Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 22:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
533b9a60a49da46f7688d0590dca9930_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
533b9a60a49da46f7688d0590dca9930_NeikiAnalytics.exe
-
Size
94KB
-
MD5
533b9a60a49da46f7688d0590dca9930
-
SHA1
702a3c00cbc2f840326a4883d92cfdba4d0c1962
-
SHA256
ed3b9c6d9656ca1cc8c65a64fa68ec7d2f7ec18781aa86922890ae64523852e7
-
SHA512
4a970b4cacc18db3c17ac9b3e808d9e879472c23bb1110e6d7610d8197c2458cac0e5e8d4f9063e74d2f45294cc1f2fb9fc92beae3036a9db2958d69fd5ebc70
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTrx:ymb3NkkiQ3mdBjFIj+qNhvZuHQYfw4P
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral1/memory/2032-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1296-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/912-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/824-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1172-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1532-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/852-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-960-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rppxpx.exeprpdd.exefdxpdf.exetrdxn.exenxblntx.exevbfdhv.exelvrhlt.exehjjppnf.exebpvnxjh.exennjfl.exedpptxjx.exepnjpnt.exehjvnnpj.exeplblrl.exetftlxnl.exelvbfrlx.exetjlpr.exeddftjxn.exebrbxxjx.exevlhbp.exenxphh.exedxppdnb.exexpfpj.exefpxpvhd.exebnhvdpb.exefbtvtv.exejbrbbj.exetxbrxh.exefbvdnjx.exetfrhdb.exeflhjtln.exeplvdvd.exelnhtxj.exejbndxlt.exetvvfbfh.exebdvrxpr.exelbjppx.exelrthh.exethbjvld.exedrtbl.exefppblxh.exehbbdn.exejbdvt.exetvhvdn.exehlthtl.exepvrrvx.exexhtxxj.exelhfrn.exebthhrr.exerrhvll.exexxxpfj.exephvdprr.exednfllxn.exeptpfbb.exethplh.exenjjhlpp.exexlbln.exehflxbx.exevhbxpff.exenfnxnr.exeppddxnh.exepjhtnnh.exellxtf.exetptvn.exepid process 1716 rppxpx.exe 1296 prpdd.exe 2468 fdxpdf.exe 2580 trdxn.exe 2708 nxblntx.exe 2648 vbfdhv.exe 2512 lvrhlt.exe 2380 hjjppnf.exe 2168 bpvnxjh.exe 2160 nnjfl.exe 1008 dpptxjx.exe 888 pnjpnt.exe 2220 hjvnnpj.exe 2296 plblrl.exe 912 tftlxnl.exe 1708 lvbfrlx.exe 1612 tjlpr.exe 2620 ddftjxn.exe 824 brbxxjx.exe 860 vlhbp.exe 2988 nxphh.exe 2092 dxppdnb.exe 1264 xpfpj.exe 1144 fpxpvhd.exe 1172 bnhvdpb.exe 1648 fbtvtv.exe 1040 jbrbbj.exe 1532 txbrxh.exe 2820 fbvdnjx.exe 2864 tfrhdb.exe 852 flhjtln.exe 1428 plvdvd.exe 2064 lnhtxj.exe 2208 jbndxlt.exe 1548 tvvfbfh.exe 2780 bdvrxpr.exe 1036 lbjppx.exe 2468 lrthh.exe 2532 thbjvld.exe 2704 drtbl.exe 2684 fppblxh.exe 2636 hbbdn.exe 2488 jbdvt.exe 2408 tvhvdn.exe 2372 hlthtl.exe 2428 pvrrvx.exe 2304 xhtxxj.exe 676 lhfrn.exe 580 bthhrr.exe 484 rrhvll.exe 2300 xxxpfj.exe 924 phvdprr.exe 1072 dnfllxn.exe 912 ptpfbb.exe 1492 thplh.exe 2476 njjhlpp.exe 1636 xlbln.exe 2968 hflxbx.exe 824 vhbxpff.exe 2072 nfnxnr.exe 2804 ppddxnh.exe 1268 pjhtnnh.exe 1028 llxtf.exe 1512 tptvn.exe -
Processes:
resource yara_rule behavioral1/memory/2032-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1296-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/912-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/824-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1264-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1172-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1532-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/852-306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-960-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
533b9a60a49da46f7688d0590dca9930_NeikiAnalytics.exerppxpx.exeprpdd.exefdxpdf.exetrdxn.exenxblntx.exevbfdhv.exelvrhlt.exehjjppnf.exebpvnxjh.exennjfl.exedpptxjx.exepnjpnt.exehjvnnpj.exeplblrl.exetftlxnl.exedescription pid process target process PID 2032 wrote to memory of 1716 2032 533b9a60a49da46f7688d0590dca9930_NeikiAnalytics.exe rppxpx.exe PID 2032 wrote to memory of 1716 2032 533b9a60a49da46f7688d0590dca9930_NeikiAnalytics.exe rppxpx.exe PID 2032 wrote to memory of 1716 2032 533b9a60a49da46f7688d0590dca9930_NeikiAnalytics.exe rppxpx.exe PID 2032 wrote to memory of 1716 2032 533b9a60a49da46f7688d0590dca9930_NeikiAnalytics.exe rppxpx.exe PID 1716 wrote to memory of 1296 1716 rppxpx.exe prpdd.exe PID 1716 wrote to memory of 1296 1716 rppxpx.exe prpdd.exe PID 1716 wrote to memory of 1296 1716 rppxpx.exe prpdd.exe PID 1716 wrote to memory of 1296 1716 rppxpx.exe prpdd.exe PID 1296 wrote to memory of 2468 1296 prpdd.exe fdxpdf.exe PID 1296 wrote to memory of 2468 1296 prpdd.exe fdxpdf.exe PID 1296 wrote to memory of 2468 1296 prpdd.exe fdxpdf.exe PID 1296 wrote to memory of 2468 1296 prpdd.exe fdxpdf.exe PID 2468 wrote to memory of 2580 2468 fdxpdf.exe trdxn.exe PID 2468 wrote to memory of 2580 2468 fdxpdf.exe trdxn.exe PID 2468 wrote to memory of 2580 2468 fdxpdf.exe trdxn.exe PID 2468 wrote to memory of 2580 2468 fdxpdf.exe trdxn.exe PID 2580 wrote to memory of 2708 2580 trdxn.exe nxblntx.exe PID 2580 wrote to memory of 2708 2580 trdxn.exe nxblntx.exe PID 2580 wrote to memory of 2708 2580 trdxn.exe nxblntx.exe PID 2580 wrote to memory of 2708 2580 trdxn.exe nxblntx.exe PID 2708 wrote to memory of 2648 2708 nxblntx.exe vbfdhv.exe PID 2708 wrote to memory of 2648 2708 nxblntx.exe vbfdhv.exe PID 2708 wrote to memory of 2648 2708 nxblntx.exe vbfdhv.exe PID 2708 wrote to memory of 2648 2708 nxblntx.exe vbfdhv.exe PID 2648 wrote to memory of 2512 2648 vbfdhv.exe lvrhlt.exe PID 2648 wrote to memory of 2512 2648 vbfdhv.exe lvrhlt.exe PID 2648 wrote to memory of 2512 2648 vbfdhv.exe lvrhlt.exe PID 2648 wrote to memory of 2512 2648 vbfdhv.exe lvrhlt.exe PID 2512 wrote to memory of 2380 2512 lvrhlt.exe hjjppnf.exe PID 2512 wrote to memory of 2380 2512 lvrhlt.exe hjjppnf.exe PID 2512 wrote to memory of 2380 2512 lvrhlt.exe hjjppnf.exe PID 2512 wrote to memory of 2380 2512 lvrhlt.exe hjjppnf.exe PID 2380 wrote to memory of 2168 2380 hjjppnf.exe bpvnxjh.exe PID 2380 wrote to memory of 2168 2380 hjjppnf.exe bpvnxjh.exe PID 2380 wrote to memory of 2168 2380 hjjppnf.exe bpvnxjh.exe PID 2380 wrote to memory of 2168 2380 hjjppnf.exe bpvnxjh.exe PID 2168 wrote to memory of 2160 2168 bpvnxjh.exe nnjfl.exe PID 2168 wrote to memory of 2160 2168 bpvnxjh.exe nnjfl.exe PID 2168 wrote to memory of 2160 2168 bpvnxjh.exe nnjfl.exe PID 2168 wrote to memory of 2160 2168 bpvnxjh.exe nnjfl.exe PID 2160 wrote to memory of 1008 2160 nnjfl.exe dpptxjx.exe PID 2160 wrote to memory of 1008 2160 nnjfl.exe dpptxjx.exe PID 2160 wrote to memory of 1008 2160 nnjfl.exe dpptxjx.exe PID 2160 wrote to memory of 1008 2160 nnjfl.exe dpptxjx.exe PID 1008 wrote to memory of 888 1008 dpptxjx.exe pnjpnt.exe PID 1008 wrote to memory of 888 1008 dpptxjx.exe pnjpnt.exe PID 1008 wrote to memory of 888 1008 dpptxjx.exe pnjpnt.exe PID 1008 wrote to memory of 888 1008 dpptxjx.exe pnjpnt.exe PID 888 wrote to memory of 2220 888 pnjpnt.exe hjvnnpj.exe PID 888 wrote to memory of 2220 888 pnjpnt.exe hjvnnpj.exe PID 888 wrote to memory of 2220 888 pnjpnt.exe hjvnnpj.exe PID 888 wrote to memory of 2220 888 pnjpnt.exe hjvnnpj.exe PID 2220 wrote to memory of 2296 2220 hjvnnpj.exe plblrl.exe PID 2220 wrote to memory of 2296 2220 hjvnnpj.exe plblrl.exe PID 2220 wrote to memory of 2296 2220 hjvnnpj.exe plblrl.exe PID 2220 wrote to memory of 2296 2220 hjvnnpj.exe plblrl.exe PID 2296 wrote to memory of 912 2296 plblrl.exe tftlxnl.exe PID 2296 wrote to memory of 912 2296 plblrl.exe tftlxnl.exe PID 2296 wrote to memory of 912 2296 plblrl.exe tftlxnl.exe PID 2296 wrote to memory of 912 2296 plblrl.exe tftlxnl.exe PID 912 wrote to memory of 1708 912 tftlxnl.exe lvbfrlx.exe PID 912 wrote to memory of 1708 912 tftlxnl.exe lvbfrlx.exe PID 912 wrote to memory of 1708 912 tftlxnl.exe lvbfrlx.exe PID 912 wrote to memory of 1708 912 tftlxnl.exe lvbfrlx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\533b9a60a49da46f7688d0590dca9930_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\533b9a60a49da46f7688d0590dca9930_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\rppxpx.exec:\rppxpx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\prpdd.exec:\prpdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\fdxpdf.exec:\fdxpdf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\trdxn.exec:\trdxn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\nxblntx.exec:\nxblntx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\vbfdhv.exec:\vbfdhv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\lvrhlt.exec:\lvrhlt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\hjjppnf.exec:\hjjppnf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\bpvnxjh.exec:\bpvnxjh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\nnjfl.exec:\nnjfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\dpptxjx.exec:\dpptxjx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\pnjpnt.exec:\pnjpnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\hjvnnpj.exec:\hjvnnpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\plblrl.exec:\plblrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\tftlxnl.exec:\tftlxnl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\lvbfrlx.exec:\lvbfrlx.exe17⤵
- Executes dropped EXE
PID:1708 -
\??\c:\tjlpr.exec:\tjlpr.exe18⤵
- Executes dropped EXE
PID:1612 -
\??\c:\ddftjxn.exec:\ddftjxn.exe19⤵
- Executes dropped EXE
PID:2620 -
\??\c:\brbxxjx.exec:\brbxxjx.exe20⤵
- Executes dropped EXE
PID:824 -
\??\c:\vlhbp.exec:\vlhbp.exe21⤵
- Executes dropped EXE
PID:860 -
\??\c:\nxphh.exec:\nxphh.exe22⤵
- Executes dropped EXE
PID:2988 -
\??\c:\dxppdnb.exec:\dxppdnb.exe23⤵
- Executes dropped EXE
PID:2092 -
\??\c:\xpfpj.exec:\xpfpj.exe24⤵
- Executes dropped EXE
PID:1264 -
\??\c:\fpxpvhd.exec:\fpxpvhd.exe25⤵
- Executes dropped EXE
PID:1144 -
\??\c:\bnhvdpb.exec:\bnhvdpb.exe26⤵
- Executes dropped EXE
PID:1172 -
\??\c:\fbtvtv.exec:\fbtvtv.exe27⤵
- Executes dropped EXE
PID:1648 -
\??\c:\jbrbbj.exec:\jbrbbj.exe28⤵
- Executes dropped EXE
PID:1040 -
\??\c:\txbrxh.exec:\txbrxh.exe29⤵
- Executes dropped EXE
PID:1532 -
\??\c:\fbvdnjx.exec:\fbvdnjx.exe30⤵
- Executes dropped EXE
PID:2820 -
\??\c:\tfrhdb.exec:\tfrhdb.exe31⤵
- Executes dropped EXE
PID:2864 -
\??\c:\flhjtln.exec:\flhjtln.exe32⤵
- Executes dropped EXE
PID:852 -
\??\c:\plvdvd.exec:\plvdvd.exe33⤵
- Executes dropped EXE
PID:1428 -
\??\c:\lnhtxj.exec:\lnhtxj.exe34⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jbndxlt.exec:\jbndxlt.exe35⤵
- Executes dropped EXE
PID:2208 -
\??\c:\tvvfbfh.exec:\tvvfbfh.exe36⤵
- Executes dropped EXE
PID:1548 -
\??\c:\bdvrxpr.exec:\bdvrxpr.exe37⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lbjppx.exec:\lbjppx.exe38⤵
- Executes dropped EXE
PID:1036 -
\??\c:\lrthh.exec:\lrthh.exe39⤵
- Executes dropped EXE
PID:2468 -
\??\c:\thbjvld.exec:\thbjvld.exe40⤵
- Executes dropped EXE
PID:2532 -
\??\c:\drtbl.exec:\drtbl.exe41⤵
- Executes dropped EXE
PID:2704 -
\??\c:\fppblxh.exec:\fppblxh.exe42⤵
- Executes dropped EXE
PID:2684 -
\??\c:\hbbdn.exec:\hbbdn.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\jbdvt.exec:\jbdvt.exe44⤵
- Executes dropped EXE
PID:2488 -
\??\c:\tvhvdn.exec:\tvhvdn.exe45⤵
- Executes dropped EXE
PID:2408 -
\??\c:\hlthtl.exec:\hlthtl.exe46⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pvrrvx.exec:\pvrrvx.exe47⤵
- Executes dropped EXE
PID:2428 -
\??\c:\xhtxxj.exec:\xhtxxj.exe48⤵
- Executes dropped EXE
PID:2304 -
\??\c:\lhfrn.exec:\lhfrn.exe49⤵
- Executes dropped EXE
PID:676 -
\??\c:\bthhrr.exec:\bthhrr.exe50⤵
- Executes dropped EXE
PID:580 -
\??\c:\rrhvll.exec:\rrhvll.exe51⤵
- Executes dropped EXE
PID:484 -
\??\c:\xxxpfj.exec:\xxxpfj.exe52⤵
- Executes dropped EXE
PID:2300 -
\??\c:\phvdprr.exec:\phvdprr.exe53⤵
- Executes dropped EXE
PID:924 -
\??\c:\dnfllxn.exec:\dnfllxn.exe54⤵
- Executes dropped EXE
PID:1072 -
\??\c:\ptpfbb.exec:\ptpfbb.exe55⤵
- Executes dropped EXE
PID:912 -
\??\c:\thplh.exec:\thplh.exe56⤵
- Executes dropped EXE
PID:1492 -
\??\c:\njjhlpp.exec:\njjhlpp.exe57⤵
- Executes dropped EXE
PID:2476 -
\??\c:\xlbln.exec:\xlbln.exe58⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hflxbx.exec:\hflxbx.exe59⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vhbxpff.exec:\vhbxpff.exe60⤵
- Executes dropped EXE
PID:824 -
\??\c:\nfnxnr.exec:\nfnxnr.exe61⤵
- Executes dropped EXE
PID:2072 -
\??\c:\ppddxnh.exec:\ppddxnh.exe62⤵
- Executes dropped EXE
PID:2804 -
\??\c:\pjhtnnh.exec:\pjhtnnh.exe63⤵
- Executes dropped EXE
PID:1268 -
\??\c:\llxtf.exec:\llxtf.exe64⤵
- Executes dropped EXE
PID:1028 -
\??\c:\tptvn.exec:\tptvn.exe65⤵
- Executes dropped EXE
PID:1512 -
\??\c:\nlnpvx.exec:\nlnpvx.exe66⤵PID:1608
-
\??\c:\phppx.exec:\phppx.exe67⤵PID:940
-
\??\c:\vtnndn.exec:\vtnndn.exe68⤵PID:640
-
\??\c:\rdlxtf.exec:\rdlxtf.exe69⤵PID:3004
-
\??\c:\xjhhb.exec:\xjhhb.exe70⤵PID:3020
-
\??\c:\nflbpx.exec:\nflbpx.exe71⤵PID:528
-
\??\c:\vtvrpft.exec:\vtvrpft.exe72⤵PID:2752
-
\??\c:\hjxxfbf.exec:\hjxxfbf.exe73⤵PID:2916
-
\??\c:\bptxxdr.exec:\bptxxdr.exe74⤵PID:3000
-
\??\c:\lvrlbhv.exec:\lvrlbhv.exe75⤵PID:2212
-
\??\c:\ljhnx.exec:\ljhnx.exe76⤵PID:1100
-
\??\c:\rjjdrj.exec:\rjjdrj.exe77⤵PID:2152
-
\??\c:\lldnbtv.exec:\lldnbtv.exe78⤵PID:1584
-
\??\c:\jbxvjx.exec:\jbxvjx.exe79⤵PID:2200
-
\??\c:\dpbrdvd.exec:\dpbrdvd.exe80⤵PID:2592
-
\??\c:\rvtlhnv.exec:\rvtlhnv.exe81⤵PID:2612
-
\??\c:\ptdhdh.exec:\ptdhdh.exe82⤵PID:2500
-
\??\c:\hdjtlnx.exec:\hdjtlnx.exe83⤵PID:2624
-
\??\c:\xpppppl.exec:\xpppppl.exe84⤵PID:2156
-
\??\c:\xnfxffv.exec:\xnfxffv.exe85⤵PID:2648
-
\??\c:\nnxbvlb.exec:\nnxbvlb.exe86⤵PID:2552
-
\??\c:\lprdhfh.exec:\lprdhfh.exe87⤵PID:2868
-
\??\c:\hrfdvtd.exec:\hrfdvtd.exe88⤵PID:2784
-
\??\c:\xhdjhn.exec:\xhdjhn.exe89⤵PID:2360
-
\??\c:\phpxhj.exec:\phpxhj.exe90⤵PID:2160
-
\??\c:\lltxjnl.exec:\lltxjnl.exe91⤵PID:1108
-
\??\c:\lvfpp.exec:\lvfpp.exe92⤵PID:936
-
\??\c:\xbrldtl.exec:\xbrldtl.exe93⤵PID:1712
-
\??\c:\vfjdfx.exec:\vfjdfx.exe94⤵PID:1964
-
\??\c:\vtrbl.exec:\vtrbl.exe95⤵PID:1932
-
\??\c:\xhtdt.exec:\xhtdt.exe96⤵PID:2320
-
\??\c:\ldvvt.exec:\ldvvt.exe97⤵PID:2224
-
\??\c:\phjrx.exec:\phjrx.exe98⤵PID:1632
-
\??\c:\rhttdp.exec:\rhttdp.exe99⤵PID:1732
-
\??\c:\fdfhf.exec:\fdfhf.exe100⤵PID:1132
-
\??\c:\hrnfh.exec:\hrnfh.exe101⤵PID:1452
-
\??\c:\rnntnbt.exec:\rnntnbt.exe102⤵PID:2264
-
\??\c:\fjrppl.exec:\fjrppl.exe103⤵PID:1880
-
\??\c:\ntndbf.exec:\ntndbf.exe104⤵PID:2728
-
\??\c:\vnxvvh.exec:\vnxvvh.exe105⤵PID:2720
-
\??\c:\xpfll.exec:\xpfll.exe106⤵PID:2024
-
\??\c:\ttfrd.exec:\ttfrd.exe107⤵PID:364
-
\??\c:\tvdnbl.exec:\tvdnbl.exe108⤵PID:1144
-
\??\c:\rldjdxb.exec:\rldjdxb.exe109⤵PID:3036
-
\??\c:\xhphpl.exec:\xhphpl.exe110⤵PID:3024
-
\??\c:\xrtffpj.exec:\xrtffpj.exe111⤵PID:1120
-
\??\c:\hvttdf.exec:\hvttdf.exe112⤵PID:2772
-
\??\c:\xtnpp.exec:\xtnpp.exe113⤵PID:1532
-
\??\c:\jlfhp.exec:\jlfhp.exe114⤵PID:2744
-
\??\c:\frhrbb.exec:\frhrbb.exe115⤵PID:856
-
\??\c:\rtbnh.exec:\rtbnh.exe116⤵PID:2712
-
\??\c:\htxjvfp.exec:\htxjvfp.exe117⤵PID:1252
-
\??\c:\fthhhn.exec:\fthhhn.exe118⤵PID:1448
-
\??\c:\xftpxv.exec:\xftpxv.exe119⤵PID:2564
-
\??\c:\hxrrnxr.exec:\hxrrnxr.exe120⤵PID:2208
-
\??\c:\jbjfjlv.exec:\jbjfjlv.exe121⤵PID:1548
-
\??\c:\ntlhxxt.exec:\ntlhxxt.exe122⤵PID:2584
-
\??\c:\dpbddnh.exec:\dpbddnh.exe123⤵PID:2524
-
\??\c:\pnttj.exec:\pnttj.exe124⤵PID:2876
-
\??\c:\pxntbn.exec:\pxntbn.exe125⤵PID:2708
-
\??\c:\fftrtd.exec:\fftrtd.exe126⤵PID:2664
-
\??\c:\ltrjd.exec:\ltrjd.exe127⤵PID:2544
-
\??\c:\dvtxt.exec:\dvtxt.exe128⤵PID:2396
-
\??\c:\xxjbvr.exec:\xxjbvr.exe129⤵PID:2792
-
\??\c:\nldhn.exec:\nldhn.exe130⤵PID:2908
-
\??\c:\pfbjjnd.exec:\pfbjjnd.exe131⤵PID:1556
-
\??\c:\lvnfhnp.exec:\lvnfhnp.exe132⤵PID:568
-
\??\c:\lrhtdb.exec:\lrhtdb.exe133⤵PID:1220
-
\??\c:\nbjlj.exec:\nbjlj.exe134⤵PID:1456
-
\??\c:\npjdpjd.exec:\npjdpjd.exe135⤵PID:1936
-
\??\c:\fnvlh.exec:\fnvlh.exe136⤵PID:2352
-
\??\c:\pfnbdb.exec:\pfnbdb.exe137⤵PID:1140
-
\??\c:\pbjxdl.exec:\pbjxdl.exe138⤵PID:1672
-
\??\c:\lhtfppx.exec:\lhtfppx.exe139⤵PID:1976
-
\??\c:\dfllvtt.exec:\dfllvtt.exe140⤵PID:1536
-
\??\c:\ddrprdx.exec:\ddrprdx.exe141⤵PID:1612
-
\??\c:\jllbhbj.exec:\jllbhbj.exe142⤵PID:2416
-
\??\c:\vxfvvjl.exec:\vxfvvjl.exe143⤵PID:2688
-
\??\c:\dhrthjh.exec:\dhrthjh.exe144⤵PID:2996
-
\??\c:\thjvrtd.exec:\thjvrtd.exe145⤵PID:2116
-
\??\c:\npnjnnv.exec:\npnjnnv.exe146⤵PID:2872
-
\??\c:\dvjfx.exec:\dvjfx.exe147⤵PID:2904
-
\??\c:\xxrnl.exec:\xxrnl.exe148⤵PID:2008
-
\??\c:\xpppv.exec:\xpppv.exe149⤵PID:1472
-
\??\c:\hrjldr.exec:\hrjldr.exe150⤵PID:240
-
\??\c:\hxlbbpb.exec:\hxlbbpb.exe151⤵PID:1708
-
\??\c:\nfnlvx.exec:\nfnlvx.exe152⤵PID:2964
-
\??\c:\xtdjh.exec:\xtdjh.exe153⤵PID:848
-
\??\c:\lfhjh.exec:\lfhjh.exe154⤵PID:2824
-
\??\c:\blbvh.exec:\blbvh.exe155⤵PID:2836
-
\??\c:\ddhvr.exec:\ddhvr.exe156⤵PID:2276
-
\??\c:\fxnjffp.exec:\fxnjffp.exe157⤵PID:1156
-
\??\c:\vlhlnnl.exec:\vlhlnnl.exe158⤵PID:1596
-
\??\c:\dbvvvt.exec:\dbvvvt.exe159⤵PID:1196
-
\??\c:\tljrnpr.exec:\tljrnpr.exe160⤵PID:2460
-
\??\c:\fbxnpxl.exec:\fbxnpxl.exe161⤵PID:1904
-
\??\c:\jtnrdv.exec:\jtnrdv.exe162⤵PID:2652
-
\??\c:\pvhnjtx.exec:\pvhnjtx.exe163⤵PID:524
-
\??\c:\hhxhphp.exec:\hhxhphp.exe164⤵PID:2656
-
\??\c:\nrrtjh.exec:\nrrtjh.exe165⤵PID:2504
-
\??\c:\pblxd.exec:\pblxd.exe166⤵PID:2528
-
\??\c:\rbplrxb.exec:\rbplrxb.exe167⤵PID:2384
-
\??\c:\njdrp.exec:\njdrp.exe168⤵PID:2644
-
\??\c:\bfpbdl.exec:\bfpbdl.exe169⤵PID:2424
-
\??\c:\jldvrjb.exec:\jldvrjb.exe170⤵PID:2540
-
\??\c:\xxhnn.exec:\xxhnn.exe171⤵PID:2488
-
\??\c:\pxdvj.exec:\pxdvj.exe172⤵PID:2420
-
\??\c:\dxxfhf.exec:\dxxfhf.exe173⤵PID:472
-
\??\c:\rdpbxrr.exec:\rdpbxrr.exe174⤵PID:788
-
\??\c:\pbbnbxl.exec:\pbbnbxl.exe175⤵PID:2304
-
\??\c:\nhnvdpv.exec:\nhnvdpv.exe176⤵PID:1344
-
\??\c:\jfxxf.exec:\jfxxf.exe177⤵PID:1008
-
\??\c:\xvfnhnj.exec:\xvfnhnj.exe178⤵PID:2216
-
\??\c:\pjhnnd.exec:\pjhnnd.exe179⤵PID:1444
-
\??\c:\ljrbdn.exec:\ljrbdn.exe180⤵PID:1964
-
\??\c:\bdvdbj.exec:\bdvdbj.exe181⤵PID:2120
-
\??\c:\thhvd.exec:\thhvd.exe182⤵PID:1620
-
\??\c:\lbbpddn.exec:\lbbpddn.exe183⤵PID:2660
-
\??\c:\fldplh.exec:\fldplh.exe184⤵PID:1492
-
\??\c:\plnlpl.exec:\plnlpl.exe185⤵PID:2140
-
\??\c:\xhbdj.exec:\xhbdj.exe186⤵PID:2252
-
\??\c:\xxfjx.exec:\xxfjx.exe187⤵PID:2808
-
\??\c:\pvjjbf.exec:\pvjjbf.exe188⤵PID:2264
-
\??\c:\hlprvx.exec:\hlprvx.exe189⤵PID:860
-
\??\c:\xxdlhld.exec:\xxdlhld.exe190⤵PID:2804
-
\??\c:\jdfrlx.exec:\jdfrlx.exe191⤵PID:2012
-
\??\c:\pfhdxjt.exec:\pfhdxjt.exe192⤵PID:964
-
\??\c:\nfpbj.exec:\nfpbj.exe193⤵PID:2284
-
\??\c:\llfvf.exec:\llfvf.exe194⤵PID:1812
-
\??\c:\hnrbhj.exec:\hnrbhj.exe195⤵PID:960
-
\??\c:\fhbbl.exec:\fhbbl.exe196⤵PID:1044
-
\??\c:\jtrfptt.exec:\jtrfptt.exe197⤵PID:3012
-
\??\c:\fpfvvt.exec:\fpfvvt.exe198⤵PID:3020
-
\??\c:\vjbbn.exec:\vjbbn.exe199⤵PID:2768
-
\??\c:\dhhlx.exec:\dhhlx.exe200⤵PID:2344
-
\??\c:\hpfrt.exec:\hpfrt.exe201⤵PID:2864
-
\??\c:\dnhxhhv.exec:\dnhxhhv.exe202⤵PID:2700
-
\??\c:\prrddl.exec:\prrddl.exe203⤵PID:824
-
\??\c:\hhjrdx.exec:\hhjrdx.exe204⤵PID:2032
-
\??\c:\fnrjx.exec:\fnrjx.exe205⤵PID:1904
-
\??\c:\lnvlv.exec:\lnvlv.exe206⤵PID:2652
-
\??\c:\xxhhlxl.exec:\xxhhlxl.exe207⤵PID:524
-
\??\c:\rjfnd.exec:\rjfnd.exe208⤵PID:2656
-
\??\c:\dftbhl.exec:\dftbhl.exe209⤵PID:2504
-
\??\c:\dpnvdlb.exec:\dpnvdlb.exe210⤵PID:2528
-
\??\c:\vfbjf.exec:\vfbjf.exe211⤵PID:1124
-
\??\c:\nhnhn.exec:\nhnhn.exe212⤵PID:2400
-
\??\c:\dxvtp.exec:\dxvtp.exe213⤵PID:1892
-
\??\c:\fhnppt.exec:\fhnppt.exe214⤵PID:656
-
\??\c:\bpnldh.exec:\bpnldh.exe215⤵PID:2488
-
\??\c:\rjxnvh.exec:\rjxnvh.exe216⤵PID:2420
-
\??\c:\dtpxdtf.exec:\dtpxdtf.exe217⤵PID:472
-
\??\c:\bddlxhr.exec:\bddlxhr.exe218⤵PID:1284
-
\??\c:\fpxhbp.exec:\fpxhbp.exe219⤵PID:1948
-
\??\c:\prddj.exec:\prddj.exe220⤵PID:368
-
\??\c:\tnhjf.exec:\tnhjf.exe221⤵PID:2340
-
\??\c:\rhrdr.exec:\rhrdr.exe222⤵PID:2220
-
\??\c:\lvdfd.exec:\lvdfd.exe223⤵PID:1932
-
\??\c:\bpnvbxp.exec:\bpnvbxp.exe224⤵PID:2484
-
\??\c:\fhfxlx.exec:\fhfxlx.exe225⤵PID:2120
-
\??\c:\ptjrxl.exec:\ptjrxl.exe226⤵PID:1620
-
\??\c:\ttfdvxt.exec:\ttfdvxt.exe227⤵PID:2660
-
\??\c:\rdhnjp.exec:\rdhnjp.exe228⤵PID:1492
-
\??\c:\dnfjhbd.exec:\dnfjhbd.exe229⤵PID:2140
-
\??\c:\tpbxv.exec:\tpbxv.exe230⤵PID:2668
-
\??\c:\fvfvbj.exec:\fvfvbj.exe231⤵PID:1052
-
\??\c:\lbxxxhv.exec:\lbxxxhv.exe232⤵PID:2264
-
\??\c:\lpbtlr.exec:\lpbtlr.exe233⤵PID:860
-
\??\c:\jpxvjr.exec:\jpxvjr.exe234⤵PID:1528
-
\??\c:\xthld.exec:\xthld.exe235⤵PID:1836
-
\??\c:\btblfdb.exec:\btblfdb.exe236⤵PID:964
-
\??\c:\xjplpd.exec:\xjplpd.exe237⤵PID:3036
-
\??\c:\ddnlffv.exec:\ddnlffv.exe238⤵PID:1652
-
\??\c:\flfxj.exec:\flfxj.exe239⤵PID:880
-
\??\c:\hppbrx.exec:\hppbrx.exe240⤵PID:1044
-
\??\c:\pblthfn.exec:\pblthfn.exe241⤵PID:3016
-
\??\c:\pnjfjtj.exec:\pnjfjtj.exe242⤵PID:1760