrlrrx.exe 2452 hnbhnt.exe 2412 7tnbbh.exe 1748 dvjpv.exe 1664 rfrfllr.exe 1640 bhhhth.exe 1592 ddvvj.exe 2076 vpvdd.exe 2140 rllrxfl.exe 2936 7bnnht.exe 320 5ddpv.exe 992 lrllfxx.exe -
Processes:
resource yara_rule behavioral1/memory/2420-0-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\5rrfrxl.exe upx behavioral1/memory/2420-8-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\3bnnhb.exe upx behavioral1/memory/2052-16-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\nnbbhh.exe upx behavioral1/memory/2240-26-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2088-27-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2088-35-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\pjjvd.exe upx C:\nnhnbb.exe upx behavioral1/memory/2724-46-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2924-55-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\9vdpd.exe upx C:\fxlxrlr.exe upx behavioral1/memory/2272-64-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\hhthnb.exe upx behavioral1/memory/2592-74-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\rlflrrl.exe upx behavioral1/memory/2592-83-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2608-85-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\hbbnbn.exe upx C:\rxfrlfl.exe upx behavioral1/memory/2368-101-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\ddvdp.exe upx behavioral1/memory/2524-109-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\lllrffx.exe upx behavioral1/memory/2864-119-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\djvvv.exe upx C:\3llfrrf.exe upx behavioral1/memory/284-136-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\hbtthh.exe upx behavioral1/memory/2452-143-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\ppjvd.exe upx behavioral1/memory/1348-153-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1760-156-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\lfflrxf.exe upx C:\vvjpv.exe upx behavioral1/memory/2776-172-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\lffrxxl.exe upx C:\5jpjv.exe upx behavioral1/memory/2076-189-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\rrlxflf.exe upx behavioral1/memory/2060-198-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\thhnth.exe upx C:\vjdpd.exe upx C:\9jpvd.exe upx behavioral1/memory/600-225-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1612-227-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\vpvjp.exe upx behavioral1/memory/1612-235-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\7htbtt.exe upx behavioral1/memory/1276-246-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\xrflflx.exe upx C:\dddpd.exe upx C:\lrfxfrl.exe upx C:\tnbhtt.exe upx behavioral1/memory/3036-278-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\dpvdd.exe upx behavioral1/memory/1888-294-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1708-298-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2148-305-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1624-312-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2240-325-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0d66425ee0b32c8d7016d2d8d1f6e8e0_NeikiAnalytics.exe5rrfrxl.exe3bnnhb.exennbbhh.exepjjvd.exennhnbb.exe9vdpd.exefxlxrlr.exehhthnb.exerlflrrl.exehbbnbn.exerxfrlfl.exeddvdp.exelllrffx.exedjvvv.exe3llfrrf.exedescription pid process target process PID 2420 wrote to memory of 2052 2420 0d66425ee0b32c8d7016d2d8d1f6e8e0_NeikiAnalytics.exe 5rrfrxl.exe PID 2420 wrote to memory of 2052 2420 0d66425ee0b32c8d7016d2d8d1f6e8e0_NeikiAnalytics.exe 5rrfrxl.exe PID 2420 wrote to memory of 2052 2420 0d66425ee0b32c8d7016d2d8d1f6e8e0_NeikiAnalytics.exe 5rrfrxl.exe PID 2420 wrote to memory of 2052 2420 0d66425ee0b32c8d7016d2d8d1f6e8e0_NeikiAnalytics.exe 5rrfrxl.exe PID 2052 wrote to memory of 2240 2052 5rrfrxl.exe 3bnnhb.exe PID 2052 wrote to memory of 2240 2052 5rrfrxl.exe 3bnnhb.exe PID 2052 wrote to memory of 2240 2052 5rrfrxl.exe 3bnnhb.exe PID 2052 wrote to memory of 2240 2052 5rrfrxl.exe 3bnnhb.exe PID 2240 wrote to memory of 2088 2240 3bnnhb.exe nnbbhh.exe PID 2240 wrote to memory of 2088 2240 3bnnhb.exe nnbbhh.exe PID 2240 wrote to memory of 2088 2240 3bnnhb.exe nnbbhh.exe PID 2240 wrote to memory of 2088 2240 3bnnhb.exe nnbbhh.exe PID 2088 wrote to memory of 2724 2088 nnbbhh.exe pjjvd.exe PID 2088 wrote to memory of 2724 2088 nnbbhh.exe pjjvd.exe PID 2088 wrote to memory of 2724 2088 nnbbhh.exe pjjvd.exe PID 2088 wrote to memory of 2724 2088 nnbbhh.exe pjjvd.exe PID 2724 wrote to memory of 2924 2724 pjjvd.exe nnhnbb.exe PID 2724 wrote to memory of 2924 2724 pjjvd.exe nnhnbb.exe PID 2724 wrote to memory of 2924 2724 pjjvd.exe nnhnbb.exe PID 2724 wrote to memory of 2924 2724 pjjvd.exe nnhnbb.exe PID 2924 wrote to memory of 2272 2924 nnhnbb.exe 9vdpd.exe PID 2924 wrote to memory of 2272 2924 nnhnbb.exe 9vdpd.exe PID 2924 wrote to memory of 2272 2924 nnhnbb.exe 9vdpd.exe PID 2924 wrote to memory of 2272 2924 nnhnbb.exe 9vdpd.exe PID 2272 wrote to memory of 2576 2272 9vdpd.exe fxlxrlr.exe PID 2272 wrote to memory of 2576 2272 9vdpd.exe fxlxrlr.exe PID 2272 wrote to memory of 2576 2272 9vdpd.exe fxlxrlr.exe PID 2272 wrote to memory of 2576 2272 9vdpd.exe fxlxrlr.exe PID 2576 wrote to memory of 2592 2576 fxlxrlr.exe hhthnb.exe PID 2576 wrote to memory of 2592 2576 fxlxrlr.exe hhthnb.exe PID 2576 wrote to memory of 2592 2576 fxlxrlr.exe hhthnb.exe PID 2576 wrote to memory of 2592 2576 fxlxrlr.exe hhthnb.exe PID 2592 wrote to memory of 2608 2592 hhthnb.exe rlflrrl.exe PID 2592 wrote to memory of 2608 2592 hhthnb.exe rlflrrl.exe PID 2592 wrote to memory of 2608 2592 hhthnb.exe rlflrrl.exe PID 2592 wrote to memory of 2608 2592 hhthnb.exe rlflrrl.exe PID 2608 wrote to memory of 2368 2608 rlflrrl.exe hbbnbn.exe PID 2608 wrote to memory of 2368 2608 rlflrrl.exe hbbnbn.exe PID 2608 wrote to memory of 2368 2608 rlflrrl.exe hbbnbn.exe PID 2608 wrote to memory of 2368 2608 rlflrrl.exe hbbnbn.exe PID 2368 wrote to memory of 2524 2368 hbbnbn.exe rxfrlfl.exe PID 2368 wrote to memory of 2524 2368 hbbnbn.exe rxfrlfl.exe PID 2368 wrote to memory of 2524 2368 hbbnbn.exe rxfrlfl.exe PID 2368 wrote to memory of 2524 2368 hbbnbn.exe rxfrlfl.exe PID 2524 wrote to memory of 2864 2524 rxfrlfl.exe ddvdp.exe PID 2524 wrote to memory of 2864 2524 rxfrlfl.exe ddvdp.exe PID 2524 wrote to memory of 2864 2524 rxfrlfl.exe ddvdp.exe PID 2524 wrote to memory of 2864 2524 rxfrlfl.exe ddvdp.exe PID 2864 wrote to memory of 2992 2864 ddvdp.exe lllrffx.exe PID 2864 wrote to memory of 2992 2864 ddvdp.exe lllrffx.exe PID 2864 wrote to memory of 2992 2864 ddvdp.exe lllrffx.exe PID 2864 wrote to memory of 2992 2864 ddvdp.exe lllrffx.exe PID 2992 wrote to memory of 284 2992 lllrffx.exe djvvv.exe PID 2992 wrote to memory of 284 2992 lllrffx.exe djvvv.exe PID 2992 wrote to memory of 284 2992 lllrffx.exe djvvv.exe PID 2992 wrote to memory of 284 2992 lllrffx.exe djvvv.exe PID 284 wrote to memory of 2452 284 djvvv.exe 3llfrrf.exe PID 284 wrote to memory of 2452 284 djvvv.exe 3llfrrf.exe PID 284 wrote to memory of 2452 284 djvvv.exe 3llfrrf.exe PID 284 wrote to memory of 2452 284 djvvv.exe 3llfrrf.exe PID 2452 wrote to memory of 1348 2452 3llfrrf.exe hbtthh.exe PID 2452 wrote to memory of 1348 2452 3llfrrf.exe hbtthh.exe PID 2452 wrote to memory of 1348 2452 3llfrrf.exe hbtthh.exe PID 2452 wrote to memory of 1348 2452 3llfrrf.exe hbtthh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d66425ee0b32c8d7016d2d8d1f6e8e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0d66425ee0b32c8d7016d2d8d1f6e8e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\5rrfrxl.exec:\5rrfrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\3bnnhb.exec:\3bnnhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\nnbbhh.exec:\nnbbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\pjjvd.exec:\pjjvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\nnhnbb.exec:\nnhnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\9vdpd.exec:\9vdpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\fxlxrlr.exec:\fxlxrlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\hhthnb.exec:\hhthnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rlflrrl.exec:\rlflrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\hbbnbn.exec:\hbbnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\rxfrlfl.exec:\rxfrlfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\ddvdp.exec:\ddvdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\lllrffx.exec:\lllrffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\djvvv.exec:\djvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:284 -
\??\c:\3llfrrf.exec:\3llfrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\hbtthh.exec:\hbtthh.exe17⤵
- Executes dropped EXE
PID:1348 -
\??\c:\ppjvd.exec:\ppjvd.exe18⤵
- Executes dropped EXE
PID:1760 -
\??\c:\lfflrxf.exec:\lfflrxf.exe19⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vvjpv.exec:\vvjpv.exe20⤵
- Executes dropped EXE
PID:1592 -
\??\c:\lffrxxl.exec:\lffrxxl.exe21⤵
- Executes dropped EXE
PID:2076 -
\??\c:\5jpjv.exec:\5jpjv.exe22⤵
- Executes dropped EXE
PID:2060 -
\??\c:\rrlxflf.exec:\rrlxflf.exe23⤵
- Executes dropped EXE
PID:2092 -
\??\c:\thhnth.exec:\thhnth.exe24⤵
- Executes dropped EXE
PID:1264 -
\??\c:\vjdpd.exec:\vjdpd.exe25⤵
- Executes dropped EXE
PID:600 -
\??\c:\9jpvd.exec:\9jpvd.exe26⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vpvjp.exec:\vpvjp.exe27⤵
- Executes dropped EXE
PID:1400 -
\??\c:\7htbtt.exec:\7htbtt.exe28⤵
- Executes dropped EXE
PID:1276 -
\??\c:\xrflflx.exec:\xrflflx.exe29⤵
- Executes dropped EXE
PID:1672 -
\??\c:\dddpd.exec:\dddpd.exe30⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lrfxfrl.exec:\lrfxfrl.exe31⤵
- Executes dropped EXE
PID:852 -
\??\c:\tnbhtt.exec:\tnbhtt.exe32⤵
- Executes dropped EXE
PID:3036 -
\??\c:\dpvdd.exec:\dpvdd.exe33⤵
- Executes dropped EXE
PID:1888 -
\??\c:\7htnth.exec:\7htnth.exe34⤵
- Executes dropped EXE
PID:1900 -
\??\c:\1vvjd.exec:\1vvjd.exe35⤵PID:1708
-
\??\c:\ttnbnn.exec:\ttnbnn.exe36⤵
- Executes dropped EXE
PID:2148 -
\??\c:\5pjjd.exec:\5pjjd.exe37⤵
- Executes dropped EXE
PID:1624 -
\??\c:\fxxfrrf.exec:\fxxfrrf.exe38⤵
- Executes dropped EXE
PID:2240 -
\??\c:\rxrfrrl.exec:\rxrfrrl.exe39⤵
- Executes dropped EXE
PID:2684 -
\??\c:\bttntb.exec:\bttntb.exe40⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vvvdv.exec:\vvvdv.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\5rrfxfx.exec:\5rrfxfx.exe42⤵
- Executes dropped EXE
PID:2812 -
\??\c:\5ttnbb.exec:\5ttnbb.exe43⤵
- Executes dropped EXE
PID:2740 -
\??\c:\bnhttb.exec:\bnhttb.exe44⤵
- Executes dropped EXE
PID:2584 -
\??\c:\vvpvj.exec:\vvpvj.exe45⤵
- Executes dropped EXE
PID:2548 -
\??\c:\3rrxflr.exec:\3rrxflr.exe46⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xfxlxfx.exec:\xfxlxfx.exe47⤵
- Executes dropped EXE
PID:2188 -
\??\c:\thbhtn.exec:\thbhtn.exe48⤵
- Executes dropped EXE
PID:3028 -
\??\c:\3dvvd.exec:\3dvvd.exe49⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7pjpd.exec:\7pjpd.exe50⤵
- Executes dropped EXE
PID:2860 -
\??\c:\fxlfllf.exec:\fxlfllf.exe51⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nhbhtt.exec:\nhbhtt.exe52⤵
- Executes dropped EXE
PID:1292 -
\??\c:\nttnbh.exec:\nttnbh.exe53⤵
- Executes dropped EXE
PID:1332 -
\??\c:\1dvdj.exec:\1dvdj.exe54⤵
- Executes dropped EXE
PID:1680 -
\??\c:\1rrlrrx.exec:\1rrlrrx.exe55⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hnbhnt.exec:\hnbhnt.exe56⤵
- Executes dropped EXE
PID:2452 -
\??\c:\7tnbbh.exec:\7tnbbh.exe57⤵
- Executes dropped EXE
PID:2412 -
\??\c:\dvjpv.exec:\dvjpv.exe58⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rfrfllr.exec:\rfrfllr.exe59⤵
- Executes dropped EXE
PID:1664 -
\??\c:\bhhhth.exec:\bhhhth.exe60⤵
- Executes dropped EXE
PID:1640 -
\??\c:\ddvvj.exec:\ddvvj.exe61⤵
- Executes dropped EXE
PID:1592 -
\??\c:\vpvdd.exec:\vpvdd.exe62⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rllrxfl.exec:\rllrxfl.exe63⤵
- Executes dropped EXE
PID:2140 -
\??\c:\7bnnht.exec:\7bnnht.exe64⤵
- Executes dropped EXE
PID:2936 -
\??\c:\5ddpv.exec:\5ddpv.exe65⤵
- Executes dropped EXE
PID:320 -
\??\c:\lrllfxx.exec:\lrllfxx.exe66⤵
- Executes dropped EXE
PID:992 -
\??\c:\rlfrllx.exec:\rlfrllx.exe67⤵PID:584
-
\??\c:\bbhnbn.exec:\bbhnbn.exe68⤵PID:576
-
\??\c:\9jjvp.exec:\9jjvp.exe69⤵PID:1880
-
\??\c:\jddvp.exec:\jddvp.exe70⤵PID:1928
-
\??\c:\ffxrxfx.exec:\ffxrxfx.exe71⤵PID:848
-
\??\c:\ntbhth.exec:\ntbhth.exe72⤵PID:572
-
\??\c:\7pjpv.exec:\7pjpv.exe73⤵PID:2908
-
\??\c:\vvpvd.exec:\vvpvd.exe74⤵PID:1240
-
\??\c:\xrlrxfl.exec:\xrlrxfl.exe75⤵PID:2968
-
\??\c:\hbtthn.exec:\hbtthn.exe76⤵PID:1876
-
\??\c:\hbbbhh.exec:\hbbbhh.exe77⤵PID:1340
-
\??\c:\rxxrflr.exec:\rxxrflr.exe78⤵PID:2268
-
\??\c:\llffrxl.exec:\llffrxl.exe79⤵PID:2260
-
\??\c:\tnhhtb.exec:\tnhhtb.exe80⤵PID:1544
-
\??\c:\9vpvp.exec:\9vpvp.exe81⤵PID:1128
-
\??\c:\1jvdj.exec:\1jvdj.exe82⤵PID:2644
-
\??\c:\lfxxflf.exec:\lfxxflf.exe83⤵PID:2108
-
\??\c:\3hntht.exec:\3hntht.exe84⤵PID:2684
-
\??\c:\5nhtbh.exec:\5nhtbh.exe85⤵PID:2760
-
\??\c:\dvjdp.exec:\dvjdp.exe86⤵PID:2544
-
\??\c:\xxflxll.exec:\xxflxll.exe87⤵PID:2572
-
\??\c:\3lxxrfl.exec:\3lxxrfl.exe88⤵PID:2820
-
\??\c:\hbtbnt.exec:\hbtbnt.exe89⤵PID:2576
-
\??\c:\bthhhb.exec:\bthhhb.exe90⤵PID:2704
-
\??\c:\7vvvj.exec:\7vvvj.exe91⤵PID:2656
-
\??\c:\fllxflx.exec:\fllxflx.exe92⤵PID:1884
-
\??\c:\fxrxffl.exec:\fxrxffl.exe93⤵PID:2624
-
\??\c:\nnhthh.exec:\nnhthh.exe94⤵PID:2780
-
\??\c:\vjppd.exec:\vjppd.exe95⤵PID:2856
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe96⤵PID:2880
-
\??\c:\lfxxffl.exec:\lfxxffl.exe97⤵PID:304
-
\??\c:\7ntbhn.exec:\7ntbhn.exe98⤵PID:1296
-
\??\c:\nttbnt.exec:\nttbnt.exe99⤵PID:284
-
\??\c:\dvppd.exec:\dvppd.exe100⤵PID:2288
-
\??\c:\7lffrxr.exec:\7lffrxr.exe101⤵PID:2344
-
\??\c:\bthntn.exec:\bthntn.exe102⤵PID:316
-
\??\c:\hhtbhn.exec:\hhtbhn.exe103⤵PID:1700
-
\??\c:\9jvdj.exec:\9jvdj.exe104⤵PID:1572
-
\??\c:\flflrlx.exec:\flflrlx.exe105⤵PID:1152
-
\??\c:\hhtntt.exec:\hhtntt.exe106⤵PID:2940
-
\??\c:\hbnbtt.exec:\hbnbtt.exe107⤵PID:2312
-
\??\c:\3jvdj.exec:\3jvdj.exe108⤵PID:2180
-
\??\c:\flrlrrx.exec:\flrlrrx.exe109⤵PID:2936
-
\??\c:\1lffflr.exec:\1lffflr.exe110⤵PID:680
-
\??\c:\nhtbhh.exec:\nhtbhh.exe111⤵PID:1532
-
\??\c:\djppj.exec:\djppj.exe112⤵PID:584
-
\??\c:\xxxlrrr.exec:\xxxlrrr.exe113⤵PID:576
-
\??\c:\7bnbnn.exec:\7bnbnn.exe114⤵PID:2976
-
\??\c:\1dvdj.exec:\1dvdj.exe115⤵PID:1856
-
\??\c:\9lfrxfl.exec:\9lfrxfl.exe116⤵PID:936
-
\??\c:\nhtbbt.exec:\nhtbbt.exe117⤵PID:2236
-
\??\c:\dpdpp.exec:\dpdpp.exe118⤵PID:988
-
\??\c:\lfxlrrx.exec:\lfxlrrx.exe119⤵PID:2232
-
\??\c:\frlrrrf.exec:\frlrrrf.exe120⤵PID:852
-
\??\c:\hbthnn.exec:\hbthnn.exe121⤵PID:2620
-
\??\c:\dvpjp.exec:\dvpjp.exe122⤵PID:2616
-
\??\c:\xlxflfl.exec:\xlxflfl.exe123⤵PID:2996
-
\??\c:\bbthtb.exec:\bbthtb.exe124⤵PID:2748
-
\??\c:\1bntbb.exec:\1bntbb.exe125⤵PID:1544
-
\??\c:\djdjv.exec:\djdjv.exe126⤵PID:1128
-
\??\c:\lllxlxl.exec:\lllxlxl.exe127⤵PID:2736
-
\??\c:\9tnthn.exec:\9tnthn.exe128⤵PID:2724
-
\??\c:\5nhbhn.exec:\5nhbhn.exe129⤵PID:2836
-
\??\c:\jjdjd.exec:\jjdjd.exe130⤵PID:2840
-
\??\c:\vjvjv.exec:\vjvjv.exe131⤵PID:2544
-
\??\c:\rxrfflx.exec:\rxrfflx.exe132⤵PID:2708
-
\??\c:\btnthh.exec:\btnthh.exe133⤵PID:2556
-
\??\c:\pjjjp.exec:\pjjjp.exe134⤵PID:2788
-
\??\c:\vppdp.exec:\vppdp.exe135⤵PID:2612
-
\??\c:\1xxxlrx.exec:\1xxxlrx.exe136⤵PID:2176
-
\??\c:\tttthh.exec:\tttthh.exe137⤵PID:2712
-
\??\c:\thbhhn.exec:\thbhhn.exe138⤵PID:2804
-
\??\c:\djdpd.exec:\djdpd.exe139⤵PID:3016
-
\??\c:\xrrrxfr.exec:\xrrrxfr.exe140⤵PID:2980
-
\??\c:\rrfrxxl.exec:\rrfrxxl.exe141⤵PID:2024
-
\??\c:\bbbbhh.exec:\bbbbhh.exe142⤵PID:2016
-
\??\c:\jjjjp.exec:\jjjjp.exe143⤵PID:2340
-
\??\c:\rllxllr.exec:\rllxllr.exe144⤵PID:1704
-
\??\c:\xlffrrx.exec:\xlffrrx.exe145⤵PID:2512
-
\??\c:\7ttnbh.exec:\7ttnbh.exe146⤵PID:1760
-
\??\c:\dvjvj.exec:\dvjvj.exe147⤵PID:1692
-
\??\c:\3jpvd.exec:\3jpvd.exe148⤵PID:1768
-
\??\c:\rfxrffl.exec:\rfxrffl.exe149⤵PID:2884
-
\??\c:\1bhtht.exec:\1bhtht.exe150⤵PID:2904
-
\??\c:\bbtbtb.exec:\bbtbtb.exe151⤵PID:2284
-
\??\c:\pppdv.exec:\pppdv.exe152⤵PID:536
-
\??\c:\xrlxflx.exec:\xrlxflx.exe153⤵PID:784
-
\??\c:\9nttbh.exec:\9nttbh.exe154⤵PID:1264
-
\??\c:\nbthnt.exec:\nbthnt.exe155⤵PID:1168
-
\??\c:\dvpvd.exec:\dvpvd.exe156⤵PID:2200
-
\??\c:\rlllrxf.exec:\rlllrxf.exe157⤵PID:1636
-
\??\c:\fxrfrlx.exec:\fxrfrlx.exe158⤵PID:2040
-
\??\c:\nhbhnt.exec:\nhbhnt.exe159⤵PID:1276
-
\??\c:\jjjvp.exec:\jjjvp.exe160⤵PID:1892
-
\??\c:\jdvjv.exec:\jdvjv.exe161⤵PID:1860
-
\??\c:\lllrffr.exec:\lllrffr.exe162⤵PID:892
-
\??\c:\bbtthb.exec:\bbtthb.exe163⤵PID:2236
-
\??\c:\vvpdv.exec:\vvpdv.exe164⤵PID:988
-
\??\c:\dvppv.exec:\dvppv.exe165⤵PID:3036
-
\??\c:\fxlrllx.exec:\fxlrllx.exe166⤵PID:2300
-
\??\c:\tnhhbn.exec:\tnhhbn.exe167⤵PID:2620
-
\??\c:\bhbbhn.exec:\bhbbhn.exe168⤵PID:2616
-
\??\c:\7pjvd.exec:\7pjvd.exe169⤵PID:1256
-
\??\c:\5xlfrrf.exec:\5xlfrrf.exe170⤵PID:2748
-
\??\c:\thbthh.exec:\thbthh.exe171⤵PID:2628
-
\??\c:\thnbht.exec:\thnbht.exe172⤵PID:2764
-
\??\c:\pjvvp.exec:\pjvvp.exe173⤵PID:2688
-
\??\c:\rfxfffr.exec:\rfxfffr.exe174⤵PID:2720
-
\??\c:\ffxxrfr.exec:\ffxxrfr.exe175⤵PID:2564
-
\??\c:\nhtbtt.exec:\nhtbtt.exe176⤵PID:2668
-
\??\c:\1jjpd.exec:\1jjpd.exe177⤵PID:2536
-
\??\c:\fxllrxr.exec:\fxllrxr.exe178⤵PID:2584
-
\??\c:\fxrxflx.exec:\fxrxflx.exe179⤵PID:2208
-
\??\c:\1nhtbt.exec:\1nhtbt.exe180⤵PID:2580
-
\??\c:\vpjjd.exec:\vpjjd.exe181⤵PID:2028
-
\??\c:\vvppj.exec:\vvppj.exe182⤵PID:2808
-
\??\c:\1lxflll.exec:\1lxflll.exe183⤵PID:2888
-
\??\c:\nntthn.exec:\nntthn.exe184⤵PID:772
-
\??\c:\9hntbh.exec:\9hntbh.exe185⤵PID:620
-
\??\c:\pjjjv.exec:\pjjjv.exe186⤵PID:300
-
\??\c:\9lfflrf.exec:\9lfflrf.exe187⤵PID:1040
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe188⤵PID:2336
-
\??\c:\nttnnb.exec:\nttnnb.exe189⤵PID:1064
-
\??\c:\vddvp.exec:\vddvp.exe190⤵PID:2288
-
\??\c:\ppjvp.exec:\ppjvp.exe191⤵PID:2344
-
\??\c:\7fflrfl.exec:\7fflrfl.exe192⤵PID:1748
-
\??\c:\nnnnbt.exec:\nnnnbt.exe193⤵PID:2068
-
\??\c:\5nnhnb.exec:\5nnhnb.exe194⤵PID:1572
-
\??\c:\ppjvd.exec:\ppjvd.exe195⤵PID:2516
-
\??\c:\1fxxxxr.exec:\1fxxxxr.exe196⤵PID:2384
-
\??\c:\hbtbhn.exec:\hbtbhn.exe197⤵PID:1204
-
\??\c:\bbtbth.exec:\bbtbth.exe198⤵PID:868
-
\??\c:\jvppd.exec:\jvppd.exe199⤵PID:2308
-
\??\c:\xxrxffl.exec:\xxrxffl.exe200⤵PID:1496
-
\??\c:\nbhhnn.exec:\nbhhnn.exe201⤵PID:1532
-
\??\c:\7bbbnb.exec:\7bbbnb.exe202⤵PID:560
-
\??\c:\9vppv.exec:\9vppv.exe203⤵PID:576
-
\??\c:\3lfxfxf.exec:\3lfxfxf.exe204⤵PID:948
-
\??\c:\3rfflxr.exec:\3rfflxr.exe205⤵PID:1060
-
\??\c:\hhnbnt.exec:\hhnbnt.exe206⤵PID:1672
-
\??\c:\3vjjp.exec:\3vjjp.exe207⤵PID:2472
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe208⤵PID:2908
-
\??\c:\5xffffl.exec:\5xffffl.exe209⤵PID:2324
-
\??\c:\7hbhnn.exec:\7hbhnn.exe210⤵PID:876
-
\??\c:\tbnttt.exec:\tbnttt.exe211⤵PID:2160
-
\??\c:\dvpvp.exec:\dvpvp.exe212⤵PID:2296
-
\??\c:\lfrxfxf.exec:\lfrxfxf.exe213⤵PID:2264
-
\??\c:\5bnnnn.exec:\5bnnnn.exe214⤵PID:1616
-
\??\c:\hhnbnt.exec:\hhnbnt.exe215⤵PID:2144
-
\??\c:\vvpdp.exec:\vvpdp.exe216⤵PID:2240
-
\??\c:\xrrxlfr.exec:\xrrxlfr.exe217⤵PID:1128
-
\??\c:\btnbnn.exec:\btnbnn.exe218⤵PID:2736
-
\??\c:\thtbhh.exec:\thtbhh.exe219⤵PID:2684
-
\??\c:\jjvdp.exec:\jjvdp.exe220⤵PID:2760
-
\??\c:\3fflrxf.exec:\3fflrxf.exe221⤵PID:2824
-
\??\c:\ffxflfr.exec:\ffxflfr.exe222⤵PID:2740
-
\??\c:\tnhnbh.exec:\tnhnbh.exe223⤵PID:2820
-
\??\c:\jdvdp.exec:\jdvdp.exe224⤵PID:2576
-
\??\c:\7xxrxfl.exec:\7xxrxfl.exe225⤵PID:3024
-
\??\c:\xlfxffr.exec:\xlfxffr.exe226⤵PID:1792
-
\??\c:\nnntbb.exec:\nnntbb.exe227⤵PID:1884
-
\??\c:\7dvdp.exec:\7dvdp.exe228⤵PID:2892
-
\??\c:\ddpdj.exec:\ddpdj.exe229⤵PID:2744
-
\??\c:\xlffrrx.exec:\xlffrrx.exe230⤵PID:2860
-
\??\c:\9lffllr.exec:\9lffllr.exe231⤵PID:2880
-
\??\c:\nhbnbh.exec:\nhbnbh.exe232⤵PID:304
-
\??\c:\5pjpd.exec:\5pjpd.exe233⤵PID:1296
-
\??\c:\jdpjj.exec:\jdpjj.exe234⤵PID:1808
-
\??\c:\frllxlr.exec:\frllxlr.exe235⤵PID:1444
-
\??\c:\bbtbnt.exec:\bbtbnt.exe236⤵PID:2412
-
\??\c:\thtbnn.exec:\thtbnn.exe237⤵PID:2172
-
\??\c:\1jjpv.exec:\1jjpv.exe238⤵PID:1760
-
\??\c:\lfrxlll.exec:\lfrxlll.exe239⤵PID:1696
-
\??\c:\bbnhth.exec:\bbnhth.exe240⤵PID:2100
-
\??\c:\3htbhh.exec:\3htbhh.exe241⤵PID:1572
-
\??\c:\5jjpp.exec:\5jjpp.exe242⤵PID:2516