Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 22:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
458597d33fbc72dd9b520564a9574d40_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
458597d33fbc72dd9b520564a9574d40_NeikiAnalytics.exe
-
Size
273KB
-
MD5
458597d33fbc72dd9b520564a9574d40
-
SHA1
f57f9553332e332b3775abc32f7fb0094cc2e85f
-
SHA256
4fdddef09db6255cb0b777b5cf0f2659223ebd5ff366eee3cf8fa898d5872be6
-
SHA512
664eefde4210f5a36a8f08577307f3cc5ea016919ea8bcf8bf7ec16422712102a63232dd7e4ab7e5e3b8daf8a20ab42608c1a4812e3513fedf89e9d6960e950c
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFK:8cm7ImGddXmNt251UriZFK
Malware Config
Signatures
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/1252-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1116-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-57-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2420-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/240-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-272-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2832-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-399-0x00000000002E0000-0x000000000030A000-memory.dmp family_blackmoon behavioral1/memory/2788-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-501-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3024-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-571-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1588-621-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2684-644-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2528-663-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/764-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-737-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-735-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/912-750-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1576-764-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1636-771-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1148-821-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3036-830-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/856-867-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2352-998-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2300-1024-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/964-1108-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2784-1250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1116 tffhpdx.exe 1740 hvpjjnb.exe 2196 pnvdt.exe 2200 vjhnx.exe 2588 jbfjvfv.exe 2480 fdxjrbd.exe 2648 ljxjln.exe 2812 tlrlnnx.exe 2424 phtlpx.exe 2420 fvflj.exe 2788 jddvj.exe 764 htxhp.exe 676 prnblht.exe 1692 djtxxf.exe 748 tltrfr.exe 1920 vrlrbd.exe 1824 hhljplx.exe 2224 lrpdf.exe 1764 rdfbf.exe 2660 xrdbjrx.exe 2688 tfxnrl.exe 2472 nbnhpd.exe 2808 ppfvpf.exe 2872 dpdhp.exe 2736 xvbbpnr.exe 1792 jbjvrf.exe 240 jprbrh.exe 1476 rvxjfp.exe 1652 lhpdv.exe 3004 ndvrrtt.exe 2832 xpxdf.exe 2916 fdrhjb.exe 1596 lrrbtxv.exe 2940 bxxtf.exe 1448 hlfpj.exe 2956 htrprnp.exe 2196 lntjh.exe 1588 jpdtxtl.exe 2580 nfrjv.exe 2208 hbfpr.exe 2520 pfvph.exe 2624 jnnjlf.exe 2536 vbvdvdr.exe 2540 pbrffb.exe 2424 lljxjx.exe 2448 lpbpr.exe 2456 tnvnf.exe 2440 pdfhfx.exe 2984 lvbpbbt.exe 2788 hprbbln.exe 268 xxthjjp.exe 580 rbfdrf.exe 2296 dvblvt.exe 1080 pptld.exe 1984 phtdr.exe 2292 xrhfl.exe 1672 dtjbtxv.exe 1568 nhdbd.exe 1620 rhnthfv.exe 2444 lnxhrv.exe 2140 hbjvpph.exe 2688 pxtpfv.exe 2932 tlrvllr.exe 2776 xrlltv.exe -
resource yara_rule behavioral1/memory/1252-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/240-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-501-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/3024-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-571-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1588-621-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/764-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-764-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/3036-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-881-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-907-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-1004-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2300-1024-0x00000000002C0000-0x00000000002EA000-memory.dmp upx behavioral1/memory/1612-1038-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-1108-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2700-1168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-1250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-1325-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1252 wrote to memory of 1116 1252 458597d33fbc72dd9b520564a9574d40_NeikiAnalytics.exe 28 PID 1252 wrote to memory of 1116 1252 458597d33fbc72dd9b520564a9574d40_NeikiAnalytics.exe 28 PID 1252 wrote to memory of 1116 1252 458597d33fbc72dd9b520564a9574d40_NeikiAnalytics.exe 28 PID 1252 wrote to memory of 1116 1252 458597d33fbc72dd9b520564a9574d40_NeikiAnalytics.exe 28 PID 1116 wrote to memory of 1740 1116 tffhpdx.exe 29 PID 1116 wrote to memory of 1740 1116 tffhpdx.exe 29 PID 1116 wrote to memory of 1740 1116 tffhpdx.exe 29 PID 1116 wrote to memory of 1740 1116 tffhpdx.exe 29 PID 1740 wrote to memory of 2196 1740 hvpjjnb.exe 30 PID 1740 wrote to memory of 2196 1740 hvpjjnb.exe 30 PID 1740 wrote to memory of 2196 1740 hvpjjnb.exe 30 PID 1740 wrote to memory of 2196 1740 hvpjjnb.exe 30 PID 2196 wrote to memory of 2200 2196 pnvdt.exe 31 PID 2196 wrote to memory of 2200 2196 pnvdt.exe 31 PID 2196 wrote to memory of 2200 2196 pnvdt.exe 31 PID 2196 wrote to memory of 2200 2196 pnvdt.exe 31 PID 2200 wrote to memory of 2588 2200 vjhnx.exe 32 PID 2200 wrote to memory of 2588 2200 vjhnx.exe 32 PID 2200 wrote to memory of 2588 2200 vjhnx.exe 32 PID 2200 wrote to memory of 2588 2200 vjhnx.exe 32 PID 2588 wrote to memory of 2480 2588 jbfjvfv.exe 33 PID 2588 wrote to memory of 2480 2588 jbfjvfv.exe 33 PID 2588 wrote to memory of 2480 2588 jbfjvfv.exe 33 PID 2588 wrote to memory of 2480 2588 jbfjvfv.exe 33 PID 2480 wrote to memory of 2648 2480 fdxjrbd.exe 34 PID 2480 wrote to memory of 2648 2480 fdxjrbd.exe 34 PID 2480 wrote to memory of 2648 2480 fdxjrbd.exe 34 PID 2480 wrote to memory of 2648 2480 fdxjrbd.exe 34 PID 2648 wrote to memory of 2812 2648 ljxjln.exe 35 PID 2648 wrote to memory of 2812 2648 ljxjln.exe 35 PID 2648 wrote to memory of 2812 2648 ljxjln.exe 35 PID 2648 wrote to memory of 2812 2648 ljxjln.exe 35 PID 2812 wrote to memory of 2424 2812 tlrlnnx.exe 36 PID 2812 wrote to memory of 2424 2812 tlrlnnx.exe 36 PID 2812 wrote to memory of 2424 2812 tlrlnnx.exe 36 PID 2812 wrote to memory of 2424 2812 tlrlnnx.exe 36 PID 2424 wrote to memory of 2420 2424 phtlpx.exe 37 PID 2424 wrote to memory of 2420 2424 phtlpx.exe 37 PID 2424 wrote to memory of 2420 2424 phtlpx.exe 37 PID 2424 wrote to memory of 2420 2424 phtlpx.exe 37 PID 2420 wrote to memory of 2788 2420 fvflj.exe 38 PID 2420 wrote to memory of 2788 2420 fvflj.exe 38 PID 2420 wrote to memory of 2788 2420 fvflj.exe 38 PID 2420 wrote to memory of 2788 2420 fvflj.exe 38 PID 2788 wrote to memory of 764 2788 jddvj.exe 39 PID 2788 wrote to memory of 764 2788 jddvj.exe 39 PID 2788 wrote to memory of 764 2788 jddvj.exe 39 PID 2788 wrote to memory of 764 2788 jddvj.exe 39 PID 764 wrote to memory of 676 764 htxhp.exe 40 PID 764 wrote to memory of 676 764 htxhp.exe 40 PID 764 wrote to memory of 676 764 htxhp.exe 40 PID 764 wrote to memory of 676 764 htxhp.exe 40 PID 676 wrote to memory of 1692 676 prnblht.exe 41 PID 676 wrote to memory of 1692 676 prnblht.exe 41 PID 676 wrote to memory of 1692 676 prnblht.exe 41 PID 676 wrote to memory of 1692 676 prnblht.exe 41 PID 1692 wrote to memory of 748 1692 djtxxf.exe 42 PID 1692 wrote to memory of 748 1692 djtxxf.exe 42 PID 1692 wrote to memory of 748 1692 djtxxf.exe 42 PID 1692 wrote to memory of 748 1692 djtxxf.exe 42 PID 748 wrote to memory of 1920 748 tltrfr.exe 43 PID 748 wrote to memory of 1920 748 tltrfr.exe 43 PID 748 wrote to memory of 1920 748 tltrfr.exe 43 PID 748 wrote to memory of 1920 748 tltrfr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\458597d33fbc72dd9b520564a9574d40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\458597d33fbc72dd9b520564a9574d40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\tffhpdx.exec:\tffhpdx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\hvpjjnb.exec:\hvpjjnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\pnvdt.exec:\pnvdt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\vjhnx.exec:\vjhnx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\jbfjvfv.exec:\jbfjvfv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\fdxjrbd.exec:\fdxjrbd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\ljxjln.exec:\ljxjln.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\tlrlnnx.exec:\tlrlnnx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\phtlpx.exec:\phtlpx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\fvflj.exec:\fvflj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\jddvj.exec:\jddvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\htxhp.exec:\htxhp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\prnblht.exec:\prnblht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\djtxxf.exec:\djtxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\tltrfr.exec:\tltrfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\vrlrbd.exec:\vrlrbd.exe17⤵
- Executes dropped EXE
PID:1920 -
\??\c:\hhljplx.exec:\hhljplx.exe18⤵
- Executes dropped EXE
PID:1824 -
\??\c:\lrpdf.exec:\lrpdf.exe19⤵
- Executes dropped EXE
PID:2224 -
\??\c:\rdfbf.exec:\rdfbf.exe20⤵
- Executes dropped EXE
PID:1764 -
\??\c:\xrdbjrx.exec:\xrdbjrx.exe21⤵
- Executes dropped EXE
PID:2660 -
\??\c:\tfxnrl.exec:\tfxnrl.exe22⤵
- Executes dropped EXE
PID:2688 -
\??\c:\nbnhpd.exec:\nbnhpd.exe23⤵
- Executes dropped EXE
PID:2472 -
\??\c:\ppfvpf.exec:\ppfvpf.exe24⤵
- Executes dropped EXE
PID:2808 -
\??\c:\dpdhp.exec:\dpdhp.exe25⤵
- Executes dropped EXE
PID:2872 -
\??\c:\xvbbpnr.exec:\xvbbpnr.exe26⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jbjvrf.exec:\jbjvrf.exe27⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jprbrh.exec:\jprbrh.exe28⤵
- Executes dropped EXE
PID:240 -
\??\c:\rvxjfp.exec:\rvxjfp.exe29⤵
- Executes dropped EXE
PID:1476 -
\??\c:\lhpdv.exec:\lhpdv.exe30⤵
- Executes dropped EXE
PID:1652 -
\??\c:\ndvrrtt.exec:\ndvrrtt.exe31⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xpxdf.exec:\xpxdf.exe32⤵
- Executes dropped EXE
PID:2832 -
\??\c:\fdrhjb.exec:\fdrhjb.exe33⤵
- Executes dropped EXE
PID:2916 -
\??\c:\lrrbtxv.exec:\lrrbtxv.exe34⤵
- Executes dropped EXE
PID:1596 -
\??\c:\bxxtf.exec:\bxxtf.exe35⤵
- Executes dropped EXE
PID:2940 -
\??\c:\hlfpj.exec:\hlfpj.exe36⤵
- Executes dropped EXE
PID:1448 -
\??\c:\htrprnp.exec:\htrprnp.exe37⤵
- Executes dropped EXE
PID:2956 -
\??\c:\lntjh.exec:\lntjh.exe38⤵
- Executes dropped EXE
PID:2196 -
\??\c:\jpdtxtl.exec:\jpdtxtl.exe39⤵
- Executes dropped EXE
PID:1588 -
\??\c:\nfrjv.exec:\nfrjv.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\hbfpr.exec:\hbfpr.exe41⤵
- Executes dropped EXE
PID:2208 -
\??\c:\pfvph.exec:\pfvph.exe42⤵
- Executes dropped EXE
PID:2520 -
\??\c:\jnnjlf.exec:\jnnjlf.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\vbvdvdr.exec:\vbvdvdr.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pbrffb.exec:\pbrffb.exe45⤵
- Executes dropped EXE
PID:2540 -
\??\c:\lljxjx.exec:\lljxjx.exe46⤵
- Executes dropped EXE
PID:2424 -
\??\c:\lpbpr.exec:\lpbpr.exe47⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tnvnf.exec:\tnvnf.exe48⤵
- Executes dropped EXE
PID:2456 -
\??\c:\pdfhfx.exec:\pdfhfx.exe49⤵
- Executes dropped EXE
PID:2440 -
\??\c:\lvbpbbt.exec:\lvbpbbt.exe50⤵
- Executes dropped EXE
PID:2984 -
\??\c:\hprbbln.exec:\hprbbln.exe51⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xxthjjp.exec:\xxthjjp.exe52⤵
- Executes dropped EXE
PID:268 -
\??\c:\rbfdrf.exec:\rbfdrf.exe53⤵
- Executes dropped EXE
PID:580 -
\??\c:\dvblvt.exec:\dvblvt.exe54⤵
- Executes dropped EXE
PID:2296 -
\??\c:\pptld.exec:\pptld.exe55⤵
- Executes dropped EXE
PID:1080 -
\??\c:\phtdr.exec:\phtdr.exe56⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xrhfl.exec:\xrhfl.exe57⤵
- Executes dropped EXE
PID:2292 -
\??\c:\dtjbtxv.exec:\dtjbtxv.exe58⤵
- Executes dropped EXE
PID:1672 -
\??\c:\nhdbd.exec:\nhdbd.exe59⤵
- Executes dropped EXE
PID:1568 -
\??\c:\rhnthfv.exec:\rhnthfv.exe60⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lnxhrv.exec:\lnxhrv.exe61⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hbjvpph.exec:\hbjvpph.exe62⤵
- Executes dropped EXE
PID:2140 -
\??\c:\pxtpfv.exec:\pxtpfv.exe63⤵
- Executes dropped EXE
PID:2688 -
\??\c:\tlrvllr.exec:\tlrvllr.exe64⤵
- Executes dropped EXE
PID:2932 -
\??\c:\xrlltv.exec:\xrlltv.exe65⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jprrdj.exec:\jprrdj.exe66⤵PID:2236
-
\??\c:\ttfrh.exec:\ttfrh.exe67⤵PID:2008
-
\??\c:\bpbpxdt.exec:\bpbpxdt.exe68⤵PID:1144
-
\??\c:\lprlx.exec:\lprlx.exe69⤵PID:2676
-
\??\c:\nbvjnrb.exec:\nbvjnrb.exe70⤵PID:940
-
\??\c:\lxdhf.exec:\lxdhf.exe71⤵PID:1648
-
\??\c:\ftvtnpf.exec:\ftvtnpf.exe72⤵PID:1832
-
\??\c:\hfjrfll.exec:\hfjrfll.exe73⤵PID:3024
-
\??\c:\jrhpjd.exec:\jrhpjd.exe74⤵PID:1656
-
\??\c:\vpnvt.exec:\vpnvt.exe75⤵PID:3020
-
\??\c:\nbrtlrr.exec:\nbrtlrr.exe76⤵PID:2864
-
\??\c:\hvhtxl.exec:\hvhtxl.exe77⤵PID:2276
-
\??\c:\xhhttpn.exec:\xhhttpn.exe78⤵PID:2172
-
\??\c:\rjvtnh.exec:\rjvtnh.exe79⤵PID:2844
-
\??\c:\frfdd.exec:\frfdd.exe80⤵PID:1972
-
\??\c:\dbjdnbp.exec:\dbjdnbp.exe81⤵PID:1384
-
\??\c:\ftthd.exec:\ftthd.exe82⤵PID:1580
-
\??\c:\tphjbx.exec:\tphjbx.exe83⤵PID:1584
-
\??\c:\bvjfdnp.exec:\bvjfdnp.exe84⤵PID:1588
-
\??\c:\hpbpltj.exec:\hpbpltj.exe85⤵PID:2612
-
\??\c:\tfhhxtf.exec:\tfhhxtf.exe86⤵PID:2384
-
\??\c:\thlth.exec:\thlth.exe87⤵PID:2684
-
\??\c:\dbxxlbx.exec:\dbxxlbx.exe88⤵PID:2624
-
\??\c:\tfljnj.exec:\tfljnj.exe89⤵PID:2708
-
\??\c:\fjrpvtn.exec:\fjrpvtn.exe90⤵PID:2528
-
\??\c:\flpdjht.exec:\flpdjht.exe91⤵PID:2408
-
\??\c:\jtthl.exec:\jtthl.exe92⤵PID:2636
-
\??\c:\jjtbp.exec:\jjtbp.exe93⤵PID:2456
-
\??\c:\xlvhxdd.exec:\xlvhxdd.exe94⤵PID:472
-
\??\c:\pxnjrfp.exec:\pxnjrfp.exe95⤵PID:764
-
\??\c:\rttnx.exec:\rttnx.exe96⤵PID:968
-
\??\c:\trjrr.exec:\trjrr.exe97⤵PID:484
-
\??\c:\bjfdhjl.exec:\bjfdhjl.exe98⤵PID:1692
-
\??\c:\dhxhv.exec:\dhxhv.exe99⤵PID:2040
-
\??\c:\lppbrjf.exec:\lppbrjf.exe100⤵PID:2004
-
\??\c:\lpxbpvj.exec:\lpxbpvj.exe101⤵PID:2124
-
\??\c:\bbtxtx.exec:\bbtxtx.exe102⤵PID:2336
-
\??\c:\flbxrjb.exec:\flbxrjb.exe103⤵PID:912
-
\??\c:\dtbrd.exec:\dtbrd.exe104⤵PID:2348
-
\??\c:\hnnhr.exec:\hnnhr.exe105⤵PID:1576
-
\??\c:\tnfhlt.exec:\tnfhlt.exe106⤵PID:1636
-
\??\c:\fnrff.exec:\fnrff.exe107⤵PID:860
-
\??\c:\xptbphd.exec:\xptbphd.exe108⤵PID:2988
-
\??\c:\fjxxr.exec:\fjxxr.exe109⤵PID:2808
-
\??\c:\htltdhp.exec:\htltdhp.exe110⤵PID:2912
-
\??\c:\flvbxn.exec:\flvbxn.exe111⤵PID:1800
-
\??\c:\xbtnxb.exec:\xbtnxb.exe112⤵PID:2736
-
\??\c:\dtnnxnh.exec:\dtnnxnh.exe113⤵PID:2568
-
\??\c:\thtxbv.exec:\thtxbv.exe114⤵PID:1148
-
\??\c:\xhjbxpv.exec:\xhjbxpv.exe115⤵PID:3036
-
\??\c:\jvdtnb.exec:\jvdtnb.exe116⤵PID:1628
-
\??\c:\rjtjb.exec:\rjtjb.exe117⤵PID:1832
-
\??\c:\hrdnvx.exec:\hrdnvx.exe118⤵PID:3052
-
\??\c:\xvptld.exec:\xvptld.exe119⤵PID:2820
-
\??\c:\xddlp.exec:\xddlp.exe120⤵PID:2832
-
\??\c:\hljdff.exec:\hljdff.exe121⤵PID:856
-
\??\c:\pdrxf.exec:\pdrxf.exe122⤵PID:2216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-