Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 16:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb5d779c490d6a384905b42193355940_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
eb5d779c490d6a384905b42193355940_NeikiAnalytics.exe
-
Size
76KB
-
MD5
eb5d779c490d6a384905b42193355940
-
SHA1
52518e16473afbe197c735262da56bd4a9272555
-
SHA256
c45c002ec7b3326b659a67d92404f1e3eb1a8561eca7fb65d318933552518e4e
-
SHA512
a8d42952e3f5f96c49b5057340a8186903683d7b3d7b39e7842a32e466086894e29a43f2c524237b7751e871b34c15d143b40d631c8a42ec335c8cb5002deb5a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2wVEJT:ymb3NkkiQ3mdBjF+3TU2KEJT
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2132-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1296-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1428-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1564-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/988-32-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/988-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/668-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rjjltx.exednnxnb.exenbplb.exejtpbnpt.exejdpdvl.exednrtn.exerhltpxf.exebntvv.exehbftdp.exehvvtv.exetvddl.exexhlbx.exenrvnn.exeltjfnp.exejtfpjxd.exexlvtp.exelpfxdrp.exexppfdt.exehpfhxbr.exepjhtf.exendtpf.exejpltll.exerjjtx.exexdpxxt.exejdhlj.exephftt.exettfpvj.exeffjpvp.exexpjfhx.exedtjpppd.exehhhhfvv.exejnlpvf.exefdfdlt.exehpnrnv.exevldvn.exexnvpftd.exehrthxh.exebpxxhnp.exejxvptb.exefvrtd.exehbjttl.exenvjdn.exebjvpl.exelbxfhtv.exepfdprp.exefrxxjdv.exetjhxpp.exefnrhvn.exejlvhhv.exenrpxdp.exetftbv.exefvhjh.exexvhbld.exetbjtpp.exertjlp.exehtvddp.exedjhfj.exejvrbnr.exexnjnxf.exetfpvlxb.exertffjd.exehtljf.exedvjhx.exefdvnxx.exepid process 668 rjjltx.exe 988 dnnxnb.exe 580 nbplb.exe 2804 jtpbnpt.exe 2868 jdpdvl.exe 900 dnrtn.exe 2908 rhltpxf.exe 2672 bntvv.exe 2548 hbftdp.exe 2612 hvvtv.exe 2584 tvddl.exe 2412 xhlbx.exe 2488 nrvnn.exe 2456 ltjfnp.exe 2216 jtfpjxd.exe 1636 xlvtp.exe 1976 lpfxdrp.exe 1760 xppfdt.exe 1564 hpfhxbr.exe 1628 pjhtf.exe 1428 ndtpf.exe 1804 jpltll.exe 1712 rjjtx.exe 1800 xdpxxt.exe 1588 jdhlj.exe 1296 phftt.exe 1820 ttfpvj.exe 936 ffjpvp.exe 2132 xpjfhx.exe 2732 dtjpppd.exe 2004 hhhhfvv.exe 1688 jnlpvf.exe 548 fdfdlt.exe 2096 hpnrnv.exe 2736 vldvn.exe 2716 xnvpftd.exe 2876 hrthxh.exe 2940 bpxxhnp.exe 2792 jxvptb.exe 2692 fvrtd.exe 2744 hbjttl.exe 2892 nvjdn.exe 2556 bjvpl.exe 2636 lbxfhtv.exe 2644 pfdprp.exe 2524 frxxjdv.exe 2624 tjhxpp.exe 2580 fnrhvn.exe 2280 jlvhhv.exe 2480 nrpxdp.exe 2464 tftbv.exe 2384 fvhjh.exe 2456 xvhbld.exe 1956 tbjtpp.exe 1692 rtjlp.exe 2336 htvddp.exe 1976 djhfj.exe 1764 jvrbnr.exe 2020 xnjnxf.exe 1060 tfpvlxb.exe 2008 rtffjd.exe 1096 htljf.exe 1804 dvjhx.exe 832 fdvnxx.exe -
Processes:
resource yara_rule behavioral1/memory/2132-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1296-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1428-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/900-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/988-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/988-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-3-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
eb5d779c490d6a384905b42193355940_NeikiAnalytics.exerjjltx.exednnxnb.exenbplb.exejtpbnpt.exejdpdvl.exednrtn.exerhltpxf.exebntvv.exehbftdp.exehvvtv.exetvddl.exexhlbx.exenrvnn.exeltjfnp.exejtfpjxd.exedescription pid process target process PID 2912 wrote to memory of 668 2912 eb5d779c490d6a384905b42193355940_NeikiAnalytics.exe rjjltx.exe PID 2912 wrote to memory of 668 2912 eb5d779c490d6a384905b42193355940_NeikiAnalytics.exe rjjltx.exe PID 2912 wrote to memory of 668 2912 eb5d779c490d6a384905b42193355940_NeikiAnalytics.exe rjjltx.exe PID 2912 wrote to memory of 668 2912 eb5d779c490d6a384905b42193355940_NeikiAnalytics.exe rjjltx.exe PID 668 wrote to memory of 988 668 rjjltx.exe dnnxnb.exe PID 668 wrote to memory of 988 668 rjjltx.exe dnnxnb.exe PID 668 wrote to memory of 988 668 rjjltx.exe dnnxnb.exe PID 668 wrote to memory of 988 668 rjjltx.exe dnnxnb.exe PID 988 wrote to memory of 580 988 dnnxnb.exe nbplb.exe PID 988 wrote to memory of 580 988 dnnxnb.exe nbplb.exe PID 988 wrote to memory of 580 988 dnnxnb.exe nbplb.exe PID 988 wrote to memory of 580 988 dnnxnb.exe nbplb.exe PID 580 wrote to memory of 2804 580 nbplb.exe jtpbnpt.exe PID 580 wrote to memory of 2804 580 nbplb.exe jtpbnpt.exe PID 580 wrote to memory of 2804 580 nbplb.exe jtpbnpt.exe PID 580 wrote to memory of 2804 580 nbplb.exe jtpbnpt.exe PID 2804 wrote to memory of 2868 2804 jtpbnpt.exe jdpdvl.exe PID 2804 wrote to memory of 2868 2804 jtpbnpt.exe jdpdvl.exe PID 2804 wrote to memory of 2868 2804 jtpbnpt.exe jdpdvl.exe PID 2804 wrote to memory of 2868 2804 jtpbnpt.exe jdpdvl.exe PID 2868 wrote to memory of 900 2868 jdpdvl.exe dnrtn.exe PID 2868 wrote to memory of 900 2868 jdpdvl.exe dnrtn.exe PID 2868 wrote to memory of 900 2868 jdpdvl.exe dnrtn.exe PID 2868 wrote to memory of 900 2868 jdpdvl.exe dnrtn.exe PID 900 wrote to memory of 2908 900 dnrtn.exe rhltpxf.exe PID 900 wrote to memory of 2908 900 dnrtn.exe rhltpxf.exe PID 900 wrote to memory of 2908 900 dnrtn.exe rhltpxf.exe PID 900 wrote to memory of 2908 900 dnrtn.exe rhltpxf.exe PID 2908 wrote to memory of 2672 2908 rhltpxf.exe bntvv.exe PID 2908 wrote to memory of 2672 2908 rhltpxf.exe bntvv.exe PID 2908 wrote to memory of 2672 2908 rhltpxf.exe bntvv.exe PID 2908 wrote to memory of 2672 2908 rhltpxf.exe bntvv.exe PID 2672 wrote to memory of 2548 2672 bntvv.exe hbftdp.exe PID 2672 wrote to memory of 2548 2672 bntvv.exe hbftdp.exe PID 2672 wrote to memory of 2548 2672 bntvv.exe hbftdp.exe PID 2672 wrote to memory of 2548 2672 bntvv.exe hbftdp.exe PID 2548 wrote to memory of 2612 2548 hbftdp.exe hvvtv.exe PID 2548 wrote to memory of 2612 2548 hbftdp.exe hvvtv.exe PID 2548 wrote to memory of 2612 2548 hbftdp.exe hvvtv.exe PID 2548 wrote to memory of 2612 2548 hbftdp.exe hvvtv.exe PID 2612 wrote to memory of 2584 2612 hvvtv.exe tvddl.exe PID 2612 wrote to memory of 2584 2612 hvvtv.exe tvddl.exe PID 2612 wrote to memory of 2584 2612 hvvtv.exe tvddl.exe PID 2612 wrote to memory of 2584 2612 hvvtv.exe tvddl.exe PID 2584 wrote to memory of 2412 2584 tvddl.exe xhlbx.exe PID 2584 wrote to memory of 2412 2584 tvddl.exe xhlbx.exe PID 2584 wrote to memory of 2412 2584 tvddl.exe xhlbx.exe PID 2584 wrote to memory of 2412 2584 tvddl.exe xhlbx.exe PID 2412 wrote to memory of 2488 2412 xhlbx.exe nrvnn.exe PID 2412 wrote to memory of 2488 2412 xhlbx.exe nrvnn.exe PID 2412 wrote to memory of 2488 2412 xhlbx.exe nrvnn.exe PID 2412 wrote to memory of 2488 2412 xhlbx.exe nrvnn.exe PID 2488 wrote to memory of 2456 2488 nrvnn.exe xvhbld.exe PID 2488 wrote to memory of 2456 2488 nrvnn.exe xvhbld.exe PID 2488 wrote to memory of 2456 2488 nrvnn.exe xvhbld.exe PID 2488 wrote to memory of 2456 2488 nrvnn.exe xvhbld.exe PID 2456 wrote to memory of 2216 2456 ltjfnp.exe jtfpjxd.exe PID 2456 wrote to memory of 2216 2456 ltjfnp.exe jtfpjxd.exe PID 2456 wrote to memory of 2216 2456 ltjfnp.exe jtfpjxd.exe PID 2456 wrote to memory of 2216 2456 ltjfnp.exe jtfpjxd.exe PID 2216 wrote to memory of 1636 2216 jtfpjxd.exe xlvtp.exe PID 2216 wrote to memory of 1636 2216 jtfpjxd.exe xlvtp.exe PID 2216 wrote to memory of 1636 2216 jtfpjxd.exe xlvtp.exe PID 2216 wrote to memory of 1636 2216 jtfpjxd.exe xlvtp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb5d779c490d6a384905b42193355940_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\eb5d779c490d6a384905b42193355940_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\rjjltx.exec:\rjjltx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\dnnxnb.exec:\dnnxnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\nbplb.exec:\nbplb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\jtpbnpt.exec:\jtpbnpt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\jdpdvl.exec:\jdpdvl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\dnrtn.exec:\dnrtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\rhltpxf.exec:\rhltpxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\bntvv.exec:\bntvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\hbftdp.exec:\hbftdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\hvvtv.exec:\hvvtv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\tvddl.exec:\tvddl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\xhlbx.exec:\xhlbx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\nrvnn.exec:\nrvnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\ltjfnp.exec:\ltjfnp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\jtfpjxd.exec:\jtfpjxd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\xlvtp.exec:\xlvtp.exe17⤵
- Executes dropped EXE
PID:1636 -
\??\c:\lpfxdrp.exec:\lpfxdrp.exe18⤵
- Executes dropped EXE
PID:1976 -
\??\c:\xppfdt.exec:\xppfdt.exe19⤵
- Executes dropped EXE
PID:1760 -
\??\c:\hpfhxbr.exec:\hpfhxbr.exe20⤵
- Executes dropped EXE
PID:1564 -
\??\c:\pjhtf.exec:\pjhtf.exe21⤵
- Executes dropped EXE
PID:1628 -
\??\c:\ndtpf.exec:\ndtpf.exe22⤵
- Executes dropped EXE
PID:1428 -
\??\c:\jpltll.exec:\jpltll.exe23⤵
- Executes dropped EXE
PID:1804 -
\??\c:\rjjtx.exec:\rjjtx.exe24⤵
- Executes dropped EXE
PID:1712 -
\??\c:\xdpxxt.exec:\xdpxxt.exe25⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jdhlj.exec:\jdhlj.exe26⤵
- Executes dropped EXE
PID:1588 -
\??\c:\phftt.exec:\phftt.exe27⤵
- Executes dropped EXE
PID:1296 -
\??\c:\ttfpvj.exec:\ttfpvj.exe28⤵
- Executes dropped EXE
PID:1820 -
\??\c:\ffjpvp.exec:\ffjpvp.exe29⤵
- Executes dropped EXE
PID:936 -
\??\c:\xpjfhx.exec:\xpjfhx.exe30⤵
- Executes dropped EXE
PID:2132 -
\??\c:\dtjpppd.exec:\dtjpppd.exe31⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hhhhfvv.exec:\hhhhfvv.exe32⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jnlpvf.exec:\jnlpvf.exe33⤵
- Executes dropped EXE
PID:1688 -
\??\c:\fdfdlt.exec:\fdfdlt.exe34⤵
- Executes dropped EXE
PID:548 -
\??\c:\hpnrnv.exec:\hpnrnv.exe35⤵
- Executes dropped EXE
PID:2096 -
\??\c:\vldvn.exec:\vldvn.exe36⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xnvpftd.exec:\xnvpftd.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hrthxh.exec:\hrthxh.exe38⤵
- Executes dropped EXE
PID:2876 -
\??\c:\bpxxhnp.exec:\bpxxhnp.exe39⤵
- Executes dropped EXE
PID:2940 -
\??\c:\jxvptb.exec:\jxvptb.exe40⤵
- Executes dropped EXE
PID:2792 -
\??\c:\fvrtd.exec:\fvrtd.exe41⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hbjttl.exec:\hbjttl.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\nvjdn.exec:\nvjdn.exe43⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bjvpl.exec:\bjvpl.exe44⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lbxfhtv.exec:\lbxfhtv.exe45⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pfdprp.exec:\pfdprp.exe46⤵
- Executes dropped EXE
PID:2644 -
\??\c:\frxxjdv.exec:\frxxjdv.exe47⤵
- Executes dropped EXE
PID:2524 -
\??\c:\tjhxpp.exec:\tjhxpp.exe48⤵
- Executes dropped EXE
PID:2624 -
\??\c:\fnrhvn.exec:\fnrhvn.exe49⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jlvhhv.exec:\jlvhhv.exe50⤵
- Executes dropped EXE
PID:2280 -
\??\c:\nrpxdp.exec:\nrpxdp.exe51⤵
- Executes dropped EXE
PID:2480 -
\??\c:\tftbv.exec:\tftbv.exe52⤵
- Executes dropped EXE
PID:2464 -
\??\c:\fvhjh.exec:\fvhjh.exe53⤵
- Executes dropped EXE
PID:2384 -
\??\c:\xvhbld.exec:\xvhbld.exe54⤵
- Executes dropped EXE
PID:2456 -
\??\c:\tbjtpp.exec:\tbjtpp.exe55⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rtjlp.exec:\rtjlp.exe56⤵
- Executes dropped EXE
PID:1692 -
\??\c:\htvddp.exec:\htvddp.exe57⤵
- Executes dropped EXE
PID:2336 -
\??\c:\djhfj.exec:\djhfj.exe58⤵
- Executes dropped EXE
PID:1976 -
\??\c:\jvrbnr.exec:\jvrbnr.exe59⤵
- Executes dropped EXE
PID:1764 -
\??\c:\xnjnxf.exec:\xnjnxf.exe60⤵
- Executes dropped EXE
PID:2020 -
\??\c:\tfpvlxb.exec:\tfpvlxb.exe61⤵
- Executes dropped EXE
PID:1060 -
\??\c:\rtffjd.exec:\rtffjd.exe62⤵
- Executes dropped EXE
PID:2008 -
\??\c:\htljf.exec:\htljf.exe63⤵
- Executes dropped EXE
PID:1096 -
\??\c:\dvjhx.exec:\dvjhx.exe64⤵
- Executes dropped EXE
PID:1804 -
\??\c:\fdvnxx.exec:\fdvnxx.exe65⤵
- Executes dropped EXE
PID:832 -
\??\c:\pxldpbp.exec:\pxldpbp.exe66⤵PID:972
-
\??\c:\txltn.exec:\txltn.exe67⤵PID:1880
-
\??\c:\tddbnhn.exec:\tddbnhn.exe68⤵PID:1588
-
\??\c:\jvdjxnb.exec:\jvdjxnb.exe69⤵PID:1316
-
\??\c:\vltrdh.exec:\vltrdh.exe70⤵PID:1232
-
\??\c:\hbflvtx.exec:\hbflvtx.exe71⤵PID:760
-
\??\c:\ndntt.exec:\ndntt.exe72⤵PID:1584
-
\??\c:\fvtjpbf.exec:\fvtjpbf.exe73⤵PID:2984
-
\??\c:\rxjnr.exec:\rxjnr.exe74⤵PID:1752
-
\??\c:\rlxhxjx.exec:\rlxhxjx.exe75⤵PID:2728
-
\??\c:\xxvfx.exec:\xxvfx.exe76⤵PID:784
-
\??\c:\lvntllp.exec:\lvntllp.exe77⤵PID:668
-
\??\c:\hjhxbj.exec:\hjhxbj.exe78⤵PID:2084
-
\??\c:\ldjlfvx.exec:\ldjlfvx.exe79⤵PID:2948
-
\??\c:\pbnlvj.exec:\pbnlvj.exe80⤵PID:2748
-
\??\c:\hfplrt.exec:\hfplrt.exe81⤵PID:2864
-
\??\c:\xpdnj.exec:\xpdnj.exe82⤵PID:1572
-
\??\c:\xnbprn.exec:\xnbprn.exe83⤵PID:2824
-
\??\c:\rhljrr.exec:\rhljrr.exe84⤵PID:588
-
\??\c:\fbjphb.exec:\fbjphb.exe85⤵PID:2900
-
\??\c:\xbnxxfb.exec:\xbnxxfb.exe86⤵PID:2632
-
\??\c:\vlddf.exec:\vlddf.exe87⤵PID:2992
-
\??\c:\xlhxlf.exec:\xlhxlf.exe88⤵PID:2756
-
\??\c:\fpdrpx.exec:\fpdrpx.exe89⤵PID:2532
-
\??\c:\drxxpn.exec:\drxxpn.exe90⤵PID:2440
-
\??\c:\pvdjt.exec:\pvdjt.exe91⤵PID:2612
-
\??\c:\lnjtxv.exec:\lnjtxv.exe92⤵PID:2424
-
\??\c:\dntdfd.exec:\dntdfd.exe93⤵PID:2852
-
\??\c:\ndjdfv.exec:\ndjdfv.exe94⤵PID:2492
-
\??\c:\lxhrpj.exec:\lxhrpj.exe95⤵PID:2996
-
\??\c:\rlhlbj.exec:\rlhlbj.exe96⤵PID:2384
-
\??\c:\prdnbjb.exec:\prdnbjb.exe97⤵PID:1964
-
\??\c:\htfjp.exec:\htfjp.exe98⤵PID:2204
-
\??\c:\vrbtp.exec:\vrbtp.exe99⤵PID:1684
-
\??\c:\tdxbnpj.exec:\tdxbnpj.exe100⤵PID:1764
-
\??\c:\hfdpl.exec:\hfdpl.exe101⤵PID:1616
-
\??\c:\pvvjxjx.exec:\pvvjxjx.exe102⤵PID:2388
-
\??\c:\lhbhfbh.exec:\lhbhfbh.exe103⤵PID:1884
-
\??\c:\lbfxlxr.exec:\lbfxlxr.exe104⤵PID:1776
-
\??\c:\dldhf.exec:\dldhf.exe105⤵PID:2340
-
\??\c:\hfhxfvn.exec:\hfhxfvn.exe106⤵PID:832
-
\??\c:\lpnjlj.exec:\lpnjlj.exe107⤵PID:1324
-
\??\c:\xpfbjvh.exec:\xpfbjvh.exe108⤵PID:1880
-
\??\c:\rbfxb.exec:\rbfxb.exe109⤵PID:2452
-
\??\c:\hpvtnp.exec:\hpvtnp.exe110⤵PID:1156
-
\??\c:\fblrl.exec:\fblrl.exe111⤵PID:2040
-
\??\c:\bphpv.exec:\bphpv.exe112⤵PID:760
-
\??\c:\jtbrh.exec:\jtbrh.exe113⤵PID:388
-
\??\c:\nnrtjn.exec:\nnrtjn.exe114⤵PID:2984
-
\??\c:\bnnfp.exec:\bnnfp.exe115⤵PID:2604
-
\??\c:\tvfhj.exec:\tvfhj.exe116⤵PID:3016
-
\??\c:\dprjxvn.exec:\dprjxvn.exe117⤵PID:1164
-
\??\c:\dnlnr.exec:\dnlnr.exe118⤵PID:1332
-
\??\c:\ttjvjfp.exec:\ttjvjfp.exe119⤵PID:1724
-
\??\c:\djnrl.exec:\djnrl.exe120⤵PID:2396
-
\??\c:\pplxb.exec:\pplxb.exe121⤵PID:988
-
\??\c:\rtjbnt.exec:\rtjbnt.exe122⤵PID:2272
-
\??\c:\lfbhxdd.exec:\lfbhxdd.exe123⤵PID:2864
-
\??\c:\hpbpl.exec:\hpbpl.exe124⤵PID:2872
-
\??\c:\fpjtdtx.exec:\fpjtdtx.exe125⤵PID:2824
-
\??\c:\fblnrnp.exec:\fblnrnp.exe126⤵PID:2744
-
\??\c:\pblll.exec:\pblll.exe127⤵PID:2868
-
\??\c:\xblhx.exec:\xblhx.exe128⤵PID:1360
-
\??\c:\ptnpjv.exec:\ptnpjv.exe129⤵PID:2988
-
\??\c:\bjbtn.exec:\bjbtn.exe130⤵PID:2568
-
\??\c:\hvfrh.exec:\hvfrh.exe131⤵PID:2548
-
\??\c:\phdltd.exec:\phdltd.exe132⤵PID:2752
-
\??\c:\ppvrhp.exec:\ppvrhp.exe133⤵PID:2760
-
\??\c:\lrlnnrn.exec:\lrlnnrn.exe134⤵PID:2412
-
\??\c:\pfbvl.exec:\pfbvl.exe135⤵PID:2852
-
\??\c:\xvvphlb.exec:\xvvphlb.exe136⤵PID:2076
-
\??\c:\rplhr.exec:\rplhr.exe137⤵PID:1264
-
\??\c:\bfhnnrr.exec:\bfhnnrr.exe138⤵PID:2844
-
\??\c:\tlblblr.exec:\tlblblr.exe139⤵PID:1964
-
\??\c:\pfdjjn.exec:\pfdjjn.exe140⤵PID:928
-
\??\c:\jnxffv.exec:\jnxffv.exe141⤵PID:1656
-
\??\c:\drnfn.exec:\drnfn.exe142⤵PID:1660
-
\??\c:\vflhvxf.exec:\vflhvxf.exe143⤵PID:1424
-
\??\c:\dnxxbx.exec:\dnxxbx.exe144⤵PID:2388
-
\??\c:\npdldt.exec:\npdldt.exe145⤵PID:440
-
\??\c:\rxthxpf.exec:\rxthxpf.exe146⤵PID:1776
-
\??\c:\blxvxb.exec:\blxvxb.exe147⤵PID:828
-
\??\c:\plhftvb.exec:\plhftvb.exe148⤵PID:832
-
\??\c:\lpxjhl.exec:\lpxjhl.exe149⤵PID:1324
-
\??\c:\nttnplt.exec:\nttnplt.exe150⤵PID:1968
-
\??\c:\tdttfdx.exec:\tdttfdx.exe151⤵PID:1796
-
\??\c:\rflrpt.exec:\rflrpt.exe152⤵PID:1156
-
\??\c:\lfdvhn.exec:\lfdvhn.exe153⤵PID:2720
-
\??\c:\tpphr.exec:\tpphr.exe154⤵PID:796
-
\??\c:\dlrfp.exec:\dlrfp.exe155⤵PID:3044
-
\??\c:\dtrfxt.exec:\dtrfxt.exe156⤵PID:1592
-
\??\c:\lnvfhxf.exec:\lnvfhxf.exe157⤵PID:2604
-
\??\c:\rtpbph.exec:\rtpbph.exe158⤵PID:784
-
\??\c:\nxjdf.exec:\nxjdf.exe159⤵PID:3020
-
\??\c:\rpttptx.exec:\rpttptx.exe160⤵PID:1332
-
\??\c:\thtbhxn.exec:\thtbhxn.exe161⤵PID:1108
-
\??\c:\bpxnjh.exec:\bpxnjh.exe162⤵PID:2396
-
\??\c:\rvllndl.exec:\rvllndl.exe163⤵PID:988
-
\??\c:\pxfjvv.exec:\pxfjvv.exe164⤵PID:2272
-
\??\c:\jvvvhdt.exec:\jvvvhdt.exe165⤵PID:1568
-
\??\c:\nnbxdr.exec:\nnbxdr.exe166⤵PID:2872
-
\??\c:\vprbv.exec:\vprbv.exe167⤵PID:588
-
\??\c:\nbxxv.exec:\nbxxv.exe168⤵PID:2744
-
\??\c:\hdpllj.exec:\hdpllj.exe169⤵PID:2908
-
\??\c:\pthrln.exec:\pthrln.exe170⤵PID:1360
-
\??\c:\txlxppx.exec:\txlxppx.exe171⤵PID:2520
-
\??\c:\lrrpvv.exec:\lrrpvv.exe172⤵PID:2568
-
\??\c:\fnjvt.exec:\fnjvt.exe173⤵PID:2460
-
\??\c:\xhhjh.exec:\xhhjh.exe174⤵PID:2440
-
\??\c:\hljxrt.exec:\hljxrt.exe175⤵PID:2424
-
\??\c:\bnhdbh.exec:\bnhdbh.exe176⤵PID:2964
-
\??\c:\xhhxppp.exec:\xhhxppp.exe177⤵PID:2224
-
\??\c:\rlptbtn.exec:\rlptbtn.exe178⤵PID:2076
-
\??\c:\rnthfxp.exec:\rnthfxp.exe179⤵PID:2228
-
\??\c:\nxjbxvh.exec:\nxjbxvh.exe180⤵PID:2164
-
\??\c:\dphbbx.exec:\dphbbx.exe181⤵PID:624
-
\??\c:\dxdxd.exec:\dxdxd.exe182⤵PID:1648
-
\??\c:\lpnpv.exec:\lpnpv.exe183⤵PID:1764
-
\??\c:\bnvhfnp.exec:\bnvhfnp.exe184⤵PID:1616
-
\??\c:\vvhdfvf.exec:\vvhdfvf.exe185⤵PID:1812
-
\??\c:\pfhlvdd.exec:\pfhlvdd.exe186⤵PID:2388
-
\??\c:\pphdt.exec:\pphdt.exe187⤵PID:440
-
\??\c:\ddbjx.exec:\ddbjx.exe188⤵PID:1776
-
\??\c:\nrtfnfd.exec:\nrtfnfd.exe189⤵PID:828
-
\??\c:\dvfllrt.exec:\dvfllrt.exe190⤵PID:972
-
\??\c:\blnjdb.exec:\blnjdb.exe191⤵PID:892
-
\??\c:\txhhvb.exec:\txhhvb.exe192⤵PID:1820
-
\??\c:\lltjnh.exec:\lltjnh.exe193⤵PID:1816
-
\??\c:\nldjln.exec:\nldjln.exe194⤵PID:1768
-
\??\c:\vbftjff.exec:\vbftjff.exe195⤵PID:2400
-
\??\c:\htdjd.exec:\htdjd.exe196⤵PID:796
-
\??\c:\dxvxt.exec:\dxvxt.exe197⤵PID:2004
-
\??\c:\xpvxv.exec:\xpvxv.exe198⤵PID:324
-
\??\c:\xjvjxln.exec:\xjvjxln.exe199⤵PID:1364
-
\??\c:\fntdjtp.exec:\fntdjtp.exe200⤵PID:784
-
\??\c:\pftrb.exec:\pftrb.exe201⤵PID:2108
-
\??\c:\rnpddvt.exec:\rnpddvt.exe202⤵PID:1008
-
\??\c:\fdrpdjp.exec:\fdrpdjp.exe203⤵PID:1108
-
\??\c:\fjpfvr.exec:\fjpfvr.exe204⤵PID:2396
-
\??\c:\ffffn.exec:\ffffn.exe205⤵PID:988
-
\??\c:\dvhnfvx.exec:\dvhnfvx.exe206⤵PID:1572
-
\??\c:\lvntn.exec:\lvntn.exe207⤵PID:1568
-
\??\c:\lrjtxv.exec:\lrjtxv.exe208⤵PID:2872
-
\??\c:\tbhffjp.exec:\tbhffjp.exe209⤵PID:588
-
\??\c:\dpnvpf.exec:\dpnvpf.exe210⤵PID:2744
-
\??\c:\nnrvn.exec:\nnrvn.exe211⤵PID:2908
-
\??\c:\hdxprb.exec:\hdxprb.exe212⤵PID:3068
-
\??\c:\rxvdndx.exec:\rxvdndx.exe213⤵PID:2588
-
\??\c:\vvpbxlr.exec:\vvpbxlr.exe214⤵PID:2120
-
\??\c:\xxbrr.exec:\xxbrr.exe215⤵PID:2468
-
\??\c:\hbpjjr.exec:\hbpjjr.exe216⤵PID:2752
-
\??\c:\dtrdxl.exec:\dtrdxl.exe217⤵PID:2280
-
\??\c:\jvplfb.exec:\jvplfb.exe218⤵PID:2488
-
\??\c:\httvpd.exec:\httvpd.exe219⤵PID:1944
-
\??\c:\dpdvltx.exec:\dpdvltx.exe220⤵PID:844
-
\??\c:\vfdxpr.exec:\vfdxpr.exe221⤵PID:924
-
\??\c:\rvdpxl.exec:\rvdpxl.exe222⤵PID:2164
-
\??\c:\djvrp.exec:\djvrp.exe223⤵PID:624
-
\??\c:\vdxtj.exec:\vdxtj.exe224⤵PID:1648
-
\??\c:\vdfpb.exec:\vdfpb.exe225⤵PID:1764
-
\??\c:\dhdllrd.exec:\dhdllrd.exe226⤵PID:1616
-
\??\c:\tbjtp.exec:\tbjtp.exe227⤵PID:1856
-
\??\c:\vtdvv.exec:\vtdvv.exe228⤵PID:2388
-
\??\c:\rvdnnr.exec:\rvdnnr.exe229⤵PID:1492
-
\??\c:\rnblj.exec:\rnblj.exe230⤵PID:1992
-
\??\c:\vjbjjth.exec:\vjbjjth.exe231⤵PID:1808
-
\??\c:\jnlrf.exec:\jnlrf.exe232⤵PID:972
-
\??\c:\xhxvxv.exec:\xhxvxv.exe233⤵PID:892
-
\??\c:\dlrxjb.exec:\dlrxjb.exe234⤵PID:3000
-
\??\c:\fxjhff.exec:\fxjhff.exe235⤵PID:1816
-
\??\c:\pdnxjl.exec:\pdnxjl.exe236⤵PID:1768
-
\??\c:\vxlhvht.exec:\vxlhvht.exe237⤵PID:388
-
\??\c:\vpfbllv.exec:\vpfbllv.exe238⤵PID:780
-
\??\c:\flptfx.exec:\flptfx.exe239⤵PID:2004
-
\??\c:\httxn.exec:\httxn.exe240⤵PID:1688
-
\??\c:\jrhnhfp.exec:\jrhnhfp.exe241⤵PID:1364
-
\??\c:\ffxhpp.exec:\ffxhpp.exe242⤵PID:1640