Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 09:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e2419f83c56b26582bc2ef0a67a2b130_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e2419f83c56b26582bc2ef0a67a2b130_NeikiAnalytics.exe
-
Size
247KB
-
MD5
e2419f83c56b26582bc2ef0a67a2b130
-
SHA1
750910bb910003acaabb628177581c06fff4e9ac
-
SHA256
674734c1f86cf477bdc79b781ce95951eb3e6898efa174084b451ad117fa5a39
-
SHA512
53592c022ac6e866db18f6bddf6c412369240124e8b06f1ecc5d0a862bb67134adc56d029a90299ac8d32f8e3109a7ab0dddce9b0d5b7f15761cd023371f7568
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFRV6l:n3C9uD6AUDCa4NYmRw
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2020-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/792-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/916-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1328-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/596-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1308-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/896-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xnjjvf.exebljtffr.exepplvp.exethbhphf.exebnrdlhj.exexthbh.exebftrtb.exehpvldft.exelfltr.exenbxhlln.exelbpnnrh.exettltnjr.exenvxflrt.exefrhhp.exebpjlvbb.exevxvrx.exebvtjd.exedhnplrl.exelxdhll.exexrbjb.exefndbnr.exebprhh.exefpntn.exevtflbv.exejvtlp.exehjrbfxt.exehxpntjr.exefttdj.exebrnfrrf.exenjvdtj.exedbltvdn.exexfxbdjl.exebbfbbnn.exexvnddlh.exenjxxv.exepvfdjv.exeltnbfr.exevdphjdl.exelpddd.exehprlrl.exevjxddt.exevxljlhp.exevltbtt.exetdrfxp.exexhtvdv.exevhhhlx.exelxhhn.exedxntht.exehhpnjrn.exerxbvrh.exenjnjn.exejdvhxbr.exebdxrhd.exexxxtdv.exeblrdrp.exehtfbdlx.exerrfjlvd.exebrdhxxf.exetldfjfd.exejfxlfnx.exejfdlh.exennbffhb.exevnvbhdv.exefthnn.exepid process 2200 xnjjvf.exe 2996 bljtffr.exe 2808 pplvp.exe 2516 thbhphf.exe 2744 bnrdlhj.exe 2456 xthbh.exe 2464 bftrtb.exe 792 hpvldft.exe 1500 lfltr.exe 2736 nbxhlln.exe 2764 lbpnnrh.exe 1232 ttltnjr.exe 896 nvxflrt.exe 1948 frhhp.exe 1700 bpjlvbb.exe 2684 vxvrx.exe 916 bvtjd.exe 1512 dhnplrl.exe 2100 lxdhll.exe 2288 xrbjb.exe 1308 fndbnr.exe 1976 bprhh.exe 824 fpntn.exe 1124 vtflbv.exe 1808 jvtlp.exe 1328 hjrbfxt.exe 1712 hxpntjr.exe 596 fttdj.exe 1292 brnfrrf.exe 1620 njvdtj.exe 1340 dbltvdn.exe 1524 xfxbdjl.exe 2148 bbfbbnn.exe 3036 xvnddlh.exe 1692 njxxv.exe 2968 pvfdjv.exe 2620 ltnbfr.exe 2528 vdphjdl.exe 2712 lpddd.exe 2596 hprlrl.exe 2748 vjxddt.exe 2512 vxljlhp.exe 2396 vltbtt.exe 2876 tdrfxp.exe 3044 xhtvdv.exe 760 vhhhlx.exe 888 lxhhn.exe 2696 dxntht.exe 1360 hhpnjrn.exe 2760 rxbvrh.exe 2852 njnjn.exe 2884 jdvhxbr.exe 744 bdxrhd.exe 1948 xxxtdv.exe 1700 blrdrp.exe 1708 htfbdlx.exe 1616 rrfjlvd.exe 2280 brdhxxf.exe 1284 tldfjfd.exe 2296 jfxlfnx.exe 2088 jfdlh.exe 1444 nnbffhb.exe 1976 vnvbhdv.exe 3004 fthnn.exe -
Processes:
resource yara_rule behavioral1/memory/2020-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/916-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1328-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/596-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1308-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/896-146-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e2419f83c56b26582bc2ef0a67a2b130_NeikiAnalytics.exexnjjvf.exebljtffr.exepplvp.exethbhphf.exebnrdlhj.exexthbh.exebftrtb.exehpvldft.exelfltr.exenbxhlln.exelbpnnrh.exettltnjr.exenvxflrt.exefrhhp.exebpjlvbb.exedescription pid process target process PID 2020 wrote to memory of 2200 2020 e2419f83c56b26582bc2ef0a67a2b130_NeikiAnalytics.exe xnjjvf.exe PID 2020 wrote to memory of 2200 2020 e2419f83c56b26582bc2ef0a67a2b130_NeikiAnalytics.exe xnjjvf.exe PID 2020 wrote to memory of 2200 2020 e2419f83c56b26582bc2ef0a67a2b130_NeikiAnalytics.exe xnjjvf.exe PID 2020 wrote to memory of 2200 2020 e2419f83c56b26582bc2ef0a67a2b130_NeikiAnalytics.exe xnjjvf.exe PID 2200 wrote to memory of 2996 2200 xnjjvf.exe bljtffr.exe PID 2200 wrote to memory of 2996 2200 xnjjvf.exe bljtffr.exe PID 2200 wrote to memory of 2996 2200 xnjjvf.exe bljtffr.exe PID 2200 wrote to memory of 2996 2200 xnjjvf.exe bljtffr.exe PID 2996 wrote to memory of 2808 2996 bljtffr.exe pplvp.exe PID 2996 wrote to memory of 2808 2996 bljtffr.exe pplvp.exe PID 2996 wrote to memory of 2808 2996 bljtffr.exe pplvp.exe PID 2996 wrote to memory of 2808 2996 bljtffr.exe pplvp.exe PID 2808 wrote to memory of 2516 2808 pplvp.exe thbhphf.exe PID 2808 wrote to memory of 2516 2808 pplvp.exe thbhphf.exe PID 2808 wrote to memory of 2516 2808 pplvp.exe thbhphf.exe PID 2808 wrote to memory of 2516 2808 pplvp.exe thbhphf.exe PID 2516 wrote to memory of 2744 2516 thbhphf.exe bnrdlhj.exe PID 2516 wrote to memory of 2744 2516 thbhphf.exe bnrdlhj.exe PID 2516 wrote to memory of 2744 2516 thbhphf.exe bnrdlhj.exe PID 2516 wrote to memory of 2744 2516 thbhphf.exe bnrdlhj.exe PID 2744 wrote to memory of 2456 2744 bnrdlhj.exe xthbh.exe PID 2744 wrote to memory of 2456 2744 bnrdlhj.exe xthbh.exe PID 2744 wrote to memory of 2456 2744 bnrdlhj.exe xthbh.exe PID 2744 wrote to memory of 2456 2744 bnrdlhj.exe xthbh.exe PID 2456 wrote to memory of 2464 2456 xthbh.exe bftrtb.exe PID 2456 wrote to memory of 2464 2456 xthbh.exe bftrtb.exe PID 2456 wrote to memory of 2464 2456 xthbh.exe bftrtb.exe PID 2456 wrote to memory of 2464 2456 xthbh.exe bftrtb.exe PID 2464 wrote to memory of 792 2464 bftrtb.exe hpvldft.exe PID 2464 wrote to memory of 792 2464 bftrtb.exe hpvldft.exe PID 2464 wrote to memory of 792 2464 bftrtb.exe hpvldft.exe PID 2464 wrote to memory of 792 2464 bftrtb.exe hpvldft.exe PID 792 wrote to memory of 1500 792 hpvldft.exe lfltr.exe PID 792 wrote to memory of 1500 792 hpvldft.exe lfltr.exe PID 792 wrote to memory of 1500 792 hpvldft.exe lfltr.exe PID 792 wrote to memory of 1500 792 hpvldft.exe lfltr.exe PID 1500 wrote to memory of 2736 1500 lfltr.exe nbxhlln.exe PID 1500 wrote to memory of 2736 1500 lfltr.exe nbxhlln.exe PID 1500 wrote to memory of 2736 1500 lfltr.exe nbxhlln.exe PID 1500 wrote to memory of 2736 1500 lfltr.exe nbxhlln.exe PID 2736 wrote to memory of 2764 2736 nbxhlln.exe lbpnnrh.exe PID 2736 wrote to memory of 2764 2736 nbxhlln.exe lbpnnrh.exe PID 2736 wrote to memory of 2764 2736 nbxhlln.exe lbpnnrh.exe PID 2736 wrote to memory of 2764 2736 nbxhlln.exe lbpnnrh.exe PID 2764 wrote to memory of 1232 2764 lbpnnrh.exe ttltnjr.exe PID 2764 wrote to memory of 1232 2764 lbpnnrh.exe ttltnjr.exe PID 2764 wrote to memory of 1232 2764 lbpnnrh.exe ttltnjr.exe PID 2764 wrote to memory of 1232 2764 lbpnnrh.exe ttltnjr.exe PID 1232 wrote to memory of 896 1232 ttltnjr.exe nvxflrt.exe PID 1232 wrote to memory of 896 1232 ttltnjr.exe nvxflrt.exe PID 1232 wrote to memory of 896 1232 ttltnjr.exe nvxflrt.exe PID 1232 wrote to memory of 896 1232 ttltnjr.exe nvxflrt.exe PID 896 wrote to memory of 1948 896 nvxflrt.exe frhhp.exe PID 896 wrote to memory of 1948 896 nvxflrt.exe frhhp.exe PID 896 wrote to memory of 1948 896 nvxflrt.exe frhhp.exe PID 896 wrote to memory of 1948 896 nvxflrt.exe frhhp.exe PID 1948 wrote to memory of 1700 1948 frhhp.exe bpjlvbb.exe PID 1948 wrote to memory of 1700 1948 frhhp.exe bpjlvbb.exe PID 1948 wrote to memory of 1700 1948 frhhp.exe bpjlvbb.exe PID 1948 wrote to memory of 1700 1948 frhhp.exe bpjlvbb.exe PID 1700 wrote to memory of 2684 1700 bpjlvbb.exe vxvrx.exe PID 1700 wrote to memory of 2684 1700 bpjlvbb.exe vxvrx.exe PID 1700 wrote to memory of 2684 1700 bpjlvbb.exe vxvrx.exe PID 1700 wrote to memory of 2684 1700 bpjlvbb.exe vxvrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2419f83c56b26582bc2ef0a67a2b130_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e2419f83c56b26582bc2ef0a67a2b130_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\xnjjvf.exec:\xnjjvf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\bljtffr.exec:\bljtffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\pplvp.exec:\pplvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\thbhphf.exec:\thbhphf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\bnrdlhj.exec:\bnrdlhj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\xthbh.exec:\xthbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\bftrtb.exec:\bftrtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\hpvldft.exec:\hpvldft.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\lfltr.exec:\lfltr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\nbxhlln.exec:\nbxhlln.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\lbpnnrh.exec:\lbpnnrh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\ttltnjr.exec:\ttltnjr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\nvxflrt.exec:\nvxflrt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\frhhp.exec:\frhhp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\bpjlvbb.exec:\bpjlvbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\vxvrx.exec:\vxvrx.exe17⤵
- Executes dropped EXE
PID:2684 -
\??\c:\bvtjd.exec:\bvtjd.exe18⤵
- Executes dropped EXE
PID:916 -
\??\c:\dhnplrl.exec:\dhnplrl.exe19⤵
- Executes dropped EXE
PID:1512 -
\??\c:\lxdhll.exec:\lxdhll.exe20⤵
- Executes dropped EXE
PID:2100 -
\??\c:\xrbjb.exec:\xrbjb.exe21⤵
- Executes dropped EXE
PID:2288 -
\??\c:\fndbnr.exec:\fndbnr.exe22⤵
- Executes dropped EXE
PID:1308 -
\??\c:\bprhh.exec:\bprhh.exe23⤵
- Executes dropped EXE
PID:1976 -
\??\c:\fpntn.exec:\fpntn.exe24⤵
- Executes dropped EXE
PID:824 -
\??\c:\vtflbv.exec:\vtflbv.exe25⤵
- Executes dropped EXE
PID:1124 -
\??\c:\jvtlp.exec:\jvtlp.exe26⤵
- Executes dropped EXE
PID:1808 -
\??\c:\hjrbfxt.exec:\hjrbfxt.exe27⤵
- Executes dropped EXE
PID:1328 -
\??\c:\hxpntjr.exec:\hxpntjr.exe28⤵
- Executes dropped EXE
PID:1712 -
\??\c:\fttdj.exec:\fttdj.exe29⤵
- Executes dropped EXE
PID:596 -
\??\c:\brnfrrf.exec:\brnfrrf.exe30⤵
- Executes dropped EXE
PID:1292 -
\??\c:\njvdtj.exec:\njvdtj.exe31⤵
- Executes dropped EXE
PID:1620 -
\??\c:\dbltvdn.exec:\dbltvdn.exe32⤵
- Executes dropped EXE
PID:1340 -
\??\c:\xfxbdjl.exec:\xfxbdjl.exe33⤵
- Executes dropped EXE
PID:1524 -
\??\c:\bbfbbnn.exec:\bbfbbnn.exe34⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xvnddlh.exec:\xvnddlh.exe35⤵
- Executes dropped EXE
PID:3036 -
\??\c:\njxxv.exec:\njxxv.exe36⤵
- Executes dropped EXE
PID:1692 -
\??\c:\pvfdjv.exec:\pvfdjv.exe37⤵
- Executes dropped EXE
PID:2968 -
\??\c:\ltnbfr.exec:\ltnbfr.exe38⤵
- Executes dropped EXE
PID:2620 -
\??\c:\vdphjdl.exec:\vdphjdl.exe39⤵
- Executes dropped EXE
PID:2528 -
\??\c:\lpddd.exec:\lpddd.exe40⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hprlrl.exec:\hprlrl.exe41⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vjxddt.exec:\vjxddt.exe42⤵
- Executes dropped EXE
PID:2748 -
\??\c:\vxljlhp.exec:\vxljlhp.exe43⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vltbtt.exec:\vltbtt.exe44⤵
- Executes dropped EXE
PID:2396 -
\??\c:\tdrfxp.exec:\tdrfxp.exe45⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xhtvdv.exec:\xhtvdv.exe46⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vhhhlx.exec:\vhhhlx.exe47⤵
- Executes dropped EXE
PID:760 -
\??\c:\lxhhn.exec:\lxhhn.exe48⤵
- Executes dropped EXE
PID:888 -
\??\c:\dxntht.exec:\dxntht.exe49⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hhpnjrn.exec:\hhpnjrn.exe50⤵
- Executes dropped EXE
PID:1360 -
\??\c:\rxbvrh.exec:\rxbvrh.exe51⤵
- Executes dropped EXE
PID:2760 -
\??\c:\njnjn.exec:\njnjn.exe52⤵
- Executes dropped EXE
PID:2852 -
\??\c:\jdvhxbr.exec:\jdvhxbr.exe53⤵
- Executes dropped EXE
PID:2884 -
\??\c:\bdxrhd.exec:\bdxrhd.exe54⤵
- Executes dropped EXE
PID:744 -
\??\c:\xxxtdv.exec:\xxxtdv.exe55⤵
- Executes dropped EXE
PID:1948 -
\??\c:\blrdrp.exec:\blrdrp.exe56⤵
- Executes dropped EXE
PID:1700 -
\??\c:\htfbdlx.exec:\htfbdlx.exe57⤵
- Executes dropped EXE
PID:1708 -
\??\c:\rrfjlvd.exec:\rrfjlvd.exe58⤵
- Executes dropped EXE
PID:1616 -
\??\c:\brdhxxf.exec:\brdhxxf.exe59⤵
- Executes dropped EXE
PID:2280 -
\??\c:\tldfjfd.exec:\tldfjfd.exe60⤵
- Executes dropped EXE
PID:1284 -
\??\c:\jfxlfnx.exec:\jfxlfnx.exe61⤵
- Executes dropped EXE
PID:2296 -
\??\c:\jfdlh.exec:\jfdlh.exe62⤵
- Executes dropped EXE
PID:2088 -
\??\c:\nnbffhb.exec:\nnbffhb.exe63⤵
- Executes dropped EXE
PID:1444 -
\??\c:\vnvbhdv.exec:\vnvbhdv.exe64⤵
- Executes dropped EXE
PID:1976 -
\??\c:\fthnn.exec:\fthnn.exe65⤵
- Executes dropped EXE
PID:3004 -
\??\c:\lxndhfd.exec:\lxndhfd.exe66⤵PID:3028
-
\??\c:\ddvnv.exec:\ddvnv.exe67⤵PID:3020
-
\??\c:\njddvbd.exec:\njddvbd.exe68⤵PID:1856
-
\??\c:\xvjhl.exec:\xvjhl.exe69⤵PID:1352
-
\??\c:\tlhxb.exec:\tlhxb.exe70⤵PID:2264
-
\??\c:\lrfvd.exec:\lrfvd.exe71⤵PID:3000
-
\??\c:\ndjdhh.exec:\ndjdhh.exe72⤵PID:1468
-
\??\c:\rdhhfvr.exec:\rdhhfvr.exe73⤵PID:432
-
\??\c:\hjbbhdv.exec:\hjbbhdv.exe74⤵PID:1992
-
\??\c:\brjtlnn.exec:\brjtlnn.exe75⤵PID:536
-
\??\c:\nvxvnbv.exec:\nvxvnbv.exe76⤵PID:1920
-
\??\c:\prjrhl.exec:\prjrhl.exe77⤵PID:2312
-
\??\c:\thddl.exec:\thddl.exe78⤵PID:2192
-
\??\c:\pvnxjx.exec:\pvnxjx.exe79⤵PID:1704
-
\??\c:\ndlrxh.exec:\ndlrxh.exe80⤵PID:2120
-
\??\c:\ffvlff.exec:\ffvlff.exe81⤵PID:2636
-
\??\c:\thnhfn.exec:\thnhfn.exe82⤵PID:2664
-
\??\c:\prndn.exec:\prndn.exe83⤵PID:2524
-
\??\c:\btvvxfd.exec:\btvvxfd.exe84⤵PID:2408
-
\??\c:\lbpjth.exec:\lbpjth.exe85⤵PID:2436
-
\??\c:\dprbhfv.exec:\dprbhfv.exe86⤵PID:1804
-
\??\c:\lvvvfv.exec:\lvvvfv.exe87⤵PID:2588
-
\??\c:\dljvd.exec:\dljvd.exe88⤵PID:2520
-
\??\c:\dnfhjb.exec:\dnfhjb.exe89⤵PID:1784
-
\??\c:\jdllnd.exec:\jdllnd.exe90⤵PID:2472
-
\??\c:\lrjdxv.exec:\lrjdxv.exe91⤵PID:552
-
\??\c:\vlfrdjv.exec:\vlfrdjv.exe92⤵PID:2688
-
\??\c:\xhvdh.exec:\xhvdh.exe93⤵PID:2680
-
\??\c:\jrxvn.exec:\jrxvn.exe94⤵PID:1904
-
\??\c:\vvptntr.exec:\vvptntr.exe95⤵PID:1968
-
\??\c:\jfjtp.exec:\jfjtp.exe96⤵PID:1980
-
\??\c:\vnbfv.exec:\vnbfv.exe97⤵PID:2880
-
\??\c:\xvddbr.exec:\xvddbr.exe98⤵PID:896
-
\??\c:\flvvvbp.exec:\flvvvbp.exe99⤵PID:2652
-
\??\c:\tfldd.exec:\tfldd.exe100⤵PID:1604
-
\??\c:\fjhtj.exec:\fjhtj.exe101⤵PID:2676
-
\??\c:\tffhtjl.exec:\tffhtjl.exe102⤵PID:920
-
\??\c:\nhpvxvp.exec:\nhpvxvp.exe103⤵PID:1420
-
\??\c:\vnjrx.exec:\vnjrx.exe104⤵PID:1656
-
\??\c:\jjtnj.exec:\jjtnj.exe105⤵PID:1720
-
\??\c:\fljvvbh.exec:\fljvvbh.exe106⤵PID:612
-
\??\c:\xpxdvr.exec:\xpxdvr.exe107⤵PID:1248
-
\??\c:\rtxbdrv.exec:\rtxbdrv.exe108⤵PID:2268
-
\??\c:\fxdhd.exec:\fxdhd.exe109⤵PID:2060
-
\??\c:\dnvrrxj.exec:\dnvrrxj.exe110⤵PID:1832
-
\??\c:\lvflh.exec:\lvflh.exe111⤵PID:1124
-
\??\c:\rdxrf.exec:\rdxrf.exe112⤵PID:1960
-
\??\c:\jxljvx.exec:\jxljvx.exe113⤵PID:1016
-
\??\c:\nvnnddl.exec:\nvnnddl.exe114⤵PID:644
-
\??\c:\ndlbb.exec:\ndlbb.exe115⤵PID:2092
-
\??\c:\jtrdf.exec:\jtrdf.exe116⤵PID:2352
-
\??\c:\ljftnhv.exec:\ljftnhv.exe117⤵PID:1684
-
\??\c:\ndfvlpb.exec:\ndfvlpb.exe118⤵PID:1620
-
\??\c:\hdttlh.exec:\hdttlh.exe119⤵PID:1924
-
\??\c:\dnvtjxd.exec:\dnvtjxd.exe120⤵PID:1772
-
\??\c:\lrbllb.exec:\lrbllb.exe121⤵PID:876
-
\??\c:\vhnpht.exec:\vhnpht.exe122⤵PID:2720
-
\??\c:\ftjrjd.exec:\ftjrjd.exe123⤵PID:2148
-
\??\c:\fvtjfj.exec:\fvtjfj.exe124⤵PID:1384
-
\??\c:\jbtjrd.exec:\jbtjrd.exe125⤵PID:2140
-
\??\c:\prffx.exec:\prffx.exe126⤵PID:2936
-
\??\c:\xrnvfl.exec:\xrnvfl.exe127⤵PID:2704
-
\??\c:\dbdftj.exec:\dbdftj.exe128⤵PID:2504
-
\??\c:\rdjtdvv.exec:\rdjtdvv.exe129⤵PID:2896
-
\??\c:\fbrhlb.exec:\fbrhlb.exe130⤵PID:2436
-
\??\c:\pxhld.exec:\pxhld.exe131⤵PID:2608
-
\??\c:\tdlbl.exec:\tdlbl.exe132⤵PID:2944
-
\??\c:\bvhvbv.exec:\bvhvbv.exe133⤵PID:2452
-
\??\c:\dhllvd.exec:\dhllvd.exe134⤵PID:2872
-
\??\c:\fpbvh.exec:\fpbvh.exe135⤵PID:560
-
\??\c:\vdlfx.exec:\vdlfx.exe136⤵PID:1688
-
\??\c:\nnvlx.exec:\nnvlx.exe137⤵PID:2772
-
\??\c:\dfbbff.exec:\dfbbff.exe138⤵PID:2752
-
\??\c:\dlhrr.exec:\dlhrr.exe139⤵PID:1416
-
\??\c:\vffpn.exec:\vffpn.exe140⤵PID:528
-
\??\c:\vvjrljt.exec:\vvjrljt.exe141⤵PID:2024
-
\??\c:\tlnrj.exec:\tlnrj.exe142⤵PID:2880
-
\??\c:\rrrdx.exec:\rrrdx.exe143⤵PID:2236
-
\??\c:\rrfnv.exec:\rrfnv.exe144⤵PID:2652
-
\??\c:\vlnrbfv.exec:\vlnrbfv.exe145⤵PID:1796
-
\??\c:\brhlj.exec:\brhlj.exe146⤵PID:2684
-
\??\c:\npbvxjd.exec:\npbvxjd.exe147⤵PID:2248
-
\??\c:\bjfrvdn.exec:\bjfrvdn.exe148⤵PID:2240
-
\??\c:\jxlbx.exec:\jxlbx.exe149⤵PID:2156
-
\??\c:\fvbbx.exec:\fvbbx.exe150⤵PID:2104
-
\??\c:\nxhjlvr.exec:\nxhjlvr.exe151⤵PID:1092
-
\??\c:\tlvvdb.exec:\tlvvdb.exe152⤵PID:2260
-
\??\c:\pttxjn.exec:\pttxjn.exe153⤵PID:788
-
\??\c:\bvvjtnh.exec:\bvvjtnh.exe154⤵PID:1120
-
\??\c:\nfdbffx.exec:\nfdbffx.exe155⤵PID:2084
-
\??\c:\fjphft.exec:\fjphft.exe156⤵PID:3020
-
\??\c:\trffdrd.exec:\trffdrd.exe157⤵PID:1768
-
\??\c:\pnjxhh.exec:\pnjxhh.exe158⤵PID:1328
-
\??\c:\lptbr.exec:\lptbr.exe159⤵PID:2328
-
\??\c:\vlnbxx.exec:\vlnbxx.exe160⤵PID:820
-
\??\c:\ffpfb.exec:\ffpfb.exe161⤵PID:2352
-
\??\c:\rfdplrl.exec:\rfdplrl.exe162⤵PID:1932
-
\??\c:\phnlplv.exec:\phnlplv.exe163⤵PID:2480
-
\??\c:\btrlhx.exec:\btrlhx.exe164⤵PID:1984
-
\??\c:\jhpvdn.exec:\jhpvdn.exe165⤵PID:1728
-
\??\c:\nplvplv.exec:\nplvplv.exe166⤵PID:1592
-
\??\c:\rtpfhpv.exec:\rtpfhpv.exe167⤵PID:2580
-
\??\c:\bnpnf.exec:\bnpnf.exe168⤵PID:2192
-
\??\c:\xxvdtv.exec:\xxvdtv.exe169⤵PID:2968
-
\??\c:\vhrllhd.exec:\vhrllhd.exe170⤵PID:2120
-
\??\c:\lnhxb.exec:\lnhxb.exe171⤵PID:2064
-
\??\c:\rrtjtrf.exec:\rrtjtrf.exe172⤵PID:2576
-
\??\c:\ddxrtp.exec:\ddxrtp.exe173⤵PID:2408
-
\??\c:\fnhpdbr.exec:\fnhpdbr.exe174⤵PID:2708
-
\??\c:\dhjplbb.exec:\dhjplbb.exe175⤵PID:1916
-
\??\c:\fxdhjdf.exec:\fxdhjdf.exe176⤵PID:2868
-
\??\c:\vnrpr.exec:\vnrpr.exe177⤵PID:2520
-
\??\c:\rbndf.exec:\rbndf.exe178⤵PID:1288
-
\??\c:\tnnnh.exec:\tnnnh.exe179⤵PID:2472
-
\??\c:\hpppvvv.exec:\hpppvvv.exe180⤵PID:2464
-
\??\c:\prddjf.exec:\prddjf.exe181⤵PID:2656
-
\??\c:\hpnflr.exec:\hpnflr.exe182⤵PID:2776
-
\??\c:\jrhthnp.exec:\jrhthnp.exe183⤵PID:1460
-
\??\c:\ptpdj.exec:\ptpdj.exe184⤵PID:1968
-
\??\c:\pvvppv.exec:\pvvppv.exe185⤵PID:1644
-
\??\c:\rddlxd.exec:\rddlxd.exe186⤵PID:748
-
\??\c:\bjvrtv.exec:\bjvrtv.exe187⤵PID:368
-
\??\c:\nvfnjtt.exec:\nvfnjtt.exe188⤵PID:2040
-
\??\c:\xdhddjt.exec:\xdhddjt.exe189⤵PID:1576
-
\??\c:\djnft.exec:\djnft.exe190⤵PID:2976
-
\??\c:\lvxtf.exec:\lvxtf.exe191⤵PID:1900
-
\??\c:\ffrpnh.exec:\ffrpnh.exe192⤵PID:796
-
\??\c:\nfxpd.exec:\nfxpd.exe193⤵PID:1488
-
\??\c:\xnfnt.exec:\xnfnt.exe194⤵PID:2300
-
\??\c:\hbjhj.exec:\hbjhj.exe195⤵PID:2388
-
\??\c:\xfdlhv.exec:\xfdlhv.exe196⤵PID:2948
-
\??\c:\fbvlfn.exec:\fbvlfn.exe197⤵PID:2284
-
\??\c:\lvfddfr.exec:\lvfddfr.exe198⤵PID:3048
-
\??\c:\tddljv.exec:\tddljv.exe199⤵PID:1356
-
\??\c:\ltbbljd.exec:\ltbbljd.exe200⤵PID:1808
-
\??\c:\vhnntpl.exec:\vhnntpl.exe201⤵PID:2124
-
\??\c:\jtvxrf.exec:\jtvxrf.exe202⤵PID:2080
-
\??\c:\trppv.exec:\trppv.exe203⤵PID:2980
-
\??\c:\npbthb.exec:\npbthb.exe204⤵PID:1628
-
\??\c:\bpvtddp.exec:\bpvtddp.exe205⤵PID:1292
-
\??\c:\dbjvh.exec:\dbjvh.exe206⤵PID:2184
-
\??\c:\bpthtrb.exec:\bpthtrb.exe207⤵PID:2076
-
\??\c:\hbdrprh.exec:\hbdrprh.exe208⤵PID:868
-
\??\c:\ddnjvr.exec:\ddnjvr.exe209⤵PID:1792
-
\??\c:\bvxjb.exec:\bvxjb.exe210⤵PID:2780
-
\??\c:\vjrrnxf.exec:\vjrrnxf.exe211⤵PID:1280
-
\??\c:\vfflbh.exec:\vfflbh.exe212⤵PID:2940
-
\??\c:\xdprtjj.exec:\xdprtjj.exe213⤵PID:2548
-
\??\c:\rvtdt.exec:\rvtdt.exe214⤵PID:2552
-
\??\c:\bxbbh.exec:\bxbbh.exe215⤵PID:2532
-
\??\c:\jfftd.exec:\jfftd.exe216⤵PID:2600
-
\??\c:\nfbndhp.exec:\nfbndhp.exe217⤵PID:2516
-
\??\c:\lntxd.exec:\lntxd.exe218⤵PID:2596
-
\??\c:\lvbxbd.exec:\lvbxbd.exe219⤵PID:2232
-
\??\c:\dnndjr.exec:\dnndjr.exe220⤵PID:2512
-
\??\c:\hfdfjbb.exec:\hfdfjbb.exe221⤵PID:2412
-
\??\c:\dlpjxv.exec:\dlpjxv.exe222⤵PID:2016
-
\??\c:\nthxtlr.exec:\nthxtlr.exe223⤵PID:1496
-
\??\c:\fhjfnjd.exec:\fhjfnjd.exe224⤵PID:2648
-
\??\c:\nrhvbb.exec:\nrhvbb.exe225⤵PID:1524
-
\??\c:\tlnnfb.exec:\tlnnfb.exe226⤵PID:2728
-
\??\c:\plpbh.exec:\plpbh.exe227⤵PID:2308
-
\??\c:\nnffrtt.exec:\nnffrtt.exe228⤵PID:1972
-
\??\c:\vrflv.exec:\vrflv.exe229⤵PID:1324
-
\??\c:\vxlhhph.exec:\vxlhhph.exe230⤵PID:1652
-
\??\c:\bbjrffj.exec:\bbjrffj.exe231⤵PID:1844
-
\??\c:\ldbnf.exec:\ldbnf.exe232⤵PID:2304
-
\??\c:\hnrdr.exec:\hnrdr.exe233⤵PID:1836
-
\??\c:\rpllp.exec:\rpllp.exe234⤵PID:1572
-
\??\c:\txptvbp.exec:\txptvbp.exe235⤵PID:1336
-
\??\c:\jfxhhf.exec:\jfxhhf.exe236⤵PID:1624
-
\??\c:\lfbtn.exec:\lfbtn.exe237⤵PID:2164
-
\??\c:\tddrfp.exec:\tddrfp.exe238⤵PID:2660
-
\??\c:\nnnvjj.exec:\nnnvjj.exe239⤵PID:2296
-
\??\c:\hnblpnd.exec:\hnblpnd.exe240⤵PID:1812
-
\??\c:\fttvxn.exec:\fttvxn.exe241⤵PID:1444
-
\??\c:\vvxdxh.exec:\vvxdxh.exe242⤵PID:2272