Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 19:52
Behavioral task
behavioral1
Sample
e0b072d0ca534f136dc4ec68852a72c0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
e0b072d0ca534f136dc4ec68852a72c0_NeikiAnalytics.exe
-
Size
71KB
-
MD5
e0b072d0ca534f136dc4ec68852a72c0
-
SHA1
826d31ed1580b5692d7ffd97d4e37c8031d967e3
-
SHA256
cf61cb5003dee77a3bd17e571ea804deed4e7611c11f52721f38cd852cffe0c2
-
SHA512
ebdeb32934f6ba781d01432be37ee28e90fe7f4feb867e758d94287529d325d250f5cc7b0ce82d6ec1a457a9484e223f70f71a718a648129f78e66aa9e992a03
-
SSDEEP
1536:NvQBeOGtrYS3srx93UBWfwC6Ggnouy8KlAXmAXIBG/+WIFuTKLXvCB5yAXNlIQkz:NhOmTsF93UYfwC6GIoutOP/WWGKL/SYx
Malware Config
Signatures
-
Detect Blackmoon payload 59 IoCs
resource yara_rule behavioral1/memory/1892-12-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/696-113-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2184-164-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1644-199-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1588-190-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2692-173-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1964-248-0x0000000000260000-0x0000000000293000-memory.dmp family_blackmoon behavioral1/memory/2268-276-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/892-294-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1960-233-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2240-309-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2240-308-0x00000000002A0000-0x00000000002D3000-memory.dmp family_blackmoon behavioral1/memory/2204-147-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/2340-131-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1216-121-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2204-104-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/2204-102-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2208-93-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2348-77-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2488-59-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2676-49-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2496-40-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2744-28-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2240-8-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1608-316-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1132-323-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/2496-338-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2240-339-0x00000000002A0000-0x00000000002D3000-memory.dmp family_blackmoon behavioral1/memory/2628-342-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/1132-353-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/2392-361-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2404-381-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/768-388-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2352-391-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1480-402-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1252-451-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1472-458-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2104-465-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1696-467-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/856-564-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/576-586-0x00000000001B0000-0x00000000001E3000-memory.dmp family_blackmoon behavioral1/memory/1064-591-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1608-604-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1132-612-0x0000000000230000-0x0000000000263000-memory.dmp family_blackmoon behavioral1/memory/1132-611-0x0000000000230000-0x0000000000263000-memory.dmp family_blackmoon behavioral1/memory/2388-631-0x00000000003C0000-0x00000000003F3000-memory.dmp family_blackmoon behavioral1/memory/2400-700-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/2312-719-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1948-747-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/1288-828-0x00000000003C0000-0x00000000003F3000-memory.dmp family_blackmoon behavioral1/memory/2448-884-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/2488-918-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/2448-920-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/3032-927-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/1312-936-0x00000000001B0000-0x00000000001E3000-memory.dmp family_blackmoon behavioral1/memory/2564-985-0x0000000000440000-0x0000000000473000-memory.dmp family_blackmoon behavioral1/memory/2848-988-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/1648-1000-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/308-1041-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1892 npvnbph.exe 2744 njddlv.exe 2496 vjfvff.exe 2676 hdtlxdl.exe 2488 jpjphfl.exe 2548 ndvtb.exe 2528 hnjpr.exe 2348 tnrjv.exe 2208 nbpvh.exe 2204 pbftlt.exe 696 dhtdlb.exe 1216 djnnv.exe 2340 nhhpnt.exe 2572 dvnljr.exe 1800 jxjvll.exe 1976 rjppxrt.exe 2184 tbfhf.exe 2692 frfhxvp.exe 1728 rtdphp.exe 1588 dpbfv.exe 1644 nxtnv.exe 2852 dpplrrj.exe 436 rhhlhh.exe 956 tjlfb.exe 1960 brjbnl.exe 800 rjttj.exe 1964 jjjlfj.exe 900 ffddvf.exe 2220 tjtvp.exe 2268 jnxrd.exe 268 bjjrfxp.exe 892 htxfxh.exe 2116 xjnrht.exe 2240 dtfhpbv.exe 1608 brbjf.exe 1132 lnnflvh.exe 2484 jhthvvf.exe 2496 htltd.exe 2628 bnpbbdl.exe 2540 jrpfhv.exe 2392 tjrdl.exe 2416 fjnrthh.exe 2668 bbrpftv.exe 2404 jttvx.exe 768 lvpptl.exe 2352 nfbjdjr.exe 1480 rnntl.exe 556 tvpdxph.exe 2560 jfvdpr.exe 2596 nbvpl.exe 2188 lxvjlj.exe 1668 jdjjtjh.exe 1924 xprdxpn.exe 1664 rjpphrd.exe 1252 pxhdpjt.exe 1472 ptlhrd.exe 2104 ljvldd.exe 1696 ddjvlrx.exe 2324 jrdpxdj.exe 1692 jjlrrlv.exe 1596 xrxtvfx.exe 1724 hvxjv.exe 2852 lnhdxh.exe 436 brpllxl.exe -
resource yara_rule behavioral1/memory/1892-12-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x000d0000000122d1-10.dat upx behavioral1/memory/1892-14-0x00000000002C0000-0x00000000002F3000-memory.dmp upx behavioral1/files/0x00220000000122f4-21.dat upx behavioral1/files/0x000900000001267d-41.dat upx behavioral1/files/0x000800000001269e-51.dat upx behavioral1/files/0x00080000000126f7-66.dat upx behavioral1/files/0x0006000000014e3d-94.dat upx behavioral1/files/0x0006000000014ec4-105.dat upx behavioral1/memory/696-113-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000014fe1-111.dat upx behavioral1/files/0x0006000000015264-122.dat upx behavioral1/files/0x0006000000015364-129.dat upx behavioral1/files/0x00060000000155d4-139.dat upx behavioral1/files/0x00060000000155d9-149.dat upx behavioral1/files/0x001a000000012300-157.dat upx behavioral1/memory/2184-164-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x000600000001560a-175.dat upx behavioral1/memory/1728-174-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000015a98-192.dat upx behavioral1/files/0x0006000000015c0d-200.dat upx behavioral1/memory/1644-199-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/1588-190-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000015a2d-183.dat upx behavioral1/memory/2692-173-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x00060000000155e2-165.dat upx behavioral1/files/0x0006000000015c3c-218.dat upx behavioral1/files/0x0006000000015c52-226.dat upx behavioral1/files/0x0006000000015c5d-235.dat upx behavioral1/files/0x0006000000015c69-244.dat upx behavioral1/files/0x0006000000015c7c-252.dat upx behavioral1/files/0x0006000000015c87-260.dat upx behavioral1/files/0x0006000000015cb9-268.dat upx behavioral1/files/0x0006000000015d88-278.dat upx behavioral1/files/0x0006000000015db4-286.dat upx behavioral1/memory/2268-276-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/892-294-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/1960-233-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2240-301-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2240-309-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000015c2f-209.dat upx behavioral1/memory/2340-131-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/1216-121-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2204-102-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2204-101-0x0000000000220000-0x0000000000253000-memory.dmp upx behavioral1/memory/2208-93-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000014c67-85.dat upx behavioral1/memory/2348-77-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x00090000000139d6-76.dat upx behavioral1/files/0x00080000000126c7-60.dat upx behavioral1/memory/2488-59-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2488-50-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2676-49-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2496-40-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x00230000000122f8-32.dat upx behavioral1/memory/2496-31-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2744-28-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2744-20-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2240-8-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2240-0-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/1608-316-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2496-330-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2496-338-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2392-354-0x0000000000400000-0x0000000000433000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1892 2240 e0b072d0ca534f136dc4ec68852a72c0_NeikiAnalytics.exe 28 PID 2240 wrote to memory of 1892 2240 e0b072d0ca534f136dc4ec68852a72c0_NeikiAnalytics.exe 28 PID 2240 wrote to memory of 1892 2240 e0b072d0ca534f136dc4ec68852a72c0_NeikiAnalytics.exe 28 PID 2240 wrote to memory of 1892 2240 e0b072d0ca534f136dc4ec68852a72c0_NeikiAnalytics.exe 28 PID 1892 wrote to memory of 2744 1892 npvnbph.exe 29 PID 1892 wrote to memory of 2744 1892 npvnbph.exe 29 PID 1892 wrote to memory of 2744 1892 npvnbph.exe 29 PID 1892 wrote to memory of 2744 1892 npvnbph.exe 29 PID 2744 wrote to memory of 2496 2744 njddlv.exe 65 PID 2744 wrote to memory of 2496 2744 njddlv.exe 65 PID 2744 wrote to memory of 2496 2744 njddlv.exe 65 PID 2744 wrote to memory of 2496 2744 njddlv.exe 65 PID 2496 wrote to memory of 2676 2496 vjfvff.exe 31 PID 2496 wrote to memory of 2676 2496 vjfvff.exe 31 PID 2496 wrote to memory of 2676 2496 vjfvff.exe 31 PID 2496 wrote to memory of 2676 2496 vjfvff.exe 31 PID 2676 wrote to memory of 2488 2676 hdtlxdl.exe 32 PID 2676 wrote to memory of 2488 2676 hdtlxdl.exe 32 PID 2676 wrote to memory of 2488 2676 hdtlxdl.exe 32 PID 2676 wrote to memory of 2488 2676 hdtlxdl.exe 32 PID 2488 wrote to memory of 2548 2488 jpjphfl.exe 33 PID 2488 wrote to memory of 2548 2488 jpjphfl.exe 33 PID 2488 wrote to memory of 2548 2488 jpjphfl.exe 33 PID 2488 wrote to memory of 2548 2488 jpjphfl.exe 33 PID 2548 wrote to memory of 2528 2548 ndvtb.exe 34 PID 2548 wrote to memory of 2528 2548 ndvtb.exe 34 PID 2548 wrote to memory of 2528 2548 ndvtb.exe 34 PID 2548 wrote to memory of 2528 2548 ndvtb.exe 34 PID 2528 wrote to memory of 2348 2528 hnjpr.exe 35 PID 2528 wrote to memory of 2348 2528 hnjpr.exe 35 PID 2528 wrote to memory of 2348 2528 hnjpr.exe 35 PID 2528 wrote to memory of 2348 2528 hnjpr.exe 35 PID 2348 wrote to memory of 2208 2348 tnrjv.exe 36 PID 2348 wrote to memory of 2208 2348 tnrjv.exe 36 PID 2348 wrote to memory of 2208 2348 tnrjv.exe 36 PID 2348 wrote to memory of 2208 2348 tnrjv.exe 36 PID 2208 wrote to memory of 2204 2208 nbpvh.exe 37 PID 2208 wrote to memory of 2204 2208 nbpvh.exe 37 PID 2208 wrote to memory of 2204 2208 nbpvh.exe 37 PID 2208 wrote to memory of 2204 2208 nbpvh.exe 37 PID 2204 wrote to memory of 696 2204 pbftlt.exe 38 PID 2204 wrote to memory of 696 2204 pbftlt.exe 38 PID 2204 wrote to memory of 696 2204 pbftlt.exe 38 PID 2204 wrote to memory of 696 2204 pbftlt.exe 38 PID 696 wrote to memory of 1216 696 dhtdlb.exe 39 PID 696 wrote to memory of 1216 696 dhtdlb.exe 39 PID 696 wrote to memory of 1216 696 dhtdlb.exe 39 PID 696 wrote to memory of 1216 696 dhtdlb.exe 39 PID 1216 wrote to memory of 2340 1216 djnnv.exe 40 PID 1216 wrote to memory of 2340 1216 djnnv.exe 40 PID 1216 wrote to memory of 2340 1216 djnnv.exe 40 PID 1216 wrote to memory of 2340 1216 djnnv.exe 40 PID 2340 wrote to memory of 2572 2340 nhhpnt.exe 41 PID 2340 wrote to memory of 2572 2340 nhhpnt.exe 41 PID 2340 wrote to memory of 2572 2340 nhhpnt.exe 41 PID 2340 wrote to memory of 2572 2340 nhhpnt.exe 41 PID 2572 wrote to memory of 1800 2572 dvnljr.exe 42 PID 2572 wrote to memory of 1800 2572 dvnljr.exe 42 PID 2572 wrote to memory of 1800 2572 dvnljr.exe 42 PID 2572 wrote to memory of 1800 2572 dvnljr.exe 42 PID 1800 wrote to memory of 1976 1800 jxjvll.exe 43 PID 1800 wrote to memory of 1976 1800 jxjvll.exe 43 PID 1800 wrote to memory of 1976 1800 jxjvll.exe 43 PID 1800 wrote to memory of 1976 1800 jxjvll.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0b072d0ca534f136dc4ec68852a72c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e0b072d0ca534f136dc4ec68852a72c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\npvnbph.exec:\npvnbph.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\njddlv.exec:\njddlv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\vjfvff.exec:\vjfvff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\hdtlxdl.exec:\hdtlxdl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\jpjphfl.exec:\jpjphfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\ndvtb.exec:\ndvtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\hnjpr.exec:\hnjpr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\tnrjv.exec:\tnrjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\nbpvh.exec:\nbpvh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\pbftlt.exec:\pbftlt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\dhtdlb.exec:\dhtdlb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\djnnv.exec:\djnnv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\nhhpnt.exec:\nhhpnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\dvnljr.exec:\dvnljr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\jxjvll.exec:\jxjvll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\rjppxrt.exec:\rjppxrt.exe17⤵
- Executes dropped EXE
PID:1976 -
\??\c:\tbfhf.exec:\tbfhf.exe18⤵
- Executes dropped EXE
PID:2184 -
\??\c:\frfhxvp.exec:\frfhxvp.exe19⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rtdphp.exec:\rtdphp.exe20⤵
- Executes dropped EXE
PID:1728 -
\??\c:\dpbfv.exec:\dpbfv.exe21⤵
- Executes dropped EXE
PID:1588 -
\??\c:\nxtnv.exec:\nxtnv.exe22⤵
- Executes dropped EXE
PID:1644 -
\??\c:\dpplrrj.exec:\dpplrrj.exe23⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rhhlhh.exec:\rhhlhh.exe24⤵
- Executes dropped EXE
PID:436 -
\??\c:\tjlfb.exec:\tjlfb.exe25⤵
- Executes dropped EXE
PID:956 -
\??\c:\brjbnl.exec:\brjbnl.exe26⤵
- Executes dropped EXE
PID:1960 -
\??\c:\rjttj.exec:\rjttj.exe27⤵
- Executes dropped EXE
PID:800 -
\??\c:\jjjlfj.exec:\jjjlfj.exe28⤵
- Executes dropped EXE
PID:1964 -
\??\c:\ffddvf.exec:\ffddvf.exe29⤵
- Executes dropped EXE
PID:900 -
\??\c:\tjtvp.exec:\tjtvp.exe30⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jnxrd.exec:\jnxrd.exe31⤵
- Executes dropped EXE
PID:2268 -
\??\c:\bjjrfxp.exec:\bjjrfxp.exe32⤵
- Executes dropped EXE
PID:268 -
\??\c:\htxfxh.exec:\htxfxh.exe33⤵
- Executes dropped EXE
PID:892 -
\??\c:\xjnrht.exec:\xjnrht.exe34⤵
- Executes dropped EXE
PID:2116 -
\??\c:\dtfhpbv.exec:\dtfhpbv.exe35⤵
- Executes dropped EXE
PID:2240 -
\??\c:\brbjf.exec:\brbjf.exe36⤵
- Executes dropped EXE
PID:1608 -
\??\c:\lnnflvh.exec:\lnnflvh.exe37⤵
- Executes dropped EXE
PID:1132 -
\??\c:\jhthvvf.exec:\jhthvvf.exe38⤵
- Executes dropped EXE
PID:2484 -
\??\c:\htltd.exec:\htltd.exe39⤵
- Executes dropped EXE
PID:2496 -
\??\c:\bnpbbdl.exec:\bnpbbdl.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jrpfhv.exec:\jrpfhv.exe41⤵
- Executes dropped EXE
PID:2540 -
\??\c:\tjrdl.exec:\tjrdl.exe42⤵
- Executes dropped EXE
PID:2392 -
\??\c:\fjnrthh.exec:\fjnrthh.exe43⤵
- Executes dropped EXE
PID:2416 -
\??\c:\bbrpftv.exec:\bbrpftv.exe44⤵
- Executes dropped EXE
PID:2668 -
\??\c:\jttvx.exec:\jttvx.exe45⤵
- Executes dropped EXE
PID:2404 -
\??\c:\lvpptl.exec:\lvpptl.exe46⤵
- Executes dropped EXE
PID:768 -
\??\c:\nfbjdjr.exec:\nfbjdjr.exe47⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rnntl.exec:\rnntl.exe48⤵
- Executes dropped EXE
PID:1480 -
\??\c:\tvpdxph.exec:\tvpdxph.exe49⤵
- Executes dropped EXE
PID:556 -
\??\c:\jfvdpr.exec:\jfvdpr.exe50⤵
- Executes dropped EXE
PID:2560 -
\??\c:\nbvpl.exec:\nbvpl.exe51⤵
- Executes dropped EXE
PID:2596 -
\??\c:\lxvjlj.exec:\lxvjlj.exe52⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jdjjtjh.exec:\jdjjtjh.exe53⤵
- Executes dropped EXE
PID:1668 -
\??\c:\xprdxpn.exec:\xprdxpn.exe54⤵
- Executes dropped EXE
PID:1924 -
\??\c:\rjpphrd.exec:\rjpphrd.exe55⤵
- Executes dropped EXE
PID:1664 -
\??\c:\pxhdpjt.exec:\pxhdpjt.exe56⤵
- Executes dropped EXE
PID:1252 -
\??\c:\ptlhrd.exec:\ptlhrd.exe57⤵
- Executes dropped EXE
PID:1472 -
\??\c:\ljvldd.exec:\ljvldd.exe58⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ddjvlrx.exec:\ddjvlrx.exe59⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jrdpxdj.exec:\jrdpxdj.exe60⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jjlrrlv.exec:\jjlrrlv.exe61⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xrxtvfx.exec:\xrxtvfx.exe62⤵
- Executes dropped EXE
PID:1596 -
\??\c:\hvxjv.exec:\hvxjv.exe63⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lnhdxh.exec:\lnhdxh.exe64⤵
- Executes dropped EXE
PID:2852 -
\??\c:\brpllxl.exec:\brpllxl.exe65⤵
- Executes dropped EXE
PID:436 -
\??\c:\vjbtxjn.exec:\vjbtxjn.exe66⤵PID:956
-
\??\c:\prtphl.exec:\prtphl.exe67⤵PID:1960
-
\??\c:\fpvrxdr.exec:\fpvrxdr.exe68⤵PID:1968
-
\??\c:\nhbjthj.exec:\nhbjthj.exe69⤵PID:2808
-
\??\c:\dntltfv.exec:\dntltfv.exe70⤵PID:1200
-
\??\c:\hfrtlh.exec:\hfrtlh.exe71⤵PID:1956
-
\??\c:\vrvxdft.exec:\vrvxdft.exe72⤵PID:2604
-
\??\c:\prnjjj.exec:\prnjjj.exe73⤵PID:576
-
\??\c:\vnxxvpf.exec:\vnxxvpf.exe74⤵PID:856
-
\??\c:\rvbhjhn.exec:\rvbhjhn.exe75⤵PID:2968
-
\??\c:\pxnfvvx.exec:\pxnfvvx.exe76⤵PID:2764
-
\??\c:\lbnbpvl.exec:\lbnbpvl.exe77⤵PID:2908
-
\??\c:\xndrh.exec:\xndrh.exe78⤵PID:1064
-
\??\c:\nnhlt.exec:\nnhlt.exe79⤵PID:1612
-
\??\c:\htdvbx.exec:\htdvbx.exe80⤵PID:1608
-
\??\c:\jbtnp.exec:\jbtnp.exe81⤵PID:1132
-
\??\c:\jtbtll.exec:\jtbtll.exe82⤵PID:3040
-
\??\c:\jtrpjv.exec:\jtrpjv.exe83⤵PID:2148
-
\??\c:\dllnb.exec:\dllnb.exe84⤵PID:2388
-
\??\c:\pdxplx.exec:\pdxplx.exe85⤵PID:2648
-
\??\c:\bpffnx.exec:\bpffnx.exe86⤵PID:2624
-
\??\c:\thvht.exec:\thvht.exe87⤵PID:2372
-
\??\c:\nnvxxd.exec:\nnvxxd.exe88⤵PID:2396
-
\??\c:\vbljvt.exec:\vbljvt.exe89⤵PID:2348
-
\??\c:\pvbthd.exec:\pvbthd.exe90⤵PID:1672
-
\??\c:\xtpfh.exec:\xtpfh.exe91⤵PID:768
-
\??\c:\bdjvd.exec:\bdjvd.exe92⤵PID:2432
-
\??\c:\rltdb.exec:\rltdb.exe93⤵PID:1480
-
\??\c:\hdlbjd.exec:\hdlbjd.exe94⤵PID:1216
-
\??\c:\vxxfrnr.exec:\vxxfrnr.exe95⤵PID:2400
-
\??\c:\btrjjjt.exec:\btrjjjt.exe96⤵PID:2596
-
\??\c:\vpdxnt.exec:\vpdxnt.exe97⤵PID:2188
-
\??\c:\blxbvp.exec:\blxbvp.exe98⤵PID:1668
-
\??\c:\nvlxl.exec:\nvlxl.exe99⤵PID:2312
-
\??\c:\ljflhtd.exec:\ljflhtd.exe100⤵PID:1824
-
\??\c:\vfrftbv.exec:\vfrftbv.exe101⤵PID:2544
-
\??\c:\nfbhlt.exec:\nfbhlt.exe102⤵PID:308
-
\??\c:\pjrhl.exec:\pjrhl.exe103⤵PID:1948
-
\??\c:\prjdr.exec:\prjdr.exe104⤵PID:1588
-
\??\c:\jpptdl.exec:\jpptdl.exe105⤵PID:2948
-
\??\c:\xbndhd.exec:\xbndhd.exe106⤵PID:1764
-
\??\c:\jfjdvlv.exec:\jfjdvlv.exe107⤵PID:1748
-
\??\c:\dltxpvd.exec:\dltxpvd.exe108⤵PID:2452
-
\??\c:\dfnrp.exec:\dfnrp.exe109⤵PID:1632
-
\??\c:\lpvdpl.exec:\lpvdpl.exe110⤵PID:1152
-
\??\c:\rljdn.exec:\rljdn.exe111⤵PID:436
-
\??\c:\tblxl.exec:\tblxl.exe112⤵PID:956
-
\??\c:\hppvx.exec:\hppvx.exe113⤵PID:1960
-
\??\c:\tfvhdt.exec:\tfvhdt.exe114⤵PID:1968
-
\??\c:\rvdtpx.exec:\rvdtpx.exe115⤵PID:1288
-
\??\c:\dpxtjp.exec:\dpxtjp.exe116⤵PID:2060
-
\??\c:\nfnft.exec:\nfnft.exe117⤵PID:1112
-
\??\c:\fllrdrn.exec:\fllrdrn.exe118⤵PID:2268
-
\??\c:\tnbdn.exec:\tnbdn.exe119⤵PID:2308
-
\??\c:\tjpxxrf.exec:\tjpxxrf.exe120⤵PID:1484
-
\??\c:\pxbhhvt.exec:\pxbhhvt.exe121⤵PID:892
-
\??\c:\xjbhldj.exec:\xjbhldj.exe122⤵PID:2248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-