Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14-05-2024 18:03
Behavioral task
behavioral1
Sample
06aa51bee03cf4ec44c597248f9a7c40_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
06aa51bee03cf4ec44c597248f9a7c40_NeikiAnalytics.exe
-
Size
253KB
-
MD5
06aa51bee03cf4ec44c597248f9a7c40
-
SHA1
7baf638a17b10460be29ef1df2769e18e154160c
-
SHA256
f6d0f1845435dce3ad821655a27df61a39133467c2d7ca18004d3af727da888c
-
SHA512
efcc28ce20fc7ff9ea177ef9ee220ba0ac23bcd44ba2cb5286265d98642cbdfa8b718e76506f293a38da0fa290da2592e9d2284d3972505b708a7aa8bce85751
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+THkS:ccm4FmowdHoSi9EIBftapTs4WZazeES
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2428-13-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2748-10-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2096-28-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2416-38-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2684-47-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2600-50-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2288-73-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2640-81-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2180-93-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2544-91-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1768-102-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2280-117-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2760-142-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2980-151-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1680-170-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1436-172-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1436-179-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/860-189-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/112-210-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1708-224-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1864-227-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/952-237-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2748-302-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2100-309-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2156-335-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2744-362-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2800-377-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2992-439-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1776-454-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1980-473-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2984-487-0x0000000000260000-0x0000000000296000-memory.dmp family_blackmoon behavioral1/memory/488-495-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1904-539-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1876-546-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2428-589-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2652-705-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/864-738-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1576-789-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1436-815-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2476-927-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2828-979-0x00000000002A0000-0x00000000002D6000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000c000000013113-11.dat family_berbew behavioral1/files/0x000a00000001342b-19.dat family_berbew behavioral1/files/0x00090000000139e0-26.dat family_berbew behavioral1/files/0x0008000000013a11-36.dat family_berbew behavioral1/files/0x0008000000013a21-46.dat family_berbew behavioral1/files/0x0008000000013a71-55.dat family_berbew behavioral1/files/0x000b000000014120-62.dat family_berbew behavioral1/files/0x000b0000000141e6-74.dat family_berbew behavioral1/files/0x00070000000142b0-79.dat family_berbew behavioral1/files/0x00070000000142c4-92.dat family_berbew behavioral1/files/0x0007000000014316-98.dat family_berbew behavioral1/files/0x0006000000014390-108.dat family_berbew behavioral1/files/0x00060000000143ec-115.dat family_berbew behavioral1/files/0x000600000001447e-125.dat family_berbew behavioral1/files/0x000600000001448a-132.dat family_berbew behavioral1/files/0x00060000000144ac-140.dat family_berbew behavioral1/files/0x0006000000014539-153.dat family_berbew behavioral1/files/0x0006000000014667-161.dat family_berbew behavioral1/files/0x00060000000146a2-171.dat family_berbew behavioral1/files/0x00060000000146b8-180.dat family_berbew behavioral1/files/0x00060000000146c0-190.dat family_berbew behavioral1/files/0x00060000000147ea-198.dat family_berbew behavioral1/files/0x000a000000013928-208.dat family_berbew behavioral1/files/0x0006000000014825-216.dat family_berbew behavioral1/files/0x00060000000149f5-225.dat family_berbew behavioral1/files/0x0006000000014abe-234.dat family_berbew behavioral1/files/0x0006000000014af6-243.dat family_berbew behavioral1/files/0x0006000000014b31-250.dat family_berbew behavioral1/files/0x0006000000014b70-262.dat family_berbew behavioral1/files/0x0006000000014de9-268.dat family_berbew behavioral1/files/0x0006000000014ef8-279.dat family_berbew behavioral1/files/0x0006000000015018-287.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2428 xrllxlx.exe 2096 nhbnhn.exe 2416 dvjpd.exe 2684 nbnbtb.exe 2600 vpjdv.exe 2712 pjvvj.exe 2288 bbhnnh.exe 2640 djdjd.exe 2544 3lflflr.exe 2180 ttnntt.exe 1768 vpjvj.exe 2280 vpdpv.exe 1448 frfflrf.exe 1444 jjvdp.exe 2760 jdppv.exe 2980 5rfrrrf.exe 864 ddvdp.exe 1680 jjddv.exe 1436 3hnthn.exe 860 3bbbbh.exe 2224 fxfflrf.exe 268 1lxxffx.exe 112 7dvjp.exe 1708 ddjvp.exe 1864 ffrlxfr.exe 952 ththnb.exe 1036 ppvvd.exe 1856 rlxfllx.exe 696 hhbnbh.exe 2032 tnbhtb.exe 2244 fffrlrf.exe 608 1xffllf.exe 276 bththh.exe 2748 ddjjp.exe 2100 pjddp.exe 2932 ffrxffl.exe 1508 9tnnbb.exe 2156 bbtthh.exe 3064 ddpvj.exe 2592 ffrrfxx.exe 2624 rrlxrfr.exe 2744 tnhtht.exe 2492 7vjdp.exe 2604 3dvjv.exe 2800 1fxxflr.exe 2588 7lfxlxl.exe 3048 ddvdp.exe 1300 5dvpv.exe 1768 fxfrxlx.exe 1048 9xrrlrx.exe 1920 tnbtbb.exe 2536 vpjpd.exe 2792 vvpdp.exe 2992 fxrrxfr.exe 2108 9lfxfxf.exe 2984 tnbbnt.exe 1776 9vvdd.exe 1528 vpjdv.exe 1436 rlfrllr.exe 1980 nhbbhn.exe 856 tbthbh.exe 488 ppdpj.exe 1576 1xxflxf.exe 112 1nhnbh.exe -
resource yara_rule behavioral1/memory/2748-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2748-5-0x00000000002C0000-0x00000000002F6000-memory.dmp upx behavioral1/files/0x000c000000013113-11.dat upx behavioral1/memory/2428-13-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2748-10-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000a00000001342b-19.dat upx behavioral1/memory/2096-28-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00090000000139e0-26.dat upx behavioral1/memory/2416-29-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2416-38-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000013a11-36.dat upx behavioral1/memory/2684-47-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000013a21-46.dat upx behavioral1/memory/2600-50-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000013a71-55.dat upx behavioral1/files/0x000b000000014120-62.dat upx behavioral1/files/0x000b0000000141e6-74.dat upx behavioral1/memory/2288-73-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00070000000142b0-79.dat upx behavioral1/memory/2640-81-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2544-82-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2180-93-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00070000000142c4-92.dat upx behavioral1/memory/2544-91-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000014316-98.dat upx behavioral1/memory/1768-102-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000014390-108.dat upx behavioral1/files/0x00060000000143ec-115.dat upx behavioral1/memory/2280-117-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000600000001447e-125.dat upx behavioral1/files/0x000600000001448a-132.dat upx behavioral1/memory/2760-142-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00060000000144ac-140.dat upx behavioral1/memory/2980-150-0x0000000000250000-0x0000000000286000-memory.dmp upx behavioral1/files/0x0006000000014539-153.dat upx behavioral1/memory/2980-151-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000014667-161.dat upx behavioral1/memory/1680-170-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1436-172-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00060000000146a2-171.dat upx behavioral1/memory/1436-179-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00060000000146b8-180.dat upx behavioral1/files/0x00060000000146c0-190.dat upx behavioral1/memory/860-189-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00060000000147ea-198.dat upx behavioral1/files/0x000a000000013928-208.dat upx behavioral1/memory/112-210-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000014825-216.dat upx behavioral1/files/0x00060000000149f5-225.dat upx behavioral1/memory/1708-224-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1864-227-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000014abe-234.dat upx behavioral1/memory/952-237-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000014af6-243.dat upx behavioral1/files/0x0006000000014b31-250.dat upx behavioral1/memory/1856-252-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000014b70-262.dat upx behavioral1/memory/696-261-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000014de9-268.dat upx behavioral1/files/0x0006000000014ef8-279.dat upx behavioral1/files/0x0006000000015018-287.dat upx behavioral1/memory/2748-302-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2100-309-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2932-315-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2748 wrote to memory of 2428 2748 06aa51bee03cf4ec44c597248f9a7c40_NeikiAnalytics.exe 28 PID 2748 wrote to memory of 2428 2748 06aa51bee03cf4ec44c597248f9a7c40_NeikiAnalytics.exe 28 PID 2748 wrote to memory of 2428 2748 06aa51bee03cf4ec44c597248f9a7c40_NeikiAnalytics.exe 28 PID 2748 wrote to memory of 2428 2748 06aa51bee03cf4ec44c597248f9a7c40_NeikiAnalytics.exe 28 PID 2428 wrote to memory of 2096 2428 xrllxlx.exe 29 PID 2428 wrote to memory of 2096 2428 xrllxlx.exe 29 PID 2428 wrote to memory of 2096 2428 xrllxlx.exe 29 PID 2428 wrote to memory of 2096 2428 xrllxlx.exe 29 PID 2096 wrote to memory of 2416 2096 nhbnhn.exe 30 PID 2096 wrote to memory of 2416 2096 nhbnhn.exe 30 PID 2096 wrote to memory of 2416 2096 nhbnhn.exe 30 PID 2096 wrote to memory of 2416 2096 nhbnhn.exe 30 PID 2416 wrote to memory of 2684 2416 dvjpd.exe 31 PID 2416 wrote to memory of 2684 2416 dvjpd.exe 31 PID 2416 wrote to memory of 2684 2416 dvjpd.exe 31 PID 2416 wrote to memory of 2684 2416 dvjpd.exe 31 PID 2684 wrote to memory of 2600 2684 nbnbtb.exe 32 PID 2684 wrote to memory of 2600 2684 nbnbtb.exe 32 PID 2684 wrote to memory of 2600 2684 nbnbtb.exe 32 PID 2684 wrote to memory of 2600 2684 nbnbtb.exe 32 PID 2600 wrote to memory of 2712 2600 vpjdv.exe 33 PID 2600 wrote to memory of 2712 2600 vpjdv.exe 33 PID 2600 wrote to memory of 2712 2600 vpjdv.exe 33 PID 2600 wrote to memory of 2712 2600 vpjdv.exe 33 PID 2712 wrote to memory of 2288 2712 pjvvj.exe 34 PID 2712 wrote to memory of 2288 2712 pjvvj.exe 34 PID 2712 wrote to memory of 2288 2712 pjvvj.exe 34 PID 2712 wrote to memory of 2288 2712 pjvvj.exe 34 PID 2288 wrote to memory of 2640 2288 bbhnnh.exe 35 PID 2288 wrote to memory of 2640 2288 bbhnnh.exe 35 PID 2288 wrote to memory of 2640 2288 bbhnnh.exe 35 PID 2288 wrote to memory of 2640 2288 bbhnnh.exe 35 PID 2640 wrote to memory of 2544 2640 djdjd.exe 36 PID 2640 wrote to memory of 2544 2640 djdjd.exe 36 PID 2640 wrote to memory of 2544 2640 djdjd.exe 36 PID 2640 wrote to memory of 2544 2640 djdjd.exe 36 PID 2544 wrote to memory of 2180 2544 3lflflr.exe 37 PID 2544 wrote to memory of 2180 2544 3lflflr.exe 37 PID 2544 wrote to memory of 2180 2544 3lflflr.exe 37 PID 2544 wrote to memory of 2180 2544 3lflflr.exe 37 PID 2180 wrote to memory of 1768 2180 ttnntt.exe 38 PID 2180 wrote to memory of 1768 2180 ttnntt.exe 38 PID 2180 wrote to memory of 1768 2180 ttnntt.exe 38 PID 2180 wrote to memory of 1768 2180 ttnntt.exe 38 PID 1768 wrote to memory of 2280 1768 vpjvj.exe 39 PID 1768 wrote to memory of 2280 1768 vpjvj.exe 39 PID 1768 wrote to memory of 2280 1768 vpjvj.exe 39 PID 1768 wrote to memory of 2280 1768 vpjvj.exe 39 PID 2280 wrote to memory of 1448 2280 vpdpv.exe 40 PID 2280 wrote to memory of 1448 2280 vpdpv.exe 40 PID 2280 wrote to memory of 1448 2280 vpdpv.exe 40 PID 2280 wrote to memory of 1448 2280 vpdpv.exe 40 PID 1448 wrote to memory of 1444 1448 frfflrf.exe 41 PID 1448 wrote to memory of 1444 1448 frfflrf.exe 41 PID 1448 wrote to memory of 1444 1448 frfflrf.exe 41 PID 1448 wrote to memory of 1444 1448 frfflrf.exe 41 PID 1444 wrote to memory of 2760 1444 jjvdp.exe 42 PID 1444 wrote to memory of 2760 1444 jjvdp.exe 42 PID 1444 wrote to memory of 2760 1444 jjvdp.exe 42 PID 1444 wrote to memory of 2760 1444 jjvdp.exe 42 PID 2760 wrote to memory of 2980 2760 jdppv.exe 43 PID 2760 wrote to memory of 2980 2760 jdppv.exe 43 PID 2760 wrote to memory of 2980 2760 jdppv.exe 43 PID 2760 wrote to memory of 2980 2760 jdppv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\06aa51bee03cf4ec44c597248f9a7c40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\06aa51bee03cf4ec44c597248f9a7c40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\xrllxlx.exec:\xrllxlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\nhbnhn.exec:\nhbnhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\dvjpd.exec:\dvjpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\nbnbtb.exec:\nbnbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\vpjdv.exec:\vpjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\pjvvj.exec:\pjvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\bbhnnh.exec:\bbhnnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\djdjd.exec:\djdjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\3lflflr.exec:\3lflflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\ttnntt.exec:\ttnntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\vpjvj.exec:\vpjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\vpdpv.exec:\vpdpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\frfflrf.exec:\frfflrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\jjvdp.exec:\jjvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\jdppv.exec:\jdppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\5rfrrrf.exec:\5rfrrrf.exe17⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ddvdp.exec:\ddvdp.exe18⤵
- Executes dropped EXE
PID:864 -
\??\c:\jjddv.exec:\jjddv.exe19⤵
- Executes dropped EXE
PID:1680 -
\??\c:\3hnthn.exec:\3hnthn.exe20⤵
- Executes dropped EXE
PID:1436 -
\??\c:\3bbbbh.exec:\3bbbbh.exe21⤵
- Executes dropped EXE
PID:860 -
\??\c:\fxfflrf.exec:\fxfflrf.exe22⤵
- Executes dropped EXE
PID:2224 -
\??\c:\1lxxffx.exec:\1lxxffx.exe23⤵
- Executes dropped EXE
PID:268 -
\??\c:\7dvjp.exec:\7dvjp.exe24⤵
- Executes dropped EXE
PID:112 -
\??\c:\ddjvp.exec:\ddjvp.exe25⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ffrlxfr.exec:\ffrlxfr.exe26⤵
- Executes dropped EXE
PID:1864 -
\??\c:\ththnb.exec:\ththnb.exe27⤵
- Executes dropped EXE
PID:952 -
\??\c:\ppvvd.exec:\ppvvd.exe28⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rlxfllx.exec:\rlxfllx.exe29⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hhbnbh.exec:\hhbnbh.exe30⤵
- Executes dropped EXE
PID:696 -
\??\c:\tnbhtb.exec:\tnbhtb.exe31⤵
- Executes dropped EXE
PID:2032 -
\??\c:\fffrlrf.exec:\fffrlrf.exe32⤵
- Executes dropped EXE
PID:2244 -
\??\c:\1xffllf.exec:\1xffllf.exe33⤵
- Executes dropped EXE
PID:608 -
\??\c:\bththh.exec:\bththh.exe34⤵
- Executes dropped EXE
PID:276 -
\??\c:\ddjjp.exec:\ddjjp.exe35⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pjddp.exec:\pjddp.exe36⤵
- Executes dropped EXE
PID:2100 -
\??\c:\ffrxffl.exec:\ffrxffl.exe37⤵
- Executes dropped EXE
PID:2932 -
\??\c:\9tnnbb.exec:\9tnnbb.exe38⤵
- Executes dropped EXE
PID:1508 -
\??\c:\bbtthh.exec:\bbtthh.exe39⤵
- Executes dropped EXE
PID:2156 -
\??\c:\ddpvj.exec:\ddpvj.exe40⤵
- Executes dropped EXE
PID:3064 -
\??\c:\ffrrfxx.exec:\ffrrfxx.exe41⤵
- Executes dropped EXE
PID:2592 -
\??\c:\rrlxrfr.exec:\rrlxrfr.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\tnhtht.exec:\tnhtht.exe43⤵
- Executes dropped EXE
PID:2744 -
\??\c:\7vjdp.exec:\7vjdp.exe44⤵
- Executes dropped EXE
PID:2492 -
\??\c:\3dvjv.exec:\3dvjv.exe45⤵
- Executes dropped EXE
PID:2604 -
\??\c:\1fxxflr.exec:\1fxxflr.exe46⤵
- Executes dropped EXE
PID:2800 -
\??\c:\7lfxlxl.exec:\7lfxlxl.exe47⤵
- Executes dropped EXE
PID:2588 -
\??\c:\ddvdp.exec:\ddvdp.exe48⤵
- Executes dropped EXE
PID:3048 -
\??\c:\5dvpv.exec:\5dvpv.exe49⤵
- Executes dropped EXE
PID:1300 -
\??\c:\fxfrxlx.exec:\fxfrxlx.exe50⤵
- Executes dropped EXE
PID:1768 -
\??\c:\9xrrlrx.exec:\9xrrlrx.exe51⤵
- Executes dropped EXE
PID:1048 -
\??\c:\tnbtbb.exec:\tnbtbb.exe52⤵
- Executes dropped EXE
PID:1920 -
\??\c:\vpjpd.exec:\vpjpd.exe53⤵
- Executes dropped EXE
PID:2536 -
\??\c:\vvpdp.exec:\vvpdp.exe54⤵
- Executes dropped EXE
PID:2792 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe55⤵
- Executes dropped EXE
PID:2992 -
\??\c:\9lfxfxf.exec:\9lfxfxf.exe56⤵
- Executes dropped EXE
PID:2108 -
\??\c:\tnbbnt.exec:\tnbbnt.exe57⤵
- Executes dropped EXE
PID:2984 -
\??\c:\9vvdd.exec:\9vvdd.exe58⤵
- Executes dropped EXE
PID:1776 -
\??\c:\vpjdv.exec:\vpjdv.exe59⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rlfrllr.exec:\rlfrllr.exe60⤵
- Executes dropped EXE
PID:1436 -
\??\c:\nhbbhn.exec:\nhbbhn.exe61⤵
- Executes dropped EXE
PID:1980 -
\??\c:\tbthbh.exec:\tbthbh.exe62⤵
- Executes dropped EXE
PID:856 -
\??\c:\ppdpj.exec:\ppdpj.exe63⤵
- Executes dropped EXE
PID:488 -
\??\c:\1xxflxf.exec:\1xxflxf.exe64⤵
- Executes dropped EXE
PID:1576 -
\??\c:\1nhnbh.exec:\1nhnbh.exe65⤵
- Executes dropped EXE
PID:112 -
\??\c:\nnbnbh.exec:\nnbnbh.exe66⤵PID:1624
-
\??\c:\jdvdp.exec:\jdvdp.exe67⤵PID:1796
-
\??\c:\llxflxf.exec:\llxflxf.exe68⤵PID:2144
-
\??\c:\xrflflx.exec:\xrflflx.exe69⤵PID:1824
-
\??\c:\bnbbth.exec:\bnbbth.exe70⤵PID:1904
-
\??\c:\7ddvj.exec:\7ddvj.exe71⤵PID:1876
-
\??\c:\pjdjp.exec:\pjdjp.exe72⤵PID:2228
-
\??\c:\7fllxfl.exec:\7fllxfl.exe73⤵PID:108
-
\??\c:\hbtnbb.exec:\hbtnbb.exe74⤵PID:2412
-
\??\c:\vvpdp.exec:\vvpdp.exe75⤵PID:1196
-
\??\c:\3vjdv.exec:\3vjdv.exe76⤵PID:892
-
\??\c:\fxrflrf.exec:\fxrflrf.exe77⤵PID:1644
-
\??\c:\bhthnh.exec:\bhthnh.exe78⤵PID:3020
-
\??\c:\hhhtnn.exec:\hhhtnn.exe79⤵PID:2428
-
\??\c:\jvjpp.exec:\jvjpp.exe80⤵PID:1504
-
\??\c:\vvjvp.exec:\vvjvp.exe81⤵PID:2576
-
\??\c:\ffxlflr.exec:\ffxlflr.exe82⤵PID:2608
-
\??\c:\9nhtht.exec:\9nhtht.exe83⤵PID:2664
-
\??\c:\nhnnnn.exec:\nhnnnn.exe84⤵PID:2148
-
\??\c:\pvdpd.exec:\pvdpd.exe85⤵PID:2864
-
\??\c:\7pjvp.exec:\7pjvp.exe86⤵PID:2728
-
\??\c:\7ffrxlx.exec:\7ffrxlx.exe87⤵PID:2740
-
\??\c:\1bthtt.exec:\1bthtt.exe88⤵PID:2628
-
\??\c:\5thtbb.exec:\5thtbb.exe89⤵PID:2484
-
\??\c:\dvdvv.exec:\dvdvv.exe90⤵PID:2524
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe91⤵PID:2312
-
\??\c:\xrfrffr.exec:\xrfrffr.exe92⤵PID:2544
-
\??\c:\hbtbhh.exec:\hbtbhh.exe93⤵PID:3048
-
\??\c:\3bbbhh.exec:\3bbbhh.exe94⤵PID:2828
-
\??\c:\vpvdp.exec:\vpvdp.exe95⤵PID:1768
-
\??\c:\1rxxrxx.exec:\1rxxrxx.exe96⤵PID:2652
-
\??\c:\xfflxlr.exec:\xfflxlr.exe97⤵PID:1444
-
\??\c:\nhtbnt.exec:\nhtbnt.exe98⤵PID:2848
-
\??\c:\pjjvj.exec:\pjjvj.exe99⤵PID:2776
-
\??\c:\fxfxxlf.exec:\fxfxxlf.exe100⤵PID:2996
-
\??\c:\lfrxffr.exec:\lfrxffr.exe101⤵PID:864
-
\??\c:\tnhhnn.exec:\tnhhnn.exe102⤵PID:2060
-
\??\c:\7btnth.exec:\7btnth.exe103⤵PID:2064
-
\??\c:\pdjjp.exec:\pdjjp.exe104⤵PID:1268
-
\??\c:\9pvpv.exec:\9pvpv.exe105⤵PID:1436
-
\??\c:\xlrrrrx.exec:\xlrrrrx.exe106⤵PID:2072
-
\??\c:\nthnth.exec:\nthnth.exe107⤵PID:2260
-
\??\c:\bbthhn.exec:\bbthhn.exe108⤵PID:760
-
\??\c:\vvvdj.exec:\vvvdj.exe109⤵PID:1576
-
\??\c:\xrrrfrf.exec:\xrrrfrf.exe110⤵PID:832
-
\??\c:\rflrflf.exec:\rflrflf.exe111⤵PID:1792
-
\??\c:\tbhbbn.exec:\tbhbbn.exe112⤵PID:1796
-
\??\c:\pjddj.exec:\pjddj.exe113⤵PID:952
-
\??\c:\3vvpj.exec:\3vvpj.exe114⤵PID:1824
-
\??\c:\1llrflf.exec:\1llrflf.exe115⤵PID:2324
-
\??\c:\5hhthn.exec:\5hhthn.exe116⤵PID:884
-
\??\c:\bbbtnt.exec:\bbbtnt.exe117⤵PID:696
-
\??\c:\5pjjp.exec:\5pjjp.exe118⤵PID:552
-
\??\c:\vvvjd.exec:\vvvjd.exe119⤵PID:1704
-
\??\c:\xrrxlfx.exec:\xrrxlfx.exe120⤵PID:3028
-
\??\c:\hhbtbt.exec:\hhbtbt.exe121⤵PID:2916
-
\??\c:\btnntb.exec:\btnntb.exe122⤵PID:2552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-