Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 02:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
52afa0f82627200f1810fac4d74b40b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
52afa0f82627200f1810fac4d74b40b0_NeikiAnalytics.exe
-
Size
389KB
-
MD5
52afa0f82627200f1810fac4d74b40b0
-
SHA1
4a3fb6b4980da15adc3f411f285b9a590d69d72b
-
SHA256
cc686ec6604648f5b67cbab6ea04cabb9ccf0f9f9a888df0676db1861774b108
-
SHA512
c4c8af77352447a541a79f45a1d45cd4c53d7f74997293f81de4d4e7a3ae300269ba5f88666ca6ef21c868f1422c73afaeb294520a482390176f154a9cc5df7d
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Gom
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2244-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1180-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/400-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/924-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hdnbt.exehvjvjjp.exelvnvv.exenjxbjjr.exetdxfx.exetrbff.exennfbvdn.exehtvftl.exeltfpjff.exexbvjn.exefbhnh.exebrtjd.exeffljrd.exentdfftl.exenxnfjt.exedrbjn.exevrrhl.exeftdjnjt.exejtfdj.exeftrlj.exeprlrdfv.exentjhjxj.exehtvfhl.exebpnhhbn.exelltxfj.exebxtbxr.exefpjxj.exeptvln.exelnpnv.exetlfjln.exerlhdhx.exevnxfrnh.exehnhpj.exerrdvx.exevtrnxj.exeljhrfbv.exeblhrvn.exehxvfn.exenhvtln.exeffhlblj.exelhpdj.exehnxxv.exehtrfvvf.exetlnvx.exehhdjlj.exexnrxp.exevjbtjrh.exennvhdvb.exejpdbnbb.exennfrbh.exedltnb.exevhfpbr.exeflvbh.exehhfdxdh.exetdljtf.exepprfxp.exehjvxbx.exexrlpjld.exeltlrx.exevhjdh.exefbvlnnb.exefpthhvn.exehptpb.exeljnbhn.exepid process 2116 hdnbt.exe 2940 hvjvjjp.exe 2640 lvnvv.exe 2676 njxbjjr.exe 2096 tdxfx.exe 2072 trbff.exe 2456 nnfbvdn.exe 2472 htvftl.exe 1032 ltfpjff.exe 1180 xbvjn.exe 2524 fbhnh.exe 2212 brtjd.exe 1992 ffljrd.exe 1964 ntdfftl.exe 1048 nxnfjt.exe 808 drbjn.exe 2520 vrrhl.exe 3032 ftdjnjt.exe 2320 jtfdj.exe 2292 ftrlj.exe 2928 prlrdfv.exe 2300 ntjhjxj.exe 400 htvfhl.exe 2964 bpnhhbn.exe 1828 lltxfj.exe 1584 bxtbxr.exe 1824 fpjxj.exe 924 ptvln.exe 1544 lnpnv.exe 2956 tlfjln.exe 2784 rlhdhx.exe 1600 vnxfrnh.exe 2360 hnhpj.exe 2744 rrdvx.exe 1668 vtrnxj.exe 2116 ljhrfbv.exe 2940 blhrvn.exe 2564 hxvfn.exe 2936 nhvtln.exe 2660 ffhlblj.exe 2096 lhpdj.exe 2496 hnxxv.exe 2848 htrfvvf.exe 2888 tlnvx.exe 2344 hhdjlj.exe 2404 xnrxp.exe 1020 vjbtjrh.exe 1180 nnvhdvb.exe 2708 jpdbnbb.exe 2492 nnfrbh.exe 1820 dltnb.exe 1232 vhfpbr.exe 1964 flvbh.exe 852 hhfdxdh.exe 2220 tdljtf.exe 2232 pprfxp.exe 2224 hjvxbx.exe 3032 xrlpjld.exe 2216 ltlrx.exe 2080 vhjdh.exe 2960 fbvlnnb.exe 304 fpthhvn.exe 2976 hptpb.exe 3004 ljnbhn.exe -
Processes:
resource yara_rule behavioral1/memory/2244-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1180-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/400-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/924-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-35-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
52afa0f82627200f1810fac4d74b40b0_NeikiAnalytics.exehdnbt.exehvjvjjp.exelvnvv.exenjxbjjr.exetdxfx.exetrbff.exennfbvdn.exehtvftl.exeltfpjff.exexbvjn.exefbhnh.exebrtjd.exeffljrd.exentdfftl.exenxnfjt.exedescription pid process target process PID 2244 wrote to memory of 2116 2244 52afa0f82627200f1810fac4d74b40b0_NeikiAnalytics.exe hdnbt.exe PID 2244 wrote to memory of 2116 2244 52afa0f82627200f1810fac4d74b40b0_NeikiAnalytics.exe hdnbt.exe PID 2244 wrote to memory of 2116 2244 52afa0f82627200f1810fac4d74b40b0_NeikiAnalytics.exe hdnbt.exe PID 2244 wrote to memory of 2116 2244 52afa0f82627200f1810fac4d74b40b0_NeikiAnalytics.exe hdnbt.exe PID 2116 wrote to memory of 2940 2116 hdnbt.exe blhrvn.exe PID 2116 wrote to memory of 2940 2116 hdnbt.exe blhrvn.exe PID 2116 wrote to memory of 2940 2116 hdnbt.exe blhrvn.exe PID 2116 wrote to memory of 2940 2116 hdnbt.exe blhrvn.exe PID 2940 wrote to memory of 2640 2940 hvjvjjp.exe lvnvv.exe PID 2940 wrote to memory of 2640 2940 hvjvjjp.exe lvnvv.exe PID 2940 wrote to memory of 2640 2940 hvjvjjp.exe lvnvv.exe PID 2940 wrote to memory of 2640 2940 hvjvjjp.exe lvnvv.exe PID 2640 wrote to memory of 2676 2640 lvnvv.exe njxbjjr.exe PID 2640 wrote to memory of 2676 2640 lvnvv.exe njxbjjr.exe PID 2640 wrote to memory of 2676 2640 lvnvv.exe njxbjjr.exe PID 2640 wrote to memory of 2676 2640 lvnvv.exe njxbjjr.exe PID 2676 wrote to memory of 2096 2676 njxbjjr.exe lhpdj.exe PID 2676 wrote to memory of 2096 2676 njxbjjr.exe lhpdj.exe PID 2676 wrote to memory of 2096 2676 njxbjjr.exe lhpdj.exe PID 2676 wrote to memory of 2096 2676 njxbjjr.exe lhpdj.exe PID 2096 wrote to memory of 2072 2096 tdxfx.exe trbff.exe PID 2096 wrote to memory of 2072 2096 tdxfx.exe trbff.exe PID 2096 wrote to memory of 2072 2096 tdxfx.exe trbff.exe PID 2096 wrote to memory of 2072 2096 tdxfx.exe trbff.exe PID 2072 wrote to memory of 2456 2072 trbff.exe nnfbvdn.exe PID 2072 wrote to memory of 2456 2072 trbff.exe nnfbvdn.exe PID 2072 wrote to memory of 2456 2072 trbff.exe nnfbvdn.exe PID 2072 wrote to memory of 2456 2072 trbff.exe nnfbvdn.exe PID 2456 wrote to memory of 2472 2456 nnfbvdn.exe htvftl.exe PID 2456 wrote to memory of 2472 2456 nnfbvdn.exe htvftl.exe PID 2456 wrote to memory of 2472 2456 nnfbvdn.exe htvftl.exe PID 2456 wrote to memory of 2472 2456 nnfbvdn.exe htvftl.exe PID 2472 wrote to memory of 1032 2472 htvftl.exe ltfpjff.exe PID 2472 wrote to memory of 1032 2472 htvftl.exe ltfpjff.exe PID 2472 wrote to memory of 1032 2472 htvftl.exe ltfpjff.exe PID 2472 wrote to memory of 1032 2472 htvftl.exe ltfpjff.exe PID 1032 wrote to memory of 1180 1032 ltfpjff.exe xbvjn.exe PID 1032 wrote to memory of 1180 1032 ltfpjff.exe xbvjn.exe PID 1032 wrote to memory of 1180 1032 ltfpjff.exe xbvjn.exe PID 1032 wrote to memory of 1180 1032 ltfpjff.exe xbvjn.exe PID 1180 wrote to memory of 2524 1180 xbvjn.exe fbhnh.exe PID 1180 wrote to memory of 2524 1180 xbvjn.exe fbhnh.exe PID 1180 wrote to memory of 2524 1180 xbvjn.exe fbhnh.exe PID 1180 wrote to memory of 2524 1180 xbvjn.exe fbhnh.exe PID 2524 wrote to memory of 2212 2524 fbhnh.exe brtjd.exe PID 2524 wrote to memory of 2212 2524 fbhnh.exe brtjd.exe PID 2524 wrote to memory of 2212 2524 fbhnh.exe brtjd.exe PID 2524 wrote to memory of 2212 2524 fbhnh.exe brtjd.exe PID 2212 wrote to memory of 1992 2212 brtjd.exe ffljrd.exe PID 2212 wrote to memory of 1992 2212 brtjd.exe ffljrd.exe PID 2212 wrote to memory of 1992 2212 brtjd.exe ffljrd.exe PID 2212 wrote to memory of 1992 2212 brtjd.exe ffljrd.exe PID 1992 wrote to memory of 1964 1992 ffljrd.exe ntdfftl.exe PID 1992 wrote to memory of 1964 1992 ffljrd.exe ntdfftl.exe PID 1992 wrote to memory of 1964 1992 ffljrd.exe ntdfftl.exe PID 1992 wrote to memory of 1964 1992 ffljrd.exe ntdfftl.exe PID 1964 wrote to memory of 1048 1964 ntdfftl.exe nxnfjt.exe PID 1964 wrote to memory of 1048 1964 ntdfftl.exe nxnfjt.exe PID 1964 wrote to memory of 1048 1964 ntdfftl.exe nxnfjt.exe PID 1964 wrote to memory of 1048 1964 ntdfftl.exe nxnfjt.exe PID 1048 wrote to memory of 808 1048 nxnfjt.exe drbjn.exe PID 1048 wrote to memory of 808 1048 nxnfjt.exe drbjn.exe PID 1048 wrote to memory of 808 1048 nxnfjt.exe drbjn.exe PID 1048 wrote to memory of 808 1048 nxnfjt.exe drbjn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52afa0f82627200f1810fac4d74b40b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\52afa0f82627200f1810fac4d74b40b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\hdnbt.exec:\hdnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\hvjvjjp.exec:\hvjvjjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\lvnvv.exec:\lvnvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\njxbjjr.exec:\njxbjjr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\tdxfx.exec:\tdxfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\trbff.exec:\trbff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\nnfbvdn.exec:\nnfbvdn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\htvftl.exec:\htvftl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\ltfpjff.exec:\ltfpjff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\xbvjn.exec:\xbvjn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\fbhnh.exec:\fbhnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\brtjd.exec:\brtjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\ffljrd.exec:\ffljrd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\ntdfftl.exec:\ntdfftl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\nxnfjt.exec:\nxnfjt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\drbjn.exec:\drbjn.exe17⤵
- Executes dropped EXE
PID:808 -
\??\c:\vrrhl.exec:\vrrhl.exe18⤵
- Executes dropped EXE
PID:2520 -
\??\c:\ftdjnjt.exec:\ftdjnjt.exe19⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jtfdj.exec:\jtfdj.exe20⤵
- Executes dropped EXE
PID:2320 -
\??\c:\ftrlj.exec:\ftrlj.exe21⤵
- Executes dropped EXE
PID:2292 -
\??\c:\prlrdfv.exec:\prlrdfv.exe22⤵
- Executes dropped EXE
PID:2928 -
\??\c:\ntjhjxj.exec:\ntjhjxj.exe23⤵
- Executes dropped EXE
PID:2300 -
\??\c:\htvfhl.exec:\htvfhl.exe24⤵
- Executes dropped EXE
PID:400 -
\??\c:\bpnhhbn.exec:\bpnhhbn.exe25⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lltxfj.exec:\lltxfj.exe26⤵
- Executes dropped EXE
PID:1828 -
\??\c:\bxtbxr.exec:\bxtbxr.exe27⤵
- Executes dropped EXE
PID:1584 -
\??\c:\fpjxj.exec:\fpjxj.exe28⤵
- Executes dropped EXE
PID:1824 -
\??\c:\ptvln.exec:\ptvln.exe29⤵
- Executes dropped EXE
PID:924 -
\??\c:\lnpnv.exec:\lnpnv.exe30⤵
- Executes dropped EXE
PID:1544 -
\??\c:\tlfjln.exec:\tlfjln.exe31⤵
- Executes dropped EXE
PID:2956 -
\??\c:\rlhdhx.exec:\rlhdhx.exe32⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vnxfrnh.exec:\vnxfrnh.exe33⤵
- Executes dropped EXE
PID:1600 -
\??\c:\hnhpj.exec:\hnhpj.exe34⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rrdvx.exec:\rrdvx.exe35⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vtrnxj.exec:\vtrnxj.exe36⤵
- Executes dropped EXE
PID:1668 -
\??\c:\ljhrfbv.exec:\ljhrfbv.exe37⤵
- Executes dropped EXE
PID:2116 -
\??\c:\blhrvn.exec:\blhrvn.exe38⤵
- Executes dropped EXE
PID:2940 -
\??\c:\hxvfn.exec:\hxvfn.exe39⤵
- Executes dropped EXE
PID:2564 -
\??\c:\nhvtln.exec:\nhvtln.exe40⤵
- Executes dropped EXE
PID:2936 -
\??\c:\ffhlblj.exec:\ffhlblj.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\lhpdj.exec:\lhpdj.exe42⤵
- Executes dropped EXE
PID:2096 -
\??\c:\hnxxv.exec:\hnxxv.exe43⤵
- Executes dropped EXE
PID:2496 -
\??\c:\htrfvvf.exec:\htrfvvf.exe44⤵
- Executes dropped EXE
PID:2848 -
\??\c:\tlnvx.exec:\tlnvx.exe45⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hhdjlj.exec:\hhdjlj.exe46⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xnrxp.exec:\xnrxp.exe47⤵
- Executes dropped EXE
PID:2404 -
\??\c:\vjbtjrh.exec:\vjbtjrh.exe48⤵
- Executes dropped EXE
PID:1020 -
\??\c:\nnvhdvb.exec:\nnvhdvb.exe49⤵
- Executes dropped EXE
PID:1180 -
\??\c:\jpdbnbb.exec:\jpdbnbb.exe50⤵
- Executes dropped EXE
PID:2708 -
\??\c:\nnfrbh.exec:\nnfrbh.exe51⤵
- Executes dropped EXE
PID:2492 -
\??\c:\dltnb.exec:\dltnb.exe52⤵
- Executes dropped EXE
PID:1820 -
\??\c:\vhfpbr.exec:\vhfpbr.exe53⤵
- Executes dropped EXE
PID:1232 -
\??\c:\flvbh.exec:\flvbh.exe54⤵
- Executes dropped EXE
PID:1964 -
\??\c:\hhfdxdh.exec:\hhfdxdh.exe55⤵
- Executes dropped EXE
PID:852 -
\??\c:\tdljtf.exec:\tdljtf.exe56⤵
- Executes dropped EXE
PID:2220 -
\??\c:\pprfxp.exec:\pprfxp.exe57⤵
- Executes dropped EXE
PID:2232 -
\??\c:\hjvxbx.exec:\hjvxbx.exe58⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xrlpjld.exec:\xrlpjld.exe59⤵
- Executes dropped EXE
PID:3032 -
\??\c:\ltlrx.exec:\ltlrx.exe60⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vhjdh.exec:\vhjdh.exe61⤵
- Executes dropped EXE
PID:2080 -
\??\c:\fbvlnnb.exec:\fbvlnnb.exe62⤵
- Executes dropped EXE
PID:2960 -
\??\c:\fpthhvn.exec:\fpthhvn.exe63⤵
- Executes dropped EXE
PID:304 -
\??\c:\hptpb.exec:\hptpb.exe64⤵
- Executes dropped EXE
PID:2976 -
\??\c:\ljnbhn.exec:\ljnbhn.exe65⤵
- Executes dropped EXE
PID:3004 -
\??\c:\lndtnvn.exec:\lndtnvn.exe66⤵PID:1960
-
\??\c:\dvfnld.exec:\dvfnld.exe67⤵PID:3060
-
\??\c:\xnvfn.exec:\xnvfn.exe68⤵PID:792
-
\??\c:\hllrxh.exec:\hllrxh.exe69⤵PID:1584
-
\??\c:\bntljl.exec:\bntljl.exe70⤵PID:1840
-
\??\c:\dlptjvh.exec:\dlptjvh.exe71⤵PID:2168
-
\??\c:\vfnftjt.exec:\vfnftjt.exe72⤵PID:564
-
\??\c:\lfthl.exec:\lfthl.exe73⤵PID:1340
-
\??\c:\tfprjh.exec:\tfprjh.exe74⤵PID:2956
-
\??\c:\vbtbpff.exec:\vbtbpff.exe75⤵PID:1248
-
\??\c:\rdbpd.exec:\rdbpd.exe76⤵PID:2124
-
\??\c:\vtjvvd.exec:\vtjvvd.exe77⤵PID:2352
-
\??\c:\njbxnfn.exec:\njbxnfn.exe78⤵PID:1224
-
\??\c:\prrhjvp.exec:\prrhjvp.exe79⤵PID:2912
-
\??\c:\jhrjd.exec:\jhrjd.exe80⤵PID:2632
-
\??\c:\xxrlr.exec:\xxrlr.exe81⤵PID:2116
-
\??\c:\fhpvxtx.exec:\fhpvxtx.exe82⤵PID:2640
-
\??\c:\lfpjt.exec:\lfpjt.exe83⤵PID:3044
-
\??\c:\dxjbb.exec:\dxjbb.exe84⤵PID:2596
-
\??\c:\fndpjpv.exec:\fndpjpv.exe85⤵PID:2424
-
\??\c:\rtrpfj.exec:\rtrpfj.exe86⤵PID:1548
-
\??\c:\tnvvv.exec:\tnvvv.exe87⤵PID:2072
-
\??\c:\ntblx.exec:\ntblx.exe88⤵PID:3016
-
\??\c:\fflnrh.exec:\fflnrh.exe89⤵PID:2932
-
\??\c:\trjfhlf.exec:\trjfhlf.exe90⤵PID:1524
-
\??\c:\rxxbndt.exec:\rxxbndt.exe91⤵PID:2484
-
\??\c:\tdblr.exec:\tdblr.exe92⤵PID:2740
-
\??\c:\vtlvtf.exec:\vtlvtf.exe93⤵PID:1732
-
\??\c:\jtfxnx.exec:\jtfxnx.exe94⤵PID:2668
-
\??\c:\jxhnt.exec:\jxhnt.exe95⤵PID:1796
-
\??\c:\pxbpvd.exec:\pxbpvd.exe96⤵PID:1428
-
\??\c:\dvvdjn.exec:\dvvdjn.exe97⤵PID:2736
-
\??\c:\tnjxxpp.exec:\tnjxxpp.exe98⤵PID:2024
-
\??\c:\vfftn.exec:\vfftn.exe99⤵PID:1772
-
\??\c:\nbtljlr.exec:\nbtljlr.exe100⤵PID:1700
-
\??\c:\rbnrnn.exec:\rbnrnn.exe101⤵PID:1620
-
\??\c:\phnbp.exec:\phnbp.exe102⤵PID:2280
-
\??\c:\dlvdxl.exec:\dlvdxl.exe103⤵PID:944
-
\??\c:\vdhxbn.exec:\vdhxbn.exe104⤵PID:596
-
\??\c:\dvbblp.exec:\dvbblp.exe105⤵PID:2292
-
\??\c:\vrvbpvn.exec:\vrvbpvn.exe106⤵PID:2772
-
\??\c:\xjnff.exec:\xjnff.exe107⤵PID:436
-
\??\c:\vftvl.exec:\vftvl.exe108⤵PID:2972
-
\??\c:\fjlnn.exec:\fjlnn.exe109⤵PID:2044
-
\??\c:\vdnvnfv.exec:\vdnvnfv.exe110⤵PID:1392
-
\??\c:\lnrvb.exec:\lnrvb.exe111⤵PID:1828
-
\??\c:\nvxvdd.exec:\nvxvdd.exe112⤵PID:1076
-
\??\c:\rhrhjp.exec:\rhrhjp.exe113⤵PID:908
-
\??\c:\lrvpf.exec:\lrvpf.exe114⤵PID:1832
-
\??\c:\rlndd.exec:\rlndd.exe115⤵PID:2820
-
\??\c:\lvphj.exec:\lvphj.exe116⤵PID:1460
-
\??\c:\plfpnnl.exec:\plfpnnl.exe117⤵PID:2148
-
\??\c:\vljrf.exec:\vljrf.exe118⤵PID:3056
-
\??\c:\nbnrnbr.exec:\nbnrnbr.exe119⤵PID:2348
-
\??\c:\lptxn.exec:\lptxn.exe120⤵PID:2504
-
\??\c:\nhtrxl.exec:\nhtrxl.exe121⤵PID:2272
-
\??\c:\xlvnbp.exec:\xlvnbp.exe122⤵PID:3012
-
\??\c:\nhtrjd.exec:\nhtrjd.exe123⤵PID:2864
-
\??\c:\ntnfdv.exec:\ntnfdv.exe124⤵PID:2516
-
\??\c:\jvpppl.exec:\jvpppl.exe125⤵PID:2620
-
\??\c:\llbhx.exec:\llbhx.exe126⤵PID:2692
-
\??\c:\bnpxdhn.exec:\bnpxdhn.exe127⤵PID:2584
-
\??\c:\vpnplht.exec:\vpnplht.exe128⤵PID:2468
-
\??\c:\lbhvvvr.exec:\lbhvvvr.exe129⤵PID:2600
-
\??\c:\pnnfx.exec:\pnnfx.exe130⤵PID:2560
-
\??\c:\pvdxvt.exec:\pvdxvt.exe131⤵PID:3048
-
\??\c:\pjrtr.exec:\pjrtr.exe132⤵PID:2436
-
\??\c:\hnnjx.exec:\hnnjx.exe133⤵PID:824
-
\??\c:\pdlhh.exec:\pdlhh.exe134⤵PID:956
-
\??\c:\ndnnvv.exec:\ndnnvv.exe135⤵PID:2716
-
\??\c:\nftdll.exec:\nftdll.exe136⤵PID:2860
-
\??\c:\hnrfd.exec:\hnrfd.exe137⤵PID:1740
-
\??\c:\bnxvdvf.exec:\bnxvdvf.exe138⤵PID:1984
-
\??\c:\htlbl.exec:\htlbl.exe139⤵PID:2856
-
\??\c:\fhnfpxj.exec:\fhnfpxj.exe140⤵PID:2248
-
\??\c:\rtjjpdv.exec:\rtjjpdv.exe141⤵PID:2252
-
\??\c:\vvpdnx.exec:\vvpdnx.exe142⤵PID:764
-
\??\c:\rnbvnf.exec:\rnbvnf.exe143⤵PID:1656
-
\??\c:\prvtj.exec:\prvtj.exe144⤵PID:948
-
\??\c:\fdvhdp.exec:\fdvhdp.exe145⤵PID:1704
-
\??\c:\vftvtr.exec:\vftvtr.exe146⤵PID:1780
-
\??\c:\xtnftbh.exec:\xtnftbh.exe147⤵PID:468
-
\??\c:\dlrpb.exec:\dlrpb.exe148⤵PID:2776
-
\??\c:\dvfdnf.exec:\dvfdnf.exe149⤵PID:676
-
\??\c:\dbxppbh.exec:\dbxppbh.exe150⤵PID:276
-
\??\c:\rvdjv.exec:\rvdjv.exe151⤵PID:2188
-
\??\c:\bbjvf.exec:\bbjvf.exe152⤵PID:2040
-
\??\c:\jpphp.exec:\jpphp.exe153⤵PID:1852
-
\??\c:\bxpjjrt.exec:\bxpjjrt.exe154⤵PID:108
-
\??\c:\jndnndp.exec:\jndnndp.exe155⤵PID:2992
-
\??\c:\fdfppx.exec:\fdfppx.exe156⤵PID:792
-
\??\c:\hhfvpjr.exec:\hhfvpjr.exe157⤵PID:1584
-
\??\c:\jhrbdv.exec:\jhrbdv.exe158⤵PID:924
-
\??\c:\fdbdd.exec:\fdbdd.exe159⤵PID:2900
-
\??\c:\vfbpdtl.exec:\vfbpdtl.exe160⤵PID:1892
-
\??\c:\rjvvtjv.exec:\rjvvtjv.exe161⤵PID:1708
-
\??\c:\nvtrb.exec:\nvtrb.exe162⤵PID:2956
-
\??\c:\dnhdnr.exec:\dnhdnr.exe163⤵PID:3056
-
\??\c:\fdbtnj.exec:\fdbtnj.exe164⤵PID:2124
-
\??\c:\xrnrv.exec:\xrnrv.exe165⤵PID:1672
-
\??\c:\dnhdbbn.exec:\dnhdbbn.exe166⤵PID:1224
-
\??\c:\txptfnb.exec:\txptfnb.exe167⤵PID:2764
-
\??\c:\pnthl.exec:\pnthl.exe168⤵PID:2688
-
\??\c:\dtxnpr.exec:\dtxnpr.exe169⤵PID:2756
-
\??\c:\jvjthn.exec:\jvjthn.exe170⤵PID:2640
-
\??\c:\xrhxjr.exec:\xrhxjr.exe171⤵PID:2660
-
\??\c:\jlfjntv.exec:\jlfjntv.exe172⤵PID:2584
-
\??\c:\vnfvb.exec:\vnfvb.exe173⤵PID:2500
-
\??\c:\xtprhh.exec:\xtprhh.exe174⤵PID:2496
-
\??\c:\vrdrrj.exec:\vrdrrj.exe175⤵PID:2072
-
\??\c:\jfdpfj.exec:\jfdpfj.exe176⤵PID:3016
-
\??\c:\vnbljnp.exec:\vnbljnp.exe177⤵PID:2436
-
\??\c:\ttdhd.exec:\ttdhd.exe178⤵PID:2404
-
\??\c:\lnfhvlr.exec:\lnfhvlr.exe179⤵PID:2728
-
\??\c:\vfndlx.exec:\vfndlx.exe180⤵PID:812
-
\??\c:\nrnfvb.exec:\nrnfvb.exe181⤵PID:2708
-
\??\c:\tdbpdf.exec:\tdbpdf.exe182⤵PID:2668
-
\??\c:\pxrlrt.exec:\pxrlrt.exe183⤵PID:1444
-
\??\c:\rbpdll.exec:\rbpdll.exe184⤵PID:1428
-
\??\c:\nbhrpnl.exec:\nbhrpnl.exe185⤵PID:2736
-
\??\c:\flblpb.exec:\flblpb.exe186⤵PID:2032
-
\??\c:\hxbrfnj.exec:\hxbrfnj.exe187⤵PID:1756
-
\??\c:\bvtvdrv.exec:\bvtvdrv.exe188⤵PID:1700
-
\??\c:\vrxtdd.exec:\vrxtdd.exe189⤵PID:1620
-
\??\c:\hbjll.exec:\hbjll.exe190⤵PID:1112
-
\??\c:\tfhvph.exec:\tfhvph.exe191⤵PID:592
-
\??\c:\xtdlnb.exec:\xtdlnb.exe192⤵PID:692
-
\??\c:\ndjrlt.exec:\ndjrlt.exe193⤵PID:2292
-
\??\c:\vtpdl.exec:\vtpdl.exe194⤵PID:2064
-
\??\c:\rhhdfhp.exec:\rhhdfhp.exe195⤵PID:2372
-
\??\c:\vnjrtf.exec:\vnjrtf.exe196⤵PID:1120
-
\??\c:\fprll.exec:\fprll.exe197⤵PID:960
-
\??\c:\vlhlr.exec:\vlhlr.exe198⤵PID:1604
-
\??\c:\vrhbtx.exec:\vrhbtx.exe199⤵PID:2192
-
\??\c:\jhdhj.exec:\jhdhj.exe200⤵PID:1804
-
\??\c:\pdxbf.exec:\pdxbf.exe201⤵PID:1888
-
\??\c:\dfbfj.exec:\dfbfj.exe202⤵PID:1288
-
\??\c:\jbvrn.exec:\jbvrn.exe203⤵PID:3000
-
\??\c:\fxvrt.exec:\fxvrt.exe204⤵PID:1720
-
\??\c:\xdfvh.exec:\xdfvh.exe205⤵PID:2376
-
\??\c:\nfvdvtr.exec:\nfvdvtr.exe206⤵PID:2336
-
\??\c:\djhtnbr.exec:\djhtnbr.exe207⤵PID:872
-
\??\c:\vdtndfx.exec:\vdtndfx.exe208⤵PID:1588
-
\??\c:\fbntxjn.exec:\fbntxjn.exe209⤵PID:1640
-
\??\c:\thvrfnb.exec:\thvrfnb.exe210⤵PID:2572
-
\??\c:\rhfldxl.exec:\rhfldxl.exe211⤵PID:2984
-
\??\c:\dlfvh.exec:\dlfvh.exe212⤵PID:2648
-
\??\c:\lpjjb.exec:\lpjjb.exe213⤵PID:2164
-
\??\c:\dvbprj.exec:\dvbprj.exe214⤵PID:2936
-
\??\c:\plldx.exec:\plldx.exe215⤵PID:3044
-
\??\c:\flphpvp.exec:\flphpvp.exe216⤵PID:1276
-
\??\c:\jlhjv.exec:\jlhjv.exe217⤵PID:2156
-
\??\c:\bbvftj.exec:\bbvftj.exe218⤵PID:2548
-
\??\c:\tblxtd.exec:\tblxtd.exe219⤵PID:2892
-
\??\c:\jbnllbj.exec:\jbnllbj.exe220⤵PID:1380
-
\??\c:\bdthx.exec:\bdthx.exe221⤵PID:2344
-
\??\c:\xbhttnf.exec:\xbhttnf.exe222⤵PID:888
-
\??\c:\rfvnd.exec:\rfvnd.exe223⤵PID:2712
-
\??\c:\jhxtrj.exec:\jhxtrj.exe224⤵PID:1628
-
\??\c:\ljjnrfl.exec:\ljjnrfl.exe225⤵PID:2036
-
\??\c:\fphppl.exec:\fphppl.exe226⤵PID:1996
-
\??\c:\hvtvjxr.exec:\hvtvjxr.exe227⤵PID:2856
-
\??\c:\nbjfdhl.exec:\nbjfdhl.exe228⤵PID:1048
-
\??\c:\nhffbbf.exec:\nhffbbf.exe229⤵PID:1964
-
\??\c:\thbdr.exec:\thbdr.exe230⤵PID:1680
-
\??\c:\djhrlfd.exec:\djhrlfd.exe231⤵PID:2276
-
\??\c:\vptddrt.exec:\vptddrt.exe232⤵PID:2656
-
\??\c:\rfxhnv.exec:\rfxhnv.exe233⤵PID:324
-
\??\c:\fvfjnd.exec:\fvfjnd.exe234⤵PID:1936
-
\??\c:\dbldvp.exec:\dbldvp.exe235⤵PID:692
-
\??\c:\xtxvf.exec:\xtxvf.exe236⤵PID:2056
-
\??\c:\ttrhl.exec:\ttrhl.exe237⤵PID:1260
-
\??\c:\xjnnh.exec:\xjnnh.exe238⤵PID:1764
-
\??\c:\vxjvxbf.exec:\vxjvxbf.exe239⤵PID:1812
-
\??\c:\tpdnbjx.exec:\tpdnbjx.exe240⤵PID:1800
-
\??\c:\vvljpt.exec:\vvljpt.exe241⤵PID:2992
-
\??\c:\njpplvr.exec:\njpplvr.exe242⤵PID:2196