Analysis
-
max time kernel
151s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 05:13
Behavioral task
behavioral1
Sample
b5ec551250661f81976b05fc3b349d70_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b5ec551250661f81976b05fc3b349d70_NeikiAnalytics.exe
-
Size
367KB
-
MD5
b5ec551250661f81976b05fc3b349d70
-
SHA1
64a266ef8803806778bce04eb1ad6f2ff556272d
-
SHA256
8333eb94e1de377d0b8bb58e36a3b559203193c3a3fe4f6e9424189fe56b357f
-
SHA512
f9d2892ec59106e54bd9678a0d998b66be57dc219a6a0fca547a7f7e8ec78819c308066dd55f8372e21733a81976d4881fc411fb771e32f085e7019609792e2f
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOFltH4tiAlSpgFZAzwdjcIlSpgFZZr3GSM/x5z:y4wFHoS3eFplAlSpgFZAKjcIlSpgFZZ4
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
Processes:
resource yara_rule behavioral1/memory/1676-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1440-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/836-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/808-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/304-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1816-279-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/980-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/544-299-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2336-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-348-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2456-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/676-524-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1936-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-551-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/968-600-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2820-617-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2652-653-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-696-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-786-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/768-824-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fbhxfv.exetxlbvhd.exexvvnbj.exefpfnrp.exefjtbd.exerxlplnj.exedxbbfh.exelfrndv.exepndhxlp.exettpfv.exevxjph.exepxpvxd.exehpjrf.exevjbxfx.exedthjxj.exejdrbxt.exehjphxj.exevthnph.exepthljt.exertrtvvb.exenrdnhv.exevbrfxh.exexhjlf.exebhbrf.exepxvxj.exehbxfx.exellllfxl.exexfbhldr.exehnnrx.exethhfhhl.exepxhtff.exerllxn.exexhprvp.exefnrrd.exexlbtdl.exepxtjnj.exevbfxf.exedbxhdfh.exepdrntth.exehpfxnxx.exehdnpvjp.exerhbxlpr.exenlfpx.exejtrjtd.exedhpjtt.exehndfx.exeptnrdjl.exerxfxrhl.exebpjllbt.exevbjhbtl.exeflpvrd.exenlhjpt.exexxpxvx.exeddxhfdn.exevrjlbtn.exenlldlp.exedlpvtbl.exehrvpp.exedljljfj.exebjhhfth.exefnrvth.exebplvllh.exentvjnp.exevtftxp.exepid process 1676 fbhxfv.exe 2940 txlbvhd.exe 2636 xvvnbj.exe 2548 fpfnrp.exe 2540 fjtbd.exe 2596 rxlplnj.exe 2680 dxbbfh.exe 2068 lfrndv.exe 580 pndhxlp.exe 2012 ttpfv.exe 1748 vxjph.exe 836 pxpvxd.exe 2716 hpjrf.exe 2212 vjbxfx.exe 1980 dthjxj.exe 1968 jdrbxt.exe 1648 hjphxj.exe 808 vthnph.exe 2520 pthljt.exe 3032 rtrtvvb.exe 2264 nrdnhv.exe 2776 vbrfxh.exe 2920 xhjlf.exe 304 bhbrf.exe 2056 pxvxj.exe 2040 hbxfx.exe 1764 llllfxl.exe 1604 xfbhldr.exe 1816 hnnrx.exe 980 thhfhhl.exe 544 pxhtff.exe 2868 rllxn.exe 1760 xhprvp.exe 2336 fnrrd.exe 1440 xlbtdl.exe 2272 pxtjnj.exe 2084 vbfxf.exe 2640 dbxhdfh.exe 2612 pdrntth.exe 2156 hpfxnxx.exe 2432 hdnpvjp.exe 2644 rhbxlpr.exe 2600 nlfpx.exe 2536 jtrjtd.exe 2456 dhpjtt.exe 2680 hndfx.exe 776 ptnrdjl.exe 1020 rxfxrhl.exe 2172 bpjllbt.exe 1736 vbjhbtl.exe 1748 flpvrd.exe 2608 nlhjpt.exe 2856 xxpxvx.exe 2236 ddxhfdn.exe 2032 vrjlbtn.exe 1980 nlldlp.exe 1968 dlpvtbl.exe 2184 hrvpp.exe 2228 dljljfj.exe 1696 bjhhfth.exe 2520 fnrvth.exe 2308 bplvllh.exe 324 ntvjnp.exe 676 vtftxp.exe -
Processes:
resource yara_rule behavioral1/memory/1440-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fbhxfv.exe upx C:\txlbvhd.exe upx behavioral1/memory/1676-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2940-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xvvnbj.exe upx behavioral1/memory/1440-8-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fpfnrp.exe upx behavioral1/memory/2636-40-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fjtbd.exe upx behavioral1/memory/2548-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-60-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxlplnj.exe upx behavioral1/memory/2596-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2680-72-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dxbbfh.exe upx behavioral1/memory/2680-79-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfrndv.exe upx behavioral1/memory/2068-82-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pndhxlp.exe upx behavioral1/memory/2068-91-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttpfv.exe upx C:\vxjph.exe upx C:\pxpvxd.exe upx behavioral1/memory/836-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/836-124-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hpjrf.exe upx behavioral1/memory/2716-126-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vjbxfx.exe upx behavioral1/memory/2716-134-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dthjxj.exe upx behavioral1/memory/2212-144-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdrbxt.exe upx C:\hjphxj.exe upx behavioral1/memory/1648-170-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vthnph.exe upx behavioral1/memory/808-179-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pthljt.exe upx C:\rtrtvvb.exe upx behavioral1/memory/2520-190-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nrdnhv.exe upx behavioral1/memory/3032-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2264-207-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vbrfxh.exe upx C:\xhjlf.exe upx behavioral1/memory/2776-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/304-230-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bhbrf.exe upx C:\pxvxj.exe upx behavioral1/memory/304-237-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hbxfx.exe upx C:\llllfxl.exe upx behavioral1/memory/1764-264-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xfbhldr.exe upx C:\hnnrx.exe upx C:\thhfhhl.exe upx C:\pxhtff.exe upx behavioral1/memory/980-289-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rllxn.exe upx behavioral1/memory/2336-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1440-322-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2336-321-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2272-329-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b5ec551250661f81976b05fc3b349d70_NeikiAnalytics.exefbhxfv.exetxlbvhd.exexvvnbj.exefpfnrp.exefjtbd.exerxlplnj.exedxbbfh.exelfrndv.exepndhxlp.exettpfv.exevxjph.exepxpvxd.exehpjrf.exevjbxfx.exedthjxj.exedescription pid process target process PID 1440 wrote to memory of 1676 1440 b5ec551250661f81976b05fc3b349d70_NeikiAnalytics.exe fbhxfv.exe PID 1440 wrote to memory of 1676 1440 b5ec551250661f81976b05fc3b349d70_NeikiAnalytics.exe fbhxfv.exe PID 1440 wrote to memory of 1676 1440 b5ec551250661f81976b05fc3b349d70_NeikiAnalytics.exe fbhxfv.exe PID 1440 wrote to memory of 1676 1440 b5ec551250661f81976b05fc3b349d70_NeikiAnalytics.exe fbhxfv.exe PID 1676 wrote to memory of 2940 1676 fbhxfv.exe txlbvhd.exe PID 1676 wrote to memory of 2940 1676 fbhxfv.exe txlbvhd.exe PID 1676 wrote to memory of 2940 1676 fbhxfv.exe txlbvhd.exe PID 1676 wrote to memory of 2940 1676 fbhxfv.exe txlbvhd.exe PID 2940 wrote to memory of 2636 2940 txlbvhd.exe xvvnbj.exe PID 2940 wrote to memory of 2636 2940 txlbvhd.exe xvvnbj.exe PID 2940 wrote to memory of 2636 2940 txlbvhd.exe xvvnbj.exe PID 2940 wrote to memory of 2636 2940 txlbvhd.exe xvvnbj.exe PID 2636 wrote to memory of 2548 2636 xvvnbj.exe fpfnrp.exe PID 2636 wrote to memory of 2548 2636 xvvnbj.exe fpfnrp.exe PID 2636 wrote to memory of 2548 2636 xvvnbj.exe fpfnrp.exe PID 2636 wrote to memory of 2548 2636 xvvnbj.exe fpfnrp.exe PID 2548 wrote to memory of 2540 2548 fpfnrp.exe fjtbd.exe PID 2548 wrote to memory of 2540 2548 fpfnrp.exe fjtbd.exe PID 2548 wrote to memory of 2540 2548 fpfnrp.exe fjtbd.exe PID 2548 wrote to memory of 2540 2548 fpfnrp.exe fjtbd.exe PID 2540 wrote to memory of 2596 2540 fjtbd.exe rxlplnj.exe PID 2540 wrote to memory of 2596 2540 fjtbd.exe rxlplnj.exe PID 2540 wrote to memory of 2596 2540 fjtbd.exe rxlplnj.exe PID 2540 wrote to memory of 2596 2540 fjtbd.exe rxlplnj.exe PID 2596 wrote to memory of 2680 2596 rxlplnj.exe dxbbfh.exe PID 2596 wrote to memory of 2680 2596 rxlplnj.exe dxbbfh.exe PID 2596 wrote to memory of 2680 2596 rxlplnj.exe dxbbfh.exe PID 2596 wrote to memory of 2680 2596 rxlplnj.exe dxbbfh.exe PID 2680 wrote to memory of 2068 2680 dxbbfh.exe lfrndv.exe PID 2680 wrote to memory of 2068 2680 dxbbfh.exe lfrndv.exe PID 2680 wrote to memory of 2068 2680 dxbbfh.exe lfrndv.exe PID 2680 wrote to memory of 2068 2680 dxbbfh.exe lfrndv.exe PID 2068 wrote to memory of 580 2068 lfrndv.exe pndhxlp.exe PID 2068 wrote to memory of 580 2068 lfrndv.exe pndhxlp.exe PID 2068 wrote to memory of 580 2068 lfrndv.exe pndhxlp.exe PID 2068 wrote to memory of 580 2068 lfrndv.exe pndhxlp.exe PID 580 wrote to memory of 2012 580 pndhxlp.exe ttpfv.exe PID 580 wrote to memory of 2012 580 pndhxlp.exe ttpfv.exe PID 580 wrote to memory of 2012 580 pndhxlp.exe ttpfv.exe PID 580 wrote to memory of 2012 580 pndhxlp.exe ttpfv.exe PID 2012 wrote to memory of 1748 2012 ttpfv.exe vxjph.exe PID 2012 wrote to memory of 1748 2012 ttpfv.exe vxjph.exe PID 2012 wrote to memory of 1748 2012 ttpfv.exe vxjph.exe PID 2012 wrote to memory of 1748 2012 ttpfv.exe vxjph.exe PID 1748 wrote to memory of 836 1748 vxjph.exe pxpvxd.exe PID 1748 wrote to memory of 836 1748 vxjph.exe pxpvxd.exe PID 1748 wrote to memory of 836 1748 vxjph.exe pxpvxd.exe PID 1748 wrote to memory of 836 1748 vxjph.exe pxpvxd.exe PID 836 wrote to memory of 2716 836 pxpvxd.exe hpjrf.exe PID 836 wrote to memory of 2716 836 pxpvxd.exe hpjrf.exe PID 836 wrote to memory of 2716 836 pxpvxd.exe hpjrf.exe PID 836 wrote to memory of 2716 836 pxpvxd.exe hpjrf.exe PID 2716 wrote to memory of 2212 2716 hpjrf.exe vjbxfx.exe PID 2716 wrote to memory of 2212 2716 hpjrf.exe vjbxfx.exe PID 2716 wrote to memory of 2212 2716 hpjrf.exe vjbxfx.exe PID 2716 wrote to memory of 2212 2716 hpjrf.exe vjbxfx.exe PID 2212 wrote to memory of 1980 2212 vjbxfx.exe dthjxj.exe PID 2212 wrote to memory of 1980 2212 vjbxfx.exe dthjxj.exe PID 2212 wrote to memory of 1980 2212 vjbxfx.exe dthjxj.exe PID 2212 wrote to memory of 1980 2212 vjbxfx.exe dthjxj.exe PID 1980 wrote to memory of 1968 1980 dthjxj.exe jdrbxt.exe PID 1980 wrote to memory of 1968 1980 dthjxj.exe jdrbxt.exe PID 1980 wrote to memory of 1968 1980 dthjxj.exe jdrbxt.exe PID 1980 wrote to memory of 1968 1980 dthjxj.exe jdrbxt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5ec551250661f81976b05fc3b349d70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b5ec551250661f81976b05fc3b349d70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\fbhxfv.exec:\fbhxfv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\txlbvhd.exec:\txlbvhd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\xvvnbj.exec:\xvvnbj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\fpfnrp.exec:\fpfnrp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\fjtbd.exec:\fjtbd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\rxlplnj.exec:\rxlplnj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\dxbbfh.exec:\dxbbfh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\lfrndv.exec:\lfrndv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\pndhxlp.exec:\pndhxlp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\ttpfv.exec:\ttpfv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\vxjph.exec:\vxjph.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\pxpvxd.exec:\pxpvxd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\hpjrf.exec:\hpjrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\vjbxfx.exec:\vjbxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\dthjxj.exec:\dthjxj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\jdrbxt.exec:\jdrbxt.exe17⤵
- Executes dropped EXE
PID:1968 -
\??\c:\hjphxj.exec:\hjphxj.exe18⤵
- Executes dropped EXE
PID:1648 -
\??\c:\vthnph.exec:\vthnph.exe19⤵
- Executes dropped EXE
PID:808 -
\??\c:\pthljt.exec:\pthljt.exe20⤵
- Executes dropped EXE
PID:2520 -
\??\c:\rtrtvvb.exec:\rtrtvvb.exe21⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nrdnhv.exec:\nrdnhv.exe22⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vbrfxh.exec:\vbrfxh.exe23⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xhjlf.exec:\xhjlf.exe24⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bhbrf.exec:\bhbrf.exe25⤵
- Executes dropped EXE
PID:304 -
\??\c:\pxvxj.exec:\pxvxj.exe26⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hbxfx.exec:\hbxfx.exe27⤵
- Executes dropped EXE
PID:2040 -
\??\c:\llllfxl.exec:\llllfxl.exe28⤵
- Executes dropped EXE
PID:1764 -
\??\c:\xfbhldr.exec:\xfbhldr.exe29⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hnnrx.exec:\hnnrx.exe30⤵
- Executes dropped EXE
PID:1816 -
\??\c:\thhfhhl.exec:\thhfhhl.exe31⤵
- Executes dropped EXE
PID:980 -
\??\c:\pxhtff.exec:\pxhtff.exe32⤵
- Executes dropped EXE
PID:544 -
\??\c:\rllxn.exec:\rllxn.exe33⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xhprvp.exec:\xhprvp.exe34⤵
- Executes dropped EXE
PID:1760 -
\??\c:\fnrrd.exec:\fnrrd.exe35⤵
- Executes dropped EXE
PID:2336 -
\??\c:\xlbtdl.exec:\xlbtdl.exe36⤵
- Executes dropped EXE
PID:1440 -
\??\c:\pxtjnj.exec:\pxtjnj.exe37⤵
- Executes dropped EXE
PID:2272 -
\??\c:\vbfxf.exec:\vbfxf.exe38⤵
- Executes dropped EXE
PID:2084 -
\??\c:\dbxhdfh.exec:\dbxhdfh.exe39⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pdrntth.exec:\pdrntth.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hpfxnxx.exec:\hpfxnxx.exe41⤵
- Executes dropped EXE
PID:2156 -
\??\c:\hdnpvjp.exec:\hdnpvjp.exe42⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rhbxlpr.exec:\rhbxlpr.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nlfpx.exec:\nlfpx.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\jtrjtd.exec:\jtrjtd.exe45⤵
- Executes dropped EXE
PID:2536 -
\??\c:\dhpjtt.exec:\dhpjtt.exe46⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hndfx.exec:\hndfx.exe47⤵
- Executes dropped EXE
PID:2680 -
\??\c:\ptnrdjl.exec:\ptnrdjl.exe48⤵
- Executes dropped EXE
PID:776 -
\??\c:\rxfxrhl.exec:\rxfxrhl.exe49⤵
- Executes dropped EXE
PID:1020 -
\??\c:\bpjllbt.exec:\bpjllbt.exe50⤵
- Executes dropped EXE
PID:2172 -
\??\c:\vbjhbtl.exec:\vbjhbtl.exe51⤵
- Executes dropped EXE
PID:1736 -
\??\c:\flpvrd.exec:\flpvrd.exe52⤵
- Executes dropped EXE
PID:1748 -
\??\c:\nlhjpt.exec:\nlhjpt.exe53⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xxpxvx.exec:\xxpxvx.exe54⤵
- Executes dropped EXE
PID:2856 -
\??\c:\ddxhfdn.exec:\ddxhfdn.exe55⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vrjlbtn.exec:\vrjlbtn.exe56⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nlldlp.exec:\nlldlp.exe57⤵
- Executes dropped EXE
PID:1980 -
\??\c:\dlpvtbl.exec:\dlpvtbl.exe58⤵
- Executes dropped EXE
PID:1968 -
\??\c:\hrvpp.exec:\hrvpp.exe59⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dljljfj.exec:\dljljfj.exe60⤵
- Executes dropped EXE
PID:2228 -
\??\c:\bjhhfth.exec:\bjhhfth.exe61⤵
- Executes dropped EXE
PID:1696 -
\??\c:\fnrvth.exec:\fnrvth.exe62⤵
- Executes dropped EXE
PID:2520 -
\??\c:\bplvllh.exec:\bplvllh.exe63⤵
- Executes dropped EXE
PID:2308 -
\??\c:\ntvjnp.exec:\ntvjnp.exe64⤵
- Executes dropped EXE
PID:324 -
\??\c:\vtftxp.exec:\vtftxp.exe65⤵
- Executes dropped EXE
PID:676 -
\??\c:\xpbjjd.exec:\xpbjjd.exe66⤵PID:1936
-
\??\c:\nthlx.exec:\nthlx.exe67⤵PID:2188
-
\??\c:\rxhrv.exec:\rxhrv.exe68⤵PID:400
-
\??\c:\hlfhd.exec:\hlfhd.exe69⤵PID:2972
-
\??\c:\jxrtxl.exec:\jxrtxl.exe70⤵PID:2056
-
\??\c:\nbjnvbx.exec:\nbjnvbx.exe71⤵PID:484
-
\??\c:\fxxld.exec:\fxxld.exe72⤵PID:2044
-
\??\c:\njnbnft.exec:\njnbnft.exe73⤵PID:1028
-
\??\c:\dxfjvhv.exec:\dxfjvhv.exe74⤵PID:1832
-
\??\c:\rrdpjx.exec:\rrdpjx.exe75⤵PID:1824
-
\??\c:\rjvtdnv.exec:\rjvtdnv.exe76⤵PID:2820
-
\??\c:\ltvxlb.exec:\ltvxlb.exe77⤵PID:968
-
\??\c:\pxlnbnx.exec:\pxlnbnx.exe78⤵PID:3024
-
\??\c:\dvxrxl.exec:\dvxrxl.exe79⤵PID:1536
-
\??\c:\ptvpv.exec:\ptvpv.exe80⤵PID:1600
-
\??\c:\ftxdbhx.exec:\ftxdbhx.exe81⤵PID:2364
-
\??\c:\vfvfhr.exec:\vfvfhr.exe82⤵PID:1572
-
\??\c:\lbdtt.exec:\lbdtt.exe83⤵PID:1596
-
\??\c:\ltxpdx.exec:\ltxpdx.exe84⤵PID:2564
-
\??\c:\jbrldjx.exec:\jbrldjx.exe85⤵PID:2652
-
\??\c:\nfrhxlx.exec:\nfrhxlx.exe86⤵PID:2580
-
\??\c:\jnhxrlb.exec:\jnhxrlb.exe87⤵PID:2568
-
\??\c:\jjptrl.exec:\jjptrl.exe88⤵PID:2624
-
\??\c:\pfhjxl.exec:\pfhjxl.exe89⤵PID:2096
-
\??\c:\txjlfdn.exec:\txjlfdn.exe90⤵PID:2584
-
\??\c:\dlljjjx.exec:\dlljjjx.exe91⤵PID:2888
-
\??\c:\dbhtt.exec:\dbhtt.exe92⤵PID:2436
-
\??\c:\hlrdh.exec:\hlrdh.exe93⤵PID:2476
-
\??\c:\thlxxb.exec:\thlxxb.exe94⤵PID:2472
-
\??\c:\fxnjjx.exec:\fxnjjx.exe95⤵PID:2848
-
\??\c:\ttfndrb.exec:\ttfndrb.exe96⤵PID:776
-
\??\c:\hfrnbld.exec:\hfrnbld.exe97⤵PID:1728
-
\??\c:\bbpbvr.exec:\bbpbvr.exe98⤵PID:1876
-
\??\c:\tvtrdnf.exec:\tvtrdnf.exe99⤵PID:2492
-
\??\c:\xphbb.exec:\xphbb.exe100⤵PID:2512
-
\??\c:\bpfxf.exec:\bpfxf.exe101⤵PID:2604
-
\??\c:\xrfdfn.exec:\xrfdfn.exe102⤵PID:2212
-
\??\c:\lbrhxv.exec:\lbrhxv.exe103⤵PID:2052
-
\??\c:\phnfvnt.exec:\phnfvnt.exe104⤵PID:2032
-
\??\c:\bhxjvb.exec:\bhxjvb.exe105⤵PID:1048
-
\??\c:\hfjhxlx.exec:\hfjhxlx.exe106⤵PID:2960
-
\??\c:\jhhfx.exec:\jhhfx.exe107⤵PID:768
-
\??\c:\fdpvl.exec:\fdpvl.exe108⤵PID:1692
-
\??\c:\pbrtl.exec:\pbrtl.exe109⤵PID:1704
-
\??\c:\rjftrtx.exec:\rjftrtx.exe110⤵PID:2320
-
\??\c:\vlbjhl.exec:\vlbjhl.exe111⤵PID:2296
-
\??\c:\jdvbjl.exec:\jdvbjl.exe112⤵PID:2292
-
\??\c:\hddxfpb.exec:\hddxfpb.exe113⤵PID:692
-
\??\c:\vxnfn.exec:\vxnfn.exe114⤵PID:2948
-
\??\c:\hthddd.exec:\hthddd.exe115⤵PID:1688
-
\??\c:\rtbdh.exec:\rtbdh.exe116⤵PID:1120
-
\??\c:\jxnnnp.exec:\jxnnnp.exe117⤵PID:1292
-
\??\c:\lfpjr.exec:\lfpjr.exe118⤵PID:2392
-
\??\c:\vtxfpt.exec:\vtxfpt.exe119⤵PID:1392
-
\??\c:\tlhbdxx.exec:\tlhbdxx.exe120⤵PID:2044
-
\??\c:\lbbvt.exec:\lbbvt.exe121⤵PID:1892
-
\??\c:\vdjlbb.exec:\vdjlbb.exe122⤵PID:1824
-
\??\c:\pjdnbxh.exec:\pjdnbxh.exe123⤵PID:2164
-
\??\c:\tpbdb.exec:\tpbdb.exe124⤵PID:3028
-
\??\c:\nnlttxh.exec:\nnlttxh.exe125⤵PID:3000
-
\??\c:\pdvtvln.exec:\pdvtvln.exe126⤵PID:1708
-
\??\c:\dpphf.exec:\dpphf.exe127⤵PID:1760
-
\??\c:\ljrpx.exec:\ljrpx.exe128⤵PID:2336
-
\??\c:\fxdxbl.exec:\fxdxbl.exe129⤵PID:2864
-
\??\c:\xttdvd.exec:\xttdvd.exe130⤵PID:2980
-
\??\c:\fdtff.exec:\fdtff.exe131⤵PID:2564
-
\??\c:\fvvxrvp.exec:\fvvxrvp.exe132⤵PID:2528
-
\??\c:\hbtvtbp.exec:\hbtvtbp.exe133⤵PID:2612
-
\??\c:\ppdfn.exec:\ppdfn.exe134⤵PID:2760
-
\??\c:\lbltn.exec:\lbltn.exe135⤵PID:2720
-
\??\c:\dnpjtn.exec:\dnpjtn.exe136⤵PID:2176
-
\??\c:\jvvvr.exec:\jvvvr.exe137⤵PID:2596
-
\??\c:\pxfxlt.exec:\pxfxlt.exe138⤵PID:2536
-
\??\c:\bfxxn.exec:\bfxxn.exe139⤵PID:2444
-
\??\c:\bfhhdl.exec:\bfhhdl.exe140⤵PID:2680
-
\??\c:\pjvhln.exec:\pjvhln.exe141⤵PID:2060
-
\??\c:\ffrhbb.exec:\ffrhbb.exe142⤵PID:2068
-
\??\c:\fxhdlvd.exec:\fxhdlvd.exe143⤵PID:824
-
\??\c:\nfttpjn.exec:\nfttpjn.exe144⤵PID:1880
-
\??\c:\rvhjjn.exec:\rvhjjn.exe145⤵PID:1876
-
\??\c:\lhvhbh.exec:\lhvhbh.exe146⤵PID:2492
-
\??\c:\xxrtr.exec:\xxrtr.exe147⤵PID:2512
-
\??\c:\lthrj.exec:\lthrj.exe148⤵PID:2604
-
\??\c:\phhvbb.exec:\phhvbb.exe149⤵PID:2212
-
\??\c:\fbtrt.exec:\fbtrt.exe150⤵PID:2052
-
\??\c:\xhdthn.exec:\xhdthn.exe151⤵PID:2032
-
\??\c:\flxldp.exec:\flxldp.exe152⤵PID:876
-
\??\c:\hrtplr.exec:\hrtplr.exe153⤵PID:2220
-
\??\c:\bbpxjn.exec:\bbpxjn.exe154⤵PID:2328
-
\??\c:\nphtdnb.exec:\nphtdnb.exe155⤵PID:1616
-
\??\c:\fljdn.exec:\fljdn.exe156⤵PID:2152
-
\??\c:\rxttx.exec:\rxttx.exe157⤵PID:2308
-
\??\c:\bhtntdj.exec:\bhtntdj.exe158⤵PID:2276
-
\??\c:\njtnlbp.exec:\njtnlbp.exe159⤵PID:324
-
\??\c:\rhvlpdj.exec:\rhvlpdj.exe160⤵PID:676
-
\??\c:\ptbrhrb.exec:\ptbrhrb.exe161⤵PID:3068
-
\??\c:\xbhrj.exec:\xbhrj.exe162⤵PID:2372
-
\??\c:\dxnxnbv.exec:\dxnxnbv.exe163⤵PID:436
-
\??\c:\rhrll.exec:\rhrll.exe164⤵PID:1808
-
\??\c:\rtnxhp.exec:\rtnxhp.exe165⤵PID:1884
-
\??\c:\jlvtp.exec:\jlvtp.exe166⤵PID:1360
-
\??\c:\rblfxx.exec:\rblfxx.exe167⤵PID:1888
-
\??\c:\ldprd.exec:\ldprd.exe168⤵PID:2044
-
\??\c:\rfvvx.exec:\rfvvx.exe169⤵PID:564
-
\??\c:\hhplhv.exec:\hhplhv.exe170⤵PID:612
-
\??\c:\vxpnv.exec:\vxpnv.exe171⤵PID:2164
-
\??\c:\nnhdf.exec:\nnhdf.exe172⤵PID:1248
-
\??\c:\dlfjdh.exec:\dlfjdh.exe173⤵PID:1536
-
\??\c:\pdlftt.exec:\pdlftt.exe174⤵PID:2140
-
\??\c:\fpfldjf.exec:\fpfldjf.exe175⤵PID:2348
-
\??\c:\pfhvp.exec:\pfhvp.exe176⤵PID:2116
-
\??\c:\blttrfp.exec:\blttrfp.exe177⤵PID:2912
-
\??\c:\phdvdxp.exec:\phdvdxp.exe178⤵PID:3012
-
\??\c:\tlfvr.exec:\tlfvr.exe179⤵PID:2744
-
\??\c:\djnnppl.exec:\djnnppl.exe180⤵PID:2632
-
\??\c:\bhnxh.exec:\bhnxh.exe181⤵PID:2660
-
\??\c:\rdxljvn.exec:\rdxljvn.exe182⤵PID:2432
-
\??\c:\hjlrnt.exec:\hjlrnt.exe183⤵PID:2644
-
\??\c:\xxnxhv.exec:\xxnxhv.exe184⤵PID:2720
-
\??\c:\rntfbf.exec:\rntfbf.exe185⤵PID:2176
-
\??\c:\rpnjh.exec:\rpnjh.exe186⤵PID:2544
-
\??\c:\dprphbb.exec:\dprphbb.exe187⤵PID:2536
-
\??\c:\ndlbr.exec:\ndlbr.exe188⤵PID:2444
-
\??\c:\xtpdjhd.exec:\xtpdjhd.exe189⤵PID:2680
-
\??\c:\rbfjfr.exec:\rbfjfr.exe190⤵PID:572
-
\??\c:\fpvxpf.exec:\fpvxpf.exe191⤵PID:1084
-
\??\c:\hvhtb.exec:\hvhtb.exe192⤵PID:956
-
\??\c:\rjrjtd.exec:\rjrjtd.exe193⤵PID:2636
-
\??\c:\dvflpxt.exec:\dvflpxt.exe194⤵PID:2608
-
\??\c:\rdxfdfp.exec:\rdxfdfp.exe195⤵PID:2736
-
\??\c:\lrjfdv.exec:\lrjfdv.exe196⤵PID:2236
-
\??\c:\ddxnlp.exec:\ddxnlp.exe197⤵PID:2232
-
\??\c:\djjllf.exec:\djjllf.exe198⤵PID:2224
-
\??\c:\njpvhpt.exec:\njpvhpt.exe199⤵PID:2000
-
\??\c:\vjxxvp.exec:\vjxxvp.exe200⤵PID:2032
-
\??\c:\fvnln.exec:\fvnln.exe201⤵PID:1656
-
\??\c:\ttplxh.exec:\ttplxh.exe202⤵PID:944
-
\??\c:\dlvnthh.exec:\dlvnthh.exe203⤵PID:1580
-
\??\c:\dtxtvd.exec:\dtxtvd.exe204⤵PID:2108
-
\??\c:\rjtvdjv.exec:\rjtvdjv.exe205⤵PID:2280
-
\??\c:\hhnrl.exec:\hhnrl.exe206⤵PID:2308
-
\??\c:\tlprlb.exec:\tlprlb.exe207⤵PID:1712
-
\??\c:\jlpdr.exec:\jlpdr.exe208⤵PID:1936
-
\??\c:\rdnjb.exec:\rdnjb.exe209⤵PID:2920
-
\??\c:\jndbd.exec:\jndbd.exe210⤵PID:840
-
\??\c:\lrrvh.exec:\lrrvh.exe211⤵PID:2372
-
\??\c:\tjvlfnt.exec:\tjvlfnt.exe212⤵PID:436
-
\??\c:\rbrpf.exec:\rbrpf.exe213⤵PID:2396
-
\??\c:\bxdvlrn.exec:\bxdvlrn.exe214⤵PID:1884
-
\??\c:\drplj.exec:\drplj.exe215⤵PID:1360
-
\??\c:\xdbldr.exec:\xdbldr.exe216⤵PID:1888
-
\??\c:\dbfprv.exec:\dbfprv.exe217⤵PID:2044
-
\??\c:\vnnxdjv.exec:\vnnxdjv.exe218⤵PID:2204
-
\??\c:\xddth.exec:\xddth.exe219⤵PID:612
-
\??\c:\tpnnn.exec:\tpnnn.exe220⤵PID:3024
-
\??\c:\jdfrhd.exec:\jdfrhd.exe221⤵PID:3000
-
\??\c:\ldtjt.exec:\ldtjt.exe222⤵PID:1536
-
\??\c:\dpfjp.exec:\dpfjp.exe223⤵PID:2140
-
\??\c:\lhnbvj.exec:\lhnbvj.exe224⤵PID:872
-
\??\c:\pxlvf.exec:\pxlvf.exe225⤵PID:2916
-
\??\c:\vhxxdb.exec:\vhxxdb.exe226⤵PID:108
-
\??\c:\xxjtthf.exec:\xxjtthf.exe227⤵PID:2352
-
\??\c:\ttprn.exec:\ttprn.exe228⤵PID:2676
-
\??\c:\jvdhhp.exec:\jvdhhp.exe229⤵PID:2756
-
\??\c:\tpjtjj.exec:\tpjtjj.exe230⤵PID:2696
-
\??\c:\ldlvj.exec:\ldlvj.exe231⤵PID:2096
-
\??\c:\jdnnjv.exec:\jdnnjv.exe232⤵PID:2588
-
\??\c:\tpldn.exec:\tpldn.exe233⤵PID:2176
-
\??\c:\bflvllx.exec:\bflvllx.exe234⤵PID:2468
-
\??\c:\pxpdfnx.exec:\pxpdfnx.exe235⤵PID:1032
-
\??\c:\fpbjxh.exec:\fpbjxh.exe236⤵PID:2472
-
\??\c:\rfjjtb.exec:\rfjjtb.exe237⤵PID:2012
-
\??\c:\bfjbr.exec:\bfjbr.exe238⤵PID:776
-
\??\c:\xbdbrx.exec:\xbdbrx.exe239⤵PID:836
-
\??\c:\xnbtr.exec:\xnbtr.exe240⤵PID:956
-
\??\c:\rvnnjvb.exec:\rvnnjvb.exe241⤵PID:2636
-
\??\c:\rtjrbhj.exec:\rtjrbhj.exe242⤵PID:1820