Analysis
-
max time kernel
123s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
13268a522e90b7c18b456f6e581501d0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
13268a522e90b7c18b456f6e581501d0_NeikiAnalytics.exe
-
Size
306KB
-
MD5
13268a522e90b7c18b456f6e581501d0
-
SHA1
98778a9155e915f5dac8dd51046f59d9519d08c2
-
SHA256
635432c5c18e9d664f893d93a0f3b16b567bd5124d55be19e0e163d06a4c80d4
-
SHA512
e4ca8ede98fd1ea8ad0481591dd92ad9fb854a8f1a85463c662343331fd86555c2dd9b74fc38d94964c6d9c739ddae650ebb4ba6277435896668fa1c06b38fd2
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAQ5lpBoG74Abtud+3SomfOTr00A:Pcm7ImGddXtWrXF5lpKGsAbA+3pB09
Malware Config
Signatures
-
Detect Blackmoon payload 49 IoCs
Processes:
resource yara_rule behavioral1/memory/2320-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-55-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2612-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-94-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/576-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/940-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1096-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1144-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-247-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1856-245-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2928-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-312-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2244-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-333-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-347-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-366-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-374-0x00000000003B0000-0x00000000003D9000-memory.dmp family_blackmoon behavioral1/memory/2432-397-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/944-441-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1076-448-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-468-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-482-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-495-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3052-530-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1620-636-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2636-678-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2648-729-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2696-744-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-775-0x00000000002B0000-0x00000000002D9000-memory.dmp family_blackmoon behavioral1/memory/2672-817-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2672-822-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2080-829-0x00000000002B0000-0x00000000002D9000-memory.dmp family_blackmoon behavioral1/memory/788-842-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2948-907-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rjnfdpv.exejbvnp.exedtplhl.exehflvb.exexxhvb.exefrrvxp.exelxhlt.exetbljbhb.exexpndx.exeptlrf.exentnhh.exejlphtl.exedvbfv.exefnrlxft.exepdvldf.exedxjdplb.exervrbn.exedjlfrl.exetddbhhb.exepxdhhb.exehtffflb.exexbnfn.exefrpvfth.exenvxhdlv.exebhbbtn.exetfftxl.exejvhjfbn.exephjrt.exexnlxp.exendxtrlh.exerdxpb.exehldfxnb.exelxdtt.exexhxbvpf.exehnjdn.exetptbjjl.exefhtbfrb.exeldxtxj.exevdpntl.exedrxjvr.exefdvvrdj.exexhppl.exedtfbdnh.exedvptlp.exettllvjf.exepnrvhh.exexvhnfn.exennrljb.exendhnrp.exelfxvj.exexfjrphn.exebdhfr.exejldhrvb.exefdtthx.exedvbxr.exeltlhj.exejhxfbb.exejvvfbh.exehlddx.exehnrbnhf.exerdrdvj.exehxntrjh.exehhpplhn.exelbtdxd.exepid process 2808 rjnfdpv.exe 2448 jbvnp.exe 2504 dtplhl.exe 2512 hflvb.exe 2612 xxhvb.exe 3028 frrvxp.exe 2352 lxhlt.exe 1760 tbljbhb.exe 2804 xpndx.exe 576 ptlrf.exe 940 ntnhh.exe 2576 jlphtl.exe 2680 dvbfv.exe 2396 fnrlxft.exe 1796 pdvldf.exe 2312 dxjdplb.exe 2228 rvrbn.exe 936 djlfrl.exe 2972 tddbhhb.exe 1556 pxdhhb.exe 1096 htffflb.exe 2160 xbnfn.exe 1696 frpvfth.exe 1144 nvxhdlv.exe 2980 bhbbtn.exe 1856 tfftxl.exe 1564 jvhjfbn.exe 1852 phjrt.exe 1844 xnlxp.exe 568 ndxtrlh.exe 1744 rdxpb.exe 2928 hldfxnb.exe 1732 lxdtt.exe 1528 xhxbvpf.exe 2244 hnjdn.exe 2556 tptbjjl.exe 2808 fhtbfrb.exe 1092 ldxtxj.exe 2588 vdpntl.exe 2584 drxjvr.exe 2264 fdvvrdj.exe 2636 xhppl.exe 2676 dtfbdnh.exe 2004 dvptlp.exe 2400 ttllvjf.exe 2432 pnrvhh.exe 1032 xvhnfn.exe 1124 nnrljb.exe 2336 ndhnrp.exe 1980 lfxvj.exe 2656 xfjrphn.exe 2664 bdhfr.exe 944 jldhrvb.exe 1076 fdtthx.exe 2396 dvbxr.exe 1308 ltlhj.exe 1960 jhxfbb.exe 1768 jvvfbh.exe 1728 hlddx.exe 1644 hnrbnhf.exe 1608 rdrdvj.exe 1288 hxntrjh.exe 528 hhpplhn.exe 712 lbtdxd.exe -
Processes:
resource yara_rule behavioral1/memory/2320-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-53-0x00000000001B0000-0x00000000001D9000-memory.dmp upx behavioral1/memory/3028-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/576-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/940-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/940-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1096-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1144-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-313-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-366-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-383-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-397-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-422-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/944-441-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-448-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1308-455-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-468-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-482-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/528-502-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/908-565-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1328-572-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-637-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-662-0x00000000002A0000-0x00000000002C9000-memory.dmp upx behavioral1/memory/1512-704-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-731-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-744-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1680-778-0x0000000000230000-0x0000000000259000-memory.dmp upx behavioral1/memory/2672-817-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2080-829-0x00000000002B0000-0x00000000002D9000-memory.dmp upx behavioral1/memory/1072-855-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-862-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-888-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
13268a522e90b7c18b456f6e581501d0_NeikiAnalytics.exerjnfdpv.exejbvnp.exedtplhl.exehflvb.exexxhvb.exefrrvxp.exelxhlt.exetbljbhb.exexpndx.exeptlrf.exentnhh.exejlphtl.exedvbfv.exefnrlxft.exepdvldf.exedescription pid process target process PID 2320 wrote to memory of 2808 2320 13268a522e90b7c18b456f6e581501d0_NeikiAnalytics.exe rjnfdpv.exe PID 2320 wrote to memory of 2808 2320 13268a522e90b7c18b456f6e581501d0_NeikiAnalytics.exe rjnfdpv.exe PID 2320 wrote to memory of 2808 2320 13268a522e90b7c18b456f6e581501d0_NeikiAnalytics.exe rjnfdpv.exe PID 2320 wrote to memory of 2808 2320 13268a522e90b7c18b456f6e581501d0_NeikiAnalytics.exe rjnfdpv.exe PID 2808 wrote to memory of 2448 2808 rjnfdpv.exe jbvnp.exe PID 2808 wrote to memory of 2448 2808 rjnfdpv.exe jbvnp.exe PID 2808 wrote to memory of 2448 2808 rjnfdpv.exe jbvnp.exe PID 2808 wrote to memory of 2448 2808 rjnfdpv.exe jbvnp.exe PID 2448 wrote to memory of 2504 2448 jbvnp.exe dtplhl.exe PID 2448 wrote to memory of 2504 2448 jbvnp.exe dtplhl.exe PID 2448 wrote to memory of 2504 2448 jbvnp.exe dtplhl.exe PID 2448 wrote to memory of 2504 2448 jbvnp.exe dtplhl.exe PID 2504 wrote to memory of 2512 2504 dtplhl.exe hflvb.exe PID 2504 wrote to memory of 2512 2504 dtplhl.exe hflvb.exe PID 2504 wrote to memory of 2512 2504 dtplhl.exe hflvb.exe PID 2504 wrote to memory of 2512 2504 dtplhl.exe hflvb.exe PID 2512 wrote to memory of 2612 2512 hflvb.exe xxhvb.exe PID 2512 wrote to memory of 2612 2512 hflvb.exe xxhvb.exe PID 2512 wrote to memory of 2612 2512 hflvb.exe xxhvb.exe PID 2512 wrote to memory of 2612 2512 hflvb.exe xxhvb.exe PID 2612 wrote to memory of 3028 2612 xxhvb.exe frrvxp.exe PID 2612 wrote to memory of 3028 2612 xxhvb.exe frrvxp.exe PID 2612 wrote to memory of 3028 2612 xxhvb.exe frrvxp.exe PID 2612 wrote to memory of 3028 2612 xxhvb.exe frrvxp.exe PID 3028 wrote to memory of 2352 3028 frrvxp.exe lxhlt.exe PID 3028 wrote to memory of 2352 3028 frrvxp.exe lxhlt.exe PID 3028 wrote to memory of 2352 3028 frrvxp.exe lxhlt.exe PID 3028 wrote to memory of 2352 3028 frrvxp.exe lxhlt.exe PID 2352 wrote to memory of 1760 2352 lxhlt.exe tbljbhb.exe PID 2352 wrote to memory of 1760 2352 lxhlt.exe tbljbhb.exe PID 2352 wrote to memory of 1760 2352 lxhlt.exe tbljbhb.exe PID 2352 wrote to memory of 1760 2352 lxhlt.exe tbljbhb.exe PID 1760 wrote to memory of 2804 1760 tbljbhb.exe xpndx.exe PID 1760 wrote to memory of 2804 1760 tbljbhb.exe xpndx.exe PID 1760 wrote to memory of 2804 1760 tbljbhb.exe xpndx.exe PID 1760 wrote to memory of 2804 1760 tbljbhb.exe xpndx.exe PID 2804 wrote to memory of 576 2804 xpndx.exe ptlrf.exe PID 2804 wrote to memory of 576 2804 xpndx.exe ptlrf.exe PID 2804 wrote to memory of 576 2804 xpndx.exe ptlrf.exe PID 2804 wrote to memory of 576 2804 xpndx.exe ptlrf.exe PID 576 wrote to memory of 940 576 ptlrf.exe ntnhh.exe PID 576 wrote to memory of 940 576 ptlrf.exe ntnhh.exe PID 576 wrote to memory of 940 576 ptlrf.exe ntnhh.exe PID 576 wrote to memory of 940 576 ptlrf.exe ntnhh.exe PID 940 wrote to memory of 2576 940 ntnhh.exe jlphtl.exe PID 940 wrote to memory of 2576 940 ntnhh.exe jlphtl.exe PID 940 wrote to memory of 2576 940 ntnhh.exe jlphtl.exe PID 940 wrote to memory of 2576 940 ntnhh.exe jlphtl.exe PID 2576 wrote to memory of 2680 2576 jlphtl.exe dvbfv.exe PID 2576 wrote to memory of 2680 2576 jlphtl.exe dvbfv.exe PID 2576 wrote to memory of 2680 2576 jlphtl.exe dvbfv.exe PID 2576 wrote to memory of 2680 2576 jlphtl.exe dvbfv.exe PID 2680 wrote to memory of 2396 2680 dvbfv.exe fnrlxft.exe PID 2680 wrote to memory of 2396 2680 dvbfv.exe fnrlxft.exe PID 2680 wrote to memory of 2396 2680 dvbfv.exe fnrlxft.exe PID 2680 wrote to memory of 2396 2680 dvbfv.exe fnrlxft.exe PID 2396 wrote to memory of 1796 2396 fnrlxft.exe pdvldf.exe PID 2396 wrote to memory of 1796 2396 fnrlxft.exe pdvldf.exe PID 2396 wrote to memory of 1796 2396 fnrlxft.exe pdvldf.exe PID 2396 wrote to memory of 1796 2396 fnrlxft.exe pdvldf.exe PID 1796 wrote to memory of 2312 1796 pdvldf.exe dxjdplb.exe PID 1796 wrote to memory of 2312 1796 pdvldf.exe dxjdplb.exe PID 1796 wrote to memory of 2312 1796 pdvldf.exe dxjdplb.exe PID 1796 wrote to memory of 2312 1796 pdvldf.exe dxjdplb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\13268a522e90b7c18b456f6e581501d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\13268a522e90b7c18b456f6e581501d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\rjnfdpv.exec:\rjnfdpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\jbvnp.exec:\jbvnp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\dtplhl.exec:\dtplhl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\hflvb.exec:\hflvb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\xxhvb.exec:\xxhvb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\frrvxp.exec:\frrvxp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\lxhlt.exec:\lxhlt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\tbljbhb.exec:\tbljbhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\xpndx.exec:\xpndx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\ptlrf.exec:\ptlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\ntnhh.exec:\ntnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\jlphtl.exec:\jlphtl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\dvbfv.exec:\dvbfv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\fnrlxft.exec:\fnrlxft.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\pdvldf.exec:\pdvldf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\dxjdplb.exec:\dxjdplb.exe17⤵
- Executes dropped EXE
PID:2312 -
\??\c:\rvrbn.exec:\rvrbn.exe18⤵
- Executes dropped EXE
PID:2228 -
\??\c:\djlfrl.exec:\djlfrl.exe19⤵
- Executes dropped EXE
PID:936 -
\??\c:\tddbhhb.exec:\tddbhhb.exe20⤵
- Executes dropped EXE
PID:2972 -
\??\c:\pxdhhb.exec:\pxdhhb.exe21⤵
- Executes dropped EXE
PID:1556 -
\??\c:\htffflb.exec:\htffflb.exe22⤵
- Executes dropped EXE
PID:1096 -
\??\c:\xbnfn.exec:\xbnfn.exe23⤵
- Executes dropped EXE
PID:2160 -
\??\c:\frpvfth.exec:\frpvfth.exe24⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nvxhdlv.exec:\nvxhdlv.exe25⤵
- Executes dropped EXE
PID:1144 -
\??\c:\bhbbtn.exec:\bhbbtn.exe26⤵
- Executes dropped EXE
PID:2980 -
\??\c:\tfftxl.exec:\tfftxl.exe27⤵
- Executes dropped EXE
PID:1856 -
\??\c:\jvhjfbn.exec:\jvhjfbn.exe28⤵
- Executes dropped EXE
PID:1564 -
\??\c:\phjrt.exec:\phjrt.exe29⤵
- Executes dropped EXE
PID:1852 -
\??\c:\xnlxp.exec:\xnlxp.exe30⤵
- Executes dropped EXE
PID:1844 -
\??\c:\ndxtrlh.exec:\ndxtrlh.exe31⤵
- Executes dropped EXE
PID:568 -
\??\c:\rdxpb.exec:\rdxpb.exe32⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hldfxnb.exec:\hldfxnb.exe33⤵
- Executes dropped EXE
PID:2928 -
\??\c:\lxdtt.exec:\lxdtt.exe34⤵
- Executes dropped EXE
PID:1732 -
\??\c:\xhxbvpf.exec:\xhxbvpf.exe35⤵
- Executes dropped EXE
PID:1528 -
\??\c:\hnjdn.exec:\hnjdn.exe36⤵
- Executes dropped EXE
PID:2244 -
\??\c:\tptbjjl.exec:\tptbjjl.exe37⤵
- Executes dropped EXE
PID:2556 -
\??\c:\fhtbfrb.exec:\fhtbfrb.exe38⤵
- Executes dropped EXE
PID:2808 -
\??\c:\ldxtxj.exec:\ldxtxj.exe39⤵
- Executes dropped EXE
PID:1092 -
\??\c:\vdpntl.exec:\vdpntl.exe40⤵
- Executes dropped EXE
PID:2588 -
\??\c:\drxjvr.exec:\drxjvr.exe41⤵
- Executes dropped EXE
PID:2584 -
\??\c:\fdvvrdj.exec:\fdvvrdj.exe42⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xhppl.exec:\xhppl.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\dtfbdnh.exec:\dtfbdnh.exe44⤵
- Executes dropped EXE
PID:2676 -
\??\c:\dvptlp.exec:\dvptlp.exe45⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ttllvjf.exec:\ttllvjf.exe46⤵
- Executes dropped EXE
PID:2400 -
\??\c:\pnrvhh.exec:\pnrvhh.exe47⤵
- Executes dropped EXE
PID:2432 -
\??\c:\xvhnfn.exec:\xvhnfn.exe48⤵
- Executes dropped EXE
PID:1032 -
\??\c:\nnrljb.exec:\nnrljb.exe49⤵
- Executes dropped EXE
PID:1124 -
\??\c:\ndhnrp.exec:\ndhnrp.exe50⤵
- Executes dropped EXE
PID:2336 -
\??\c:\lfxvj.exec:\lfxvj.exe51⤵
- Executes dropped EXE
PID:1980 -
\??\c:\xfjrphn.exec:\xfjrphn.exe52⤵
- Executes dropped EXE
PID:2656 -
\??\c:\bdhfr.exec:\bdhfr.exe53⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jldhrvb.exec:\jldhrvb.exe54⤵
- Executes dropped EXE
PID:944 -
\??\c:\fdtthx.exec:\fdtthx.exe55⤵
- Executes dropped EXE
PID:1076 -
\??\c:\dvbxr.exec:\dvbxr.exe56⤵
- Executes dropped EXE
PID:2396 -
\??\c:\ltlhj.exec:\ltlhj.exe57⤵
- Executes dropped EXE
PID:1308 -
\??\c:\jhxfbb.exec:\jhxfbb.exe58⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jvvfbh.exec:\jvvfbh.exe59⤵
- Executes dropped EXE
PID:1768 -
\??\c:\hlddx.exec:\hlddx.exe60⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hnrbnhf.exec:\hnrbnhf.exe61⤵
- Executes dropped EXE
PID:1644 -
\??\c:\rdrdvj.exec:\rdrdvj.exe62⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hxntrjh.exec:\hxntrjh.exe63⤵
- Executes dropped EXE
PID:1288 -
\??\c:\hhpplhn.exec:\hhpplhn.exe64⤵
- Executes dropped EXE
PID:528 -
\??\c:\lbtdxd.exec:\lbtdxd.exe65⤵
- Executes dropped EXE
PID:712 -
\??\c:\lptdjnh.exec:\lptdjnh.exe66⤵PID:600
-
\??\c:\vbptfjt.exec:\vbptfjt.exe67⤵PID:1696
-
\??\c:\vhndbf.exec:\vhndbf.exe68⤵PID:3052
-
\??\c:\tlhtxv.exec:\tlhtxv.exe69⤵PID:3064
-
\??\c:\jdtpdt.exec:\jdtpdt.exe70⤵PID:1884
-
\??\c:\trjbrrx.exec:\trjbrrx.exe71⤵PID:1404
-
\??\c:\nfhhn.exec:\nfhhn.exe72⤵PID:1568
-
\??\c:\dphtrb.exec:\dphtrb.exe73⤵PID:2140
-
\??\c:\rnddnv.exec:\rnddnv.exe74⤵PID:908
-
\??\c:\jnljb.exec:\jnljb.exe75⤵PID:1328
-
\??\c:\rrjrb.exec:\rrjrb.exe76⤵PID:568
-
\??\c:\vjtvdrd.exec:\vjtvdrd.exe77⤵PID:2892
-
\??\c:\tfxntpl.exec:\tfxntpl.exe78⤵PID:2948
-
\??\c:\tljlnxt.exec:\tljlnxt.exe79⤵PID:2240
-
\??\c:\hdhvbl.exec:\hdhvbl.exe80⤵PID:2840
-
\??\c:\tbbnn.exec:\tbbnn.exe81⤵PID:1732
-
\??\c:\dxvhvbj.exec:\dxvhvbj.exe82⤵PID:1528
-
\??\c:\dpxjdp.exec:\dpxjdp.exe83⤵PID:1600
-
\??\c:\vhfppb.exec:\vhfppb.exe84⤵PID:1620
-
\??\c:\hrpdj.exec:\hrpdj.exe85⤵PID:2936
-
\??\c:\jtndpv.exec:\jtndpv.exe86⤵PID:2728
-
\??\c:\jtrbx.exec:\jtrbx.exe87⤵PID:2588
-
\??\c:\tjnjdxn.exec:\tjnjdxn.exe88⤵PID:2560
-
\??\c:\tjbvf.exec:\tjbvf.exe89⤵PID:2652
-
\??\c:\nnxhpdd.exec:\nnxhpdd.exe90⤵PID:2636
-
\??\c:\blbxtbd.exec:\blbxtbd.exe91⤵PID:2612
-
\??\c:\pjdppx.exec:\pjdppx.exe92⤵PID:2004
-
\??\c:\rbdbrnv.exec:\rbdbrnv.exe93⤵PID:2792
-
\??\c:\vfbln.exec:\vfbln.exe94⤵PID:2788
-
\??\c:\jxplrn.exec:\jxplrn.exe95⤵PID:1512
-
\??\c:\pfnhhrp.exec:\pfnhhrp.exe96⤵PID:1500
-
\??\c:\lhxpvb.exec:\lhxpvb.exe97⤵PID:1996
-
\??\c:\lxtvnh.exec:\lxtvnh.exe98⤵PID:2648
-
\??\c:\vvpnn.exec:\vvpnn.exe99⤵PID:2456
-
\??\c:\jbhrvb.exec:\jbhrvb.exe100⤵PID:2696
-
\??\c:\tvdnd.exec:\tvdnd.exe101⤵PID:2168
-
\??\c:\ndjdh.exec:\ndjdh.exe102⤵PID:3032
-
\??\c:\ntldbjh.exec:\ntldbjh.exe103⤵PID:1812
-
\??\c:\ljrnd.exec:\ljrnd.exe104⤵PID:2236
-
\??\c:\bldpjff.exec:\bldpjff.exe105⤵PID:1772
-
\??\c:\pjddbvl.exec:\pjddbvl.exe106⤵PID:1680
-
\??\c:\rnxvxh.exec:\rnxvxh.exe107⤵PID:1660
-
\??\c:\xlnpd.exec:\xlnpd.exe108⤵PID:3044
-
\??\c:\bhrrv.exec:\bhrrv.exe109⤵PID:1988
-
\??\c:\ldvjl.exec:\ldvjl.exe110⤵PID:1288
-
\??\c:\jbxnrv.exec:\jbxnrv.exe111⤵PID:788
-
\??\c:\tprlpl.exec:\tprlpl.exe112⤵PID:2672
-
\??\c:\dvjnnlp.exec:\dvjnnlp.exe113⤵PID:2080
-
\??\c:\jdtjbrp.exec:\jdtjbrp.exe114⤵PID:400
-
\??\c:\rdnjj.exec:\rdnjj.exe115⤵PID:2024
-
\??\c:\tnlhlrd.exec:\tnlhlrd.exe116⤵PID:780
-
\??\c:\nfbdhtl.exec:\nfbdhtl.exe117⤵PID:2572
-
\??\c:\jlbpn.exec:\jlbpn.exe118⤵PID:1072
-
\??\c:\xldxdlp.exec:\xldxdlp.exe119⤵PID:1956
-
\??\c:\rvfpv.exec:\rvfpv.exe120⤵PID:968
-
\??\c:\nbfjdbd.exec:\nbfjdbd.exe121⤵PID:908
-
\??\c:\bfvhjlt.exec:\bfvhjlt.exe122⤵PID:1328
-
\??\c:\nvxhbxf.exec:\nvxhbxf.exe123⤵PID:2776
-
\??\c:\dffpl.exec:\dffpl.exe124⤵PID:2892
-
\??\c:\pjvnhrx.exec:\pjvnhrx.exe125⤵PID:2948
-
\??\c:\xrjljd.exec:\xrjljd.exe126⤵PID:1080
-
\??\c:\tjrrrf.exec:\tjrrrf.exe127⤵PID:1748
-
\??\c:\tpxphp.exec:\tpxphp.exe128⤵PID:1936
-
\??\c:\lfpbv.exec:\lfpbv.exe129⤵PID:2944
-
\??\c:\hpvdn.exec:\hpvdn.exe130⤵PID:2884
-
\??\c:\dtrfd.exec:\dtrfd.exe131⤵PID:2496
-
\??\c:\hhrpv.exec:\hhrpv.exe132⤵PID:2624
-
\??\c:\dflpjl.exec:\dflpjl.exe133⤵PID:2728
-
\??\c:\rbblxlj.exec:\rbblxlj.exe134⤵PID:2660
-
\??\c:\tjfvpnp.exec:\tjfvpnp.exe135⤵PID:2564
-
\??\c:\lxpdnj.exec:\lxpdnj.exe136⤵PID:2372
-
\??\c:\vxpjpf.exec:\vxpjpf.exe137⤵PID:2388
-
\??\c:\nlxnv.exec:\nlxnv.exe138⤵PID:2352
-
\??\c:\thnnpb.exec:\thnnpb.exe139⤵PID:2368
-
\??\c:\xtjhhx.exec:\xtjhhx.exe140⤵PID:1496
-
\??\c:\plpxt.exec:\plpxt.exe141⤵PID:240
-
\??\c:\xnndnj.exec:\xnndnj.exe142⤵PID:1532
-
\??\c:\fnflbr.exec:\fnflbr.exe143⤵PID:2336
-
\??\c:\jjlprbt.exec:\jjlprbt.exe144⤵PID:2044
-
\??\c:\vpnvdt.exec:\vpnvdt.exe145⤵PID:2568
-
\??\c:\tbnnxp.exec:\tbnnxp.exe146⤵PID:2456
-
\??\c:\dnbnvxj.exec:\dnbnvxj.exe147⤵PID:2696
-
\??\c:\lddnpdt.exec:\lddnpdt.exe148⤵PID:2168
-
\??\c:\vdnrl.exec:\vdnrl.exe149⤵PID:2204
-
\??\c:\txdvpfl.exec:\txdvpfl.exe150⤵PID:1308
-
\??\c:\dltdbb.exec:\dltdbb.exe151⤵PID:2176
-
\??\c:\xbpdfn.exec:\xbpdfn.exe152⤵PID:1768
-
\??\c:\jbvjpd.exec:\jbvjpd.exe153⤵PID:1552
-
\??\c:\prfvb.exec:\prfvb.exe154⤵PID:2260
-
\??\c:\ndphtrv.exec:\ndphtrv.exe155⤵PID:856
-
\??\c:\nrdrhth.exec:\nrdrhth.exe156⤵PID:1988
-
\??\c:\pjrrdv.exec:\pjrrdv.exe157⤵PID:1288
-
\??\c:\pfllr.exec:\pfllr.exe158⤵PID:2976
-
\??\c:\jpdlxp.exec:\jpdlxp.exe159⤵PID:2988
-
\??\c:\ffnnnlx.exec:\ffnnnlx.exe160⤵PID:2156
-
\??\c:\drbvbx.exec:\drbvbx.exe161⤵PID:836
-
\??\c:\bltlp.exec:\bltlp.exe162⤵PID:1800
-
\??\c:\rpfxl.exec:\rpfxl.exe163⤵PID:2212
-
\??\c:\rxxtj.exec:\rxxtj.exe164⤵PID:2572
-
\??\c:\flpdtrx.exec:\flpdtrx.exe165⤵PID:1636
-
\??\c:\ppffd.exec:\ppffd.exe166⤵PID:2344
-
\??\c:\bjnbhf.exec:\bjnbhf.exe167⤵PID:968
-
\??\c:\hdpplvn.exec:\hdpplvn.exe168⤵PID:908
-
\??\c:\bnhhb.exec:\bnhhb.exe169⤵PID:1700
-
\??\c:\ddljpt.exec:\ddljpt.exe170⤵PID:948
-
\??\c:\rtrtrt.exec:\rtrtrt.exe171⤵PID:2316
-
\??\c:\hvxpdp.exec:\hvxpdp.exe172⤵PID:2084
-
\??\c:\plrxp.exec:\plrxp.exe173⤵PID:3024
-
\??\c:\vvbjl.exec:\vvbjl.exe174⤵PID:852
-
\??\c:\lpfxn.exec:\lpfxn.exe175⤵PID:1936
-
\??\c:\fjpfnxf.exec:\fjpfnxf.exe176⤵PID:2944
-
\??\c:\xnfpjb.exec:\xnfpjb.exe177⤵PID:1720
-
\??\c:\tdrth.exec:\tdrth.exe178⤵PID:2596
-
\??\c:\dbjlv.exec:\dbjlv.exe179⤵PID:2608
-
\??\c:\vhnpln.exec:\vhnpln.exe180⤵PID:2628
-
\??\c:\xthbx.exec:\xthbx.exe181⤵PID:2380
-
\??\c:\dlbthh.exec:\dlbthh.exe182⤵PID:2408
-
\??\c:\pbtfxv.exec:\pbtfxv.exe183⤵PID:2636
-
\??\c:\vfhplx.exec:\vfhplx.exe184⤵PID:2676
-
\??\c:\tntxrh.exec:\tntxrh.exe185⤵PID:544
-
\??\c:\nlhthj.exec:\nlhthj.exe186⤵PID:2268
-
\??\c:\tlbpt.exec:\tlbpt.exe187⤵PID:556
-
\??\c:\hnftj.exec:\hnftj.exe188⤵PID:2448
-
\??\c:\pdlrdxx.exec:\pdlrdxx.exe189⤵PID:584
-
\??\c:\lrlfjh.exec:\lrlfjh.exe190⤵PID:1820
-
\??\c:\rfhbrpv.exec:\rfhbrpv.exe191⤵PID:2648
-
\??\c:\jxrrrbr.exec:\jxrrrbr.exe192⤵PID:2772
-
\??\c:\fhdxrt.exec:\fhdxrt.exe193⤵PID:2688
-
\??\c:\njnpfvj.exec:\njnpfvj.exe194⤵PID:1040
-
\??\c:\rlrlh.exec:\rlrlh.exe195⤵PID:1796
-
\??\c:\lrxrdt.exec:\lrxrdt.exe196⤵PID:2168
-
\??\c:\pbtfvf.exec:\pbtfvf.exe197⤵PID:2204
-
\??\c:\pxnlfxt.exec:\pxnlfxt.exe198⤵PID:888
-
\??\c:\fddlrb.exec:\fddlrb.exe199⤵PID:2180
-
\??\c:\nrfpfdd.exec:\nrfpfdd.exe200⤵PID:1616
-
\??\c:\vbptjd.exec:\vbptjd.exe201⤵PID:1660
-
\??\c:\rtxrxjb.exec:\rtxrxjb.exe202⤵PID:3044
-
\??\c:\tdhdpt.exec:\tdhdpt.exe203⤵PID:2540
-
\??\c:\ddjltv.exec:\ddjltv.exe204⤵PID:1096
-
\??\c:\thlndpb.exec:\thlndpb.exe205⤵PID:3016
-
\??\c:\lprtv.exec:\lprtv.exe206⤵PID:2672
-
\??\c:\nlrtvpf.exec:\nlrtvpf.exe207⤵PID:272
-
\??\c:\hhtxn.exec:\hhtxn.exe208⤵PID:2156
-
\??\c:\lfnlx.exec:\lfnlx.exe209⤵PID:2972
-
\??\c:\ltdxnr.exec:\ltdxnr.exe210⤵PID:1568
-
\??\c:\prjtr.exec:\prjtr.exe211⤵PID:2572
-
\??\c:\hjhjt.exec:\hjhjt.exe212⤵PID:1892
-
\??\c:\lhprdhp.exec:\lhprdhp.exe213⤵PID:2344
-
\??\c:\rvphr.exec:\rvphr.exe214⤵PID:2760
-
\??\c:\bfbrlbr.exec:\bfbrlbr.exe215⤵PID:908
-
\??\c:\hbtxrfv.exec:\hbtxrfv.exe216⤵PID:848
-
\??\c:\tjnxtfb.exec:\tjnxtfb.exe217⤵PID:788
-
\??\c:\xbhhnh.exec:\xbhhnh.exe218⤵PID:2948
-
\??\c:\ppvbblv.exec:\ppvbblv.exe219⤵PID:2240
-
\??\c:\bdnfnph.exec:\bdnfnph.exe220⤵PID:1752
-
\??\c:\jdptprl.exec:\jdptprl.exe221⤵PID:1952
-
\??\c:\xbrfpvt.exec:\xbrfpvt.exe222⤵PID:1628
-
\??\c:\bhhxddb.exec:\bhhxddb.exe223⤵PID:2460
-
\??\c:\xtljhj.exec:\xtljhj.exe224⤵PID:2600
-
\??\c:\jnhfpt.exec:\jnhfpt.exe225⤵PID:2644
-
\??\c:\dhhlxf.exec:\dhhlxf.exe226⤵PID:2516
-
\??\c:\vxdbvfh.exec:\vxdbvfh.exe227⤵PID:2712
-
\??\c:\dphhnb.exec:\dphhnb.exe228⤵PID:2660
-
\??\c:\jfpvl.exec:\jfpvl.exe229⤵PID:2356
-
\??\c:\ddnddnp.exec:\ddnddnp.exe230⤵PID:2360
-
\??\c:\bfpjfrj.exec:\bfpjfrj.exe231⤵PID:2388
-
\??\c:\pjhhnv.exec:\pjhhnv.exe232⤵PID:2676
-
\??\c:\ppfrlft.exec:\ppfrlft.exe233⤵PID:1052
-
\??\c:\tfvjnn.exec:\tfvjnn.exe234⤵PID:1496
-
\??\c:\dfltp.exec:\dfltp.exe235⤵PID:1504
-
\??\c:\dbdblt.exec:\dbdblt.exe236⤵PID:2620
-
\??\c:\ntdxn.exec:\ntdxn.exe237⤵PID:648
-
\??\c:\jxdjjd.exec:\jxdjjd.exe238⤵PID:2640
-
\??\c:\thrxphb.exec:\thrxphb.exe239⤵PID:808
-
\??\c:\tldnj.exec:\tldnj.exe240⤵PID:1456
-
\??\c:\bltplrj.exec:\bltplrj.exe241⤵PID:1972
-
\??\c:\xhbrfht.exec:\xhbrfht.exe242⤵PID:1040