Analysis
-
max time kernel
133s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad9f4326ab37b131a40b8cfb1ff34160_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
ad9f4326ab37b131a40b8cfb1ff34160_NeikiAnalytics.exe
-
Size
59KB
-
MD5
ad9f4326ab37b131a40b8cfb1ff34160
-
SHA1
131e8050998db775a03dbb3a237c8c8b5abf1cbf
-
SHA256
3f10aec19278d2bc78a69f76ed534a8e2cc5b7a2a604e43a33e6a2f965423a05
-
SHA512
e77a85d157d85751a2c1096e9e9c532659fb2480d66919922dca3e82697bb6f6d1e072b9f2cdfd82453e992246a6b91964622ca1ad5573a5822ad925d8116755
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIms8:ymb3NkkiQ3mdBjFIsIF8
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2244-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-55-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/492-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1848-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xjphb.exeddnht.exentltv.exebldlhhn.exehhhnnb.exenjpdxpn.exetndvh.exerdbrth.exevhpjvp.exehdbrvv.exebjfrxdp.exeprtdp.exebvdnflp.exefpdtlp.exetbrtvrx.exevxjfd.exenjtvph.exejlfrl.exejhphftd.exelxrxdvp.exelvdrh.exeptdjxx.exehfnvbn.exevnrxpn.exetjjvlhb.exehhddb.exejllfljr.exelxpvxxn.exeprdrf.exelvtttxf.exepvfjprn.exenjpnl.exedvppjdv.exenfxxlb.exerdrjv.exevfhll.exenflfrhv.exerrlfpp.exevfpxbxv.exebtnvflx.exelfvxnh.exebbjldtb.exejtvhh.exexpnrlh.exerlphtft.exettvjtbr.exelphvd.exedtxfrj.exebhlfb.exexdhxvj.exexddxrh.exebjndrh.exepnppjnn.exejpxpnl.exefvxlp.exehpjjb.exevvflr.exepxpld.exevrtnpb.exeprfvxhh.exelbbth.exendvft.exexnlpd.exeljndddl.exepid process 2596 xjphb.exe 2548 ddnht.exe 2628 ntltv.exe 2920 bldlhhn.exe 2720 hhhnnb.exe 2412 njpdxpn.exe 2368 tndvh.exe 532 rdbrth.exe 2080 vhpjvp.exe 1716 hdbrvv.exe 1860 bjfrxdp.exe 492 prtdp.exe 348 bvdnflp.exe 2220 fpdtlp.exe 1952 tbrtvrx.exe 2316 vxjfd.exe 1588 njtvph.exe 1764 jlfrl.exe 3040 jhphftd.exe 2780 lxrxdvp.exe 2984 lvdrh.exe 2128 ptdjxx.exe 2948 hfnvbn.exe 1848 vnrxpn.exe 1200 tjjvlhb.exe 948 hhddb.exe 1624 jllfljr.exe 1752 lxpvxxn.exe 2180 prdrf.exe 1264 lvtttxf.exe 1240 pvfjprn.exe 2872 njpnl.exe 3036 dvppjdv.exe 1544 nfxxlb.exe 2536 rdrjv.exe 2632 vfhll.exe 2756 nflfrhv.exe 1932 rrlfpp.exe 2524 vfpxbxv.exe 2680 btnvflx.exe 2420 lfvxnh.exe 2828 bbjldtb.exe 2664 jtvhh.exe 1184 xpnrlh.exe 664 rlphtft.exe 1360 ttvjtbr.exe 1076 lphvd.exe 464 dtxfrj.exe 2320 bhlfb.exe 1860 xdhxvj.exe 1924 xddxrh.exe 1796 bjndrh.exe 1812 pnppjnn.exe 1972 jpxpnl.exe 1500 fvxlp.exe 1600 hpjjb.exe 1612 vvflr.exe 1476 pxpld.exe 2740 vrtnpb.exe 2772 prfvxhh.exe 2036 lbbth.exe 2976 ndvft.exe 2144 xnlpd.exe 1776 ljndddl.exe -
Processes:
resource yara_rule behavioral1/memory/2244-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/492-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/348-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1848-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-281-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ad9f4326ab37b131a40b8cfb1ff34160_NeikiAnalytics.exexjphb.exeddnht.exentltv.exebldlhhn.exehhhnnb.exenjpdxpn.exetndvh.exerdbrth.exevhpjvp.exehdbrvv.exebjfrxdp.exeprtdp.exebvdnflp.exefpdtlp.exetbrtvrx.exedescription pid process target process PID 2244 wrote to memory of 2596 2244 ad9f4326ab37b131a40b8cfb1ff34160_NeikiAnalytics.exe xjphb.exe PID 2244 wrote to memory of 2596 2244 ad9f4326ab37b131a40b8cfb1ff34160_NeikiAnalytics.exe xjphb.exe PID 2244 wrote to memory of 2596 2244 ad9f4326ab37b131a40b8cfb1ff34160_NeikiAnalytics.exe xjphb.exe PID 2244 wrote to memory of 2596 2244 ad9f4326ab37b131a40b8cfb1ff34160_NeikiAnalytics.exe xjphb.exe PID 2596 wrote to memory of 2548 2596 xjphb.exe ddnht.exe PID 2596 wrote to memory of 2548 2596 xjphb.exe ddnht.exe PID 2596 wrote to memory of 2548 2596 xjphb.exe ddnht.exe PID 2596 wrote to memory of 2548 2596 xjphb.exe ddnht.exe PID 2548 wrote to memory of 2628 2548 ddnht.exe ntltv.exe PID 2548 wrote to memory of 2628 2548 ddnht.exe ntltv.exe PID 2548 wrote to memory of 2628 2548 ddnht.exe ntltv.exe PID 2548 wrote to memory of 2628 2548 ddnht.exe ntltv.exe PID 2628 wrote to memory of 2920 2628 ntltv.exe bldlhhn.exe PID 2628 wrote to memory of 2920 2628 ntltv.exe bldlhhn.exe PID 2628 wrote to memory of 2920 2628 ntltv.exe bldlhhn.exe PID 2628 wrote to memory of 2920 2628 ntltv.exe bldlhhn.exe PID 2920 wrote to memory of 2720 2920 bldlhhn.exe hhhnnb.exe PID 2920 wrote to memory of 2720 2920 bldlhhn.exe hhhnnb.exe PID 2920 wrote to memory of 2720 2920 bldlhhn.exe hhhnnb.exe PID 2920 wrote to memory of 2720 2920 bldlhhn.exe hhhnnb.exe PID 2720 wrote to memory of 2412 2720 hhhnnb.exe njpdxpn.exe PID 2720 wrote to memory of 2412 2720 hhhnnb.exe njpdxpn.exe PID 2720 wrote to memory of 2412 2720 hhhnnb.exe njpdxpn.exe PID 2720 wrote to memory of 2412 2720 hhhnnb.exe njpdxpn.exe PID 2412 wrote to memory of 2368 2412 njpdxpn.exe tndvh.exe PID 2412 wrote to memory of 2368 2412 njpdxpn.exe tndvh.exe PID 2412 wrote to memory of 2368 2412 njpdxpn.exe tndvh.exe PID 2412 wrote to memory of 2368 2412 njpdxpn.exe tndvh.exe PID 2368 wrote to memory of 532 2368 tndvh.exe rdbrth.exe PID 2368 wrote to memory of 532 2368 tndvh.exe rdbrth.exe PID 2368 wrote to memory of 532 2368 tndvh.exe rdbrth.exe PID 2368 wrote to memory of 532 2368 tndvh.exe rdbrth.exe PID 532 wrote to memory of 2080 532 rdbrth.exe vhpjvp.exe PID 532 wrote to memory of 2080 532 rdbrth.exe vhpjvp.exe PID 532 wrote to memory of 2080 532 rdbrth.exe vhpjvp.exe PID 532 wrote to memory of 2080 532 rdbrth.exe vhpjvp.exe PID 2080 wrote to memory of 1716 2080 vhpjvp.exe hdbrvv.exe PID 2080 wrote to memory of 1716 2080 vhpjvp.exe hdbrvv.exe PID 2080 wrote to memory of 1716 2080 vhpjvp.exe hdbrvv.exe PID 2080 wrote to memory of 1716 2080 vhpjvp.exe hdbrvv.exe PID 1716 wrote to memory of 1860 1716 hdbrvv.exe bjfrxdp.exe PID 1716 wrote to memory of 1860 1716 hdbrvv.exe bjfrxdp.exe PID 1716 wrote to memory of 1860 1716 hdbrvv.exe bjfrxdp.exe PID 1716 wrote to memory of 1860 1716 hdbrvv.exe bjfrxdp.exe PID 1860 wrote to memory of 492 1860 bjfrxdp.exe prtdp.exe PID 1860 wrote to memory of 492 1860 bjfrxdp.exe prtdp.exe PID 1860 wrote to memory of 492 1860 bjfrxdp.exe prtdp.exe PID 1860 wrote to memory of 492 1860 bjfrxdp.exe prtdp.exe PID 492 wrote to memory of 348 492 prtdp.exe bvdnflp.exe PID 492 wrote to memory of 348 492 prtdp.exe bvdnflp.exe PID 492 wrote to memory of 348 492 prtdp.exe bvdnflp.exe PID 492 wrote to memory of 348 492 prtdp.exe bvdnflp.exe PID 348 wrote to memory of 2220 348 bvdnflp.exe fpdtlp.exe PID 348 wrote to memory of 2220 348 bvdnflp.exe fpdtlp.exe PID 348 wrote to memory of 2220 348 bvdnflp.exe fpdtlp.exe PID 348 wrote to memory of 2220 348 bvdnflp.exe fpdtlp.exe PID 2220 wrote to memory of 1952 2220 fpdtlp.exe tbrtvrx.exe PID 2220 wrote to memory of 1952 2220 fpdtlp.exe tbrtvrx.exe PID 2220 wrote to memory of 1952 2220 fpdtlp.exe tbrtvrx.exe PID 2220 wrote to memory of 1952 2220 fpdtlp.exe tbrtvrx.exe PID 1952 wrote to memory of 2316 1952 tbrtvrx.exe vxjfd.exe PID 1952 wrote to memory of 2316 1952 tbrtvrx.exe vxjfd.exe PID 1952 wrote to memory of 2316 1952 tbrtvrx.exe vxjfd.exe PID 1952 wrote to memory of 2316 1952 tbrtvrx.exe vxjfd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad9f4326ab37b131a40b8cfb1ff34160_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ad9f4326ab37b131a40b8cfb1ff34160_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\xjphb.exec:\xjphb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\ddnht.exec:\ddnht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\ntltv.exec:\ntltv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\bldlhhn.exec:\bldlhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\hhhnnb.exec:\hhhnnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\njpdxpn.exec:\njpdxpn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\tndvh.exec:\tndvh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\rdbrth.exec:\rdbrth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\vhpjvp.exec:\vhpjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\hdbrvv.exec:\hdbrvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\bjfrxdp.exec:\bjfrxdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\prtdp.exec:\prtdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:492 -
\??\c:\bvdnflp.exec:\bvdnflp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\fpdtlp.exec:\fpdtlp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\tbrtvrx.exec:\tbrtvrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\vxjfd.exec:\vxjfd.exe17⤵
- Executes dropped EXE
PID:2316 -
\??\c:\njtvph.exec:\njtvph.exe18⤵
- Executes dropped EXE
PID:1588 -
\??\c:\jlfrl.exec:\jlfrl.exe19⤵
- Executes dropped EXE
PID:1764 -
\??\c:\jhphftd.exec:\jhphftd.exe20⤵
- Executes dropped EXE
PID:3040 -
\??\c:\lxrxdvp.exec:\lxrxdvp.exe21⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lvdrh.exec:\lvdrh.exe22⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ptdjxx.exec:\ptdjxx.exe23⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hfnvbn.exec:\hfnvbn.exe24⤵
- Executes dropped EXE
PID:2948 -
\??\c:\vnrxpn.exec:\vnrxpn.exe25⤵
- Executes dropped EXE
PID:1848 -
\??\c:\tjjvlhb.exec:\tjjvlhb.exe26⤵
- Executes dropped EXE
PID:1200 -
\??\c:\hhddb.exec:\hhddb.exe27⤵
- Executes dropped EXE
PID:948 -
\??\c:\jllfljr.exec:\jllfljr.exe28⤵
- Executes dropped EXE
PID:1624 -
\??\c:\lxpvxxn.exec:\lxpvxxn.exe29⤵
- Executes dropped EXE
PID:1752 -
\??\c:\prdrf.exec:\prdrf.exe30⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lvtttxf.exec:\lvtttxf.exe31⤵
- Executes dropped EXE
PID:1264 -
\??\c:\pvfjprn.exec:\pvfjprn.exe32⤵
- Executes dropped EXE
PID:1240 -
\??\c:\njpnl.exec:\njpnl.exe33⤵
- Executes dropped EXE
PID:2872 -
\??\c:\dvppjdv.exec:\dvppjdv.exe34⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nfxxlb.exec:\nfxxlb.exe35⤵
- Executes dropped EXE
PID:1544 -
\??\c:\rdrjv.exec:\rdrjv.exe36⤵
- Executes dropped EXE
PID:2536 -
\??\c:\vfhll.exec:\vfhll.exe37⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nflfrhv.exec:\nflfrhv.exe38⤵
- Executes dropped EXE
PID:2756 -
\??\c:\rrlfpp.exec:\rrlfpp.exe39⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vfpxbxv.exec:\vfpxbxv.exe40⤵
- Executes dropped EXE
PID:2524 -
\??\c:\btnvflx.exec:\btnvflx.exe41⤵
- Executes dropped EXE
PID:2680 -
\??\c:\lfvxnh.exec:\lfvxnh.exe42⤵
- Executes dropped EXE
PID:2420 -
\??\c:\bbjldtb.exec:\bbjldtb.exe43⤵
- Executes dropped EXE
PID:2828 -
\??\c:\jtvhh.exec:\jtvhh.exe44⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xpnrlh.exec:\xpnrlh.exe45⤵
- Executes dropped EXE
PID:1184 -
\??\c:\rlphtft.exec:\rlphtft.exe46⤵
- Executes dropped EXE
PID:664 -
\??\c:\ttvjtbr.exec:\ttvjtbr.exe47⤵
- Executes dropped EXE
PID:1360 -
\??\c:\lphvd.exec:\lphvd.exe48⤵
- Executes dropped EXE
PID:1076 -
\??\c:\dtxfrj.exec:\dtxfrj.exe49⤵
- Executes dropped EXE
PID:464 -
\??\c:\bhlfb.exec:\bhlfb.exe50⤵
- Executes dropped EXE
PID:2320 -
\??\c:\xdhxvj.exec:\xdhxvj.exe51⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xddxrh.exec:\xddxrh.exe52⤵
- Executes dropped EXE
PID:1924 -
\??\c:\bjndrh.exec:\bjndrh.exe53⤵
- Executes dropped EXE
PID:1796 -
\??\c:\pnppjnn.exec:\pnppjnn.exe54⤵
- Executes dropped EXE
PID:1812 -
\??\c:\jpxpnl.exec:\jpxpnl.exe55⤵
- Executes dropped EXE
PID:1972 -
\??\c:\fvxlp.exec:\fvxlp.exe56⤵
- Executes dropped EXE
PID:1500 -
\??\c:\hpjjb.exec:\hpjjb.exe57⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vvflr.exec:\vvflr.exe58⤵
- Executes dropped EXE
PID:1612 -
\??\c:\pxpld.exec:\pxpld.exe59⤵
- Executes dropped EXE
PID:1476 -
\??\c:\vrtnpb.exec:\vrtnpb.exe60⤵
- Executes dropped EXE
PID:2740 -
\??\c:\prfvxhh.exec:\prfvxhh.exe61⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lbbth.exec:\lbbth.exe62⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ndvft.exec:\ndvft.exe63⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xnlpd.exec:\xnlpd.exe64⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ljndddl.exec:\ljndddl.exe65⤵
- Executes dropped EXE
PID:1776 -
\??\c:\ttxlhtb.exec:\ttxlhtb.exe66⤵PID:1784
-
\??\c:\thndx.exec:\thndx.exe67⤵PID:1372
-
\??\c:\drlddnf.exec:\drlddnf.exe68⤵PID:1312
-
\??\c:\jbbdlv.exec:\jbbdlv.exe69⤵PID:1608
-
\??\c:\xptxnx.exec:\xptxnx.exe70⤵PID:3056
-
\??\c:\ptttphd.exec:\ptttphd.exe71⤵PID:2160
-
\??\c:\xvnpvfr.exec:\xvnpvfr.exe72⤵PID:2276
-
\??\c:\bpjbvf.exec:\bpjbvf.exe73⤵PID:2116
-
\??\c:\tnfvlbv.exec:\tnfvlbv.exe74⤵PID:1264
-
\??\c:\ptxdjrt.exec:\ptxdjrt.exe75⤵PID:2032
-
\??\c:\fhhlbhp.exec:\fhhlbhp.exe76⤵PID:2168
-
\??\c:\hfxpr.exec:\hfxpr.exe77⤵PID:2944
-
\??\c:\fbnftfv.exec:\fbnftfv.exe78⤵PID:2908
-
\??\c:\pvptfpt.exec:\pvptfpt.exe79⤵PID:2556
-
\??\c:\dvltvfh.exec:\dvltvfh.exe80⤵PID:2564
-
\??\c:\dnbpvdj.exec:\dnbpvdj.exe81⤵PID:2588
-
\??\c:\bjddtvl.exec:\bjddtvl.exe82⤵PID:2560
-
\??\c:\fpbxbtj.exec:\fpbxbtj.exe83⤵PID:2600
-
\??\c:\ltrtlht.exec:\ltrtlht.exe84⤵PID:2544
-
\??\c:\bjbbbdb.exec:\bjbbbdb.exe85⤵PID:2408
-
\??\c:\lnpbtx.exec:\lnpbtx.exe86⤵PID:2460
-
\??\c:\fdxdn.exec:\fdxdn.exe87⤵PID:2836
-
\??\c:\lvtxtf.exec:\lvtxtf.exe88⤵PID:2368
-
\??\c:\pljxrpj.exec:\pljxrpj.exe89⤵PID:1156
-
\??\c:\nbjrv.exec:\nbjrv.exe90⤵PID:892
-
\??\c:\njvbtvl.exec:\njvbtvl.exe91⤵PID:1728
-
\??\c:\plrxxt.exec:\plrxxt.exe92⤵PID:1736
-
\??\c:\vrrfpr.exec:\vrrfpr.exe93⤵PID:1552
-
\??\c:\pbjxp.exec:\pbjxp.exe94⤵PID:1652
-
\??\c:\hhtxdb.exec:\hhtxdb.exe95⤵PID:1008
-
\??\c:\xbhhfdh.exec:\xbhhfdh.exe96⤵PID:2344
-
\??\c:\txfxx.exec:\txfxx.exe97⤵PID:2240
-
\??\c:\hffbbj.exec:\hffbbj.exe98⤵PID:2156
-
\??\c:\lrvlpn.exec:\lrvlpn.exe99⤵PID:1392
-
\??\c:\bjptn.exec:\bjptn.exe100⤵PID:1512
-
\??\c:\vbxrnd.exec:\vbxrnd.exe101⤵PID:1560
-
\??\c:\xbdldhh.exec:\xbdldhh.exe102⤵PID:2296
-
\??\c:\njhnj.exec:\njhnj.exe103⤵PID:3040
-
\??\c:\pdtlhb.exec:\pdtlhb.exe104⤵PID:2780
-
\??\c:\txbdttx.exec:\txbdttx.exe105⤵PID:2992
-
\??\c:\hfttfx.exec:\hfttfx.exe106⤵PID:944
-
\??\c:\ttdldld.exec:\ttdldld.exe107⤵PID:2108
-
\??\c:\hxddltv.exec:\hxddltv.exe108⤵PID:1336
-
\??\c:\vdljhb.exec:\vdljhb.exe109⤵PID:1848
-
\??\c:\hpbbl.exec:\hpbbl.exe110⤵PID:1004
-
\??\c:\bdfvfl.exec:\bdfvfl.exe111⤵PID:1348
-
\??\c:\lfnbh.exec:\lfnbh.exe112⤵PID:2352
-
\??\c:\nttfbr.exec:\nttfbr.exe113⤵PID:2184
-
\??\c:\hdljd.exec:\hdljd.exe114⤵PID:1128
-
\??\c:\llhpp.exec:\llhpp.exe115⤵PID:2252
-
\??\c:\hlnxhdb.exec:\hlnxhdb.exe116⤵PID:2180
-
\??\c:\xhpbhld.exec:\xhpbhld.exe117⤵PID:1304
-
\??\c:\nffhhb.exec:\nffhhb.exe118⤵PID:2256
-
\??\c:\xrtpbpr.exec:\xrtpbpr.exe119⤵PID:2844
-
\??\c:\drdddv.exec:\drdddv.exe120⤵PID:1148
-
\??\c:\ldjhfdb.exec:\ldjhfdb.exe121⤵PID:1664
-
\??\c:\rjxhlxd.exec:\rjxhlxd.exe122⤵PID:2596
-
\??\c:\ptbjh.exec:\ptbjh.exe123⤵PID:2652
-
\??\c:\txhjlbv.exec:\txhjlbv.exe124⤵PID:2688
-
\??\c:\jlxvxfj.exec:\jlxvxfj.exe125⤵PID:2416
-
\??\c:\ppnlldl.exec:\ppnlldl.exe126⤵PID:2568
-
\??\c:\ljjvjj.exec:\ljjvjj.exe127⤵PID:2672
-
\??\c:\lprnhd.exec:\lprnhd.exe128⤵PID:2424
-
\??\c:\bfrprt.exec:\bfrprt.exe129⤵PID:2408
-
\??\c:\xfpltl.exec:\xfpltl.exe130⤵PID:2832
-
\??\c:\lrxxpd.exec:\lrxxpd.exe131⤵PID:984
-
\??\c:\lllpl.exec:\lllpl.exe132⤵PID:1828
-
\??\c:\xrttnlx.exec:\xrttnlx.exe133⤵PID:744
-
\??\c:\lvdfxj.exec:\lvdfxj.exe134⤵PID:564
-
\??\c:\pvxdxpf.exec:\pvxdxpf.exe135⤵PID:1548
-
\??\c:\rfrjnb.exec:\rfrjnb.exe136⤵PID:1648
-
\??\c:\djpdlll.exec:\djpdlll.exe137⤵PID:2396
-
\??\c:\tjbfn.exec:\tjbfn.exe138⤵PID:348
-
\??\c:\rnrln.exec:\rnrln.exe139⤵PID:2356
-
\??\c:\pnbhnh.exec:\pnbhnh.exe140⤵PID:2716
-
\??\c:\rrpbj.exec:\rrpbj.exe141⤵PID:1528
-
\??\c:\fxlbld.exec:\fxlbld.exe142⤵PID:1388
-
\??\c:\vlnxld.exec:\vlnxld.exe143⤵PID:1428
-
\??\c:\tvnjbt.exec:\tvnjbt.exe144⤵PID:3048
-
\??\c:\lntlr.exec:\lntlr.exe145⤵PID:2996
-
\??\c:\jfbnxh.exec:\jfbnxh.exe146⤵PID:2812
-
\??\c:\fhbrrnr.exec:\fhbrrnr.exe147⤵PID:2952
-
\??\c:\xttdxp.exec:\xttdxp.exe148⤵PID:1272
-
\??\c:\bhxdtnh.exec:\bhxdtnh.exe149⤵PID:896
-
\??\c:\pfptxtl.exec:\pfptxtl.exe150⤵PID:1136
-
\??\c:\fnffn.exec:\fnffn.exe151⤵PID:1056
-
\??\c:\bxjjj.exec:\bxjjj.exe152⤵PID:1864
-
\??\c:\xxbfxr.exec:\xxbfxr.exe153⤵PID:1804
-
\??\c:\rthvd.exec:\rthvd.exe154⤵PID:1144
-
\??\c:\ddljpdh.exec:\ddljpdh.exe155⤵PID:820
-
\??\c:\nlfbpx.exec:\nlfbpx.exe156⤵PID:1708
-
\??\c:\dvdpfdh.exec:\dvdpfdh.exe157⤵PID:2748
-
\??\c:\pflhrph.exec:\pflhrph.exe158⤵PID:1292
-
\??\c:\lfrxd.exec:\lfrxd.exe159⤵PID:2160
-
\??\c:\fhjrdb.exec:\fhjrdb.exe160⤵PID:876
-
\??\c:\hxnllrd.exec:\hxnllrd.exe161⤵PID:2116
-
\??\c:\lhfnfn.exec:\lhfnfn.exe162⤵PID:1976
-
\??\c:\rrjlj.exec:\rrjlj.exe163⤵PID:2872
-
\??\c:\pxlpp.exec:\pxlpp.exe164⤵PID:2168
-
\??\c:\tlthxd.exec:\tlthxd.exe165⤵PID:2888
-
\??\c:\xhflvl.exec:\xhflvl.exe166⤵PID:2548
-
\??\c:\dlhhjdb.exec:\dlhhjdb.exe167⤵PID:2636
-
\??\c:\rtvpl.exec:\rtvpl.exe168⤵PID:2756
-
\??\c:\bhdxjf.exec:\bhdxjf.exe169⤵PID:1932
-
\??\c:\hrjnrnt.exec:\hrjnrnt.exe170⤵PID:2848
-
\??\c:\rblvfr.exec:\rblvfr.exe171⤵PID:2196
-
\??\c:\dndrllf.exec:\dndrllf.exe172⤵PID:2572
-
\??\c:\pdbdn.exec:\pdbdn.exe173⤵PID:2404
-
\??\c:\jbvdrn.exec:\jbvdrn.exe174⤵PID:480
-
\??\c:\vrpftb.exec:\vrpftb.exe175⤵PID:568
-
\??\c:\dldfnf.exec:\dldfnf.exe176⤵PID:664
-
\??\c:\hdppl.exec:\hdppl.exe177⤵PID:1156
-
\??\c:\nfhtbj.exec:\nfhtbj.exe178⤵PID:580
-
\??\c:\plldrt.exec:\plldrt.exe179⤵PID:816
-
\??\c:\xtnpx.exec:\xtnpx.exe180⤵PID:492
-
\??\c:\rtxpd.exec:\rtxpd.exe181⤵PID:1032
-
\??\c:\pllfdj.exec:\pllfdj.exe182⤵PID:1948
-
\??\c:\lntbff.exec:\lntbff.exe183⤵PID:748
-
\??\c:\jvlxtn.exec:\jvlxtn.exe184⤵PID:784
-
\??\c:\jjbrd.exec:\jjbrd.exe185⤵PID:2236
-
\??\c:\ntdlpvn.exec:\ntdlpvn.exe186⤵PID:1596
-
\??\c:\pxbfh.exec:\pxbfh.exe187⤵PID:1392
-
\??\c:\jlpbn.exec:\jlpbn.exe188⤵PID:1612
-
\??\c:\bpjllx.exec:\bpjllx.exe189⤵PID:2732
-
\??\c:\hvlnh.exec:\hvlnh.exe190⤵PID:2592
-
\??\c:\xvddj.exec:\xvddj.exe191⤵PID:2148
-
\??\c:\vvnpfd.exec:\vvnpfd.exe192⤵PID:2780
-
\??\c:\ltpnpp.exec:\ltpnpp.exe193⤵PID:2052
-
\??\c:\vdblh.exec:\vdblh.exe194⤵PID:2948
-
\??\c:\btprvpj.exec:\btprvpj.exe195⤵PID:2108
-
\??\c:\npxplt.exec:\npxplt.exe196⤵PID:1524
-
\??\c:\ddhrrbr.exec:\ddhrrbr.exe197⤵PID:2272
-
\??\c:\rdhjb.exec:\rdhjb.exe198⤵PID:884
-
\??\c:\xflnjb.exec:\xflnjb.exe199⤵PID:2360
-
\??\c:\hvxbbv.exec:\hvxbbv.exe200⤵PID:1508
-
\??\c:\vvnxbd.exec:\vvnxbd.exe201⤵PID:868
-
\??\c:\hfvjl.exec:\hfvjl.exe202⤵PID:2792
-
\??\c:\fvfnpd.exec:\fvfnpd.exe203⤵PID:2276
-
\??\c:\hdnlxnp.exec:\hdnlxnp.exe204⤵PID:2280
-
\??\c:\prpvpl.exec:\prpvpl.exe205⤵PID:1264
-
\??\c:\thtnpr.exec:\thtnpr.exe206⤵PID:2488
-
\??\c:\blnfv.exec:\blnfv.exe207⤵PID:3016
-
\??\c:\phrrrl.exec:\phrrrl.exe208⤵PID:2112
-
\??\c:\htlrnbl.exec:\htlrnbl.exe209⤵PID:2552
-
\??\c:\frnplp.exec:\frnplp.exe210⤵PID:2624
-
\??\c:\jnxtd.exec:\jnxtd.exe211⤵PID:2564
-
\??\c:\rxvxfv.exec:\rxvxfv.exe212⤵PID:1640
-
\??\c:\htfxfvb.exec:\htfxfvb.exe213⤵PID:2444
-
\??\c:\jhvdf.exec:\jhvdf.exe214⤵PID:2704
-
\??\c:\jpjpfp.exec:\jpjpfp.exe215⤵PID:2672
-
\??\c:\jhlxx.exec:\jhlxx.exe216⤵PID:2824
-
\??\c:\rxdfb.exec:\rxdfb.exe217⤵PID:2460
-
\??\c:\hbhlvvj.exec:\hbhlvvj.exe218⤵PID:2836
-
\??\c:\flvptdj.exec:\flvptdj.exe219⤵PID:984
-
\??\c:\lhvjh.exec:\lhvjh.exe220⤵PID:1828
-
\??\c:\bbdrd.exec:\bbdrd.exe221⤵PID:744
-
\??\c:\txnxlxf.exec:\txnxlxf.exe222⤵PID:564
-
\??\c:\trvlbp.exec:\trvlbp.exe223⤵PID:1548
-
\??\c:\fjtbn.exec:\fjtbn.exe224⤵PID:1644
-
\??\c:\ttdvfxh.exec:\ttdvfxh.exe225⤵PID:1248
-
\??\c:\vthxl.exec:\vthxl.exe226⤵PID:348
-
\??\c:\dldjpjh.exec:\dldjpjh.exe227⤵PID:2384
-
\??\c:\xdhpbn.exec:\xdhpbn.exe228⤵PID:1936
-
\??\c:\pfrnnn.exec:\pfrnnn.exe229⤵PID:2028
-
\??\c:\tvnljt.exec:\tvnljt.exe230⤵PID:2316
-
\??\c:\hplxx.exec:\hplxx.exe231⤵PID:1600
-
\??\c:\bxdptfd.exec:\bxdptfd.exe232⤵PID:3048
-
\??\c:\xvhpfp.exec:\xvhpfp.exe233⤵PID:2764
-
\??\c:\htvdrbf.exec:\htvdrbf.exe234⤵PID:2812
-
\??\c:\fxnnpt.exec:\fxnnpt.exe235⤵PID:2972
-
\??\c:\drdbxln.exec:\drdbxln.exe236⤵PID:2876
-
\??\c:\pdxnf.exec:\pdxnf.exe237⤵PID:896
-
\??\c:\hfrtht.exec:\hfrtht.exe238⤵PID:2092
-
\??\c:\hhffj.exec:\hhffj.exe239⤵PID:1056
-
\??\c:\prtll.exec:\prtll.exe240⤵PID:1864
-
\??\c:\bxfrbpd.exec:\bxfrbpd.exe241⤵PID:1804
-
\??\c:\ddnddv.exec:\ddnddv.exe242⤵PID:1144