Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 10:04
Behavioral task
behavioral1
Sample
8331c9081a64a1bf2eb8e8187682d670_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
8331c9081a64a1bf2eb8e8187682d670_NeikiAnalytics.exe
-
Size
278KB
-
MD5
8331c9081a64a1bf2eb8e8187682d670
-
SHA1
30c08c1f26bfcb7e1cddccd95d9d312670ccd534
-
SHA256
47bfa7e4b3a593cb80ac33d3f1e20cde3eba66736193864f79a61ed719ee7a61
-
SHA512
e70afbb25cd8ac0851cbe9b22a15ecef5992d1dce30758375742ef97f954afd35a6d433f8930fc5eee87634370324ceed12ea7a49e998d9a375c8c5cb755e743
-
SSDEEP
6144:7cm4FmowdHoSoXSBcm4Vcm4FmowdHoSphra+cm4FMhraHcpOaKHpl:B4wFHoSoXW434wFHoS3eg4aeFaKHpl
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/3024-7-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/3064-17-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2152-36-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2384-27-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2728-47-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2532-50-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2532-56-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2432-74-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2808-65-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2808-64-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2528-85-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2528-84-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2212-104-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2840-113-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2992-123-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/288-133-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1792-142-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2052-152-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/756-162-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1540-174-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1712-172-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1540-183-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1820-193-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1436-192-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1820-201-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/584-203-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/584-211-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/656-213-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/656-221-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/908-238-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1676-249-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2360-248-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1676-257-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1384-266-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1992-268-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2160-278-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1992-276-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2160-286-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2160-285-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/276-288-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2472-305-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2472-304-0x00000000003B0000-0x00000000003FD000-memory.dmp family_blackmoon behavioral1/memory/872-314-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2220-315-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2220-322-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1736-323-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1736-330-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1616-339-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2616-347-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2616-348-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2172-355-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2172-356-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2732-363-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2896-370-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2852-379-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2180-387-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2576-395-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2644-403-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2688-412-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2688-413-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2624-427-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1688-428-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1688-435-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1688-434-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3064 pjjpj.exe 2384 xxflfrl.exe 2152 7frfrfl.exe 2728 9btbhn.exe 2532 dvpdj.exe 2808 xrrxrrf.exe 2432 nntbhn.exe 2528 pvvvv.exe 2688 pvvpj.exe 2212 djppv.exe 2840 rfrfxrl.exe 2992 rlxxrrx.exe 288 7rlrxlx.exe 1792 vjdjv.exe 2052 9tntnb.exe 756 xrflrxf.exe 1712 hhbbnn.exe 1540 xlflxfr.exe 1436 nhhtth.exe 1820 9vjvp.exe 584 dvddj.exe 656 nhbnbh.exe 2288 xflxrlf.exe 908 xflffxx.exe 2360 pvjjj.exe 1676 xxrfrfr.exe 1384 hbbtbt.exe 1992 5fxfrxl.exe 2160 vpdjp.exe 276 3xrlfrl.exe 2472 3pddd.exe 872 rllrxfr.exe 2220 jdvvp.exe 1736 jpdvp.exe 1616 1tbbnb.exe 2616 1vpjv.exe 2172 ntthnt.exe 2732 1vvjj.exe 2896 1btnnt.exe 2852 pppdd.exe 2180 fllffxr.exe 2576 9nbtbt.exe 2644 pjddd.exe 2688 nnnbtb.exe 2788 jjppd.exe 2624 1rxfxfl.exe 1688 3ntbnt.exe 2992 dddpd.exe 2416 xfrffxx.exe 844 1ttbbn.exe 2768 dvppv.exe 1732 llflxlx.exe 756 pjddv.exe 2244 xrlrffl.exe 2508 hhthhn.exe 2928 jdvdj.exe 320 rlflfxr.exe 748 nbbhtt.exe 1100 ppjdv.exe 1632 vvpvj.exe 2288 rfflllx.exe 2352 9tnntb.exe 1868 hbthnb.exe 940 3jvvd.exe -
resource yara_rule behavioral1/memory/3024-0-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x000b0000000122ee-9.dat upx behavioral1/memory/3024-7-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2384-18-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/3064-17-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0030000000014d0f-16.dat upx behavioral1/files/0x000800000001523e-25.dat upx behavioral1/memory/2728-38-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x00070000000155e8-37.dat upx behavioral1/memory/2152-36-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2152-30-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2384-27-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0007000000015a15-45.dat upx behavioral1/memory/2728-47-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2532-50-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0008000000015d13-67.dat upx behavioral1/files/0x0007000000015b37-58.dat upx behavioral1/memory/2532-56-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0008000000015d28-76.dat upx behavioral1/memory/2432-74-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2808-65-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2528-79-0x0000000000220000-0x000000000026D000-memory.dmp upx behavioral1/files/0x0006000000015d89-82.dat upx behavioral1/memory/2528-85-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2528-84-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2212-96-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2688-95-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0006000000015d99-94.dat upx behavioral1/files/0x0006000000015f40-101.dat upx behavioral1/memory/2212-104-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2840-105-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2840-113-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0006000000015fbb-115.dat upx behavioral1/files/0x0006000000016020-121.dat upx behavioral1/memory/2992-123-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/288-124-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/288-133-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0006000000016126-132.dat upx behavioral1/memory/1792-134-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0006000000016228-143.dat upx behavioral1/memory/2052-144-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1792-142-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0030000000014fac-153.dat upx behavioral1/memory/2052-152-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/756-154-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/756-162-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x000600000001640f-163.dat upx behavioral1/memory/1712-164-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x000600000001650f-173.dat upx behavioral1/memory/1540-174-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1712-172-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0006000000016591-184.dat upx behavioral1/memory/1540-183-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1820-193-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1436-192-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x00060000000167e8-191.dat upx behavioral1/memory/1820-201-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/584-203-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0006000000016a3a-202.dat upx behavioral1/memory/584-211-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/656-213-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/files/0x0006000000016c3a-212.dat upx behavioral1/files/0x0006000000016c57-222.dat upx behavioral1/memory/656-221-0x0000000000400000-0x000000000044D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3024 wrote to memory of 3064 3024 8331c9081a64a1bf2eb8e8187682d670_NeikiAnalytics.exe 28 PID 3024 wrote to memory of 3064 3024 8331c9081a64a1bf2eb8e8187682d670_NeikiAnalytics.exe 28 PID 3024 wrote to memory of 3064 3024 8331c9081a64a1bf2eb8e8187682d670_NeikiAnalytics.exe 28 PID 3024 wrote to memory of 3064 3024 8331c9081a64a1bf2eb8e8187682d670_NeikiAnalytics.exe 28 PID 3064 wrote to memory of 2384 3064 pjjpj.exe 29 PID 3064 wrote to memory of 2384 3064 pjjpj.exe 29 PID 3064 wrote to memory of 2384 3064 pjjpj.exe 29 PID 3064 wrote to memory of 2384 3064 pjjpj.exe 29 PID 2384 wrote to memory of 2152 2384 xxflfrl.exe 30 PID 2384 wrote to memory of 2152 2384 xxflfrl.exe 30 PID 2384 wrote to memory of 2152 2384 xxflfrl.exe 30 PID 2384 wrote to memory of 2152 2384 xxflfrl.exe 30 PID 2152 wrote to memory of 2728 2152 7frfrfl.exe 31 PID 2152 wrote to memory of 2728 2152 7frfrfl.exe 31 PID 2152 wrote to memory of 2728 2152 7frfrfl.exe 31 PID 2152 wrote to memory of 2728 2152 7frfrfl.exe 31 PID 2728 wrote to memory of 2532 2728 9btbhn.exe 32 PID 2728 wrote to memory of 2532 2728 9btbhn.exe 32 PID 2728 wrote to memory of 2532 2728 9btbhn.exe 32 PID 2728 wrote to memory of 2532 2728 9btbhn.exe 32 PID 2532 wrote to memory of 2808 2532 dvpdj.exe 33 PID 2532 wrote to memory of 2808 2532 dvpdj.exe 33 PID 2532 wrote to memory of 2808 2532 dvpdj.exe 33 PID 2532 wrote to memory of 2808 2532 dvpdj.exe 33 PID 2808 wrote to memory of 2432 2808 xrrxrrf.exe 34 PID 2808 wrote to memory of 2432 2808 xrrxrrf.exe 34 PID 2808 wrote to memory of 2432 2808 xrrxrrf.exe 34 PID 2808 wrote to memory of 2432 2808 xrrxrrf.exe 34 PID 2432 wrote to memory of 2528 2432 nntbhn.exe 35 PID 2432 wrote to memory of 2528 2432 nntbhn.exe 35 PID 2432 wrote to memory of 2528 2432 nntbhn.exe 35 PID 2432 wrote to memory of 2528 2432 nntbhn.exe 35 PID 2528 wrote to memory of 2688 2528 pvvvv.exe 36 PID 2528 wrote to memory of 2688 2528 pvvvv.exe 36 PID 2528 wrote to memory of 2688 2528 pvvvv.exe 36 PID 2528 wrote to memory of 2688 2528 pvvvv.exe 36 PID 2688 wrote to memory of 2212 2688 pvvpj.exe 37 PID 2688 wrote to memory of 2212 2688 pvvpj.exe 37 PID 2688 wrote to memory of 2212 2688 pvvpj.exe 37 PID 2688 wrote to memory of 2212 2688 pvvpj.exe 37 PID 2212 wrote to memory of 2840 2212 djppv.exe 38 PID 2212 wrote to memory of 2840 2212 djppv.exe 38 PID 2212 wrote to memory of 2840 2212 djppv.exe 38 PID 2212 wrote to memory of 2840 2212 djppv.exe 38 PID 2840 wrote to memory of 2992 2840 rfrfxrl.exe 39 PID 2840 wrote to memory of 2992 2840 rfrfxrl.exe 39 PID 2840 wrote to memory of 2992 2840 rfrfxrl.exe 39 PID 2840 wrote to memory of 2992 2840 rfrfxrl.exe 39 PID 2992 wrote to memory of 288 2992 rlxxrrx.exe 40 PID 2992 wrote to memory of 288 2992 rlxxrrx.exe 40 PID 2992 wrote to memory of 288 2992 rlxxrrx.exe 40 PID 2992 wrote to memory of 288 2992 rlxxrrx.exe 40 PID 288 wrote to memory of 1792 288 7rlrxlx.exe 41 PID 288 wrote to memory of 1792 288 7rlrxlx.exe 41 PID 288 wrote to memory of 1792 288 7rlrxlx.exe 41 PID 288 wrote to memory of 1792 288 7rlrxlx.exe 41 PID 1792 wrote to memory of 2052 1792 vjdjv.exe 42 PID 1792 wrote to memory of 2052 1792 vjdjv.exe 42 PID 1792 wrote to memory of 2052 1792 vjdjv.exe 42 PID 1792 wrote to memory of 2052 1792 vjdjv.exe 42 PID 2052 wrote to memory of 756 2052 9tntnb.exe 43 PID 2052 wrote to memory of 756 2052 9tntnb.exe 43 PID 2052 wrote to memory of 756 2052 9tntnb.exe 43 PID 2052 wrote to memory of 756 2052 9tntnb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\8331c9081a64a1bf2eb8e8187682d670_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8331c9081a64a1bf2eb8e8187682d670_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\pjjpj.exec:\pjjpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\xxflfrl.exec:\xxflfrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\7frfrfl.exec:\7frfrfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\9btbhn.exec:\9btbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\dvpdj.exec:\dvpdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\xrrxrrf.exec:\xrrxrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\nntbhn.exec:\nntbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\pvvvv.exec:\pvvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\pvvpj.exec:\pvvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\djppv.exec:\djppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\rfrfxrl.exec:\rfrfxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rlxxrrx.exec:\rlxxrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\7rlrxlx.exec:\7rlrxlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:288 -
\??\c:\vjdjv.exec:\vjdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\9tntnb.exec:\9tntnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\xrflrxf.exec:\xrflrxf.exe17⤵
- Executes dropped EXE
PID:756 -
\??\c:\hhbbnn.exec:\hhbbnn.exe18⤵
- Executes dropped EXE
PID:1712 -
\??\c:\xlflxfr.exec:\xlflxfr.exe19⤵
- Executes dropped EXE
PID:1540 -
\??\c:\nhhtth.exec:\nhhtth.exe20⤵
- Executes dropped EXE
PID:1436 -
\??\c:\9vjvp.exec:\9vjvp.exe21⤵
- Executes dropped EXE
PID:1820 -
\??\c:\dvddj.exec:\dvddj.exe22⤵
- Executes dropped EXE
PID:584 -
\??\c:\nhbnbh.exec:\nhbnbh.exe23⤵
- Executes dropped EXE
PID:656 -
\??\c:\xflxrlf.exec:\xflxrlf.exe24⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xflffxx.exec:\xflffxx.exe25⤵
- Executes dropped EXE
PID:908 -
\??\c:\pvjjj.exec:\pvjjj.exe26⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xxrfrfr.exec:\xxrfrfr.exe27⤵
- Executes dropped EXE
PID:1676 -
\??\c:\hbbtbt.exec:\hbbtbt.exe28⤵
- Executes dropped EXE
PID:1384 -
\??\c:\5fxfrxl.exec:\5fxfrxl.exe29⤵
- Executes dropped EXE
PID:1992 -
\??\c:\vpdjp.exec:\vpdjp.exe30⤵
- Executes dropped EXE
PID:2160 -
\??\c:\3xrlfrl.exec:\3xrlfrl.exe31⤵
- Executes dropped EXE
PID:276 -
\??\c:\3pddd.exec:\3pddd.exe32⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rllrxfr.exec:\rllrxfr.exe33⤵
- Executes dropped EXE
PID:872 -
\??\c:\jdvvp.exec:\jdvvp.exe34⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jpdvp.exec:\jpdvp.exe35⤵
- Executes dropped EXE
PID:1736 -
\??\c:\1tbbnb.exec:\1tbbnb.exe36⤵
- Executes dropped EXE
PID:1616 -
\??\c:\1vpjv.exec:\1vpjv.exe37⤵
- Executes dropped EXE
PID:2616 -
\??\c:\ntthnt.exec:\ntthnt.exe38⤵
- Executes dropped EXE
PID:2172 -
\??\c:\1vvjj.exec:\1vvjj.exe39⤵
- Executes dropped EXE
PID:2732 -
\??\c:\1btnnt.exec:\1btnnt.exe40⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pppdd.exec:\pppdd.exe41⤵
- Executes dropped EXE
PID:2852 -
\??\c:\fllffxr.exec:\fllffxr.exe42⤵
- Executes dropped EXE
PID:2180 -
\??\c:\9nbtbt.exec:\9nbtbt.exe43⤵
- Executes dropped EXE
PID:2576 -
\??\c:\pjddd.exec:\pjddd.exe44⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nnnbtb.exec:\nnnbtb.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jjppd.exec:\jjppd.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1rxfxfl.exec:\1rxfxfl.exe47⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3ntbnt.exec:\3ntbnt.exe48⤵
- Executes dropped EXE
PID:1688 -
\??\c:\dddpd.exec:\dddpd.exe49⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xfrffxx.exec:\xfrffxx.exe50⤵
- Executes dropped EXE
PID:2416 -
\??\c:\1ttbbn.exec:\1ttbbn.exe51⤵
- Executes dropped EXE
PID:844 -
\??\c:\dvppv.exec:\dvppv.exe52⤵
- Executes dropped EXE
PID:2768 -
\??\c:\llflxlx.exec:\llflxlx.exe53⤵
- Executes dropped EXE
PID:1732 -
\??\c:\pjddv.exec:\pjddv.exe54⤵
- Executes dropped EXE
PID:756 -
\??\c:\xrlrffl.exec:\xrlrffl.exe55⤵
- Executes dropped EXE
PID:2244 -
\??\c:\hhthhn.exec:\hhthhn.exe56⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jdvdj.exec:\jdvdj.exe57⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rlflfxr.exec:\rlflfxr.exe58⤵
- Executes dropped EXE
PID:320 -
\??\c:\nbbhtt.exec:\nbbhtt.exe59⤵
- Executes dropped EXE
PID:748 -
\??\c:\ppjdv.exec:\ppjdv.exe60⤵
- Executes dropped EXE
PID:1100 -
\??\c:\vvpvj.exec:\vvpvj.exe61⤵
- Executes dropped EXE
PID:1632 -
\??\c:\rfflllx.exec:\rfflllx.exe62⤵
- Executes dropped EXE
PID:2288 -
\??\c:\9tnntb.exec:\9tnntb.exe63⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hbthnb.exec:\hbthnb.exe64⤵
- Executes dropped EXE
PID:1868 -
\??\c:\3jvvd.exec:\3jvvd.exe65⤵
- Executes dropped EXE
PID:940 -
\??\c:\ffrxllx.exec:\ffrxllx.exe66⤵PID:1876
-
\??\c:\xrffllx.exec:\xrffllx.exe67⤵PID:2000
-
\??\c:\nhbntt.exec:\nhbntt.exe68⤵PID:2200
-
\??\c:\5dvvp.exec:\5dvvp.exe69⤵PID:2160
-
\??\c:\pjvdv.exec:\pjvdv.exe70⤵PID:2144
-
\??\c:\llfxrfx.exec:\llfxrfx.exe71⤵PID:820
-
\??\c:\lfllllx.exec:\lfllllx.exe72⤵PID:1584
-
\??\c:\7bnhbh.exec:\7bnhbh.exe73⤵PID:1624
-
\??\c:\1vvjj.exec:\1vvjj.exe74⤵PID:1612
-
\??\c:\7xrxflx.exec:\7xrxflx.exe75⤵PID:3052
-
\??\c:\xlxfffr.exec:\xlxfffr.exe76⤵PID:2628
-
\??\c:\btnbth.exec:\btnbth.exe77⤵PID:2748
-
\??\c:\hbhntt.exec:\hbhntt.exe78⤵PID:2676
-
\??\c:\9jpdp.exec:\9jpdp.exe79⤵PID:2560
-
\??\c:\3vjpd.exec:\3vjpd.exe80⤵PID:2660
-
\??\c:\rrxfrxx.exec:\rrxfrxx.exe81⤵PID:2740
-
\??\c:\hbttbb.exec:\hbttbb.exe82⤵PID:2696
-
\??\c:\nnnbnt.exec:\nnnbnt.exe83⤵PID:2576
-
\??\c:\jjjpd.exec:\jjjpd.exe84⤵PID:2364
-
\??\c:\xrrxrxr.exec:\xrrxrxr.exe85⤵PID:2436
-
\??\c:\9fxrflx.exec:\9fxrflx.exe86⤵PID:2788
-
\??\c:\nnnnbh.exec:\nnnnbh.exe87⤵PID:2756
-
\??\c:\jpjpd.exec:\jpjpd.exe88⤵PID:2300
-
\??\c:\xxxrffr.exec:\xxxrffr.exe89⤵PID:1740
-
\??\c:\7fxlfxl.exec:\7fxlfxl.exe90⤵PID:2416
-
\??\c:\hbnbhh.exec:\hbnbhh.exe91⤵PID:1288
-
\??\c:\9dpvj.exec:\9dpvj.exe92⤵PID:2768
-
\??\c:\vpddp.exec:\vpddp.exe93⤵PID:1444
-
\??\c:\rlffllr.exec:\rlffllr.exe94⤵PID:1508
-
\??\c:\1bnthh.exec:\1bnthh.exe95⤵PID:1972
-
\??\c:\5nnbht.exec:\5nnbht.exe96⤵PID:2920
-
\??\c:\pjppv.exec:\pjppv.exe97⤵PID:2056
-
\??\c:\5llrxlr.exec:\5llrxlr.exe98⤵PID:680
-
\??\c:\bbbntb.exec:\bbbntb.exe99⤵PID:2284
-
\??\c:\7ppvv.exec:\7ppvv.exe100⤵PID:1088
-
\??\c:\3jjpd.exec:\3jjpd.exe101⤵PID:1140
-
\??\c:\1llxffr.exec:\1llxffr.exe102⤵PID:1336
-
\??\c:\tnthbn.exec:\tnthbn.exe103⤵PID:396
-
\??\c:\9jjdj.exec:\9jjdj.exe104⤵PID:468
-
\??\c:\fffllrf.exec:\fffllrf.exe105⤵PID:1384
-
\??\c:\bbnntb.exec:\bbnntb.exe106⤵PID:2204
-
\??\c:\jjdjd.exec:\jjdjd.exe107⤵PID:1696
-
\??\c:\ppjdp.exec:\ppjdp.exe108⤵PID:2216
-
\??\c:\rrrxflf.exec:\rrrxflf.exe109⤵PID:1392
-
\??\c:\xrxxfrx.exec:\xrxxfrx.exe110⤵PID:1264
-
\??\c:\bththh.exec:\bththh.exe111⤵PID:872
-
\??\c:\vjppp.exec:\vjppp.exe112⤵PID:1592
-
\??\c:\3vjpd.exec:\3vjpd.exe113⤵PID:2832
-
\??\c:\5lrxlrf.exec:\5lrxlrf.exe114⤵PID:1720
-
\??\c:\hhtthh.exec:\hhtthh.exe115⤵PID:2400
-
\??\c:\9bbntb.exec:\9bbntb.exe116⤵PID:2724
-
\??\c:\7vdvj.exec:\7vdvj.exe117⤵PID:2172
-
\??\c:\fxfffff.exec:\fxfffff.exe118⤵PID:2736
-
\??\c:\fffxrfr.exec:\fffxrfr.exe119⤵PID:2808
-
\??\c:\hnbnth.exec:\hnbnth.exe120⤵PID:2800
-
\??\c:\dpddd.exec:\dpddd.exe121⤵PID:2540
-
\??\c:\pppdv.exec:\pppdv.exe122⤵PID:2552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-