Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 21:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
047c34d2d7aac1e59f107f952c756310_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
047c34d2d7aac1e59f107f952c756310_NeikiAnalytics.exe
-
Size
286KB
-
MD5
047c34d2d7aac1e59f107f952c756310
-
SHA1
fab1823e9daf7f73aa033a58008601d90f179275
-
SHA256
cfb9d3e8558a264290e1ab9b8ec69cd280ed46e5f6ea48436a9a58de8e908ec9
-
SHA512
0a0197517df0e997c3c2ce3dac8a50c8016209dfda9fbc4fb2a226c068f9a8e4fb3cec3c354e19f395c90a22f7d67021ae106c19cfe5caf9988fa09285af1e29
-
SSDEEP
3072:ThOm2sI93UufdC67cipfmCiiiXAQ5lpBoGYwNNhu0CzhKPJFj:Tcm7ImGddXlWrXF5lpKGYV0wh6J5
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2988-7-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2124-17-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2144-30-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2676-48-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2728-45-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1136-57-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2992-67-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2752-75-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2596-86-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2964-101-0x0000000000220000-0x000000000024B000-memory.dmp family_blackmoon behavioral1/memory/1620-111-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1500-122-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1060-130-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2448-141-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2196-150-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2256-159-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/604-176-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2200-184-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2368-196-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2268-210-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1352-242-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2332-262-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/796-286-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2864-334-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/3044-335-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/3044-338-0x0000000000220000-0x000000000024B000-memory.dmp family_blackmoon behavioral1/memory/1680-361-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1948-427-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1716-492-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1320-524-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2908-575-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2964-687-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1500-701-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/468-710-0x00000000002B0000-0x00000000002DB000-memory.dmp family_blackmoon behavioral1/memory/1692-722-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2952-779-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2952-774-0x0000000000220000-0x000000000024B000-memory.dmp family_blackmoon behavioral1/memory/1820-804-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1648-1006-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1624-1020-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2012-1131-0x00000000005C0000-0x00000000005EB000-memory.dmp family_blackmoon behavioral1/memory/2876-1209-0x0000000000220000-0x000000000024B000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2124 vpjpd.exe 2468 rrlxrrl.exe 2144 vvjdp.exe 2728 ddjvj.exe 2676 3nnbhn.exe 1136 1pvdd.exe 2992 rrxllrf.exe 2752 tbtbnt.exe 2596 vvjvv.exe 2964 fxlrlrf.exe 1620 tbbbbn.exe 1500 xlflrrx.exe 1060 nnnthn.exe 2448 jdpvj.exe 2196 nnbbnb.exe 2256 ppjpv.exe 1256 fflffxr.exe 604 5bthbn.exe 2200 jjppv.exe 640 nhbnbh.exe 2368 ppjpj.exe 2268 7llrlxf.exe 2376 hnbntt.exe 2320 pdvpd.exe 1320 7bnbnb.exe 1352 jppdp.exe 1412 bbthhb.exe 1824 vdvjv.exe 2332 xxrfxlr.exe 2084 1hbbht.exe 796 rrflxxl.exe 1880 btnbnb.exe 2868 dppvv.exe 1688 5xflxfl.exe 2488 nhhnnb.exe 1728 vjdjv.exe 2848 fflfxlx.exe 2864 tnnbth.exe 3044 bhnhbn.exe 2876 vvddp.exe 3064 rxflflf.exe 2780 tthnhh.exe 1680 9hnnth.exe 2992 ppdjv.exe 2588 fxlxrrl.exe 2948 btnbnt.exe 2572 pddvv.exe 820 1frfrfx.exe 1536 rlrlfxx.exe 2584 hhhnnb.exe 1800 5vvjv.exe 1948 xrlflxf.exe 2432 bbbthh.exe 316 9vvjv.exe 2244 7ddjp.exe 2844 rxxllll.exe 1512 nbthtb.exe 484 pjvpp.exe 604 xrfllrf.exe 2932 7tntnb.exe 1772 bttbnn.exe 1716 jjppp.exe 2368 xrflrfr.exe 2716 7rrffrx.exe -
resource yara_rule behavioral1/memory/2988-0-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2988-7-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2124-9-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2124-17-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2144-30-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2676-48-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2728-45-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1136-57-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2992-67-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2752-75-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2596-86-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2752-82-0x0000000000220000-0x000000000024B000-memory.dmp upx behavioral1/memory/1620-111-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1500-113-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1500-122-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1060-130-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2448-141-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2196-150-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2256-159-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/604-176-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2200-184-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2368-196-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2268-210-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1352-242-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2332-262-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/796-286-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1880-287-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2868-296-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2488-309-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2864-334-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/3044-335-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1680-361-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1680-364-0x0000000000220000-0x000000000024B000-memory.dmp upx behavioral1/memory/2992-369-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2588-376-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2584-407-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1948-427-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2432-428-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1716-492-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1492-516-0x00000000002A0000-0x00000000002CB000-memory.dmp upx behavioral1/memory/1320-524-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/568-549-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/568-555-0x0000000000220000-0x000000000024B000-memory.dmp upx behavioral1/memory/2908-575-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2964-687-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1500-701-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/468-710-0x00000000002B0000-0x00000000002DB000-memory.dmp upx behavioral1/memory/1692-722-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1444-753-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2952-779-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2952-774-0x0000000000220000-0x000000000024B000-memory.dmp upx behavioral1/memory/1820-804-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2740-907-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2724-922-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2788-935-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1628-967-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/812-999-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1648-1006-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1628-1013-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1624-1020-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2232-1033-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2476-1058-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/912-1083-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2012-1131-0x00000000005C0000-0x00000000005EB000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2124 2988 047c34d2d7aac1e59f107f952c756310_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 2124 2988 047c34d2d7aac1e59f107f952c756310_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 2124 2988 047c34d2d7aac1e59f107f952c756310_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 2124 2988 047c34d2d7aac1e59f107f952c756310_NeikiAnalytics.exe 28 PID 2124 wrote to memory of 2468 2124 vpjpd.exe 29 PID 2124 wrote to memory of 2468 2124 vpjpd.exe 29 PID 2124 wrote to memory of 2468 2124 vpjpd.exe 29 PID 2124 wrote to memory of 2468 2124 vpjpd.exe 29 PID 2468 wrote to memory of 2144 2468 rrlxrrl.exe 30 PID 2468 wrote to memory of 2144 2468 rrlxrrl.exe 30 PID 2468 wrote to memory of 2144 2468 rrlxrrl.exe 30 PID 2468 wrote to memory of 2144 2468 rrlxrrl.exe 30 PID 2144 wrote to memory of 2728 2144 vvjdp.exe 31 PID 2144 wrote to memory of 2728 2144 vvjdp.exe 31 PID 2144 wrote to memory of 2728 2144 vvjdp.exe 31 PID 2144 wrote to memory of 2728 2144 vvjdp.exe 31 PID 2728 wrote to memory of 2676 2728 ddjvj.exe 32 PID 2728 wrote to memory of 2676 2728 ddjvj.exe 32 PID 2728 wrote to memory of 2676 2728 ddjvj.exe 32 PID 2728 wrote to memory of 2676 2728 ddjvj.exe 32 PID 2676 wrote to memory of 1136 2676 3nnbhn.exe 33 PID 2676 wrote to memory of 1136 2676 3nnbhn.exe 33 PID 2676 wrote to memory of 1136 2676 3nnbhn.exe 33 PID 2676 wrote to memory of 1136 2676 3nnbhn.exe 33 PID 1136 wrote to memory of 2992 1136 1pvdd.exe 34 PID 1136 wrote to memory of 2992 1136 1pvdd.exe 34 PID 1136 wrote to memory of 2992 1136 1pvdd.exe 34 PID 1136 wrote to memory of 2992 1136 1pvdd.exe 34 PID 2992 wrote to memory of 2752 2992 rrxllrf.exe 35 PID 2992 wrote to memory of 2752 2992 rrxllrf.exe 35 PID 2992 wrote to memory of 2752 2992 rrxllrf.exe 35 PID 2992 wrote to memory of 2752 2992 rrxllrf.exe 35 PID 2752 wrote to memory of 2596 2752 tbtbnt.exe 36 PID 2752 wrote to memory of 2596 2752 tbtbnt.exe 36 PID 2752 wrote to memory of 2596 2752 tbtbnt.exe 36 PID 2752 wrote to memory of 2596 2752 tbtbnt.exe 36 PID 2596 wrote to memory of 2964 2596 vvjvv.exe 37 PID 2596 wrote to memory of 2964 2596 vvjvv.exe 37 PID 2596 wrote to memory of 2964 2596 vvjvv.exe 37 PID 2596 wrote to memory of 2964 2596 vvjvv.exe 37 PID 2964 wrote to memory of 1620 2964 fxlrlrf.exe 38 PID 2964 wrote to memory of 1620 2964 fxlrlrf.exe 38 PID 2964 wrote to memory of 1620 2964 fxlrlrf.exe 38 PID 2964 wrote to memory of 1620 2964 fxlrlrf.exe 38 PID 1620 wrote to memory of 1500 1620 tbbbbn.exe 39 PID 1620 wrote to memory of 1500 1620 tbbbbn.exe 39 PID 1620 wrote to memory of 1500 1620 tbbbbn.exe 39 PID 1620 wrote to memory of 1500 1620 tbbbbn.exe 39 PID 1500 wrote to memory of 1060 1500 xlflrrx.exe 40 PID 1500 wrote to memory of 1060 1500 xlflrrx.exe 40 PID 1500 wrote to memory of 1060 1500 xlflrrx.exe 40 PID 1500 wrote to memory of 1060 1500 xlflrrx.exe 40 PID 1060 wrote to memory of 2448 1060 nnnthn.exe 41 PID 1060 wrote to memory of 2448 1060 nnnthn.exe 41 PID 1060 wrote to memory of 2448 1060 nnnthn.exe 41 PID 1060 wrote to memory of 2448 1060 nnnthn.exe 41 PID 2448 wrote to memory of 2196 2448 jdpvj.exe 42 PID 2448 wrote to memory of 2196 2448 jdpvj.exe 42 PID 2448 wrote to memory of 2196 2448 jdpvj.exe 42 PID 2448 wrote to memory of 2196 2448 jdpvj.exe 42 PID 2196 wrote to memory of 2256 2196 nnbbnb.exe 43 PID 2196 wrote to memory of 2256 2196 nnbbnb.exe 43 PID 2196 wrote to memory of 2256 2196 nnbbnb.exe 43 PID 2196 wrote to memory of 2256 2196 nnbbnb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\047c34d2d7aac1e59f107f952c756310_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\047c34d2d7aac1e59f107f952c756310_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\vpjpd.exec:\vpjpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\rrlxrrl.exec:\rrlxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\vvjdp.exec:\vvjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\ddjvj.exec:\ddjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\3nnbhn.exec:\3nnbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\1pvdd.exec:\1pvdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\rrxllrf.exec:\rrxllrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\tbtbnt.exec:\tbtbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\vvjvv.exec:\vvjvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\fxlrlrf.exec:\fxlrlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\tbbbbn.exec:\tbbbbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\xlflrrx.exec:\xlflrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\nnnthn.exec:\nnnthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\jdpvj.exec:\jdpvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\nnbbnb.exec:\nnbbnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\ppjpv.exec:\ppjpv.exe17⤵
- Executes dropped EXE
PID:2256 -
\??\c:\fflffxr.exec:\fflffxr.exe18⤵
- Executes dropped EXE
PID:1256 -
\??\c:\5bthbn.exec:\5bthbn.exe19⤵
- Executes dropped EXE
PID:604 -
\??\c:\jjppv.exec:\jjppv.exe20⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nhbnbh.exec:\nhbnbh.exe21⤵
- Executes dropped EXE
PID:640 -
\??\c:\ppjpj.exec:\ppjpj.exe22⤵
- Executes dropped EXE
PID:2368 -
\??\c:\7llrlxf.exec:\7llrlxf.exe23⤵
- Executes dropped EXE
PID:2268 -
\??\c:\hnbntt.exec:\hnbntt.exe24⤵
- Executes dropped EXE
PID:2376 -
\??\c:\pdvpd.exec:\pdvpd.exe25⤵
- Executes dropped EXE
PID:2320 -
\??\c:\7bnbnb.exec:\7bnbnb.exe26⤵
- Executes dropped EXE
PID:1320 -
\??\c:\jppdp.exec:\jppdp.exe27⤵
- Executes dropped EXE
PID:1352 -
\??\c:\bbthhb.exec:\bbthhb.exe28⤵
- Executes dropped EXE
PID:1412 -
\??\c:\vdvjv.exec:\vdvjv.exe29⤵
- Executes dropped EXE
PID:1824 -
\??\c:\xxrfxlr.exec:\xxrfxlr.exe30⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1hbbht.exec:\1hbbht.exe31⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rrflxxl.exec:\rrflxxl.exe32⤵
- Executes dropped EXE
PID:796 -
\??\c:\btnbnb.exec:\btnbnb.exe33⤵
- Executes dropped EXE
PID:1880 -
\??\c:\dppvv.exec:\dppvv.exe34⤵
- Executes dropped EXE
PID:2868 -
\??\c:\5xflxfl.exec:\5xflxfl.exe35⤵
- Executes dropped EXE
PID:1688 -
\??\c:\nhhnnb.exec:\nhhnnb.exe36⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vjdjv.exec:\vjdjv.exe37⤵
- Executes dropped EXE
PID:1728 -
\??\c:\fflfxlx.exec:\fflfxlx.exe38⤵
- Executes dropped EXE
PID:2848 -
\??\c:\tnnbth.exec:\tnnbth.exe39⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bhnhbn.exec:\bhnhbn.exe40⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vvddp.exec:\vvddp.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rxflflf.exec:\rxflflf.exe42⤵
- Executes dropped EXE
PID:3064 -
\??\c:\tthnhh.exec:\tthnhh.exe43⤵
- Executes dropped EXE
PID:2780 -
\??\c:\9hnnth.exec:\9hnnth.exe44⤵
- Executes dropped EXE
PID:1680 -
\??\c:\ppdjv.exec:\ppdjv.exe45⤵
- Executes dropped EXE
PID:2992 -
\??\c:\fxlxrrl.exec:\fxlxrrl.exe46⤵
- Executes dropped EXE
PID:2588 -
\??\c:\btnbnt.exec:\btnbnt.exe47⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pddvv.exec:\pddvv.exe48⤵
- Executes dropped EXE
PID:2572 -
\??\c:\1frfrfx.exec:\1frfrfx.exe49⤵
- Executes dropped EXE
PID:820 -
\??\c:\rlrlfxx.exec:\rlrlfxx.exe50⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hhhnnb.exec:\hhhnnb.exe51⤵
- Executes dropped EXE
PID:2584 -
\??\c:\5vvjv.exec:\5vvjv.exe52⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xrlflxf.exec:\xrlflxf.exe53⤵
- Executes dropped EXE
PID:1948 -
\??\c:\bbbthh.exec:\bbbthh.exe54⤵
- Executes dropped EXE
PID:2432 -
\??\c:\9vvjv.exec:\9vvjv.exe55⤵
- Executes dropped EXE
PID:316 -
\??\c:\7ddjp.exec:\7ddjp.exe56⤵
- Executes dropped EXE
PID:2244 -
\??\c:\rxxllll.exec:\rxxllll.exe57⤵
- Executes dropped EXE
PID:2844 -
\??\c:\nbthtb.exec:\nbthtb.exe58⤵
- Executes dropped EXE
PID:1512 -
\??\c:\pjvpp.exec:\pjvpp.exe59⤵
- Executes dropped EXE
PID:484 -
\??\c:\xrfllrf.exec:\xrfllrf.exe60⤵
- Executes dropped EXE
PID:604 -
\??\c:\7tntnb.exec:\7tntnb.exe61⤵
- Executes dropped EXE
PID:2932 -
\??\c:\bttbnn.exec:\bttbnn.exe62⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jjppp.exec:\jjppp.exe63⤵
- Executes dropped EXE
PID:1716 -
\??\c:\xrflrfr.exec:\xrflrfr.exe64⤵
- Executes dropped EXE
PID:2368 -
\??\c:\7rrffrx.exec:\7rrffrx.exe65⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nhbhnn.exec:\nhbhnn.exe66⤵PID:2324
-
\??\c:\nbntnt.exec:\nbntnt.exe67⤵PID:1492
-
\??\c:\7jvvj.exec:\7jvvj.exe68⤵PID:556
-
\??\c:\1xllxxl.exec:\1xllxxl.exe69⤵PID:1320
-
\??\c:\ttnbnb.exec:\ttnbnb.exe70⤵PID:1528
-
\??\c:\1nbhtt.exec:\1nbhtt.exe71⤵PID:1412
-
\??\c:\1djvd.exec:\1djvd.exe72⤵PID:1296
-
\??\c:\vpjvd.exec:\vpjvd.exe73⤵PID:568
-
\??\c:\5lffxrf.exec:\5lffxrf.exe74⤵PID:2016
-
\??\c:\7tnbnt.exec:\7tnbnt.exe75⤵PID:1928
-
\??\c:\3pvjj.exec:\3pvjj.exe76⤵PID:3016
-
\??\c:\5vjvd.exec:\5vjvd.exe77⤵PID:2908
-
\??\c:\llfxxrx.exec:\llfxxrx.exe78⤵PID:2492
-
\??\c:\nbnnnn.exec:\nbnnnn.exe79⤵PID:2868
-
\??\c:\hhbthh.exec:\hhbthh.exe80⤵PID:2988
-
\??\c:\dvjpp.exec:\dvjpp.exe81⤵PID:1564
-
\??\c:\rxlxlff.exec:\rxlxlff.exe82⤵PID:2796
-
\??\c:\1rrfllx.exec:\1rrfllx.exe83⤵PID:2848
-
\??\c:\bnnhhn.exec:\bnnhhn.exe84⤵PID:2632
-
\??\c:\dvppv.exec:\dvppv.exe85⤵PID:3044
-
\??\c:\fxrxrfr.exec:\fxrxrfr.exe86⤵PID:2676
-
\??\c:\xrfxxxl.exec:\xrfxxxl.exe87⤵PID:2680
-
\??\c:\bbnhtt.exec:\bbnhtt.exe88⤵PID:2788
-
\??\c:\3btthn.exec:\3btthn.exe89⤵PID:2712
-
\??\c:\jvvvd.exec:\jvvvd.exe90⤵PID:2688
-
\??\c:\xlxxxff.exec:\xlxxxff.exe91⤵PID:2208
-
\??\c:\3thhhb.exec:\3thhhb.exe92⤵PID:2944
-
\??\c:\btbhnb.exec:\btbhnb.exe93⤵PID:2416
-
\??\c:\djvpv.exec:\djvpv.exe94⤵PID:2964
-
\??\c:\flrflfx.exec:\flrflfx.exe95⤵PID:1924
-
\??\c:\9thtbt.exec:\9thtbt.exe96⤵PID:2708
-
\??\c:\pjdjj.exec:\pjdjj.exe97⤵PID:1500
-
\??\c:\pjvdd.exec:\pjvdd.exe98⤵PID:468
-
\??\c:\xxrrlxr.exec:\xxrrlxr.exe99⤵PID:1692
-
\??\c:\7nthnt.exec:\7nthnt.exe100⤵PID:1792
-
\??\c:\5vjvd.exec:\5vjvd.exe101⤵PID:2236
-
\??\c:\xfxllrr.exec:\xfxllrr.exe102⤵PID:1072
-
\??\c:\1nbhbn.exec:\1nbhbn.exe103⤵PID:584
-
\??\c:\vvvjv.exec:\vvvjv.exe104⤵PID:1700
-
\??\c:\5jppv.exec:\5jppv.exe105⤵PID:1444
-
\??\c:\lfxfxrl.exec:\lfxfxrl.exe106⤵PID:1332
-
\??\c:\bbbhbb.exec:\bbbhbb.exe107⤵PID:640
-
\??\c:\nnhbtn.exec:\nnhbtn.exe108⤵PID:2952
-
\??\c:\pppdj.exec:\pppdj.exe109⤵PID:2276
-
\??\c:\lfxlxlr.exec:\lfxlxlr.exe110⤵PID:2872
-
\??\c:\ttbhbh.exec:\ttbhbh.exe111⤵PID:2376
-
\??\c:\nnbhtt.exec:\nnbhtt.exe112⤵PID:2328
-
\??\c:\jjddv.exec:\jjddv.exe113⤵PID:1820
-
\??\c:\ddjdp.exec:\ddjdp.exe114⤵PID:1840
-
\??\c:\hbnthn.exec:\hbnthn.exe115⤵PID:1876
-
\??\c:\nhhbht.exec:\nhhbht.exe116⤵PID:1344
-
\??\c:\ppjpj.exec:\ppjpj.exe117⤵PID:888
-
\??\c:\vvpdp.exec:\vvpdp.exe118⤵PID:1160
-
\??\c:\rrrxlrf.exec:\rrrxlrf.exe119⤵PID:1516
-
\??\c:\nthhnn.exec:\nthhnn.exe120⤵PID:1452
-
\??\c:\hhhnnt.exec:\hhhnnt.exe121⤵PID:900
-
\??\c:\ddvjj.exec:\ddvjj.exe122⤵PID:3004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-