Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 20:47
Behavioral task
behavioral1
Sample
37c573a93e73f632ae5123a798f80c40_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
37c573a93e73f632ae5123a798f80c40_NeikiAnalytics.exe
-
Size
340KB
-
MD5
37c573a93e73f632ae5123a798f80c40
-
SHA1
81a526a2211d721bf6516fd4161a65bda3d0bad5
-
SHA256
45a8b24df3346005928185943b40d68704f03768e3d8cfb81c7fdb61a1a3e564
-
SHA512
f9016ccc2ff8efacfb05dab099b5f84dbbfcb44b7c4f2de0d0f9190573d7d00535239782cad9293364d29f7e6c8cb062443dc4e570a1d2c1b849d9b961fd3b48
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBHNgu5ex1B2OkEv0KvmhNiYx2:9cm4FmowdHoS4BtguSPKyHYk
Malware Config
Signatures
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2292-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2076-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-39-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2912-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-76-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2872-82-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2660-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/944-139-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/944-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/764-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1504-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/880-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1052-290-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/928-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-340-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2812-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-417-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2380-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/828-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1044-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1292-469-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/908-473-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/816-490-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/764-497-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/764-518-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1104-526-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/760-597-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1508-656-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2368-805-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-879-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1136-1116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1896-1165-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2680-1180-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2076 rdlnvf.exe 2240 vrrfbx.exe 2872 ffnhlj.exe 2912 ffbjbbf.exe 3020 plfvxtn.exe 2988 hlfrxdx.exe 2540 hpvbpnf.exe 2660 vljrnh.exe 2404 fvxvl.exe 2436 pltjxn.exe 2444 xtprvvl.exe 2448 lpdhbb.exe 1020 hpxvjhp.exe 944 nbrrdd.exe 1696 tddxbvn.exe 2000 vdfjdd.exe 2284 phntv.exe 2036 ddlfdtd.exe 764 hftfd.exe 2440 tffjnpx.exe 2472 thlbf.exe 2720 jnxdnln.exe 2700 npfxx.exe 1504 xrfhl.exe 568 rdppr.exe 1920 trbvdl.exe 1304 xltrpnb.exe 1636 brdtfth.exe 576 npldvd.exe 880 hbfbxl.exe 1052 txxvjd.exe 2972 jlbhn.exe 928 ffhrpjb.exe 2020 rtjvv.exe 2228 fvjlnn.exe 2292 dvhjx.exe 1908 hrvnxd.exe 2812 lbnlf.exe 2304 pthtlpt.exe 2464 hnfljn.exe 2652 bvnvjnx.exe 3036 lfbbb.exe 2920 blrjtpj.exe 2752 frllrdd.exe 2492 pftpffn.exe 2516 tnfrxh.exe 2768 vjxfx.exe 2408 ftlvjlj.exe 2520 rbfbd.exe 2380 lrdrhvt.exe 2456 rxdfl.exe 2840 llrvtx.exe 828 dpdfn.exe 1044 vdtjl.exe 1248 lblhnj.exe 1340 nlrrnv.exe 2280 vpvrhj.exe 1292 rlbpn.exe 908 fjfjx.exe 528 fjnvfnl.exe 816 lnrjl.exe 764 vlfbfdv.exe 684 btfnx.exe 2728 ntfhv.exe -
resource yara_rule behavioral1/memory/2292-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2292-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2292-6-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0009000000016c90-11.dat upx behavioral1/files/0x0009000000016d01-19.dat upx behavioral1/memory/2076-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d4a-26.dat upx behavioral1/memory/2872-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2240-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2872-39-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0007000000016d4f-38.dat upx behavioral1/memory/2872-37-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2912-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d55-46.dat upx behavioral1/memory/3020-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d84-57.dat upx behavioral1/memory/3020-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2988-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d24-67.dat upx behavioral1/memory/2540-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b42-78.dat upx behavioral1/memory/2540-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ef-88.dat upx behavioral1/memory/2660-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194f2-96.dat upx behavioral1/memory/2404-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2436-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194f4-106.dat upx behavioral1/memory/2444-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001950c-114.dat upx behavioral1/files/0x0005000000019521-123.dat upx behavioral1/files/0x0005000000019547-131.dat upx behavioral1/memory/944-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019570-143.dat upx behavioral1/memory/944-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001959c-149.dat upx behavioral1/memory/2000-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001959e-159.dat upx behavioral1/memory/2284-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a2-169.dat upx behavioral1/files/0x00050000000195a4-176.dat upx behavioral1/memory/2036-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/764-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a6-188.dat upx behavioral1/files/0x00050000000195a7-195.dat upx behavioral1/memory/2440-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a8-206.dat upx behavioral1/files/0x00050000000195a9-215.dat upx behavioral1/memory/2700-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195aa-223.dat upx behavioral1/files/0x00050000000195ba-233.dat upx behavioral1/memory/1504-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195ff-240.dat upx behavioral1/files/0x0005000000019646-248.dat upx behavioral1/files/0x00050000000196d8-256.dat upx behavioral1/files/0x000500000001996e-265.dat upx behavioral1/files/0x0005000000019bd6-273.dat upx behavioral1/files/0x0005000000019bd7-282.dat upx behavioral1/memory/880-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bd8-291.dat upx behavioral1/memory/928-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/928-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2020-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1908-333-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2076 2292 37c573a93e73f632ae5123a798f80c40_NeikiAnalytics.exe 28 PID 2292 wrote to memory of 2076 2292 37c573a93e73f632ae5123a798f80c40_NeikiAnalytics.exe 28 PID 2292 wrote to memory of 2076 2292 37c573a93e73f632ae5123a798f80c40_NeikiAnalytics.exe 28 PID 2292 wrote to memory of 2076 2292 37c573a93e73f632ae5123a798f80c40_NeikiAnalytics.exe 28 PID 2076 wrote to memory of 2240 2076 rdlnvf.exe 29 PID 2076 wrote to memory of 2240 2076 rdlnvf.exe 29 PID 2076 wrote to memory of 2240 2076 rdlnvf.exe 29 PID 2076 wrote to memory of 2240 2076 rdlnvf.exe 29 PID 2240 wrote to memory of 2872 2240 vrrfbx.exe 30 PID 2240 wrote to memory of 2872 2240 vrrfbx.exe 30 PID 2240 wrote to memory of 2872 2240 vrrfbx.exe 30 PID 2240 wrote to memory of 2872 2240 vrrfbx.exe 30 PID 2872 wrote to memory of 2912 2872 ffnhlj.exe 31 PID 2872 wrote to memory of 2912 2872 ffnhlj.exe 31 PID 2872 wrote to memory of 2912 2872 ffnhlj.exe 31 PID 2872 wrote to memory of 2912 2872 ffnhlj.exe 31 PID 2912 wrote to memory of 3020 2912 ffbjbbf.exe 32 PID 2912 wrote to memory of 3020 2912 ffbjbbf.exe 32 PID 2912 wrote to memory of 3020 2912 ffbjbbf.exe 32 PID 2912 wrote to memory of 3020 2912 ffbjbbf.exe 32 PID 3020 wrote to memory of 2988 3020 plfvxtn.exe 33 PID 3020 wrote to memory of 2988 3020 plfvxtn.exe 33 PID 3020 wrote to memory of 2988 3020 plfvxtn.exe 33 PID 3020 wrote to memory of 2988 3020 plfvxtn.exe 33 PID 2988 wrote to memory of 2540 2988 hlfrxdx.exe 34 PID 2988 wrote to memory of 2540 2988 hlfrxdx.exe 34 PID 2988 wrote to memory of 2540 2988 hlfrxdx.exe 34 PID 2988 wrote to memory of 2540 2988 hlfrxdx.exe 34 PID 2540 wrote to memory of 2660 2540 hpvbpnf.exe 35 PID 2540 wrote to memory of 2660 2540 hpvbpnf.exe 35 PID 2540 wrote to memory of 2660 2540 hpvbpnf.exe 35 PID 2540 wrote to memory of 2660 2540 hpvbpnf.exe 35 PID 2660 wrote to memory of 2404 2660 vljrnh.exe 36 PID 2660 wrote to memory of 2404 2660 vljrnh.exe 36 PID 2660 wrote to memory of 2404 2660 vljrnh.exe 36 PID 2660 wrote to memory of 2404 2660 vljrnh.exe 36 PID 2404 wrote to memory of 2436 2404 fvxvl.exe 37 PID 2404 wrote to memory of 2436 2404 fvxvl.exe 37 PID 2404 wrote to memory of 2436 2404 fvxvl.exe 37 PID 2404 wrote to memory of 2436 2404 fvxvl.exe 37 PID 2436 wrote to memory of 2444 2436 pltjxn.exe 38 PID 2436 wrote to memory of 2444 2436 pltjxn.exe 38 PID 2436 wrote to memory of 2444 2436 pltjxn.exe 38 PID 2436 wrote to memory of 2444 2436 pltjxn.exe 38 PID 2444 wrote to memory of 2448 2444 xtprvvl.exe 39 PID 2444 wrote to memory of 2448 2444 xtprvvl.exe 39 PID 2444 wrote to memory of 2448 2444 xtprvvl.exe 39 PID 2444 wrote to memory of 2448 2444 xtprvvl.exe 39 PID 2448 wrote to memory of 1020 2448 lpdhbb.exe 40 PID 2448 wrote to memory of 1020 2448 lpdhbb.exe 40 PID 2448 wrote to memory of 1020 2448 lpdhbb.exe 40 PID 2448 wrote to memory of 1020 2448 lpdhbb.exe 40 PID 1020 wrote to memory of 944 1020 hpxvjhp.exe 41 PID 1020 wrote to memory of 944 1020 hpxvjhp.exe 41 PID 1020 wrote to memory of 944 1020 hpxvjhp.exe 41 PID 1020 wrote to memory of 944 1020 hpxvjhp.exe 41 PID 944 wrote to memory of 1696 944 nbrrdd.exe 42 PID 944 wrote to memory of 1696 944 nbrrdd.exe 42 PID 944 wrote to memory of 1696 944 nbrrdd.exe 42 PID 944 wrote to memory of 1696 944 nbrrdd.exe 42 PID 1696 wrote to memory of 2000 1696 tddxbvn.exe 43 PID 1696 wrote to memory of 2000 1696 tddxbvn.exe 43 PID 1696 wrote to memory of 2000 1696 tddxbvn.exe 43 PID 1696 wrote to memory of 2000 1696 tddxbvn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\37c573a93e73f632ae5123a798f80c40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\37c573a93e73f632ae5123a798f80c40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\rdlnvf.exec:\rdlnvf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\vrrfbx.exec:\vrrfbx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\ffnhlj.exec:\ffnhlj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\ffbjbbf.exec:\ffbjbbf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\plfvxtn.exec:\plfvxtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\hlfrxdx.exec:\hlfrxdx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\hpvbpnf.exec:\hpvbpnf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\vljrnh.exec:\vljrnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\fvxvl.exec:\fvxvl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\pltjxn.exec:\pltjxn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\xtprvvl.exec:\xtprvvl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\lpdhbb.exec:\lpdhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\hpxvjhp.exec:\hpxvjhp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\nbrrdd.exec:\nbrrdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\tddxbvn.exec:\tddxbvn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\vdfjdd.exec:\vdfjdd.exe17⤵
- Executes dropped EXE
PID:2000 -
\??\c:\phntv.exec:\phntv.exe18⤵
- Executes dropped EXE
PID:2284 -
\??\c:\ddlfdtd.exec:\ddlfdtd.exe19⤵
- Executes dropped EXE
PID:2036 -
\??\c:\hftfd.exec:\hftfd.exe20⤵
- Executes dropped EXE
PID:764 -
\??\c:\tffjnpx.exec:\tffjnpx.exe21⤵
- Executes dropped EXE
PID:2440 -
\??\c:\thlbf.exec:\thlbf.exe22⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jnxdnln.exec:\jnxdnln.exe23⤵
- Executes dropped EXE
PID:2720 -
\??\c:\npfxx.exec:\npfxx.exe24⤵
- Executes dropped EXE
PID:2700 -
\??\c:\xrfhl.exec:\xrfhl.exe25⤵
- Executes dropped EXE
PID:1504 -
\??\c:\rdppr.exec:\rdppr.exe26⤵
- Executes dropped EXE
PID:568 -
\??\c:\trbvdl.exec:\trbvdl.exe27⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xltrpnb.exec:\xltrpnb.exe28⤵
- Executes dropped EXE
PID:1304 -
\??\c:\brdtfth.exec:\brdtfth.exe29⤵
- Executes dropped EXE
PID:1636 -
\??\c:\npldvd.exec:\npldvd.exe30⤵
- Executes dropped EXE
PID:576 -
\??\c:\hbfbxl.exec:\hbfbxl.exe31⤵
- Executes dropped EXE
PID:880 -
\??\c:\txxvjd.exec:\txxvjd.exe32⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jlbhn.exec:\jlbhn.exe33⤵
- Executes dropped EXE
PID:2972 -
\??\c:\ffhrpjb.exec:\ffhrpjb.exe34⤵
- Executes dropped EXE
PID:928 -
\??\c:\rtjvv.exec:\rtjvv.exe35⤵
- Executes dropped EXE
PID:2020 -
\??\c:\fvjlnn.exec:\fvjlnn.exe36⤵
- Executes dropped EXE
PID:2228 -
\??\c:\dvhjx.exec:\dvhjx.exe37⤵
- Executes dropped EXE
PID:2292 -
\??\c:\hrvnxd.exec:\hrvnxd.exe38⤵
- Executes dropped EXE
PID:1908 -
\??\c:\lbnlf.exec:\lbnlf.exe39⤵
- Executes dropped EXE
PID:2812 -
\??\c:\pthtlpt.exec:\pthtlpt.exe40⤵
- Executes dropped EXE
PID:2304 -
\??\c:\hnfljn.exec:\hnfljn.exe41⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bvnvjnx.exec:\bvnvjnx.exe42⤵
- Executes dropped EXE
PID:2652 -
\??\c:\lfbbb.exec:\lfbbb.exe43⤵
- Executes dropped EXE
PID:3036 -
\??\c:\blrjtpj.exec:\blrjtpj.exe44⤵
- Executes dropped EXE
PID:2920 -
\??\c:\frllrdd.exec:\frllrdd.exe45⤵
- Executes dropped EXE
PID:2752 -
\??\c:\pftpffn.exec:\pftpffn.exe46⤵
- Executes dropped EXE
PID:2492 -
\??\c:\tnfrxh.exec:\tnfrxh.exe47⤵
- Executes dropped EXE
PID:2516 -
\??\c:\vjxfx.exec:\vjxfx.exe48⤵
- Executes dropped EXE
PID:2768 -
\??\c:\ftlvjlj.exec:\ftlvjlj.exe49⤵
- Executes dropped EXE
PID:2408 -
\??\c:\rbfbd.exec:\rbfbd.exe50⤵
- Executes dropped EXE
PID:2520 -
\??\c:\lrdrhvt.exec:\lrdrhvt.exe51⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rxdfl.exec:\rxdfl.exe52⤵
- Executes dropped EXE
PID:2456 -
\??\c:\llrvtx.exec:\llrvtx.exe53⤵
- Executes dropped EXE
PID:2840 -
\??\c:\dpdfn.exec:\dpdfn.exe54⤵
- Executes dropped EXE
PID:828 -
\??\c:\vdtjl.exec:\vdtjl.exe55⤵
- Executes dropped EXE
PID:1044 -
\??\c:\lblhnj.exec:\lblhnj.exe56⤵
- Executes dropped EXE
PID:1248 -
\??\c:\nlrrnv.exec:\nlrrnv.exe57⤵
- Executes dropped EXE
PID:1340 -
\??\c:\vpvrhj.exec:\vpvrhj.exe58⤵
- Executes dropped EXE
PID:2280 -
\??\c:\rlbpn.exec:\rlbpn.exe59⤵
- Executes dropped EXE
PID:1292 -
\??\c:\fjfjx.exec:\fjfjx.exe60⤵
- Executes dropped EXE
PID:908 -
\??\c:\fjnvfnl.exec:\fjnvfnl.exe61⤵
- Executes dropped EXE
PID:528 -
\??\c:\lnrjl.exec:\lnrjl.exe62⤵
- Executes dropped EXE
PID:816 -
\??\c:\vlfbfdv.exec:\vlfbfdv.exe63⤵
- Executes dropped EXE
PID:764 -
\??\c:\btfnx.exec:\btfnx.exe64⤵
- Executes dropped EXE
PID:684 -
\??\c:\ntfhv.exec:\ntfhv.exe65⤵
- Executes dropped EXE
PID:2728 -
\??\c:\npffffj.exec:\npffffj.exe66⤵PID:2716
-
\??\c:\frnnxjh.exec:\frnnxjh.exe67⤵PID:2484
-
\??\c:\vbnhnxh.exec:\vbnhnxh.exe68⤵PID:1104
-
\??\c:\jprvh.exec:\jprvh.exe69⤵PID:2452
-
\??\c:\bnpthh.exec:\bnpthh.exe70⤵PID:1804
-
\??\c:\bhpjv.exec:\bhpjv.exe71⤵PID:852
-
\??\c:\pdvxhv.exec:\pdvxhv.exe72⤵PID:1920
-
\??\c:\tlbnnpb.exec:\tlbnnpb.exe73⤵PID:1056
-
\??\c:\jxntt.exec:\jxntt.exe74⤵PID:1844
-
\??\c:\nfnjn.exec:\nfnjn.exe75⤵PID:1748
-
\??\c:\drlrnt.exec:\drlrnt.exe76⤵PID:576
-
\??\c:\ffpjjl.exec:\ffpjjl.exe77⤵PID:832
-
\??\c:\ffjrvfv.exec:\ffjrvfv.exe78⤵PID:2224
-
\??\c:\vdnnrx.exec:\vdnnrx.exe79⤵PID:760
-
\??\c:\bfhvd.exec:\bfhvd.exe80⤵PID:1796
-
\??\c:\dphtxfp.exec:\dphtxfp.exe81⤵PID:3056
-
\??\c:\ptbxpd.exec:\ptbxpd.exe82⤵PID:888
-
\??\c:\ddjlnb.exec:\ddjlnb.exe83⤵PID:1344
-
\??\c:\jlntvp.exec:\jlntvp.exe84⤵PID:1508
-
\??\c:\vrphnl.exec:\vrphnl.exe85⤵PID:1608
-
\??\c:\tvfdlj.exec:\tvfdlj.exe86⤵PID:2816
-
\??\c:\nplvnhd.exec:\nplvnhd.exe87⤵PID:2308
-
\??\c:\jvlnj.exec:\jvlnj.exe88⤵PID:3004
-
\??\c:\ffllv.exec:\ffllv.exe89⤵PID:2884
-
\??\c:\txrffr.exec:\txrffr.exe90⤵PID:2928
-
\??\c:\jjrdvbx.exec:\jjrdvbx.exe91⤵PID:2572
-
\??\c:\vdtdrj.exec:\vdtdrj.exe92⤵PID:2936
-
\??\c:\rxxphn.exec:\rxxphn.exe93⤵PID:2236
-
\??\c:\plfvh.exec:\plfvh.exe94⤵PID:2508
-
\??\c:\rnbnjl.exec:\rnbnjl.exe95⤵PID:2620
-
\??\c:\hflfp.exec:\hflfp.exe96⤵PID:2416
-
\??\c:\ndlxj.exec:\ndlxj.exe97⤵PID:2604
-
\??\c:\nvjpb.exec:\nvjpb.exe98⤵PID:2576
-
\??\c:\tjfxfff.exec:\tjfxfff.exe99⤵PID:2400
-
\??\c:\hnlxxt.exec:\hnlxxt.exe100⤵PID:2876
-
\??\c:\tntfr.exec:\tntfr.exe101⤵PID:2444
-
\??\c:\jtfjf.exec:\jtfjf.exe102⤵PID:2840
-
\??\c:\nvfjdvp.exec:\nvfjdvp.exe103⤵PID:828
-
\??\c:\ldltf.exec:\ldltf.exe104⤵PID:1044
-
\??\c:\tfpdpxd.exec:\tfpdpxd.exe105⤵PID:604
-
\??\c:\lxjhbr.exec:\lxjhbr.exe106⤵PID:1340
-
\??\c:\xtdphf.exec:\xtdphf.exe107⤵PID:1124
-
\??\c:\rxtbj.exec:\rxtbj.exe108⤵PID:1292
-
\??\c:\thbnf.exec:\thbnf.exe109⤵PID:908
-
\??\c:\lpxrvtn.exec:\lpxrvtn.exe110⤵PID:1684
-
\??\c:\nnvrtf.exec:\nnvrtf.exe111⤵PID:816
-
\??\c:\lbldjf.exec:\lbldjf.exe112⤵PID:2368
-
\??\c:\txrhltv.exec:\txrhltv.exe113⤵PID:2676
-
\??\c:\jrvjfnn.exec:\jrvjfnn.exe114⤵PID:2740
-
\??\c:\bhxnxtb.exec:\bhxnxtb.exe115⤵PID:2716
-
\??\c:\fpxpl.exec:\fpxpl.exe116⤵PID:2628
-
\??\c:\xrjtf.exec:\xrjtf.exe117⤵PID:1104
-
\??\c:\pjtbf.exec:\pjtbf.exe118⤵PID:440
-
\??\c:\vvnnjh.exec:\vvnnjh.exe119⤵PID:868
-
\??\c:\vvlfpn.exec:\vvlfpn.exe120⤵PID:1028
-
\??\c:\nppvjtt.exec:\nppvjtt.exe121⤵PID:1680
-
\??\c:\dftjnb.exec:\dftjnb.exe122⤵PID:1580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-