Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 07:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70_NeikiAnalytics.exe
-
Size
77KB
-
MD5
d2e0b98906083980d4684929a28ed520
-
SHA1
39e920e6a8d9dd19c28e2fe5e6d851f1aaf52a6f
-
SHA256
1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70
-
SHA512
454c45ef9dcd610ecd6f53eb09a00588a1d2c35067b4a6b0ee2af3aa445384318bf63ed4f7c6b75ebc8589893d610bb0affcc2e67118709b3e9cbd26465c21a1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2wVEJjOB3:ymb3NkkiQ3mdBjF+3TU2KEJjE3
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2864-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1380-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/948-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1100-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/800-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/364-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vhdpt.exenfjbftn.exepjttb.exenpxlv.exehjltdlb.exerxbxhxt.exepbtbf.exevvlthr.exerlhvptj.exefvfdrhp.exetbblfh.exexhrtfr.exenfpnffj.exexjlbjth.exevfbrnj.exetndfp.exejxrtfv.exehhlnh.exehdttfd.exerdblbr.exebjrjfxt.exenvvfff.exenxtprxx.exejlxrhb.exexhbvpv.exebpvtb.exenhllnld.exeddnlrfr.exefnlnpx.exenlrtrj.exejtbxdf.exenbfdb.exevjfpj.exenhxvddx.exexlnfhl.exejnrll.exervnxtv.exexjdhrrd.exepfbfjh.exevvxfdn.exeftllj.exebhdblxv.exevfjpfh.exevxpbnbv.exendvhp.exexbbjt.exerbnnl.exetfjfxdp.exefhftlh.exefppnpf.exerrprprb.exerxnlnx.exedpntn.exetfdnpxn.exefrttp.exervtdnd.exevdlpflx.exevxrvt.exepvlrljf.exebpblxn.exejvlrbdh.exebvjbf.exebljlhl.exenpdtrfh.exepid process 2864 vhdpt.exe 2468 nfjbftn.exe 2644 pjttb.exe 2524 npxlv.exe 2592 hjltdlb.exe 2476 rxbxhxt.exe 2436 pbtbf.exe 2872 vvlthr.exe 1380 rlhvptj.exe 2344 fvfdrhp.exe 2560 tbblfh.exe 2720 xhrtfr.exe 2040 nfpnffj.exe 2168 xjlbjth.exe 1100 vfbrnj.exe 948 tndfp.exe 800 jxrtfv.exe 2460 hhlnh.exe 3048 hdttfd.exe 2992 rdblbr.exe 1712 bjrjfxt.exe 1096 nvvfff.exe 1808 nxtprxx.exe 692 jlxrhb.exe 1028 xhbvpv.exe 2284 bpvtb.exe 364 nhllnld.exe 2916 ddnlrfr.exe 1680 fnlnpx.exe 2424 nlrtrj.exe 1748 jtbxdf.exe 2264 nbfdb.exe 2096 vjfpj.exe 1704 nhxvddx.exe 2620 xlnfhl.exe 2468 jnrll.exe 2488 rvnxtv.exe 2372 xjdhrrd.exe 2480 pfbfjh.exe 2628 vvxfdn.exe 2364 ftllj.exe 2232 bhdblxv.exe 2396 vfjpfh.exe 700 vxpbnbv.exe 1644 ndvhp.exe 1380 xbbjt.exe 1188 rbnnl.exe 1832 tfjfxdp.exe 2728 fhftlh.exe 2720 fppnpf.exe 2040 rrprprb.exe 1912 rxnlnx.exe 1972 dpntn.exe 1692 tfdnpxn.exe 940 frttp.exe 2244 rvtdnd.exe 596 vdlpflx.exe 2820 vxrvt.exe 2816 pvlrljf.exe 308 bpblxn.exe 1064 jvlrbdh.exe 2196 bvjbf.exe 1060 bljlhl.exe 1180 npdtrfh.exe -
Processes:
resource yara_rule behavioral1/memory/2192-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1380-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/948-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/800-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/364-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70_NeikiAnalytics.exevhdpt.exenfjbftn.exepjttb.exenpxlv.exehjltdlb.exerxbxhxt.exepbtbf.exevvlthr.exerlhvptj.exefvfdrhp.exetbblfh.exexhrtfr.exenfpnffj.exexjlbjth.exevfbrnj.exedescription pid process target process PID 2192 wrote to memory of 2864 2192 1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70_NeikiAnalytics.exe vhdpt.exe PID 2192 wrote to memory of 2864 2192 1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70_NeikiAnalytics.exe vhdpt.exe PID 2192 wrote to memory of 2864 2192 1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70_NeikiAnalytics.exe vhdpt.exe PID 2192 wrote to memory of 2864 2192 1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70_NeikiAnalytics.exe vhdpt.exe PID 2864 wrote to memory of 2468 2864 vhdpt.exe nfjbftn.exe PID 2864 wrote to memory of 2468 2864 vhdpt.exe nfjbftn.exe PID 2864 wrote to memory of 2468 2864 vhdpt.exe nfjbftn.exe PID 2864 wrote to memory of 2468 2864 vhdpt.exe nfjbftn.exe PID 2468 wrote to memory of 2644 2468 nfjbftn.exe pjttb.exe PID 2468 wrote to memory of 2644 2468 nfjbftn.exe pjttb.exe PID 2468 wrote to memory of 2644 2468 nfjbftn.exe pjttb.exe PID 2468 wrote to memory of 2644 2468 nfjbftn.exe pjttb.exe PID 2644 wrote to memory of 2524 2644 pjttb.exe npxlv.exe PID 2644 wrote to memory of 2524 2644 pjttb.exe npxlv.exe PID 2644 wrote to memory of 2524 2644 pjttb.exe npxlv.exe PID 2644 wrote to memory of 2524 2644 pjttb.exe npxlv.exe PID 2524 wrote to memory of 2592 2524 npxlv.exe hjltdlb.exe PID 2524 wrote to memory of 2592 2524 npxlv.exe hjltdlb.exe PID 2524 wrote to memory of 2592 2524 npxlv.exe hjltdlb.exe PID 2524 wrote to memory of 2592 2524 npxlv.exe hjltdlb.exe PID 2592 wrote to memory of 2476 2592 hjltdlb.exe rxbxhxt.exe PID 2592 wrote to memory of 2476 2592 hjltdlb.exe rxbxhxt.exe PID 2592 wrote to memory of 2476 2592 hjltdlb.exe rxbxhxt.exe PID 2592 wrote to memory of 2476 2592 hjltdlb.exe rxbxhxt.exe PID 2476 wrote to memory of 2436 2476 rxbxhxt.exe pbtbf.exe PID 2476 wrote to memory of 2436 2476 rxbxhxt.exe pbtbf.exe PID 2476 wrote to memory of 2436 2476 rxbxhxt.exe pbtbf.exe PID 2476 wrote to memory of 2436 2476 rxbxhxt.exe pbtbf.exe PID 2436 wrote to memory of 2872 2436 pbtbf.exe vvlthr.exe PID 2436 wrote to memory of 2872 2436 pbtbf.exe vvlthr.exe PID 2436 wrote to memory of 2872 2436 pbtbf.exe vvlthr.exe PID 2436 wrote to memory of 2872 2436 pbtbf.exe vvlthr.exe PID 2872 wrote to memory of 1380 2872 vvlthr.exe rlhvptj.exe PID 2872 wrote to memory of 1380 2872 vvlthr.exe rlhvptj.exe PID 2872 wrote to memory of 1380 2872 vvlthr.exe rlhvptj.exe PID 2872 wrote to memory of 1380 2872 vvlthr.exe rlhvptj.exe PID 1380 wrote to memory of 2344 1380 rlhvptj.exe fvfdrhp.exe PID 1380 wrote to memory of 2344 1380 rlhvptj.exe fvfdrhp.exe PID 1380 wrote to memory of 2344 1380 rlhvptj.exe fvfdrhp.exe PID 1380 wrote to memory of 2344 1380 rlhvptj.exe fvfdrhp.exe PID 2344 wrote to memory of 2560 2344 fvfdrhp.exe tbblfh.exe PID 2344 wrote to memory of 2560 2344 fvfdrhp.exe tbblfh.exe PID 2344 wrote to memory of 2560 2344 fvfdrhp.exe tbblfh.exe PID 2344 wrote to memory of 2560 2344 fvfdrhp.exe tbblfh.exe PID 2560 wrote to memory of 2720 2560 tbblfh.exe xhrtfr.exe PID 2560 wrote to memory of 2720 2560 tbblfh.exe xhrtfr.exe PID 2560 wrote to memory of 2720 2560 tbblfh.exe xhrtfr.exe PID 2560 wrote to memory of 2720 2560 tbblfh.exe xhrtfr.exe PID 2720 wrote to memory of 2040 2720 xhrtfr.exe nfpnffj.exe PID 2720 wrote to memory of 2040 2720 xhrtfr.exe nfpnffj.exe PID 2720 wrote to memory of 2040 2720 xhrtfr.exe nfpnffj.exe PID 2720 wrote to memory of 2040 2720 xhrtfr.exe nfpnffj.exe PID 2040 wrote to memory of 2168 2040 nfpnffj.exe xjlbjth.exe PID 2040 wrote to memory of 2168 2040 nfpnffj.exe xjlbjth.exe PID 2040 wrote to memory of 2168 2040 nfpnffj.exe xjlbjth.exe PID 2040 wrote to memory of 2168 2040 nfpnffj.exe xjlbjth.exe PID 2168 wrote to memory of 1100 2168 xjlbjth.exe vfbrnj.exe PID 2168 wrote to memory of 1100 2168 xjlbjth.exe vfbrnj.exe PID 2168 wrote to memory of 1100 2168 xjlbjth.exe vfbrnj.exe PID 2168 wrote to memory of 1100 2168 xjlbjth.exe vfbrnj.exe PID 1100 wrote to memory of 948 1100 vfbrnj.exe tndfp.exe PID 1100 wrote to memory of 948 1100 vfbrnj.exe tndfp.exe PID 1100 wrote to memory of 948 1100 vfbrnj.exe tndfp.exe PID 1100 wrote to memory of 948 1100 vfbrnj.exe tndfp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\vhdpt.exec:\vhdpt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\nfjbftn.exec:\nfjbftn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\pjttb.exec:\pjttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\npxlv.exec:\npxlv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\hjltdlb.exec:\hjltdlb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rxbxhxt.exec:\rxbxhxt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\pbtbf.exec:\pbtbf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\vvlthr.exec:\vvlthr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\rlhvptj.exec:\rlhvptj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\fvfdrhp.exec:\fvfdrhp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\tbblfh.exec:\tbblfh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\xhrtfr.exec:\xhrtfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\nfpnffj.exec:\nfpnffj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\xjlbjth.exec:\xjlbjth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\vfbrnj.exec:\vfbrnj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\tndfp.exec:\tndfp.exe17⤵
- Executes dropped EXE
PID:948 -
\??\c:\jxrtfv.exec:\jxrtfv.exe18⤵
- Executes dropped EXE
PID:800 -
\??\c:\hhlnh.exec:\hhlnh.exe19⤵
- Executes dropped EXE
PID:2460 -
\??\c:\hdttfd.exec:\hdttfd.exe20⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rdblbr.exec:\rdblbr.exe21⤵
- Executes dropped EXE
PID:2992 -
\??\c:\bjrjfxt.exec:\bjrjfxt.exe22⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nvvfff.exec:\nvvfff.exe23⤵
- Executes dropped EXE
PID:1096 -
\??\c:\nxtprxx.exec:\nxtprxx.exe24⤵
- Executes dropped EXE
PID:1808 -
\??\c:\jlxrhb.exec:\jlxrhb.exe25⤵
- Executes dropped EXE
PID:692 -
\??\c:\xhbvpv.exec:\xhbvpv.exe26⤵
- Executes dropped EXE
PID:1028 -
\??\c:\bpvtb.exec:\bpvtb.exe27⤵
- Executes dropped EXE
PID:2284 -
\??\c:\nhllnld.exec:\nhllnld.exe28⤵
- Executes dropped EXE
PID:364 -
\??\c:\ddnlrfr.exec:\ddnlrfr.exe29⤵
- Executes dropped EXE
PID:2916 -
\??\c:\fnlnpx.exec:\fnlnpx.exe30⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nlrtrj.exec:\nlrtrj.exe31⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jtbxdf.exec:\jtbxdf.exe32⤵
- Executes dropped EXE
PID:1748 -
\??\c:\nbfdb.exec:\nbfdb.exe33⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vjfpj.exec:\vjfpj.exe34⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nhxvddx.exec:\nhxvddx.exe35⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xlnfhl.exec:\xlnfhl.exe36⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jnrll.exec:\jnrll.exe37⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rvnxtv.exec:\rvnxtv.exe38⤵
- Executes dropped EXE
PID:2488 -
\??\c:\xjdhrrd.exec:\xjdhrrd.exe39⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pfbfjh.exec:\pfbfjh.exe40⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vvxfdn.exec:\vvxfdn.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ftllj.exec:\ftllj.exe42⤵
- Executes dropped EXE
PID:2364 -
\??\c:\bhdblxv.exec:\bhdblxv.exe43⤵
- Executes dropped EXE
PID:2232 -
\??\c:\vfjpfh.exec:\vfjpfh.exe44⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vxpbnbv.exec:\vxpbnbv.exe45⤵
- Executes dropped EXE
PID:700 -
\??\c:\ndvhp.exec:\ndvhp.exe46⤵
- Executes dropped EXE
PID:1644 -
\??\c:\xbbjt.exec:\xbbjt.exe47⤵
- Executes dropped EXE
PID:1380 -
\??\c:\rbnnl.exec:\rbnnl.exe48⤵
- Executes dropped EXE
PID:1188 -
\??\c:\tfjfxdp.exec:\tfjfxdp.exe49⤵
- Executes dropped EXE
PID:1832 -
\??\c:\fhftlh.exec:\fhftlh.exe50⤵
- Executes dropped EXE
PID:2728 -
\??\c:\fppnpf.exec:\fppnpf.exe51⤵
- Executes dropped EXE
PID:2720 -
\??\c:\rrprprb.exec:\rrprprb.exe52⤵
- Executes dropped EXE
PID:2040 -
\??\c:\rxnlnx.exec:\rxnlnx.exe53⤵
- Executes dropped EXE
PID:1912 -
\??\c:\dpntn.exec:\dpntn.exe54⤵
- Executes dropped EXE
PID:1972 -
\??\c:\tfdnpxn.exec:\tfdnpxn.exe55⤵
- Executes dropped EXE
PID:1692 -
\??\c:\frttp.exec:\frttp.exe56⤵
- Executes dropped EXE
PID:940 -
\??\c:\rvtdnd.exec:\rvtdnd.exe57⤵
- Executes dropped EXE
PID:2244 -
\??\c:\vdlpflx.exec:\vdlpflx.exe58⤵
- Executes dropped EXE
PID:596 -
\??\c:\vxrvt.exec:\vxrvt.exe59⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pvlrljf.exec:\pvlrljf.exe60⤵
- Executes dropped EXE
PID:2816 -
\??\c:\bpblxn.exec:\bpblxn.exe61⤵
- Executes dropped EXE
PID:308 -
\??\c:\jvlrbdh.exec:\jvlrbdh.exe62⤵
- Executes dropped EXE
PID:1064 -
\??\c:\bvjbf.exec:\bvjbf.exe63⤵
- Executes dropped EXE
PID:2196 -
\??\c:\bljlhl.exec:\bljlhl.exe64⤵
- Executes dropped EXE
PID:1060 -
\??\c:\npdtrfh.exec:\npdtrfh.exe65⤵
- Executes dropped EXE
PID:1180 -
\??\c:\llrfp.exec:\llrfp.exe66⤵PID:1756
-
\??\c:\bltrbv.exec:\bltrbv.exe67⤵PID:3044
-
\??\c:\ljjvd.exec:\ljjvd.exe68⤵PID:1992
-
\??\c:\bnxlxp.exec:\bnxlxp.exe69⤵PID:1640
-
\??\c:\tnbttr.exec:\tnbttr.exe70⤵PID:1736
-
\??\c:\rhhlxr.exec:\rhhlxr.exe71⤵PID:2132
-
\??\c:\rtvjvrr.exec:\rtvjvrr.exe72⤵PID:1680
-
\??\c:\lvhfxt.exec:\lvhfxt.exe73⤵PID:2208
-
\??\c:\jvhnrf.exec:\jvhnrf.exe74⤵PID:1140
-
\??\c:\nhtrl.exec:\nhtrl.exe75⤵PID:1516
-
\??\c:\plfrxr.exec:\plfrxr.exe76⤵PID:1608
-
\??\c:\xfxbn.exec:\xfxbn.exe77⤵PID:2096
-
\??\c:\tllfhff.exec:\tllfhff.exe78⤵PID:2960
-
\??\c:\jlftx.exec:\jlftx.exe79⤵PID:2516
-
\??\c:\pffdjbl.exec:\pffdjbl.exe80⤵PID:2656
-
\??\c:\brthbpv.exec:\brthbpv.exe81⤵PID:2144
-
\??\c:\nvvrllp.exec:\nvvrllp.exe82⤵PID:1588
-
\??\c:\jtjhhnx.exec:\jtjhhnx.exe83⤵PID:2528
-
\??\c:\jdnvr.exec:\jdnvr.exe84⤵PID:2384
-
\??\c:\ldrxrx.exec:\ldrxrx.exe85⤵PID:2868
-
\??\c:\vrvpbvv.exec:\vrvpbvv.exe86⤵PID:3040
-
\??\c:\bppjx.exec:\bppjx.exe87⤵PID:580
-
\??\c:\nbjft.exec:\nbjft.exe88⤵PID:884
-
\??\c:\xlfnrnb.exec:\xlfnrnb.exe89⤵PID:1472
-
\??\c:\ftfdxr.exec:\ftfdxr.exe90⤵PID:1072
-
\??\c:\vffjdv.exec:\vffjdv.exe91⤵PID:2744
-
\??\c:\pltdvnn.exec:\pltdvnn.exe92⤵PID:2732
-
\??\c:\trrnv.exec:\trrnv.exe93⤵PID:1968
-
\??\c:\phjdrr.exec:\phjdrr.exe94⤵PID:2100
-
\??\c:\dtxrx.exec:\dtxrx.exe95⤵PID:1636
-
\??\c:\tvbvv.exec:\tvbvv.exe96⤵PID:2464
-
\??\c:\bdhvr.exec:\bdhvr.exe97⤵PID:768
-
\??\c:\dbnftpp.exec:\dbnftpp.exe98⤵PID:2544
-
\??\c:\pxnnfd.exec:\pxnnfd.exe99⤵PID:896
-
\??\c:\pdxjb.exec:\pdxjb.exe100⤵PID:1532
-
\??\c:\xftxbnl.exec:\xftxbnl.exe101⤵PID:1716
-
\??\c:\xxpnd.exec:\xxpnd.exe102⤵PID:3004
-
\??\c:\rvjxjl.exec:\rvjxjl.exe103⤵PID:2064
-
\??\c:\ldbnbn.exec:\ldbnbn.exe104⤵PID:2860
-
\??\c:\bvhhdhr.exec:\bvhhdhr.exe105⤵PID:912
-
\??\c:\phhvrh.exec:\phhvrh.exe106⤵PID:1836
-
\??\c:\vfjtppx.exec:\vfjtppx.exe107⤵PID:1732
-
\??\c:\bjvvvn.exec:\bjvvvn.exe108⤵PID:2000
-
\??\c:\rdfjj.exec:\rdfjj.exe109⤵PID:708
-
\??\c:\hdjxbdn.exec:\hdjxbdn.exe110⤵PID:1988
-
\??\c:\nrpxr.exec:\nrpxr.exe111⤵PID:2284
-
\??\c:\tfjbxr.exec:\tfjbxr.exe112⤵PID:908
-
\??\c:\npxhh.exec:\npxhh.exe113⤵PID:2084
-
\??\c:\vntbbp.exec:\vntbbp.exe114⤵PID:1764
-
\??\c:\hvjrt.exec:\hvjrt.exe115⤵PID:1512
-
\??\c:\rhvfvf.exec:\rhvfvf.exe116⤵PID:1752
-
\??\c:\fbjtlnx.exec:\fbjtlnx.exe117⤵PID:1748
-
\??\c:\bdprltx.exec:\bdprltx.exe118⤵PID:1600
-
\??\c:\rnnljh.exec:\rnnljh.exe119⤵PID:2900
-
\??\c:\vlnpfb.exec:\vlnpfb.exe120⤵PID:2148
-
\??\c:\ltdft.exec:\ltdft.exe121⤵PID:2504
-
\??\c:\ljptnj.exec:\ljptnj.exe122⤵PID:3032
-
\??\c:\hfpvbr.exec:\hfpvbr.exe123⤵PID:2964
-
\??\c:\bbnjbl.exec:\bbnjbl.exe124⤵PID:2664
-
\??\c:\lvxrf.exec:\lvxrf.exe125⤵PID:2684
-
\??\c:\lbrvl.exec:\lbrvl.exe126⤵PID:2592
-
\??\c:\bnvnjjv.exec:\bnvnjjv.exe127⤵PID:2536
-
\??\c:\fvlpl.exec:\fvlpl.exe128⤵PID:2912
-
\??\c:\nrfffvn.exec:\nrfffvn.exe129⤵PID:2440
-
\??\c:\rhbtjf.exec:\rhbtjf.exe130⤵PID:644
-
\??\c:\lvnxd.exec:\lvnxd.exe131⤵PID:1928
-
\??\c:\dldvbx.exec:\dldvbx.exe132⤵PID:1396
-
\??\c:\ljvffb.exec:\ljvffb.exe133⤵PID:2568
-
\??\c:\phvpf.exec:\phvpf.exe134⤵PID:2736
-
\??\c:\jpdtf.exec:\jpdtf.exe135⤵PID:2704
-
\??\c:\tflrb.exec:\tflrb.exe136⤵PID:1104
-
\??\c:\xbtlnnd.exec:\xbtlnnd.exe137⤵PID:1920
-
\??\c:\vfddltf.exec:\vfddltf.exe138⤵PID:1912
-
\??\c:\vlftn.exec:\vlftn.exe139⤵PID:956
-
\??\c:\ftrdjdt.exec:\ftrdjdt.exe140⤵PID:2464
-
\??\c:\jdtdjfl.exec:\jdtdjfl.exe141⤵PID:1492
-
\??\c:\bphvnlr.exec:\bphvnlr.exe142⤵PID:2052
-
\??\c:\hxtprjd.exec:\hxtprjd.exe143⤵PID:540
-
\??\c:\plxpdv.exec:\plxpdv.exe144⤵PID:2172
-
\??\c:\jntnx.exec:\jntnx.exe145⤵PID:2152
-
\??\c:\xvldbf.exec:\xvldbf.exe146⤵PID:308
-
\??\c:\rrvdl.exec:\rrvdl.exe147⤵PID:2836
-
\??\c:\rrrfj.exec:\rrrfj.exe148⤵PID:2272
-
\??\c:\fvjdnn.exec:\fvjdnn.exe149⤵PID:2012
-
\??\c:\xdtdddf.exec:\xdtdddf.exe150⤵PID:984
-
\??\c:\tdhbdbl.exec:\tdhbdbl.exe151⤵PID:1844
-
\??\c:\rbpdj.exec:\rbpdj.exe152⤵PID:1620
-
\??\c:\dhnfp.exec:\dhnfp.exe153⤵PID:1624
-
\??\c:\dnnprdl.exec:\dnnprdl.exe154⤵PID:612
-
\??\c:\dttthp.exec:\dttthp.exe155⤵PID:2076
-
\??\c:\pbfvpb.exec:\pbfvpb.exe156⤵PID:1524
-
\??\c:\rxprj.exec:\rxprj.exe157⤵PID:3060
-
\??\c:\tnnfpv.exec:\tnnfpv.exe158⤵PID:892
-
\??\c:\dvpvbp.exec:\dvpvbp.exe159⤵PID:1564
-
\??\c:\lxnbn.exec:\lxnbn.exe160⤵PID:2680
-
\??\c:\hbtvj.exec:\hbtvj.exe161⤵PID:1748
-
\??\c:\bpnpdtb.exec:\bpnpdtb.exe162⤵PID:2492
-
\??\c:\hjdjdj.exec:\hjdjdj.exe163⤵PID:2864
-
\??\c:\lfpnpx.exec:\lfpnpx.exe164⤵PID:2472
-
\??\c:\pnjnl.exec:\pnjnl.exe165⤵PID:2608
-
\??\c:\lllhnrh.exec:\lllhnrh.exe166⤵PID:2488
-
\??\c:\hxjbdl.exec:\hxjbdl.exe167⤵PID:2372
-
\??\c:\jxvxnrh.exec:\jxvxnrh.exe168⤵PID:2480
-
\??\c:\bjlhvjt.exec:\bjlhvjt.exe169⤵PID:2532
-
\??\c:\bhptf.exec:\bhptf.exe170⤵PID:2420
-
\??\c:\prvvvhf.exec:\prvvvhf.exe171⤵PID:2556
-
\??\c:\lvtnbn.exec:\lvtnbn.exe172⤵PID:2396
-
\??\c:\njlhvvl.exec:\njlhvvl.exe173⤵PID:1372
-
\??\c:\trrnlhh.exec:\trrnlhh.exe174⤵PID:1916
-
\??\c:\nxdjf.exec:\nxdjf.exe175⤵PID:1380
-
\??\c:\dnrxr.exec:\dnrxr.exe176⤵PID:568
-
\??\c:\bvnpbtb.exec:\bvnpbtb.exe177⤵PID:2696
-
\??\c:\rnnnxbr.exec:\rnnnxbr.exe178⤵PID:2600
-
\??\c:\prdjjr.exec:\prdjjr.exe179⤵PID:2340
-
\??\c:\lrvfhvv.exec:\lrvfhvv.exe180⤵PID:2692
-
\??\c:\thlttx.exec:\thlttx.exe181⤵PID:1124
-
\??\c:\xhjpd.exec:\xhjpd.exe182⤵PID:764
-
\??\c:\xbtpvlp.exec:\xbtpvlp.exe183⤵PID:2852
-
\??\c:\dpdvvt.exec:\dpdvvt.exe184⤵PID:2276
-
\??\c:\fpbflth.exec:\fpbflth.exe185⤵PID:1708
-
\??\c:\bdbfnl.exec:\bdbfnl.exe186⤵PID:596
-
\??\c:\trbdx.exec:\trbdx.exe187⤵PID:584
-
\??\c:\trjjpb.exec:\trjjpb.exe188⤵PID:3004
-
\??\c:\pdpxpfn.exec:\pdpxpfn.exe189⤵PID:1964
-
\??\c:\hjrbj.exec:\hjrbj.exe190⤵PID:2028
-
\??\c:\hvtdhh.exec:\hvtdhh.exe191⤵PID:2296
-
\??\c:\ldxxlv.exec:\ldxxlv.exe192⤵PID:2072
-
\??\c:\vtrhxd.exec:\vtrhxd.exe193⤵PID:2804
-
\??\c:\bhlxll.exec:\bhlxll.exe194⤵PID:1328
-
\??\c:\dvbtbhl.exec:\dvbtbhl.exe195⤵PID:1672
-
\??\c:\hvhfnj.exec:\hvhfnj.exe196⤵PID:1620
-
\??\c:\vfpbfx.exec:\vfpbfx.exe197⤵PID:2220
-
\??\c:\htbxn.exec:\htbxn.exe198⤵PID:1640
-
\??\c:\hjntl.exec:\hjntl.exe199⤵PID:1736
-
\??\c:\tvvnfpl.exec:\tvvnfpl.exe200⤵PID:1684
-
\??\c:\ttxnnbp.exec:\ttxnnbp.exe201⤵PID:1144
-
\??\c:\vbnjnnf.exec:\vbnjnnf.exe202⤵PID:1728
-
\??\c:\nhjxb.exec:\nhjxb.exe203⤵PID:1140
-
\??\c:\lvnxnj.exec:\lvnxnj.exe204⤵PID:2680
-
\??\c:\rrlpv.exec:\rrlpv.exe205⤵PID:1632
-
\??\c:\xhlvhp.exec:\xhlvhp.exe206⤵PID:2520
-
\??\c:\ftffxj.exec:\ftffxj.exe207⤵PID:2512
-
\??\c:\fpbrh.exec:\fpbrh.exe208⤵PID:2292
-
\??\c:\rnbvf.exec:\rnbvf.exe209⤵PID:2796
-
\??\c:\vtbffn.exec:\vtbffn.exe210⤵PID:2500
-
\??\c:\lvphfdf.exec:\lvphfdf.exe211⤵PID:2748
-
\??\c:\nvvnbx.exec:\nvvnbx.exe212⤵PID:2376
-
\??\c:\rphxvh.exec:\rphxvh.exe213⤵PID:2232
-
\??\c:\xtbxbp.exec:\xtbxbp.exe214⤵PID:2868
-
\??\c:\pldpvn.exec:\pldpvn.exe215⤵PID:1384
-
\??\c:\lhbjr.exec:\lhbjr.exe216⤵PID:2428
-
\??\c:\fffbt.exec:\fffbt.exe217⤵PID:1372
-
\??\c:\vlhljt.exec:\vlhljt.exe218⤵PID:968
-
\??\c:\tltnrvn.exec:\tltnrvn.exe219⤵PID:1380
-
\??\c:\drdvptd.exec:\drdvptd.exe220⤵PID:1348
-
\??\c:\hxvhdjl.exec:\hxvhdjl.exe221⤵PID:2736
-
\??\c:\vhvnlr.exec:\vhvnlr.exe222⤵PID:1656
-
\??\c:\jnfpxdr.exec:\jnfpxdr.exe223⤵PID:1092
-
\??\c:\xpjhf.exec:\xpjhf.exe224⤵PID:2692
-
\??\c:\nfbnl.exec:\nfbnl.exe225⤵PID:1124
-
\??\c:\rphtdvr.exec:\rphtdvr.exe226⤵PID:764
-
\??\c:\hbfnrnf.exec:\hbfnrnf.exe227⤵PID:1116
-
\??\c:\jdxbr.exec:\jdxbr.exe228⤵PID:2276
-
\??\c:\hffhlfn.exec:\hffhlfn.exe229⤵PID:1708
-
\??\c:\bfthbt.exec:\bfthbt.exe230⤵PID:2812
-
\??\c:\bnxjpx.exec:\bnxjpx.exe231⤵PID:584
-
\??\c:\nfrnjb.exec:\nfrnjb.exe232⤵PID:528
-
\??\c:\ptlnpjn.exec:\ptlnpjn.exe233⤵PID:1824
-
\??\c:\dxblt.exec:\dxblt.exe234⤵PID:2028
-
\??\c:\rtdvbt.exec:\rtdvbt.exe235⤵PID:1836
-
\??\c:\ppvxbtv.exec:\ppvxbtv.exe236⤵PID:1552
-
\??\c:\ndnbdhh.exec:\ndnbdhh.exe237⤵PID:1060
-
\??\c:\hrtjf.exec:\hrtjf.exe238⤵PID:1180
-
\??\c:\pjvrn.exec:\pjvrn.exe239⤵PID:1952
-
\??\c:\ltfrdr.exec:\ltfrdr.exe240⤵PID:2080
-
\??\c:\dljlfj.exec:\dljlfj.exe241⤵PID:2220
-
\??\c:\jpdfvp.exec:\jpdfvp.exe242⤵PID:1584