Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 01:55
Behavioral task
behavioral1
Sample
5166950456179abc92150a26df2a3c40_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
5166950456179abc92150a26df2a3c40_NeikiAnalytics.exe
-
Size
334KB
-
MD5
5166950456179abc92150a26df2a3c40
-
SHA1
726b0d3589208e1154e22263be9dc54ef116734c
-
SHA256
c251c79d528bea1ddd089a0db712881c1bd2eceb13427a47678b5b76f7801ee5
-
SHA512
20db240cc080fe8d7ad8db22fbbe7d0d90aa3bb997317a99971a66a0e4e208132cdd58ddbb8f844a2189e4f650078186725f71e047e52317683e9250a01e86b6
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1i/x:x4wFHoS3eFaKHpv/VycgE8ox
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2772-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1616-28-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1616-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1016-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1840-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/940-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1300-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-515-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1492-581-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2016-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1544-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-190-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1036-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1796-175-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1796-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1264-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1300-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1784-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-96-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2512-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-695-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2396-702-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-787-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1516-856-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/872-875-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2952 lfxlbfj.exe 1616 npdvhpj.exe 2920 jrbtb.exe 2688 nxvrl.exe 2512 prfrt.exe 2704 nbjtb.exe 2228 trbdfd.exe 2408 vrhlhvh.exe 552 vdxlnr.exe 2392 ppnjfp.exe 1876 blpdhxd.exe 2468 phxxl.exe 2644 lxhnbnb.exe 1784 bhjrx.exe 1300 dxlhfl.exe 1264 xxntrh.exe 1768 hhxphxd.exe 1796 bdttvd.exe 1036 pxpvdlj.exe 3056 ddblhdb.exe 768 hdrhxx.exe 2588 jbhrpv.exe 744 rbjvfj.exe 1936 nxxtdx.exe 1136 bpjrfdt.exe 1544 vpfldbl.exe 1952 fdhrlpv.exe 2016 bhdbdfp.exe 1640 dtxprl.exe 1708 xtdnbf.exe 1684 nfphblh.exe 2824 rfpbr.exe 2488 lhrhxx.exe 1224 pvlrfjn.exe 2780 vjjvftd.exe 2912 htvdbtn.exe 940 ffpnr.exe 2692 jthtlt.exe 2532 jfjptpt.exe 2676 xxrxl.exe 2672 jnvvrv.exe 2704 rjpdd.exe 2228 hxljll.exe 1016 rlhbb.exe 2604 xxhrfph.exe 1984 lhjtb.exe 1840 xdrhvv.exe 2476 lvjhlnd.exe 1628 xptxhvp.exe 1928 bpthrnd.exe 2644 dbpdh.exe 1948 pnxhnd.exe 1300 tbbnpth.exe 1988 xphlj.exe 1932 lvdll.exe 2620 vrbnnf.exe 2116 rxxrfl.exe 2812 dhvdjdx.exe 1740 vtfjxj.exe 2808 dhbpb.exe 2588 nxrjltl.exe 2064 xxnvxh.exe 2380 vnfhrt.exe 1196 lvhjx.exe -
resource yara_rule behavioral1/memory/2772-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015c23-6.dat upx behavioral1/memory/2772-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000f000000015c7c-19.dat upx behavioral1/memory/1616-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1616-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015db4-26.dat upx behavioral1/memory/2920-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015e02-38.dat upx behavioral1/memory/2952-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2512-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015e5b-49.dat upx behavioral1/files/0x0007000000016b5e-59.dat upx behavioral1/memory/2704-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2228-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b15-77.dat upx behavioral1/files/0x0006000000018ae8-68.dat upx behavioral1/files/0x0006000000018b33-85.dat upx behavioral1/files/0x000f000000015c87-93.dat upx behavioral1/files/0x0006000000018b37-102.dat upx behavioral1/memory/2392-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b42-110.dat upx behavioral1/files/0x0006000000018b4a-117.dat upx behavioral1/files/0x0006000000018b6a-128.dat upx behavioral1/files/0x0006000000018b73-138.dat upx behavioral1/files/0x0006000000018ba2-157.dat upx behavioral1/files/0x0006000000018d06-165.dat upx behavioral1/files/0x00050000000192c9-177.dat upx behavioral1/files/0x00050000000192f4-187.dat upx behavioral1/memory/3056-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001931b-195.dat upx behavioral1/files/0x0005000000019333-204.dat upx behavioral1/files/0x0005000000019368-214.dat upx behavioral1/memory/2588-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019377-222.dat upx behavioral1/files/0x000500000001939b-229.dat upx behavioral1/files/0x00050000000193b0-238.dat upx behavioral1/files/0x000500000001946b-254.dat upx behavioral1/files/0x000500000001946f-264.dat upx behavioral1/files/0x0005000000019485-280.dat upx behavioral1/files/0x00050000000194a4-288.dat upx behavioral1/memory/2912-321-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2692-337-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2692-344-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2532-353-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1016-384-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1840-403-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2476-410-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1928-423-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/940-336-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/940-329-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2912-328-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1300-437-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1300-444-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019473-273.dat upx behavioral1/memory/1708-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2016-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019410-247.dat upx behavioral1/memory/1544-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/768-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3056-190-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1036-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1796-174-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2952 2772 5166950456179abc92150a26df2a3c40_NeikiAnalytics.exe 28 PID 2772 wrote to memory of 2952 2772 5166950456179abc92150a26df2a3c40_NeikiAnalytics.exe 28 PID 2772 wrote to memory of 2952 2772 5166950456179abc92150a26df2a3c40_NeikiAnalytics.exe 28 PID 2772 wrote to memory of 2952 2772 5166950456179abc92150a26df2a3c40_NeikiAnalytics.exe 28 PID 2952 wrote to memory of 1616 2952 lfxlbfj.exe 29 PID 2952 wrote to memory of 1616 2952 lfxlbfj.exe 29 PID 2952 wrote to memory of 1616 2952 lfxlbfj.exe 29 PID 2952 wrote to memory of 1616 2952 lfxlbfj.exe 29 PID 1616 wrote to memory of 2920 1616 npdvhpj.exe 30 PID 1616 wrote to memory of 2920 1616 npdvhpj.exe 30 PID 1616 wrote to memory of 2920 1616 npdvhpj.exe 30 PID 1616 wrote to memory of 2920 1616 npdvhpj.exe 30 PID 2920 wrote to memory of 2688 2920 jrbtb.exe 31 PID 2920 wrote to memory of 2688 2920 jrbtb.exe 31 PID 2920 wrote to memory of 2688 2920 jrbtb.exe 31 PID 2920 wrote to memory of 2688 2920 jrbtb.exe 31 PID 2688 wrote to memory of 2512 2688 nxvrl.exe 32 PID 2688 wrote to memory of 2512 2688 nxvrl.exe 32 PID 2688 wrote to memory of 2512 2688 nxvrl.exe 32 PID 2688 wrote to memory of 2512 2688 nxvrl.exe 32 PID 2512 wrote to memory of 2704 2512 prfrt.exe 70 PID 2512 wrote to memory of 2704 2512 prfrt.exe 70 PID 2512 wrote to memory of 2704 2512 prfrt.exe 70 PID 2512 wrote to memory of 2704 2512 prfrt.exe 70 PID 2704 wrote to memory of 2228 2704 nbjtb.exe 115 PID 2704 wrote to memory of 2228 2704 nbjtb.exe 115 PID 2704 wrote to memory of 2228 2704 nbjtb.exe 115 PID 2704 wrote to memory of 2228 2704 nbjtb.exe 115 PID 2228 wrote to memory of 2408 2228 trbdfd.exe 35 PID 2228 wrote to memory of 2408 2228 trbdfd.exe 35 PID 2228 wrote to memory of 2408 2228 trbdfd.exe 35 PID 2228 wrote to memory of 2408 2228 trbdfd.exe 35 PID 2408 wrote to memory of 552 2408 vrhlhvh.exe 36 PID 2408 wrote to memory of 552 2408 vrhlhvh.exe 36 PID 2408 wrote to memory of 552 2408 vrhlhvh.exe 36 PID 2408 wrote to memory of 552 2408 vrhlhvh.exe 36 PID 552 wrote to memory of 2392 552 vdxlnr.exe 37 PID 552 wrote to memory of 2392 552 vdxlnr.exe 37 PID 552 wrote to memory of 2392 552 vdxlnr.exe 37 PID 552 wrote to memory of 2392 552 vdxlnr.exe 37 PID 2392 wrote to memory of 1876 2392 ppnjfp.exe 38 PID 2392 wrote to memory of 1876 2392 ppnjfp.exe 38 PID 2392 wrote to memory of 1876 2392 ppnjfp.exe 38 PID 2392 wrote to memory of 1876 2392 ppnjfp.exe 38 PID 1876 wrote to memory of 2468 1876 blpdhxd.exe 39 PID 1876 wrote to memory of 2468 1876 blpdhxd.exe 39 PID 1876 wrote to memory of 2468 1876 blpdhxd.exe 39 PID 1876 wrote to memory of 2468 1876 blpdhxd.exe 39 PID 2468 wrote to memory of 2644 2468 phxxl.exe 79 PID 2468 wrote to memory of 2644 2468 phxxl.exe 79 PID 2468 wrote to memory of 2644 2468 phxxl.exe 79 PID 2468 wrote to memory of 2644 2468 phxxl.exe 79 PID 2644 wrote to memory of 1784 2644 lxhnbnb.exe 41 PID 2644 wrote to memory of 1784 2644 lxhnbnb.exe 41 PID 2644 wrote to memory of 1784 2644 lxhnbnb.exe 41 PID 2644 wrote to memory of 1784 2644 lxhnbnb.exe 41 PID 1784 wrote to memory of 1300 1784 bhjrx.exe 42 PID 1784 wrote to memory of 1300 1784 bhjrx.exe 42 PID 1784 wrote to memory of 1300 1784 bhjrx.exe 42 PID 1784 wrote to memory of 1300 1784 bhjrx.exe 42 PID 1300 wrote to memory of 1264 1300 dxlhfl.exe 43 PID 1300 wrote to memory of 1264 1300 dxlhfl.exe 43 PID 1300 wrote to memory of 1264 1300 dxlhfl.exe 43 PID 1300 wrote to memory of 1264 1300 dxlhfl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\5166950456179abc92150a26df2a3c40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5166950456179abc92150a26df2a3c40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\lfxlbfj.exec:\lfxlbfj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\npdvhpj.exec:\npdvhpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\jrbtb.exec:\jrbtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\nxvrl.exec:\nxvrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\prfrt.exec:\prfrt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\nbjtb.exec:\nbjtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\trbdfd.exec:\trbdfd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\vrhlhvh.exec:\vrhlhvh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\vdxlnr.exec:\vdxlnr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\ppnjfp.exec:\ppnjfp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\blpdhxd.exec:\blpdhxd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\phxxl.exec:\phxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\lxhnbnb.exec:\lxhnbnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\bhjrx.exec:\bhjrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\dxlhfl.exec:\dxlhfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\xxntrh.exec:\xxntrh.exe17⤵
- Executes dropped EXE
PID:1264 -
\??\c:\hhxphxd.exec:\hhxphxd.exe18⤵
- Executes dropped EXE
PID:1768 -
\??\c:\bdttvd.exec:\bdttvd.exe19⤵
- Executes dropped EXE
PID:1796 -
\??\c:\pxpvdlj.exec:\pxpvdlj.exe20⤵
- Executes dropped EXE
PID:1036 -
\??\c:\ddblhdb.exec:\ddblhdb.exe21⤵
- Executes dropped EXE
PID:3056 -
\??\c:\hdrhxx.exec:\hdrhxx.exe22⤵
- Executes dropped EXE
PID:768 -
\??\c:\jbhrpv.exec:\jbhrpv.exe23⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rbjvfj.exec:\rbjvfj.exe24⤵
- Executes dropped EXE
PID:744 -
\??\c:\nxxtdx.exec:\nxxtdx.exe25⤵
- Executes dropped EXE
PID:1936 -
\??\c:\bpjrfdt.exec:\bpjrfdt.exe26⤵
- Executes dropped EXE
PID:1136 -
\??\c:\vpfldbl.exec:\vpfldbl.exe27⤵
- Executes dropped EXE
PID:1544 -
\??\c:\fdhrlpv.exec:\fdhrlpv.exe28⤵
- Executes dropped EXE
PID:1952 -
\??\c:\bhdbdfp.exec:\bhdbdfp.exe29⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dtxprl.exec:\dtxprl.exe30⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xtdnbf.exec:\xtdnbf.exe31⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nfphblh.exec:\nfphblh.exe32⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rfpbr.exec:\rfpbr.exe33⤵
- Executes dropped EXE
PID:2824 -
\??\c:\lhrhxx.exec:\lhrhxx.exe34⤵
- Executes dropped EXE
PID:2488 -
\??\c:\pvlrfjn.exec:\pvlrfjn.exe35⤵
- Executes dropped EXE
PID:1224 -
\??\c:\vjjvftd.exec:\vjjvftd.exe36⤵
- Executes dropped EXE
PID:2780 -
\??\c:\nxhfnr.exec:\nxhfnr.exe37⤵PID:1696
-
\??\c:\htvdbtn.exec:\htvdbtn.exe38⤵
- Executes dropped EXE
PID:2912 -
\??\c:\ffpnr.exec:\ffpnr.exe39⤵
- Executes dropped EXE
PID:940 -
\??\c:\jthtlt.exec:\jthtlt.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jfjptpt.exec:\jfjptpt.exe41⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xxrxl.exec:\xxrxl.exe42⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jnvvrv.exec:\jnvvrv.exe43⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rjpdd.exec:\rjpdd.exe44⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hxljll.exec:\hxljll.exe45⤵
- Executes dropped EXE
PID:2228 -
\??\c:\rlhbb.exec:\rlhbb.exe46⤵
- Executes dropped EXE
PID:1016 -
\??\c:\xxhrfph.exec:\xxhrfph.exe47⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lhjtb.exec:\lhjtb.exe48⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xdrhvv.exec:\xdrhvv.exe49⤵
- Executes dropped EXE
PID:1840 -
\??\c:\lvjhlnd.exec:\lvjhlnd.exe50⤵
- Executes dropped EXE
PID:2476 -
\??\c:\xptxhvp.exec:\xptxhvp.exe51⤵
- Executes dropped EXE
PID:1628 -
\??\c:\bpthrnd.exec:\bpthrnd.exe52⤵
- Executes dropped EXE
PID:1928 -
\??\c:\dbpdh.exec:\dbpdh.exe53⤵
- Executes dropped EXE
PID:2644 -
\??\c:\pnxhnd.exec:\pnxhnd.exe54⤵
- Executes dropped EXE
PID:1948 -
\??\c:\tbbnpth.exec:\tbbnpth.exe55⤵
- Executes dropped EXE
PID:1300 -
\??\c:\xphlj.exec:\xphlj.exe56⤵
- Executes dropped EXE
PID:1988 -
\??\c:\lvdll.exec:\lvdll.exe57⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vrbnnf.exec:\vrbnnf.exe58⤵
- Executes dropped EXE
PID:2620 -
\??\c:\rxxrfl.exec:\rxxrfl.exe59⤵
- Executes dropped EXE
PID:2116 -
\??\c:\dhvdjdx.exec:\dhvdjdx.exe60⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vtfjxj.exec:\vtfjxj.exe61⤵
- Executes dropped EXE
PID:1740 -
\??\c:\dhbpb.exec:\dhbpb.exe62⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nxrjltl.exec:\nxrjltl.exe63⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xxnvxh.exec:\xxnvxh.exe64⤵
- Executes dropped EXE
PID:2064 -
\??\c:\vnfhrt.exec:\vnfhrt.exe65⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lvhjx.exec:\lvhjx.exe66⤵
- Executes dropped EXE
PID:1196 -
\??\c:\hhnhdt.exec:\hhnhdt.exe67⤵PID:1976
-
\??\c:\nptdrb.exec:\nptdrb.exe68⤵PID:2256
-
\??\c:\hptbfbf.exec:\hptbfbf.exe69⤵PID:1856
-
\??\c:\blpjfll.exec:\blpjfll.exe70⤵PID:2792
-
\??\c:\nlvnpdv.exec:\nlvnpdv.exe71⤵PID:900
-
\??\c:\vfrfvp.exec:\vfrfvp.exe72⤵PID:476
-
\??\c:\hdbbxht.exec:\hdbbxht.exe73⤵PID:2164
-
\??\c:\nvxrrvj.exec:\nvxrrvj.exe74⤵PID:1816
-
\??\c:\fjjxhdd.exec:\fjjxhdd.exe75⤵PID:1632
-
\??\c:\lbvhb.exec:\lbvhb.exe76⤵PID:1492
-
\??\c:\rhdxv.exec:\rhdxv.exe77⤵PID:2848
-
\??\c:\nrthpp.exec:\nrthpp.exe78⤵PID:1224
-
\??\c:\txplddj.exec:\txplddj.exe79⤵PID:2780
-
\??\c:\blrtrb.exec:\blrtrb.exe80⤵PID:1696
-
\??\c:\prxvxtf.exec:\prxvxtf.exe81⤵PID:2232
-
\??\c:\plxnrp.exec:\plxnrp.exe82⤵PID:2556
-
\??\c:\lxjtv.exec:\lxjtv.exe83⤵PID:2656
-
\??\c:\bjdbl.exec:\bjdbl.exe84⤵PID:2944
-
\??\c:\pbtnf.exec:\pbtnf.exe85⤵PID:2024
-
\??\c:\llpxhp.exec:\llpxhp.exe86⤵PID:2900
-
\??\c:\tlrdbvl.exec:\tlrdbvl.exe87⤵PID:2572
-
\??\c:\nrprnlj.exec:\nrprnlj.exe88⤵PID:2420
-
\??\c:\vfbvfh.exec:\vfbvfh.exe89⤵PID:2228
-
\??\c:\vxfbph.exec:\vxfbph.exe90⤵PID:1464
-
\??\c:\xtndhbn.exec:\xtndhbn.exe91⤵PID:2604
-
\??\c:\dxrjvj.exec:\dxrjvj.exe92⤵PID:2088
-
\??\c:\jrthbpb.exec:\jrthbpb.exe93⤵PID:824
-
\??\c:\hhrdbl.exec:\hhrdbl.exe94⤵PID:2396
-
\??\c:\dpbffb.exec:\dpbffb.exe95⤵PID:1996
-
\??\c:\xvlfl.exec:\xvlfl.exe96⤵PID:1028
-
\??\c:\npdxfht.exec:\npdxfht.exe97⤵PID:1248
-
\??\c:\jdjffp.exec:\jdjffp.exe98⤵PID:1968
-
\??\c:\jrrpttf.exec:\jrrpttf.exe99⤵PID:1992
-
\??\c:\lxhlv.exec:\lxhlv.exe100⤵PID:3024
-
\??\c:\thxptx.exec:\thxptx.exe101⤵PID:1116
-
\??\c:\hnljfdd.exec:\hnljfdd.exe102⤵PID:1304
-
\??\c:\dvdhtd.exec:\dvdhtd.exe103⤵PID:748
-
\??\c:\njvjdrh.exec:\njvjdrh.exe104⤵PID:2496
-
\??\c:\ldrdjtj.exec:\ldrdjtj.exe105⤵PID:528
-
\??\c:\jhvvxdh.exec:\jhvvxdh.exe106⤵PID:2152
-
\??\c:\xjlll.exec:\xjlll.exe107⤵PID:2768
-
\??\c:\blxvvd.exec:\blxvvd.exe108⤵PID:532
-
\??\c:\dhbvbtj.exec:\dhbvbtj.exe109⤵PID:1676
-
\??\c:\tttrj.exec:\tttrj.exe110⤵PID:3060
-
\??\c:\jdlhd.exec:\jdlhd.exe111⤵PID:1272
-
\??\c:\hffpx.exec:\hffpx.exe112⤵PID:1756
-
\??\c:\hpbnjt.exec:\hpbnjt.exe113⤵PID:1544
-
\??\c:\dvjtvph.exec:\dvjtvph.exe114⤵PID:1680
-
\??\c:\hdnvxdh.exec:\hdnvxdh.exe115⤵PID:2040
-
\??\c:\xnbbbh.exec:\xnbbbh.exe116⤵PID:2624
-
\??\c:\xrfjd.exec:\xrfjd.exe117⤵PID:900
-
\??\c:\blhhh.exec:\blhhh.exe118⤵PID:1516
-
\??\c:\vhlljt.exec:\vhlljt.exe119⤵PID:1764
-
\??\c:\njfbdfh.exec:\njfbdfh.exe120⤵PID:1512
-
\??\c:\hddhld.exec:\hddhld.exe121⤵PID:872
-
\??\c:\lllfb.exec:\lllfb.exe122⤵PID:1608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-