Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 03:42
Behavioral task
behavioral1
Sample
2a6e3ccd72b72a65c167e090f62e1d1ff32a3ab774cf2cecbf68b50d23fb1983_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2a6e3ccd72b72a65c167e090f62e1d1ff32a3ab774cf2cecbf68b50d23fb1983_NeikiAnalytics.exe
-
Size
92KB
-
MD5
38f49eff137b92c50a9d7945572185b0
-
SHA1
8952db17f47e0755af64c5b8c03a9441df0fa8ff
-
SHA256
2a6e3ccd72b72a65c167e090f62e1d1ff32a3ab774cf2cecbf68b50d23fb1983
-
SHA512
ace7991c6350e41e848da3f78e39186bc8d28c46168d5322cfe521e80ad0eafe1e4be156d952f08cd91643d3610626c90662782706bd1f4f44d64094fbfa342a
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWprCTI:8hOmTsF93UYfwC6GIout0fmCiiiXA6mP
Malware Config
Signatures
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/1704-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2332-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/868-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1724-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1056-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1276-477-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1548-584-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2748-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/904-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/584-274-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/868-277-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/664-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1128-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1740-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1344-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1652-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1144-663-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2792-680-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/808-772-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2460-858-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2584-864-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2556-871-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1764-878-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1764-877-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1764-897-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2196-11320-0x00000000779B0000-0x0000000077AAA000-memory.dmp family_blackmoon behavioral1/memory/2196-12181-0x0000000077AB0000-0x0000000077BCF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2088 hjpxl.exe 2332 vddllx.exe 2560 dvjltl.exe 2660 ndhjrnn.exe 2668 nbpldl.exe 2700 pxfvh.exe 2444 vfhfjp.exe 2532 pffhrt.exe 2476 pjhnx.exe 2968 dvdbdtr.exe 648 jftfxn.exe 2372 phvbnr.exe 1652 jdvvbl.exe 2776 tprhh.exe 2828 vvpnvrb.exe 2736 xpfpr.exe 1676 njtdphl.exe 1344 lbptl.exe 920 thfxlr.exe 2764 pxxdhfj.exe 2720 hrpbr.exe 1620 djlljt.exe 1740 ljfpp.exe 2316 rrpvd.exe 1128 drjldv.exe 664 drrxjn.exe 1668 vpdxtbt.exe 2000 ttjxbf.exe 1812 ltddxh.exe 584 bxjxpjr.exe 1484 pvbpxv.exe 2112 jxxhtx.exe 2220 pttprht.exe 2388 rfvprt.exe 868 ftdxx.exe 1724 lrtpl.exe 1704 vvlhf.exe 3048 rxjltl.exe 1692 rndnpfb.exe 2512 jhvpfx.exe 2560 xtdtl.exe 2704 bdbrv.exe 2552 dnrtp.exe 2668 vfblxp.exe 2592 bfvjlf.exe 2584 xxrprpr.exe 2432 jjbjt.exe 2532 nvpvhbh.exe 2960 lhntnf.exe 2860 pdxjp.exe 2968 xdlljx.exe 748 prvdbvn.exe 1120 jxltfr.exe 904 hvvvbl.exe 2812 jtdrlr.exe 2848 lbhxxjr.exe 1056 vxtlfj.exe 2780 hvbbvvl.exe 1184 tdfdvv.exe 2164 lrhfjj.exe 924 nttjrl.exe 2520 lprjjnj.exe 2748 frvdnj.exe 1616 bhjfl.exe -
resource yara_rule behavioral1/memory/1704-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2332-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000014491-26.dat upx behavioral1/files/0x000700000001449f-45.dat upx behavioral1/memory/2668-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014544-51.dat upx behavioral1/files/0x000800000001454e-61.dat upx behavioral1/memory/2444-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001561c-75.dat upx behavioral1/files/0x0006000000015c0f-85.dat upx behavioral1/files/0x0006000000015c2f-100.dat upx behavioral1/files/0x0006000000015c39-106.dat upx behavioral1/memory/2776-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2828-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d00000001436b-146.dat upx behavioral1/files/0x0006000000015c83-155.dat upx behavioral1/files/0x0006000000015c91-162.dat upx behavioral1/memory/2764-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2720-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cb9-184.dat upx behavioral1/files/0x0006000000015cd2-193.dat upx behavioral1/files/0x0006000000015cfc-211.dat upx behavioral1/files/0x0006000000015dc5-219.dat upx behavioral1/memory/2000-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015f1f-240.dat upx behavioral1/files/0x0006000000015ff4-248.dat upx behavioral1/files/0x0006000000016096-255.dat upx behavioral1/memory/868-278-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1724-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2560-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2592-326-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1056-395-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1612-439-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2200-520-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1276-477-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/812-466-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1500-460-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-588-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2628-607-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/1948-608-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2748-428-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2972-619-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2164-406-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/904-379-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2960-347-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015eb5-234.dat upx behavioral1/files/0x0006000000015e85-226.dat upx behavioral1/memory/664-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/664-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1128-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cf2-202.dat upx behavioral1/memory/2316-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1740-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1740-191-0x0000000000250000-0x0000000000277000-memory.dmp upx behavioral1/files/0x0006000000015cb2-178.dat upx behavioral1/files/0x0006000000015ca2-170.dat upx behavioral1/memory/1344-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c79-140.dat upx behavioral1/memory/2736-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c68-132.dat upx behavioral1/files/0x0006000000015c60-124.dat upx behavioral1/files/0x0006000000015c58-116.dat upx behavioral1/memory/2776-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1652-114-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2088 1704 2a6e3ccd72b72a65c167e090f62e1d1ff32a3ab774cf2cecbf68b50d23fb1983_NeikiAnalytics.exe 28 PID 1704 wrote to memory of 2088 1704 2a6e3ccd72b72a65c167e090f62e1d1ff32a3ab774cf2cecbf68b50d23fb1983_NeikiAnalytics.exe 28 PID 1704 wrote to memory of 2088 1704 2a6e3ccd72b72a65c167e090f62e1d1ff32a3ab774cf2cecbf68b50d23fb1983_NeikiAnalytics.exe 28 PID 1704 wrote to memory of 2088 1704 2a6e3ccd72b72a65c167e090f62e1d1ff32a3ab774cf2cecbf68b50d23fb1983_NeikiAnalytics.exe 28 PID 2088 wrote to memory of 2332 2088 hjpxl.exe 29 PID 2088 wrote to memory of 2332 2088 hjpxl.exe 29 PID 2088 wrote to memory of 2332 2088 hjpxl.exe 29 PID 2088 wrote to memory of 2332 2088 hjpxl.exe 29 PID 2332 wrote to memory of 2560 2332 vddllx.exe 30 PID 2332 wrote to memory of 2560 2332 vddllx.exe 30 PID 2332 wrote to memory of 2560 2332 vddllx.exe 30 PID 2332 wrote to memory of 2560 2332 vddllx.exe 30 PID 2560 wrote to memory of 2660 2560 dvjltl.exe 31 PID 2560 wrote to memory of 2660 2560 dvjltl.exe 31 PID 2560 wrote to memory of 2660 2560 dvjltl.exe 31 PID 2560 wrote to memory of 2660 2560 dvjltl.exe 31 PID 2660 wrote to memory of 2668 2660 ndhjrnn.exe 32 PID 2660 wrote to memory of 2668 2660 ndhjrnn.exe 32 PID 2660 wrote to memory of 2668 2660 ndhjrnn.exe 32 PID 2660 wrote to memory of 2668 2660 ndhjrnn.exe 32 PID 2668 wrote to memory of 2700 2668 nbpldl.exe 33 PID 2668 wrote to memory of 2700 2668 nbpldl.exe 33 PID 2668 wrote to memory of 2700 2668 nbpldl.exe 33 PID 2668 wrote to memory of 2700 2668 nbpldl.exe 33 PID 2700 wrote to memory of 2444 2700 pxfvh.exe 34 PID 2700 wrote to memory of 2444 2700 pxfvh.exe 34 PID 2700 wrote to memory of 2444 2700 pxfvh.exe 34 PID 2700 wrote to memory of 2444 2700 pxfvh.exe 34 PID 2444 wrote to memory of 2532 2444 vfhfjp.exe 35 PID 2444 wrote to memory of 2532 2444 vfhfjp.exe 35 PID 2444 wrote to memory of 2532 2444 vfhfjp.exe 35 PID 2444 wrote to memory of 2532 2444 vfhfjp.exe 35 PID 2532 wrote to memory of 2476 2532 pffhrt.exe 36 PID 2532 wrote to memory of 2476 2532 pffhrt.exe 36 PID 2532 wrote to memory of 2476 2532 pffhrt.exe 36 PID 2532 wrote to memory of 2476 2532 pffhrt.exe 36 PID 2476 wrote to memory of 2968 2476 pjhnx.exe 37 PID 2476 wrote to memory of 2968 2476 pjhnx.exe 37 PID 2476 wrote to memory of 2968 2476 pjhnx.exe 37 PID 2476 wrote to memory of 2968 2476 pjhnx.exe 37 PID 2968 wrote to memory of 648 2968 dvdbdtr.exe 38 PID 2968 wrote to memory of 648 2968 dvdbdtr.exe 38 PID 2968 wrote to memory of 648 2968 dvdbdtr.exe 38 PID 2968 wrote to memory of 648 2968 dvdbdtr.exe 38 PID 648 wrote to memory of 2372 648 jftfxn.exe 39 PID 648 wrote to memory of 2372 648 jftfxn.exe 39 PID 648 wrote to memory of 2372 648 jftfxn.exe 39 PID 648 wrote to memory of 2372 648 jftfxn.exe 39 PID 2372 wrote to memory of 1652 2372 phvbnr.exe 40 PID 2372 wrote to memory of 1652 2372 phvbnr.exe 40 PID 2372 wrote to memory of 1652 2372 phvbnr.exe 40 PID 2372 wrote to memory of 1652 2372 phvbnr.exe 40 PID 1652 wrote to memory of 2776 1652 jdvvbl.exe 41 PID 1652 wrote to memory of 2776 1652 jdvvbl.exe 41 PID 1652 wrote to memory of 2776 1652 jdvvbl.exe 41 PID 1652 wrote to memory of 2776 1652 jdvvbl.exe 41 PID 2776 wrote to memory of 2828 2776 tprhh.exe 42 PID 2776 wrote to memory of 2828 2776 tprhh.exe 42 PID 2776 wrote to memory of 2828 2776 tprhh.exe 42 PID 2776 wrote to memory of 2828 2776 tprhh.exe 42 PID 2828 wrote to memory of 2736 2828 vvpnvrb.exe 134 PID 2828 wrote to memory of 2736 2828 vvpnvrb.exe 134 PID 2828 wrote to memory of 2736 2828 vvpnvrb.exe 134 PID 2828 wrote to memory of 2736 2828 vvpnvrb.exe 134
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a6e3ccd72b72a65c167e090f62e1d1ff32a3ab774cf2cecbf68b50d23fb1983_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2a6e3ccd72b72a65c167e090f62e1d1ff32a3ab774cf2cecbf68b50d23fb1983_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\hjpxl.exec:\hjpxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\vddllx.exec:\vddllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\dvjltl.exec:\dvjltl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\ndhjrnn.exec:\ndhjrnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\nbpldl.exec:\nbpldl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\pxfvh.exec:\pxfvh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\vfhfjp.exec:\vfhfjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\pffhrt.exec:\pffhrt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\pjhnx.exec:\pjhnx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\dvdbdtr.exec:\dvdbdtr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\jftfxn.exec:\jftfxn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\phvbnr.exec:\phvbnr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\jdvvbl.exec:\jdvvbl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\tprhh.exec:\tprhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\vvpnvrb.exec:\vvpnvrb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\xpfpr.exec:\xpfpr.exe17⤵
- Executes dropped EXE
PID:2736 -
\??\c:\njtdphl.exec:\njtdphl.exe18⤵
- Executes dropped EXE
PID:1676 -
\??\c:\lbptl.exec:\lbptl.exe19⤵
- Executes dropped EXE
PID:1344 -
\??\c:\thfxlr.exec:\thfxlr.exe20⤵
- Executes dropped EXE
PID:920 -
\??\c:\pxxdhfj.exec:\pxxdhfj.exe21⤵
- Executes dropped EXE
PID:2764 -
\??\c:\hrpbr.exec:\hrpbr.exe22⤵
- Executes dropped EXE
PID:2720 -
\??\c:\djlljt.exec:\djlljt.exe23⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ljfpp.exec:\ljfpp.exe24⤵
- Executes dropped EXE
PID:1740 -
\??\c:\rrpvd.exec:\rrpvd.exe25⤵
- Executes dropped EXE
PID:2316 -
\??\c:\drjldv.exec:\drjldv.exe26⤵
- Executes dropped EXE
PID:1128 -
\??\c:\drrxjn.exec:\drrxjn.exe27⤵
- Executes dropped EXE
PID:664 -
\??\c:\vpdxtbt.exec:\vpdxtbt.exe28⤵
- Executes dropped EXE
PID:1668 -
\??\c:\ttjxbf.exec:\ttjxbf.exe29⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ltddxh.exec:\ltddxh.exe30⤵
- Executes dropped EXE
PID:1812 -
\??\c:\bxjxpjr.exec:\bxjxpjr.exe31⤵
- Executes dropped EXE
PID:584 -
\??\c:\pvbpxv.exec:\pvbpxv.exe32⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jxxhtx.exec:\jxxhtx.exe33⤵
- Executes dropped EXE
PID:2112 -
\??\c:\pttprht.exec:\pttprht.exe34⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rfvprt.exec:\rfvprt.exe35⤵
- Executes dropped EXE
PID:2388 -
\??\c:\ftdxx.exec:\ftdxx.exe36⤵
- Executes dropped EXE
PID:868 -
\??\c:\lrtpl.exec:\lrtpl.exe37⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vvlhf.exec:\vvlhf.exe38⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rxjltl.exec:\rxjltl.exe39⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rndnpfb.exec:\rndnpfb.exe40⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jhvpfx.exec:\jhvpfx.exe41⤵
- Executes dropped EXE
PID:2512 -
\??\c:\xtdtl.exec:\xtdtl.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bdbrv.exec:\bdbrv.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\dnrtp.exec:\dnrtp.exe44⤵
- Executes dropped EXE
PID:2552 -
\??\c:\vfblxp.exec:\vfblxp.exe45⤵
- Executes dropped EXE
PID:2668 -
\??\c:\bfvjlf.exec:\bfvjlf.exe46⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xxrprpr.exec:\xxrprpr.exe47⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jjbjt.exec:\jjbjt.exe48⤵
- Executes dropped EXE
PID:2432 -
\??\c:\nvpvhbh.exec:\nvpvhbh.exe49⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lhntnf.exec:\lhntnf.exe50⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pdxjp.exec:\pdxjp.exe51⤵
- Executes dropped EXE
PID:2860 -
\??\c:\xdlljx.exec:\xdlljx.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\prvdbvn.exec:\prvdbvn.exe53⤵
- Executes dropped EXE
PID:748 -
\??\c:\jxltfr.exec:\jxltfr.exe54⤵
- Executes dropped EXE
PID:1120 -
\??\c:\hvvvbl.exec:\hvvvbl.exe55⤵
- Executes dropped EXE
PID:904 -
\??\c:\jtdrlr.exec:\jtdrlr.exe56⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lbhxxjr.exec:\lbhxxjr.exe57⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vxtlfj.exec:\vxtlfj.exe58⤵
- Executes dropped EXE
PID:1056 -
\??\c:\hvbbvvl.exec:\hvbbvvl.exe59⤵
- Executes dropped EXE
PID:2780 -
\??\c:\tdfdvv.exec:\tdfdvv.exe60⤵
- Executes dropped EXE
PID:1184 -
\??\c:\lrhfjj.exec:\lrhfjj.exe61⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nttjrl.exec:\nttjrl.exe62⤵
- Executes dropped EXE
PID:924 -
\??\c:\lprjjnj.exec:\lprjjnj.exe63⤵
- Executes dropped EXE
PID:2520 -
\??\c:\frvdnj.exec:\frvdnj.exe64⤵
- Executes dropped EXE
PID:2748 -
\??\c:\bhjfl.exec:\bhjfl.exe65⤵
- Executes dropped EXE
PID:1616 -
\??\c:\bfhnrrp.exec:\bfhnrrp.exe66⤵PID:1612
-
\??\c:\pdbhpx.exec:\pdbhpx.exe67⤵PID:2744
-
\??\c:\jnjhj.exec:\jnjhj.exe68⤵PID:2180
-
\??\c:\ldtbh.exec:\ldtbh.exe69⤵PID:2236
-
\??\c:\fdtfb.exec:\fdtfb.exe70⤵PID:2644
-
\??\c:\ttvnh.exec:\ttvnh.exe71⤵PID:1500
-
\??\c:\rbnpv.exec:\rbnpv.exe72⤵PID:812
-
\??\c:\nxpdd.exec:\nxpdd.exe73⤵PID:1276
-
\??\c:\dnxbhrn.exec:\dnxbhrn.exe74⤵PID:980
-
\??\c:\bnnfjj.exec:\bnnfjj.exe75⤵PID:1920
-
\??\c:\xrhdx.exec:\xrhdx.exe76⤵PID:1772
-
\??\c:\fllhf.exec:\fllhf.exe77⤵PID:948
-
\??\c:\ltfpld.exec:\ltfpld.exe78⤵PID:1080
-
\??\c:\bfnxt.exec:\bfnxt.exe79⤵PID:808
-
\??\c:\rptltf.exec:\rptltf.exe80⤵PID:1960
-
\??\c:\xbrpnx.exec:\xbrpnx.exe81⤵PID:1152
-
\??\c:\ntjxh.exec:\ntjxh.exe82⤵PID:2200
-
\??\c:\hdphpn.exec:\hdphpn.exe83⤵PID:1364
-
\??\c:\ttrnv.exec:\ttrnv.exe84⤵PID:1972
-
\??\c:\prlxbl.exec:\prlxbl.exe85⤵PID:1312
-
\??\c:\jlnjdhj.exec:\jlnjdhj.exe86⤵PID:2500
-
\??\c:\vlrllrp.exec:\vlrllrp.exe87⤵PID:1704
-
\??\c:\lrxxp.exec:\lrxxp.exe88⤵PID:1548
-
\??\c:\xdplrx.exec:\xdplrx.exe89⤵PID:2640
-
\??\c:\nlfrjpl.exec:\nlfrjpl.exe90⤵PID:876
-
\??\c:\fbfxfr.exec:\fbfxfr.exe91⤵PID:2664
-
\??\c:\jfdfbt.exec:\jfdfbt.exe92⤵PID:2620
-
\??\c:\jvrfj.exec:\jvrfj.exe93⤵PID:2544
-
\??\c:\pjdpn.exec:\pjdpn.exe94⤵PID:2196
-
\??\c:\xlfxvbx.exec:\xlfxvbx.exe95⤵PID:2732
-
\??\c:\hldrp.exec:\hldrp.exe96⤵PID:2452
-
\??\c:\rxdrrfp.exec:\rxdrrfp.exe97⤵PID:2628
-
\??\c:\nnljp.exec:\nnljp.exe98⤵PID:1948
-
\??\c:\xdxphn.exec:\xdxphn.exe99⤵PID:756
-
\??\c:\dbfhj.exec:\dbfhj.exe100⤵PID:2972
-
\??\c:\jtjxp.exec:\jtjxp.exe101⤵PID:848
-
\??\c:\tvvtlnd.exec:\tvvtlnd.exe102⤵PID:1636
-
\??\c:\npnrdh.exec:\npnrdh.exe103⤵PID:2508
-
\??\c:\vxrphr.exec:\vxrphr.exe104⤵PID:2784
-
\??\c:\dlvldr.exec:\dlvldr.exe105⤵PID:2812
-
\??\c:\jbttjr.exec:\jbttjr.exe106⤵PID:784
-
\??\c:\pdldd.exec:\pdldd.exe107⤵PID:1144
-
\??\c:\fdjhh.exec:\fdjhh.exe108⤵PID:2736
-
\??\c:\pvjbntx.exec:\pvjbntx.exe109⤵PID:1720
-
\??\c:\fntrvjj.exec:\fntrvjj.exe110⤵PID:2792
-
\??\c:\dndfrpr.exec:\dndfrpr.exe111⤵PID:920
-
\??\c:\xjdjld.exec:\xjdjld.exe112⤵PID:2764
-
\??\c:\dpltfv.exec:\dpltfv.exe113⤵PID:1532
-
\??\c:\lnjjj.exec:\lnjjj.exe114⤵PID:2672
-
\??\c:\nvbjj.exec:\nvbjj.exe115⤵PID:2232
-
\??\c:\rdhdj.exec:\rdhdj.exe116⤵PID:1220
-
\??\c:\flvtl.exec:\flvtl.exe117⤵PID:2368
-
\??\c:\hpxpbhp.exec:\hpxpbhp.exe118⤵PID:2516
-
\??\c:\pbtdpxp.exec:\pbtdpxp.exe119⤵PID:1912
-
\??\c:\fllnfd.exec:\fllnfd.exe120⤵PID:664
-
\??\c:\dtlfjvj.exec:\dtlfjvj.exe121⤵PID:1488
-
\??\c:\xffbh.exec:\xffbh.exe122⤵PID:1600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-