Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 22:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f94d45ab5800f079ea8e6e1e4db5500_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0f94d45ab5800f079ea8e6e1e4db5500_NeikiAnalytics.exe
-
Size
206KB
-
MD5
0f94d45ab5800f079ea8e6e1e4db5500
-
SHA1
0f00c10756732e71d0aaedefcb2cf0f6367426f9
-
SHA256
e451fda26406ceef6f017b3e414317049e478002b9a58604a7272a083dd96ac9
-
SHA512
dd6853f08208c72b0d580b8e7319949bcc31fe402129f94367effb4c8ef27b900027f53b028ea9d0698b4691e522d9d52d295745044526cfd5d14cc2d58372ef
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+C2HVM1p6TQpCihyo:PhOm2sI93UufdC67ciJTU2HVS64hyo
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/1620-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-71-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2552-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/804-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/300-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-325-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-408-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-417-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-454-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1260-462-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1660-481-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-482-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-501-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1136-520-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1888-527-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1000-577-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-682-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-1049-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/904-1280-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2444 hhtbnn.exe 2620 jdjpv.exe 2796 llxlffx.exe 2636 3fxrxfl.exe 2788 tbtnnn.exe 2536 rxrflxr.exe 2564 bbnbnt.exe 2552 llffrxr.exe 3032 7rrlxlr.exe 1852 vdjdd.exe 2704 jvvjp.exe 2708 btbnhn.exe 2876 hhhhtb.exe 1652 dvvvd.exe 1860 xxrfxxl.exe 804 jjppv.exe 2412 lrlxffx.exe 2872 htnttb.exe 3052 hbhbhn.exe 2904 1rllrxl.exe 2012 frlrrxx.exe 1916 bhhhnn.exe 548 1rfrxxf.exe 1560 ntnhbh.exe 1704 hhbtht.exe 296 dvpvj.exe 1284 lxfrrrr.exe 2148 3jvdj.exe 680 vpdjj.exe 2044 hhhhbb.exe 300 3djvd.exe 1088 7xrrfff.exe 1568 nnhbnt.exe 2296 pjjpj.exe 2832 7ppjp.exe 1692 1rffxxf.exe 2640 nhntnt.exe 2808 nhhhnb.exe 2796 dvjvd.exe 2636 rxlflrx.exe 2236 rflllff.exe 3068 btbhtt.exe 2648 bnbbhb.exe 2676 jdpvj.exe 2584 jjjvp.exe 3040 fxrxllr.exe 1004 nnhtnb.exe 2716 hbthhh.exe 2720 pjdvj.exe 2612 pjvdp.exe 2404 lrlffrr.exe 2316 3hbtbt.exe 1572 jdvjv.exe 1836 djvvv.exe 1548 rrlxrxl.exe 1528 hthbtt.exe 2888 bhhbbn.exe 1260 ddpvv.exe 2912 jjpjd.exe 2924 fxflrxl.exe 1660 hbthnb.exe 1824 dvdjv.exe 3008 vvpdj.exe 1976 rrrrllx.exe -
resource yara_rule behavioral1/memory/1620-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/804-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/680-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/300-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-325-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-344-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-351-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1004-382-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-408-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-417-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-454-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-481-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-482-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1136-520-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-527-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/800-546-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1000-577-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-621-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-682-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-785-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/348-823-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-873-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-1004-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/804-1011-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/704-1068-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/296-1088-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-1154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-1161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-1217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-1267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/564-1331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/640-1344-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-1363-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-1400-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2444 1620 0f94d45ab5800f079ea8e6e1e4db5500_NeikiAnalytics.exe 28 PID 1620 wrote to memory of 2444 1620 0f94d45ab5800f079ea8e6e1e4db5500_NeikiAnalytics.exe 28 PID 1620 wrote to memory of 2444 1620 0f94d45ab5800f079ea8e6e1e4db5500_NeikiAnalytics.exe 28 PID 1620 wrote to memory of 2444 1620 0f94d45ab5800f079ea8e6e1e4db5500_NeikiAnalytics.exe 28 PID 2444 wrote to memory of 2620 2444 hhtbnn.exe 29 PID 2444 wrote to memory of 2620 2444 hhtbnn.exe 29 PID 2444 wrote to memory of 2620 2444 hhtbnn.exe 29 PID 2444 wrote to memory of 2620 2444 hhtbnn.exe 29 PID 2620 wrote to memory of 2796 2620 jdjpv.exe 30 PID 2620 wrote to memory of 2796 2620 jdjpv.exe 30 PID 2620 wrote to memory of 2796 2620 jdjpv.exe 30 PID 2620 wrote to memory of 2796 2620 jdjpv.exe 30 PID 2796 wrote to memory of 2636 2796 llxlffx.exe 31 PID 2796 wrote to memory of 2636 2796 llxlffx.exe 31 PID 2796 wrote to memory of 2636 2796 llxlffx.exe 31 PID 2796 wrote to memory of 2636 2796 llxlffx.exe 31 PID 2636 wrote to memory of 2788 2636 3fxrxfl.exe 32 PID 2636 wrote to memory of 2788 2636 3fxrxfl.exe 32 PID 2636 wrote to memory of 2788 2636 3fxrxfl.exe 32 PID 2636 wrote to memory of 2788 2636 3fxrxfl.exe 32 PID 2788 wrote to memory of 2536 2788 tbtnnn.exe 33 PID 2788 wrote to memory of 2536 2788 tbtnnn.exe 33 PID 2788 wrote to memory of 2536 2788 tbtnnn.exe 33 PID 2788 wrote to memory of 2536 2788 tbtnnn.exe 33 PID 2536 wrote to memory of 2564 2536 rxrflxr.exe 34 PID 2536 wrote to memory of 2564 2536 rxrflxr.exe 34 PID 2536 wrote to memory of 2564 2536 rxrflxr.exe 34 PID 2536 wrote to memory of 2564 2536 rxrflxr.exe 34 PID 2564 wrote to memory of 2552 2564 bbnbnt.exe 35 PID 2564 wrote to memory of 2552 2564 bbnbnt.exe 35 PID 2564 wrote to memory of 2552 2564 bbnbnt.exe 35 PID 2564 wrote to memory of 2552 2564 bbnbnt.exe 35 PID 2552 wrote to memory of 3032 2552 llffrxr.exe 36 PID 2552 wrote to memory of 3032 2552 llffrxr.exe 36 PID 2552 wrote to memory of 3032 2552 llffrxr.exe 36 PID 2552 wrote to memory of 3032 2552 llffrxr.exe 36 PID 3032 wrote to memory of 1852 3032 7rrlxlr.exe 37 PID 3032 wrote to memory of 1852 3032 7rrlxlr.exe 37 PID 3032 wrote to memory of 1852 3032 7rrlxlr.exe 37 PID 3032 wrote to memory of 1852 3032 7rrlxlr.exe 37 PID 1852 wrote to memory of 2704 1852 vdjdd.exe 38 PID 1852 wrote to memory of 2704 1852 vdjdd.exe 38 PID 1852 wrote to memory of 2704 1852 vdjdd.exe 38 PID 1852 wrote to memory of 2704 1852 vdjdd.exe 38 PID 2704 wrote to memory of 2708 2704 jvvjp.exe 39 PID 2704 wrote to memory of 2708 2704 jvvjp.exe 39 PID 2704 wrote to memory of 2708 2704 jvvjp.exe 39 PID 2704 wrote to memory of 2708 2704 jvvjp.exe 39 PID 2708 wrote to memory of 2876 2708 btbnhn.exe 40 PID 2708 wrote to memory of 2876 2708 btbnhn.exe 40 PID 2708 wrote to memory of 2876 2708 btbnhn.exe 40 PID 2708 wrote to memory of 2876 2708 btbnhn.exe 40 PID 2876 wrote to memory of 1652 2876 hhhhtb.exe 41 PID 2876 wrote to memory of 1652 2876 hhhhtb.exe 41 PID 2876 wrote to memory of 1652 2876 hhhhtb.exe 41 PID 2876 wrote to memory of 1652 2876 hhhhtb.exe 41 PID 1652 wrote to memory of 1860 1652 dvvvd.exe 42 PID 1652 wrote to memory of 1860 1652 dvvvd.exe 42 PID 1652 wrote to memory of 1860 1652 dvvvd.exe 42 PID 1652 wrote to memory of 1860 1652 dvvvd.exe 42 PID 1860 wrote to memory of 804 1860 xxrfxxl.exe 43 PID 1860 wrote to memory of 804 1860 xxrfxxl.exe 43 PID 1860 wrote to memory of 804 1860 xxrfxxl.exe 43 PID 1860 wrote to memory of 804 1860 xxrfxxl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f94d45ab5800f079ea8e6e1e4db5500_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f94d45ab5800f079ea8e6e1e4db5500_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\hhtbnn.exec:\hhtbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\jdjpv.exec:\jdjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\llxlffx.exec:\llxlffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\3fxrxfl.exec:\3fxrxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\tbtnnn.exec:\tbtnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\rxrflxr.exec:\rxrflxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\bbnbnt.exec:\bbnbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\llffrxr.exec:\llffrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\7rrlxlr.exec:\7rrlxlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\vdjdd.exec:\vdjdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\jvvjp.exec:\jvvjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\btbnhn.exec:\btbnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\hhhhtb.exec:\hhhhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\dvvvd.exec:\dvvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\xxrfxxl.exec:\xxrfxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\jjppv.exec:\jjppv.exe17⤵
- Executes dropped EXE
PID:804 -
\??\c:\lrlxffx.exec:\lrlxffx.exe18⤵
- Executes dropped EXE
PID:2412 -
\??\c:\htnttb.exec:\htnttb.exe19⤵
- Executes dropped EXE
PID:2872 -
\??\c:\hbhbhn.exec:\hbhbhn.exe20⤵
- Executes dropped EXE
PID:3052 -
\??\c:\1rllrxl.exec:\1rllrxl.exe21⤵
- Executes dropped EXE
PID:2904 -
\??\c:\frlrrxx.exec:\frlrrxx.exe22⤵
- Executes dropped EXE
PID:2012 -
\??\c:\bhhhnn.exec:\bhhhnn.exe23⤵
- Executes dropped EXE
PID:1916 -
\??\c:\1rfrxxf.exec:\1rfrxxf.exe24⤵
- Executes dropped EXE
PID:548 -
\??\c:\ntnhbh.exec:\ntnhbh.exe25⤵
- Executes dropped EXE
PID:1560 -
\??\c:\hhbtht.exec:\hhbtht.exe26⤵
- Executes dropped EXE
PID:1704 -
\??\c:\dvpvj.exec:\dvpvj.exe27⤵
- Executes dropped EXE
PID:296 -
\??\c:\lxfrrrr.exec:\lxfrrrr.exe28⤵
- Executes dropped EXE
PID:1284 -
\??\c:\3jvdj.exec:\3jvdj.exe29⤵
- Executes dropped EXE
PID:2148 -
\??\c:\vpdjj.exec:\vpdjj.exe30⤵
- Executes dropped EXE
PID:680 -
\??\c:\hhhhbb.exec:\hhhhbb.exe31⤵
- Executes dropped EXE
PID:2044 -
\??\c:\3djvd.exec:\3djvd.exe32⤵
- Executes dropped EXE
PID:300 -
\??\c:\7xrrfff.exec:\7xrrfff.exe33⤵
- Executes dropped EXE
PID:1088 -
\??\c:\nnhbnt.exec:\nnhbnt.exe34⤵
- Executes dropped EXE
PID:1568 -
\??\c:\pjjpj.exec:\pjjpj.exe35⤵
- Executes dropped EXE
PID:2296 -
\??\c:\7ppjp.exec:\7ppjp.exe36⤵
- Executes dropped EXE
PID:2832 -
\??\c:\1rffxxf.exec:\1rffxxf.exe37⤵
- Executes dropped EXE
PID:1692 -
\??\c:\nhntnt.exec:\nhntnt.exe38⤵
- Executes dropped EXE
PID:2640 -
\??\c:\nhhhnb.exec:\nhhhnb.exe39⤵
- Executes dropped EXE
PID:2808 -
\??\c:\dvjvd.exec:\dvjvd.exe40⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rxlflrx.exec:\rxlflrx.exe41⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rflllff.exec:\rflllff.exe42⤵
- Executes dropped EXE
PID:2236 -
\??\c:\btbhtt.exec:\btbhtt.exe43⤵
- Executes dropped EXE
PID:3068 -
\??\c:\bnbbhb.exec:\bnbbhb.exe44⤵
- Executes dropped EXE
PID:2648 -
\??\c:\jdpvj.exec:\jdpvj.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jjjvp.exec:\jjjvp.exe46⤵
- Executes dropped EXE
PID:2584 -
\??\c:\fxrxllr.exec:\fxrxllr.exe47⤵
- Executes dropped EXE
PID:3040 -
\??\c:\nnhtnb.exec:\nnhtnb.exe48⤵
- Executes dropped EXE
PID:1004 -
\??\c:\hbthhh.exec:\hbthhh.exe49⤵
- Executes dropped EXE
PID:2716 -
\??\c:\pjdvj.exec:\pjdvj.exe50⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pjvdp.exec:\pjvdp.exe51⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lrlffrr.exec:\lrlffrr.exe52⤵
- Executes dropped EXE
PID:2404 -
\??\c:\3hbtbt.exec:\3hbtbt.exe53⤵
- Executes dropped EXE
PID:2316 -
\??\c:\jdvjv.exec:\jdvjv.exe54⤵
- Executes dropped EXE
PID:1572 -
\??\c:\djvvv.exec:\djvvv.exe55⤵
- Executes dropped EXE
PID:1836 -
\??\c:\rrlxrxl.exec:\rrlxrxl.exe56⤵
- Executes dropped EXE
PID:1548 -
\??\c:\hthbtt.exec:\hthbtt.exe57⤵
- Executes dropped EXE
PID:1528 -
\??\c:\bhhbbn.exec:\bhhbbn.exe58⤵
- Executes dropped EXE
PID:2888 -
\??\c:\ddpvv.exec:\ddpvv.exe59⤵
- Executes dropped EXE
PID:1260 -
\??\c:\jjpjd.exec:\jjpjd.exe60⤵
- Executes dropped EXE
PID:2912 -
\??\c:\fxflrxl.exec:\fxflrxl.exe61⤵
- Executes dropped EXE
PID:2924 -
\??\c:\hbthnb.exec:\hbthnb.exe62⤵
- Executes dropped EXE
PID:1660 -
\??\c:\dvdjv.exec:\dvdjv.exe63⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vvpdj.exec:\vvpdj.exe64⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rrrrllx.exec:\rrrrllx.exe65⤵
- Executes dropped EXE
PID:1976 -
\??\c:\3bttnn.exec:\3bttnn.exe66⤵PID:1408
-
\??\c:\btbbnn.exec:\btbbnn.exe67⤵PID:832
-
\??\c:\ddvdv.exec:\ddvdv.exe68⤵PID:1136
-
\??\c:\jdvvd.exec:\jdvvd.exe69⤵PID:1888
-
\??\c:\xrflfff.exec:\xrflfff.exe70⤵PID:1536
-
\??\c:\bnnttt.exec:\bnnttt.exe71⤵PID:940
-
\??\c:\btnttn.exec:\btnttn.exe72⤵PID:236
-
\??\c:\jddvv.exec:\jddvv.exe73⤵PID:800
-
\??\c:\rrllflx.exec:\rrllflx.exe74⤵PID:1912
-
\??\c:\rrflxxx.exec:\rrflxxx.exe75⤵PID:2024
-
\??\c:\nhtbth.exec:\nhtbth.exe76⤵PID:1140
-
\??\c:\tntbnt.exec:\tntbnt.exe77⤵PID:300
-
\??\c:\dvppd.exec:\dvppd.exe78⤵PID:1000
-
\??\c:\rfxflxf.exec:\rfxflxf.exe79⤵PID:1568
-
\??\c:\lfrxrrf.exec:\lfrxrrf.exe80⤵PID:2692
-
\??\c:\hbnnbt.exec:\hbnnbt.exe81⤵PID:2604
-
\??\c:\dvpdv.exec:\dvpdv.exe82⤵PID:2336
-
\??\c:\pjvdp.exec:\pjvdp.exe83⤵PID:2960
-
\??\c:\xrxxllf.exec:\xrxxllf.exe84⤵PID:2800
-
\??\c:\lflfxxf.exec:\lflfxxf.exe85⤵PID:2616
-
\??\c:\tnnbtt.exec:\tnnbtt.exe86⤵PID:2112
-
\??\c:\bbthbh.exec:\bbthbh.exe87⤵PID:2532
-
\??\c:\vvvjv.exec:\vvvjv.exe88⤵PID:2536
-
\??\c:\vpjvv.exec:\vpjvv.exe89⤵PID:2680
-
\??\c:\1rrxlrx.exec:\1rrxlrx.exe90⤵PID:2836
-
\??\c:\rlfrxfl.exec:\rlfrxfl.exe91⤵PID:2176
-
\??\c:\nhntbh.exec:\nhntbh.exe92⤵PID:280
-
\??\c:\3ddpv.exec:\3ddpv.exe93⤵PID:1920
-
\??\c:\vpjjd.exec:\vpjjd.exe94⤵PID:2740
-
\??\c:\xrlrxfl.exec:\xrlrxfl.exe95⤵PID:2744
-
\??\c:\fxllllr.exec:\fxllllr.exe96⤵PID:1588
-
\??\c:\nhbnbh.exec:\nhbnbh.exe97⤵PID:2188
-
\??\c:\tnthbh.exec:\tnthbh.exe98⤵PID:1592
-
\??\c:\7dvvv.exec:\7dvvv.exe99⤵PID:268
-
\??\c:\ddvdd.exec:\ddvdd.exe100⤵PID:872
-
\??\c:\xrlxfrx.exec:\xrlxfrx.exe101⤵PID:2032
-
\??\c:\lfrxfrf.exec:\lfrxfrf.exe102⤵PID:2864
-
\??\c:\ttbhnb.exec:\ttbhnb.exe103⤵PID:1528
-
\??\c:\jdjpd.exec:\jdjpd.exe104⤵PID:1352
-
\??\c:\pjdvd.exec:\pjdvd.exe105⤵PID:1272
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe106⤵PID:2920
-
\??\c:\fffrfrf.exec:\fffrfrf.exe107⤵PID:3024
-
\??\c:\hhhtht.exec:\hhhtht.exe108⤵PID:2212
-
\??\c:\7bhbnt.exec:\7bhbnt.exe109⤵PID:2268
-
\??\c:\9ddjd.exec:\9ddjd.exe110⤵PID:660
-
\??\c:\llxxxrx.exec:\llxxxrx.exe111⤵PID:704
-
\??\c:\lfrxllr.exec:\lfrxllr.exe112⤵PID:2972
-
\??\c:\5hbhtt.exec:\5hbhtt.exe113⤵PID:592
-
\??\c:\btnthh.exec:\btnthh.exe114⤵PID:1068
-
\??\c:\vpjpd.exec:\vpjpd.exe115⤵PID:1464
-
\??\c:\9jpvj.exec:\9jpvj.exe116⤵PID:952
-
\??\c:\rlxlffl.exec:\rlxlffl.exe117⤵PID:1304
-
\??\c:\tthtbb.exec:\tthtbb.exe118⤵PID:348
-
\??\c:\bnbtnt.exec:\bnbtnt.exe119⤵PID:1144
-
\??\c:\vpvdp.exec:\vpvdp.exe120⤵PID:1960
-
\??\c:\dvpjp.exec:\dvpjp.exe121⤵PID:2044
-
\??\c:\ffrxffl.exec:\ffrxffl.exe122⤵PID:2288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-