Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 22:55
Behavioral task
behavioral1
Sample
24184fbe84a49c31bca442e24e193730_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
24184fbe84a49c31bca442e24e193730_NeikiAnalytics.exe
-
Size
441KB
-
MD5
24184fbe84a49c31bca442e24e193730
-
SHA1
d46cdeca238bebf93288f12de2c036a3ed80984d
-
SHA256
348db13714932ecffda8039d11264d7c0ac29d2c25db1500355509e55605229c
-
SHA512
209f25facff9842fa62041e98332416a43013f22c709e470b82d38b7eef1f7269a8072a05a5e93afc1f4accc4856229e7b03a0b0964b1a97edbee3ae62bee00a
-
SSDEEP
12288:w4wFHoS9KxbNnidEhjEJd1kNpeUgI95yRoZHVaoJMOxFXnRV4PiGO0hUmH0:kKxbNndhjEJd1kNpeUgI95yRoZHgoJMa
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
Processes:
resource yara_rule behavioral1/memory/2504-13-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2020-8-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2916-29-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2576-41-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2680-37-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2932-56-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2588-68-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2444-82-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1208-91-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1652-101-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/924-117-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2632-126-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1808-134-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2068-152-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2364-171-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1040-188-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2464-199-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2800-208-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1980-226-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1096-243-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/772-251-0x0000000000250000-0x0000000000284000-memory.dmp family_blackmoon behavioral1/memory/1648-262-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1564-295-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2992-326-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2920-340-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1708-347-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2468-385-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2444-398-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2284-411-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2284-412-0x0000000000260000-0x0000000000294000-memory.dmp family_blackmoon behavioral1/memory/924-431-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2628-438-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2080-528-0x00000000002A0000-0x00000000002D4000-memory.dmp family_blackmoon behavioral1/memory/2880-587-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1932-756-0x00000000002B0000-0x00000000002E4000-memory.dmp family_blackmoon behavioral1/memory/1932-757-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2000-802-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2952-810-0x00000000001B0000-0x00000000001E4000-memory.dmp family_blackmoon behavioral1/memory/2328-885-0x0000000000330000-0x0000000000364000-memory.dmp family_blackmoon behavioral1/memory/1308-917-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2504-926-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2496-1025-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/400-1115-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\rdfhrp.exe family_berbew C:\bjfnbn.exe family_berbew C:\rhvjr.exe family_berbew C:\jtxrfj.exe family_berbew C:\dljvf.exe family_berbew C:\pprllb.exe family_berbew C:\vvnvjb.exe family_berbew C:\hptbj.exe family_berbew C:\npdfn.exe family_berbew C:\xvpnhpj.exe family_berbew C:\lnvfhb.exe family_berbew C:\ftjdx.exe family_berbew C:\bdrvrrp.exe family_berbew C:\dblxjl.exe family_berbew C:\trjnjd.exe family_berbew C:\hbhbp.exe family_berbew C:\hbrtdl.exe family_berbew C:\lltddv.exe family_berbew \??\c:\jrdvnr.exe family_berbew C:\vvprjrl.exe family_berbew C:\bhxtj.exe family_berbew C:\ffrdhvj.exe family_berbew C:\pxjjb.exe family_berbew C:\hvtlf.exe family_berbew C:\vjnbv.exe family_berbew C:\jbrpn.exe family_berbew C:\ddtpnfn.exe family_berbew C:\bnvnpvb.exe family_berbew C:\xdjvl.exe family_berbew C:\xxnht.exe family_berbew C:\pdjvfj.exe family_berbew C:\dplnxn.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
rdfhrp.exebjfnbn.exerhvjr.exejtxrfj.exedljvf.exepprllb.exevvnvjb.exehptbj.exenpdfn.exexvpnhpj.exelnvfhb.exeftjdx.exebdrvrrp.exedblxjl.exetrjnjd.exehbhbp.exehbrtdl.exelltddv.exejrdvnr.exevvprjrl.exebhxtj.exeffrdhvj.exepxjjb.exehvtlf.exevjnbv.exejbrpn.exeddtpnfn.exebnvnpvb.exexdjvl.exexxnht.exepdjvfj.exedplnxn.exebtppv.exefrtpnpj.exeplvtdb.exellnrd.exehpxfh.exepdvdlv.exehlrrxdt.exenxrlvd.exenbdxvfj.exefdlvpt.exevrxfr.exebhjpnx.exejrdll.exefppllh.exetpxhffh.exexbbhbrj.exebjfrtfn.exehrbtpfd.exevjvvr.exelfrxhph.exedtfdbf.exefjrrdh.exevpttv.exenrnlrd.exejjdft.exenflrx.exetvprj.exephnnb.exephbvj.exexxlfrbj.exevtnrn.exerbprth.exepid process 2504 rdfhrp.exe 2916 bjfnbn.exe 2680 rhvjr.exe 2576 jtxrfj.exe 2932 dljvf.exe 2600 pprllb.exe 2588 vvnvjb.exe 2444 hptbj.exe 1208 npdfn.exe 1652 xvpnhpj.exe 1804 lnvfhb.exe 924 ftjdx.exe 2632 bdrvrrp.exe 1808 dblxjl.exe 1292 trjnjd.exe 2068 hbhbp.exe 2136 hbrtdl.exe 2364 lltddv.exe 2652 jrdvnr.exe 1040 vvprjrl.exe 2464 bhxtj.exe 2800 ffrdhvj.exe 324 pxjjb.exe 1980 hvtlf.exe 2232 vjnbv.exe 1096 jbrpn.exe 772 ddtpnfn.exe 2876 bnvnpvb.exe 1648 xdjvl.exe 1164 xxnht.exe 2176 pdjvfj.exe 1564 dplnxn.exe 1688 btppv.exe 2336 frtpnpj.exe 836 plvtdb.exe 2020 llnrd.exe 2992 hpxfh.exe 2916 pdvdlv.exe 2920 hlrrxdt.exe 1708 nxrlvd.exe 2776 nbdxvfj.exe 2704 fdlvpt.exe 2432 vrxfr.exe 2452 bhjpnx.exe 2592 jrdll.exe 2468 fppllh.exe 2500 tpxhffh.exe 2444 xbbhbrj.exe 588 bjfrtfn.exe 2284 hrbtpfd.exe 2188 vjvvr.exe 2492 lfrxhph.exe 924 dtfdbf.exe 2628 fjrrdh.exe 748 vpttv.exe 1932 nrnlrd.exe 2384 jjdft.exe 2068 nflrx.exe 2136 tvprj.exe 1948 phnnb.exe 1484 phbvj.exe 1572 xxlfrbj.exe 2000 vtnrn.exe 2952 rbprth.exe -
Processes:
resource yara_rule behavioral1/memory/2020-0-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rdfhrp.exe upx behavioral1/memory/2504-13-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2020-8-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\bjfnbn.exe upx behavioral1/memory/2916-20-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2916-29-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rhvjr.exe upx C:\jtxrfj.exe upx behavioral1/memory/2576-41-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2680-37-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\dljvf.exe upx behavioral1/memory/2932-48-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2932-56-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pprllb.exe upx C:\vvnvjb.exe upx behavioral1/memory/2588-68-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\hptbj.exe upx behavioral1/memory/2444-82-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\npdfn.exe upx C:\xvpnhpj.exe upx behavioral1/memory/1208-91-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\lnvfhb.exe upx behavioral1/memory/1652-101-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\ftjdx.exe upx behavioral1/memory/924-117-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\bdrvrrp.exe upx behavioral1/memory/2632-126-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\dblxjl.exe upx behavioral1/memory/1808-134-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\trjnjd.exe upx C:\hbhbp.exe upx behavioral1/memory/2068-152-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\hbrtdl.exe upx behavioral1/memory/2136-154-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\lltddv.exe upx behavioral1/memory/2364-163-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2364-171-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\jrdvnr.exe upx C:\vvprjrl.exe upx behavioral1/memory/1040-188-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\bhxtj.exe upx C:\ffrdhvj.exe upx behavioral1/memory/2464-199-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2800-208-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pxjjb.exe upx C:\hvtlf.exe upx C:\vjnbv.exe upx behavioral1/memory/1980-226-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jbrpn.exe upx C:\ddtpnfn.exe upx behavioral1/memory/1096-243-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\bnvnpvb.exe upx C:\xdjvl.exe upx behavioral1/memory/1648-262-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xxnht.exe upx C:\pdjvfj.exe upx C:\dplnxn.exe upx behavioral1/memory/1564-294-0x0000000000220000-0x0000000000254000-memory.dmp upx behavioral1/memory/1564-295-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2992-326-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2916-327-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2920-340-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1708-347-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
24184fbe84a49c31bca442e24e193730_NeikiAnalytics.exerdfhrp.exebjfnbn.exerhvjr.exejtxrfj.exedljvf.exepprllb.exevvnvjb.exehptbj.exenpdfn.exexvpnhpj.exelnvfhb.exeftjdx.exebdrvrrp.exedblxjl.exetrjnjd.exedescription pid process target process PID 2020 wrote to memory of 2504 2020 24184fbe84a49c31bca442e24e193730_NeikiAnalytics.exe rdfhrp.exe PID 2020 wrote to memory of 2504 2020 24184fbe84a49c31bca442e24e193730_NeikiAnalytics.exe rdfhrp.exe PID 2020 wrote to memory of 2504 2020 24184fbe84a49c31bca442e24e193730_NeikiAnalytics.exe rdfhrp.exe PID 2020 wrote to memory of 2504 2020 24184fbe84a49c31bca442e24e193730_NeikiAnalytics.exe rdfhrp.exe PID 2504 wrote to memory of 2916 2504 rdfhrp.exe bjfnbn.exe PID 2504 wrote to memory of 2916 2504 rdfhrp.exe bjfnbn.exe PID 2504 wrote to memory of 2916 2504 rdfhrp.exe bjfnbn.exe PID 2504 wrote to memory of 2916 2504 rdfhrp.exe bjfnbn.exe PID 2916 wrote to memory of 2680 2916 bjfnbn.exe rhvjr.exe PID 2916 wrote to memory of 2680 2916 bjfnbn.exe rhvjr.exe PID 2916 wrote to memory of 2680 2916 bjfnbn.exe rhvjr.exe PID 2916 wrote to memory of 2680 2916 bjfnbn.exe rhvjr.exe PID 2680 wrote to memory of 2576 2680 rhvjr.exe jtxrfj.exe PID 2680 wrote to memory of 2576 2680 rhvjr.exe jtxrfj.exe PID 2680 wrote to memory of 2576 2680 rhvjr.exe jtxrfj.exe PID 2680 wrote to memory of 2576 2680 rhvjr.exe jtxrfj.exe PID 2576 wrote to memory of 2932 2576 jtxrfj.exe dljvf.exe PID 2576 wrote to memory of 2932 2576 jtxrfj.exe dljvf.exe PID 2576 wrote to memory of 2932 2576 jtxrfj.exe dljvf.exe PID 2576 wrote to memory of 2932 2576 jtxrfj.exe dljvf.exe PID 2932 wrote to memory of 2600 2932 dljvf.exe pprllb.exe PID 2932 wrote to memory of 2600 2932 dljvf.exe pprllb.exe PID 2932 wrote to memory of 2600 2932 dljvf.exe pprllb.exe PID 2932 wrote to memory of 2600 2932 dljvf.exe pprllb.exe PID 2600 wrote to memory of 2588 2600 pprllb.exe vvnvjb.exe PID 2600 wrote to memory of 2588 2600 pprllb.exe vvnvjb.exe PID 2600 wrote to memory of 2588 2600 pprllb.exe vvnvjb.exe PID 2600 wrote to memory of 2588 2600 pprllb.exe vvnvjb.exe PID 2588 wrote to memory of 2444 2588 vvnvjb.exe hptbj.exe PID 2588 wrote to memory of 2444 2588 vvnvjb.exe hptbj.exe PID 2588 wrote to memory of 2444 2588 vvnvjb.exe hptbj.exe PID 2588 wrote to memory of 2444 2588 vvnvjb.exe hptbj.exe PID 2444 wrote to memory of 1208 2444 hptbj.exe npdfn.exe PID 2444 wrote to memory of 1208 2444 hptbj.exe npdfn.exe PID 2444 wrote to memory of 1208 2444 hptbj.exe npdfn.exe PID 2444 wrote to memory of 1208 2444 hptbj.exe npdfn.exe PID 1208 wrote to memory of 1652 1208 npdfn.exe xvpnhpj.exe PID 1208 wrote to memory of 1652 1208 npdfn.exe xvpnhpj.exe PID 1208 wrote to memory of 1652 1208 npdfn.exe xvpnhpj.exe PID 1208 wrote to memory of 1652 1208 npdfn.exe xvpnhpj.exe PID 1652 wrote to memory of 1804 1652 xvpnhpj.exe lnvfhb.exe PID 1652 wrote to memory of 1804 1652 xvpnhpj.exe lnvfhb.exe PID 1652 wrote to memory of 1804 1652 xvpnhpj.exe lnvfhb.exe PID 1652 wrote to memory of 1804 1652 xvpnhpj.exe lnvfhb.exe PID 1804 wrote to memory of 924 1804 lnvfhb.exe ftjdx.exe PID 1804 wrote to memory of 924 1804 lnvfhb.exe ftjdx.exe PID 1804 wrote to memory of 924 1804 lnvfhb.exe ftjdx.exe PID 1804 wrote to memory of 924 1804 lnvfhb.exe ftjdx.exe PID 924 wrote to memory of 2632 924 ftjdx.exe bdrvrrp.exe PID 924 wrote to memory of 2632 924 ftjdx.exe bdrvrrp.exe PID 924 wrote to memory of 2632 924 ftjdx.exe bdrvrrp.exe PID 924 wrote to memory of 2632 924 ftjdx.exe bdrvrrp.exe PID 2632 wrote to memory of 1808 2632 bdrvrrp.exe dblxjl.exe PID 2632 wrote to memory of 1808 2632 bdrvrrp.exe dblxjl.exe PID 2632 wrote to memory of 1808 2632 bdrvrrp.exe dblxjl.exe PID 2632 wrote to memory of 1808 2632 bdrvrrp.exe dblxjl.exe PID 1808 wrote to memory of 1292 1808 dblxjl.exe trjnjd.exe PID 1808 wrote to memory of 1292 1808 dblxjl.exe trjnjd.exe PID 1808 wrote to memory of 1292 1808 dblxjl.exe trjnjd.exe PID 1808 wrote to memory of 1292 1808 dblxjl.exe trjnjd.exe PID 1292 wrote to memory of 2068 1292 trjnjd.exe hbhbp.exe PID 1292 wrote to memory of 2068 1292 trjnjd.exe hbhbp.exe PID 1292 wrote to memory of 2068 1292 trjnjd.exe hbhbp.exe PID 1292 wrote to memory of 2068 1292 trjnjd.exe hbhbp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24184fbe84a49c31bca442e24e193730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\24184fbe84a49c31bca442e24e193730_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\rdfhrp.exec:\rdfhrp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\bjfnbn.exec:\bjfnbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\rhvjr.exec:\rhvjr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\jtxrfj.exec:\jtxrfj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\dljvf.exec:\dljvf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\pprllb.exec:\pprllb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\vvnvjb.exec:\vvnvjb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\hptbj.exec:\hptbj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\npdfn.exec:\npdfn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\xvpnhpj.exec:\xvpnhpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\lnvfhb.exec:\lnvfhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\ftjdx.exec:\ftjdx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\bdrvrrp.exec:\bdrvrrp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\dblxjl.exec:\dblxjl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\trjnjd.exec:\trjnjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\hbhbp.exec:\hbhbp.exe17⤵
- Executes dropped EXE
PID:2068 -
\??\c:\hbrtdl.exec:\hbrtdl.exe18⤵
- Executes dropped EXE
PID:2136 -
\??\c:\lltddv.exec:\lltddv.exe19⤵
- Executes dropped EXE
PID:2364 -
\??\c:\jrdvnr.exec:\jrdvnr.exe20⤵
- Executes dropped EXE
PID:2652 -
\??\c:\vvprjrl.exec:\vvprjrl.exe21⤵
- Executes dropped EXE
PID:1040 -
\??\c:\bhxtj.exec:\bhxtj.exe22⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ffrdhvj.exec:\ffrdhvj.exe23⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pxjjb.exec:\pxjjb.exe24⤵
- Executes dropped EXE
PID:324 -
\??\c:\hvtlf.exec:\hvtlf.exe25⤵
- Executes dropped EXE
PID:1980 -
\??\c:\vjnbv.exec:\vjnbv.exe26⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jbrpn.exec:\jbrpn.exe27⤵
- Executes dropped EXE
PID:1096 -
\??\c:\ddtpnfn.exec:\ddtpnfn.exe28⤵
- Executes dropped EXE
PID:772 -
\??\c:\bnvnpvb.exec:\bnvnpvb.exe29⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xdjvl.exec:\xdjvl.exe30⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xxnht.exec:\xxnht.exe31⤵
- Executes dropped EXE
PID:1164 -
\??\c:\pdjvfj.exec:\pdjvfj.exe32⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dplnxn.exec:\dplnxn.exe33⤵
- Executes dropped EXE
PID:1564 -
\??\c:\btppv.exec:\btppv.exe34⤵
- Executes dropped EXE
PID:1688 -
\??\c:\frtpnpj.exec:\frtpnpj.exe35⤵
- Executes dropped EXE
PID:2336 -
\??\c:\plvtdb.exec:\plvtdb.exe36⤵
- Executes dropped EXE
PID:836 -
\??\c:\llnrd.exec:\llnrd.exe37⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hpxfh.exec:\hpxfh.exe38⤵
- Executes dropped EXE
PID:2992 -
\??\c:\pdvdlv.exec:\pdvdlv.exe39⤵
- Executes dropped EXE
PID:2916 -
\??\c:\hlrrxdt.exec:\hlrrxdt.exe40⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nxrlvd.exec:\nxrlvd.exe41⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nbdxvfj.exec:\nbdxvfj.exe42⤵
- Executes dropped EXE
PID:2776 -
\??\c:\fdlvpt.exec:\fdlvpt.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\vrxfr.exec:\vrxfr.exe44⤵
- Executes dropped EXE
PID:2432 -
\??\c:\bhjpnx.exec:\bhjpnx.exe45⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jrdll.exec:\jrdll.exe46⤵
- Executes dropped EXE
PID:2592 -
\??\c:\fppllh.exec:\fppllh.exe47⤵
- Executes dropped EXE
PID:2468 -
\??\c:\tpxhffh.exec:\tpxhffh.exe48⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xbbhbrj.exec:\xbbhbrj.exe49⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bjfrtfn.exec:\bjfrtfn.exe50⤵
- Executes dropped EXE
PID:588 -
\??\c:\hrbtpfd.exec:\hrbtpfd.exe51⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vjvvr.exec:\vjvvr.exe52⤵
- Executes dropped EXE
PID:2188 -
\??\c:\lfrxhph.exec:\lfrxhph.exe53⤵
- Executes dropped EXE
PID:2492 -
\??\c:\dtfdbf.exec:\dtfdbf.exe54⤵
- Executes dropped EXE
PID:924 -
\??\c:\fjrrdh.exec:\fjrrdh.exe55⤵
- Executes dropped EXE
PID:2628 -
\??\c:\vpttv.exec:\vpttv.exe56⤵
- Executes dropped EXE
PID:748 -
\??\c:\nrnlrd.exec:\nrnlrd.exe57⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jjdft.exec:\jjdft.exe58⤵
- Executes dropped EXE
PID:2384 -
\??\c:\nflrx.exec:\nflrx.exe59⤵
- Executes dropped EXE
PID:2068 -
\??\c:\tvprj.exec:\tvprj.exe60⤵
- Executes dropped EXE
PID:2136 -
\??\c:\phnnb.exec:\phnnb.exe61⤵
- Executes dropped EXE
PID:1948 -
\??\c:\phbvj.exec:\phbvj.exe62⤵
- Executes dropped EXE
PID:1484 -
\??\c:\xxlfrbj.exec:\xxlfrbj.exe63⤵
- Executes dropped EXE
PID:1572 -
\??\c:\vtnrn.exec:\vtnrn.exe64⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rbprth.exec:\rbprth.exe65⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xjvpt.exec:\xjvpt.exe66⤵PID:780
-
\??\c:\pvhfhp.exec:\pvhfhp.exe67⤵PID:2800
-
\??\c:\rhvllr.exec:\rhvllr.exe68⤵PID:324
-
\??\c:\xnnvfd.exec:\xnnvfd.exe69⤵PID:2080
-
\??\c:\hhnjvnb.exec:\hhnjvnb.exe70⤵PID:1156
-
\??\c:\flvjrx.exec:\flvjrx.exe71⤵PID:944
-
\??\c:\fbfxx.exec:\fbfxx.exe72⤵PID:1096
-
\??\c:\pdhfpn.exec:\pdhfpn.exe73⤵PID:1720
-
\??\c:\ndbjxn.exec:\ndbjxn.exe74⤵PID:1916
-
\??\c:\hfhfp.exec:\hfhfp.exe75⤵PID:2984
-
\??\c:\hpjhxr.exec:\hpjhxr.exe76⤵PID:2784
-
\??\c:\fhtlxrj.exec:\fhtlxrj.exe77⤵PID:2840
-
\??\c:\nnflx.exec:\nnflx.exe78⤵PID:2108
-
\??\c:\bhfvdth.exec:\bhfvdth.exe79⤵PID:2880
-
\??\c:\drllfxt.exec:\drllfxt.exe80⤵PID:2768
-
\??\c:\bhtnttl.exec:\bhtnttl.exe81⤵PID:2256
-
\??\c:\bprltvb.exec:\bprltvb.exe82⤵PID:876
-
\??\c:\vrhvxv.exec:\vrhvxv.exe83⤵PID:1288
-
\??\c:\njlnfh.exec:\njlnfh.exe84⤵PID:2504
-
\??\c:\lrrvxn.exec:\lrrvxn.exe85⤵PID:2972
-
\??\c:\phrxvn.exec:\phrxvn.exe86⤵PID:2696
-
\??\c:\tfphv.exec:\tfphv.exe87⤵PID:1576
-
\??\c:\lfpjt.exec:\lfpjt.exe88⤵PID:2556
-
\??\c:\rxhrbjx.exec:\rxhrbjx.exe89⤵PID:2724
-
\??\c:\rhffhbh.exec:\rhffhbh.exe90⤵PID:2720
-
\??\c:\blrjn.exec:\blrjn.exe91⤵PID:2540
-
\??\c:\bjnpbfh.exec:\bjnpbfh.exe92⤵PID:2692
-
\??\c:\thxbh.exec:\thxbh.exe93⤵PID:2480
-
\??\c:\pdvxdt.exec:\pdvxdt.exe94⤵PID:2588
-
\??\c:\bthxpl.exec:\bthxpl.exe95⤵PID:2544
-
\??\c:\vjtjjnx.exec:\vjtjjnx.exe96⤵PID:2404
-
\??\c:\ndjvh.exec:\ndjvh.exe97⤵PID:2352
-
\??\c:\bjvjnhr.exec:\bjvjnhr.exe98⤵PID:1652
-
\??\c:\xxbxjpd.exec:\xxbxjpd.exe99⤵PID:1860
-
\??\c:\ddltp.exec:\ddltp.exe100⤵PID:280
-
\??\c:\hlvjnjv.exec:\hlvjnjv.exe101⤵PID:1276
-
\??\c:\hhppjdj.exec:\hhppjdj.exe102⤵PID:2632
-
\??\c:\dfblf.exec:\dfblf.exe103⤵PID:644
-
\??\c:\vjtpvvb.exec:\vjtpvvb.exe104⤵PID:748
-
\??\c:\jjpnnlv.exec:\jjpnnlv.exe105⤵PID:1932
-
\??\c:\ltrdx.exec:\ltrdx.exe106⤵PID:1848
-
\??\c:\tdvbdl.exec:\tdvbdl.exe107⤵PID:2008
-
\??\c:\lvpdjb.exec:\lvpdjb.exe108⤵PID:1624
-
\??\c:\bnntjrr.exec:\bnntjrr.exe109⤵PID:2212
-
\??\c:\jxnxv.exec:\jxnxv.exe110⤵PID:1484
-
\??\c:\hhxbn.exec:\hhxbn.exe111⤵PID:3052
-
\??\c:\bbrfxfx.exec:\bbrfxfx.exe112⤵PID:2000
-
\??\c:\jnfhbv.exec:\jnfhbv.exe113⤵PID:2952
-
\??\c:\nnxxf.exec:\nnxxf.exe114⤵PID:2980
-
\??\c:\fnvfjfv.exec:\fnvfjfv.exe115⤵PID:2320
-
\??\c:\xldbb.exec:\xldbb.exe116⤵PID:1988
-
\??\c:\fbrnpf.exec:\fbrnpf.exe117⤵PID:2232
-
\??\c:\jvxdhdf.exec:\jvxdhdf.exe118⤵PID:1864
-
\??\c:\tfrnf.exec:\tfrnf.exe119⤵PID:1348
-
\??\c:\tlnjdrn.exec:\tlnjdrn.exe120⤵PID:1324
-
\??\c:\vfvjrj.exec:\vfvjrj.exe121⤵PID:1776
-
\??\c:\lxfdt.exec:\lxfdt.exe122⤵PID:2876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-