Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 01:33
Behavioral task
behavioral1
Sample
1d0953d05efec3e53c3fb8ffbd3a8cd0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
1d0953d05efec3e53c3fb8ffbd3a8cd0_NeikiAnalytics.exe
-
Size
81KB
-
MD5
1d0953d05efec3e53c3fb8ffbd3a8cd0
-
SHA1
5dcaed28bf86dbe8a84341e4409e4b1e921a1168
-
SHA256
314b32a30e4c2f5619c10e323343c6cd1d30042a7a5480f7c74e3cbf5f49c221
-
SHA512
b63c8537f82245e71aae1612043b7832e966d0412600c17509782ece9cc32754ed1f0088d3666d7a936f41896b34a9cd5b0c14c4a8186070465a63d90d7e00a9
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6T7QV:zhOmTsF93UYfwC6GIoutiTU2HVS63QV
Malware Config
Signatures
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2724-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/940-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-71-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2228-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1876-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1028-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1680-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1680-150-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2252-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1304-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/964-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-339-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1152-346-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2304-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1784-420-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1020-464-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2844-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-584-0x0000000077710000-0x000000007782F000-memory.dmp family_blackmoon behavioral1/memory/2500-611-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2868-669-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/580-681-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1116-993-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1300-1004-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2780-1155-0x0000000077710000-0x000000007782F000-memory.dmp family_blackmoon behavioral1/memory/2780-10904-0x0000000077710000-0x000000007782F000-memory.dmp family_blackmoon behavioral1/memory/2780-11482-0x0000000077610000-0x000000007770A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2272 jrppbvl.exe 940 pfbrftd.exe 2500 ldnxx.exe 2640 fdbld.exe 2560 bjljlbt.exe 2944 ptlnp.exe 2444 dbnrb.exe 2228 vxxxp.exe 2408 xvfbjj.exe 2904 lxbpft.exe 2388 fbtxnv.exe 1876 vrjjbf.exe 1028 btrnvt.exe 2632 jldrdbt.exe 1932 jbddv.exe 1332 rlblrt.exe 1680 rbdtjv.exe 1308 rxlvb.exe 2252 jjtpltx.exe 1304 hdldtjx.exe 2620 dfhntxb.exe 2084 ljxbpb.exe 2076 jpvpt.exe 1704 xvfjbr.exe 2808 ndtdbff.exe 2060 ljrrb.exe 3064 njjndb.exe 1328 pdxll.exe 240 hffxtnl.exe 964 fnpppvh.exe 2016 xdnphb.exe 1640 ddxbx.exe 1516 jhrdrf.exe 2892 hbvnhl.exe 2492 rrlvlfr.exe 2824 xtdxp.exe 1632 fbtjrdf.exe 1488 vnfpvv.exe 2092 xrtbld.exe 1624 hnrhrn.exe 2984 jbpnj.exe 2980 tfldrnl.exe 940 fvpvxn.exe 2692 njtjrnj.exe 1696 fhlvptf.exe 1152 nlttbj.exe 2800 pnxrhp.exe 2720 lbnxp.exe 2704 lhjhtp.exe 2684 txxrdj.exe 2576 vnxxv.exe 2228 ptplb.exe 2460 bnbbd.exe 2484 hxxrhj.exe 1480 xlnnd.exe 2304 pvpvtx.exe 800 dlrffr.exe 2396 xjbpp.exe 2616 xhlbf.exe 1784 thfvd.exe 1980 tltnbxd.exe 1500 pbfhxx.exe 1728 prbtdt.exe 2352 hhjlbpt.exe -
resource yara_rule behavioral1/memory/2724-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2724-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015c23-5.dat upx behavioral1/files/0x0027000000015c69-16.dat upx behavioral1/memory/940-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2272-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000f000000015c7c-25.dat upx behavioral1/memory/940-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015db4-32.dat upx behavioral1/memory/2640-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2560-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015e02-40.dat upx behavioral1/memory/2500-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015e5b-48.dat upx behavioral1/memory/2560-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2944-57-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2944-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016b5e-58.dat upx behavioral1/files/0x0006000000018ae8-65.dat upx behavioral1/memory/2444-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2228-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b15-75.dat upx behavioral1/memory/2408-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b33-87.dat upx behavioral1/memory/2408-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b42-94.dat upx behavioral1/memory/2388-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b4a-102.dat upx behavioral1/memory/1876-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000f000000015c87-110.dat upx behavioral1/files/0x0006000000018b6a-119.dat upx behavioral1/memory/1028-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b73-127.dat upx behavioral1/memory/2632-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1932-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b96-134.dat upx behavioral1/files/0x0006000000018ba2-142.dat upx behavioral1/memory/1680-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018d06-152.dat upx behavioral1/files/0x00050000000192c9-158.dat upx behavioral1/memory/2252-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2252-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000192f4-166.dat upx behavioral1/memory/1304-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001931b-175.dat upx behavioral1/files/0x0005000000019333-183.dat upx behavioral1/memory/2620-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2084-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019368-191.dat upx behavioral1/files/0x0005000000019377-198.dat upx behavioral1/files/0x000500000001939b-207.dat upx behavioral1/memory/1704-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b0-214.dat upx behavioral1/memory/2060-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019410-222.dat upx behavioral1/memory/3064-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001946b-230.dat upx behavioral1/files/0x000500000001946f-237.dat upx behavioral1/files/0x0005000000019473-244.dat upx behavioral1/memory/964-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019485-252.dat upx behavioral1/files/0x00050000000194a4-260.dat upx behavioral1/memory/2016-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1640-267-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2724 wrote to memory of 2272 2724 1d0953d05efec3e53c3fb8ffbd3a8cd0_NeikiAnalytics.exe 28 PID 2724 wrote to memory of 2272 2724 1d0953d05efec3e53c3fb8ffbd3a8cd0_NeikiAnalytics.exe 28 PID 2724 wrote to memory of 2272 2724 1d0953d05efec3e53c3fb8ffbd3a8cd0_NeikiAnalytics.exe 28 PID 2724 wrote to memory of 2272 2724 1d0953d05efec3e53c3fb8ffbd3a8cd0_NeikiAnalytics.exe 28 PID 2272 wrote to memory of 940 2272 jrppbvl.exe 29 PID 2272 wrote to memory of 940 2272 jrppbvl.exe 29 PID 2272 wrote to memory of 940 2272 jrppbvl.exe 29 PID 2272 wrote to memory of 940 2272 jrppbvl.exe 29 PID 940 wrote to memory of 2500 940 pfbrftd.exe 30 PID 940 wrote to memory of 2500 940 pfbrftd.exe 30 PID 940 wrote to memory of 2500 940 pfbrftd.exe 30 PID 940 wrote to memory of 2500 940 pfbrftd.exe 30 PID 2500 wrote to memory of 2640 2500 ldnxx.exe 31 PID 2500 wrote to memory of 2640 2500 ldnxx.exe 31 PID 2500 wrote to memory of 2640 2500 ldnxx.exe 31 PID 2500 wrote to memory of 2640 2500 ldnxx.exe 31 PID 2640 wrote to memory of 2560 2640 fdbld.exe 32 PID 2640 wrote to memory of 2560 2640 fdbld.exe 32 PID 2640 wrote to memory of 2560 2640 fdbld.exe 32 PID 2640 wrote to memory of 2560 2640 fdbld.exe 32 PID 2560 wrote to memory of 2944 2560 bjljlbt.exe 33 PID 2560 wrote to memory of 2944 2560 bjljlbt.exe 33 PID 2560 wrote to memory of 2944 2560 bjljlbt.exe 33 PID 2560 wrote to memory of 2944 2560 bjljlbt.exe 33 PID 2944 wrote to memory of 2444 2944 ptlnp.exe 34 PID 2944 wrote to memory of 2444 2944 ptlnp.exe 34 PID 2944 wrote to memory of 2444 2944 ptlnp.exe 34 PID 2944 wrote to memory of 2444 2944 ptlnp.exe 34 PID 2444 wrote to memory of 2228 2444 dbnrb.exe 35 PID 2444 wrote to memory of 2228 2444 dbnrb.exe 35 PID 2444 wrote to memory of 2228 2444 dbnrb.exe 35 PID 2444 wrote to memory of 2228 2444 dbnrb.exe 35 PID 2228 wrote to memory of 2408 2228 vxxxp.exe 36 PID 2228 wrote to memory of 2408 2228 vxxxp.exe 36 PID 2228 wrote to memory of 2408 2228 vxxxp.exe 36 PID 2228 wrote to memory of 2408 2228 vxxxp.exe 36 PID 2408 wrote to memory of 2904 2408 xvfbjj.exe 37 PID 2408 wrote to memory of 2904 2408 xvfbjj.exe 37 PID 2408 wrote to memory of 2904 2408 xvfbjj.exe 37 PID 2408 wrote to memory of 2904 2408 xvfbjj.exe 37 PID 2904 wrote to memory of 2388 2904 lxbpft.exe 38 PID 2904 wrote to memory of 2388 2904 lxbpft.exe 38 PID 2904 wrote to memory of 2388 2904 lxbpft.exe 38 PID 2904 wrote to memory of 2388 2904 lxbpft.exe 38 PID 2388 wrote to memory of 1876 2388 fbtxnv.exe 39 PID 2388 wrote to memory of 1876 2388 fbtxnv.exe 39 PID 2388 wrote to memory of 1876 2388 fbtxnv.exe 39 PID 2388 wrote to memory of 1876 2388 fbtxnv.exe 39 PID 1876 wrote to memory of 1028 1876 vrjjbf.exe 40 PID 1876 wrote to memory of 1028 1876 vrjjbf.exe 40 PID 1876 wrote to memory of 1028 1876 vrjjbf.exe 40 PID 1876 wrote to memory of 1028 1876 vrjjbf.exe 40 PID 1028 wrote to memory of 2632 1028 btrnvt.exe 41 PID 1028 wrote to memory of 2632 1028 btrnvt.exe 41 PID 1028 wrote to memory of 2632 1028 btrnvt.exe 41 PID 1028 wrote to memory of 2632 1028 btrnvt.exe 41 PID 2632 wrote to memory of 1932 2632 jldrdbt.exe 42 PID 2632 wrote to memory of 1932 2632 jldrdbt.exe 42 PID 2632 wrote to memory of 1932 2632 jldrdbt.exe 42 PID 2632 wrote to memory of 1932 2632 jldrdbt.exe 42 PID 1932 wrote to memory of 1332 1932 jbddv.exe 43 PID 1932 wrote to memory of 1332 1932 jbddv.exe 43 PID 1932 wrote to memory of 1332 1932 jbddv.exe 43 PID 1932 wrote to memory of 1332 1932 jbddv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d0953d05efec3e53c3fb8ffbd3a8cd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1d0953d05efec3e53c3fb8ffbd3a8cd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\jrppbvl.exec:\jrppbvl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\pfbrftd.exec:\pfbrftd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\ldnxx.exec:\ldnxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\fdbld.exec:\fdbld.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\bjljlbt.exec:\bjljlbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\ptlnp.exec:\ptlnp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\dbnrb.exec:\dbnrb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\vxxxp.exec:\vxxxp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\xvfbjj.exec:\xvfbjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\lxbpft.exec:\lxbpft.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\fbtxnv.exec:\fbtxnv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\vrjjbf.exec:\vrjjbf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\btrnvt.exec:\btrnvt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\jldrdbt.exec:\jldrdbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\jbddv.exec:\jbddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\rlblrt.exec:\rlblrt.exe17⤵
- Executes dropped EXE
PID:1332 -
\??\c:\rbdtjv.exec:\rbdtjv.exe18⤵
- Executes dropped EXE
PID:1680 -
\??\c:\rxlvb.exec:\rxlvb.exe19⤵
- Executes dropped EXE
PID:1308 -
\??\c:\jjtpltx.exec:\jjtpltx.exe20⤵
- Executes dropped EXE
PID:2252 -
\??\c:\hdldtjx.exec:\hdldtjx.exe21⤵
- Executes dropped EXE
PID:1304 -
\??\c:\dfhntxb.exec:\dfhntxb.exe22⤵
- Executes dropped EXE
PID:2620 -
\??\c:\ljxbpb.exec:\ljxbpb.exe23⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jpvpt.exec:\jpvpt.exe24⤵
- Executes dropped EXE
PID:2076 -
\??\c:\xvfjbr.exec:\xvfjbr.exe25⤵
- Executes dropped EXE
PID:1704 -
\??\c:\ndtdbff.exec:\ndtdbff.exe26⤵
- Executes dropped EXE
PID:2808 -
\??\c:\ljrrb.exec:\ljrrb.exe27⤵
- Executes dropped EXE
PID:2060 -
\??\c:\njjndb.exec:\njjndb.exe28⤵
- Executes dropped EXE
PID:3064 -
\??\c:\pdxll.exec:\pdxll.exe29⤵
- Executes dropped EXE
PID:1328 -
\??\c:\hffxtnl.exec:\hffxtnl.exe30⤵
- Executes dropped EXE
PID:240 -
\??\c:\fnpppvh.exec:\fnpppvh.exe31⤵
- Executes dropped EXE
PID:964 -
\??\c:\xdnphb.exec:\xdnphb.exe32⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ddxbx.exec:\ddxbx.exe33⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jhrdrf.exec:\jhrdrf.exe34⤵
- Executes dropped EXE
PID:1516 -
\??\c:\hbvnhl.exec:\hbvnhl.exe35⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rrlvlfr.exec:\rrlvlfr.exe36⤵
- Executes dropped EXE
PID:2492 -
\??\c:\xtdxp.exec:\xtdxp.exe37⤵
- Executes dropped EXE
PID:2824 -
\??\c:\fbtjrdf.exec:\fbtjrdf.exe38⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vnfpvv.exec:\vnfpvv.exe39⤵
- Executes dropped EXE
PID:1488 -
\??\c:\xrtbld.exec:\xrtbld.exe40⤵
- Executes dropped EXE
PID:2092 -
\??\c:\hnrhrn.exec:\hnrhrn.exe41⤵
- Executes dropped EXE
PID:1624 -
\??\c:\jbpnj.exec:\jbpnj.exe42⤵
- Executes dropped EXE
PID:2984 -
\??\c:\tfldrnl.exec:\tfldrnl.exe43⤵
- Executes dropped EXE
PID:2980 -
\??\c:\fvpvxn.exec:\fvpvxn.exe44⤵
- Executes dropped EXE
PID:940 -
\??\c:\njtjrnj.exec:\njtjrnj.exe45⤵
- Executes dropped EXE
PID:2692 -
\??\c:\fhlvptf.exec:\fhlvptf.exe46⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nlttbj.exec:\nlttbj.exe47⤵
- Executes dropped EXE
PID:1152 -
\??\c:\pnxrhp.exec:\pnxrhp.exe48⤵
- Executes dropped EXE
PID:2800 -
\??\c:\lbnxp.exec:\lbnxp.exe49⤵
- Executes dropped EXE
PID:2720 -
\??\c:\lhjhtp.exec:\lhjhtp.exe50⤵
- Executes dropped EXE
PID:2704 -
\??\c:\txxrdj.exec:\txxrdj.exe51⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vnxxv.exec:\vnxxv.exe52⤵
- Executes dropped EXE
PID:2576 -
\??\c:\ptplb.exec:\ptplb.exe53⤵
- Executes dropped EXE
PID:2228 -
\??\c:\bnbbd.exec:\bnbbd.exe54⤵
- Executes dropped EXE
PID:2460 -
\??\c:\hxxrhj.exec:\hxxrhj.exe55⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xlnnd.exec:\xlnnd.exe56⤵
- Executes dropped EXE
PID:1480 -
\??\c:\pvpvtx.exec:\pvpvtx.exe57⤵
- Executes dropped EXE
PID:2304 -
\??\c:\dlrffr.exec:\dlrffr.exe58⤵
- Executes dropped EXE
PID:800 -
\??\c:\xjbpp.exec:\xjbpp.exe59⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xhlbf.exec:\xhlbf.exe60⤵
- Executes dropped EXE
PID:2616 -
\??\c:\thfvd.exec:\thfvd.exe61⤵
- Executes dropped EXE
PID:1784 -
\??\c:\tltnbxd.exec:\tltnbxd.exe62⤵
- Executes dropped EXE
PID:1980 -
\??\c:\pbfhxx.exec:\pbfhxx.exe63⤵
- Executes dropped EXE
PID:1500 -
\??\c:\prbtdt.exec:\prbtdt.exe64⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hhjlbpt.exec:\hhjlbpt.exe65⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hvbrpxv.exec:\hvbrpxv.exe66⤵PID:604
-
\??\c:\tnfxvrl.exec:\tnfxvrl.exe67⤵PID:1768
-
\??\c:\vhttvbb.exec:\vhttvbb.exe68⤵PID:1276
-
\??\c:\vppjrtj.exec:\vppjrtj.exe69⤵PID:1020
-
\??\c:\txvftrj.exec:\txvftrj.exe70⤵PID:2844
-
\??\c:\lvltn.exec:\lvltn.exe71⤵PID:2620
-
\??\c:\trvnl.exec:\trvnl.exe72⤵PID:676
-
\??\c:\fvxdlrb.exec:\fvxdlrb.exe73⤵PID:2324
-
\??\c:\xlvjrfr.exec:\xlvjrfr.exe74⤵PID:2796
-
\??\c:\lrndr.exec:\lrndr.exe75⤵PID:2244
-
\??\c:\dbtrtf.exec:\dbtrtf.exe76⤵PID:1132
-
\??\c:\hvtxh.exec:\hvtxh.exe77⤵PID:2132
-
\??\c:\jtxxbb.exec:\jtxxbb.exe78⤵PID:3036
-
\??\c:\pdnhn.exec:\pdnhn.exe79⤵PID:3064
-
\??\c:\fpjvbd.exec:\fpjvbd.exe80⤵PID:1656
-
\??\c:\fjlpd.exec:\fjlpd.exe81⤵PID:1128
-
\??\c:\pbnrf.exec:\pbnrf.exe82⤵PID:240
-
\??\c:\nbdlnl.exec:\nbdlnl.exe83⤵PID:2040
-
\??\c:\ttpnv.exec:\ttpnv.exe84⤵PID:2016
-
\??\c:\blxxr.exec:\blxxr.exe85⤵PID:1720
-
\??\c:\brptv.exec:\brptv.exe86⤵PID:2164
-
\??\c:\vftrrb.exec:\vftrrb.exe87⤵PID:2264
-
\??\c:\tprfnj.exec:\tprfnj.exe88⤵PID:1012
-
\??\c:\bbfvr.exec:\bbfvr.exe89⤵PID:2260
-
\??\c:\bbxdth.exec:\bbxdth.exe90⤵PID:2848
-
\??\c:\hpftrjv.exec:\hpftrjv.exe91⤵PID:1224
-
\??\c:\hjltfdj.exec:\hjltfdj.exe92⤵PID:2780
-
\??\c:\trtxt.exec:\trtxt.exe93⤵PID:2272
-
\??\c:\phbrv.exec:\phbrv.exe94⤵PID:1624
-
\??\c:\bvvdhh.exec:\bvvdhh.exe95⤵PID:2984
-
\??\c:\ttlntbj.exec:\ttlntbj.exe96⤵PID:2980
-
\??\c:\bldxd.exec:\bldxd.exe97⤵PID:2500
-
\??\c:\ltddjx.exec:\ltddjx.exe98⤵PID:1596
-
\??\c:\frpjtpf.exec:\frpjtpf.exe99⤵PID:2716
-
\??\c:\xjrpj.exec:\xjrpj.exe100⤵PID:2548
-
\??\c:\htfnnj.exec:\htfnnj.exe101⤵PID:2536
-
\??\c:\nnrllr.exec:\nnrllr.exe102⤵PID:2568
-
\??\c:\fnjtj.exec:\fnjtj.exe103⤵PID:2944
-
\??\c:\hrttrxj.exec:\hrttrxj.exe104⤵PID:2600
-
\??\c:\vbttx.exec:\vbttx.exe105⤵PID:2444
-
\??\c:\hhnnr.exec:\hhnnr.exe106⤵PID:2348
-
\??\c:\pdjlhb.exec:\pdjlhb.exe107⤵PID:2528
-
\??\c:\fpjfvr.exec:\fpjfvr.exe108⤵PID:2868
-
\??\c:\hrjxvn.exec:\hrjxvn.exe109⤵PID:2012
-
\??\c:\hxlrnph.exec:\hxlrnph.exe110⤵PID:580
-
\??\c:\rprnnrl.exec:\rprnnrl.exe111⤵PID:1848
-
\??\c:\lrvhnl.exec:\lrvhnl.exe112⤵PID:2004
-
\??\c:\ljrpvxh.exec:\ljrpvxh.exe113⤵PID:2660
-
\??\c:\vxnxnl.exec:\vxnxnl.exe114⤵PID:2396
-
\??\c:\xjrjtbb.exec:\xjrjtbb.exe115⤵PID:2736
-
\??\c:\xnbxr.exec:\xnbxr.exe116⤵PID:1928
-
\??\c:\xtjphvd.exec:\xtjphvd.exe117⤵PID:1980
-
\??\c:\lnrdpjr.exec:\lnrdpjr.exe118⤵PID:2316
-
\??\c:\blfrhfl.exec:\blfrhfl.exe119⤵PID:1944
-
\??\c:\lxtnjdj.exec:\lxtnjdj.exe120⤵PID:2352
-
\??\c:\xrthlnl.exec:\xrthlnl.exe121⤵PID:1600
-
\??\c:\blnrb.exec:\blnrb.exe122⤵PID:1768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-