Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 17:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2355242f54cb037e6f0b0b98238fb630_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2355242f54cb037e6f0b0b98238fb630_NeikiAnalytics.exe
-
Size
70KB
-
MD5
2355242f54cb037e6f0b0b98238fb630
-
SHA1
f1fdb0389c3feeb0015119a20261213b666bdc51
-
SHA256
8e56cc5658c169ecfaf9bd60e2989b127c6c35bc37fabc8589c869233e4ebb15
-
SHA512
ece1495beba30393a7946371fd8a8aa8cac7b887f3ad1df0a279d0ef19326ccc16cafdfa6c8e845493508fbde013f3e96d8f621ee92bea782de22732b9e610b7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7tAHEqSCkKWSO:ymb3NkkiQ3mdBjFIynIKO
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral1/memory/2648-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-17-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1316-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1456-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/980-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hdtpd.exexbrvjbf.exeldfvp.exedrfhn.exetfvxr.exefhjtdp.exejrpltlr.exebnhrln.exehdfjv.exexfjfxj.exelfpljf.exennnxv.exerbjvbf.exenbnvdj.exenjrpvfj.exevvtvfj.exedrbvp.exepftjbbl.exenpnbn.exebjvnnvt.exexrxrbf.exelptjhrd.exeptxxb.exefbhhxb.exenhlnln.exebpjppdb.exehhhbt.exebbxvh.exerldnl.exettndpv.exexvrlhp.exebjnrvjr.exerpxxd.exefhdtvjr.exefvxjj.exerdxtt.exefbffn.exeblflff.exehjdrjt.exejhbxd.exefjjfvnv.exepdhpbbp.exelnhhtb.exelnvhj.exeflrjd.exebrxfvvp.exerfvjljn.exefrbtxxr.exejtpvbtf.exexrlplj.exexjnrtln.exenjxjb.exeptnfnl.exendnxxx.exejtvfx.exevdbfnjp.exerlrxbnh.exetvjlb.exerdtlxn.exenrpnbl.exehrvfphb.exennhfbtn.exelrhrr.exexttnt.exepid process 2840 hdtpd.exe 3012 xbrvjbf.exe 2492 ldfvp.exe 2504 drfhn.exe 2644 tfvxr.exe 2528 fhjtdp.exe 2376 jrpltlr.exe 2412 bnhrln.exe 1028 hdfjv.exe 1316 xfjfxj.exe 2668 lfpljf.exe 2988 nnnxv.exe 932 rbjvbf.exe 1656 nbnvdj.exe 1080 njrpvfj.exe 2272 vvtvfj.exe 1244 drbvp.exe 1704 pftjbbl.exe 2220 npnbn.exe 524 bjvnnvt.exe 2712 xrxrbf.exe 1060 lptjhrd.exe 2916 ptxxb.exe 1456 fbhhxb.exe 980 nhlnln.exe 1684 bpjppdb.exe 1088 hhhbt.exe 3040 bbxvh.exe 1760 rldnl.exe 2180 ttndpv.exe 1696 xvrlhp.exe 1036 bjnrvjr.exe 2840 rpxxd.exe 1572 fhdtvjr.exe 2996 fvxjj.exe 2508 rdxtt.exe 2580 fbffn.exe 2520 blflff.exe 2524 hjdrjt.exe 2504 jhbxd.exe 2644 fjjfvnv.exe 2384 pdhpbbp.exe 2484 lnhhtb.exe 2380 lnvhj.exe 2412 flrjd.exe 1816 brxfvvp.exe 1440 rfvjljn.exe 2616 frbtxxr.exe 2760 jtpvbtf.exe 2900 xrlplj.exe 1740 xjnrtln.exe 1928 njxjb.exe 1948 ptnfnl.exe 804 ndnxxx.exe 1972 jtvfx.exe 2272 vdbfnjp.exe 2456 rlrxbnh.exe 1604 tvjlb.exe 2720 rdtlxn.exe 2144 nrpnbl.exe 2244 hrvfphb.exe 2732 nnhfbtn.exe 2952 lrhrr.exe 1964 xttnt.exe -
Processes:
resource yara_rule behavioral1/memory/2648-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1316-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1456-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-312-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2355242f54cb037e6f0b0b98238fb630_NeikiAnalytics.exehdtpd.exexbrvjbf.exeldfvp.exedrfhn.exetfvxr.exefhjtdp.exejrpltlr.exebnhrln.exehdfjv.exexfjfxj.exelfpljf.exennnxv.exerbjvbf.exenbnvdj.exenjrpvfj.exedescription pid process target process PID 2648 wrote to memory of 2840 2648 2355242f54cb037e6f0b0b98238fb630_NeikiAnalytics.exe hdtpd.exe PID 2648 wrote to memory of 2840 2648 2355242f54cb037e6f0b0b98238fb630_NeikiAnalytics.exe hdtpd.exe PID 2648 wrote to memory of 2840 2648 2355242f54cb037e6f0b0b98238fb630_NeikiAnalytics.exe hdtpd.exe PID 2648 wrote to memory of 2840 2648 2355242f54cb037e6f0b0b98238fb630_NeikiAnalytics.exe hdtpd.exe PID 2840 wrote to memory of 3012 2840 hdtpd.exe xbrvjbf.exe PID 2840 wrote to memory of 3012 2840 hdtpd.exe xbrvjbf.exe PID 2840 wrote to memory of 3012 2840 hdtpd.exe xbrvjbf.exe PID 2840 wrote to memory of 3012 2840 hdtpd.exe xbrvjbf.exe PID 3012 wrote to memory of 2492 3012 xbrvjbf.exe ldfvp.exe PID 3012 wrote to memory of 2492 3012 xbrvjbf.exe ldfvp.exe PID 3012 wrote to memory of 2492 3012 xbrvjbf.exe ldfvp.exe PID 3012 wrote to memory of 2492 3012 xbrvjbf.exe ldfvp.exe PID 2492 wrote to memory of 2504 2492 ldfvp.exe drfhn.exe PID 2492 wrote to memory of 2504 2492 ldfvp.exe drfhn.exe PID 2492 wrote to memory of 2504 2492 ldfvp.exe drfhn.exe PID 2492 wrote to memory of 2504 2492 ldfvp.exe drfhn.exe PID 2504 wrote to memory of 2644 2504 drfhn.exe tfvxr.exe PID 2504 wrote to memory of 2644 2504 drfhn.exe tfvxr.exe PID 2504 wrote to memory of 2644 2504 drfhn.exe tfvxr.exe PID 2504 wrote to memory of 2644 2504 drfhn.exe tfvxr.exe PID 2644 wrote to memory of 2528 2644 tfvxr.exe fhjtdp.exe PID 2644 wrote to memory of 2528 2644 tfvxr.exe fhjtdp.exe PID 2644 wrote to memory of 2528 2644 tfvxr.exe fhjtdp.exe PID 2644 wrote to memory of 2528 2644 tfvxr.exe fhjtdp.exe PID 2528 wrote to memory of 2376 2528 fhjtdp.exe jrpltlr.exe PID 2528 wrote to memory of 2376 2528 fhjtdp.exe jrpltlr.exe PID 2528 wrote to memory of 2376 2528 fhjtdp.exe jrpltlr.exe PID 2528 wrote to memory of 2376 2528 fhjtdp.exe jrpltlr.exe PID 2376 wrote to memory of 2412 2376 jrpltlr.exe bnhrln.exe PID 2376 wrote to memory of 2412 2376 jrpltlr.exe bnhrln.exe PID 2376 wrote to memory of 2412 2376 jrpltlr.exe bnhrln.exe PID 2376 wrote to memory of 2412 2376 jrpltlr.exe bnhrln.exe PID 2412 wrote to memory of 1028 2412 bnhrln.exe hdfjv.exe PID 2412 wrote to memory of 1028 2412 bnhrln.exe hdfjv.exe PID 2412 wrote to memory of 1028 2412 bnhrln.exe hdfjv.exe PID 2412 wrote to memory of 1028 2412 bnhrln.exe hdfjv.exe PID 1028 wrote to memory of 1316 1028 hdfjv.exe xfjfxj.exe PID 1028 wrote to memory of 1316 1028 hdfjv.exe xfjfxj.exe PID 1028 wrote to memory of 1316 1028 hdfjv.exe xfjfxj.exe PID 1028 wrote to memory of 1316 1028 hdfjv.exe xfjfxj.exe PID 1316 wrote to memory of 2668 1316 xfjfxj.exe lfpljf.exe PID 1316 wrote to memory of 2668 1316 xfjfxj.exe lfpljf.exe PID 1316 wrote to memory of 2668 1316 xfjfxj.exe lfpljf.exe PID 1316 wrote to memory of 2668 1316 xfjfxj.exe lfpljf.exe PID 2668 wrote to memory of 2988 2668 lfpljf.exe nnnxv.exe PID 2668 wrote to memory of 2988 2668 lfpljf.exe nnnxv.exe PID 2668 wrote to memory of 2988 2668 lfpljf.exe nnnxv.exe PID 2668 wrote to memory of 2988 2668 lfpljf.exe nnnxv.exe PID 2988 wrote to memory of 932 2988 nnnxv.exe rbjvbf.exe PID 2988 wrote to memory of 932 2988 nnnxv.exe rbjvbf.exe PID 2988 wrote to memory of 932 2988 nnnxv.exe rbjvbf.exe PID 2988 wrote to memory of 932 2988 nnnxv.exe rbjvbf.exe PID 932 wrote to memory of 1656 932 rbjvbf.exe nbnvdj.exe PID 932 wrote to memory of 1656 932 rbjvbf.exe nbnvdj.exe PID 932 wrote to memory of 1656 932 rbjvbf.exe nbnvdj.exe PID 932 wrote to memory of 1656 932 rbjvbf.exe nbnvdj.exe PID 1656 wrote to memory of 1080 1656 nbnvdj.exe njrpvfj.exe PID 1656 wrote to memory of 1080 1656 nbnvdj.exe njrpvfj.exe PID 1656 wrote to memory of 1080 1656 nbnvdj.exe njrpvfj.exe PID 1656 wrote to memory of 1080 1656 nbnvdj.exe njrpvfj.exe PID 1080 wrote to memory of 2272 1080 njrpvfj.exe vvtvfj.exe PID 1080 wrote to memory of 2272 1080 njrpvfj.exe vvtvfj.exe PID 1080 wrote to memory of 2272 1080 njrpvfj.exe vvtvfj.exe PID 1080 wrote to memory of 2272 1080 njrpvfj.exe vvtvfj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2355242f54cb037e6f0b0b98238fb630_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2355242f54cb037e6f0b0b98238fb630_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hdtpd.exec:\hdtpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\xbrvjbf.exec:\xbrvjbf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\ldfvp.exec:\ldfvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\drfhn.exec:\drfhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\tfvxr.exec:\tfvxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\fhjtdp.exec:\fhjtdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\jrpltlr.exec:\jrpltlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\bnhrln.exec:\bnhrln.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\hdfjv.exec:\hdfjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\xfjfxj.exec:\xfjfxj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\lfpljf.exec:\lfpljf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\nnnxv.exec:\nnnxv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\rbjvbf.exec:\rbjvbf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\nbnvdj.exec:\nbnvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\njrpvfj.exec:\njrpvfj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\vvtvfj.exec:\vvtvfj.exe17⤵
- Executes dropped EXE
PID:2272 -
\??\c:\drbvp.exec:\drbvp.exe18⤵
- Executes dropped EXE
PID:1244 -
\??\c:\pftjbbl.exec:\pftjbbl.exe19⤵
- Executes dropped EXE
PID:1704 -
\??\c:\npnbn.exec:\npnbn.exe20⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bjvnnvt.exec:\bjvnnvt.exe21⤵
- Executes dropped EXE
PID:524 -
\??\c:\xrxrbf.exec:\xrxrbf.exe22⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lptjhrd.exec:\lptjhrd.exe23⤵
- Executes dropped EXE
PID:1060 -
\??\c:\ptxxb.exec:\ptxxb.exe24⤵
- Executes dropped EXE
PID:2916 -
\??\c:\fbhhxb.exec:\fbhhxb.exe25⤵
- Executes dropped EXE
PID:1456 -
\??\c:\nhlnln.exec:\nhlnln.exe26⤵
- Executes dropped EXE
PID:980 -
\??\c:\bpjppdb.exec:\bpjppdb.exe27⤵
- Executes dropped EXE
PID:1684 -
\??\c:\hhhbt.exec:\hhhbt.exe28⤵
- Executes dropped EXE
PID:1088 -
\??\c:\bbxvh.exec:\bbxvh.exe29⤵
- Executes dropped EXE
PID:3040 -
\??\c:\rldnl.exec:\rldnl.exe30⤵
- Executes dropped EXE
PID:1760 -
\??\c:\ttndpv.exec:\ttndpv.exe31⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xvrlhp.exec:\xvrlhp.exe32⤵
- Executes dropped EXE
PID:1696 -
\??\c:\bjnrvjr.exec:\bjnrvjr.exe33⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rpxxd.exec:\rpxxd.exe34⤵
- Executes dropped EXE
PID:2840 -
\??\c:\fhdtvjr.exec:\fhdtvjr.exe35⤵
- Executes dropped EXE
PID:1572 -
\??\c:\fvxjj.exec:\fvxjj.exe36⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rdxtt.exec:\rdxtt.exe37⤵
- Executes dropped EXE
PID:2508 -
\??\c:\fbffn.exec:\fbffn.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\blflff.exec:\blflff.exe39⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hjdrjt.exec:\hjdrjt.exe40⤵
- Executes dropped EXE
PID:2524 -
\??\c:\jhbxd.exec:\jhbxd.exe41⤵
- Executes dropped EXE
PID:2504 -
\??\c:\fjjfvnv.exec:\fjjfvnv.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\pdhpbbp.exec:\pdhpbbp.exe43⤵
- Executes dropped EXE
PID:2384 -
\??\c:\lnhhtb.exec:\lnhhtb.exe44⤵
- Executes dropped EXE
PID:2484 -
\??\c:\lnvhj.exec:\lnvhj.exe45⤵
- Executes dropped EXE
PID:2380 -
\??\c:\flrjd.exec:\flrjd.exe46⤵
- Executes dropped EXE
PID:2412 -
\??\c:\brxfvvp.exec:\brxfvvp.exe47⤵
- Executes dropped EXE
PID:1816 -
\??\c:\rfvjljn.exec:\rfvjljn.exe48⤵
- Executes dropped EXE
PID:1440 -
\??\c:\frbtxxr.exec:\frbtxxr.exe49⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jtpvbtf.exec:\jtpvbtf.exe50⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xrlplj.exec:\xrlplj.exe51⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xjnrtln.exec:\xjnrtln.exe52⤵
- Executes dropped EXE
PID:1740 -
\??\c:\njxjb.exec:\njxjb.exe53⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ptnfnl.exec:\ptnfnl.exe54⤵
- Executes dropped EXE
PID:1948 -
\??\c:\ndnxxx.exec:\ndnxxx.exe55⤵
- Executes dropped EXE
PID:804 -
\??\c:\jtvfx.exec:\jtvfx.exe56⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vdbfnjp.exec:\vdbfnjp.exe57⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rlrxbnh.exec:\rlrxbnh.exe58⤵
- Executes dropped EXE
PID:2456 -
\??\c:\tvjlb.exec:\tvjlb.exe59⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rdtlxn.exec:\rdtlxn.exe60⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nrpnbl.exec:\nrpnbl.exe61⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hrvfphb.exec:\hrvfphb.exe62⤵
- Executes dropped EXE
PID:2244 -
\??\c:\nnhfbtn.exec:\nnhfbtn.exe63⤵
- Executes dropped EXE
PID:2732 -
\??\c:\lrhrr.exec:\lrhrr.exe64⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xttnt.exec:\xttnt.exe65⤵
- Executes dropped EXE
PID:1964 -
\??\c:\dxxtxjn.exec:\dxxtxjn.exe66⤵PID:484
-
\??\c:\lbdljj.exec:\lbdljj.exe67⤵PID:1168
-
\??\c:\fxbtbhh.exec:\fxbtbhh.exe68⤵PID:1528
-
\??\c:\hldvhx.exec:\hldvhx.exe69⤵PID:1664
-
\??\c:\ffvxj.exec:\ffvxj.exe70⤵PID:596
-
\??\c:\xbpjndb.exec:\xbpjndb.exe71⤵PID:2032
-
\??\c:\hvllrb.exec:\hvllrb.exe72⤵PID:1644
-
\??\c:\ppdpv.exec:\ppdpv.exe73⤵PID:2188
-
\??\c:\nvpnjpd.exec:\nvpnjpd.exe74⤵PID:872
-
\??\c:\tvhnddx.exec:\tvhnddx.exe75⤵PID:2316
-
\??\c:\tpxdhbj.exec:\tpxdhbj.exe76⤵PID:2688
-
\??\c:\nnlpjr.exec:\nnlpjr.exe77⤵PID:3000
-
\??\c:\rdxhn.exec:\rdxhn.exe78⤵PID:2844
-
\??\c:\rftrlvj.exec:\rftrlvj.exe79⤵PID:2984
-
\??\c:\ddbthfd.exec:\ddbthfd.exe80⤵PID:2556
-
\??\c:\xlpdbtt.exec:\xlpdbtt.exe81⤵PID:2628
-
\??\c:\jxfndrd.exec:\jxfndrd.exe82⤵PID:2580
-
\??\c:\vjjfd.exec:\vjjfd.exe83⤵PID:2548
-
\??\c:\xlfbhx.exec:\xlfbhx.exe84⤵PID:2620
-
\??\c:\nnpdjjb.exec:\nnpdjjb.exe85⤵PID:2324
-
\??\c:\jnthvnp.exec:\jnthvnp.exe86⤵PID:2644
-
\??\c:\bfvbxfv.exec:\bfvbxfv.exe87⤵PID:2364
-
\??\c:\xxvxpv.exec:\xxvxpv.exe88⤵PID:2160
-
\??\c:\xxlpr.exec:\xxlpr.exe89⤵PID:2784
-
\??\c:\btllhnb.exec:\btllhnb.exe90⤵PID:1200
-
\??\c:\rhplff.exec:\rhplff.exe91⤵PID:1028
-
\??\c:\bpbdl.exec:\bpbdl.exe92⤵PID:2672
-
\??\c:\lbvfbr.exec:\lbvfbr.exe93⤵PID:1524
-
\??\c:\dfldxbl.exec:\dfldxbl.exe94⤵PID:2980
-
\??\c:\jfrnfb.exec:\jfrnfb.exe95⤵PID:1776
-
\??\c:\rnfhh.exec:\rnfhh.exe96⤵PID:1976
-
\??\c:\bljhpr.exec:\bljhpr.exe97⤵PID:932
-
\??\c:\xbjbnxr.exec:\xbjbnxr.exe98⤵PID:1932
-
\??\c:\rfvrvpn.exec:\rfvrvpn.exe99⤵PID:1544
-
\??\c:\jjxrprh.exec:\jjxrprh.exe100⤵PID:2092
-
\??\c:\bphbnt.exec:\bphbnt.exe101⤵PID:1972
-
\??\c:\nvblff.exec:\nvblff.exe102⤵PID:2076
-
\??\c:\ptlfxt.exec:\ptlfxt.exe103⤵PID:1992
-
\??\c:\bfhdtvx.exec:\bfhdtvx.exe104⤵PID:592
-
\??\c:\jjrlfr.exec:\jjrlfr.exe105⤵PID:2720
-
\??\c:\bfpxhb.exec:\bfpxhb.exe106⤵PID:2876
-
\??\c:\vnpxdxl.exec:\vnpxdxl.exe107⤵PID:436
-
\??\c:\jphbhbn.exec:\jphbhbn.exe108⤵PID:1060
-
\??\c:\fbltpx.exec:\fbltpx.exe109⤵PID:2928
-
\??\c:\pfhvvdt.exec:\pfhvvdt.exe110⤵PID:1540
-
\??\c:\ltxpvnr.exec:\ltxpvnr.exe111⤵PID:976
-
\??\c:\fftnvpj.exec:\fftnvpj.exe112⤵PID:3036
-
\??\c:\brdvdbl.exec:\brdvdbl.exe113⤵PID:1528
-
\??\c:\bvjpfjl.exec:\bvjpfjl.exe114⤵PID:1092
-
\??\c:\rpvpppv.exec:\rpvpppv.exe115⤵PID:596
-
\??\c:\btvdrp.exec:\btvdrp.exe116⤵PID:1900
-
\??\c:\jltrljv.exec:\jltrljv.exe117⤵PID:1140
-
\??\c:\rhprbhv.exec:\rhprbhv.exe118⤵PID:2748
-
\??\c:\hbhfjb.exec:\hbhfjb.exe119⤵PID:2648
-
\??\c:\nflpfrd.exec:\nflpfrd.exe120⤵PID:3016
-
\??\c:\rhhvt.exec:\rhhvt.exe121⤵PID:2884
-
\??\c:\rblnn.exec:\rblnn.exe122⤵PID:1572
-
\??\c:\ljddrj.exec:\ljddrj.exe123⤵PID:2996
-
\??\c:\rdjdr.exec:\rdjdr.exe124⤵PID:2584
-
\??\c:\rbxhjxp.exec:\rbxhjxp.exe125⤵PID:2576
-
\??\c:\rpxfjdf.exec:\rpxfjdf.exe126⤵PID:2608
-
\??\c:\bnhlrp.exec:\bnhlrp.exe127⤵PID:2388
-
\??\c:\vdnhbp.exec:\vdnhbp.exe128⤵PID:2416
-
\??\c:\dbppbr.exec:\dbppbr.exe129⤵PID:2432
-
\??\c:\fjhblt.exec:\fjhblt.exe130⤵PID:2636
-
\??\c:\jhppff.exec:\jhppff.exe131⤵PID:1640
-
\??\c:\rhfpr.exec:\rhfpr.exe132⤵PID:1276
-
\??\c:\nbpbn.exec:\nbpbn.exe133⤵PID:1076
-
\??\c:\btnxft.exec:\btnxft.exe134⤵PID:1016
-
\??\c:\hjjbxv.exec:\hjjbxv.exe135⤵PID:2464
-
\??\c:\fhthd.exec:\fhthd.exe136⤵PID:2740
-
\??\c:\pdnlr.exec:\pdnlr.exe137⤵PID:1896
-
\??\c:\bxhljv.exec:\bxhljv.exe138⤵PID:1768
-
\??\c:\pthxjr.exec:\pthxjr.exe139⤵PID:2988
-
\??\c:\rxbdn.exec:\rxbdn.exe140⤵PID:2336
-
\??\c:\vlptbh.exec:\vlptbh.exe141⤵PID:1652
-
\??\c:\hxtjbp.exec:\hxtjbp.exe142⤵PID:2148
-
\??\c:\jlhxvd.exec:\jlhxvd.exe143⤵PID:828
-
\??\c:\dljnn.exec:\dljnn.exe144⤵PID:1412
-
\??\c:\xnpjnl.exec:\xnpjnl.exe145⤵PID:2236
-
\??\c:\jjllf.exec:\jjllf.exe146⤵PID:2096
-
\??\c:\ntlhh.exec:\ntlhh.exe147⤵PID:2724
-
\??\c:\hfvfdxj.exec:\hfvfdxj.exe148⤵PID:584
-
\??\c:\nvfnjft.exec:\nvfnjft.exe149⤵PID:896
-
\??\c:\bnnbp.exec:\bnnbp.exe150⤵PID:696
-
\??\c:\hbrvlt.exec:\hbrvlt.exe151⤵PID:2892
-
\??\c:\vxftrrt.exec:\vxftrrt.exe152⤵PID:1424
-
\??\c:\bfdpbbf.exec:\bfdpbbf.exe153⤵PID:1064
-
\??\c:\rjltv.exec:\rjltv.exe154⤵PID:1084
-
\??\c:\jrtbn.exec:\jrtbn.exe155⤵PID:2252
-
\??\c:\dpjxjll.exec:\dpjxjll.exe156⤵PID:1252
-
\??\c:\hjxrrb.exec:\hjxrrb.exe157⤵PID:1088
-
\??\c:\bnfjhrf.exec:\bnfjhrf.exe158⤵PID:1552
-
\??\c:\prvpb.exec:\prvpb.exe159⤵PID:3068
-
\??\c:\xrdpdt.exec:\xrdpdt.exe160⤵PID:2280
-
\??\c:\lblpnf.exec:\lblpnf.exe161⤵PID:2180
-
\??\c:\xxfdpf.exec:\xxfdpf.exe162⤵PID:2544
-
\??\c:\ltrrr.exec:\ltrrr.exe163⤵PID:1592
-
\??\c:\nnfrp.exec:\nnfrp.exe164⤵PID:2852
-
\??\c:\bpjlxp.exec:\bpjlxp.exe165⤵PID:2848
-
\??\c:\ljjtbv.exec:\ljjtbv.exe166⤵PID:2572
-
\??\c:\prtfv.exec:\prtfv.exe167⤵PID:2508
-
\??\c:\jtnfnj.exec:\jtnfnj.exe168⤵PID:2704
-
\??\c:\nnhvh.exec:\nnhvh.exe169⤵PID:2520
-
\??\c:\hpbnjtn.exec:\hpbnjtn.exe170⤵PID:2676
-
\??\c:\lhpxl.exec:\lhpxl.exe171⤵PID:2504
-
\??\c:\thnblll.exec:\thnblll.exe172⤵PID:2600
-
\??\c:\xnvtn.exec:\xnvtn.exe173⤵PID:2976
-
\??\c:\dnnjhrr.exec:\dnnjhrr.exe174⤵PID:2164
-
\??\c:\rdtdprp.exec:\rdtdprp.exe175⤵PID:2376
-
\??\c:\dbxvv.exec:\dbxvv.exe176⤵PID:2772
-
\??\c:\pjpbr.exec:\pjpbr.exe177⤵PID:1272
-
\??\c:\tdnrrr.exec:\tdnrrr.exe178⤵PID:2540
-
\??\c:\xnxfbrf.exec:\xnxfbrf.exe179⤵PID:2292
-
\??\c:\dphvp.exec:\dphvp.exe180⤵PID:1580
-
\??\c:\lnftnj.exec:\lnftnj.exe181⤵PID:2760
-
\??\c:\drbjtpt.exec:\drbjtpt.exe182⤵PID:2680
-
\??\c:\lxvvlb.exec:\lxvvlb.exe183⤵PID:1936
-
\??\c:\blxft.exec:\blxft.exe184⤵PID:948
-
\??\c:\vxlvbxx.exec:\vxlvbxx.exe185⤵PID:2940
-
\??\c:\rbblv.exec:\rbblv.exe186⤵PID:2152
-
\??\c:\plvlh.exec:\plvlh.exe187⤵PID:1636
-
\??\c:\thjtbhx.exec:\thjtbhx.exe188⤵PID:1492
-
\??\c:\xddffp.exec:\xddffp.exe189⤵PID:2088
-
\??\c:\rrfpt.exec:\rrfpt.exe190⤵PID:2220
-
\??\c:\lfxlfjt.exec:\lfxlfjt.exe191⤵PID:268
-
\??\c:\dhjxpx.exec:\dhjxpx.exe192⤵PID:2172
-
\??\c:\pxtrb.exec:\pxtrb.exe193⤵PID:2720
-
\??\c:\rfrnbv.exec:\rfrnbv.exe194⤵PID:2876
-
\??\c:\fljnrhj.exec:\fljnrhj.exe195⤵PID:2304
-
\??\c:\ntlpx.exec:\ntlpx.exe196⤵PID:708
-
\??\c:\pvnftp.exec:\pvnftp.exe197⤵PID:1608
-
\??\c:\hfdhtt.exec:\hfdhtt.exe198⤵PID:980
-
\??\c:\ntptrf.exec:\ntptrf.exe199⤵PID:1160
-
\??\c:\nhlxbjb.exec:\nhlxbjb.exe200⤵PID:3036
-
\??\c:\vfjhpn.exec:\vfjhpn.exe201⤵PID:2204
-
\??\c:\tvhnjdt.exec:\tvhnjdt.exe202⤵PID:1092
-
\??\c:\jnxxx.exec:\jnxxx.exe203⤵PID:2112
-
\??\c:\vrnbbj.exec:\vrnbbj.exe204⤵PID:2196
-
\??\c:\tvvjrj.exec:\tvvjrj.exe205⤵PID:1696
-
\??\c:\fjfpb.exec:\fjfpb.exe206⤵PID:2864
-
\??\c:\njvlbb.exec:\njvlbb.exe207⤵PID:2832
-
\??\c:\vhrfbv.exec:\vhrfbv.exe208⤵PID:2992
-
\??\c:\dttvdxh.exec:\dttvdxh.exe209⤵PID:1600
-
\??\c:\lrfpbhb.exec:\lrfpbhb.exe210⤵PID:2964
-
\??\c:\pvbpnht.exec:\pvbpnht.exe211⤵PID:2492
-
\??\c:\jjdhxx.exec:\jjdhxx.exe212⤵PID:2104
-
\??\c:\rpjxb.exec:\rpjxb.exe213⤵PID:2640
-
\??\c:\jlvfnp.exec:\jlvfnp.exe214⤵PID:2500
-
\??\c:\bpltj.exec:\bpltj.exe215⤵PID:2388
-
\??\c:\jpxvffp.exec:\jpxvffp.exe216⤵PID:2416
-
\??\c:\tflbll.exec:\tflbll.exe217⤵PID:2432
-
\??\c:\rhfdjp.exec:\rhfdjp.exe218⤵PID:2636
-
\??\c:\vtbxlr.exec:\vtbxlr.exe219⤵PID:956
-
\??\c:\dbvnjdj.exec:\dbvnjdj.exe220⤵PID:2436
-
\??\c:\trvnjjd.exec:\trvnjjd.exe221⤵PID:588
-
\??\c:\dfpvrpl.exec:\dfpvrpl.exe222⤵PID:1028
-
\??\c:\brxrb.exec:\brxrb.exe223⤵PID:2540
-
\??\c:\dpthnjn.exec:\dpthnjn.exe224⤵PID:2288
-
\??\c:\tvptvx.exec:\tvptvx.exe225⤵PID:2616
-
\??\c:\fbjprf.exec:\fbjprf.exe226⤵PID:1776
-
\??\c:\xfjlpbl.exec:\xfjlpbl.exe227⤵PID:940
-
\??\c:\lhlpr.exec:\lhlpr.exe228⤵PID:1520
-
\??\c:\nlptjhf.exec:\nlptjhf.exe229⤵PID:1912
-
\??\c:\tfdffdv.exec:\tfdffdv.exe230⤵PID:1544
-
\??\c:\xdnbxrd.exec:\xdnbxrd.exe231⤵PID:828
-
\??\c:\lrjttvr.exec:\lrjttvr.exe232⤵PID:2012
-
\??\c:\lhrnhpv.exec:\lhrnhpv.exe233⤵PID:2084
-
\??\c:\jbjrnxd.exec:\jbjrnxd.exe234⤵PID:1604
-
\??\c:\hvntxxr.exec:\hvntxxr.exe235⤵PID:1704
-
\??\c:\jlrdjl.exec:\jlrdjl.exe236⤵PID:584
-
\??\c:\rrfrv.exec:\rrfrv.exe237⤵PID:3052
-
\??\c:\brtdh.exec:\brtdh.exe238⤵PID:2948
-
\??\c:\tvflndr.exec:\tvflndr.exe239⤵PID:2892
-
\??\c:\lfjbf.exec:\lfjbf.exe240⤵PID:1424
-
\??\c:\nrhrtb.exec:\nrhrtb.exe241⤵PID:1336
-
\??\c:\tdpjdnj.exec:\tdpjdnj.exe242⤵PID:1096