Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 19:13
Behavioral task
behavioral1
Sample
1b909bd0543d876655325fa8d8f0b360_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
1b909bd0543d876655325fa8d8f0b360_NeikiAnalytics.exe
-
Size
92KB
-
MD5
1b909bd0543d876655325fa8d8f0b360
-
SHA1
cb179b172fb79f7eef527b0e6478266f13f6b6da
-
SHA256
9710ba39ee9caf04303008da0d232fcd60d64692a392d420539dc7c89b14ae6b
-
SHA512
6cea63a695af7acf78c09fc68e3d3c8d0b49b373c2a493716303c8132ab91441dd199208844c64a99b08a073d8da91898036bc7fab61c9d0175d1766b75b8414
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWprCT:8hOmTsF93UYfwC6GIout0fmCiiiXA6ma
Malware Config
Signatures
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral1/memory/2772-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1616-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1152-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-67-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2612-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1876-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-123-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2376-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/648-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-192-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/532-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-218-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1936-227-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2496-226-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1388-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/240-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-256-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/900-270-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2028-261-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2136-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-279-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/692-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-295-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2940-320-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2980-328-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2676-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-346-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2540-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-349-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2744-369-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2744-370-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2408-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-403-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1792-414-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1100-431-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1296-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-506-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2188-505-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/648-504-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1132-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/900-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2144-629-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-682-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-723-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2780-7445-0x0000000077710000-0x000000007782F000-memory.dmp family_blackmoon behavioral1/memory/2780-7446-0x0000000077610000-0x000000007770A000-memory.dmp family_blackmoon behavioral1/memory/2780-8303-0x0000000077610000-0x000000007770A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2952 xtbhnh.exe 1616 njphjvx.exe 2956 lfljhbn.exe 2672 hdltjr.exe 1152 plthbph.exe 2784 vrxnr.exe 2612 dprhxld.exe 2600 tvvddrh.exe 2420 tfttj.exe 2856 xrfrhj.exe 1628 njpbfnf.exe 1876 jhhrvx.exe 1028 fxbrbvb.exe 2616 xlbtf.exe 2736 tvfhb.exe 2376 tffdvlx.exe 1944 jhjpd.exe 1296 nptxbl.exe 1820 rflbt.exe 2380 fjvtlb.exe 648 ptvvll.exe 1736 vhdxbf.exe 2496 ljrlh.exe 532 xlbrnp.exe 2796 ptnrbrt.exe 3040 bbfjd.exe 1936 lrjdttn.exe 1388 jltnlt.exe 240 pnrhxf.exe 1760 nhdhtnr.exe 2028 fjdfrhf.exe 900 fjvjf.exe 2136 lfvddf.exe 2236 hlnfphp.exe 692 njhtl.exe 2916 bvfxp.exe 2200 xrdhrjr.exe 2840 xnbpd.exe 928 dtjnj.exe 2940 vlnxvf.exe 2980 vrdrnx.exe 2948 pbbhfjv.exe 2676 hxrpf.exe 2712 plnvf.exe 2540 nvrdhv.exe 1152 hpbfhl.exe 2432 vxrbn.exe 2744 rnxdt.exe 2572 jndrdtt.exe 2408 tntfv.exe 2320 jbxjp.exe 2344 vhxxv.exe 2700 ljdhhn.exe 1100 bphddxt.exe 824 tdjhltt.exe 1792 tdbldnv.exe 2668 fjdxdn.exe 1932 jdtblr.exe 1804 dpvtflx.exe 1948 tlhvt.exe 2316 ndfrv.exe 2368 txxrdbb.exe 1296 lxxbbd.exe 1796 tfrxl.exe -
resource yara_rule behavioral1/memory/2772-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-7-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0009000000015c23-8.dat upx behavioral1/memory/2772-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000f000000015c7c-16.dat upx behavioral1/memory/2952-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1616-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1616-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015db4-25.dat upx behavioral1/files/0x0007000000015e02-32.dat upx behavioral1/memory/2672-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015e5b-40.dat upx behavioral1/files/0x0007000000016b5e-51.dat upx behavioral1/memory/2784-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1152-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018ae8-57.dat upx behavioral1/memory/2784-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b15-65.dat upx behavioral1/memory/2600-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2612-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2600-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b33-75.dat upx behavioral1/files/0x0006000000018b37-83.dat upx behavioral1/memory/2420-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2856-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b42-100.dat upx behavioral1/memory/1876-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000f000000015c87-93.dat upx behavioral1/files/0x0006000000018b4a-107.dat upx behavioral1/files/0x0006000000018b6a-114.dat upx behavioral1/memory/2616-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b73-122.dat upx behavioral1/files/0x0006000000018b96-130.dat upx behavioral1/memory/2376-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018ba2-137.dat upx behavioral1/files/0x0006000000018d06-145.dat upx behavioral1/files/0x00050000000192c9-152.dat upx behavioral1/files/0x00050000000192f4-160.dat upx behavioral1/memory/1820-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001931b-169.dat upx behavioral1/memory/2380-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/648-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019333-177.dat upx behavioral1/memory/1736-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019368-185.dat upx behavioral1/files/0x0005000000019377-193.dat upx behavioral1/memory/532-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001939b-202.dat upx behavioral1/files/0x00050000000193b0-209.dat upx behavioral1/files/0x0005000000019410-217.dat upx behavioral1/files/0x000500000001946b-229.dat upx behavioral1/files/0x000500000001946f-238.dat upx behavioral1/memory/1388-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019473-245.dat upx behavioral1/memory/240-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019485-252.dat upx behavioral1/files/0x00050000000194a4-263.dat upx behavioral1/memory/2136-276-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/692-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/692-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2200-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-302-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-308-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-339-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2952 2772 1b909bd0543d876655325fa8d8f0b360_NeikiAnalytics.exe 28 PID 2772 wrote to memory of 2952 2772 1b909bd0543d876655325fa8d8f0b360_NeikiAnalytics.exe 28 PID 2772 wrote to memory of 2952 2772 1b909bd0543d876655325fa8d8f0b360_NeikiAnalytics.exe 28 PID 2772 wrote to memory of 2952 2772 1b909bd0543d876655325fa8d8f0b360_NeikiAnalytics.exe 28 PID 2952 wrote to memory of 1616 2952 xtbhnh.exe 29 PID 2952 wrote to memory of 1616 2952 xtbhnh.exe 29 PID 2952 wrote to memory of 1616 2952 xtbhnh.exe 29 PID 2952 wrote to memory of 1616 2952 xtbhnh.exe 29 PID 1616 wrote to memory of 2956 1616 njphjvx.exe 30 PID 1616 wrote to memory of 2956 1616 njphjvx.exe 30 PID 1616 wrote to memory of 2956 1616 njphjvx.exe 30 PID 1616 wrote to memory of 2956 1616 njphjvx.exe 30 PID 2956 wrote to memory of 2672 2956 lfljhbn.exe 31 PID 2956 wrote to memory of 2672 2956 lfljhbn.exe 31 PID 2956 wrote to memory of 2672 2956 lfljhbn.exe 31 PID 2956 wrote to memory of 2672 2956 lfljhbn.exe 31 PID 2672 wrote to memory of 1152 2672 hdltjr.exe 32 PID 2672 wrote to memory of 1152 2672 hdltjr.exe 32 PID 2672 wrote to memory of 1152 2672 hdltjr.exe 32 PID 2672 wrote to memory of 1152 2672 hdltjr.exe 32 PID 1152 wrote to memory of 2784 1152 plthbph.exe 33 PID 1152 wrote to memory of 2784 1152 plthbph.exe 33 PID 1152 wrote to memory of 2784 1152 plthbph.exe 33 PID 1152 wrote to memory of 2784 1152 plthbph.exe 33 PID 2784 wrote to memory of 2612 2784 vrxnr.exe 34 PID 2784 wrote to memory of 2612 2784 vrxnr.exe 34 PID 2784 wrote to memory of 2612 2784 vrxnr.exe 34 PID 2784 wrote to memory of 2612 2784 vrxnr.exe 34 PID 2612 wrote to memory of 2600 2612 dprhxld.exe 35 PID 2612 wrote to memory of 2600 2612 dprhxld.exe 35 PID 2612 wrote to memory of 2600 2612 dprhxld.exe 35 PID 2612 wrote to memory of 2600 2612 dprhxld.exe 35 PID 2600 wrote to memory of 2420 2600 tvvddrh.exe 36 PID 2600 wrote to memory of 2420 2600 tvvddrh.exe 36 PID 2600 wrote to memory of 2420 2600 tvvddrh.exe 36 PID 2600 wrote to memory of 2420 2600 tvvddrh.exe 36 PID 2420 wrote to memory of 2856 2420 tfttj.exe 37 PID 2420 wrote to memory of 2856 2420 tfttj.exe 37 PID 2420 wrote to memory of 2856 2420 tfttj.exe 37 PID 2420 wrote to memory of 2856 2420 tfttj.exe 37 PID 2856 wrote to memory of 1628 2856 xrfrhj.exe 38 PID 2856 wrote to memory of 1628 2856 xrfrhj.exe 38 PID 2856 wrote to memory of 1628 2856 xrfrhj.exe 38 PID 2856 wrote to memory of 1628 2856 xrfrhj.exe 38 PID 1628 wrote to memory of 1876 1628 njpbfnf.exe 39 PID 1628 wrote to memory of 1876 1628 njpbfnf.exe 39 PID 1628 wrote to memory of 1876 1628 njpbfnf.exe 39 PID 1628 wrote to memory of 1876 1628 njpbfnf.exe 39 PID 1876 wrote to memory of 1028 1876 jhhrvx.exe 40 PID 1876 wrote to memory of 1028 1876 jhhrvx.exe 40 PID 1876 wrote to memory of 1028 1876 jhhrvx.exe 40 PID 1876 wrote to memory of 1028 1876 jhhrvx.exe 40 PID 1028 wrote to memory of 2616 1028 fxbrbvb.exe 41 PID 1028 wrote to memory of 2616 1028 fxbrbvb.exe 41 PID 1028 wrote to memory of 2616 1028 fxbrbvb.exe 41 PID 1028 wrote to memory of 2616 1028 fxbrbvb.exe 41 PID 2616 wrote to memory of 2736 2616 xlbtf.exe 42 PID 2616 wrote to memory of 2736 2616 xlbtf.exe 42 PID 2616 wrote to memory of 2736 2616 xlbtf.exe 42 PID 2616 wrote to memory of 2736 2616 xlbtf.exe 42 PID 2736 wrote to memory of 2376 2736 tvfhb.exe 43 PID 2736 wrote to memory of 2376 2736 tvfhb.exe 43 PID 2736 wrote to memory of 2376 2736 tvfhb.exe 43 PID 2736 wrote to memory of 2376 2736 tvfhb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b909bd0543d876655325fa8d8f0b360_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1b909bd0543d876655325fa8d8f0b360_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\xtbhnh.exec:\xtbhnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\njphjvx.exec:\njphjvx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\lfljhbn.exec:\lfljhbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\hdltjr.exec:\hdltjr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\plthbph.exec:\plthbph.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\vrxnr.exec:\vrxnr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\dprhxld.exec:\dprhxld.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\tvvddrh.exec:\tvvddrh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\tfttj.exec:\tfttj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\xrfrhj.exec:\xrfrhj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\njpbfnf.exec:\njpbfnf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\jhhrvx.exec:\jhhrvx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\fxbrbvb.exec:\fxbrbvb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\xlbtf.exec:\xlbtf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\tvfhb.exec:\tvfhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\tffdvlx.exec:\tffdvlx.exe17⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jhjpd.exec:\jhjpd.exe18⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nptxbl.exec:\nptxbl.exe19⤵
- Executes dropped EXE
PID:1296 -
\??\c:\rflbt.exec:\rflbt.exe20⤵
- Executes dropped EXE
PID:1820 -
\??\c:\fjvtlb.exec:\fjvtlb.exe21⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ptvvll.exec:\ptvvll.exe22⤵
- Executes dropped EXE
PID:648 -
\??\c:\vhdxbf.exec:\vhdxbf.exe23⤵
- Executes dropped EXE
PID:1736 -
\??\c:\ljrlh.exec:\ljrlh.exe24⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xlbrnp.exec:\xlbrnp.exe25⤵
- Executes dropped EXE
PID:532 -
\??\c:\ptnrbrt.exec:\ptnrbrt.exe26⤵
- Executes dropped EXE
PID:2796 -
\??\c:\bbfjd.exec:\bbfjd.exe27⤵
- Executes dropped EXE
PID:3040 -
\??\c:\lrjdttn.exec:\lrjdttn.exe28⤵
- Executes dropped EXE
PID:1936 -
\??\c:\jltnlt.exec:\jltnlt.exe29⤵
- Executes dropped EXE
PID:1388 -
\??\c:\pnrhxf.exec:\pnrhxf.exe30⤵
- Executes dropped EXE
PID:240 -
\??\c:\nhdhtnr.exec:\nhdhtnr.exe31⤵
- Executes dropped EXE
PID:1760 -
\??\c:\fjdfrhf.exec:\fjdfrhf.exe32⤵
- Executes dropped EXE
PID:2028 -
\??\c:\fjvjf.exec:\fjvjf.exe33⤵
- Executes dropped EXE
PID:900 -
\??\c:\lfvddf.exec:\lfvddf.exe34⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hlnfphp.exec:\hlnfphp.exe35⤵
- Executes dropped EXE
PID:2236 -
\??\c:\njhtl.exec:\njhtl.exe36⤵
- Executes dropped EXE
PID:692 -
\??\c:\bvfxp.exec:\bvfxp.exe37⤵
- Executes dropped EXE
PID:2916 -
\??\c:\xrdhrjr.exec:\xrdhrjr.exe38⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xnbpd.exec:\xnbpd.exe39⤵
- Executes dropped EXE
PID:2840 -
\??\c:\dtjnj.exec:\dtjnj.exe40⤵
- Executes dropped EXE
PID:928 -
\??\c:\vlnxvf.exec:\vlnxvf.exe41⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vrdrnx.exec:\vrdrnx.exe42⤵
- Executes dropped EXE
PID:2980 -
\??\c:\pbbhfjv.exec:\pbbhfjv.exe43⤵
- Executes dropped EXE
PID:2948 -
\??\c:\hxrpf.exec:\hxrpf.exe44⤵
- Executes dropped EXE
PID:2676 -
\??\c:\plnvf.exec:\plnvf.exe45⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nvrdhv.exec:\nvrdhv.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hpbfhl.exec:\hpbfhl.exe47⤵
- Executes dropped EXE
PID:1152 -
\??\c:\vxrbn.exec:\vxrbn.exe48⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rnxdt.exec:\rnxdt.exe49⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jndrdtt.exec:\jndrdtt.exe50⤵
- Executes dropped EXE
PID:2572 -
\??\c:\tntfv.exec:\tntfv.exe51⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jbxjp.exec:\jbxjp.exe52⤵
- Executes dropped EXE
PID:2320 -
\??\c:\vhxxv.exec:\vhxxv.exe53⤵
- Executes dropped EXE
PID:2344 -
\??\c:\ljdhhn.exec:\ljdhhn.exe54⤵
- Executes dropped EXE
PID:2700 -
\??\c:\bphddxt.exec:\bphddxt.exe55⤵
- Executes dropped EXE
PID:1100 -
\??\c:\tdjhltt.exec:\tdjhltt.exe56⤵
- Executes dropped EXE
PID:824 -
\??\c:\tdbldnv.exec:\tdbldnv.exe57⤵
- Executes dropped EXE
PID:1792 -
\??\c:\fjdxdn.exec:\fjdxdn.exe58⤵
- Executes dropped EXE
PID:2668 -
\??\c:\jdtblr.exec:\jdtblr.exe59⤵
- Executes dropped EXE
PID:1932 -
\??\c:\dpvtflx.exec:\dpvtflx.exe60⤵
- Executes dropped EXE
PID:1804 -
\??\c:\tlhvt.exec:\tlhvt.exe61⤵
- Executes dropped EXE
PID:1948 -
\??\c:\ndfrv.exec:\ndfrv.exe62⤵
- Executes dropped EXE
PID:2316 -
\??\c:\txxrdbb.exec:\txxrdbb.exe63⤵
- Executes dropped EXE
PID:2368 -
\??\c:\lxxbbd.exec:\lxxbbd.exe64⤵
- Executes dropped EXE
PID:1296 -
\??\c:\tfrxl.exec:\tfrxl.exe65⤵
- Executes dropped EXE
PID:1796 -
\??\c:\bbtfrjd.exec:\bbtfrjd.exe66⤵PID:1724
-
\??\c:\vnrlt.exec:\vnrlt.exe67⤵PID:1772
-
\??\c:\jnpdxb.exec:\jnpdxb.exe68⤵PID:648
-
\??\c:\lhtfht.exec:\lhtfht.exe69⤵PID:2116
-
\??\c:\rhlpp.exec:\rhlpp.exe70⤵PID:768
-
\??\c:\nhfhbt.exec:\nhfhbt.exe71⤵PID:1512
-
\??\c:\dnptdlt.exec:\dnptdlt.exe72⤵PID:2588
-
\??\c:\vldrnp.exec:\vldrnp.exe73⤵PID:2188
-
\??\c:\lfvjlt.exec:\lfvjlt.exe74⤵PID:1132
-
\??\c:\jtbxvxp.exec:\jtbxvxp.exe75⤵PID:2148
-
\??\c:\pvxlbxp.exec:\pvxlbxp.exe76⤵PID:1832
-
\??\c:\ftjhtd.exec:\ftjhtd.exe77⤵PID:1604
-
\??\c:\pbbhlb.exec:\pbbhlb.exe78⤵PID:1756
-
\??\c:\hftbt.exec:\hftbt.exe79⤵PID:964
-
\??\c:\lptrdxd.exec:\lptrdxd.exe80⤵PID:2024
-
\??\c:\ddhff.exec:\ddhff.exe81⤵PID:2232
-
\??\c:\hlbbx.exec:\hlbbx.exe82⤵PID:900
-
\??\c:\drnhf.exec:\drnhf.exe83⤵PID:2584
-
\??\c:\bjjbv.exec:\bjjbv.exe84⤵PID:2824
-
\??\c:\rdbtpv.exec:\rdbtpv.exe85⤵PID:2996
-
\??\c:\rrxtl.exec:\rrxtl.exe86⤵PID:1224
-
\??\c:\blndbb.exec:\blndbb.exe87⤵PID:2220
-
\??\c:\jhvnnnl.exec:\jhvnnnl.exe88⤵PID:1624
-
\??\c:\rttxjlt.exec:\rttxjlt.exe89⤵PID:2780
-
\??\c:\rdbfl.exec:\rdbfl.exe90⤵PID:2952
-
\??\c:\pxpxrfb.exec:\pxpxrfb.exe91⤵PID:1636
-
\??\c:\tnbnnll.exec:\tnbnnll.exe92⤵PID:1532
-
\??\c:\lljfvx.exec:\lljfvx.exe93⤵PID:2536
-
\??\c:\vvpdxjb.exec:\vvpdxjb.exe94⤵PID:2924
-
\??\c:\bxtpnvl.exec:\bxtpnvl.exe95⤵PID:2676
-
\??\c:\bbbrjl.exec:\bbbrjl.exe96⤵PID:2144
-
\??\c:\phjvbxj.exec:\phjvbxj.exe97⤵PID:2540
-
\??\c:\bhfhf.exec:\bhfhf.exe98⤵PID:2604
-
\??\c:\dprjt.exec:\dprjt.exe99⤵PID:2944
-
\??\c:\hdnft.exec:\hdnft.exe100⤵PID:2612
-
\??\c:\hljtrtx.exec:\hljtrtx.exe101⤵PID:2696
-
\??\c:\lxlpvpl.exec:\lxlpvpl.exe102⤵PID:2708
-
\??\c:\dptvhj.exec:\dptvhj.exe103⤵PID:2600
-
\??\c:\dnhrj.exec:\dnhrj.exe104⤵PID:2864
-
\??\c:\jjtvhp.exec:\jjtvhp.exe105⤵PID:704
-
\??\c:\vfptf.exec:\vfptf.exe106⤵PID:2700
-
\??\c:\pjntlt.exec:\pjntlt.exe107⤵PID:2636
-
\??\c:\pxldrlh.exec:\pxldrlh.exe108⤵PID:1876
-
\??\c:\dhljhv.exec:\dhljhv.exe109⤵PID:1248
-
\??\c:\pdjprxb.exec:\pdjprxb.exe110⤵PID:2204
-
\??\c:\nhjtx.exec:\nhjtx.exe111⤵PID:1784
-
\??\c:\fhtjvl.exec:\fhtjvl.exe112⤵PID:2736
-
\??\c:\ttbvbx.exec:\ttbvbx.exe113⤵PID:1956
-
\??\c:\tdfdht.exec:\tdfdht.exe114⤵PID:1732
-
\??\c:\jnxxr.exec:\jnxxr.exe115⤵PID:1040
-
\??\c:\jxjphbd.exec:\jxjphbd.exe116⤵PID:2044
-
\??\c:\rhdltrx.exec:\rhdltrx.exe117⤵PID:1296
-
\??\c:\prjbrnt.exec:\prjbrnt.exe118⤵PID:1964
-
\??\c:\htbxhfl.exec:\htbxhfl.exe119⤵PID:2620
-
\??\c:\bplrx.exec:\bplrx.exe120⤵PID:1740
-
\??\c:\jlvhhf.exec:\jlvhhf.exe121⤵PID:2448
-
\??\c:\xrttd.exec:\xrttd.exe122⤵PID:372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-