Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 07:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1df23a1c674df8907efce94ad1e27ed97aa19e5290ccf65966478916f2732aa1_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1df23a1c674df8907efce94ad1e27ed97aa19e5290ccf65966478916f2732aa1_NeikiAnalytics.exe
-
Size
335KB
-
MD5
e1757d743b01fddf39ac30c69ee49d90
-
SHA1
e7b9936dd27f2a82b27e293c57fd1cf821b069f4
-
SHA256
1df23a1c674df8907efce94ad1e27ed97aa19e5290ccf65966478916f2732aa1
-
SHA512
9d3d1446fa000a23566156de48d01ca339b07dae2f3c540720d65c0762330aec549c8c608118cdacc73822882cb45998ec58cbf516be0198392768e1ee0cba8b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LCgnilBxBqwZK2q6sYTsmZDSFdBE0rXE4efT:n3C9BRo/CEilXBG2qZSlSFdBXExT
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1720-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/560-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1440-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1184-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1116-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1080-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xpttv.exehrddrh.exepdhnpb.exevxxbdbj.exefhxthh.exexvtdxdt.exedlvjv.exejlxhdjr.exebddtvbj.exetnhjnjf.exehnvrxvv.exevhndnjh.exextpvfrd.exethfdpbn.exepvtrrd.exejnvfrpx.exelhrnnhv.exedtrnrdv.exepbfrth.exepnhjv.exefjlfbb.exevhjflnd.exenfbvb.exejvxdpd.exepdtnpjl.exettdtnxp.exebfnvnnh.exetnjrh.exepjjlpft.exebtlnhf.exevjpbrp.exenxppjx.exepdflxl.exevnjhp.exedhbxnnr.exertnrhd.exevhlfdb.exepflfrdj.exejhblfd.exerptbl.exenjtppnd.exedxpnrl.exejvbxpdh.exenxvvtdf.exehvfllhn.exetvjjr.exerbfnv.exejjnfr.exexxlvbb.exennrnbdr.exelnljd.exelnxbdp.exexfxnb.exexhhvd.exerhlvx.exevphpbf.exenhpxxt.exepfnhddl.exerbbvb.exetlxhpl.exexbjrd.exennphn.exerrfbh.exehjtdxft.exepid process 2124 xpttv.exe 2900 hrddrh.exe 2576 pdhnpb.exe 2388 vxxbdbj.exe 2416 fhxthh.exe 2376 xvtdxdt.exe 2820 dlvjv.exe 560 jlxhdjr.exe 1440 bddtvbj.exe 1184 tnhjnjf.exe 2636 hnvrxvv.exe 2700 vhndnjh.exe 1904 xtpvfrd.exe 1896 thfdpbn.exe 1744 pvtrrd.exe 596 jnvfrpx.exe 1116 lhrnnhv.exe 1460 dtrnrdv.exe 2040 pbfrth.exe 2476 pnhjv.exe 2008 fjlfbb.exe 1080 vhjflnd.exe 1108 nfbvb.exe 3032 jvxdpd.exe 1152 pdtnpjl.exe 2768 ttdtnxp.exe 1832 bfnvnnh.exe 2800 tnjrh.exe 1500 pjjlpft.exe 1700 btlnhf.exe 1392 vjpbrp.exe 2072 nxppjx.exe 2784 pdflxl.exe 2168 vnjhp.exe 1876 dhbxnnr.exe 2732 rtnrhd.exe 1880 vhlfdb.exe 2676 pflfrdj.exe 2540 jhblfd.exe 2744 rptbl.exe 2604 njtppnd.exe 2404 dxpnrl.exe 2424 jvbxpdh.exe 2668 nxvvtdf.exe 1596 hvfllhn.exe 1716 tvjjr.exe 1336 rbfnv.exe 1516 jjnfr.exe 1184 xxlvbb.exe 2720 nnrnbdr.exe 1408 lnljd.exe 1924 lnxbdp.exe 1608 xfxnb.exe 1476 xhhvd.exe 2292 rhlvx.exe 756 vphpbf.exe 1308 nhpxxt.exe 1116 pfnhddl.exe 2096 rbbvb.exe 2260 tlxhpl.exe 1988 xbjrd.exe 2980 nnphn.exe 1936 rrfbh.exe 3028 hjtdxft.exe -
Processes:
resource yara_rule behavioral1/memory/1720-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/560-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/560-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1184-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1116-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-284-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1df23a1c674df8907efce94ad1e27ed97aa19e5290ccf65966478916f2732aa1_NeikiAnalytics.exexpttv.exehrddrh.exepdhnpb.exevxxbdbj.exefhxthh.exexvtdxdt.exedlvjv.exejlxhdjr.exebddtvbj.exetnhjnjf.exehnvrxvv.exevhndnjh.exextpvfrd.exethfdpbn.exepvtrrd.exedescription pid process target process PID 1720 wrote to memory of 2124 1720 1df23a1c674df8907efce94ad1e27ed97aa19e5290ccf65966478916f2732aa1_NeikiAnalytics.exe xpttv.exe PID 1720 wrote to memory of 2124 1720 1df23a1c674df8907efce94ad1e27ed97aa19e5290ccf65966478916f2732aa1_NeikiAnalytics.exe xpttv.exe PID 1720 wrote to memory of 2124 1720 1df23a1c674df8907efce94ad1e27ed97aa19e5290ccf65966478916f2732aa1_NeikiAnalytics.exe xpttv.exe PID 1720 wrote to memory of 2124 1720 1df23a1c674df8907efce94ad1e27ed97aa19e5290ccf65966478916f2732aa1_NeikiAnalytics.exe xpttv.exe PID 2124 wrote to memory of 2900 2124 xpttv.exe hrddrh.exe PID 2124 wrote to memory of 2900 2124 xpttv.exe hrddrh.exe PID 2124 wrote to memory of 2900 2124 xpttv.exe hrddrh.exe PID 2124 wrote to memory of 2900 2124 xpttv.exe hrddrh.exe PID 2900 wrote to memory of 2576 2900 hrddrh.exe pdhnpb.exe PID 2900 wrote to memory of 2576 2900 hrddrh.exe pdhnpb.exe PID 2900 wrote to memory of 2576 2900 hrddrh.exe pdhnpb.exe PID 2900 wrote to memory of 2576 2900 hrddrh.exe pdhnpb.exe PID 2576 wrote to memory of 2388 2576 pdhnpb.exe vxxbdbj.exe PID 2576 wrote to memory of 2388 2576 pdhnpb.exe vxxbdbj.exe PID 2576 wrote to memory of 2388 2576 pdhnpb.exe vxxbdbj.exe PID 2576 wrote to memory of 2388 2576 pdhnpb.exe vxxbdbj.exe PID 2388 wrote to memory of 2416 2388 vxxbdbj.exe fhxthh.exe PID 2388 wrote to memory of 2416 2388 vxxbdbj.exe fhxthh.exe PID 2388 wrote to memory of 2416 2388 vxxbdbj.exe fhxthh.exe PID 2388 wrote to memory of 2416 2388 vxxbdbj.exe fhxthh.exe PID 2416 wrote to memory of 2376 2416 fhxthh.exe xvtdxdt.exe PID 2416 wrote to memory of 2376 2416 fhxthh.exe xvtdxdt.exe PID 2416 wrote to memory of 2376 2416 fhxthh.exe xvtdxdt.exe PID 2416 wrote to memory of 2376 2416 fhxthh.exe xvtdxdt.exe PID 2376 wrote to memory of 2820 2376 xvtdxdt.exe dlvjv.exe PID 2376 wrote to memory of 2820 2376 xvtdxdt.exe dlvjv.exe PID 2376 wrote to memory of 2820 2376 xvtdxdt.exe dlvjv.exe PID 2376 wrote to memory of 2820 2376 xvtdxdt.exe dlvjv.exe PID 2820 wrote to memory of 560 2820 dlvjv.exe jlxhdjr.exe PID 2820 wrote to memory of 560 2820 dlvjv.exe jlxhdjr.exe PID 2820 wrote to memory of 560 2820 dlvjv.exe jlxhdjr.exe PID 2820 wrote to memory of 560 2820 dlvjv.exe jlxhdjr.exe PID 560 wrote to memory of 1440 560 jlxhdjr.exe bddtvbj.exe PID 560 wrote to memory of 1440 560 jlxhdjr.exe bddtvbj.exe PID 560 wrote to memory of 1440 560 jlxhdjr.exe bddtvbj.exe PID 560 wrote to memory of 1440 560 jlxhdjr.exe bddtvbj.exe PID 1440 wrote to memory of 1184 1440 bddtvbj.exe tnhjnjf.exe PID 1440 wrote to memory of 1184 1440 bddtvbj.exe tnhjnjf.exe PID 1440 wrote to memory of 1184 1440 bddtvbj.exe tnhjnjf.exe PID 1440 wrote to memory of 1184 1440 bddtvbj.exe tnhjnjf.exe PID 1184 wrote to memory of 2636 1184 tnhjnjf.exe hnvrxvv.exe PID 1184 wrote to memory of 2636 1184 tnhjnjf.exe hnvrxvv.exe PID 1184 wrote to memory of 2636 1184 tnhjnjf.exe hnvrxvv.exe PID 1184 wrote to memory of 2636 1184 tnhjnjf.exe hnvrxvv.exe PID 2636 wrote to memory of 2700 2636 hnvrxvv.exe vhndnjh.exe PID 2636 wrote to memory of 2700 2636 hnvrxvv.exe vhndnjh.exe PID 2636 wrote to memory of 2700 2636 hnvrxvv.exe vhndnjh.exe PID 2636 wrote to memory of 2700 2636 hnvrxvv.exe vhndnjh.exe PID 2700 wrote to memory of 1904 2700 vhndnjh.exe xtpvfrd.exe PID 2700 wrote to memory of 1904 2700 vhndnjh.exe xtpvfrd.exe PID 2700 wrote to memory of 1904 2700 vhndnjh.exe xtpvfrd.exe PID 2700 wrote to memory of 1904 2700 vhndnjh.exe xtpvfrd.exe PID 1904 wrote to memory of 1896 1904 xtpvfrd.exe thfdpbn.exe PID 1904 wrote to memory of 1896 1904 xtpvfrd.exe thfdpbn.exe PID 1904 wrote to memory of 1896 1904 xtpvfrd.exe thfdpbn.exe PID 1904 wrote to memory of 1896 1904 xtpvfrd.exe thfdpbn.exe PID 1896 wrote to memory of 1744 1896 thfdpbn.exe pvtrrd.exe PID 1896 wrote to memory of 1744 1896 thfdpbn.exe pvtrrd.exe PID 1896 wrote to memory of 1744 1896 thfdpbn.exe pvtrrd.exe PID 1896 wrote to memory of 1744 1896 thfdpbn.exe pvtrrd.exe PID 1744 wrote to memory of 596 1744 pvtrrd.exe jnvfrpx.exe PID 1744 wrote to memory of 596 1744 pvtrrd.exe jnvfrpx.exe PID 1744 wrote to memory of 596 1744 pvtrrd.exe jnvfrpx.exe PID 1744 wrote to memory of 596 1744 pvtrrd.exe jnvfrpx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1df23a1c674df8907efce94ad1e27ed97aa19e5290ccf65966478916f2732aa1_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1df23a1c674df8907efce94ad1e27ed97aa19e5290ccf65966478916f2732aa1_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\xpttv.exec:\xpttv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\hrddrh.exec:\hrddrh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\pdhnpb.exec:\pdhnpb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\vxxbdbj.exec:\vxxbdbj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\fhxthh.exec:\fhxthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\xvtdxdt.exec:\xvtdxdt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\dlvjv.exec:\dlvjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\jlxhdjr.exec:\jlxhdjr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\bddtvbj.exec:\bddtvbj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\tnhjnjf.exec:\tnhjnjf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\hnvrxvv.exec:\hnvrxvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\vhndnjh.exec:\vhndnjh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\xtpvfrd.exec:\xtpvfrd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\thfdpbn.exec:\thfdpbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\pvtrrd.exec:\pvtrrd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\jnvfrpx.exec:\jnvfrpx.exe17⤵
- Executes dropped EXE
PID:596 -
\??\c:\lhrnnhv.exec:\lhrnnhv.exe18⤵
- Executes dropped EXE
PID:1116 -
\??\c:\dtrnrdv.exec:\dtrnrdv.exe19⤵
- Executes dropped EXE
PID:1460 -
\??\c:\pbfrth.exec:\pbfrth.exe20⤵
- Executes dropped EXE
PID:2040 -
\??\c:\pnhjv.exec:\pnhjv.exe21⤵
- Executes dropped EXE
PID:2476 -
\??\c:\fjlfbb.exec:\fjlfbb.exe22⤵
- Executes dropped EXE
PID:2008 -
\??\c:\vhjflnd.exec:\vhjflnd.exe23⤵
- Executes dropped EXE
PID:1080 -
\??\c:\nfbvb.exec:\nfbvb.exe24⤵
- Executes dropped EXE
PID:1108 -
\??\c:\jvxdpd.exec:\jvxdpd.exe25⤵
- Executes dropped EXE
PID:3032 -
\??\c:\pdtnpjl.exec:\pdtnpjl.exe26⤵
- Executes dropped EXE
PID:1152 -
\??\c:\ttdtnxp.exec:\ttdtnxp.exe27⤵
- Executes dropped EXE
PID:2768 -
\??\c:\bfnvnnh.exec:\bfnvnnh.exe28⤵
- Executes dropped EXE
PID:1832 -
\??\c:\tnjrh.exec:\tnjrh.exe29⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pjjlpft.exec:\pjjlpft.exe30⤵
- Executes dropped EXE
PID:1500 -
\??\c:\btlnhf.exec:\btlnhf.exe31⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vjpbrp.exec:\vjpbrp.exe32⤵
- Executes dropped EXE
PID:1392 -
\??\c:\nxppjx.exec:\nxppjx.exe33⤵
- Executes dropped EXE
PID:2072 -
\??\c:\pdflxl.exec:\pdflxl.exe34⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vnjhp.exec:\vnjhp.exe35⤵
- Executes dropped EXE
PID:2168 -
\??\c:\dhbxnnr.exec:\dhbxnnr.exe36⤵
- Executes dropped EXE
PID:1876 -
\??\c:\rtnrhd.exec:\rtnrhd.exe37⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vhlfdb.exec:\vhlfdb.exe38⤵
- Executes dropped EXE
PID:1880 -
\??\c:\pflfrdj.exec:\pflfrdj.exe39⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jhblfd.exec:\jhblfd.exe40⤵
- Executes dropped EXE
PID:2540 -
\??\c:\rptbl.exec:\rptbl.exe41⤵
- Executes dropped EXE
PID:2744 -
\??\c:\njtppnd.exec:\njtppnd.exe42⤵
- Executes dropped EXE
PID:2604 -
\??\c:\dxpnrl.exec:\dxpnrl.exe43⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jvbxpdh.exec:\jvbxpdh.exe44⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nxvvtdf.exec:\nxvvtdf.exe45⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hvfllhn.exec:\hvfllhn.exe46⤵
- Executes dropped EXE
PID:1596 -
\??\c:\tvjjr.exec:\tvjjr.exe47⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rbfnv.exec:\rbfnv.exe48⤵
- Executes dropped EXE
PID:1336 -
\??\c:\jjnfr.exec:\jjnfr.exe49⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xxlvbb.exec:\xxlvbb.exe50⤵
- Executes dropped EXE
PID:1184 -
\??\c:\nnrnbdr.exec:\nnrnbdr.exe51⤵
- Executes dropped EXE
PID:2720 -
\??\c:\lnljd.exec:\lnljd.exe52⤵
- Executes dropped EXE
PID:1408 -
\??\c:\lnxbdp.exec:\lnxbdp.exe53⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xfxnb.exec:\xfxnb.exe54⤵
- Executes dropped EXE
PID:1608 -
\??\c:\xhhvd.exec:\xhhvd.exe55⤵
- Executes dropped EXE
PID:1476 -
\??\c:\rhlvx.exec:\rhlvx.exe56⤵
- Executes dropped EXE
PID:2292 -
\??\c:\vphpbf.exec:\vphpbf.exe57⤵
- Executes dropped EXE
PID:756 -
\??\c:\nhpxxt.exec:\nhpxxt.exe58⤵
- Executes dropped EXE
PID:1308 -
\??\c:\pfnhddl.exec:\pfnhddl.exe59⤵
- Executes dropped EXE
PID:1116 -
\??\c:\rbbvb.exec:\rbbvb.exe60⤵
- Executes dropped EXE
PID:2096 -
\??\c:\tlxhpl.exec:\tlxhpl.exe61⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xbjrd.exec:\xbjrd.exe62⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nnphn.exec:\nnphn.exe63⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rrfbh.exec:\rrfbh.exe64⤵
- Executes dropped EXE
PID:1936 -
\??\c:\hjtdxft.exec:\hjtdxft.exe65⤵
- Executes dropped EXE
PID:3028 -
\??\c:\bjvnhtn.exec:\bjvnhtn.exe66⤵PID:2952
-
\??\c:\jfdlnxj.exec:\jfdlnxj.exe67⤵PID:920
-
\??\c:\pfpjr.exec:\pfpjr.exe68⤵PID:1396
-
\??\c:\rvjhtl.exec:\rvjhtl.exe69⤵PID:1600
-
\??\c:\xbjnd.exec:\xbjnd.exe70⤵PID:1664
-
\??\c:\jhbftdb.exec:\jhbftdb.exe71⤵PID:2104
-
\??\c:\pphtfx.exec:\pphtfx.exe72⤵PID:2800
-
\??\c:\hlfjb.exec:\hlfjb.exe73⤵PID:272
-
\??\c:\jvtxx.exec:\jvtxx.exe74⤵PID:1616
-
\??\c:\ndptl.exec:\ndptl.exe75⤵PID:1548
-
\??\c:\xddhpjx.exec:\xddhpjx.exe76⤵PID:2036
-
\??\c:\ptnffp.exec:\ptnffp.exe77⤵PID:1392
-
\??\c:\tphbtd.exec:\tphbtd.exe78⤵PID:1512
-
\??\c:\hxhhldt.exec:\hxhhldt.exe79⤵PID:1164
-
\??\c:\ftdxd.exec:\ftdxd.exe80⤵PID:2684
-
\??\c:\pvblh.exec:\pvblh.exe81⤵PID:1704
-
\??\c:\lxbfnl.exec:\lxbfnl.exe82⤵PID:1940
-
\??\c:\bxtxjvj.exec:\bxtxjvj.exe83⤵PID:2148
-
\??\c:\lhrnjnn.exec:\lhrnjnn.exe84⤵PID:2760
-
\??\c:\lbtxl.exec:\lbtxl.exe85⤵PID:2508
-
\??\c:\rbtxv.exec:\rbtxv.exe86⤵PID:2680
-
\??\c:\phhrfx.exec:\phhrfx.exe87⤵PID:2156
-
\??\c:\hpflnbb.exec:\hpflnbb.exe88⤵PID:2548
-
\??\c:\bhbjnbx.exec:\bhbjnbx.exe89⤵PID:2376
-
\??\c:\dbpddt.exec:\dbpddt.exe90⤵PID:2456
-
\??\c:\rdjbp.exec:\rdjbp.exe91⤵PID:2820
-
\??\c:\fftjfpp.exec:\fftjfpp.exe92⤵PID:1016
-
\??\c:\ppvlhhx.exec:\ppvlhhx.exe93⤵PID:556
-
\??\c:\tjltf.exec:\tjltf.exe94⤵PID:1440
-
\??\c:\fbjhf.exec:\fbjhf.exe95⤵PID:2712
-
\??\c:\nbdrxp.exec:\nbdrxp.exe96⤵PID:1196
-
\??\c:\jnfnn.exec:\jnfnn.exe97⤵PID:1412
-
\??\c:\njbnnj.exec:\njbnnj.exe98⤵PID:1920
-
\??\c:\xjfndvf.exec:\xjfndvf.exe99⤵PID:2284
-
\??\c:\dllvlv.exec:\dllvlv.exe100⤵PID:1900
-
\??\c:\jxhjb.exec:\jxhjb.exe101⤵PID:1744
-
\??\c:\vbvjhh.exec:\vbvjhh.exe102⤵PID:1540
-
\??\c:\rpllb.exec:\rpllb.exe103⤵PID:3000
-
\??\c:\vnppx.exec:\vnppx.exe104⤵PID:2024
-
\??\c:\jjxrffn.exec:\jjxrffn.exe105⤵PID:2004
-
\??\c:\pjpvvh.exec:\pjpvvh.exe106⤵PID:660
-
\??\c:\bfvlxb.exec:\bfvlxb.exe107⤵PID:2116
-
\??\c:\tbxpj.exec:\tbxpj.exe108⤵PID:2964
-
\??\c:\rhthxx.exec:\rhthxx.exe109⤵PID:2076
-
\??\c:\pjhnjr.exec:\pjhnjr.exe110⤵PID:3020
-
\??\c:\vbbhrfl.exec:\vbbhrfl.exe111⤵PID:1928
-
\??\c:\jrvnjx.exec:\jrvnjx.exe112⤵PID:2688
-
\??\c:\ttddxtf.exec:\ttddxtf.exe113⤵PID:2316
-
\??\c:\vhbbl.exec:\vhbbl.exe114⤵PID:2348
-
\??\c:\drltx.exec:\drltx.exe115⤵PID:1788
-
\??\c:\xpnbbvj.exec:\xpnbbvj.exe116⤵PID:1052
-
\??\c:\tjhjxb.exec:\tjhjxb.exe117⤵PID:1056
-
\??\c:\jrfnbp.exec:\jrfnbp.exe118⤵PID:2332
-
\??\c:\dfftb.exec:\dfftb.exe119⤵PID:1828
-
\??\c:\njlfnt.exec:\njlfnt.exe120⤵PID:1748
-
\??\c:\thbxb.exec:\thbxb.exe121⤵PID:792
-
\??\c:\djhpbp.exec:\djhpbp.exe122⤵PID:1684
-
\??\c:\bhtddt.exec:\bhtddt.exe123⤵PID:1728
-
\??\c:\jxlhjv.exec:\jxlhjv.exe124⤵PID:2784
-
\??\c:\thvplf.exec:\thvplf.exe125⤵PID:2012
-
\??\c:\ppbnbl.exec:\ppbnbl.exe126⤵PID:1704
-
\??\c:\vxblt.exec:\vxblt.exe127⤵PID:2492
-
\??\c:\hvbnn.exec:\hvbnn.exe128⤵PID:2564
-
\??\c:\rdltj.exec:\rdltj.exe129⤵PID:2584
-
\??\c:\fvfxf.exec:\fvfxf.exe130⤵PID:2748
-
\??\c:\vjbhblh.exec:\vjbhblh.exe131⤵PID:2388
-
\??\c:\rvtdtr.exec:\rvtdtr.exe132⤵PID:2156
-
\??\c:\xnfpbbn.exec:\xnfpbbn.exe133⤵PID:2988
-
\??\c:\htfbl.exec:\htfbl.exe134⤵PID:2376
-
\??\c:\tdlxjr.exec:\tdlxjr.exe135⤵PID:1144
-
\??\c:\nxbdf.exec:\nxbdf.exe136⤵PID:2820
-
\??\c:\ljltr.exec:\ljltr.exe137⤵PID:564
-
\??\c:\jflnl.exec:\jflnl.exe138⤵PID:2280
-
\??\c:\jdxtnn.exec:\jdxtnn.exe139⤵PID:2664
-
\??\c:\xbbvp.exec:\xbbvp.exe140⤵PID:2596
-
\??\c:\lbpxjpb.exec:\lbpxjpb.exe141⤵PID:1296
-
\??\c:\tbfrvbv.exec:\tbfrvbv.exe142⤵PID:1912
-
\??\c:\nnfxvvt.exec:\nnfxvvt.exe143⤵PID:2356
-
\??\c:\dfjfjnp.exec:\dfjfjnp.exe144⤵PID:2244
-
\??\c:\btjhhdv.exec:\btjhhdv.exe145⤵PID:1528
-
\??\c:\xlndh.exec:\xlndh.exe146⤵PID:1388
-
\??\c:\vbjrjrb.exec:\vbjrjrb.exe147⤵PID:840
-
\??\c:\ntnrjb.exec:\ntnrjb.exe148⤵PID:1696
-
\??\c:\tfrjltr.exec:\tfrjltr.exe149⤵PID:612
-
\??\c:\drjbff.exec:\drjbff.exe150⤵PID:2096
-
\??\c:\jpbrdf.exec:\jpbrdf.exe151⤵PID:2260
-
\??\c:\phhtlf.exec:\phhtlf.exe152⤵PID:2764
-
\??\c:\tnrldb.exec:\tnrldb.exe153⤵PID:2980
-
\??\c:\jbjdn.exec:\jbjdn.exe154⤵PID:2928
-
\??\c:\pfpnxf.exec:\pfpnxf.exe155⤵PID:432
-
\??\c:\vjrnn.exec:\vjrnn.exe156⤵PID:2952
-
\??\c:\fdrjhfp.exec:\fdrjhfp.exe157⤵PID:1168
-
\??\c:\hdxpb.exec:\hdxpb.exe158⤵PID:388
-
\??\c:\jfljbbh.exec:\jfljbbh.exe159⤵PID:2768
-
\??\c:\xhnvjjb.exec:\xhnvjjb.exe160⤵PID:1832
-
\??\c:\fpbhv.exec:\fpbhv.exe161⤵PID:624
-
\??\c:\hnhrjx.exec:\hnhrjx.exe162⤵PID:1312
-
\??\c:\njfnr.exec:\njfnr.exe163⤵PID:2888
-
\??\c:\bnnnbxn.exec:\bnnnbxn.exe164⤵PID:1980
-
\??\c:\bdbjptb.exec:\bdbjptb.exe165⤵PID:1548
-
\??\c:\rhpvlf.exec:\rhpvlf.exe166⤵PID:1000
-
\??\c:\nfjhl.exec:\nfjhl.exe167⤵PID:1392
-
\??\c:\rltnlrh.exec:\rltnlrh.exe168⤵PID:1512
-
\??\c:\fhxlvxn.exec:\fhxlvxn.exe169⤵PID:1560
-
\??\c:\dttnp.exec:\dttnp.exe170⤵PID:2940
-
\??\c:\rtblxjv.exec:\rtblxjv.exe171⤵PID:2908
-
\??\c:\jtjnx.exec:\jtjnx.exe172⤵PID:1880
-
\??\c:\bnlpv.exec:\bnlpv.exe173⤵PID:1072
-
\??\c:\hldpvnn.exec:\hldpvnn.exe174⤵PID:2500
-
\??\c:\pbjbfr.exec:\pbjbfr.exe175⤵PID:2600
-
\??\c:\rrthfdf.exec:\rrthfdf.exe176⤵PID:2184
-
\??\c:\fhhlrfv.exec:\fhhlrfv.exe177⤵PID:2412
-
\??\c:\xbddtrl.exec:\xbddtrl.exe178⤵PID:788
-
\??\c:\ffndj.exec:\ffndj.exe179⤵PID:2824
-
\??\c:\dtvfxn.exec:\dtvfxn.exe180⤵PID:1404
-
\??\c:\hnjxvh.exec:\hnjxvh.exe181⤵PID:276
-
\??\c:\lnvnfd.exec:\lnvnfd.exe182⤵PID:2368
-
\??\c:\fnxbf.exec:\fnxbf.exe183⤵PID:2480
-
\??\c:\nhhjx.exec:\nhhjx.exe184⤵PID:1440
-
\??\c:\vplpxtj.exec:\vplpxtj.exe185⤵PID:2716
-
\??\c:\nvplrbn.exec:\nvplrbn.exe186⤵PID:2160
-
\??\c:\vxhtlj.exec:\vxhtlj.exe187⤵PID:1048
-
\??\c:\lfptv.exec:\lfptv.exe188⤵PID:1608
-
\??\c:\dnrft.exec:\dnrft.exe189⤵PID:1648
-
\??\c:\rljbpd.exec:\rljbpd.exe190⤵PID:1964
-
\??\c:\trxtfbp.exec:\trxtfbp.exe191⤵PID:2836
-
\??\c:\bdtrh.exec:\bdtrh.exe192⤵PID:1308
-
\??\c:\lfjbxd.exec:\lfjbxd.exe193⤵PID:2064
-
\??\c:\bbpxj.exec:\bbpxj.exe194⤵PID:2024
-
\??\c:\rlbxjr.exec:\rlbxjr.exe195⤵PID:544
-
\??\c:\jtbndjj.exec:\jtbndjj.exe196⤵PID:1988
-
\??\c:\nrftnft.exec:\nrftnft.exe197⤵PID:1820
-
\??\c:\hftphnh.exec:\hftphnh.exe198⤵PID:2008
-
\??\c:\vpltv.exec:\vpltv.exe199⤵PID:1080
-
\??\c:\rbrnbnt.exec:\rbrnbnt.exe200⤵PID:940
-
\??\c:\bnbtd.exec:\bnbtd.exe201⤵PID:832
-
\??\c:\xtrlpn.exec:\xtrlpn.exe202⤵PID:2688
-
\??\c:\bfrfjvv.exec:\bfrfjvv.exe203⤵PID:1600
-
\??\c:\vtjxll.exec:\vtjxll.exe204⤵PID:1664
-
\??\c:\fntbf.exec:\fntbf.exe205⤵PID:2104
-
\??\c:\jxvxhl.exec:\jxvxhl.exe206⤵PID:2800
-
\??\c:\ltjhd.exec:\ltjhd.exe207⤵PID:1652
-
\??\c:\nvpxxh.exec:\nvpxxh.exe208⤵PID:2844
-
\??\c:\nrlljxx.exec:\nrlljxx.exe209⤵PID:2780
-
\??\c:\xxbfjf.exec:\xxbfjf.exe210⤵PID:1748
-
\??\c:\dfrlpn.exec:\dfrlpn.exe211⤵PID:792
-
\??\c:\rjlhh.exec:\rjlhh.exe212⤵PID:2968
-
\??\c:\vpfnvr.exec:\vpfnvr.exe213⤵PID:1708
-
\??\c:\hlrtp.exec:\hlrtp.exe214⤵PID:2256
-
\??\c:\lhphfxf.exec:\lhphfxf.exe215⤵PID:2488
-
\??\c:\xldbrn.exec:\xldbrn.exe216⤵PID:2672
-
\??\c:\ptntvh.exec:\ptntvh.exe217⤵PID:2572
-
\??\c:\vtfnfh.exec:\vtfnfh.exe218⤵PID:2568
-
\??\c:\ftbpvlh.exec:\ftbpvlh.exe219⤵PID:2624
-
\??\c:\xdbnvbd.exec:\xdbnvbd.exe220⤵PID:2420
-
\??\c:\prbjxvn.exec:\prbjxvn.exe221⤵PID:2416
-
\??\c:\rdbvjfb.exec:\rdbvjfb.exe222⤵PID:2548
-
\??\c:\jbnhj.exec:\jbnhj.exe223⤵PID:2988
-
\??\c:\xhppl.exec:\xhppl.exe224⤵PID:1344
-
\??\c:\lbrjpt.exec:\lbrjpt.exe225⤵PID:2736
-
\??\c:\jbnxt.exec:\jbnxt.exe226⤵PID:1336
-
\??\c:\llxbh.exec:\llxbh.exe227⤵PID:1176
-
\??\c:\phbvr.exec:\phbvr.exe228⤵PID:1184
-
\??\c:\drpjjn.exec:\drpjjn.exe229⤵PID:2636
-
\??\c:\ljtdh.exec:\ljtdh.exe230⤵PID:1124
-
\??\c:\fjbxn.exec:\fjbxn.exe231⤵PID:1296
-
\??\c:\rptxx.exec:\rptxx.exe232⤵PID:2288
-
\??\c:\fffhnxt.exec:\fffhnxt.exe233⤵PID:1896
-
\??\c:\phdbf.exec:\phdbf.exe234⤵PID:2852
-
\??\c:\btvxvxx.exec:\btvxvxx.exe235⤵PID:1456
-
\??\c:\hvrnjf.exec:\hvrnjf.exe236⤵PID:2308
-
\??\c:\vrnxvb.exec:\vrnxvb.exe237⤵PID:2252
-
\??\c:\jfhln.exec:\jfhln.exe238⤵PID:2228
-
\??\c:\vnttpxv.exec:\vnttpxv.exe239⤵PID:1756
-
\??\c:\frfvfh.exec:\frfvfh.exe240⤵PID:2060
-
\??\c:\jhxdpxt.exec:\jhxdpxt.exe241⤵PID:2220
-
\??\c:\nvtprn.exec:\nvtprn.exe242⤵PID:2764