Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 14:10
Behavioral task
behavioral1
Sample
e177a4a09161a9fae3b6f5179c564990_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
e177a4a09161a9fae3b6f5179c564990_NeikiAnalytics.exe
-
Size
498KB
-
MD5
e177a4a09161a9fae3b6f5179c564990
-
SHA1
faa3d2a710c6cc66d55ae9e356ea820c6ac9f0b0
-
SHA256
aaa7f20634fa7025e7a418049d989d53475e1b20ff83c4da3dcd4a30e331ef00
-
SHA512
e7ac6ec6e657f75be5b910add5c029dcd335c541fc3297b5e5f9f5542e109bbf7b32a2ff10877f7df170b2cf7e22b6f8e45744fa08a9b7de10801428bccd3b35
-
SSDEEP
12288:S4wFHoSyoS3ebeFmFVvlrmwcT4wpteFmFTxS:0KFmFVtrRcFEFmFs
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/1252-9-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2052-17-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1972-28-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2652-38-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2584-47-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2480-56-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2480-57-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2644-67-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2512-77-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2512-70-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2432-88-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2868-90-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2868-98-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2800-100-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2800-108-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1008-111-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1008-118-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1456-127-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2308-136-0x0000000000500000-0x0000000000584000-memory.dmp family_blackmoon behavioral1/memory/2352-147-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2352-148-0x0000000001CC0000-0x0000000001D44000-memory.dmp family_blackmoon behavioral1/memory/1988-158-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1984-166-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1084-176-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2688-197-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1388-195-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1388-194-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1508-185-0x0000000000220000-0x00000000002A4000-memory.dmp family_blackmoon behavioral1/memory/1508-183-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1508-184-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2688-205-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2688-204-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/3008-214-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2776-227-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2776-226-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1800-247-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1512-256-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2092-236-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2284-270-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1812-278-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1812-277-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/3012-287-0x0000000001D20000-0x0000000001DA4000-memory.dmp family_blackmoon behavioral1/memory/3012-289-0x0000000001D20000-0x0000000001DA4000-memory.dmp family_blackmoon behavioral1/memory/3012-288-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2864-303-0x0000000000320000-0x00000000003A4000-memory.dmp family_blackmoon behavioral1/memory/2828-298-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2864-308-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1596-311-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1252-321-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1596-320-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1252-329-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1696-336-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1696-335-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1696-337-0x0000000000490000-0x0000000000514000-memory.dmp family_blackmoon behavioral1/memory/1384-344-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1384-343-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1740-351-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1740-352-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2616-360-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2576-368-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2576-367-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1892-376-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2648-383-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2640-389-0x0000000000220000-0x00000000002A4000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2052 nfrfdxf.exe 1972 vrpdxp.exe 2652 hxhjn.exe 2584 hhnpd.exe 2480 nnxdd.exe 2644 htxtv.exe 2512 dhffr.exe 2432 hpphht.exe 2868 tbbph.exe 2800 nhhfdp.exe 1008 vhhnjrh.exe 1456 dpjfh.exe 2308 dpbvlf.exe 2352 rxvjdh.exe 1988 pjrbhn.exe 1984 vxxxt.exe 1084 dfdldrv.exe 1508 jptfdtn.exe 1388 jfhjjxb.exe 2688 bbxfddl.exe 3008 fxdbhxb.exe 2776 jnvhhp.exe 2092 pdrfxf.exe 1800 fjhvrrb.exe 1512 hbfdx.exe 2284 nxjlpnv.exe 1812 lhfxvt.exe 3012 xxxrd.exe 2828 tdvtxlj.exe 2864 jhbrl.exe 1596 rnbrf.exe 1252 vvxfp.exe 1696 pvxxvr.exe 1384 lvflpl.exe 1740 tfndpfh.exe 2616 dprhf.exe 2576 dbfvbx.exe 1892 rjtvxx.exe 2648 vrvpffp.exe 2640 xdxppbd.exe 2396 xnrftrl.exe 2408 nvpfxl.exe 2788 nhdnldv.exe 2984 hlhxt.exe 2800 tptfpt.exe 1220 tnjxtt.exe 1912 drfft.exe 2320 pjptd.exe 1780 pdljd.exe 2004 rbhtfxh.exe 912 rhlrp.exe 1084 rhrtbv.exe 2348 hnvtvxn.exe 2660 hnrlh.exe 2628 tljttjt.exe 2968 xjhbx.exe 2416 nnprhxl.exe 2676 dltrh.exe 2256 hhhrx.exe 2268 hxbpl.exe 2736 jljthv.exe 3036 hvrfrjj.exe 1628 bvhlj.exe 1040 ppbhxff.exe -
resource yara_rule behavioral1/memory/1252-0-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x000d000000014267-6.dat upx behavioral1/memory/1252-9-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2052-12-0x0000000000500000-0x0000000000584000-memory.dmp upx behavioral1/memory/1972-19-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x00080000000143d1-18.dat upx behavioral1/memory/2052-17-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x000900000001441e-26.dat upx behavioral1/memory/1972-28-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2652-29-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0007000000014698-36.dat upx behavioral1/memory/2652-38-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x000900000001445e-48.dat upx behavioral1/memory/2584-47-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2480-50-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2644-59-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0007000000014738-58.dat upx behavioral1/memory/2480-57-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2644-67-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2512-77-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0007000000014909-69.dat upx behavioral1/memory/2512-78-0x0000000000490000-0x0000000000514000-memory.dmp upx behavioral1/memory/2512-70-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2644-66-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0009000000014a94-79.dat upx behavioral1/memory/2432-81-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2432-88-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2868-90-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x000600000001560a-89.dat upx behavioral1/memory/2868-98-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000015a2d-99.dat upx behavioral1/memory/2800-100-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2800-108-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1008-111-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000015a98-110.dat upx behavioral1/memory/1008-118-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000015c0d-120.dat upx behavioral1/files/0x0006000000015c23-130.dat upx behavioral1/memory/2308-129-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1456-127-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000015c2f-139.dat upx behavioral1/memory/2352-147-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000015c3c-149.dat upx behavioral1/memory/2352-148-0x0000000001CC0000-0x0000000001D44000-memory.dmp upx behavioral1/memory/1988-158-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000015c52-157.dat upx behavioral1/memory/1984-166-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000015c5d-168.dat upx behavioral1/memory/1984-164-0x0000000000220000-0x00000000002A4000-memory.dmp upx behavioral1/files/0x0006000000015c69-177.dat upx behavioral1/memory/1084-176-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000015c7c-186.dat upx behavioral1/memory/1388-187-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000015c87-196.dat upx behavioral1/memory/2688-197-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1388-195-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1508-185-0x0000000000220000-0x00000000002A4000-memory.dmp upx behavioral1/memory/1508-184-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000015cb9-206.dat upx behavioral1/memory/2688-205-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2776-216-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000015d88-215.dat upx behavioral1/memory/3008-214-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2776-221-0x0000000001D80000-0x0000000001E04000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1252 wrote to memory of 2052 1252 e177a4a09161a9fae3b6f5179c564990_NeikiAnalytics.exe 28 PID 1252 wrote to memory of 2052 1252 e177a4a09161a9fae3b6f5179c564990_NeikiAnalytics.exe 28 PID 1252 wrote to memory of 2052 1252 e177a4a09161a9fae3b6f5179c564990_NeikiAnalytics.exe 28 PID 1252 wrote to memory of 2052 1252 e177a4a09161a9fae3b6f5179c564990_NeikiAnalytics.exe 28 PID 2052 wrote to memory of 1972 2052 nfrfdxf.exe 29 PID 2052 wrote to memory of 1972 2052 nfrfdxf.exe 29 PID 2052 wrote to memory of 1972 2052 nfrfdxf.exe 29 PID 2052 wrote to memory of 1972 2052 nfrfdxf.exe 29 PID 1972 wrote to memory of 2652 1972 vrpdxp.exe 30 PID 1972 wrote to memory of 2652 1972 vrpdxp.exe 30 PID 1972 wrote to memory of 2652 1972 vrpdxp.exe 30 PID 1972 wrote to memory of 2652 1972 vrpdxp.exe 30 PID 2652 wrote to memory of 2584 2652 hxhjn.exe 31 PID 2652 wrote to memory of 2584 2652 hxhjn.exe 31 PID 2652 wrote to memory of 2584 2652 hxhjn.exe 31 PID 2652 wrote to memory of 2584 2652 hxhjn.exe 31 PID 2584 wrote to memory of 2480 2584 hhnpd.exe 32 PID 2584 wrote to memory of 2480 2584 hhnpd.exe 32 PID 2584 wrote to memory of 2480 2584 hhnpd.exe 32 PID 2584 wrote to memory of 2480 2584 hhnpd.exe 32 PID 2480 wrote to memory of 2644 2480 nnxdd.exe 33 PID 2480 wrote to memory of 2644 2480 nnxdd.exe 33 PID 2480 wrote to memory of 2644 2480 nnxdd.exe 33 PID 2480 wrote to memory of 2644 2480 nnxdd.exe 33 PID 2644 wrote to memory of 2512 2644 htxtv.exe 34 PID 2644 wrote to memory of 2512 2644 htxtv.exe 34 PID 2644 wrote to memory of 2512 2644 htxtv.exe 34 PID 2644 wrote to memory of 2512 2644 htxtv.exe 34 PID 2512 wrote to memory of 2432 2512 dhffr.exe 35 PID 2512 wrote to memory of 2432 2512 dhffr.exe 35 PID 2512 wrote to memory of 2432 2512 dhffr.exe 35 PID 2512 wrote to memory of 2432 2512 dhffr.exe 35 PID 2432 wrote to memory of 2868 2432 hpphht.exe 36 PID 2432 wrote to memory of 2868 2432 hpphht.exe 36 PID 2432 wrote to memory of 2868 2432 hpphht.exe 36 PID 2432 wrote to memory of 2868 2432 hpphht.exe 36 PID 2868 wrote to memory of 2800 2868 tbbph.exe 37 PID 2868 wrote to memory of 2800 2868 tbbph.exe 37 PID 2868 wrote to memory of 2800 2868 tbbph.exe 37 PID 2868 wrote to memory of 2800 2868 tbbph.exe 37 PID 2800 wrote to memory of 1008 2800 nhhfdp.exe 38 PID 2800 wrote to memory of 1008 2800 nhhfdp.exe 38 PID 2800 wrote to memory of 1008 2800 nhhfdp.exe 38 PID 2800 wrote to memory of 1008 2800 nhhfdp.exe 38 PID 1008 wrote to memory of 1456 1008 vhhnjrh.exe 39 PID 1008 wrote to memory of 1456 1008 vhhnjrh.exe 39 PID 1008 wrote to memory of 1456 1008 vhhnjrh.exe 39 PID 1008 wrote to memory of 1456 1008 vhhnjrh.exe 39 PID 1456 wrote to memory of 2308 1456 dpjfh.exe 40 PID 1456 wrote to memory of 2308 1456 dpjfh.exe 40 PID 1456 wrote to memory of 2308 1456 dpjfh.exe 40 PID 1456 wrote to memory of 2308 1456 dpjfh.exe 40 PID 2308 wrote to memory of 2352 2308 dpbvlf.exe 41 PID 2308 wrote to memory of 2352 2308 dpbvlf.exe 41 PID 2308 wrote to memory of 2352 2308 dpbvlf.exe 41 PID 2308 wrote to memory of 2352 2308 dpbvlf.exe 41 PID 2352 wrote to memory of 1988 2352 rxvjdh.exe 42 PID 2352 wrote to memory of 1988 2352 rxvjdh.exe 42 PID 2352 wrote to memory of 1988 2352 rxvjdh.exe 42 PID 2352 wrote to memory of 1988 2352 rxvjdh.exe 42 PID 1988 wrote to memory of 1984 1988 pjrbhn.exe 43 PID 1988 wrote to memory of 1984 1988 pjrbhn.exe 43 PID 1988 wrote to memory of 1984 1988 pjrbhn.exe 43 PID 1988 wrote to memory of 1984 1988 pjrbhn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e177a4a09161a9fae3b6f5179c564990_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e177a4a09161a9fae3b6f5179c564990_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\nfrfdxf.exec:\nfrfdxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\vrpdxp.exec:\vrpdxp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\hxhjn.exec:\hxhjn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\hhnpd.exec:\hhnpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\nnxdd.exec:\nnxdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\htxtv.exec:\htxtv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\dhffr.exec:\dhffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\hpphht.exec:\hpphht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\tbbph.exec:\tbbph.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\nhhfdp.exec:\nhhfdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\vhhnjrh.exec:\vhhnjrh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\dpjfh.exec:\dpjfh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\dpbvlf.exec:\dpbvlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\rxvjdh.exec:\rxvjdh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\pjrbhn.exec:\pjrbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\vxxxt.exec:\vxxxt.exe17⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dfdldrv.exec:\dfdldrv.exe18⤵
- Executes dropped EXE
PID:1084 -
\??\c:\jptfdtn.exec:\jptfdtn.exe19⤵
- Executes dropped EXE
PID:1508 -
\??\c:\jfhjjxb.exec:\jfhjjxb.exe20⤵
- Executes dropped EXE
PID:1388 -
\??\c:\bbxfddl.exec:\bbxfddl.exe21⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fxdbhxb.exec:\fxdbhxb.exe22⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jnvhhp.exec:\jnvhhp.exe23⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pdrfxf.exec:\pdrfxf.exe24⤵
- Executes dropped EXE
PID:2092 -
\??\c:\fjhvrrb.exec:\fjhvrrb.exe25⤵
- Executes dropped EXE
PID:1800 -
\??\c:\hbfdx.exec:\hbfdx.exe26⤵
- Executes dropped EXE
PID:1512 -
\??\c:\nxjlpnv.exec:\nxjlpnv.exe27⤵
- Executes dropped EXE
PID:2284 -
\??\c:\lhfxvt.exec:\lhfxvt.exe28⤵
- Executes dropped EXE
PID:1812 -
\??\c:\xxxrd.exec:\xxxrd.exe29⤵
- Executes dropped EXE
PID:3012 -
\??\c:\tdvtxlj.exec:\tdvtxlj.exe30⤵
- Executes dropped EXE
PID:2828 -
\??\c:\jhbrl.exec:\jhbrl.exe31⤵
- Executes dropped EXE
PID:2864 -
\??\c:\rnbrf.exec:\rnbrf.exe32⤵
- Executes dropped EXE
PID:1596 -
\??\c:\vvxfp.exec:\vvxfp.exe33⤵
- Executes dropped EXE
PID:1252 -
\??\c:\pvxxvr.exec:\pvxxvr.exe34⤵
- Executes dropped EXE
PID:1696 -
\??\c:\lvflpl.exec:\lvflpl.exe35⤵
- Executes dropped EXE
PID:1384 -
\??\c:\tfndpfh.exec:\tfndpfh.exe36⤵
- Executes dropped EXE
PID:1740 -
\??\c:\dprhf.exec:\dprhf.exe37⤵
- Executes dropped EXE
PID:2616 -
\??\c:\dbfvbx.exec:\dbfvbx.exe38⤵
- Executes dropped EXE
PID:2576 -
\??\c:\rjtvxx.exec:\rjtvxx.exe39⤵
- Executes dropped EXE
PID:1892 -
\??\c:\vrvpffp.exec:\vrvpffp.exe40⤵
- Executes dropped EXE
PID:2648 -
\??\c:\xdxppbd.exec:\xdxppbd.exe41⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xnrftrl.exec:\xnrftrl.exe42⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nvpfxl.exec:\nvpfxl.exe43⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nhdnldv.exec:\nhdnldv.exe44⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hlhxt.exec:\hlhxt.exe45⤵
- Executes dropped EXE
PID:2984 -
\??\c:\tptfpt.exec:\tptfpt.exe46⤵
- Executes dropped EXE
PID:2800 -
\??\c:\tnjxtt.exec:\tnjxtt.exe47⤵
- Executes dropped EXE
PID:1220 -
\??\c:\drfft.exec:\drfft.exe48⤵
- Executes dropped EXE
PID:1912 -
\??\c:\pjptd.exec:\pjptd.exe49⤵
- Executes dropped EXE
PID:2320 -
\??\c:\pdljd.exec:\pdljd.exe50⤵
- Executes dropped EXE
PID:1780 -
\??\c:\rbhtfxh.exec:\rbhtfxh.exe51⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rhlrp.exec:\rhlrp.exe52⤵
- Executes dropped EXE
PID:912 -
\??\c:\rhrtbv.exec:\rhrtbv.exe53⤵
- Executes dropped EXE
PID:1084 -
\??\c:\hnvtvxn.exec:\hnvtvxn.exe54⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hnrlh.exec:\hnrlh.exe55⤵
- Executes dropped EXE
PID:2660 -
\??\c:\tljttjt.exec:\tljttjt.exe56⤵
- Executes dropped EXE
PID:2628 -
\??\c:\xjhbx.exec:\xjhbx.exe57⤵
- Executes dropped EXE
PID:2968 -
\??\c:\nnprhxl.exec:\nnprhxl.exe58⤵
- Executes dropped EXE
PID:2416 -
\??\c:\dltrh.exec:\dltrh.exe59⤵
- Executes dropped EXE
PID:2676 -
\??\c:\hhhrx.exec:\hhhrx.exe60⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hxbpl.exec:\hxbpl.exe61⤵
- Executes dropped EXE
PID:2268 -
\??\c:\jljthv.exec:\jljthv.exe62⤵
- Executes dropped EXE
PID:2736 -
\??\c:\hvrfrjj.exec:\hvrfrjj.exe63⤵
- Executes dropped EXE
PID:3036 -
\??\c:\bvhlj.exec:\bvhlj.exe64⤵
- Executes dropped EXE
PID:1628 -
\??\c:\ppbhxff.exec:\ppbhxff.exe65⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ftplht.exec:\ftplht.exe66⤵PID:1812
-
\??\c:\jbrfh.exec:\jbrfh.exe67⤵PID:2760
-
\??\c:\plhrdfj.exec:\plhrdfj.exe68⤵PID:2832
-
\??\c:\hfbvl.exec:\hfbvl.exe69⤵PID:2740
-
\??\c:\dvxrr.exec:\dvxrr.exe70⤵PID:3048
-
\??\c:\fdfxnvf.exec:\fdfxnvf.exe71⤵PID:1156
-
\??\c:\hjjxx.exec:\hjjxx.exe72⤵PID:1428
-
\??\c:\djflfrl.exec:\djflfrl.exe73⤵PID:2212
-
\??\c:\ftxnpxp.exec:\ftxnpxp.exe74⤵PID:1100
-
\??\c:\hfdtx.exec:\hfdtx.exe75⤵PID:2036
-
\??\c:\nrfpftf.exec:\nrfpftf.exe76⤵PID:2208
-
\??\c:\jhxjntl.exec:\jhxjntl.exe77⤵PID:1972
-
\??\c:\rrjjhtv.exec:\rrjjhtv.exe78⤵PID:2992
-
\??\c:\xljnr.exec:\xljnr.exe79⤵PID:2616
-
\??\c:\hrtbxrx.exec:\hrtbxrx.exe80⤵PID:2556
-
\??\c:\xlttv.exec:\xlttv.exe81⤵PID:2664
-
\??\c:\vvrhxpv.exec:\vvrhxpv.exe82⤵PID:2636
-
\??\c:\thpxf.exec:\thpxf.exe83⤵PID:2548
-
\??\c:\rhbvd.exec:\rhbvd.exe84⤵PID:2488
-
\??\c:\rvtrhb.exec:\rvtrhb.exe85⤵PID:2544
-
\??\c:\xjlbh.exec:\xjlbh.exe86⤵PID:2440
-
\??\c:\dvbrpb.exec:\dvbrpb.exe87⤵PID:2868
-
\??\c:\jtjtv.exec:\jtjtv.exe88⤵PID:2168
-
\??\c:\ntfthft.exec:\ntfthft.exe89⤵PID:676
-
\??\c:\fnbbx.exec:\fnbbx.exe90⤵PID:2800
-
\??\c:\btpvp.exec:\btpvp.exe91⤵PID:2220
-
\??\c:\fddfhf.exec:\fddfhf.exe92⤵PID:1284
-
\??\c:\ftdxvn.exec:\ftdxvn.exe93⤵PID:2300
-
\??\c:\vtbfl.exec:\vtbfl.exe94⤵PID:2308
-
\??\c:\lxjrv.exec:\lxjrv.exe95⤵PID:2316
-
\??\c:\vvnbrh.exec:\vvnbrh.exe96⤵PID:744
-
\??\c:\djppp.exec:\djppp.exe97⤵PID:1672
-
\??\c:\rtnvnpd.exec:\rtnvnpd.exe98⤵PID:912
-
\??\c:\lvdfhbf.exec:\lvdfhbf.exe99⤵PID:1632
-
\??\c:\vdlnt.exec:\vdlnt.exe100⤵PID:1732
-
\??\c:\rxnrjx.exec:\rxnrjx.exe101⤵PID:1616
-
\??\c:\rpfvp.exec:\rpfvp.exe102⤵PID:1152
-
\??\c:\rhppv.exec:\rhppv.exe103⤵PID:2620
-
\??\c:\vhdffhb.exec:\vhdffhb.exe104⤵PID:1452
-
\??\c:\lbvbhn.exec:\lbvbhn.exe105⤵PID:2804
-
\??\c:\tpjdvf.exec:\tpjdvf.exe106⤵PID:1880
-
\??\c:\dxlpjnd.exec:\dxlpjnd.exe107⤵PID:1644
-
\??\c:\bxvbhp.exec:\bxvbhp.exe108⤵PID:2012
-
\??\c:\nxfnvdb.exec:\nxfnvdb.exe109⤵PID:1028
-
\??\c:\lhrlnh.exec:\lhrlnh.exe110⤵PID:2268
-
\??\c:\tlvlt.exec:\tlvlt.exe111⤵PID:2164
-
\??\c:\hvvtxv.exec:\hvvtxv.exe112⤵PID:1664
-
\??\c:\bvjrtrd.exec:\bvjrtrd.exe113⤵PID:1608
-
\??\c:\hjdlv.exec:\hjdlv.exe114⤵PID:1468
-
\??\c:\hvfbvtx.exec:\hvfbvtx.exe115⤵PID:3060
-
\??\c:\ldvhdpx.exec:\ldvhdpx.exe116⤵PID:2724
-
\??\c:\fvhtvxd.exec:\fvhtvxd.exe117⤵PID:1760
-
\??\c:\fdptl.exec:\fdptl.exe118⤵PID:2172
-
\??\c:\dxtxdhf.exec:\dxtxdhf.exe119⤵PID:2828
-
\??\c:\tnlvnn.exec:\tnlvnn.exe120⤵PID:2324
-
\??\c:\pxddt.exec:\pxddt.exe121⤵PID:2700
-
\??\c:\dxtvjb.exec:\dxtvjb.exe122⤵PID:2052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-