Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 04:29
Behavioral task
behavioral1
Sample
6dc20b8037865e2366416534ccf7c040_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
6dc20b8037865e2366416534ccf7c040_NeikiAnalytics.exe
-
Size
453KB
-
MD5
6dc20b8037865e2366416534ccf7c040
-
SHA1
f5d864e70e5e9788cfc87035a526525432ee8597
-
SHA256
cb459200d9c35872a41ab728e9d8246fd22583de59812c305d6fdaedc501b84e
-
SHA512
0186ec69aea9fc9aed64593629a6ff407c4a94418ea7637b866db45e6def7016f6877150d6ab4b4b20462f1c770485b296d174c9a932e662e27373e82a7f7378
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNml:x4wFHoS3eFaKHpv/VycgE81lgS
Malware Config
Signatures
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2116-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1076-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1244-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-288-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1764-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-311-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/3012-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1568-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1568-367-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1840-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-408-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2372-400-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/592-382-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2976-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-192-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2160-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1428-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/472-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1880-553-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-556-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1012-601-0x0000000000330000-0x0000000000357000-memory.dmp family_blackmoon behavioral1/memory/2208-602-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1012-600-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-609-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-653-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-675-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-672-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2484-678-0x0000000000320000-0x0000000000347000-memory.dmp family_blackmoon behavioral1/memory/1996-688-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1936-729-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-728-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-744-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-743-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-807-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2116 tfbnh.exe 2712 fbhhb.exe 2864 nvtddjf.exe 2848 tnbpfx.exe 2468 rtnnv.exe 2472 frvbb.exe 2212 plprl.exe 472 rxtbtb.exe 1076 tjtblpf.exe 1712 bjblx.exe 2612 frfbfv.exe 2956 vbjlb.exe 2608 brnfp.exe 1428 vjndph.exe 2160 nrbfb.exe 1244 dlrbv.exe 2672 lprpl.exe 2024 dftxl.exe 1820 vjnnhfl.exe 2072 pljfl.exe 2032 ftdtr.exe 2272 lpfjvx.exe 2316 ntdxvn.exe 432 rvhxd.exe 1136 vbtbdp.exe 1504 htpfll.exe 1360 rjnvvn.exe 1780 tlvdj.exe 852 hlhtx.exe 2204 dxpvhx.exe 2344 jbxxxld.exe 1764 npnpj.exe 2364 jdhrhrv.exe 3032 vnbrnrf.exe 1876 ndjnhb.exe 3012 tfpjvfv.exe 1568 vhhlppf.exe 2736 hrfntd.exe 2712 trhxvdp.exe 2864 bndpt.exe 2972 njrfp.exe 2688 htpblxh.exe 2976 fvvdrdb.exe 592 lttbtbv.exe 2404 phrrp.exe 2432 dlxvxv.exe 2372 pfhxpj.exe 2820 bdtdbf.exe 2952 bflfn.exe 2812 xfbhrh.exe 2644 bnhjxn.exe 2624 jfjlpvj.exe 2324 lthxfl.exe 2636 npljt.exe 2676 xjjbbbf.exe 1032 tjpbdd.exe 1840 lndpln.exe 1768 hxtvv.exe 1820 vbnrb.exe 2088 dnrbbx.exe 2156 rbvlj.exe 2880 xnblt.exe 2144 tjhlp.exe 1928 fdfxvnr.exe -
resource yara_rule behavioral1/memory/2760-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000014909-10.dat upx behavioral1/memory/2116-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-8-0x00000000003D0000-0x00000000003F7000-memory.dmp upx behavioral1/memory/2760-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x002c000000014b6d-17.dat upx behavioral1/files/0x002c000000014c67-28.dat upx behavioral1/memory/2712-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015264-37.dat upx behavioral1/memory/2864-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2468-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015364-48.dat upx behavioral1/memory/2848-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001560a-57.dat upx behavioral1/memory/2468-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2212-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2472-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015cb9-67.dat upx behavioral1/files/0x000e000000014e3d-75.dat upx behavioral1/files/0x0007000000016cf0-85.dat upx behavioral1/files/0x0006000000016d01-95.dat upx behavioral1/memory/1712-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d11-102.dat upx behavioral1/files/0x0006000000016d24-110.dat upx behavioral1/memory/1076-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d36-121.dat upx behavioral1/files/0x0006000000016d41-130.dat upx behavioral1/files/0x0006000000016d4a-138.dat upx behavioral1/files/0x0006000000016d4f-148.dat upx behavioral1/files/0x0006000000016d55-158.dat upx behavioral1/memory/1244-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d84-167.dat upx behavioral1/memory/2024-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d89-176.dat upx behavioral1/files/0x0006000000016e56-186.dat upx behavioral1/files/0x000600000001704f-194.dat upx behavioral1/files/0x0006000000017090-203.dat upx behavioral1/files/0x000500000001868c-211.dat upx behavioral1/files/0x0005000000018698-221.dat upx behavioral1/memory/432-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186a0-228.dat upx behavioral1/files/0x0006000000018ae2-236.dat upx behavioral1/files/0x0006000000018ae8-245.dat upx behavioral1/memory/852-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b33-263.dat upx behavioral1/files/0x0006000000018b15-254.dat upx behavioral1/files/0x0006000000018b37-270.dat upx behavioral1/memory/2204-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b42-278.dat upx behavioral1/memory/1764-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b4a-290.dat upx behavioral1/memory/1136-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2032-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1568-332-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2736-340-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1840-474-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2880-501-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-454-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2624-432-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-425-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/592-375-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2976-374-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-318-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2760 wrote to memory of 2116 2760 6dc20b8037865e2366416534ccf7c040_NeikiAnalytics.exe 28 PID 2760 wrote to memory of 2116 2760 6dc20b8037865e2366416534ccf7c040_NeikiAnalytics.exe 28 PID 2760 wrote to memory of 2116 2760 6dc20b8037865e2366416534ccf7c040_NeikiAnalytics.exe 28 PID 2760 wrote to memory of 2116 2760 6dc20b8037865e2366416534ccf7c040_NeikiAnalytics.exe 28 PID 2116 wrote to memory of 2712 2116 tfbnh.exe 66 PID 2116 wrote to memory of 2712 2116 tfbnh.exe 66 PID 2116 wrote to memory of 2712 2116 tfbnh.exe 66 PID 2116 wrote to memory of 2712 2116 tfbnh.exe 66 PID 2712 wrote to memory of 2864 2712 fbhhb.exe 67 PID 2712 wrote to memory of 2864 2712 fbhhb.exe 67 PID 2712 wrote to memory of 2864 2712 fbhhb.exe 67 PID 2712 wrote to memory of 2864 2712 fbhhb.exe 67 PID 2864 wrote to memory of 2848 2864 nvtddjf.exe 31 PID 2864 wrote to memory of 2848 2864 nvtddjf.exe 31 PID 2864 wrote to memory of 2848 2864 nvtddjf.exe 31 PID 2864 wrote to memory of 2848 2864 nvtddjf.exe 31 PID 2848 wrote to memory of 2468 2848 tnbpfx.exe 32 PID 2848 wrote to memory of 2468 2848 tnbpfx.exe 32 PID 2848 wrote to memory of 2468 2848 tnbpfx.exe 32 PID 2848 wrote to memory of 2468 2848 tnbpfx.exe 32 PID 2468 wrote to memory of 2472 2468 rtnnv.exe 33 PID 2468 wrote to memory of 2472 2468 rtnnv.exe 33 PID 2468 wrote to memory of 2472 2468 rtnnv.exe 33 PID 2468 wrote to memory of 2472 2468 rtnnv.exe 33 PID 2472 wrote to memory of 2212 2472 frvbb.exe 34 PID 2472 wrote to memory of 2212 2472 frvbb.exe 34 PID 2472 wrote to memory of 2212 2472 frvbb.exe 34 PID 2472 wrote to memory of 2212 2472 frvbb.exe 34 PID 2212 wrote to memory of 472 2212 plprl.exe 35 PID 2212 wrote to memory of 472 2212 plprl.exe 35 PID 2212 wrote to memory of 472 2212 plprl.exe 35 PID 2212 wrote to memory of 472 2212 plprl.exe 35 PID 472 wrote to memory of 1076 472 rxtbtb.exe 36 PID 472 wrote to memory of 1076 472 rxtbtb.exe 36 PID 472 wrote to memory of 1076 472 rxtbtb.exe 36 PID 472 wrote to memory of 1076 472 rxtbtb.exe 36 PID 1076 wrote to memory of 1712 1076 tjtblpf.exe 37 PID 1076 wrote to memory of 1712 1076 tjtblpf.exe 37 PID 1076 wrote to memory of 1712 1076 tjtblpf.exe 37 PID 1076 wrote to memory of 1712 1076 tjtblpf.exe 37 PID 1712 wrote to memory of 2612 1712 bjblx.exe 38 PID 1712 wrote to memory of 2612 1712 bjblx.exe 38 PID 1712 wrote to memory of 2612 1712 bjblx.exe 38 PID 1712 wrote to memory of 2612 1712 bjblx.exe 38 PID 2612 wrote to memory of 2956 2612 frfbfv.exe 39 PID 2612 wrote to memory of 2956 2612 frfbfv.exe 39 PID 2612 wrote to memory of 2956 2612 frfbfv.exe 39 PID 2612 wrote to memory of 2956 2612 frfbfv.exe 39 PID 2956 wrote to memory of 2608 2956 vbjlb.exe 40 PID 2956 wrote to memory of 2608 2956 vbjlb.exe 40 PID 2956 wrote to memory of 2608 2956 vbjlb.exe 40 PID 2956 wrote to memory of 2608 2956 vbjlb.exe 40 PID 2608 wrote to memory of 1428 2608 brnfp.exe 41 PID 2608 wrote to memory of 1428 2608 brnfp.exe 41 PID 2608 wrote to memory of 1428 2608 brnfp.exe 41 PID 2608 wrote to memory of 1428 2608 brnfp.exe 41 PID 1428 wrote to memory of 2160 1428 vjndph.exe 42 PID 1428 wrote to memory of 2160 1428 vjndph.exe 42 PID 1428 wrote to memory of 2160 1428 vjndph.exe 42 PID 1428 wrote to memory of 2160 1428 vjndph.exe 42 PID 2160 wrote to memory of 1244 2160 nrbfb.exe 43 PID 2160 wrote to memory of 1244 2160 nrbfb.exe 43 PID 2160 wrote to memory of 1244 2160 nrbfb.exe 43 PID 2160 wrote to memory of 1244 2160 nrbfb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6dc20b8037865e2366416534ccf7c040_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6dc20b8037865e2366416534ccf7c040_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\tfbnh.exec:\tfbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\fbhhb.exec:\fbhhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nvtddjf.exec:\nvtddjf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\tnbpfx.exec:\tnbpfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\rtnnv.exec:\rtnnv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\frvbb.exec:\frvbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\plprl.exec:\plprl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\rxtbtb.exec:\rxtbtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
\??\c:\tjtblpf.exec:\tjtblpf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\bjblx.exec:\bjblx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\frfbfv.exec:\frfbfv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\vbjlb.exec:\vbjlb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\brnfp.exec:\brnfp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\vjndph.exec:\vjndph.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\nrbfb.exec:\nrbfb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\dlrbv.exec:\dlrbv.exe17⤵
- Executes dropped EXE
PID:1244 -
\??\c:\lprpl.exec:\lprpl.exe18⤵
- Executes dropped EXE
PID:2672 -
\??\c:\dftxl.exec:\dftxl.exe19⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vjnnhfl.exec:\vjnnhfl.exe20⤵
- Executes dropped EXE
PID:1820 -
\??\c:\pljfl.exec:\pljfl.exe21⤵
- Executes dropped EXE
PID:2072 -
\??\c:\ftdtr.exec:\ftdtr.exe22⤵
- Executes dropped EXE
PID:2032 -
\??\c:\lpfjvx.exec:\lpfjvx.exe23⤵
- Executes dropped EXE
PID:2272 -
\??\c:\ntdxvn.exec:\ntdxvn.exe24⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rvhxd.exec:\rvhxd.exe25⤵
- Executes dropped EXE
PID:432 -
\??\c:\vbtbdp.exec:\vbtbdp.exe26⤵
- Executes dropped EXE
PID:1136 -
\??\c:\htpfll.exec:\htpfll.exe27⤵
- Executes dropped EXE
PID:1504 -
\??\c:\rjnvvn.exec:\rjnvvn.exe28⤵
- Executes dropped EXE
PID:1360 -
\??\c:\tlvdj.exec:\tlvdj.exe29⤵
- Executes dropped EXE
PID:1780 -
\??\c:\hlhtx.exec:\hlhtx.exe30⤵
- Executes dropped EXE
PID:852 -
\??\c:\dxpvhx.exec:\dxpvhx.exe31⤵
- Executes dropped EXE
PID:2204 -
\??\c:\jbxxxld.exec:\jbxxxld.exe32⤵
- Executes dropped EXE
PID:2344 -
\??\c:\npnpj.exec:\npnpj.exe33⤵
- Executes dropped EXE
PID:1764 -
\??\c:\jdhrhrv.exec:\jdhrhrv.exe34⤵
- Executes dropped EXE
PID:2364 -
\??\c:\vnbrnrf.exec:\vnbrnrf.exe35⤵
- Executes dropped EXE
PID:3032 -
\??\c:\ndjnhb.exec:\ndjnhb.exe36⤵
- Executes dropped EXE
PID:1876 -
\??\c:\tfpjvfv.exec:\tfpjvfv.exe37⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vhhlppf.exec:\vhhlppf.exe38⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hrfntd.exec:\hrfntd.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\trhxvdp.exec:\trhxvdp.exe40⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bndpt.exec:\bndpt.exe41⤵
- Executes dropped EXE
PID:2864 -
\??\c:\njrfp.exec:\njrfp.exe42⤵
- Executes dropped EXE
PID:2972 -
\??\c:\htpblxh.exec:\htpblxh.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fvvdrdb.exec:\fvvdrdb.exe44⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lttbtbv.exec:\lttbtbv.exe45⤵
- Executes dropped EXE
PID:592 -
\??\c:\phrrp.exec:\phrrp.exe46⤵
- Executes dropped EXE
PID:2404 -
\??\c:\dlxvxv.exec:\dlxvxv.exe47⤵
- Executes dropped EXE
PID:2432 -
\??\c:\pfhxpj.exec:\pfhxpj.exe48⤵
- Executes dropped EXE
PID:2372 -
\??\c:\bdtdbf.exec:\bdtdbf.exe49⤵
- Executes dropped EXE
PID:2820 -
\??\c:\bflfn.exec:\bflfn.exe50⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xfbhrh.exec:\xfbhrh.exe51⤵
- Executes dropped EXE
PID:2812 -
\??\c:\bnhjxn.exec:\bnhjxn.exe52⤵
- Executes dropped EXE
PID:2644 -
\??\c:\jfjlpvj.exec:\jfjlpvj.exe53⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lthxfl.exec:\lthxfl.exe54⤵
- Executes dropped EXE
PID:2324 -
\??\c:\npljt.exec:\npljt.exe55⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xjjbbbf.exec:\xjjbbbf.exe56⤵
- Executes dropped EXE
PID:2676 -
\??\c:\tjpbdd.exec:\tjpbdd.exe57⤵
- Executes dropped EXE
PID:1032 -
\??\c:\lndpln.exec:\lndpln.exe58⤵
- Executes dropped EXE
PID:1840 -
\??\c:\hxtvv.exec:\hxtvv.exe59⤵
- Executes dropped EXE
PID:1768 -
\??\c:\vbnrb.exec:\vbnrb.exe60⤵
- Executes dropped EXE
PID:1820 -
\??\c:\dnrbbx.exec:\dnrbbx.exe61⤵
- Executes dropped EXE
PID:2088 -
\??\c:\rbvlj.exec:\rbvlj.exe62⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xnblt.exec:\xnblt.exe63⤵
- Executes dropped EXE
PID:2880 -
\??\c:\tjhlp.exec:\tjhlp.exe64⤵
- Executes dropped EXE
PID:2144 -
\??\c:\fdfxvnr.exec:\fdfxvnr.exe65⤵
- Executes dropped EXE
PID:1928 -
\??\c:\dbvfjpx.exec:\dbvfjpx.exe66⤵PID:1108
-
\??\c:\hbbnnr.exec:\hbbnnr.exe67⤵PID:1344
-
\??\c:\bxpjjfj.exec:\bxpjjfj.exe68⤵PID:1516
-
\??\c:\pnprnh.exec:\pnprnh.exe69⤵PID:1604
-
\??\c:\nblvn.exec:\nblvn.exe70⤵PID:1880
-
\??\c:\nfphf.exec:\nfphf.exe71⤵PID:2900
-
\??\c:\brpjt.exec:\brpjt.exe72⤵PID:2208
-
\??\c:\tjlfpll.exec:\tjlfpll.exe73⤵PID:1312
-
\??\c:\pjfppn.exec:\pjfppn.exe74⤵PID:636
-
\??\c:\xrjrntv.exec:\xrjrntv.exe75⤵PID:800
-
\??\c:\lxfrrt.exec:\lxfrrt.exe76⤵PID:2240
-
\??\c:\xthpr.exec:\xthpr.exe77⤵PID:1012
-
\??\c:\xbjtdl.exec:\xbjtdl.exe78⤵PID:1952
-
\??\c:\nhrnh.exec:\nhrnh.exe79⤵PID:2352
-
\??\c:\xffrt.exec:\xffrt.exe80⤵PID:3056
-
\??\c:\rrrfbl.exec:\rrrfbl.exe81⤵PID:1956
-
\??\c:\xjfnt.exec:\xjfnt.exe82⤵PID:2564
-
\??\c:\bbttxp.exec:\bbttxp.exe83⤵PID:2752
-
\??\c:\xxdxbjf.exec:\xxdxbjf.exe84⤵PID:2708
-
\??\c:\hfxfxfj.exec:\hfxfxfj.exe85⤵PID:2552
-
\??\c:\txxjrrf.exec:\txxjrrf.exe86⤵PID:2104
-
\??\c:\jttlxp.exec:\jttlxp.exe87⤵PID:2524
-
\??\c:\rlbltlh.exec:\rlbltlh.exe88⤵PID:2492
-
\??\c:\rtpdld.exec:\rtpdld.exe89⤵PID:2484
-
\??\c:\hpvnr.exec:\hpvnr.exe90⤵PID:1996
-
\??\c:\tfdpvpr.exec:\tfdpvpr.exe91⤵PID:652
-
\??\c:\drjbld.exec:\drjbld.exe92⤵PID:2936
-
\??\c:\hjxnj.exec:\hjxnj.exe93⤵PID:2800
-
\??\c:\btbhnb.exec:\btbhnb.exe94⤵PID:1796
-
\??\c:\fnnbpjh.exec:\fnnbpjh.exe95⤵PID:2748
-
\??\c:\jjvxr.exec:\jjvxr.exe96⤵PID:1716
-
\??\c:\jhjdh.exec:\jhjdh.exe97⤵PID:1936
-
\??\c:\ndhdlbp.exec:\ndhdlbp.exe98⤵PID:2732
-
\??\c:\vvfbjv.exec:\vvfbjv.exe99⤵PID:1712
-
\??\c:\rrbhfnh.exec:\rrbhfnh.exe100⤵PID:1244
-
\??\c:\fjhvt.exec:\fjhvt.exe101⤵PID:1832
-
\??\c:\jfpdp.exec:\jfpdp.exe102⤵PID:1324
-
\??\c:\xftllx.exec:\xftllx.exe103⤵PID:2320
-
\??\c:\jrvtj.exec:\jrvtj.exe104⤵PID:1840
-
\??\c:\bhddtr.exec:\bhddtr.exe105⤵PID:1768
-
\??\c:\vhvvft.exec:\vhvvft.exe106⤵PID:2328
-
\??\c:\tvdxb.exec:\tvdxb.exe107⤵PID:1644
-
\??\c:\nnlpf.exec:\nnlpf.exe108⤵PID:1864
-
\??\c:\xdbxrn.exec:\xdbxrn.exe109⤵PID:2288
-
\??\c:\ddtnfv.exec:\ddtnfv.exe110⤵PID:1980
-
\??\c:\xtrvjv.exec:\xtrvjv.exe111⤵PID:2092
-
\??\c:\jtfhlp.exec:\jtfhlp.exe112⤵PID:1052
-
\??\c:\jdjxbtb.exec:\jdjxbtb.exe113⤵PID:2640
-
\??\c:\dhhvf.exec:\dhhvf.exe114⤵PID:1316
-
\??\c:\hfppffv.exec:\hfppffv.exe115⤵PID:2296
-
\??\c:\ppddv.exec:\ppddv.exe116⤵PID:1156
-
\??\c:\pfnrp.exec:\pfnrp.exe117⤵PID:1780
-
\??\c:\vrblj.exec:\vrblj.exe118⤵PID:2384
-
\??\c:\bdxhxp.exec:\bdxhxp.exe119⤵PID:2244
-
\??\c:\bxdrbb.exec:\bxdrbb.exe120⤵PID:1312
-
\??\c:\dpjhlh.exec:\dpjhlh.exe121⤵PID:636
-
\??\c:\bjrblnh.exec:\bjrblnh.exe122⤵PID:1304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-