Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 23:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
128b2457e9b1a219b9c84d6841fa84c0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
128b2457e9b1a219b9c84d6841fa84c0_NeikiAnalytics.exe
-
Size
479KB
-
MD5
128b2457e9b1a219b9c84d6841fa84c0
-
SHA1
cfcdd2f6f32980fc9ff54cb5d753b32be73584a4
-
SHA256
d25dd510a4755cd9e20452c3ab1a5f9262352a7c1c8b04bcce67ae163dc87765
-
SHA512
493e514e85a890ddd61a9a1bf2220071ee66e1075680ad3ae8a1a00a8fa2491742be5d86eb7aa97bc26a59291dea152672dc2ba88b4f94f3d8cda0566762e1a1
-
SSDEEP
6144:Pcm7ImGddXtWrXD486jJq1BStv4Ib1Hm7cs:d7Tc9Wj16A3StvxHs
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/1704-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/860-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1336-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/492-306-0x00000000779D0000-0x0000000077AEF000-memory.dmp family_blackmoon behavioral1/memory/1608-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-355-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-375-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-401-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/896-436-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-455-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-501-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-527-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-667-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-694-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-884-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/1152-934-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-1053-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-1079-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1704 rflrxff.exe 1724 ntbnbn.exe 2596 pjjvd.exe 2648 bnhnnh.exe 2860 jpjdv.exe 2804 1rllrfl.exe 2524 thttbt.exe 2544 jpjvj.exe 2520 hbbhnt.exe 2980 3tbbbh.exe 1680 rllrrrl.exe 1864 hhbhbn.exe 2704 7lxflxl.exe 1932 nhhhtb.exe 1064 lrrfrxr.exe 1772 tnnbnn.exe 1816 rxfxlfl.exe 2396 3tbhnb.exe 860 lxxrxfl.exe 2092 nhbbbb.exe 1696 thbbht.exe 2876 pjdjd.exe 2312 fflrxxr.exe 2592 ddddv.exe 444 bbntht.exe 3048 9vpvd.exe 1552 hhbhtt.exe 1620 pddjj.exe 760 ntbtbb.exe 2008 1djpj.exe 2308 ttnbnt.exe 1336 7pjpd.exe 3064 llflrlr.exe 2416 nttbnb.exe 492 xfrxlrf.exe 852 5xlrfff.exe 1724 7hbhnh.exe 3068 vdjvv.exe 2852 3ffrflf.exe 2328 1bthbn.exe 2652 ddpdp.exe 2860 lxfxllf.exe 2708 7tthhb.exe 2436 fffrfrf.exe 2428 hnhhbb.exe 2564 ppjvj.exe 2940 frrxlfr.exe 2128 5thhtt.exe 1248 pjdjv.exe 2560 7lflrrf.exe 2732 ntbtbh.exe 2820 djpjj.exe 896 xrflfrx.exe 1924 tththn.exe 2236 7vdjv.exe 2204 frlxrrf.exe 776 3bbnhn.exe 1296 jdvdj.exe 1224 fxxfxlf.exe 2380 bnbnnb.exe 2268 pvpjv.exe 1992 1rlrxfr.exe 2828 bbtbtb.exe 548 btthbn.exe -
resource yara_rule behavioral1/memory/1704-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/860-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1336-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-297-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-355-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-362-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-375-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-388-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1248-401-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-414-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/896-436-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-455-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-487-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-494-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-501-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-520-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-527-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-546-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-559-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-584-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-609-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-616-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-647-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-660-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-667-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-674-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1376-687-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-694-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-707-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-720-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-739-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-812-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/892-837-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-850-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-870-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-877-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-903-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-934-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-941-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2056 wrote to memory of 1704 2056 128b2457e9b1a219b9c84d6841fa84c0_NeikiAnalytics.exe 28 PID 2056 wrote to memory of 1704 2056 128b2457e9b1a219b9c84d6841fa84c0_NeikiAnalytics.exe 28 PID 2056 wrote to memory of 1704 2056 128b2457e9b1a219b9c84d6841fa84c0_NeikiAnalytics.exe 28 PID 2056 wrote to memory of 1704 2056 128b2457e9b1a219b9c84d6841fa84c0_NeikiAnalytics.exe 28 PID 1704 wrote to memory of 1724 1704 rflrxff.exe 29 PID 1704 wrote to memory of 1724 1704 rflrxff.exe 29 PID 1704 wrote to memory of 1724 1704 rflrxff.exe 29 PID 1704 wrote to memory of 1724 1704 rflrxff.exe 29 PID 1724 wrote to memory of 2596 1724 ntbnbn.exe 30 PID 1724 wrote to memory of 2596 1724 ntbnbn.exe 30 PID 1724 wrote to memory of 2596 1724 ntbnbn.exe 30 PID 1724 wrote to memory of 2596 1724 ntbnbn.exe 30 PID 2596 wrote to memory of 2648 2596 pjjvd.exe 31 PID 2596 wrote to memory of 2648 2596 pjjvd.exe 31 PID 2596 wrote to memory of 2648 2596 pjjvd.exe 31 PID 2596 wrote to memory of 2648 2596 pjjvd.exe 31 PID 2648 wrote to memory of 2860 2648 bnhnnh.exe 32 PID 2648 wrote to memory of 2860 2648 bnhnnh.exe 32 PID 2648 wrote to memory of 2860 2648 bnhnnh.exe 32 PID 2648 wrote to memory of 2860 2648 bnhnnh.exe 32 PID 2860 wrote to memory of 2804 2860 jpjdv.exe 33 PID 2860 wrote to memory of 2804 2860 jpjdv.exe 33 PID 2860 wrote to memory of 2804 2860 jpjdv.exe 33 PID 2860 wrote to memory of 2804 2860 jpjdv.exe 33 PID 2804 wrote to memory of 2524 2804 1rllrfl.exe 34 PID 2804 wrote to memory of 2524 2804 1rllrfl.exe 34 PID 2804 wrote to memory of 2524 2804 1rllrfl.exe 34 PID 2804 wrote to memory of 2524 2804 1rllrfl.exe 34 PID 2524 wrote to memory of 2544 2524 thttbt.exe 35 PID 2524 wrote to memory of 2544 2524 thttbt.exe 35 PID 2524 wrote to memory of 2544 2524 thttbt.exe 35 PID 2524 wrote to memory of 2544 2524 thttbt.exe 35 PID 2544 wrote to memory of 2520 2544 jpjvj.exe 36 PID 2544 wrote to memory of 2520 2544 jpjvj.exe 36 PID 2544 wrote to memory of 2520 2544 jpjvj.exe 36 PID 2544 wrote to memory of 2520 2544 jpjvj.exe 36 PID 2520 wrote to memory of 2980 2520 hbbhnt.exe 37 PID 2520 wrote to memory of 2980 2520 hbbhnt.exe 37 PID 2520 wrote to memory of 2980 2520 hbbhnt.exe 37 PID 2520 wrote to memory of 2980 2520 hbbhnt.exe 37 PID 2980 wrote to memory of 1680 2980 3tbbbh.exe 38 PID 2980 wrote to memory of 1680 2980 3tbbbh.exe 38 PID 2980 wrote to memory of 1680 2980 3tbbbh.exe 38 PID 2980 wrote to memory of 1680 2980 3tbbbh.exe 38 PID 1680 wrote to memory of 1864 1680 rllrrrl.exe 39 PID 1680 wrote to memory of 1864 1680 rllrrrl.exe 39 PID 1680 wrote to memory of 1864 1680 rllrrrl.exe 39 PID 1680 wrote to memory of 1864 1680 rllrrrl.exe 39 PID 1864 wrote to memory of 2704 1864 hhbhbn.exe 40 PID 1864 wrote to memory of 2704 1864 hhbhbn.exe 40 PID 1864 wrote to memory of 2704 1864 hhbhbn.exe 40 PID 1864 wrote to memory of 2704 1864 hhbhbn.exe 40 PID 2704 wrote to memory of 1932 2704 7lxflxl.exe 41 PID 2704 wrote to memory of 1932 2704 7lxflxl.exe 41 PID 2704 wrote to memory of 1932 2704 7lxflxl.exe 41 PID 2704 wrote to memory of 1932 2704 7lxflxl.exe 41 PID 1932 wrote to memory of 1064 1932 nhhhtb.exe 42 PID 1932 wrote to memory of 1064 1932 nhhhtb.exe 42 PID 1932 wrote to memory of 1064 1932 nhhhtb.exe 42 PID 1932 wrote to memory of 1064 1932 nhhhtb.exe 42 PID 1064 wrote to memory of 1772 1064 lrrfrxr.exe 43 PID 1064 wrote to memory of 1772 1064 lrrfrxr.exe 43 PID 1064 wrote to memory of 1772 1064 lrrfrxr.exe 43 PID 1064 wrote to memory of 1772 1064 lrrfrxr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\128b2457e9b1a219b9c84d6841fa84c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\128b2457e9b1a219b9c84d6841fa84c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\rflrxff.exec:\rflrxff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\ntbnbn.exec:\ntbnbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\pjjvd.exec:\pjjvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\bnhnnh.exec:\bnhnnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\jpjdv.exec:\jpjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\1rllrfl.exec:\1rllrfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\thttbt.exec:\thttbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\jpjvj.exec:\jpjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\hbbhnt.exec:\hbbhnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\3tbbbh.exec:\3tbbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\rllrrrl.exec:\rllrrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\hhbhbn.exec:\hhbhbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\7lxflxl.exec:\7lxflxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\nhhhtb.exec:\nhhhtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\lrrfrxr.exec:\lrrfrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\tnnbnn.exec:\tnnbnn.exe17⤵
- Executes dropped EXE
PID:1772 -
\??\c:\rxfxlfl.exec:\rxfxlfl.exe18⤵
- Executes dropped EXE
PID:1816 -
\??\c:\3tbhnb.exec:\3tbhnb.exe19⤵
- Executes dropped EXE
PID:2396 -
\??\c:\lxxrxfl.exec:\lxxrxfl.exe20⤵
- Executes dropped EXE
PID:860 -
\??\c:\nhbbbb.exec:\nhbbbb.exe21⤵
- Executes dropped EXE
PID:2092 -
\??\c:\thbbht.exec:\thbbht.exe22⤵
- Executes dropped EXE
PID:1696 -
\??\c:\pjdjd.exec:\pjdjd.exe23⤵
- Executes dropped EXE
PID:2876 -
\??\c:\fflrxxr.exec:\fflrxxr.exe24⤵
- Executes dropped EXE
PID:2312 -
\??\c:\ddddv.exec:\ddddv.exe25⤵
- Executes dropped EXE
PID:2592 -
\??\c:\bbntht.exec:\bbntht.exe26⤵
- Executes dropped EXE
PID:444 -
\??\c:\9vpvd.exec:\9vpvd.exe27⤵
- Executes dropped EXE
PID:3048 -
\??\c:\hhbhtt.exec:\hhbhtt.exe28⤵
- Executes dropped EXE
PID:1552 -
\??\c:\pddjj.exec:\pddjj.exe29⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ntbtbb.exec:\ntbtbb.exe30⤵
- Executes dropped EXE
PID:760 -
\??\c:\1djpj.exec:\1djpj.exe31⤵
- Executes dropped EXE
PID:2008 -
\??\c:\ttnbnt.exec:\ttnbnt.exe32⤵
- Executes dropped EXE
PID:2308 -
\??\c:\7pjpd.exec:\7pjpd.exe33⤵
- Executes dropped EXE
PID:1336 -
\??\c:\llflrlr.exec:\llflrlr.exe34⤵
- Executes dropped EXE
PID:3064 -
\??\c:\nttbnb.exec:\nttbnb.exe35⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xfrxlrf.exec:\xfrxlrf.exe36⤵
- Executes dropped EXE
PID:492 -
\??\c:\hbnhnh.exec:\hbnhnh.exe37⤵PID:1608
-
\??\c:\5xlrfff.exec:\5xlrfff.exe38⤵
- Executes dropped EXE
PID:852 -
\??\c:\7hbhnh.exec:\7hbhnh.exe39⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vdjvv.exec:\vdjvv.exe40⤵
- Executes dropped EXE
PID:3068 -
\??\c:\3ffrflf.exec:\3ffrflf.exe41⤵
- Executes dropped EXE
PID:2852 -
\??\c:\1bthbn.exec:\1bthbn.exe42⤵
- Executes dropped EXE
PID:2328 -
\??\c:\ddpdp.exec:\ddpdp.exe43⤵
- Executes dropped EXE
PID:2652 -
\??\c:\lxfxllf.exec:\lxfxllf.exe44⤵
- Executes dropped EXE
PID:2860 -
\??\c:\7tthhb.exec:\7tthhb.exe45⤵
- Executes dropped EXE
PID:2708 -
\??\c:\fffrfrf.exec:\fffrfrf.exe46⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hnhhbb.exec:\hnhhbb.exe47⤵
- Executes dropped EXE
PID:2428 -
\??\c:\ppjvj.exec:\ppjvj.exe48⤵
- Executes dropped EXE
PID:2564 -
\??\c:\frrxlfr.exec:\frrxlfr.exe49⤵
- Executes dropped EXE
PID:2940 -
\??\c:\5thhtt.exec:\5thhtt.exe50⤵
- Executes dropped EXE
PID:2128 -
\??\c:\pjdjv.exec:\pjdjv.exe51⤵
- Executes dropped EXE
PID:1248 -
\??\c:\7lflrrf.exec:\7lflrrf.exe52⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ntbtbh.exec:\ntbtbh.exe53⤵
- Executes dropped EXE
PID:2732 -
\??\c:\djpjj.exec:\djpjj.exe54⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xrflfrx.exec:\xrflfrx.exe55⤵
- Executes dropped EXE
PID:896 -
\??\c:\tththn.exec:\tththn.exe56⤵
- Executes dropped EXE
PID:1924 -
\??\c:\7vdjv.exec:\7vdjv.exe57⤵
- Executes dropped EXE
PID:2236 -
\??\c:\frlxrrf.exec:\frlxrrf.exe58⤵
- Executes dropped EXE
PID:2204 -
\??\c:\3bbnhn.exec:\3bbnhn.exe59⤵
- Executes dropped EXE
PID:776 -
\??\c:\jdvdj.exec:\jdvdj.exe60⤵
- Executes dropped EXE
PID:1296 -
\??\c:\fxxfxlf.exec:\fxxfxlf.exe61⤵
- Executes dropped EXE
PID:1224 -
\??\c:\bnbnnb.exec:\bnbnnb.exe62⤵
- Executes dropped EXE
PID:2380 -
\??\c:\pvpjv.exec:\pvpjv.exe63⤵
- Executes dropped EXE
PID:2268 -
\??\c:\1rlrxfr.exec:\1rlrxfr.exe64⤵
- Executes dropped EXE
PID:1992 -
\??\c:\bbtbtb.exec:\bbtbtb.exe65⤵
- Executes dropped EXE
PID:2828 -
\??\c:\btthbn.exec:\btthbn.exe66⤵
- Executes dropped EXE
PID:548 -
\??\c:\vpddv.exec:\vpddv.exe67⤵PID:2716
-
\??\c:\xxrxxfr.exec:\xxrxxfr.exe68⤵PID:404
-
\??\c:\ththnh.exec:\ththnh.exe69⤵PID:1444
-
\??\c:\fxrfrxl.exec:\fxrfrxl.exe70⤵PID:696
-
\??\c:\5flrxrr.exec:\5flrxrr.exe71⤵PID:1548
-
\??\c:\bhnhhh.exec:\bhnhhh.exe72⤵PID:1308
-
\??\c:\vpjvj.exec:\vpjvj.exe73⤵PID:2984
-
\??\c:\rlflrrl.exec:\rlflrrl.exe74⤵PID:700
-
\??\c:\1bthbb.exec:\1bthbb.exe75⤵PID:856
-
\??\c:\7pjdp.exec:\7pjdp.exe76⤵PID:2064
-
\??\c:\llfrxlf.exec:\llfrxlf.exe77⤵PID:1916
-
\??\c:\xxllxfr.exec:\xxllxfr.exe78⤵PID:580
-
\??\c:\hbtnhn.exec:\hbtnhn.exe79⤵PID:2156
-
\??\c:\3pjpd.exec:\3pjpd.exe80⤵PID:2816
-
\??\c:\xxlrflr.exec:\xxlrflr.exe81⤵PID:2220
-
\??\c:\lllrflf.exec:\lllrflf.exe82⤵PID:2012
-
\??\c:\btntht.exec:\btntht.exe83⤵PID:2960
-
\??\c:\ppjdv.exec:\ppjdv.exe84⤵PID:2896
-
\??\c:\rrrfxxl.exec:\rrrfxxl.exe85⤵PID:2916
-
\??\c:\hbbhnb.exec:\hbbhnb.exe86⤵PID:2320
-
\??\c:\pjvdj.exec:\pjvdj.exe87⤵PID:2836
-
\??\c:\1pdjv.exec:\1pdjv.exe88⤵PID:2508
-
\??\c:\llxxffl.exec:\llxxffl.exe89⤵PID:2636
-
\??\c:\nthntb.exec:\nthntb.exe90⤵PID:2604
-
\??\c:\5pddp.exec:\5pddp.exe91⤵PID:2524
-
\??\c:\7thntb.exec:\7thntb.exe92⤵PID:2512
-
\??\c:\7jddv.exec:\7jddv.exe93⤵PID:2180
-
\??\c:\lfrfxxx.exec:\lfrfxxx.exe94⤵PID:2948
-
\??\c:\bbbnhn.exec:\bbbnhn.exe95⤵PID:1376
-
\??\c:\3xfxxxx.exec:\3xfxxxx.exe96⤵PID:1808
-
\??\c:\nbnhth.exec:\nbnhth.exe97⤵PID:2700
-
\??\c:\bhhhbh.exec:\bhhhbh.exe98⤵PID:2736
-
\??\c:\djvpv.exec:\djvpv.exe99⤵PID:2712
-
\??\c:\rrlrllx.exec:\rrlrllx.exe100⤵PID:1900
-
\??\c:\tnntht.exec:\tnntht.exe101⤵PID:1060
-
\??\c:\jdpvj.exec:\jdpvj.exe102⤵PID:1640
-
\??\c:\xxrxrxr.exec:\xxrxrxr.exe103⤵PID:2208
-
\??\c:\nhbbnn.exec:\nhbbnn.exe104⤵PID:1356
-
\??\c:\9vpdj.exec:\9vpdj.exe105⤵PID:2952
-
\??\c:\xrfrxxf.exec:\xrfrxxf.exe106⤵PID:2344
-
\??\c:\hbtbnn.exec:\hbtbnn.exe107⤵PID:1232
-
\??\c:\bhbthn.exec:\bhbthn.exe108⤵PID:2284
-
\??\c:\jdvdv.exec:\jdvdv.exe109⤵PID:2268
-
\??\c:\rrflxlr.exec:\rrflxlr.exe110⤵PID:1992
-
\??\c:\lxlrxfl.exec:\lxlrxfl.exe111⤵PID:1156
-
\??\c:\3ntnhn.exec:\3ntnhn.exe112⤵PID:2312
-
\??\c:\pjdjv.exec:\pjdjv.exe113⤵PID:2316
-
\??\c:\1rlxlrl.exec:\1rlxlrl.exe114⤵PID:2460
-
\??\c:\hbnntn.exec:\hbnntn.exe115⤵PID:3008
-
\??\c:\vvdvd.exec:\vvdvd.exe116⤵PID:828
-
\??\c:\xxrrxlr.exec:\xxrrxlr.exe117⤵PID:1552
-
\??\c:\xxfflfx.exec:\xxfflfx.exe118⤵PID:348
-
\??\c:\ntthht.exec:\ntthht.exe119⤵PID:892
-
\??\c:\pdjpp.exec:\pdjpp.exe120⤵PID:1780
-
\??\c:\rrlrffr.exec:\rrlrffr.exe121⤵PID:2008
-
\??\c:\3thnbh.exec:\3thnbh.exe122⤵PID:2308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-