Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 13:55
Behavioral task
behavioral1
Sample
d2fa1cc12a609057ce2e036a938048b0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d2fa1cc12a609057ce2e036a938048b0_NeikiAnalytics.exe
-
Size
71KB
-
MD5
d2fa1cc12a609057ce2e036a938048b0
-
SHA1
2af2a42de1c0205088c378fbecf7b5fe90c2a5a8
-
SHA256
197fe983cc8f3cbc27ffca81f3a8d967a22f404dbbeec71b853cccf035834229
-
SHA512
10a3e0b93afe2fb9e72d9e49c2178a8a3153bbc35d9398bbb40adbb6ab47a8eced65d639dddbd821bbb71e85cdeb9229aa368c83b52d5f55096d5c9deae7cda1
-
SSDEEP
1536:NvQBeOGtrYS3srx93UBWfwC6Ggnouy8KlAXmAXIBG/+WIFuTKLXvCB5yAXNlIQkB:NhOmTsF93UYfwC6GIoutOP/WWGKL/SYf
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/956-7-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2468-18-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2796-27-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2648-37-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2876-48-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2792-64-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2540-82-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2788-97-0x00000000001B0000-0x00000000001E3000-memory.dmp family_blackmoon behavioral1/memory/2788-99-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1952-107-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1920-117-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2772-125-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/236-135-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/628-143-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2412-152-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1652-156-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/1652-161-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1224-171-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1892-180-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2136-190-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2884-205-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1484-232-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2912-260-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1056-292-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2652-318-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2612-331-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2780-351-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1932-385-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2896-473-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1704-523-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2140-582-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1792-638-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1988-688-0x00000000001B0000-0x00000000001E3000-memory.dmp family_blackmoon behavioral1/memory/1960-720-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2444-789-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2116-853-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/1984-926-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1700-1093-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2240-1102-0x00000000002E0000-0x0000000000313000-memory.dmp family_blackmoon behavioral1/memory/2872-1140-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2468 vpjvp.exe 2796 nhbbnh.exe 2648 jddpd.exe 2364 9dvjd.exe 2876 lrrrrxx.exe 2792 3ttnbh.exe 2852 dvpdv.exe 2560 vdppj.exe 2540 flxfflx.exe 2788 ttntht.exe 1952 5nhntn.exe 1920 dvjvj.exe 2772 xrrlxlr.exe 236 bthhht.exe 628 9dvdp.exe 2412 jdvpd.exe 1652 xrffrrx.exe 1224 hthbtb.exe 1892 dvpdp.exe 3060 ppdpd.exe 2136 xxlrfrf.exe 2884 5hhtbh.exe 2264 3pjvd.exe 1080 9xlxffr.exe 1484 ffxxflf.exe 976 tnhbbh.exe 2232 vpvdp.exe 1776 lfxrlrf.exe 2912 llrlxfl.exe 1332 nnnthn.exe 2200 ddjpd.exe 1056 5xxlrxl.exe 2308 btnbtb.exe 2140 hhhbht.exe 2800 jdvdp.exe 2796 1ddjv.exe 2652 rrlrxfr.exe 2612 xfxlfll.exe 2252 bthnbh.exe 2776 5ddpj.exe 2780 1jjvj.exe 3000 7xlrxfl.exe 2524 xrfrllx.exe 548 nbtthn.exe 1360 bbbhnn.exe 268 9nhtnb.exe 1932 ppjvj.exe 1432 lxfxrfr.exe 2680 7lfrffl.exe 2740 nhhtnb.exe 1988 bntbhb.exe 1324 1dpvv.exe 2428 jdvdp.exe 2436 lffllrx.exe 1648 rlxlffr.exe 1876 tththn.exe 1868 jddjp.exe 1880 pjvdv.exe 2840 llrxlrf.exe 2896 rlfxfrx.exe 1744 btntbb.exe 536 5nttht.exe 2704 5vvdj.exe 1108 lfxflxf.exe -
resource yara_rule behavioral1/memory/956-0-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/956-7-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x000f000000012028-5.dat upx behavioral1/memory/2468-10-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2468-18-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x00360000000144c0-17.dat upx behavioral1/files/0x0007000000014723-25.dat upx behavioral1/memory/2648-28-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2796-27-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2648-37-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x000700000001472b-36.dat upx behavioral1/files/0x000700000001473f-44.dat upx behavioral1/memory/2876-48-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0007000000014749-54.dat upx behavioral1/memory/2792-55-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0008000000014a10-62.dat upx behavioral1/memory/2792-64-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0007000000015b6e-72.dat upx behavioral1/files/0x0006000000015cdf-80.dat upx behavioral1/memory/2540-82-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000015ce8-89.dat upx behavioral1/memory/2788-97-0x00000000001B0000-0x00000000001E3000-memory.dmp upx behavioral1/memory/2788-99-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000015cf0-98.dat upx behavioral1/memory/1952-107-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000015d08-108.dat upx behavioral1/files/0x0006000000015d12-115.dat upx behavioral1/memory/1920-117-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2772-125-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000015d24-126.dat upx behavioral1/files/0x0006000000015d3b-132.dat upx behavioral1/memory/236-135-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000015d53-144.dat upx behavioral1/memory/628-143-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000015d73-151.dat upx behavioral1/memory/2412-152-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000015d7b-162.dat upx behavioral1/memory/1652-161-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000015d83-169.dat upx behavioral1/memory/1224-171-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000015d90-178.dat upx behavioral1/memory/1892-180-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000015d9f-186.dat upx behavioral1/memory/2136-190-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000015dca-197.dat upx behavioral1/files/0x0006000000015e1d-206.dat upx behavioral1/memory/2884-205-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2264-207-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000015f73-214.dat upx behavioral1/files/0x0006000000015fef-222.dat upx behavioral1/files/0x000600000001611e-231.dat upx behavioral1/memory/1484-232-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x000600000001615c-240.dat upx behavioral1/memory/2232-241-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x00060000000162e4-250.dat upx behavioral1/files/0x0036000000014531-258.dat upx behavioral1/memory/2912-260-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000016455-267.dat upx behavioral1/files/0x0006000000016581-276.dat upx behavioral1/files/0x00060000000165e1-284.dat upx behavioral1/memory/1056-292-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2140-299-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2652-318-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2612-331-0x0000000000400000-0x0000000000433000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 956 wrote to memory of 2468 956 d2fa1cc12a609057ce2e036a938048b0_NeikiAnalytics.exe 29 PID 956 wrote to memory of 2468 956 d2fa1cc12a609057ce2e036a938048b0_NeikiAnalytics.exe 29 PID 956 wrote to memory of 2468 956 d2fa1cc12a609057ce2e036a938048b0_NeikiAnalytics.exe 29 PID 956 wrote to memory of 2468 956 d2fa1cc12a609057ce2e036a938048b0_NeikiAnalytics.exe 29 PID 2468 wrote to memory of 2796 2468 vpjvp.exe 30 PID 2468 wrote to memory of 2796 2468 vpjvp.exe 30 PID 2468 wrote to memory of 2796 2468 vpjvp.exe 30 PID 2468 wrote to memory of 2796 2468 vpjvp.exe 30 PID 2796 wrote to memory of 2648 2796 nhbbnh.exe 31 PID 2796 wrote to memory of 2648 2796 nhbbnh.exe 31 PID 2796 wrote to memory of 2648 2796 nhbbnh.exe 31 PID 2796 wrote to memory of 2648 2796 nhbbnh.exe 31 PID 2648 wrote to memory of 2364 2648 jddpd.exe 32 PID 2648 wrote to memory of 2364 2648 jddpd.exe 32 PID 2648 wrote to memory of 2364 2648 jddpd.exe 32 PID 2648 wrote to memory of 2364 2648 jddpd.exe 32 PID 2364 wrote to memory of 2876 2364 9dvjd.exe 33 PID 2364 wrote to memory of 2876 2364 9dvjd.exe 33 PID 2364 wrote to memory of 2876 2364 9dvjd.exe 33 PID 2364 wrote to memory of 2876 2364 9dvjd.exe 33 PID 2876 wrote to memory of 2792 2876 lrrrrxx.exe 34 PID 2876 wrote to memory of 2792 2876 lrrrrxx.exe 34 PID 2876 wrote to memory of 2792 2876 lrrrrxx.exe 34 PID 2876 wrote to memory of 2792 2876 lrrrrxx.exe 34 PID 2792 wrote to memory of 2852 2792 3ttnbh.exe 35 PID 2792 wrote to memory of 2852 2792 3ttnbh.exe 35 PID 2792 wrote to memory of 2852 2792 3ttnbh.exe 35 PID 2792 wrote to memory of 2852 2792 3ttnbh.exe 35 PID 2852 wrote to memory of 2560 2852 dvpdv.exe 36 PID 2852 wrote to memory of 2560 2852 dvpdv.exe 36 PID 2852 wrote to memory of 2560 2852 dvpdv.exe 36 PID 2852 wrote to memory of 2560 2852 dvpdv.exe 36 PID 2560 wrote to memory of 2540 2560 vdppj.exe 37 PID 2560 wrote to memory of 2540 2560 vdppj.exe 37 PID 2560 wrote to memory of 2540 2560 vdppj.exe 37 PID 2560 wrote to memory of 2540 2560 vdppj.exe 37 PID 2540 wrote to memory of 2788 2540 flxfflx.exe 38 PID 2540 wrote to memory of 2788 2540 flxfflx.exe 38 PID 2540 wrote to memory of 2788 2540 flxfflx.exe 38 PID 2540 wrote to memory of 2788 2540 flxfflx.exe 38 PID 2788 wrote to memory of 1952 2788 ttntht.exe 39 PID 2788 wrote to memory of 1952 2788 ttntht.exe 39 PID 2788 wrote to memory of 1952 2788 ttntht.exe 39 PID 2788 wrote to memory of 1952 2788 ttntht.exe 39 PID 1952 wrote to memory of 1920 1952 5nhntn.exe 40 PID 1952 wrote to memory of 1920 1952 5nhntn.exe 40 PID 1952 wrote to memory of 1920 1952 5nhntn.exe 40 PID 1952 wrote to memory of 1920 1952 5nhntn.exe 40 PID 1920 wrote to memory of 2772 1920 dvjvj.exe 41 PID 1920 wrote to memory of 2772 1920 dvjvj.exe 41 PID 1920 wrote to memory of 2772 1920 dvjvj.exe 41 PID 1920 wrote to memory of 2772 1920 dvjvj.exe 41 PID 2772 wrote to memory of 236 2772 xrrlxlr.exe 42 PID 2772 wrote to memory of 236 2772 xrrlxlr.exe 42 PID 2772 wrote to memory of 236 2772 xrrlxlr.exe 42 PID 2772 wrote to memory of 236 2772 xrrlxlr.exe 42 PID 236 wrote to memory of 628 236 bthhht.exe 43 PID 236 wrote to memory of 628 236 bthhht.exe 43 PID 236 wrote to memory of 628 236 bthhht.exe 43 PID 236 wrote to memory of 628 236 bthhht.exe 43 PID 628 wrote to memory of 2412 628 9dvdp.exe 44 PID 628 wrote to memory of 2412 628 9dvdp.exe 44 PID 628 wrote to memory of 2412 628 9dvdp.exe 44 PID 628 wrote to memory of 2412 628 9dvdp.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2fa1cc12a609057ce2e036a938048b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d2fa1cc12a609057ce2e036a938048b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\vpjvp.exec:\vpjvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\nhbbnh.exec:\nhbbnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\jddpd.exec:\jddpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\9dvjd.exec:\9dvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\lrrrrxx.exec:\lrrrrxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\3ttnbh.exec:\3ttnbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\dvpdv.exec:\dvpdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\vdppj.exec:\vdppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\flxfflx.exec:\flxfflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\ttntht.exec:\ttntht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\5nhntn.exec:\5nhntn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\dvjvj.exec:\dvjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\xrrlxlr.exec:\xrrlxlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\bthhht.exec:\bthhht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
\??\c:\9dvdp.exec:\9dvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\jdvpd.exec:\jdvpd.exe17⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xrffrrx.exec:\xrffrrx.exe18⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hthbtb.exec:\hthbtb.exe19⤵
- Executes dropped EXE
PID:1224 -
\??\c:\dvpdp.exec:\dvpdp.exe20⤵
- Executes dropped EXE
PID:1892 -
\??\c:\ppdpd.exec:\ppdpd.exe21⤵
- Executes dropped EXE
PID:3060 -
\??\c:\xxlrfrf.exec:\xxlrfrf.exe22⤵
- Executes dropped EXE
PID:2136 -
\??\c:\5hhtbh.exec:\5hhtbh.exe23⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3pjvd.exec:\3pjvd.exe24⤵
- Executes dropped EXE
PID:2264 -
\??\c:\9xlxffr.exec:\9xlxffr.exe25⤵
- Executes dropped EXE
PID:1080 -
\??\c:\ffxxflf.exec:\ffxxflf.exe26⤵
- Executes dropped EXE
PID:1484 -
\??\c:\tnhbbh.exec:\tnhbbh.exe27⤵
- Executes dropped EXE
PID:976 -
\??\c:\vpvdp.exec:\vpvdp.exe28⤵
- Executes dropped EXE
PID:2232 -
\??\c:\lfxrlrf.exec:\lfxrlrf.exe29⤵
- Executes dropped EXE
PID:1776 -
\??\c:\llrlxfl.exec:\llrlxfl.exe30⤵
- Executes dropped EXE
PID:2912 -
\??\c:\nnnthn.exec:\nnnthn.exe31⤵
- Executes dropped EXE
PID:1332 -
\??\c:\ddjpd.exec:\ddjpd.exe32⤵
- Executes dropped EXE
PID:2200 -
\??\c:\5xxlrxl.exec:\5xxlrxl.exe33⤵
- Executes dropped EXE
PID:1056 -
\??\c:\btnbtb.exec:\btnbtb.exe34⤵
- Executes dropped EXE
PID:2308 -
\??\c:\hhhbht.exec:\hhhbht.exe35⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jdvdp.exec:\jdvdp.exe36⤵
- Executes dropped EXE
PID:2800 -
\??\c:\1ddjv.exec:\1ddjv.exe37⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rrlrxfr.exec:\rrlrxfr.exe38⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xfxlfll.exec:\xfxlfll.exe39⤵
- Executes dropped EXE
PID:2612 -
\??\c:\bthnbh.exec:\bthnbh.exe40⤵
- Executes dropped EXE
PID:2252 -
\??\c:\5ddpj.exec:\5ddpj.exe41⤵
- Executes dropped EXE
PID:2776 -
\??\c:\1jjvj.exec:\1jjvj.exe42⤵
- Executes dropped EXE
PID:2780 -
\??\c:\7xlrxfl.exec:\7xlrxfl.exe43⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xrfrllx.exec:\xrfrllx.exe44⤵
- Executes dropped EXE
PID:2524 -
\??\c:\nbtthn.exec:\nbtthn.exe45⤵
- Executes dropped EXE
PID:548 -
\??\c:\bbbhnn.exec:\bbbhnn.exe46⤵
- Executes dropped EXE
PID:1360 -
\??\c:\9nhtnb.exec:\9nhtnb.exe47⤵
- Executes dropped EXE
PID:268 -
\??\c:\ppjvj.exec:\ppjvj.exe48⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lxfxrfr.exec:\lxfxrfr.exe49⤵
- Executes dropped EXE
PID:1432 -
\??\c:\7lfrffl.exec:\7lfrffl.exe50⤵
- Executes dropped EXE
PID:2680 -
\??\c:\nhhtnb.exec:\nhhtnb.exe51⤵
- Executes dropped EXE
PID:2740 -
\??\c:\bntbhb.exec:\bntbhb.exe52⤵
- Executes dropped EXE
PID:1988 -
\??\c:\1dpvv.exec:\1dpvv.exe53⤵
- Executes dropped EXE
PID:1324 -
\??\c:\jdvdp.exec:\jdvdp.exe54⤵
- Executes dropped EXE
PID:2428 -
\??\c:\lffllrx.exec:\lffllrx.exe55⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rlxlffr.exec:\rlxlffr.exe56⤵
- Executes dropped EXE
PID:1648 -
\??\c:\tththn.exec:\tththn.exe57⤵
- Executes dropped EXE
PID:1876 -
\??\c:\jddjp.exec:\jddjp.exe58⤵
- Executes dropped EXE
PID:1868 -
\??\c:\pjvdv.exec:\pjvdv.exe59⤵
- Executes dropped EXE
PID:1880 -
\??\c:\llrxlrf.exec:\llrxlrf.exe60⤵
- Executes dropped EXE
PID:2840 -
\??\c:\rlfxfrx.exec:\rlfxfrx.exe61⤵
- Executes dropped EXE
PID:2896 -
\??\c:\btntbb.exec:\btntbb.exe62⤵
- Executes dropped EXE
PID:1744 -
\??\c:\5nttht.exec:\5nttht.exe63⤵
- Executes dropped EXE
PID:536 -
\??\c:\5vvdj.exec:\5vvdj.exe64⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lfxflxf.exec:\lfxflxf.exe65⤵
- Executes dropped EXE
PID:1108 -
\??\c:\fxrflrl.exec:\fxrflrl.exe66⤵PID:2804
-
\??\c:\bthnhh.exec:\bthnhh.exe67⤵PID:580
-
\??\c:\5thhtt.exec:\5thhtt.exe68⤵PID:556
-
\??\c:\pjppj.exec:\pjppj.exe69⤵PID:1704
-
\??\c:\fxllxxr.exec:\fxllxxr.exe70⤵PID:2092
-
\??\c:\xrxlxxl.exec:\xrxlxxl.exe71⤵PID:1272
-
\??\c:\9tthhn.exec:\9tthhn.exe72⤵PID:1748
-
\??\c:\5nhntt.exec:\5nhntt.exe73⤵PID:1772
-
\??\c:\3pppd.exec:\3pppd.exe74⤵PID:2908
-
\??\c:\1pvjv.exec:\1pvjv.exe75⤵PID:956
-
\??\c:\xxxxrff.exec:\xxxxrff.exe76⤵PID:1688
-
\??\c:\bnbbhn.exec:\bnbbhn.exe77⤵PID:2060
-
\??\c:\5hhtbn.exec:\5hhtbn.exe78⤵PID:2140
-
\??\c:\3ppdd.exec:\3ppdd.exe79⤵PID:2888
-
\??\c:\ffxlflx.exec:\ffxlflx.exe80⤵PID:3048
-
\??\c:\fxxffll.exec:\fxxffll.exe81⤵PID:2628
-
\??\c:\9bbtnt.exec:\9bbtnt.exe82⤵PID:2784
-
\??\c:\htbtbn.exec:\htbtbn.exe83⤵PID:2536
-
\??\c:\7ddvp.exec:\7ddvp.exe84⤵PID:2640
-
\??\c:\pvpvv.exec:\pvpvv.exe85⤵PID:2616
-
\??\c:\xrfrrrr.exec:\xrfrrrr.exe86⤵PID:2580
-
\??\c:\xrlxllr.exec:\xrlxllr.exe87⤵PID:2528
-
\??\c:\hbttnt.exec:\hbttnt.exe88⤵PID:1792
-
\??\c:\tbttnn.exec:\tbttnn.exe89⤵PID:2788
-
\??\c:\vjdvv.exec:\vjdvv.exe90⤵PID:2392
-
\??\c:\pjjjv.exec:\pjjjv.exe91⤵PID:1924
-
\??\c:\ffxlrxl.exec:\ffxlrxl.exe92⤵PID:1596
-
\??\c:\tntntt.exec:\tntntt.exe93⤵PID:1896
-
\??\c:\tnhttb.exec:\tnhttb.exe94⤵PID:2772
-
\??\c:\3jvvd.exec:\3jvvd.exe95⤵PID:1988
-
\??\c:\5pvjd.exec:\5pvjd.exe96⤵PID:2204
-
\??\c:\lfxxrfr.exec:\lfxxrfr.exe97⤵PID:2168
-
\??\c:\lxxrrlx.exec:\lxxrrlx.exe98⤵PID:1608
-
\??\c:\nhbhbb.exec:\nhbhbb.exe99⤵PID:1648
-
\??\c:\ppddp.exec:\ppddp.exe100⤵PID:1960
-
\??\c:\jjpvj.exec:\jjpvj.exe101⤵PID:2384
-
\??\c:\7rllxfr.exec:\7rllxfr.exe102⤵PID:2844
-
\??\c:\lfllxlx.exec:\lfllxlx.exe103⤵PID:2268
-
\??\c:\7hthtt.exec:\7hthtt.exe104⤵PID:2808
-
\??\c:\nttbbn.exec:\nttbbn.exe105⤵PID:2884
-
\??\c:\7jvjj.exec:\7jvjj.exe106⤵PID:796
-
\??\c:\pjddv.exec:\pjddv.exe107⤵PID:932
-
\??\c:\3rlxlxl.exec:\3rlxlxl.exe108⤵PID:832
-
\??\c:\nnhbnt.exec:\nnhbnt.exe109⤵PID:1768
-
\??\c:\ddvjj.exec:\ddvjj.exe110⤵PID:976
-
\??\c:\dvjvp.exec:\dvjvp.exe111⤵PID:1244
-
\??\c:\lxlfxlx.exec:\lxlfxlx.exe112⤵PID:2444
-
\??\c:\rlfflrf.exec:\rlfflrf.exe113⤵PID:2996
-
\??\c:\htbbnb.exec:\htbbnb.exe114⤵PID:2988
-
\??\c:\vjvvp.exec:\vjvvp.exe115⤵PID:1788
-
\??\c:\djppv.exec:\djppv.exe116⤵PID:2940
-
\??\c:\rlrxflr.exec:\rlrxflr.exe117⤵PID:2868
-
\??\c:\xxflrrx.exec:\xxflrrx.exe118⤵PID:1680
-
\??\c:\bhbnhh.exec:\bhbnhh.exe119⤵PID:288
-
\??\c:\1pdjv.exec:\1pdjv.exe120⤵PID:1532
-
\??\c:\5pjpd.exec:\5pjpd.exe121⤵PID:2716
-
\??\c:\xrfflxl.exec:\xrfflxl.exe122⤵PID:2116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-