Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 07:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9d953bcfb8fefe04f0ca9c7df6adc6e0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
9d953bcfb8fefe04f0ca9c7df6adc6e0_NeikiAnalytics.exe
-
Size
140KB
-
MD5
9d953bcfb8fefe04f0ca9c7df6adc6e0
-
SHA1
96d8c1d07bf3a2402253e6a29955611e9796e9dc
-
SHA256
9e00204e7d330f3b04c5597aac8972496e5df900f4d5a7e6bc381182932f26bf
-
SHA512
a8b0a29a75543ba04357a85a647cb8460ad44bf4e14db69599b5b8c44606314b6335b18973b9afcea42b3d180a7c7e465ea6f7b593661dca1d214bb3d65f1526
-
SSDEEP
3072:ymb3NkkiQ3mdBjFomR7UsyJC+n0Gsgyek1x:n3C9BRomRph+0GsgyeYx
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2136-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1176-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/240-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1532-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1076-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/272-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/908-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fnlntb.exefnvddhb.exefnjbv.exejjbhj.exevnlfjf.exevjdrjb.exedprhv.exelpdnpvp.exetxvrhp.exenlxdnt.exejtdnh.exehddlx.exetlnrfd.exevnrbr.exelpbxjvl.exerthfjdn.exenfxxb.exevprhfnf.exepbtpdxb.exejrdxlhp.exejnlrndt.exenxxdr.exetflrrp.exefbblltn.exedphhdx.exenlplvr.exehtdfrnf.exenjvvbh.exehpjpfnx.exefvxlt.exetpffxfd.exetrpplb.exebjbnrd.exebfrjbr.exellvrnx.exendhbl.exevxdvfdt.exehllttvb.exelrfdjvb.exehpfxrjr.exeflfhtbl.exerlvhx.exelnjlhb.exebbdbnrp.exevfrhjt.exedvbffr.exelfvbdbr.exerhlfdl.exedvtvfrr.exebhhlxx.exejhxhhl.exepfvln.exelrdlfnr.exerpdhvbt.exevnpjbdh.exepxhfvj.exevxfpvph.exelnfhb.exefdljn.exefldptd.exenxfxr.exedtbpd.exedxrbf.exedlxttx.exepid process 2136 fnlntb.exe 2924 fnvddhb.exe 2588 fnjbv.exe 2464 jjbhj.exe 2552 vnlfjf.exe 2492 vjdrjb.exe 2372 dprhv.exe 240 lpdnpvp.exe 1532 txvrhp.exe 1820 nlxdnt.exe 2656 jtdnh.exe 2784 hddlx.exe 1076 tlnrfd.exe 1976 vnrbr.exe 2204 lpbxjvl.exe 2216 rthfjdn.exe 816 nfxxb.exe 1640 vprhfnf.exe 1992 pbtpdxb.exe 2452 jrdxlhp.exe 712 jnlrndt.exe 2080 nxxdr.exe 272 tflrrp.exe 2964 fbblltn.exe 1884 dphhdx.exe 2572 nlplvr.exe 1940 htdfrnf.exe 908 njvvbh.exe 1756 hpjpfnx.exe 2296 fvxlt.exe 2780 tpffxfd.exe 884 trpplb.exe 2244 bjbnrd.exe 2556 bfrjbr.exe 1092 llvrnx.exe 1624 ndhbl.exe 2596 vxdvfdt.exe 3036 hllttvb.exe 2644 lrfdjvb.exe 2472 hpfxrjr.exe 2660 flfhtbl.exe 2524 rlvhx.exe 2468 lnjlhb.exe 2420 bbdbnrp.exe 2796 vfrhjt.exe 1504 dvbffr.exe 584 lfvbdbr.exe 648 rhlfdl.exe 2692 dvtvfrr.exe 1828 bhhlxx.exe 808 jhxhhl.exe 1824 pfvln.exe 1308 lrdlfnr.exe 1484 rpdhvbt.exe 3040 vnpjbdh.exe 1680 pxhfvj.exe 1652 vxfpvph.exe 1556 lnfhb.exe 1640 fdljn.exe 2096 fldptd.exe 2940 nxfxr.exe 1696 dtbpd.exe 1144 dxrbf.exe 2980 dlxttx.exe -
Processes:
resource yara_rule behavioral1/memory/2136-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1176-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/240-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/240-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/240-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1532-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/272-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/908-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-305-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9d953bcfb8fefe04f0ca9c7df6adc6e0_NeikiAnalytics.exefnlntb.exefnvddhb.exefnjbv.exejjbhj.exevnlfjf.exevjdrjb.exedprhv.exelpdnpvp.exetxvrhp.exenlxdnt.exejtdnh.exehddlx.exetlnrfd.exevnrbr.exelpbxjvl.exedescription pid process target process PID 1176 wrote to memory of 2136 1176 9d953bcfb8fefe04f0ca9c7df6adc6e0_NeikiAnalytics.exe fnlntb.exe PID 1176 wrote to memory of 2136 1176 9d953bcfb8fefe04f0ca9c7df6adc6e0_NeikiAnalytics.exe fnlntb.exe PID 1176 wrote to memory of 2136 1176 9d953bcfb8fefe04f0ca9c7df6adc6e0_NeikiAnalytics.exe fnlntb.exe PID 1176 wrote to memory of 2136 1176 9d953bcfb8fefe04f0ca9c7df6adc6e0_NeikiAnalytics.exe fnlntb.exe PID 2136 wrote to memory of 2924 2136 fnlntb.exe fnvddhb.exe PID 2136 wrote to memory of 2924 2136 fnlntb.exe fnvddhb.exe PID 2136 wrote to memory of 2924 2136 fnlntb.exe fnvddhb.exe PID 2136 wrote to memory of 2924 2136 fnlntb.exe fnvddhb.exe PID 2924 wrote to memory of 2588 2924 fnvddhb.exe fnjbv.exe PID 2924 wrote to memory of 2588 2924 fnvddhb.exe fnjbv.exe PID 2924 wrote to memory of 2588 2924 fnvddhb.exe fnjbv.exe PID 2924 wrote to memory of 2588 2924 fnvddhb.exe fnjbv.exe PID 2588 wrote to memory of 2464 2588 fnjbv.exe jjbhj.exe PID 2588 wrote to memory of 2464 2588 fnjbv.exe jjbhj.exe PID 2588 wrote to memory of 2464 2588 fnjbv.exe jjbhj.exe PID 2588 wrote to memory of 2464 2588 fnjbv.exe jjbhj.exe PID 2464 wrote to memory of 2552 2464 jjbhj.exe vnlfjf.exe PID 2464 wrote to memory of 2552 2464 jjbhj.exe vnlfjf.exe PID 2464 wrote to memory of 2552 2464 jjbhj.exe vnlfjf.exe PID 2464 wrote to memory of 2552 2464 jjbhj.exe vnlfjf.exe PID 2552 wrote to memory of 2492 2552 vnlfjf.exe vjdrjb.exe PID 2552 wrote to memory of 2492 2552 vnlfjf.exe vjdrjb.exe PID 2552 wrote to memory of 2492 2552 vnlfjf.exe vjdrjb.exe PID 2552 wrote to memory of 2492 2552 vnlfjf.exe vjdrjb.exe PID 2492 wrote to memory of 2372 2492 vjdrjb.exe dprhv.exe PID 2492 wrote to memory of 2372 2492 vjdrjb.exe dprhv.exe PID 2492 wrote to memory of 2372 2492 vjdrjb.exe dprhv.exe PID 2492 wrote to memory of 2372 2492 vjdrjb.exe dprhv.exe PID 2372 wrote to memory of 240 2372 dprhv.exe lpdnpvp.exe PID 2372 wrote to memory of 240 2372 dprhv.exe lpdnpvp.exe PID 2372 wrote to memory of 240 2372 dprhv.exe lpdnpvp.exe PID 2372 wrote to memory of 240 2372 dprhv.exe lpdnpvp.exe PID 240 wrote to memory of 1532 240 lpdnpvp.exe txvrhp.exe PID 240 wrote to memory of 1532 240 lpdnpvp.exe txvrhp.exe PID 240 wrote to memory of 1532 240 lpdnpvp.exe txvrhp.exe PID 240 wrote to memory of 1532 240 lpdnpvp.exe txvrhp.exe PID 1532 wrote to memory of 1820 1532 txvrhp.exe nlxdnt.exe PID 1532 wrote to memory of 1820 1532 txvrhp.exe nlxdnt.exe PID 1532 wrote to memory of 1820 1532 txvrhp.exe nlxdnt.exe PID 1532 wrote to memory of 1820 1532 txvrhp.exe nlxdnt.exe PID 1820 wrote to memory of 2656 1820 nlxdnt.exe jtdnh.exe PID 1820 wrote to memory of 2656 1820 nlxdnt.exe jtdnh.exe PID 1820 wrote to memory of 2656 1820 nlxdnt.exe jtdnh.exe PID 1820 wrote to memory of 2656 1820 nlxdnt.exe jtdnh.exe PID 2656 wrote to memory of 2784 2656 jtdnh.exe hddlx.exe PID 2656 wrote to memory of 2784 2656 jtdnh.exe hddlx.exe PID 2656 wrote to memory of 2784 2656 jtdnh.exe hddlx.exe PID 2656 wrote to memory of 2784 2656 jtdnh.exe hddlx.exe PID 2784 wrote to memory of 1076 2784 hddlx.exe tlnrfd.exe PID 2784 wrote to memory of 1076 2784 hddlx.exe tlnrfd.exe PID 2784 wrote to memory of 1076 2784 hddlx.exe tlnrfd.exe PID 2784 wrote to memory of 1076 2784 hddlx.exe tlnrfd.exe PID 1076 wrote to memory of 1976 1076 tlnrfd.exe vnrbr.exe PID 1076 wrote to memory of 1976 1076 tlnrfd.exe vnrbr.exe PID 1076 wrote to memory of 1976 1076 tlnrfd.exe vnrbr.exe PID 1076 wrote to memory of 1976 1076 tlnrfd.exe vnrbr.exe PID 1976 wrote to memory of 2204 1976 vnrbr.exe lpbxjvl.exe PID 1976 wrote to memory of 2204 1976 vnrbr.exe lpbxjvl.exe PID 1976 wrote to memory of 2204 1976 vnrbr.exe lpbxjvl.exe PID 1976 wrote to memory of 2204 1976 vnrbr.exe lpbxjvl.exe PID 2204 wrote to memory of 2216 2204 lpbxjvl.exe rthfjdn.exe PID 2204 wrote to memory of 2216 2204 lpbxjvl.exe rthfjdn.exe PID 2204 wrote to memory of 2216 2204 lpbxjvl.exe rthfjdn.exe PID 2204 wrote to memory of 2216 2204 lpbxjvl.exe rthfjdn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d953bcfb8fefe04f0ca9c7df6adc6e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9d953bcfb8fefe04f0ca9c7df6adc6e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\fnlntb.exec:\fnlntb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\fnvddhb.exec:\fnvddhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\fnjbv.exec:\fnjbv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\jjbhj.exec:\jjbhj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\vnlfjf.exec:\vnlfjf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\vjdrjb.exec:\vjdrjb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\dprhv.exec:\dprhv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\lpdnpvp.exec:\lpdnpvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
\??\c:\txvrhp.exec:\txvrhp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\nlxdnt.exec:\nlxdnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\jtdnh.exec:\jtdnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\hddlx.exec:\hddlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\tlnrfd.exec:\tlnrfd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\vnrbr.exec:\vnrbr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\lpbxjvl.exec:\lpbxjvl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\rthfjdn.exec:\rthfjdn.exe17⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nfxxb.exec:\nfxxb.exe18⤵
- Executes dropped EXE
PID:816 -
\??\c:\vprhfnf.exec:\vprhfnf.exe19⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pbtpdxb.exec:\pbtpdxb.exe20⤵
- Executes dropped EXE
PID:1992 -
\??\c:\jrdxlhp.exec:\jrdxlhp.exe21⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jnlrndt.exec:\jnlrndt.exe22⤵
- Executes dropped EXE
PID:712 -
\??\c:\nxxdr.exec:\nxxdr.exe23⤵
- Executes dropped EXE
PID:2080 -
\??\c:\tflrrp.exec:\tflrrp.exe24⤵
- Executes dropped EXE
PID:272 -
\??\c:\fbblltn.exec:\fbblltn.exe25⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dphhdx.exec:\dphhdx.exe26⤵
- Executes dropped EXE
PID:1884 -
\??\c:\nlplvr.exec:\nlplvr.exe27⤵
- Executes dropped EXE
PID:2572 -
\??\c:\htdfrnf.exec:\htdfrnf.exe28⤵
- Executes dropped EXE
PID:1940 -
\??\c:\njvvbh.exec:\njvvbh.exe29⤵
- Executes dropped EXE
PID:908 -
\??\c:\hpjpfnx.exec:\hpjpfnx.exe30⤵
- Executes dropped EXE
PID:1756 -
\??\c:\fvxlt.exec:\fvxlt.exe31⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tpffxfd.exec:\tpffxfd.exe32⤵
- Executes dropped EXE
PID:2780 -
\??\c:\trpplb.exec:\trpplb.exe33⤵
- Executes dropped EXE
PID:884 -
\??\c:\bjbnrd.exec:\bjbnrd.exe34⤵
- Executes dropped EXE
PID:2244 -
\??\c:\bfrjbr.exec:\bfrjbr.exe35⤵
- Executes dropped EXE
PID:2556 -
\??\c:\llvrnx.exec:\llvrnx.exe36⤵
- Executes dropped EXE
PID:1092 -
\??\c:\ndhbl.exec:\ndhbl.exe37⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vxdvfdt.exec:\vxdvfdt.exe38⤵
- Executes dropped EXE
PID:2596 -
\??\c:\hllttvb.exec:\hllttvb.exe39⤵
- Executes dropped EXE
PID:3036 -
\??\c:\lrfdjvb.exec:\lrfdjvb.exe40⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hpfxrjr.exec:\hpfxrjr.exe41⤵
- Executes dropped EXE
PID:2472 -
\??\c:\flfhtbl.exec:\flfhtbl.exe42⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rlvhx.exec:\rlvhx.exe43⤵
- Executes dropped EXE
PID:2524 -
\??\c:\lnjlhb.exec:\lnjlhb.exe44⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bbdbnrp.exec:\bbdbnrp.exe45⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vfrhjt.exec:\vfrhjt.exe46⤵
- Executes dropped EXE
PID:2796 -
\??\c:\dvbffr.exec:\dvbffr.exe47⤵
- Executes dropped EXE
PID:1504 -
\??\c:\lfvbdbr.exec:\lfvbdbr.exe48⤵
- Executes dropped EXE
PID:584 -
\??\c:\rhlfdl.exec:\rhlfdl.exe49⤵
- Executes dropped EXE
PID:648 -
\??\c:\dvtvfrr.exec:\dvtvfrr.exe50⤵
- Executes dropped EXE
PID:2692 -
\??\c:\bhhlxx.exec:\bhhlxx.exe51⤵
- Executes dropped EXE
PID:1828 -
\??\c:\jhxhhl.exec:\jhxhhl.exe52⤵
- Executes dropped EXE
PID:808 -
\??\c:\pfvln.exec:\pfvln.exe53⤵
- Executes dropped EXE
PID:1824 -
\??\c:\lrdlfnr.exec:\lrdlfnr.exe54⤵
- Executes dropped EXE
PID:1308 -
\??\c:\rpdhvbt.exec:\rpdhvbt.exe55⤵
- Executes dropped EXE
PID:1484 -
\??\c:\vnpjbdh.exec:\vnpjbdh.exe56⤵
- Executes dropped EXE
PID:3040 -
\??\c:\pxhfvj.exec:\pxhfvj.exe57⤵
- Executes dropped EXE
PID:1680 -
\??\c:\vxfpvph.exec:\vxfpvph.exe58⤵
- Executes dropped EXE
PID:1652 -
\??\c:\lnfhb.exec:\lnfhb.exe59⤵
- Executes dropped EXE
PID:1556 -
\??\c:\fdljn.exec:\fdljn.exe60⤵
- Executes dropped EXE
PID:1640 -
\??\c:\fldptd.exec:\fldptd.exe61⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nxfxr.exec:\nxfxr.exe62⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dtbpd.exec:\dtbpd.exe63⤵
- Executes dropped EXE
PID:1696 -
\??\c:\dxrbf.exec:\dxrbf.exe64⤵
- Executes dropped EXE
PID:1144 -
\??\c:\dlxttx.exec:\dlxttx.exe65⤵
- Executes dropped EXE
PID:2980 -
\??\c:\hhnljvt.exec:\hhnljvt.exe66⤵PID:272
-
\??\c:\bbphhf.exec:\bbphhf.exe67⤵PID:1576
-
\??\c:\hbdhpl.exec:\hbdhpl.exe68⤵PID:2212
-
\??\c:\fjxvptl.exec:\fjxvptl.exe69⤵PID:1852
-
\??\c:\ndhdhp.exec:\ndhdhp.exe70⤵PID:1892
-
\??\c:\ddpflj.exec:\ddpflj.exe71⤵PID:1328
-
\??\c:\xpftjr.exec:\xpftjr.exe72⤵PID:908
-
\??\c:\dpptjh.exec:\dpptjh.exe73⤵PID:1272
-
\??\c:\lxjtn.exec:\lxjtn.exe74⤵PID:2928
-
\??\c:\xvbxb.exec:\xvbxb.exe75⤵PID:1524
-
\??\c:\bfxnjtj.exec:\bfxnjtj.exe76⤵PID:1676
-
\??\c:\ptldnr.exec:\ptldnr.exe77⤵PID:1752
-
\??\c:\lvjfnd.exec:\lvjfnd.exe78⤵PID:2244
-
\??\c:\jbhtf.exec:\jbhtf.exe79⤵PID:2944
-
\??\c:\rprdrt.exec:\rprdrt.exe80⤵PID:2320
-
\??\c:\fbplb.exec:\fbplb.exe81⤵PID:2728
-
\??\c:\pxvxdbt.exec:\pxvxdbt.exe82⤵PID:2448
-
\??\c:\vvbnvr.exec:\vvbnvr.exe83⤵PID:2716
-
\??\c:\bhvhn.exec:\bhvhn.exe84⤵PID:2484
-
\??\c:\lxxlf.exec:\lxxlf.exe85⤵PID:2544
-
\??\c:\jrntrtj.exec:\jrntrtj.exe86⤵PID:2548
-
\??\c:\dvrnnbt.exec:\dvrnnbt.exe87⤵PID:2232
-
\??\c:\lxdhxxj.exec:\lxdhxxj.exe88⤵PID:2372
-
\??\c:\tbprll.exec:\tbprll.exe89⤵PID:1052
-
\??\c:\tlvbt.exec:\tlvbt.exe90⤵PID:240
-
\??\c:\ljlpv.exec:\ljlpv.exe91⤵PID:1532
-
\??\c:\ppnfrbh.exec:\ppnfrbh.exe92⤵PID:1996
-
\??\c:\lnxtr.exec:\lnxtr.exe93⤵PID:2640
-
\??\c:\nnlbft.exec:\nnlbft.exe94⤵PID:2240
-
\??\c:\vnlfj.exec:\vnlfj.exe95⤵PID:2688
-
\??\c:\nhvrhj.exec:\nhvrhj.exe96⤵PID:1368
-
\??\c:\tffnjb.exec:\tffnjb.exe97⤵PID:1964
-
\??\c:\njvvnl.exec:\njvvnl.exe98⤵PID:1968
-
\??\c:\xbdtln.exec:\xbdtln.exe99⤵PID:2180
-
\??\c:\vvjnlp.exec:\vvjnlp.exe100⤵PID:1768
-
\??\c:\pvhnvrd.exec:\pvhnvrd.exe101⤵PID:2972
-
\??\c:\xfjdb.exec:\xfjdb.exe102⤵PID:1660
-
\??\c:\ffnbl.exec:\ffnbl.exe103⤵PID:2196
-
\??\c:\ddldtx.exec:\ddldtx.exe104⤵PID:2060
-
\??\c:\vthhh.exec:\vthhh.exe105⤵PID:2540
-
\??\c:\trnxph.exec:\trnxph.exe106⤵PID:2920
-
\??\c:\xrpfvl.exec:\xrpfvl.exe107⤵PID:1316
-
\??\c:\djxnl.exec:\djxnl.exe108⤵PID:400
-
\??\c:\tjlptb.exec:\tjlptb.exe109⤵PID:3060
-
\??\c:\xrbpr.exec:\xrbpr.exe110⤵PID:780
-
\??\c:\pnjpt.exec:\pnjpt.exe111⤵PID:1184
-
\??\c:\pnhvxhb.exec:\pnhvxhb.exe112⤵PID:984
-
\??\c:\jfxjfx.exec:\jfxjfx.exe113⤵PID:2836
-
\??\c:\xhddhrx.exec:\xhddhrx.exe114⤵PID:1656
-
\??\c:\jjntvvh.exec:\jjntvvh.exe115⤵PID:2912
-
\??\c:\tblpnfb.exec:\tblpnfb.exe116⤵PID:2036
-
\??\c:\ljptv.exec:\ljptv.exe117⤵PID:1764
-
\??\c:\tpjlfv.exec:\tpjlfv.exe118⤵PID:2948
-
\??\c:\vdbrp.exec:\vdbrp.exe119⤵PID:1732
-
\??\c:\xxfhtph.exec:\xxfhtph.exe120⤵PID:3024
-
\??\c:\hfvblpd.exec:\hfvblpd.exe121⤵PID:1676
-
\??\c:\rvjrvfn.exec:\rvjrvfn.exe122⤵PID:1752
-
\??\c:\jpbdv.exec:\jpbdv.exe123⤵PID:2244
-
\??\c:\tjfjllx.exec:\tjfjllx.exe124⤵PID:2936
-
\??\c:\ppbbhl.exec:\ppbbhl.exe125⤵PID:1716
-
\??\c:\dplnpv.exec:\dplnpv.exe126⤵PID:2480
-
\??\c:\rdnbp.exec:\rdnbp.exe127⤵PID:2628
-
\??\c:\ldtrr.exec:\ldtrr.exe128⤵PID:2392
-
\??\c:\jvxlxhf.exec:\jvxlxhf.exe129⤵PID:2484
-
\??\c:\dbftjh.exec:\dbftjh.exe130⤵PID:2544
-
\??\c:\dvffl.exec:\dvffl.exe131⤵PID:2548
-
\??\c:\xflnnj.exec:\xflnnj.exe132⤵PID:2232
-
\??\c:\ldvpjbn.exec:\ldvpjbn.exe133⤵PID:2372
-
\??\c:\txbnjdj.exec:\txbnjdj.exe134⤵PID:1052
-
\??\c:\fbnxfvt.exec:\fbnxfvt.exe135⤵PID:240
-
\??\c:\vbxbp.exec:\vbxbp.exe136⤵PID:1532
-
\??\c:\jnllxpx.exec:\jnllxpx.exe137⤵PID:1808
-
\??\c:\bfxxtn.exec:\bfxxtn.exe138⤵PID:2012
-
\??\c:\vldjn.exec:\vldjn.exe139⤵PID:2240
-
\??\c:\thffphr.exec:\thffphr.exe140⤵PID:1880
-
\??\c:\vhhjlxt.exec:\vhhjlxt.exe141⤵PID:2772
-
\??\c:\dpnfrxj.exec:\dpnfrxj.exe142⤵PID:3032
-
\??\c:\xjxhf.exec:\xjxhf.exe143⤵PID:2312
-
\??\c:\fxvlx.exec:\fxvlx.exe144⤵PID:2236
-
\??\c:\vjrnr.exec:\vjrnr.exe145⤵PID:936
-
\??\c:\phlrht.exec:\phlrht.exe146⤵PID:2972
-
\??\c:\txnftxf.exec:\txnftxf.exe147⤵PID:2260
-
\??\c:\fhxxb.exec:\fhxxb.exe148⤵PID:324
-
\??\c:\vxjpff.exec:\vxjpff.exe149⤵PID:1992
-
\??\c:\fblpvf.exec:\fblpvf.exe150⤵PID:772
-
\??\c:\fphvvh.exec:\fphvvh.exe151⤵PID:2920
-
\??\c:\brblf.exec:\brblf.exe152⤵PID:1316
-
\??\c:\hhndd.exec:\hhndd.exe153⤵PID:2132
-
\??\c:\xvvvjv.exec:\xvvvjv.exe154⤵PID:3060
-
\??\c:\drlfph.exec:\drlfph.exe155⤵PID:1580
-
\??\c:\thdrvlj.exec:\thdrvlj.exe156⤵PID:1184
-
\??\c:\hltvp.exec:\hltvp.exe157⤵PID:1888
-
\??\c:\jpfjdnt.exec:\jpfjdnt.exe158⤵PID:2148
-
\??\c:\hdhvlr.exec:\hdhvlr.exe159⤵PID:1668
-
\??\c:\dfrthf.exec:\dfrthf.exe160⤵PID:2284
-
\??\c:\ndvrhlr.exec:\ndvrhlr.exe161⤵PID:2864
-
\??\c:\tbxhvlp.exec:\tbxhvlp.exe162⤵PID:108
-
\??\c:\jxjtdxj.exec:\jxjtdxj.exe163⤵PID:1244
-
\??\c:\nbdpjb.exec:\nbdpjb.exe164⤵PID:1732
-
\??\c:\xdbvfn.exec:\xdbvfn.exe165⤵PID:2700
-
\??\c:\hlvnhfp.exec:\hlvnhfp.exe166⤵PID:1952
-
\??\c:\pjnlrpj.exec:\pjnlrpj.exe167⤵PID:1620
-
\??\c:\xpxpfnt.exec:\xpxpfnt.exe168⤵PID:2624
-
\??\c:\bjxbtx.exec:\bjxbtx.exe169⤵PID:2860
-
\??\c:\fpttfvb.exec:\fpttfvb.exe170⤵PID:1716
-
\??\c:\jfhjjrr.exec:\jfhjjrr.exe171⤵PID:2712
-
\??\c:\nbrbp.exec:\nbrbp.exe172⤵PID:2628
-
\??\c:\fnldftv.exec:\fnldftv.exe173⤵PID:2392
-
\??\c:\rxrvlx.exec:\rxrvlx.exe174⤵PID:2484
-
\??\c:\tjnhnn.exec:\tjnhnn.exe175⤵PID:2544
-
\??\c:\lhlbx.exec:\lhlbx.exe176⤵PID:2548
-
\??\c:\rbtrbd.exec:\rbtrbd.exe177⤵PID:2232
-
\??\c:\xjldvlb.exec:\xjldvlb.exe178⤵PID:1060
-
\??\c:\tblpnvt.exec:\tblpnvt.exe179⤵PID:584
-
\??\c:\njfnrx.exec:\njfnrx.exe180⤵PID:2648
-
\??\c:\rpbrb.exec:\rpbrb.exe181⤵PID:2664
-
\??\c:\rjntdfl.exec:\rjntdfl.exe182⤵PID:964
-
\??\c:\dpblnf.exec:\dpblnf.exe183⤵PID:2784
-
\??\c:\drdlnx.exec:\drdlnx.exe184⤵PID:1836
-
\??\c:\hrbxv.exec:\hrbxv.exe185⤵PID:1044
-
\??\c:\pnlxbvl.exec:\pnlxbvl.exe186⤵PID:2772
-
\??\c:\lrrvh.exec:\lrrvh.exe187⤵PID:2204
-
\??\c:\bbfnnjr.exec:\bbfnnjr.exe188⤵PID:2312
-
\??\c:\txvxdfr.exec:\txvxdfr.exe189⤵PID:2236
-
\??\c:\frhffd.exec:\frhffd.exe190⤵PID:936
-
\??\c:\brpvn.exec:\brpvn.exe191⤵PID:1588
-
\??\c:\hhxbx.exec:\hhxbx.exe192⤵PID:2744
-
\??\c:\hhlbfxl.exec:\hhlbfxl.exe193⤵PID:2096
-
\??\c:\lrnbpt.exec:\lrnbpt.exe194⤵PID:2940
-
\??\c:\rnllv.exec:\rnllv.exe195⤵PID:2156
-
\??\c:\pjpvlln.exec:\pjpvlln.exe196⤵PID:1152
-
\??\c:\fprrfv.exec:\fprrfv.exe197⤵PID:2028
-
\??\c:\fbbpth.exec:\fbbpth.exe198⤵PID:1248
-
\??\c:\vjrxhd.exec:\vjrxhd.exe199⤵PID:272
-
\??\c:\llbnht.exec:\llbnht.exe200⤵PID:1580
-
\??\c:\bnrxxh.exec:\bnrxxh.exe201⤵PID:1844
-
\??\c:\xljdxnh.exec:\xljdxnh.exe202⤵PID:2344
-
\??\c:\vvxrn.exec:\vvxrn.exe203⤵PID:3000
-
\??\c:\hbdfvp.exec:\hbdfvp.exe204⤵PID:1668
-
\??\c:\tdxrhtd.exec:\tdxrhtd.exe205⤵PID:2284
-
\??\c:\vtrnbrb.exec:\vtrnbrb.exe206⤵PID:2864
-
\??\c:\jpbtdjd.exec:\jpbtdjd.exe207⤵PID:108
-
\??\c:\vjbntdx.exec:\vjbntdx.exe208⤵PID:852
-
\??\c:\xbjvhlh.exec:\xbjvhlh.exe209⤵PID:1336
-
\??\c:\vtbrpht.exec:\vtbrpht.exe210⤵PID:2808
-
\??\c:\tdhnrx.exec:\tdhnrx.exe211⤵PID:1952
-
\??\c:\lpjprfp.exec:\lpjprfp.exe212⤵PID:1620
-
\??\c:\rjphb.exec:\rjphb.exe213⤵PID:2624
-
\??\c:\jtvdrh.exec:\jtvdrh.exe214⤵PID:2860
-
\??\c:\pjhtjlp.exec:\pjhtjlp.exe215⤵PID:1716
-
\??\c:\npbtxlp.exec:\npbtxlp.exe216⤵PID:2712
-
\??\c:\pfvbjv.exec:\pfvbjv.exe217⤵PID:2628
-
\??\c:\ndfjxvh.exec:\ndfjxvh.exe218⤵PID:2528
-
\??\c:\njxlrjt.exec:\njxlrjt.exe219⤵PID:2376
-
\??\c:\vxxht.exec:\vxxht.exe220⤵PID:2468
-
\??\c:\frfjbf.exec:\frfjbf.exe221⤵PID:2432
-
\??\c:\jrvvp.exec:\jrvvp.exe222⤵PID:1168
-
\??\c:\rfjdj.exec:\rfjdj.exe223⤵PID:1060
-
\??\c:\lfhlphd.exec:\lfhlphd.exe224⤵PID:1780
-
\??\c:\fxrxj.exec:\fxrxj.exe225⤵PID:2648
-
\??\c:\nddtfv.exec:\nddtfv.exe226⤵PID:2664
-
\??\c:\tnnpjh.exec:\tnnpjh.exe227⤵PID:964
-
\??\c:\jrplv.exec:\jrplv.exe228⤵PID:2784
-
\??\c:\pdtdhn.exec:\pdtdhn.exe229⤵PID:1836
-
\??\c:\rjnxj.exec:\rjnxj.exe230⤵PID:1796
-
\??\c:\hjlhlh.exec:\hjlhlh.exe231⤵PID:3032
-
\??\c:\xnjvjxx.exec:\xnjvjxx.exe232⤵PID:2204
-
\??\c:\fvbnllr.exec:\fvbnllr.exe233⤵PID:952
-
\??\c:\fpdpx.exec:\fpdpx.exe234⤵PID:1552
-
\??\c:\vbrjxf.exec:\vbrjxf.exe235⤵PID:1572
-
\??\c:\rllrjh.exec:\rllrjh.exe236⤵PID:1556
-
\??\c:\nhxnxlp.exec:\nhxnxlp.exe237⤵PID:1096
-
\??\c:\nbjbr.exec:\nbjbr.exe238⤵PID:788
-
\??\c:\pvjtn.exec:\pvjtn.exe239⤵PID:2940
-
\??\c:\drvvpr.exec:\drvvpr.exe240⤵PID:600
-
\??\c:\fbjrv.exec:\fbjrv.exe241⤵PID:3052
-
\??\c:\fvvrpb.exec:\fvvrpb.exe242⤵PID:2980