Analysis
-
max time kernel
151s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 16:43
Behavioral task
behavioral1
Sample
148cbbc6b57015127708168ad0edbc70_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
148cbbc6b57015127708168ad0edbc70_NeikiAnalytics.exe
-
Size
92KB
-
MD5
148cbbc6b57015127708168ad0edbc70
-
SHA1
fb61540e8b6cab5fc909a54b36ff0e4f8e7beb98
-
SHA256
057fcd58b91d546e7a2f4ae32a9d31c6c5b84abea56d99b5a7f0cfb6424c9760
-
SHA512
988b6e52c8ae8e4fbbeee23afbfb8af181aa5f79891b2dd972287de417f8c7ba7ae38980a8905a8508bb991b3210978352090736f37df0b9a8569cf839204d17
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWpW4:8hOmTsF93UYfwC6GIout0fmCiiiXA6mH
Malware Config
Signatures
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/3012-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-74-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2448-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/572-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1568-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1452-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1344-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/308-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1160-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/980-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/616-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1744-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1604-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1616-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-366-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1936-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1316-460-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2316-475-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2052-492-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-515-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1328-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-555-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2892-584-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2536-593-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1652-672-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2448-690-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2264-972-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1956-1017-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/400-1064-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1184-1101-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2908-5467-0x0000000077900000-0x00000000779FA000-memory.dmp family_blackmoon behavioral1/memory/2908-7738-0x0000000077900000-0x00000000779FA000-memory.dmp family_blackmoon behavioral1/memory/2908-7737-0x00000000777E0000-0x00000000778FF000-memory.dmp family_blackmoon behavioral1/memory/2908-9464-0x00000000777E0000-0x00000000778FF000-memory.dmp family_blackmoon behavioral1/memory/2908-10612-0x0000000077900000-0x00000000779FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2696 lxdft.exe 2516 bnlhrth.exe 2608 nbhpbxb.exe 2512 fjfhfp.exe 2524 vdvtr.exe 2736 bnlxrtp.exe 2460 hprll.exe 2456 rrnljxx.exe 2448 fvhdpjp.exe 572 pbtldtt.exe 1568 dbtllr.exe 2864 xnxlf.exe 1452 frplxdb.exe 1664 lrnbdl.exe 944 tjjdxhr.exe 2168 lpjfrv.exe 1344 jnpfjn.exe 2028 vjvfxnf.exe 656 ddjtjd.exe 2324 ffndjr.exe 308 fxhtrt.exe 1748 xpvlfx.exe 2924 fhdvljb.exe 2052 bddtxpn.exe 2588 tpbpp.exe 2300 thtxx.exe 2272 bnvfr.exe 1160 bvprlxx.exe 392 ptxnn.exe 980 ftdlbv.exe 2960 xrnlvrx.exe 616 jvxrx.exe 2308 plhhvrv.exe 2208 rhdldf.exe 1744 dttndtb.exe 1408 pfddfp.exe 1604 hhvpbx.exe 2216 nvpxx.exe 2600 fhxltl.exe 2948 tlplvlj.exe 2996 lvtlh.exe 1616 nbtvf.exe 2624 xbfvf.exe 2560 fjhxhd.exe 2540 vtnxbtd.exe 2512 nxfbpf.exe 2728 ldrtdxl.exe 2576 ntfvlvx.exe 2736 rlplntl.exe 2416 nhpnjhn.exe 2480 jxphbdn.exe 2888 ltjrlb.exe 1204 jbrjlld.exe 2848 nhhvpj.exe 1180 dhrjl.exe 2840 hhvxl.exe 276 hppvn.exe 868 hhvxb.exe 1936 pvtdx.exe 2104 tnvpdr.exe 1852 bddjpn.exe 1952 fnfxdj.exe 1988 lnrvpbp.exe 1956 xnrxjr.exe -
resource yara_rule behavioral1/memory/3012-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c0000000132c6-7.dat upx behavioral1/memory/3012-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x002f0000000133b7-16.dat upx behavioral1/memory/2696-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2516-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x002d0000000134ad-23.dat upx behavioral1/memory/2608-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a0000000139d6-32.dat upx behavioral1/memory/2512-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000139e8-41.dat upx behavioral1/memory/2524-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000013a4d-51.dat upx behavioral1/memory/2524-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2736-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000140f2-59.dat upx behavioral1/memory/2460-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001450f-65.dat upx behavioral1/files/0x0006000000015c69-75.dat upx behavioral1/memory/2448-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/572-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c7c-84.dat upx behavioral1/files/0x0006000000015cb9-91.dat upx behavioral1/memory/1568-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1568-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0013000000013721-100.dat upx behavioral1/files/0x0006000000015d88-107.dat upx behavioral1/files/0x0006000000015db4-114.dat upx behavioral1/memory/1664-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1452-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015e02-123.dat upx behavioral1/memory/2168-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015e41-131.dat upx behavioral1/files/0x0006000000015e5b-138.dat upx behavioral1/memory/1344-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015e6f-147.dat upx behavioral1/memory/2028-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015e7c-156.dat upx behavioral1/files/0x0006000000015eaf-163.dat upx behavioral1/memory/2324-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015ec0-171.dat upx behavioral1/memory/308-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016042-181.dat upx behavioral1/memory/1748-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1748-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001604b-188.dat upx behavioral1/memory/2924-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016283-197.dat upx behavioral1/files/0x0006000000016332-203.dat upx behavioral1/files/0x0006000000016476-210.dat upx behavioral1/memory/2300-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000165ae-219.dat upx behavioral1/memory/2300-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001663d-229.dat upx behavioral1/memory/1160-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2272-227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1160-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000167db-235.dat upx behavioral1/files/0x0006000000016b5e-243.dat upx behavioral1/memory/980-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016b96-253.dat upx behavioral1/memory/980-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c10-260.dat upx behavioral1/memory/2960-261-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2696 3012 148cbbc6b57015127708168ad0edbc70_NeikiAnalytics.exe 28 PID 3012 wrote to memory of 2696 3012 148cbbc6b57015127708168ad0edbc70_NeikiAnalytics.exe 28 PID 3012 wrote to memory of 2696 3012 148cbbc6b57015127708168ad0edbc70_NeikiAnalytics.exe 28 PID 3012 wrote to memory of 2696 3012 148cbbc6b57015127708168ad0edbc70_NeikiAnalytics.exe 28 PID 2696 wrote to memory of 2516 2696 lxdft.exe 29 PID 2696 wrote to memory of 2516 2696 lxdft.exe 29 PID 2696 wrote to memory of 2516 2696 lxdft.exe 29 PID 2696 wrote to memory of 2516 2696 lxdft.exe 29 PID 2516 wrote to memory of 2608 2516 bnlhrth.exe 30 PID 2516 wrote to memory of 2608 2516 bnlhrth.exe 30 PID 2516 wrote to memory of 2608 2516 bnlhrth.exe 30 PID 2516 wrote to memory of 2608 2516 bnlhrth.exe 30 PID 2608 wrote to memory of 2512 2608 nbhpbxb.exe 31 PID 2608 wrote to memory of 2512 2608 nbhpbxb.exe 31 PID 2608 wrote to memory of 2512 2608 nbhpbxb.exe 31 PID 2608 wrote to memory of 2512 2608 nbhpbxb.exe 31 PID 2512 wrote to memory of 2524 2512 fjfhfp.exe 32 PID 2512 wrote to memory of 2524 2512 fjfhfp.exe 32 PID 2512 wrote to memory of 2524 2512 fjfhfp.exe 32 PID 2512 wrote to memory of 2524 2512 fjfhfp.exe 32 PID 2524 wrote to memory of 2736 2524 vdvtr.exe 33 PID 2524 wrote to memory of 2736 2524 vdvtr.exe 33 PID 2524 wrote to memory of 2736 2524 vdvtr.exe 33 PID 2524 wrote to memory of 2736 2524 vdvtr.exe 33 PID 2736 wrote to memory of 2460 2736 bnlxrtp.exe 34 PID 2736 wrote to memory of 2460 2736 bnlxrtp.exe 34 PID 2736 wrote to memory of 2460 2736 bnlxrtp.exe 34 PID 2736 wrote to memory of 2460 2736 bnlxrtp.exe 34 PID 2460 wrote to memory of 2456 2460 hprll.exe 35 PID 2460 wrote to memory of 2456 2460 hprll.exe 35 PID 2460 wrote to memory of 2456 2460 hprll.exe 35 PID 2460 wrote to memory of 2456 2460 hprll.exe 35 PID 2456 wrote to memory of 2448 2456 rrnljxx.exe 36 PID 2456 wrote to memory of 2448 2456 rrnljxx.exe 36 PID 2456 wrote to memory of 2448 2456 rrnljxx.exe 36 PID 2456 wrote to memory of 2448 2456 rrnljxx.exe 36 PID 2448 wrote to memory of 572 2448 fvhdpjp.exe 37 PID 2448 wrote to memory of 572 2448 fvhdpjp.exe 37 PID 2448 wrote to memory of 572 2448 fvhdpjp.exe 37 PID 2448 wrote to memory of 572 2448 fvhdpjp.exe 37 PID 572 wrote to memory of 1568 572 pbtldtt.exe 38 PID 572 wrote to memory of 1568 572 pbtldtt.exe 38 PID 572 wrote to memory of 1568 572 pbtldtt.exe 38 PID 572 wrote to memory of 1568 572 pbtldtt.exe 38 PID 1568 wrote to memory of 2864 1568 dbtllr.exe 39 PID 1568 wrote to memory of 2864 1568 dbtllr.exe 39 PID 1568 wrote to memory of 2864 1568 dbtllr.exe 39 PID 1568 wrote to memory of 2864 1568 dbtllr.exe 39 PID 2864 wrote to memory of 1452 2864 xnxlf.exe 40 PID 2864 wrote to memory of 1452 2864 xnxlf.exe 40 PID 2864 wrote to memory of 1452 2864 xnxlf.exe 40 PID 2864 wrote to memory of 1452 2864 xnxlf.exe 40 PID 1452 wrote to memory of 1664 1452 frplxdb.exe 41 PID 1452 wrote to memory of 1664 1452 frplxdb.exe 41 PID 1452 wrote to memory of 1664 1452 frplxdb.exe 41 PID 1452 wrote to memory of 1664 1452 frplxdb.exe 41 PID 1664 wrote to memory of 944 1664 lrnbdl.exe 42 PID 1664 wrote to memory of 944 1664 lrnbdl.exe 42 PID 1664 wrote to memory of 944 1664 lrnbdl.exe 42 PID 1664 wrote to memory of 944 1664 lrnbdl.exe 42 PID 944 wrote to memory of 2168 944 tjjdxhr.exe 43 PID 944 wrote to memory of 2168 944 tjjdxhr.exe 43 PID 944 wrote to memory of 2168 944 tjjdxhr.exe 43 PID 944 wrote to memory of 2168 944 tjjdxhr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\148cbbc6b57015127708168ad0edbc70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\148cbbc6b57015127708168ad0edbc70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\lxdft.exec:\lxdft.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\bnlhrth.exec:\bnlhrth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\nbhpbxb.exec:\nbhpbxb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\fjfhfp.exec:\fjfhfp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\vdvtr.exec:\vdvtr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\bnlxrtp.exec:\bnlxrtp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\hprll.exec:\hprll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\rrnljxx.exec:\rrnljxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\fvhdpjp.exec:\fvhdpjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\pbtldtt.exec:\pbtldtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\dbtllr.exec:\dbtllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\xnxlf.exec:\xnxlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\frplxdb.exec:\frplxdb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\lrnbdl.exec:\lrnbdl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\tjjdxhr.exec:\tjjdxhr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\lpjfrv.exec:\lpjfrv.exe17⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jnpfjn.exec:\jnpfjn.exe18⤵
- Executes dropped EXE
PID:1344 -
\??\c:\vjvfxnf.exec:\vjvfxnf.exe19⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ddjtjd.exec:\ddjtjd.exe20⤵
- Executes dropped EXE
PID:656 -
\??\c:\ffndjr.exec:\ffndjr.exe21⤵
- Executes dropped EXE
PID:2324 -
\??\c:\fxhtrt.exec:\fxhtrt.exe22⤵
- Executes dropped EXE
PID:308 -
\??\c:\xpvlfx.exec:\xpvlfx.exe23⤵
- Executes dropped EXE
PID:1748 -
\??\c:\fhdvljb.exec:\fhdvljb.exe24⤵
- Executes dropped EXE
PID:2924 -
\??\c:\bddtxpn.exec:\bddtxpn.exe25⤵
- Executes dropped EXE
PID:2052 -
\??\c:\tpbpp.exec:\tpbpp.exe26⤵
- Executes dropped EXE
PID:2588 -
\??\c:\thtxx.exec:\thtxx.exe27⤵
- Executes dropped EXE
PID:2300 -
\??\c:\bnvfr.exec:\bnvfr.exe28⤵
- Executes dropped EXE
PID:2272 -
\??\c:\bvprlxx.exec:\bvprlxx.exe29⤵
- Executes dropped EXE
PID:1160 -
\??\c:\ptxnn.exec:\ptxnn.exe30⤵
- Executes dropped EXE
PID:392 -
\??\c:\ftdlbv.exec:\ftdlbv.exe31⤵
- Executes dropped EXE
PID:980 -
\??\c:\xrnlvrx.exec:\xrnlvrx.exe32⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jvxrx.exec:\jvxrx.exe33⤵
- Executes dropped EXE
PID:616 -
\??\c:\plhhvrv.exec:\plhhvrv.exe34⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rhdldf.exec:\rhdldf.exe35⤵
- Executes dropped EXE
PID:2208 -
\??\c:\dttndtb.exec:\dttndtb.exe36⤵
- Executes dropped EXE
PID:1744 -
\??\c:\pfddfp.exec:\pfddfp.exe37⤵
- Executes dropped EXE
PID:1408 -
\??\c:\hhvpbx.exec:\hhvpbx.exe38⤵
- Executes dropped EXE
PID:1604 -
\??\c:\nvpxx.exec:\nvpxx.exe39⤵
- Executes dropped EXE
PID:2216 -
\??\c:\fhxltl.exec:\fhxltl.exe40⤵
- Executes dropped EXE
PID:2600 -
\??\c:\tlplvlj.exec:\tlplvlj.exe41⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lvtlh.exec:\lvtlh.exe42⤵
- Executes dropped EXE
PID:2996 -
\??\c:\nbtvf.exec:\nbtvf.exe43⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xbfvf.exec:\xbfvf.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\fjhxhd.exec:\fjhxhd.exe45⤵
- Executes dropped EXE
PID:2560 -
\??\c:\vtnxbtd.exec:\vtnxbtd.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nxfbpf.exec:\nxfbpf.exe47⤵
- Executes dropped EXE
PID:2512 -
\??\c:\ldrtdxl.exec:\ldrtdxl.exe48⤵
- Executes dropped EXE
PID:2728 -
\??\c:\ntfvlvx.exec:\ntfvlvx.exe49⤵
- Executes dropped EXE
PID:2576 -
\??\c:\rlplntl.exec:\rlplntl.exe50⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nhpnjhn.exec:\nhpnjhn.exe51⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jxphbdn.exec:\jxphbdn.exe52⤵
- Executes dropped EXE
PID:2480 -
\??\c:\ltjrlb.exec:\ltjrlb.exe53⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jbrjlld.exec:\jbrjlld.exe54⤵
- Executes dropped EXE
PID:1204 -
\??\c:\nhhvpj.exec:\nhhvpj.exe55⤵
- Executes dropped EXE
PID:2848 -
\??\c:\dhrjl.exec:\dhrjl.exe56⤵
- Executes dropped EXE
PID:1180 -
\??\c:\hhvxl.exec:\hhvxl.exe57⤵
- Executes dropped EXE
PID:2840 -
\??\c:\hppvn.exec:\hppvn.exe58⤵
- Executes dropped EXE
PID:276 -
\??\c:\hhvxb.exec:\hhvxb.exe59⤵
- Executes dropped EXE
PID:868 -
\??\c:\pvtdx.exec:\pvtdx.exe60⤵
- Executes dropped EXE
PID:1936 -
\??\c:\tnvpdr.exec:\tnvpdr.exe61⤵
- Executes dropped EXE
PID:2104 -
\??\c:\bddjpn.exec:\bddjpn.exe62⤵
- Executes dropped EXE
PID:1852 -
\??\c:\fnfxdj.exec:\fnfxdj.exe63⤵
- Executes dropped EXE
PID:1952 -
\??\c:\lnrvpbp.exec:\lnrvpbp.exe64⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xnrxjr.exec:\xnrxjr.exe65⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vvbdt.exec:\vvbdt.exe66⤵PID:2668
-
\??\c:\rnrfrjx.exec:\rnrfrjx.exe67⤵PID:2344
-
\??\c:\nvnptt.exec:\nvnptt.exe68⤵PID:1860
-
\??\c:\pvxfln.exec:\pvxfln.exe69⤵PID:1316
-
\??\c:\nfdfxv.exec:\nfdfxv.exe70⤵PID:2260
-
\??\c:\dhdjj.exec:\dhdjj.exe71⤵PID:2316
-
\??\c:\pxrjv.exec:\pxrjv.exe72⤵PID:2784
-
\??\c:\ldnnvlx.exec:\ldnnvlx.exe73⤵PID:2328
-
\??\c:\jpllfp.exec:\jpllfp.exe74⤵PID:2052
-
\??\c:\jfdnpv.exec:\jfdnpv.exe75⤵PID:516
-
\??\c:\lbfpld.exec:\lbfpld.exe76⤵PID:548
-
\??\c:\vbdvt.exec:\vbdvt.exe77⤵PID:436
-
\??\c:\xjvxd.exec:\xjvxd.exe78⤵PID:1512
-
\??\c:\ntptp.exec:\ntptp.exe79⤵PID:1824
-
\??\c:\xrvpjp.exec:\xrvpjp.exe80⤵PID:1672
-
\??\c:\nvhplpd.exec:\nvhplpd.exe81⤵PID:1328
-
\??\c:\hrpddfd.exec:\hrpddfd.exe82⤵PID:980
-
\??\c:\xppdlf.exec:\xppdlf.exe83⤵PID:2748
-
\??\c:\dvhhr.exec:\dvhhr.exe84⤵PID:956
-
\??\c:\vlrdhln.exec:\vlrdhln.exe85⤵PID:2080
-
\??\c:\ffxnlb.exec:\ffxnlb.exe86⤵PID:2792
-
\??\c:\bbtpxpd.exec:\bbtpxpd.exe87⤵PID:2892
-
\??\c:\vjfblrh.exec:\vjfblrh.exe88⤵PID:536
-
\??\c:\lhrllnl.exec:\lhrllnl.exe89⤵PID:704
-
\??\c:\hfllr.exec:\hfllr.exe90⤵PID:2156
-
\??\c:\vxvjfj.exec:\vxvjfj.exe91⤵PID:2904
-
\??\c:\jffxffl.exec:\jffxffl.exe92⤵PID:2496
-
\??\c:\xhxbl.exec:\xhxbl.exe93⤵PID:2536
-
\??\c:\xxhxpb.exec:\xxhxpb.exe94⤵PID:1552
-
\??\c:\xlrbn.exec:\xlrbn.exe95⤵PID:2740
-
\??\c:\fldjbfb.exec:\fldjbfb.exe96⤵PID:2604
-
\??\c:\nntjnj.exec:\nntjnj.exe97⤵PID:2608
-
\??\c:\dfjffvx.exec:\dfjffvx.exe98⤵PID:2648
-
\??\c:\jdfdff.exec:\jdfdff.exe99⤵PID:2620
-
\??\c:\pdpxl.exec:\pdpxl.exe100⤵PID:2568
-
\??\c:\nrvjl.exec:\nrvjl.exe101⤵PID:2636
-
\??\c:\vhxpfv.exec:\vhxpfv.exe102⤵PID:2000
-
\??\c:\jfdtjll.exec:\jfdtjll.exe103⤵PID:2460
-
\??\c:\xtxhp.exec:\xtxhp.exe104⤵PID:1804
-
\??\c:\bpdbf.exec:\bpdbf.exe105⤵PID:3000
-
\??\c:\xrfll.exec:\xrfll.exe106⤵PID:2480
-
\??\c:\hpfxnj.exec:\hpfxnj.exe107⤵PID:2448
-
\??\c:\trhfx.exec:\trhfx.exe108⤵PID:1652
-
\??\c:\fxxdxdt.exec:\fxxdxdt.exe109⤵PID:1128
-
\??\c:\jxdhdrh.exec:\jxdhdrh.exe110⤵PID:1180
-
\??\c:\bjrdr.exec:\bjrdr.exe111⤵PID:2840
-
\??\c:\bvjbtl.exec:\bvjbtl.exe112⤵PID:276
-
\??\c:\dtbhr.exec:\dtbhr.exe113⤵PID:1660
-
\??\c:\ntjbvjt.exec:\ntjbvjt.exe114⤵PID:1936
-
\??\c:\trxvd.exec:\trxvd.exe115⤵PID:1664
-
\??\c:\xpldtp.exec:\xpldtp.exe116⤵PID:1852
-
\??\c:\nvdpphj.exec:\nvdpphj.exe117⤵PID:1832
-
\??\c:\hhdlb.exec:\hhdlb.exe118⤵PID:1988
-
\??\c:\phjjbbh.exec:\phjjbbh.exe119⤵PID:1956
-
\??\c:\xldxtd.exec:\xldxtd.exe120⤵PID:2668
-
\??\c:\lrnxvj.exec:\lrnxvj.exe121⤵PID:2344
-
\??\c:\vxhbddv.exec:\vxhbddv.exe122⤵PID:1860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-