Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:55
Behavioral task
behavioral1
Sample
dc0496679542939a7fc9583d4daa8400_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
dc0496679542939a7fc9583d4daa8400_NeikiAnalytics.exe
-
Size
483KB
-
MD5
dc0496679542939a7fc9583d4daa8400
-
SHA1
e39a40b58a3be8b7fd86d0dc786ceb555554fa48
-
SHA256
d80495709bae1b9732128146ec3e5d7f90f8f6edd42c162355b28d287316a4bf
-
SHA512
0c6db140ae3302b6719176fdd784c7c7b35d34261d70eafdbd43f0f94a13512e0c6ba5324fb0130b125531c8eb696f6df732fd2cda057edd244bd9756f818cf1
-
SSDEEP
6144:mcm7ImGddXv/VWrXD486jCpoAhlq1mEjBqLyOSlhNFF2t:I7TcfNWj168w1VjsyvhNFF2t
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
Processes:
resource yara_rule behavioral1/memory/2320-7-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2808-16-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2448-27-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2504-36-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2512-46-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2384-57-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2372-74-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2788-79-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/240-89-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1532-104-0x0000000000230000-0x000000000025E000-memory.dmp family_blackmoon behavioral1/memory/1996-115-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2696-132-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1976-151-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2172-169-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2648-170-0x0000000000220000-0x000000000024E000-memory.dmp family_blackmoon behavioral1/memory/1724-188-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/528-207-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/684-216-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1316-225-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/400-235-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1152-246-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/968-277-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2256-294-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1932-316-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1624-337-0x00000000003B0000-0x00000000003DE000-memory.dmp family_blackmoon behavioral1/memory/2600-351-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2504-358-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2652-367-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/960-427-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1836-452-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/3044-494-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2940-526-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/3060-538-0x00000000002B0000-0x00000000002DE000-memory.dmp family_blackmoon behavioral1/memory/3060-541-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1656-574-0x00000000003B0000-0x00000000003DE000-memory.dmp family_blackmoon behavioral1/memory/1272-598-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 34 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\xrllv.exe family_berbew \??\c:\ddvvnp.exe family_berbew C:\bndxbhr.exe family_berbew C:\jrpdhdb.exe family_berbew C:\hhtdvr.exe family_berbew C:\tjplvjb.exe family_berbew C:\lrrjrfp.exe family_berbew C:\jrvfd.exe family_berbew \??\c:\vhrph.exe family_berbew C:\hhftvpn.exe family_berbew behavioral1/memory/1532-104-0x0000000000230000-0x000000000025E000-memory.dmp family_berbew C:\lvpdj.exe family_berbew C:\ffrthpv.exe family_berbew C:\tbjxlf.exe family_berbew C:\nfdhjhd.exe family_berbew C:\fnnjjht.exe family_berbew C:\xbxjlbd.exe family_berbew C:\phdhr.exe family_berbew C:\ffndfj.exe family_berbew behavioral1/memory/2648-170-0x0000000000220000-0x000000000024E000-memory.dmp family_berbew C:\hhftdl.exe family_berbew C:\bpbjp.exe family_berbew C:\bfllll.exe family_berbew C:\pxxhv.exe family_berbew C:\rtfbrr.exe family_berbew C:\tvxdp.exe family_berbew C:\xdphbp.exe family_berbew C:\fjbnf.exe family_berbew C:\xppxt.exe family_berbew C:\lvlthpn.exe family_berbew \??\c:\pblrn.exe family_berbew C:\ltbjlhj.exe family_berbew C:\xbpxbp.exe family_berbew C:\jbjpn.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
xrllv.exeddvvnp.exebndxbhr.exejrpdhdb.exehhtdvr.exetjplvjb.exelrrjrfp.exejrvfd.exevhrph.exehhftvpn.exelvpdj.exeffrthpv.exetbjxlf.exenfdhjhd.exefnnjjht.exexbxjlbd.exephdhr.exeffndfj.exehhftdl.exebpbjp.exebfllll.exepxxhv.exertfbrr.exetvxdp.exexdphbp.exefjbnf.exexppxt.exelvlthpn.exepblrn.exeltbjlhj.exexbpxbp.exejbjpn.exetjrvf.exebtthv.exextvjhrh.exetlffx.exefjhvbd.exelxlvlr.exefxpxvh.exejvvrf.exexhpvh.exepjprfrl.exelhbljvt.exehnpnhrl.exefrlnbb.exejpdrj.exehjtvx.exevhbvfft.exexdpxxhf.exerfjfl.exerjvrvrp.exednvdxr.exentddl.exebfxjrd.exerxtpt.exejtxvvd.exenvvbj.exepvdtbt.exehlvxdvh.exejlpdr.exenfvnl.exenvfxr.exeflrrhb.exelttllb.exepid process 2808 xrllv.exe 2448 ddvvnp.exe 2504 bndxbhr.exe 2512 jrpdhdb.exe 2384 hhtdvr.exe 2528 tjplvjb.exe 2372 lrrjrfp.exe 2788 jrvfd.exe 240 vhrph.exe 1532 hhftvpn.exe 1996 lvpdj.exe 2648 ffrthpv.exe 2696 tbjxlf.exe 1456 nfdhjhd.exe 1976 fnnjjht.exe 2204 xbxjlbd.exe 2172 phdhr.exe 816 ffndfj.exe 1724 hhftdl.exe 2060 bpbjp.exe 528 bfllll.exe 684 pxxhv.exe 1316 rtfbrr.exe 400 tvxdp.exe 1152 xdphbp.exe 1804 fjbnf.exe 1888 xppxt.exe 2828 lvlthpn.exe 968 pblrn.exe 2256 ltbjlhj.exe 2780 xbpxbp.exe 2732 jbjpn.exe 1932 tjrvf.exe 2944 btthv.exe 3036 xtvjhrh.exe 1624 tlffx.exe 2592 fjhvbd.exe 2600 lxlvlr.exe 2504 fxpxvh.exe 2652 jvvrf.exe 2564 xhpvh.exe 2492 pjprfrl.exe 2388 lhbljvt.exe 2372 hnpnhrl.exe 3020 frlnbb.exe 1512 jpdrj.exe 1124 hjtvx.exe 940 vhbvfft.exe 960 xdpxxhf.exe 2532 rfjfl.exe 1828 rjvrvrp.exe 1836 dnvdxr.exe 1972 ntddl.exe 1976 bfxjrd.exe 2228 rxtpt.exe 2184 jtxvvd.exe 1704 nvvbj.exe 3044 pvdtbt.exe 1724 hlvxdvh.exe 856 jlpdr.exe 2540 nfvnl.exe 2104 nvfxr.exe 2940 flrrhb.exe 2132 lttllb.exe -
Processes:
resource yara_rule behavioral1/memory/2320-0-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2320-7-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2808-16-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2448-27-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2504-36-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2512-46-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2384-57-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2372-74-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2788-79-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/240-89-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1996-115-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2696-132-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1456-134-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1976-151-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2172-169-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1724-188-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/528-207-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/684-216-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1316-225-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/400-235-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1152-246-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/968-277-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2256-294-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1932-316-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1624-330-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2600-351-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2504-358-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2652-367-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1124-412-0x0000000000230000-0x000000000025E000-memory.dmp upx behavioral1/memory/960-427-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1836-443-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1836-452-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1972-453-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/3044-494-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2940-526-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/3060-541-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1856-539-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1656-574-0x00000000003B0000-0x00000000003DE000-memory.dmp upx behavioral1/memory/2776-585-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1272-598-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2764-599-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2564-675-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dc0496679542939a7fc9583d4daa8400_NeikiAnalytics.exexrllv.exeddvvnp.exebndxbhr.exejrpdhdb.exehhtdvr.exetjplvjb.exelrrjrfp.exejrvfd.exevhrph.exehhftvpn.exelvpdj.exeffrthpv.exetbjxlf.exenfdhjhd.exefnnjjht.exedescription pid process target process PID 2320 wrote to memory of 2808 2320 dc0496679542939a7fc9583d4daa8400_NeikiAnalytics.exe xrllv.exe PID 2320 wrote to memory of 2808 2320 dc0496679542939a7fc9583d4daa8400_NeikiAnalytics.exe xrllv.exe PID 2320 wrote to memory of 2808 2320 dc0496679542939a7fc9583d4daa8400_NeikiAnalytics.exe xrllv.exe PID 2320 wrote to memory of 2808 2320 dc0496679542939a7fc9583d4daa8400_NeikiAnalytics.exe xrllv.exe PID 2808 wrote to memory of 2448 2808 xrllv.exe ddvvnp.exe PID 2808 wrote to memory of 2448 2808 xrllv.exe ddvvnp.exe PID 2808 wrote to memory of 2448 2808 xrllv.exe ddvvnp.exe PID 2808 wrote to memory of 2448 2808 xrllv.exe ddvvnp.exe PID 2448 wrote to memory of 2504 2448 ddvvnp.exe bndxbhr.exe PID 2448 wrote to memory of 2504 2448 ddvvnp.exe bndxbhr.exe PID 2448 wrote to memory of 2504 2448 ddvvnp.exe bndxbhr.exe PID 2448 wrote to memory of 2504 2448 ddvvnp.exe bndxbhr.exe PID 2504 wrote to memory of 2512 2504 bndxbhr.exe jrpdhdb.exe PID 2504 wrote to memory of 2512 2504 bndxbhr.exe jrpdhdb.exe PID 2504 wrote to memory of 2512 2504 bndxbhr.exe jrpdhdb.exe PID 2504 wrote to memory of 2512 2504 bndxbhr.exe jrpdhdb.exe PID 2512 wrote to memory of 2384 2512 jrpdhdb.exe hhtdvr.exe PID 2512 wrote to memory of 2384 2512 jrpdhdb.exe hhtdvr.exe PID 2512 wrote to memory of 2384 2512 jrpdhdb.exe hhtdvr.exe PID 2512 wrote to memory of 2384 2512 jrpdhdb.exe hhtdvr.exe PID 2384 wrote to memory of 2528 2384 hhtdvr.exe tjplvjb.exe PID 2384 wrote to memory of 2528 2384 hhtdvr.exe tjplvjb.exe PID 2384 wrote to memory of 2528 2384 hhtdvr.exe tjplvjb.exe PID 2384 wrote to memory of 2528 2384 hhtdvr.exe tjplvjb.exe PID 2528 wrote to memory of 2372 2528 tjplvjb.exe lrrjrfp.exe PID 2528 wrote to memory of 2372 2528 tjplvjb.exe lrrjrfp.exe PID 2528 wrote to memory of 2372 2528 tjplvjb.exe lrrjrfp.exe PID 2528 wrote to memory of 2372 2528 tjplvjb.exe lrrjrfp.exe PID 2372 wrote to memory of 2788 2372 lrrjrfp.exe jrvfd.exe PID 2372 wrote to memory of 2788 2372 lrrjrfp.exe jrvfd.exe PID 2372 wrote to memory of 2788 2372 lrrjrfp.exe jrvfd.exe PID 2372 wrote to memory of 2788 2372 lrrjrfp.exe jrvfd.exe PID 2788 wrote to memory of 240 2788 jrvfd.exe vhrph.exe PID 2788 wrote to memory of 240 2788 jrvfd.exe vhrph.exe PID 2788 wrote to memory of 240 2788 jrvfd.exe vhrph.exe PID 2788 wrote to memory of 240 2788 jrvfd.exe vhrph.exe PID 240 wrote to memory of 1532 240 vhrph.exe hhftvpn.exe PID 240 wrote to memory of 1532 240 vhrph.exe hhftvpn.exe PID 240 wrote to memory of 1532 240 vhrph.exe hhftvpn.exe PID 240 wrote to memory of 1532 240 vhrph.exe hhftvpn.exe PID 1532 wrote to memory of 1996 1532 hhftvpn.exe lvpdj.exe PID 1532 wrote to memory of 1996 1532 hhftvpn.exe lvpdj.exe PID 1532 wrote to memory of 1996 1532 hhftvpn.exe lvpdj.exe PID 1532 wrote to memory of 1996 1532 hhftvpn.exe lvpdj.exe PID 1996 wrote to memory of 2648 1996 lvpdj.exe ffrthpv.exe PID 1996 wrote to memory of 2648 1996 lvpdj.exe ffrthpv.exe PID 1996 wrote to memory of 2648 1996 lvpdj.exe ffrthpv.exe PID 1996 wrote to memory of 2648 1996 lvpdj.exe ffrthpv.exe PID 2648 wrote to memory of 2696 2648 ffrthpv.exe tbjxlf.exe PID 2648 wrote to memory of 2696 2648 ffrthpv.exe tbjxlf.exe PID 2648 wrote to memory of 2696 2648 ffrthpv.exe tbjxlf.exe PID 2648 wrote to memory of 2696 2648 ffrthpv.exe tbjxlf.exe PID 2696 wrote to memory of 1456 2696 tbjxlf.exe nfdhjhd.exe PID 2696 wrote to memory of 1456 2696 tbjxlf.exe nfdhjhd.exe PID 2696 wrote to memory of 1456 2696 tbjxlf.exe nfdhjhd.exe PID 2696 wrote to memory of 1456 2696 tbjxlf.exe nfdhjhd.exe PID 1456 wrote to memory of 1976 1456 nfdhjhd.exe fnnjjht.exe PID 1456 wrote to memory of 1976 1456 nfdhjhd.exe fnnjjht.exe PID 1456 wrote to memory of 1976 1456 nfdhjhd.exe fnnjjht.exe PID 1456 wrote to memory of 1976 1456 nfdhjhd.exe fnnjjht.exe PID 1976 wrote to memory of 2204 1976 fnnjjht.exe xbxjlbd.exe PID 1976 wrote to memory of 2204 1976 fnnjjht.exe xbxjlbd.exe PID 1976 wrote to memory of 2204 1976 fnnjjht.exe xbxjlbd.exe PID 1976 wrote to memory of 2204 1976 fnnjjht.exe xbxjlbd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc0496679542939a7fc9583d4daa8400_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dc0496679542939a7fc9583d4daa8400_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\xrllv.exec:\xrllv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\ddvvnp.exec:\ddvvnp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\bndxbhr.exec:\bndxbhr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\jrpdhdb.exec:\jrpdhdb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\hhtdvr.exec:\hhtdvr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\tjplvjb.exec:\tjplvjb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\lrrjrfp.exec:\lrrjrfp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\jrvfd.exec:\jrvfd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\vhrph.exec:\vhrph.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
\??\c:\hhftvpn.exec:\hhftvpn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\lvpdj.exec:\lvpdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\ffrthpv.exec:\ffrthpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\tbjxlf.exec:\tbjxlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\nfdhjhd.exec:\nfdhjhd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\fnnjjht.exec:\fnnjjht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\xbxjlbd.exec:\xbxjlbd.exe17⤵
- Executes dropped EXE
PID:2204 -
\??\c:\phdhr.exec:\phdhr.exe18⤵
- Executes dropped EXE
PID:2172 -
\??\c:\ffndfj.exec:\ffndfj.exe19⤵
- Executes dropped EXE
PID:816 -
\??\c:\hhftdl.exec:\hhftdl.exe20⤵
- Executes dropped EXE
PID:1724 -
\??\c:\bpbjp.exec:\bpbjp.exe21⤵
- Executes dropped EXE
PID:2060 -
\??\c:\bfllll.exec:\bfllll.exe22⤵
- Executes dropped EXE
PID:528 -
\??\c:\pxxhv.exec:\pxxhv.exe23⤵
- Executes dropped EXE
PID:684 -
\??\c:\rtfbrr.exec:\rtfbrr.exe24⤵
- Executes dropped EXE
PID:1316 -
\??\c:\tvxdp.exec:\tvxdp.exe25⤵
- Executes dropped EXE
PID:400 -
\??\c:\xdphbp.exec:\xdphbp.exe26⤵
- Executes dropped EXE
PID:1152 -
\??\c:\fjbnf.exec:\fjbnf.exe27⤵
- Executes dropped EXE
PID:1804 -
\??\c:\xppxt.exec:\xppxt.exe28⤵
- Executes dropped EXE
PID:1888 -
\??\c:\lvlthpn.exec:\lvlthpn.exe29⤵
- Executes dropped EXE
PID:2828 -
\??\c:\pblrn.exec:\pblrn.exe30⤵
- Executes dropped EXE
PID:968 -
\??\c:\ltbjlhj.exec:\ltbjlhj.exe31⤵
- Executes dropped EXE
PID:2256 -
\??\c:\xbpxbp.exec:\xbpxbp.exe32⤵
- Executes dropped EXE
PID:2780 -
\??\c:\jbjpn.exec:\jbjpn.exe33⤵
- Executes dropped EXE
PID:2732 -
\??\c:\tjrvf.exec:\tjrvf.exe34⤵
- Executes dropped EXE
PID:1932 -
\??\c:\btthv.exec:\btthv.exe35⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xtvjhrh.exec:\xtvjhrh.exe36⤵
- Executes dropped EXE
PID:3036 -
\??\c:\tlffx.exec:\tlffx.exe37⤵
- Executes dropped EXE
PID:1624 -
\??\c:\fjhvbd.exec:\fjhvbd.exe38⤵
- Executes dropped EXE
PID:2592 -
\??\c:\lxlvlr.exec:\lxlvlr.exe39⤵
- Executes dropped EXE
PID:2600 -
\??\c:\fxpxvh.exec:\fxpxvh.exe40⤵
- Executes dropped EXE
PID:2504 -
\??\c:\jvvrf.exec:\jvvrf.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xhpvh.exec:\xhpvh.exe42⤵
- Executes dropped EXE
PID:2564 -
\??\c:\pjprfrl.exec:\pjprfrl.exe43⤵
- Executes dropped EXE
PID:2492 -
\??\c:\lhbljvt.exec:\lhbljvt.exe44⤵
- Executes dropped EXE
PID:2388 -
\??\c:\hnpnhrl.exec:\hnpnhrl.exe45⤵
- Executes dropped EXE
PID:2372 -
\??\c:\frlnbb.exec:\frlnbb.exe46⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jpdrj.exec:\jpdrj.exe47⤵
- Executes dropped EXE
PID:1512 -
\??\c:\hjtvx.exec:\hjtvx.exe48⤵
- Executes dropped EXE
PID:1124 -
\??\c:\vhbvfft.exec:\vhbvfft.exe49⤵
- Executes dropped EXE
PID:940 -
\??\c:\xdpxxhf.exec:\xdpxxhf.exe50⤵
- Executes dropped EXE
PID:960 -
\??\c:\rfjfl.exec:\rfjfl.exe51⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rjvrvrp.exec:\rjvrvrp.exe52⤵
- Executes dropped EXE
PID:1828 -
\??\c:\dnvdxr.exec:\dnvdxr.exe53⤵
- Executes dropped EXE
PID:1836 -
\??\c:\ntddl.exec:\ntddl.exe54⤵
- Executes dropped EXE
PID:1972 -
\??\c:\bfxjrd.exec:\bfxjrd.exe55⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rxtpt.exec:\rxtpt.exe56⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jtxvvd.exec:\jtxvvd.exe57⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nvvbj.exec:\nvvbj.exe58⤵
- Executes dropped EXE
PID:1704 -
\??\c:\pvdtbt.exec:\pvdtbt.exe59⤵
- Executes dropped EXE
PID:3044 -
\??\c:\hlvxdvh.exec:\hlvxdvh.exe60⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jlpdr.exec:\jlpdr.exe61⤵
- Executes dropped EXE
PID:856 -
\??\c:\nfvnl.exec:\nfvnl.exe62⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nvfxr.exec:\nvfxr.exe63⤵
- Executes dropped EXE
PID:2104 -
\??\c:\flrrhb.exec:\flrrhb.exe64⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lttllb.exec:\lttllb.exe65⤵
- Executes dropped EXE
PID:2132 -
\??\c:\ldbxrtl.exec:\ldbxrtl.exe66⤵PID:3060
-
\??\c:\nhbvpdt.exec:\nhbvpdt.exe67⤵PID:1856
-
\??\c:\dttprj.exec:\dttprj.exe68⤵PID:1884
-
\??\c:\ldvnfxx.exec:\ldvnfxx.exe69⤵PID:2740
-
\??\c:\djrfddp.exec:\djrfddp.exe70⤵PID:1808
-
\??\c:\nhtrblr.exec:\nhtrblr.exe71⤵PID:2116
-
\??\c:\btdjhnn.exec:\btdjhnn.exe72⤵PID:1656
-
\??\c:\xvbpxr.exec:\xvbpxr.exe73⤵PID:1956
-
\??\c:\hbnnxb.exec:\hbnnxb.exe74⤵PID:2776
-
\??\c:\pxhjtjh.exec:\pxhjtjh.exe75⤵PID:1272
-
\??\c:\rjpvl.exec:\rjpvl.exe76⤵PID:2764
-
\??\c:\hrjnv.exec:\hrjnv.exe77⤵PID:2748
-
\??\c:\nxjdjr.exec:\nxjdjr.exe78⤵PID:884
-
\??\c:\njtjjd.exec:\njtjjd.exe79⤵PID:2136
-
\??\c:\tlrnl.exec:\tlrnl.exe80⤵PID:2808
-
\??\c:\btrbt.exec:\btrbt.exe81⤵PID:2924
-
\??\c:\pprfvrx.exec:\pprfvrx.exe82⤵PID:1212
-
\??\c:\llrxxhn.exec:\llrxxhn.exe83⤵PID:2496
-
\??\c:\rbbdlrn.exec:\rbbdlrn.exe84⤵PID:2728
-
\??\c:\jdxjnxl.exec:\jdxjnxl.exe85⤵PID:2364
-
\??\c:\bnnhv.exec:\bnnhv.exe86⤵PID:2512
-
\??\c:\lfjfhpl.exec:\lfjfhpl.exe87⤵PID:2384
-
\??\c:\nrrrv.exec:\nrrrv.exe88⤵PID:2564
-
\??\c:\tjfdxrb.exec:\tjfdxrb.exe89⤵PID:2528
-
\??\c:\xtjnh.exec:\xtjnh.exe90⤵PID:2792
-
\??\c:\rfnrh.exec:\rfnrh.exe91⤵PID:1760
-
\??\c:\xbfbjl.exec:\xbfbjl.exe92⤵PID:1500
-
\??\c:\nrpjhrr.exec:\nrpjhrr.exe93⤵PID:1048
-
\??\c:\plvhn.exec:\plvhn.exe94⤵PID:1168
-
\??\c:\vnppbb.exec:\vnppbb.exe95⤵PID:1996
-
\??\c:\nvnhf.exec:\nvnhf.exe96⤵PID:960
-
\??\c:\pxhvhd.exec:\pxhvhd.exe97⤵PID:1880
-
\??\c:\ffbfx.exec:\ffbfx.exe98⤵PID:2696
-
\??\c:\bvfpjl.exec:\bvfpjl.exe99⤵PID:1796
-
\??\c:\fplxrhj.exec:\fplxrhj.exe100⤵PID:2312
-
\??\c:\rnbrd.exec:\rnbrd.exe101⤵PID:1480
-
\??\c:\rbndlv.exec:\rbndlv.exe102⤵PID:1768
-
\??\c:\vdvpl.exec:\vdvpl.exe103⤵PID:2172
-
\??\c:\dhlbnlr.exec:\dhlbnlr.exe104⤵PID:1660
-
\??\c:\jxjblf.exec:\jxjblf.exe105⤵PID:1776
-
\??\c:\jnhdn.exec:\jnhdn.exe106⤵PID:2096
-
\??\c:\nxvhvb.exec:\nxvhvb.exe107⤵PID:772
-
\??\c:\rrjxvlh.exec:\rrjxvlh.exe108⤵PID:788
-
\??\c:\lbfftb.exec:\lbfftb.exe109⤵PID:2724
-
\??\c:\dntnb.exec:\dntnb.exe110⤵PID:1304
-
\??\c:\rbbbrv.exec:\rbbbrv.exe111⤵PID:2132
-
\??\c:\bdjbtvx.exec:\bdjbtvx.exe112⤵PID:836
-
\??\c:\xnpptvb.exec:\xnpptvb.exe113⤵PID:1392
-
\??\c:\hffvfx.exec:\hffvfx.exe114⤵PID:780
-
\??\c:\htpjn.exec:\htpjn.exe115⤵PID:948
-
\??\c:\lllfpn.exec:\lllfpn.exe116⤵PID:1568
-
\??\c:\brxxx.exec:\brxxx.exe117⤵PID:1892
-
\??\c:\rjbbhpj.exec:\rjbbhpj.exe118⤵PID:3000
-
\??\c:\ndpxr.exec:\ndpxr.exe119⤵PID:2036
-
\??\c:\btnjntj.exec:\btnjntj.exe120⤵PID:1744
-
\??\c:\njhhjtb.exec:\njhhjtb.exe121⤵PID:2440
-
\??\c:\vfftd.exec:\vfftd.exe122⤵PID:2256
-
\??\c:\btfbdr.exec:\btfbdr.exe123⤵PID:2240
-
\??\c:\dfbpfl.exec:\dfbpfl.exe124⤵PID:1936
-
\??\c:\jjxxn.exec:\jjxxn.exe125⤵PID:1352
-
\??\c:\dhpthv.exec:\dhpthv.exe126⤵PID:2884
-
\??\c:\tdbhd.exec:\tdbhd.exe127⤵PID:1716
-
\??\c:\pppbtvh.exec:\pppbtvh.exe128⤵PID:2860
-
\??\c:\dfdvx.exec:\dfdvx.exe129⤵PID:2480
-
\??\c:\tjfdv.exec:\tjfdv.exe130⤵PID:564
-
\??\c:\hnrnljn.exec:\hnrnljn.exe131⤵PID:2636
-
\??\c:\thxdxrr.exec:\thxdxrr.exe132⤵PID:2412
-
\??\c:\vpvtfxt.exec:\vpvtfxt.exe133⤵PID:2352
-
\??\c:\pvhtdb.exec:\pvhtdb.exe134⤵PID:2356
-
\??\c:\pxjhnjp.exec:\pxjhnjp.exe135⤵PID:2388
-
\??\c:\jbrlj.exec:\jbrlj.exe136⤵PID:2400
-
\??\c:\hjjnxp.exec:\hjjnxp.exe137⤵PID:2372
-
\??\c:\rrtjbrv.exec:\rrtjbrv.exe138⤵PID:1504
-
\??\c:\fvlbl.exec:\fvlbl.exe139⤵PID:848
-
\??\c:\xndxf.exec:\xndxf.exe140⤵PID:648
-
\??\c:\ftdpbxr.exec:\ftdpbxr.exe141⤵PID:1980
-
\??\c:\tnvdbnp.exec:\tnvdbnp.exe142⤵PID:2648
-
\??\c:\pdxbj.exec:\pdxbj.exe143⤵PID:1276
-
\??\c:\jjxjbv.exec:\jjxjbv.exe144⤵PID:1816
-
\??\c:\bdhfnjj.exec:\bdhfnjj.exe145⤵PID:1964
-
\??\c:\fvhtr.exec:\fvhtr.exe146⤵PID:1968
-
\??\c:\thjjv.exec:\thjjv.exe147⤵PID:1036
-
\??\c:\blnvnj.exec:\blnvnj.exe148⤵PID:1480
-
\??\c:\dvddn.exec:\dvddn.exe149⤵PID:1768
-
\??\c:\rdtpv.exec:\rdtpv.exe150⤵PID:1588
-
\??\c:\pjxdn.exec:\pjxdn.exe151⤵PID:1660
-
\??\c:\pdbrr.exec:\pdbrr.exe152⤵PID:1288
-
\??\c:\pfpjr.exec:\pfpjr.exe153⤵PID:2916
-
\??\c:\hdljj.exec:\hdljj.exe154⤵PID:336
-
\??\c:\vjvhbhn.exec:\vjvhbhn.exe155⤵PID:2920
-
\??\c:\nxrjrx.exec:\nxrjrx.exe156⤵PID:1144
-
\??\c:\jvtnxr.exec:\jvtnxr.exe157⤵PID:2980
-
\??\c:\hjpvnd.exec:\hjpvnd.exe158⤵PID:436
-
\??\c:\xhlvnxj.exec:\xhlvnxj.exe159⤵PID:1576
-
\??\c:\fnvfr.exec:\fnvfr.exe160⤵PID:2148
-
\??\c:\jjvnbf.exec:\jjvnbf.exe161⤵PID:1072
-
\??\c:\fnlhjtp.exec:\fnlhjtp.exe162⤵PID:2140
-
\??\c:\hbhtbtt.exec:\hbhtbtt.exe163⤵PID:112
-
\??\c:\pvvpx.exec:\pvvpx.exe164⤵PID:2756
-
\??\c:\dfvvp.exec:\dfvvp.exe165⤵PID:2832
-
\??\c:\vvtttnl.exec:\vvtttnl.exe166⤵PID:1764
-
\??\c:\pdfvj.exec:\pdfvj.exe167⤵PID:2296
-
\??\c:\fjbvdb.exec:\fjbvdb.exe168⤵PID:108
-
\??\c:\vlppj.exec:\vlppj.exe169⤵PID:1528
-
\??\c:\xjlnfn.exec:\xjlnfn.exe170⤵PID:1676
-
\??\c:\hhbxbbh.exec:\hhbxbbh.exe171⤵PID:2320
-
\??\c:\xtvfd.exec:\xtvfd.exe172⤵PID:2136
-
\??\c:\lpvxh.exec:\lpvxh.exe173⤵PID:2016
-
\??\c:\bnrpdv.exec:\bnrpdv.exe174⤵PID:1212
-
\??\c:\plhhh.exec:\plhhh.exe175⤵PID:2592
-
\??\c:\nlvdrx.exec:\nlvdrx.exe176⤵PID:2604
-
\??\c:\xbfll.exec:\xbfll.exe177⤵PID:2628
-
\??\c:\thjhllf.exec:\thjhllf.exe178⤵PID:2652
-
\??\c:\bxlrbr.exec:\bxlrbr.exe179⤵PID:2536
-
\??\c:\bpffdf.exec:\bpffdf.exe180⤵PID:2524
-
\??\c:\tldhb.exec:\tldhb.exe181⤵PID:2376
-
\??\c:\pdrbl.exec:\pdrbl.exe182⤵PID:544
-
\??\c:\pxhpth.exec:\pxhpth.exe183⤵PID:1784
-
\??\c:\jnflfh.exec:\jnflfh.exe184⤵PID:240
-
\??\c:\ndrlhvb.exec:\ndrlhvb.exe185⤵PID:584
-
\??\c:\ftfpdp.exec:\ftfpdp.exe186⤵PID:1532
-
\??\c:\tdpvxpx.exec:\tdpvxpx.exe187⤵PID:848
-
\??\c:\pvxnfr.exec:\pvxnfr.exe188⤵PID:2568
-
\??\c:\bvfnflp.exec:\bvfnflp.exe189⤵PID:2784
-
\??\c:\bthpbhf.exec:\bthpbhf.exe190⤵PID:2648
-
\??\c:\bfhbl.exec:\bfhbl.exe191⤵PID:1276
-
\??\c:\nvtnlp.exec:\nvtnlp.exe192⤵PID:2020
-
\??\c:\ppnjjt.exec:\ppnjjt.exe193⤵PID:1964
-
\??\c:\hvbvpp.exec:\hvbvpp.exe194⤵PID:2208
-
\??\c:\xllhdxf.exec:\xllhdxf.exe195⤵PID:1036
-
\??\c:\rldtt.exec:\rldtt.exe196⤵PID:1652
-
\??\c:\fdnltlx.exec:\fdnltlx.exe197⤵PID:2176
-
\??\c:\tpvjr.exec:\tpvjr.exe198⤵PID:2252
-
\??\c:\pbtlvxb.exec:\pbtlvxb.exe199⤵PID:1208
-
\??\c:\hrthfpt.exec:\hrthfpt.exe200⤵PID:2456
-
\??\c:\pdxvvr.exec:\pdxvvr.exe201⤵PID:856
-
\??\c:\tttrlb.exec:\tttrlb.exe202⤵PID:600
-
\??\c:\xvvtjf.exec:\xvvtjf.exe203⤵PID:2104
-
\??\c:\pthljbp.exec:\pthljbp.exe204⤵PID:2920
-
\??\c:\lvftr.exec:\lvftr.exe205⤵PID:1316
-
\??\c:\jbhfvdx.exec:\jbhfvdx.exe206⤵PID:2132
-
\??\c:\dpvpv.exec:\dpvpv.exe207⤵PID:1840
-
\??\c:\jdfpv.exec:\jdfpv.exe208⤵PID:1856
-
\??\c:\rhblx.exec:\rhblx.exe209⤵PID:1636
-
\??\c:\dptnb.exec:\dptnb.exe210⤵PID:2324
-
\??\c:\rdljtrl.exec:\rdljtrl.exe211⤵PID:908
-
\??\c:\fjhrj.exec:\fjhrj.exe212⤵PID:1668
-
\??\c:\dtvbnhf.exec:\dtvbnhf.exe213⤵PID:568
-
\??\c:\plpffdh.exec:\plpffdh.exe214⤵PID:2708
-
\??\c:\fpjjf.exec:\fpjjf.exe215⤵PID:2304
-
\??\c:\tdnfrb.exec:\tdnfrb.exe216⤵PID:2764
-
\??\c:\tvldll.exec:\tvldll.exe217⤵PID:2780
-
\??\c:\hxhbjtb.exec:\hxhbjtb.exe218⤵PID:2720
-
\??\c:\bnhhrb.exec:\bnhhrb.exe219⤵PID:1352
-
\??\c:\vjrrh.exec:\vjrrh.exe220⤵PID:2500
-
\??\c:\jpvpb.exec:\jpvpb.exe221⤵PID:2596
-
\??\c:\tdhjx.exec:\tdhjx.exe222⤵PID:1520
-
\??\c:\vlpvv.exec:\vlpvv.exe223⤵PID:2716
-
\??\c:\vppjffj.exec:\vppjffj.exe224⤵PID:564
-
\??\c:\pndnvnt.exec:\pndnvnt.exe225⤵PID:2636
-
\??\c:\ftbdhjt.exec:\ftbdhjt.exe226⤵PID:1752
-
\??\c:\hlvlt.exec:\hlvlt.exe227⤵PID:2232
-
\??\c:\bxjhnb.exec:\bxjhnb.exe228⤵PID:2420
-
\??\c:\xjvpl.exec:\xjvpl.exe229⤵PID:2796
-
\??\c:\xhhvlp.exec:\xhhvlp.exe230⤵PID:3020
-
\??\c:\vjpxrr.exec:\vjpxrr.exe231⤵PID:2340
-
\??\c:\pfnlxd.exec:\pfnlxd.exe232⤵PID:240
-
\??\c:\nbnvhh.exec:\nbnvhh.exe233⤵PID:372
-
\??\c:\rvrttl.exec:\rvrttl.exe234⤵PID:1532
-
\??\c:\hrhjrx.exec:\hrhjrx.exe235⤵PID:940
-
\??\c:\trnvpt.exec:\trnvpt.exe236⤵PID:960
-
\??\c:\dnjjxtv.exec:\dnjjxtv.exe237⤵PID:2532
-
\??\c:\djflvjt.exec:\djflvjt.exe238⤵PID:1880
-
\??\c:\jrrrjd.exec:\jrrrjd.exe239⤵PID:2200
-
\??\c:\vfdnlhj.exec:\vfdnlhj.exe240⤵PID:2360
-
\??\c:\vjnprfj.exec:\vjnprfj.exe241⤵PID:1964
-
\??\c:\jtpvv.exec:\jtpvv.exe242⤵PID:2208