Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 08:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8e7eb941d0d853bd295157c4491339b013184096fe9eb3492dfef6344fd23abf_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
5 signatures
150 seconds
General
-
Target
8e7eb941d0d853bd295157c4491339b013184096fe9eb3492dfef6344fd23abf_NeikiAnalytics.exe
-
Size
342KB
-
MD5
6e83d31477236dfbb16e843702527480
-
SHA1
e1cf16db24e03195e02f8f7924bfaecd8cba8b49
-
SHA256
8e7eb941d0d853bd295157c4491339b013184096fe9eb3492dfef6344fd23abf
-
SHA512
10fc0d36e47c9fe2db0724874f4669463a2af126541a9d236e2a9d1c425dc4f0473c781ae99e6d1d8efe0fc6bce533db8967a97616ce930f1d1aba97e884b4fd
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAX:l7TcbWXZshJX2VGdX
Malware Config
Signatures
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2440-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2400-22-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1108-18-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3020-37-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2708-41-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3020-39-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2600-61-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2600-59-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/2688-69-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2528-82-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2112-91-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1072-105-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1808-116-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2788-133-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1616-138-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2788-135-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1616-141-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2200-166-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1936-154-0x00000000002B0000-0x00000000002D8000-memory.dmp family_blackmoon behavioral1/memory/2572-175-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2408-184-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1976-247-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1976-249-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/876-269-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1244-286-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2040-306-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/832-314-0x0000000000250000-0x0000000000278000-memory.dmp family_blackmoon behavioral1/memory/1696-324-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1584-332-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1096-339-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3016-353-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2700-360-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1152-387-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2920-394-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2412-401-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2936-411-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2528-409-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/748-424-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1700-431-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1684-484-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1684-483-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1624-503-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2032-517-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1684-515-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2964-587-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2964-586-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2988-613-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1940-633-0x00000000003A0000-0x00000000003C8000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1108 ftnjbj.exe 2400 ndhpllp.exe 3020 xdnblf.exe 2708 fltrpp.exe 2600 trlvf.exe 2688 ptxtjxh.exe 2732 ffjndfl.exe 2528 phjbjxb.exe 2112 xdllx.exe 1072 vtrdl.exe 1808 ppvbjrp.exe 2460 lhxftrh.exe 2788 lllnhn.exe 1616 djfrrld.exe 1936 vdppjr.exe 2200 txtdjd.exe 2572 thnxhb.exe 2408 ldttr.exe 1424 jblrn.exe 2032 bbxldr.exe 432 hlbtvj.exe 580 pbdrvr.exe 2124 lvbxd.exe 3024 ftttd.exe 1976 pbrpl.exe 1004 xtbrh.exe 1872 xfjlhfr.exe 876 dxjhvhl.exe 1244 hbllbvp.exe 1212 njplt.exe 2040 nldhtt.exe 832 lxprfrl.exe 1696 vdrnbpl.exe 1584 xlrxb.exe 1096 vdlxtn.exe 2960 ltblvv.exe 3016 fldhnpn.exe 2700 dxrjr.exe 2828 ntjfjjt.exe 2616 vjxvdnn.exe 2592 dvdnvdj.exe 1152 lntxhlf.exe 2920 pdxhxxl.exe 2412 pbthbvx.exe 2528 jrxnnf.exe 2936 bhtlbd.exe 748 fhjrpv.exe 1700 pndndf.exe 1808 bnhtfl.exe 2460 vnjjv.exe 2512 xrdjn.exe 364 pjdbhv.exe 1252 xdxjvt.exe 2424 htvprjj.exe 2192 jprxdv.exe 1684 hvhdt.exe 836 pptjdlj.exe 2408 bbhfp.exe 2044 fllthtx.exe 1624 dppfr.exe 2032 pjppjtt.exe 2848 rppln.exe 1116 dnrplbf.exe 776 tdpvblv.exe -
resource yara_rule behavioral1/memory/2440-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1108-10-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2400-22-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1108-18-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2708-41-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3020-39-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2600-50-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2600-61-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2528-82-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2112-91-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1808-108-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1072-105-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1808-116-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2788-133-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/1616-138-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2788-135-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2200-166-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2200-156-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2572-175-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2408-184-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/432-202-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/580-211-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3024-230-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1004-251-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1976-249-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/876-269-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1244-278-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1244-286-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2040-306-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1696-317-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1696-324-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1096-339-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2960-346-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/3016-353-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2700-360-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1152-387-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2920-394-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2936-411-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/748-424-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1700-431-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1684-476-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1624-503-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2848-518-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1116-526-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2272-567-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2964-587-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2208-594-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2988-613-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2440 wrote to memory of 1108 2440 8e7eb941d0d853bd295157c4491339b013184096fe9eb3492dfef6344fd23abf_NeikiAnalytics.exe 28 PID 2440 wrote to memory of 1108 2440 8e7eb941d0d853bd295157c4491339b013184096fe9eb3492dfef6344fd23abf_NeikiAnalytics.exe 28 PID 2440 wrote to memory of 1108 2440 8e7eb941d0d853bd295157c4491339b013184096fe9eb3492dfef6344fd23abf_NeikiAnalytics.exe 28 PID 2440 wrote to memory of 1108 2440 8e7eb941d0d853bd295157c4491339b013184096fe9eb3492dfef6344fd23abf_NeikiAnalytics.exe 28 PID 1108 wrote to memory of 2400 1108 ftnjbj.exe 29 PID 1108 wrote to memory of 2400 1108 ftnjbj.exe 29 PID 1108 wrote to memory of 2400 1108 ftnjbj.exe 29 PID 1108 wrote to memory of 2400 1108 ftnjbj.exe 29 PID 2400 wrote to memory of 3020 2400 ndhpllp.exe 30 PID 2400 wrote to memory of 3020 2400 ndhpllp.exe 30 PID 2400 wrote to memory of 3020 2400 ndhpllp.exe 30 PID 2400 wrote to memory of 3020 2400 ndhpllp.exe 30 PID 3020 wrote to memory of 2708 3020 xdnblf.exe 31 PID 3020 wrote to memory of 2708 3020 xdnblf.exe 31 PID 3020 wrote to memory of 2708 3020 xdnblf.exe 31 PID 3020 wrote to memory of 2708 3020 xdnblf.exe 31 PID 2708 wrote to memory of 2600 2708 fltrpp.exe 32 PID 2708 wrote to memory of 2600 2708 fltrpp.exe 32 PID 2708 wrote to memory of 2600 2708 fltrpp.exe 32 PID 2708 wrote to memory of 2600 2708 fltrpp.exe 32 PID 2600 wrote to memory of 2688 2600 trlvf.exe 33 PID 2600 wrote to memory of 2688 2600 trlvf.exe 33 PID 2600 wrote to memory of 2688 2600 trlvf.exe 33 PID 2600 wrote to memory of 2688 2600 trlvf.exe 33 PID 2688 wrote to memory of 2732 2688 ptxtjxh.exe 34 PID 2688 wrote to memory of 2732 2688 ptxtjxh.exe 34 PID 2688 wrote to memory of 2732 2688 ptxtjxh.exe 34 PID 2688 wrote to memory of 2732 2688 ptxtjxh.exe 34 PID 2732 wrote to memory of 2528 2732 ffjndfl.exe 35 PID 2732 wrote to memory of 2528 2732 ffjndfl.exe 35 PID 2732 wrote to memory of 2528 2732 ffjndfl.exe 35 PID 2732 wrote to memory of 2528 2732 ffjndfl.exe 35 PID 2528 wrote to memory of 2112 2528 phjbjxb.exe 36 PID 2528 wrote to memory of 2112 2528 phjbjxb.exe 36 PID 2528 wrote to memory of 2112 2528 phjbjxb.exe 36 PID 2528 wrote to memory of 2112 2528 phjbjxb.exe 36 PID 2112 wrote to memory of 1072 2112 xdllx.exe 37 PID 2112 wrote to memory of 1072 2112 xdllx.exe 37 PID 2112 wrote to memory of 1072 2112 xdllx.exe 37 PID 2112 wrote to memory of 1072 2112 xdllx.exe 37 PID 1072 wrote to memory of 1808 1072 vtrdl.exe 38 PID 1072 wrote to memory of 1808 1072 vtrdl.exe 38 PID 1072 wrote to memory of 1808 1072 vtrdl.exe 38 PID 1072 wrote to memory of 1808 1072 vtrdl.exe 38 PID 1808 wrote to memory of 2460 1808 ppvbjrp.exe 39 PID 1808 wrote to memory of 2460 1808 ppvbjrp.exe 39 PID 1808 wrote to memory of 2460 1808 ppvbjrp.exe 39 PID 1808 wrote to memory of 2460 1808 ppvbjrp.exe 39 PID 2460 wrote to memory of 2788 2460 lhxftrh.exe 40 PID 2460 wrote to memory of 2788 2460 lhxftrh.exe 40 PID 2460 wrote to memory of 2788 2460 lhxftrh.exe 40 PID 2460 wrote to memory of 2788 2460 lhxftrh.exe 40 PID 2788 wrote to memory of 1616 2788 lllnhn.exe 41 PID 2788 wrote to memory of 1616 2788 lllnhn.exe 41 PID 2788 wrote to memory of 1616 2788 lllnhn.exe 41 PID 2788 wrote to memory of 1616 2788 lllnhn.exe 41 PID 1616 wrote to memory of 1936 1616 djfrrld.exe 42 PID 1616 wrote to memory of 1936 1616 djfrrld.exe 42 PID 1616 wrote to memory of 1936 1616 djfrrld.exe 42 PID 1616 wrote to memory of 1936 1616 djfrrld.exe 42 PID 1936 wrote to memory of 2200 1936 vdppjr.exe 43 PID 1936 wrote to memory of 2200 1936 vdppjr.exe 43 PID 1936 wrote to memory of 2200 1936 vdppjr.exe 43 PID 1936 wrote to memory of 2200 1936 vdppjr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e7eb941d0d853bd295157c4491339b013184096fe9eb3492dfef6344fd23abf_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8e7eb941d0d853bd295157c4491339b013184096fe9eb3492dfef6344fd23abf_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\ftnjbj.exec:\ftnjbj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\ndhpllp.exec:\ndhpllp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\xdnblf.exec:\xdnblf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\fltrpp.exec:\fltrpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\trlvf.exec:\trlvf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\ptxtjxh.exec:\ptxtjxh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\ffjndfl.exec:\ffjndfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\phjbjxb.exec:\phjbjxb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\xdllx.exec:\xdllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\vtrdl.exec:\vtrdl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\ppvbjrp.exec:\ppvbjrp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\lhxftrh.exec:\lhxftrh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\lllnhn.exec:\lllnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\djfrrld.exec:\djfrrld.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\vdppjr.exec:\vdppjr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\txtdjd.exec:\txtdjd.exe17⤵
- Executes dropped EXE
PID:2200 -
\??\c:\thnxhb.exec:\thnxhb.exe18⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ldttr.exec:\ldttr.exe19⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jblrn.exec:\jblrn.exe20⤵
- Executes dropped EXE
PID:1424 -
\??\c:\bbxldr.exec:\bbxldr.exe21⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hlbtvj.exec:\hlbtvj.exe22⤵
- Executes dropped EXE
PID:432 -
\??\c:\pbdrvr.exec:\pbdrvr.exe23⤵
- Executes dropped EXE
PID:580 -
\??\c:\lvbxd.exec:\lvbxd.exe24⤵
- Executes dropped EXE
PID:2124 -
\??\c:\ftttd.exec:\ftttd.exe25⤵
- Executes dropped EXE
PID:3024 -
\??\c:\pbrpl.exec:\pbrpl.exe26⤵
- Executes dropped EXE
PID:1976 -
\??\c:\xtbrh.exec:\xtbrh.exe27⤵
- Executes dropped EXE
PID:1004 -
\??\c:\xfjlhfr.exec:\xfjlhfr.exe28⤵
- Executes dropped EXE
PID:1872 -
\??\c:\dxjhvhl.exec:\dxjhvhl.exe29⤵
- Executes dropped EXE
PID:876 -
\??\c:\hbllbvp.exec:\hbllbvp.exe30⤵
- Executes dropped EXE
PID:1244 -
\??\c:\njplt.exec:\njplt.exe31⤵
- Executes dropped EXE
PID:1212 -
\??\c:\nldhtt.exec:\nldhtt.exe32⤵
- Executes dropped EXE
PID:2040 -
\??\c:\lxprfrl.exec:\lxprfrl.exe33⤵
- Executes dropped EXE
PID:832 -
\??\c:\vdrnbpl.exec:\vdrnbpl.exe34⤵
- Executes dropped EXE
PID:1696 -
\??\c:\xlrxb.exec:\xlrxb.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\vdlxtn.exec:\vdlxtn.exe36⤵
- Executes dropped EXE
PID:1096 -
\??\c:\ltblvv.exec:\ltblvv.exe37⤵
- Executes dropped EXE
PID:2960 -
\??\c:\fldhnpn.exec:\fldhnpn.exe38⤵
- Executes dropped EXE
PID:3016 -
\??\c:\dxrjr.exec:\dxrjr.exe39⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ntjfjjt.exec:\ntjfjjt.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\vjxvdnn.exec:\vjxvdnn.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\dvdnvdj.exec:\dvdnvdj.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\lntxhlf.exec:\lntxhlf.exe43⤵
- Executes dropped EXE
PID:1152 -
\??\c:\pdxhxxl.exec:\pdxhxxl.exe44⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pbthbvx.exec:\pbthbvx.exe45⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jrxnnf.exec:\jrxnnf.exe46⤵
- Executes dropped EXE
PID:2528 -
\??\c:\bhtlbd.exec:\bhtlbd.exe47⤵
- Executes dropped EXE
PID:2936 -
\??\c:\fhjrpv.exec:\fhjrpv.exe48⤵
- Executes dropped EXE
PID:748 -
\??\c:\pndndf.exec:\pndndf.exe49⤵
- Executes dropped EXE
PID:1700 -
\??\c:\bnhtfl.exec:\bnhtfl.exe50⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vnjjv.exec:\vnjjv.exe51⤵
- Executes dropped EXE
PID:2460 -
\??\c:\xrdjn.exec:\xrdjn.exe52⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pjdbhv.exec:\pjdbhv.exe53⤵
- Executes dropped EXE
PID:364 -
\??\c:\xdxjvt.exec:\xdxjvt.exe54⤵
- Executes dropped EXE
PID:1252 -
\??\c:\htvprjj.exec:\htvprjj.exe55⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jprxdv.exec:\jprxdv.exe56⤵
- Executes dropped EXE
PID:2192 -
\??\c:\hvhdt.exec:\hvhdt.exe57⤵
- Executes dropped EXE
PID:1684 -
\??\c:\pptjdlj.exec:\pptjdlj.exe58⤵
- Executes dropped EXE
PID:836 -
\??\c:\bbhfp.exec:\bbhfp.exe59⤵
- Executes dropped EXE
PID:2408 -
\??\c:\fllthtx.exec:\fllthtx.exe60⤵
- Executes dropped EXE
PID:2044 -
\??\c:\dppfr.exec:\dppfr.exe61⤵
- Executes dropped EXE
PID:1624 -
\??\c:\pjppjtt.exec:\pjppjtt.exe62⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rppln.exec:\rppln.exe63⤵
- Executes dropped EXE
PID:2848 -
\??\c:\dnrplbf.exec:\dnrplbf.exe64⤵
- Executes dropped EXE
PID:1116 -
\??\c:\tdpvblv.exec:\tdpvblv.exe65⤵
- Executes dropped EXE
PID:776 -
\??\c:\rfxfd.exec:\rfxfd.exe66⤵PID:1836
-
\??\c:\fpjlr.exec:\fpjlr.exe67⤵PID:1972
-
\??\c:\hfpxtp.exec:\hfpxtp.exe68⤵PID:1332
-
\??\c:\tvdrxbl.exec:\tvdrxbl.exe69⤵PID:768
-
\??\c:\fnjfv.exec:\fnjfv.exe70⤵PID:2272
-
\??\c:\hfbfnh.exec:\hfbfnh.exe71⤵PID:1800
-
\??\c:\hhbjhd.exec:\hhbjhd.exe72⤵PID:2964
-
\??\c:\pbtxbjf.exec:\pbtxbjf.exe73⤵PID:2352
-
\??\c:\dpbjd.exec:\dpbjd.exe74⤵PID:2208
-
\??\c:\pphtvdr.exec:\pphtvdr.exe75⤵PID:1932
-
\??\c:\jrptd.exec:\jrptd.exe76⤵PID:2988
-
\??\c:\prnlxd.exec:\prnlxd.exe77⤵PID:2040
-
\??\c:\tjnptl.exec:\tjnptl.exe78⤵PID:2980
-
\??\c:\prdbp.exec:\prdbp.exe79⤵PID:1940
-
\??\c:\xbpfblb.exec:\xbpfblb.exe80⤵PID:1628
-
\??\c:\hdvvjp.exec:\hdvvjp.exe81⤵PID:1108
-
\??\c:\bptrt.exec:\bptrt.exe82⤵PID:3044
-
\??\c:\lptff.exec:\lptff.exe83⤵PID:3012
-
\??\c:\hjfpjt.exec:\hjfpjt.exe84⤵PID:2756
-
\??\c:\xfxdlpd.exec:\xfxdlpd.exe85⤵PID:2716
-
\??\c:\ltbpdl.exec:\ltbpdl.exe86⤵PID:2728
-
\??\c:\vfvlrfb.exec:\vfvlrfb.exe87⤵PID:2616
-
\??\c:\dxlvx.exec:\dxlvx.exe88⤵PID:2816
-
\??\c:\ldtlfx.exec:\ldtlfx.exe89⤵PID:2744
-
\??\c:\tdfhlfh.exec:\tdfhlfh.exe90⤵PID:2696
-
\??\c:\fltpn.exec:\fltpn.exe91⤵PID:1996
-
\??\c:\nrfvx.exec:\nrfvx.exe92⤵PID:740
-
\??\c:\vbbdj.exec:\vbbdj.exe93⤵PID:564
-
\??\c:\brhftfx.exec:\brhftfx.exe94⤵PID:1072
-
\??\c:\rtdhhp.exec:\rtdhhp.exe95⤵PID:748
-
\??\c:\djtvp.exec:\djtvp.exe96⤵PID:2536
-
\??\c:\djbdt.exec:\djbdt.exe97⤵PID:2868
-
\??\c:\pjxtvb.exec:\pjxtvb.exe98⤵PID:2796
-
\??\c:\vpvfhbh.exec:\vpvfhbh.exe99⤵PID:1788
-
\??\c:\tdtlftn.exec:\tdtlftn.exe100⤵PID:1792
-
\??\c:\ltnfjj.exec:\ltnfjj.exe101⤵PID:1828
-
\??\c:\hhnpxf.exec:\hhnpxf.exe102⤵PID:1728
-
\??\c:\xhxnjbn.exec:\xhxnjbn.exe103⤵PID:828
-
\??\c:\vfnjrdt.exec:\vfnjrdt.exe104⤵PID:1256
-
\??\c:\jhvnjjj.exec:\jhvnjjj.exe105⤵PID:1468
-
\??\c:\rbdxbfp.exec:\rbdxbfp.exe106⤵PID:2260
-
\??\c:\npjvhp.exec:\npjvhp.exe107⤵PID:1856
-
\??\c:\txdhhnt.exec:\txdhhnt.exe108⤵PID:472
-
\??\c:\xrjrn.exec:\xrjrn.exe109⤵PID:432
-
\??\c:\vlvrbh.exec:\vlvrbh.exe110⤵PID:1140
-
\??\c:\tjtntjl.exec:\tjtntjl.exe111⤵PID:396
-
\??\c:\dttvdj.exec:\dttvdj.exe112⤵PID:776
-
\??\c:\jpxlnhj.exec:\jpxlnhj.exe113⤵PID:1092
-
\??\c:\ffvdb.exec:\ffvdb.exe114⤵PID:944
-
\??\c:\ldttn.exec:\ldttn.exe115⤵PID:1780
-
\??\c:\hpjvnpt.exec:\hpjvnpt.exe116⤵PID:2140
-
\??\c:\xjrpr.exec:\xjrpr.exe117⤵PID:1964
-
\??\c:\lvrvr.exec:\lvrvr.exe118⤵PID:1608
-
\??\c:\rvntlh.exec:\rvntlh.exe119⤵PID:600
-
\??\c:\jxbdj.exec:\jxbdj.exe120⤵PID:2132
-
\??\c:\hdnbnh.exec:\hdnbnh.exe121⤵PID:1712
-
\??\c:\dlbhbvb.exec:\dlbhbvb.exe122⤵PID:3040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-