Analysis
-
max time kernel
151s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 23:37
Behavioral task
behavioral1
Sample
26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe
-
Size
149KB
-
MD5
26661faea8740ed592e68d921dff59f0
-
SHA1
6329907014582ba2d8940ff2412baf3f793bb132
-
SHA256
b3a32c071d8022b13c4dd0f5be97b7041340b244df58d383c8cd47c5a1ee2793
-
SHA512
a77666aa969edd9000fde56a4c234169816ce30ff485132550a1e92b4b32971218b6cf8da114ef8ee91f7698a88cd307b76d0c61dcb801cd6b38faf22d00d644
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4tb:kcm4FmowdHoSphraHcpOFltH4tb
Malware Config
Signatures
-
Detect Blackmoon payload 50 IoCs
Processes:
resource yara_rule behavioral1/memory/2804-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-87-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2344-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/840-118-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/840-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1048-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-159-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1216-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-202-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2144-211-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2144-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1816-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-346-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2120-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-366-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2236-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-437-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1048-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-520-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1780-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1200-549-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1848-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-628-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-621-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-660-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-694-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/980-789-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2932-833-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-907-0x0000000000260000-0x0000000000287000-memory.dmp family_blackmoon behavioral1/memory/2544-947-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1640-1023-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1920-1044-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-1042-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1920-1041-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/532-1057-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dvtjv.exexpxltp.exerrlddx.exerhvjhpn.exerndtbrv.exefnptbbj.exebrdfjp.exelnrnxdr.exetbrjbjr.exedlbxpxj.exeltpdvt.exerjvtpbh.exejxlpf.exevnfdv.exexrdjb.exejpjfpdb.exebxxfnj.exexpfbrnl.exejnltp.exenbtbp.exevhjdxnb.exethflpj.exepvnrnjh.exelvbjff.exehtbxrr.exehhfvjbh.exebppxf.exehdtxx.exejpbhr.exedjjpdpt.exevrftrrn.exerhtnp.exevhflpfl.exevbtph.exebdddn.exejnlxp.exehxftff.exejprpt.exehdxndtr.exebjtbtlt.exenrbjnv.exephdlr.exeppjph.exertvnj.exevhdbp.exetrphlbb.exenpdxjrt.exevrrpbtj.exeplrjfrh.exehxxvxf.exebdjtpx.exevfffhvx.exerbhfd.exennbjx.exedbnnh.exenrhxh.exeftnpbx.exehxjrbt.exerxvln.exettbftff.exepnlbjj.exexldxvj.exeddpnhd.exehxnxfl.exepid process 2968 dvtjv.exe 3060 xpxltp.exe 2452 rrlddx.exe 2488 rhvjhpn.exe 2564 rndtbrv.exe 2880 fnptbbj.exe 2120 brdfjp.exe 2524 lnrnxdr.exe 2372 tbrjbjr.exe 2772 dlbxpxj.exe 2344 ltpdvt.exe 840 rjvtpbh.exe 2416 jxlpf.exe 2676 vnfdv.exe 1048 xrdjb.exe 1720 jpjfpdb.exe 1828 bxxfnj.exe 1816 xpfbrnl.exe 1216 jnltp.exe 2052 nbtbp.exe 1480 vhjdxnb.exe 2144 thflpj.exe 2940 pvnrnjh.exe 2712 lvbjff.exe 1812 htbxrr.exe 1620 hhfvjbh.exe 1872 bppxf.exe 900 hdtxx.exe 2828 jpbhr.exe 2924 djjpdpt.exe 804 vrftrrn.exe 2204 rhtnp.exe 1948 vhflpfl.exe 2816 vbtph.exe 1600 bdddn.exe 3052 jnlxp.exe 2888 hxftff.exe 2960 jprpt.exe 2504 hdxndtr.exe 2872 bjtbtlt.exe 2508 nrbjnv.exe 2564 phdlr.exe 2580 ppjph.exe 2528 rtvnj.exe 2356 vhdbp.exe 2392 trphlbb.exe 2376 npdxjrt.exe 1696 vrrpbtj.exe 1884 plrjfrh.exe 2160 hxxvxf.exe 1856 bdjtpx.exe 2760 vfffhvx.exe 2680 rbhfd.exe 2236 nnbjx.exe 1048 dbnnh.exe 2004 nrhxh.exe 2328 ftnpbx.exe 1976 hxjrbt.exe 1780 rxvln.exe 1172 ttbftff.exe 288 pnlbjj.exe 2224 xldxvj.exe 2136 ddpnhd.exe 2996 hxnxfl.exe -
Processes:
resource yara_rule behavioral1/memory/2804-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvtjv.exe upx behavioral1/memory/2968-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2968-18-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xpxltp.exe upx behavioral1/memory/3060-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2452-29-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrlddx.exe upx behavioral1/memory/3060-28-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rhvjhpn.exe upx behavioral1/memory/2452-39-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rndtbrv.exe upx C:\fnptbbj.exe upx \??\c:\brdfjp.exe upx behavioral1/memory/2880-64-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lnrnxdr.exe upx C:\tbrjbjr.exe upx behavioral1/memory/2524-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2372-93-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dlbxpxj.exe upx C:\ltpdvt.exe upx behavioral1/memory/2344-110-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rjvtpbh.exe upx C:\jxlpf.exe upx behavioral1/memory/840-120-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vnfdv.exe upx behavioral1/memory/2416-129-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrdjb.exe upx behavioral1/memory/2676-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1048-149-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jpjfpdb.exe upx behavioral1/memory/1720-158-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bxxfnj.exe upx C:\xpfbrnl.exe upx C:\jnltp.exe upx C:\nbtbp.exe upx C:\vhjdxnb.exe upx behavioral1/memory/1216-184-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pvnrnjh.exe upx behavioral1/memory/2144-210-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lvbjff.exe upx C:\htbxrr.exe upx behavioral1/memory/2712-227-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhfvjbh.exe upx behavioral1/memory/1620-238-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bppxf.exe upx C:\hdtxx.exe upx \??\c:\thflpj.exe upx C:\jpbhr.exe upx \??\c:\djjpdpt.exe upx C:\rhtnp.exe upx behavioral1/memory/2816-301-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vrftrrn.exe upx behavioral1/memory/2924-278-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1816-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2960-333-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2508-347-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2120-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2392-379-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2680-424-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1856-411-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2236-438-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exedvtjv.exexpxltp.exerrlddx.exerhvjhpn.exerndtbrv.exefnptbbj.exebrdfjp.exelnrnxdr.exetbrjbjr.exedlbxpxj.exeltpdvt.exerjvtpbh.exejxlpf.exevnfdv.exexrdjb.exedescription pid process target process PID 2804 wrote to memory of 2968 2804 26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe nbpdpv.exe PID 2804 wrote to memory of 2968 2804 26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe nbpdpv.exe PID 2804 wrote to memory of 2968 2804 26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe nbpdpv.exe PID 2804 wrote to memory of 2968 2804 26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe nbpdpv.exe PID 2968 wrote to memory of 3060 2968 dvtjv.exe ftvjpt.exe PID 2968 wrote to memory of 3060 2968 dvtjv.exe ftvjpt.exe PID 2968 wrote to memory of 3060 2968 dvtjv.exe ftvjpt.exe PID 2968 wrote to memory of 3060 2968 dvtjv.exe ftvjpt.exe PID 3060 wrote to memory of 2452 3060 xpxltp.exe fldxb.exe PID 3060 wrote to memory of 2452 3060 xpxltp.exe fldxb.exe PID 3060 wrote to memory of 2452 3060 xpxltp.exe fldxb.exe PID 3060 wrote to memory of 2452 3060 xpxltp.exe fldxb.exe PID 2452 wrote to memory of 2488 2452 rrlddx.exe vnxfbjp.exe PID 2452 wrote to memory of 2488 2452 rrlddx.exe vnxfbjp.exe PID 2452 wrote to memory of 2488 2452 rrlddx.exe vnxfbjp.exe PID 2452 wrote to memory of 2488 2452 rrlddx.exe vnxfbjp.exe PID 2488 wrote to memory of 2564 2488 rhvjhpn.exe nljvvv.exe PID 2488 wrote to memory of 2564 2488 rhvjhpn.exe nljvvv.exe PID 2488 wrote to memory of 2564 2488 rhvjhpn.exe nljvvv.exe PID 2488 wrote to memory of 2564 2488 rhvjhpn.exe nljvvv.exe PID 2564 wrote to memory of 2880 2564 rndtbrv.exe fnptbbj.exe PID 2564 wrote to memory of 2880 2564 rndtbrv.exe fnptbbj.exe PID 2564 wrote to memory of 2880 2564 rndtbrv.exe fnptbbj.exe PID 2564 wrote to memory of 2880 2564 rndtbrv.exe fnptbbj.exe PID 2880 wrote to memory of 2120 2880 fnptbbj.exe ljjrj.exe PID 2880 wrote to memory of 2120 2880 fnptbbj.exe ljjrj.exe PID 2880 wrote to memory of 2120 2880 fnptbbj.exe ljjrj.exe PID 2880 wrote to memory of 2120 2880 fnptbbj.exe ljjrj.exe PID 2120 wrote to memory of 2524 2120 brdfjp.exe jlnrfr.exe PID 2120 wrote to memory of 2524 2120 brdfjp.exe jlnrfr.exe PID 2120 wrote to memory of 2524 2120 brdfjp.exe jlnrfr.exe PID 2120 wrote to memory of 2524 2120 brdfjp.exe jlnrfr.exe PID 2524 wrote to memory of 2372 2524 lnrnxdr.exe dnllpbn.exe PID 2524 wrote to memory of 2372 2524 lnrnxdr.exe dnllpbn.exe PID 2524 wrote to memory of 2372 2524 lnrnxdr.exe dnllpbn.exe PID 2524 wrote to memory of 2372 2524 lnrnxdr.exe dnllpbn.exe PID 2372 wrote to memory of 2772 2372 tbrjbjr.exe vhhxj.exe PID 2372 wrote to memory of 2772 2372 tbrjbjr.exe vhhxj.exe PID 2372 wrote to memory of 2772 2372 tbrjbjr.exe vhhxj.exe PID 2372 wrote to memory of 2772 2372 tbrjbjr.exe vhhxj.exe PID 2772 wrote to memory of 2344 2772 dlbxpxj.exe nfftf.exe PID 2772 wrote to memory of 2344 2772 dlbxpxj.exe nfftf.exe PID 2772 wrote to memory of 2344 2772 dlbxpxj.exe nfftf.exe PID 2772 wrote to memory of 2344 2772 dlbxpxj.exe nfftf.exe PID 2344 wrote to memory of 840 2344 ltpdvt.exe nxxnphj.exe PID 2344 wrote to memory of 840 2344 ltpdvt.exe nxxnphj.exe PID 2344 wrote to memory of 840 2344 ltpdvt.exe nxxnphj.exe PID 2344 wrote to memory of 840 2344 ltpdvt.exe nxxnphj.exe PID 840 wrote to memory of 2416 840 rjvtpbh.exe lnrltxr.exe PID 840 wrote to memory of 2416 840 rjvtpbh.exe lnrltxr.exe PID 840 wrote to memory of 2416 840 rjvtpbh.exe lnrltxr.exe PID 840 wrote to memory of 2416 840 rjvtpbh.exe lnrltxr.exe PID 2416 wrote to memory of 2676 2416 jxlpf.exe brbbjr.exe PID 2416 wrote to memory of 2676 2416 jxlpf.exe brbbjr.exe PID 2416 wrote to memory of 2676 2416 jxlpf.exe brbbjr.exe PID 2416 wrote to memory of 2676 2416 jxlpf.exe brbbjr.exe PID 2676 wrote to memory of 1048 2676 vnfdv.exe vrhxr.exe PID 2676 wrote to memory of 1048 2676 vnfdv.exe vrhxr.exe PID 2676 wrote to memory of 1048 2676 vnfdv.exe vrhxr.exe PID 2676 wrote to memory of 1048 2676 vnfdv.exe vrhxr.exe PID 1048 wrote to memory of 1720 1048 xrdjb.exe bdtdt.exe PID 1048 wrote to memory of 1720 1048 xrdjb.exe bdtdt.exe PID 1048 wrote to memory of 1720 1048 xrdjb.exe bdtdt.exe PID 1048 wrote to memory of 1720 1048 xrdjb.exe bdtdt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\dvtjv.exec:\dvtjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\xpxltp.exec:\xpxltp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\rrlddx.exec:\rrlddx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\rhvjhpn.exec:\rhvjhpn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rndtbrv.exec:\rndtbrv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\fnptbbj.exec:\fnptbbj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\brdfjp.exec:\brdfjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\lnrnxdr.exec:\lnrnxdr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\tbrjbjr.exec:\tbrjbjr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\dlbxpxj.exec:\dlbxpxj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\ltpdvt.exec:\ltpdvt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\rjvtpbh.exec:\rjvtpbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\jxlpf.exec:\jxlpf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\vnfdv.exec:\vnfdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\xrdjb.exec:\xrdjb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\jpjfpdb.exec:\jpjfpdb.exe17⤵
- Executes dropped EXE
PID:1720 -
\??\c:\bxxfnj.exec:\bxxfnj.exe18⤵
- Executes dropped EXE
PID:1828 -
\??\c:\xpfbrnl.exec:\xpfbrnl.exe19⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jnltp.exec:\jnltp.exe20⤵
- Executes dropped EXE
PID:1216 -
\??\c:\nbtbp.exec:\nbtbp.exe21⤵
- Executes dropped EXE
PID:2052 -
\??\c:\vhjdxnb.exec:\vhjdxnb.exe22⤵
- Executes dropped EXE
PID:1480 -
\??\c:\thflpj.exec:\thflpj.exe23⤵
- Executes dropped EXE
PID:2144 -
\??\c:\pvnrnjh.exec:\pvnrnjh.exe24⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lvbjff.exec:\lvbjff.exe25⤵
- Executes dropped EXE
PID:2712 -
\??\c:\htbxrr.exec:\htbxrr.exe26⤵
- Executes dropped EXE
PID:1812 -
\??\c:\hhfvjbh.exec:\hhfvjbh.exe27⤵
- Executes dropped EXE
PID:1620 -
\??\c:\bppxf.exec:\bppxf.exe28⤵
- Executes dropped EXE
PID:1872 -
\??\c:\hdtxx.exec:\hdtxx.exe29⤵
- Executes dropped EXE
PID:900 -
\??\c:\jpbhr.exec:\jpbhr.exe30⤵
- Executes dropped EXE
PID:2828 -
\??\c:\djjpdpt.exec:\djjpdpt.exe31⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vrftrrn.exec:\vrftrrn.exe32⤵
- Executes dropped EXE
PID:804 -
\??\c:\rhtnp.exec:\rhtnp.exe33⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vhflpfl.exec:\vhflpfl.exe34⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vbtph.exec:\vbtph.exe35⤵
- Executes dropped EXE
PID:2816 -
\??\c:\bdddn.exec:\bdddn.exe36⤵
- Executes dropped EXE
PID:1600 -
\??\c:\jnlxp.exec:\jnlxp.exe37⤵
- Executes dropped EXE
PID:3052 -
\??\c:\hxftff.exec:\hxftff.exe38⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jprpt.exec:\jprpt.exe39⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hdxndtr.exec:\hdxndtr.exe40⤵
- Executes dropped EXE
PID:2504 -
\??\c:\bjtbtlt.exec:\bjtbtlt.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nrbjnv.exec:\nrbjnv.exe42⤵
- Executes dropped EXE
PID:2508 -
\??\c:\phdlr.exec:\phdlr.exe43⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ppjph.exec:\ppjph.exe44⤵
- Executes dropped EXE
PID:2580 -
\??\c:\rtvnj.exec:\rtvnj.exe45⤵
- Executes dropped EXE
PID:2528 -
\??\c:\vhdbp.exec:\vhdbp.exe46⤵
- Executes dropped EXE
PID:2356 -
\??\c:\trphlbb.exec:\trphlbb.exe47⤵
- Executes dropped EXE
PID:2392 -
\??\c:\npdxjrt.exec:\npdxjrt.exe48⤵
- Executes dropped EXE
PID:2376 -
\??\c:\vrrpbtj.exec:\vrrpbtj.exe49⤵
- Executes dropped EXE
PID:1696 -
\??\c:\plrjfrh.exec:\plrjfrh.exe50⤵
- Executes dropped EXE
PID:1884 -
\??\c:\hxxvxf.exec:\hxxvxf.exe51⤵
- Executes dropped EXE
PID:2160 -
\??\c:\bdjtpx.exec:\bdjtpx.exe52⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vfffhvx.exec:\vfffhvx.exe53⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rbhfd.exec:\rbhfd.exe54⤵
- Executes dropped EXE
PID:2680 -
\??\c:\nnbjx.exec:\nnbjx.exe55⤵
- Executes dropped EXE
PID:2236 -
\??\c:\dbnnh.exec:\dbnnh.exe56⤵
- Executes dropped EXE
PID:1048 -
\??\c:\nrhxh.exec:\nrhxh.exe57⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ftnpbx.exec:\ftnpbx.exe58⤵
- Executes dropped EXE
PID:2328 -
\??\c:\hxjrbt.exec:\hxjrbt.exe59⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rxvln.exec:\rxvln.exe60⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ttbftff.exec:\ttbftff.exe61⤵
- Executes dropped EXE
PID:1172 -
\??\c:\pnlbjj.exec:\pnlbjj.exe62⤵
- Executes dropped EXE
PID:288 -
\??\c:\xldxvj.exec:\xldxvj.exe63⤵
- Executes dropped EXE
PID:2224 -
\??\c:\ddpnhd.exec:\ddpnhd.exe64⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hxnxfl.exec:\hxnxfl.exe65⤵
- Executes dropped EXE
PID:2996 -
\??\c:\nvvvbt.exec:\nvvvbt.exe66⤵PID:1800
-
\??\c:\lblvddr.exec:\lblvddr.exe67⤵PID:1824
-
\??\c:\jldftj.exec:\jldftj.exe68⤵PID:1316
-
\??\c:\hjvxjt.exec:\hjvxjt.exe69⤵PID:1204
-
\??\c:\lntdvr.exec:\lntdvr.exe70⤵PID:1560
-
\??\c:\fhvvrrh.exec:\fhvvrrh.exe71⤵PID:2932
-
\??\c:\fbxnvld.exec:\fbxnvld.exe72⤵PID:1200
-
\??\c:\fbpbl.exec:\fbpbl.exe73⤵PID:1848
-
\??\c:\xfvnt.exec:\xfvnt.exe74⤵PID:2288
-
\??\c:\lfrdpt.exec:\lfrdpt.exe75⤵PID:2316
-
\??\c:\thxtnx.exec:\thxtnx.exe76⤵PID:1508
-
\??\c:\nffrhtb.exec:\nffrhtb.exe77⤵PID:2696
-
\??\c:\bdvlp.exec:\bdvlp.exe78⤵PID:2808
-
\??\c:\vvrrl.exec:\vvrrl.exe79⤵PID:2816
-
\??\c:\nlhhr.exec:\nlhhr.exe80⤵PID:1600
-
\??\c:\fntfjvj.exec:\fntfjvj.exe81⤵PID:3064
-
\??\c:\fjttjbj.exec:\fjttjbj.exe82⤵PID:3060
-
\??\c:\jlrdtt.exec:\jlrdtt.exe83⤵PID:2784
-
\??\c:\lvjvpl.exec:\lvjvpl.exe84⤵PID:3048
-
\??\c:\jddpld.exec:\jddpld.exe85⤵PID:2072
-
\??\c:\frblrnl.exec:\frblrnl.exe86⤵PID:2616
-
\??\c:\jnjtbr.exec:\jnjtbr.exe87⤵PID:2628
-
\??\c:\rpbnjd.exec:\rpbnjd.exe88⤵PID:2448
-
\??\c:\hjlrj.exec:\hjlrj.exe89⤵PID:2556
-
\??\c:\ldftrpn.exec:\ldftrpn.exe90⤵PID:2524
-
\??\c:\ltjjpf.exec:\ltjjpf.exe91⤵PID:2792
-
\??\c:\jdxrht.exec:\jdxrht.exe92⤵PID:1664
-
\??\c:\jjbrdf.exec:\jjbrdf.exe93⤵PID:608
-
\??\c:\dfxjbnj.exec:\dfxjbnj.exe94⤵PID:1704
-
\??\c:\bpnrpxp.exec:\bpnrpxp.exe95⤵PID:840
-
\??\c:\jbrxvxf.exec:\jbrxvxf.exe96⤵PID:2044
-
\??\c:\pblntt.exec:\pblntt.exe97⤵PID:2820
-
\??\c:\bdlhdhj.exec:\bdlhdhj.exe98⤵PID:2232
-
\??\c:\hfljbp.exec:\hfljbp.exe99⤵PID:1044
-
\??\c:\bbfpnjx.exec:\bbfpnjx.exe100⤵PID:1248
-
\??\c:\prpfnt.exec:\prpfnt.exe101⤵PID:1428
-
\??\c:\bvxxvrr.exec:\bvxxvrr.exe102⤵PID:1232
-
\??\c:\rhbvph.exec:\rhbvph.exe103⤵PID:2000
-
\??\c:\xdprn.exec:\xdprn.exe104⤵PID:2312
-
\??\c:\rjbhbll.exec:\rjbhbll.exe105⤵PID:2016
-
\??\c:\ffhlr.exec:\ffhlr.exe106⤵PID:1328
-
\??\c:\jhlbdpl.exec:\jhlbdpl.exe107⤵PID:568
-
\??\c:\fbhtfdr.exec:\fbhtfdr.exe108⤵PID:636
-
\??\c:\jvnnvj.exec:\jvnnvj.exe109⤵PID:980
-
\??\c:\jntprvx.exec:\jntprvx.exe110⤵PID:400
-
\??\c:\fvbxj.exec:\fvbxj.exe111⤵PID:1088
-
\??\c:\jxlrrbf.exec:\jxlrrbf.exe112⤵PID:2992
-
\??\c:\htrjdtv.exec:\htrjdtv.exe113⤵PID:1868
-
\??\c:\vxdhttv.exec:\vxdhttv.exe114⤵PID:864
-
\??\c:\ltlrn.exec:\ltlrn.exe115⤵PID:912
-
\??\c:\vhpxrd.exec:\vhpxrd.exe116⤵PID:1864
-
\??\c:\fvvthl.exec:\fvvthl.exe117⤵PID:2932
-
\??\c:\dntxn.exec:\dntxn.exe118⤵PID:1332
-
\??\c:\njnxjnj.exec:\njnxjnj.exe119⤵PID:2920
-
\??\c:\jhfjl.exec:\jhfjl.exe120⤵PID:708
-
\??\c:\bnxpldn.exec:\bnxpldn.exe121⤵PID:2200
-
\??\c:\vndvxr.exec:\vndvxr.exe122⤵PID:2800
-
\??\c:\vjndf.exec:\vjndf.exe123⤵PID:2868
-
\??\c:\vlfnph.exec:\vlfnph.exe124⤵PID:1716
-
\??\c:\prhptx.exec:\prhptx.exe125⤵PID:2968
-
\??\c:\fxfpld.exec:\fxfpld.exe126⤵PID:2980
-
\??\c:\djxvxf.exec:\djxvxf.exe127⤵PID:3012
-
\??\c:\xdhjh.exec:\xdhjh.exe128⤵PID:2452
-
\??\c:\hdvnbd.exec:\hdvnbd.exe129⤵PID:2492
-
\??\c:\lhhvtrj.exec:\lhhvtrj.exe130⤵PID:2512
-
\??\c:\brbxtvb.exec:\brbxtvb.exe131⤵PID:2388
-
\??\c:\jpbnlr.exec:\jpbnlr.exe132⤵PID:2608
-
\??\c:\pvhffrt.exec:\pvhffrt.exe133⤵PID:2544
-
\??\c:\ndhdhfb.exec:\ndhdhfb.exe134⤵PID:2532
-
\??\c:\hrhnf.exec:\hrhnf.exe135⤵PID:2776
-
\??\c:\hpvlf.exec:\hpvlf.exe136⤵PID:2376
-
\??\c:\ttfbpx.exec:\ttfbpx.exe137⤵PID:2372
-
\??\c:\lxvrrv.exec:\lxvrrv.exe138⤵PID:2180
-
\??\c:\hlhpptb.exec:\hlhpptb.exe139⤵PID:2796
-
\??\c:\tntxrrp.exec:\tntxrrp.exe140⤵PID:1640
-
\??\c:\ppfxr.exec:\ppfxr.exe141⤵PID:2668
-
\??\c:\dtvbjp.exec:\dtvbjp.exe142⤵PID:928
-
\??\c:\hvfbt.exec:\hvfbt.exe143⤵PID:2152
-
\??\c:\hpjpfnx.exec:\hpjpfnx.exe144⤵PID:324
-
\??\c:\dnplfp.exec:\dnplfp.exe145⤵PID:240
-
\??\c:\ffhvr.exec:\ffhvr.exe146⤵PID:1736
-
\??\c:\llhhnv.exec:\llhhnv.exe147⤵PID:312
-
\??\c:\nbfvhd.exec:\nbfvhd.exe148⤵PID:1920
-
\??\c:\bnvjr.exec:\bnvjr.exe149⤵PID:2124
-
\??\c:\rflnnt.exec:\rflnnt.exe150⤵PID:532
-
\??\c:\vnljj.exec:\vnljj.exe151⤵PID:1484
-
\??\c:\xhlrvp.exec:\xhlrvp.exe152⤵PID:1480
-
\??\c:\jprtp.exec:\jprtp.exe153⤵PID:440
-
\??\c:\hnxtff.exec:\hnxtff.exe154⤵PID:1596
-
\??\c:\ltxrb.exec:\ltxrb.exe155⤵PID:2712
-
\??\c:\rjnrx.exec:\rjnrx.exe156⤵PID:1564
-
\??\c:\dtfhp.exec:\dtfhp.exe157⤵PID:1692
-
\??\c:\xhbff.exec:\xhbff.exe158⤵PID:1316
-
\??\c:\jnvxfbr.exec:\jnvxfbr.exe159⤵PID:792
-
\??\c:\dvxpjtt.exec:\dvxpjtt.exe160⤵PID:1652
-
\??\c:\dpfldj.exec:\dpfldj.exe161⤵PID:1560
-
\??\c:\pplffl.exec:\pplffl.exe162⤵PID:320
-
\??\c:\fjrjh.exec:\fjrjh.exe163⤵PID:560
-
\??\c:\fnbln.exec:\fnbln.exe164⤵PID:2252
-
\??\c:\xrfnv.exec:\xrfnv.exe165⤵PID:2296
-
\??\c:\ljjjhbt.exec:\ljjjhbt.exe166⤵PID:2804
-
\??\c:\nxxhjf.exec:\nxxhjf.exe167⤵PID:2692
-
\??\c:\vphhfx.exec:\vphhfx.exe168⤵PID:1612
-
\??\c:\rrjfb.exec:\rrjfb.exe169⤵PID:2636
-
\??\c:\rvfhlx.exec:\rvfhlx.exe170⤵PID:1608
-
\??\c:\tbhlbtb.exec:\tbhlbtb.exe171⤵PID:2848
-
\??\c:\ptjxv.exec:\ptjxv.exe172⤵PID:2572
-
\??\c:\pdrxfj.exec:\pdrxfj.exe173⤵PID:2516
-
\??\c:\pntlnnh.exec:\pntlnnh.exe174⤵PID:2500
-
\??\c:\xtpfh.exec:\xtpfh.exe175⤵PID:2700
-
\??\c:\tblxv.exec:\tblxv.exe176⤵PID:2664
-
\??\c:\hlpvdpn.exec:\hlpvdpn.exe177⤵PID:2564
-
\??\c:\jxthf.exec:\jxthf.exe178⤵PID:2608
-
\??\c:\bndhfhr.exec:\bndhfhr.exe179⤵PID:2384
-
\??\c:\jfphtr.exec:\jfphtr.exe180⤵PID:2532
-
\??\c:\xxfrl.exec:\xxfrl.exe181⤵PID:2964
-
\??\c:\ftffl.exec:\ftffl.exe182⤵PID:2288
-
\??\c:\fbjjf.exec:\fbjjf.exe183⤵PID:2188
-
\??\c:\dfhppvn.exec:\dfhppvn.exe184⤵PID:2428
-
\??\c:\prjlxr.exec:\prjlxr.exe185⤵PID:1804
-
\??\c:\jfvrh.exec:\jfvrh.exe186⤵PID:2292
-
\??\c:\vhhtvf.exec:\vhhtvf.exe187⤵PID:2044
-
\??\c:\ttjxnjj.exec:\ttjxnjj.exe188⤵PID:3008
-
\??\c:\nhrbvx.exec:\nhrbvx.exe189⤵PID:2984
-
\??\c:\vntvfvf.exec:\vntvfvf.exe190⤵PID:908
-
\??\c:\hdtlr.exec:\hdtlr.exe191⤵PID:2096
-
\??\c:\rtpljnx.exec:\rtpljnx.exe192⤵PID:1728
-
\??\c:\vhvvbj.exec:\vhvvbj.exe193⤵PID:2944
-
\??\c:\rprrpx.exec:\rprrpx.exe194⤵PID:936
-
\??\c:\txfbfd.exec:\txfbfd.exe195⤵PID:1016
-
\??\c:\ljnntv.exec:\ljnntv.exe196⤵PID:576
-
\??\c:\xfhrnn.exec:\xfhrnn.exe197⤵PID:1160
-
\??\c:\dnnlvn.exec:\dnnlvn.exe198⤵PID:2728
-
\??\c:\hdpnj.exec:\hdpnj.exe199⤵PID:1244
-
\??\c:\vrnrhpv.exec:\vrnrhpv.exe200⤵PID:400
-
\??\c:\llvfxv.exec:\llvfxv.exe201⤵PID:1800
-
\??\c:\llrftf.exec:\llrftf.exe202⤵PID:2456
-
\??\c:\jnhfhr.exec:\jnhfhr.exe203⤵PID:692
-
\??\c:\vlppr.exec:\vlppr.exe204⤵PID:1788
-
\??\c:\rfnhdhh.exec:\rfnhdhh.exe205⤵PID:652
-
\??\c:\rjjjbnn.exec:\rjjjbnn.exe206⤵PID:1984
-
\??\c:\txbvjbn.exec:\txbvjbn.exe207⤵PID:2908
-
\??\c:\bftbd.exec:\bftbd.exe208⤵PID:2932
-
\??\c:\bvrnr.exec:\bvrnr.exe209⤵PID:1992
-
\??\c:\pbhjh.exec:\pbhjh.exe210⤵PID:2828
-
\??\c:\dnxxbv.exec:\dnxxbv.exe211⤵PID:2252
-
\??\c:\htvjd.exec:\htvjd.exe212⤵PID:2296
-
\??\c:\tftjbd.exec:\tftjbd.exe213⤵PID:2804
-
\??\c:\ljfhn.exec:\ljfhn.exe214⤵PID:2692
-
\??\c:\xxntjxx.exec:\xxntjxx.exe215⤵PID:1716
-
\??\c:\xfnltbx.exec:\xfnltbx.exe216⤵PID:2636
-
\??\c:\hjprl.exec:\hjprl.exe217⤵PID:2912
-
\??\c:\rbxtp.exec:\rbxtp.exe218⤵PID:2848
-
\??\c:\vvbvl.exec:\vvbvl.exe219⤵PID:2572
-
\??\c:\fdpphx.exec:\fdpphx.exe220⤵PID:2716
-
\??\c:\xhnxx.exec:\xhnxx.exe221⤵PID:2500
-
\??\c:\bfdtp.exec:\bfdtp.exe222⤵PID:2624
-
\??\c:\dblld.exec:\dblld.exe223⤵PID:2120
-
\??\c:\rhxldt.exec:\rhxldt.exe224⤵PID:2496
-
\??\c:\rrjljv.exec:\rrjljv.exe225⤵PID:2604
-
\??\c:\lxhhph.exec:\lxhhph.exe226⤵PID:2384
-
\??\c:\frlhbp.exec:\frlhbp.exe227⤵PID:2192
-
\??\c:\jpbdlvl.exec:\jpbdlvl.exe228⤵PID:1032
-
\??\c:\rrhfvr.exec:\rrhfvr.exe229⤵PID:2524
-
\??\c:\nxjbx.exec:\nxjbx.exe230⤵PID:1012
-
\??\c:\jnrrt.exec:\jnrrt.exe231⤵PID:2412
-
\??\c:\lfvfhl.exec:\lfvfhl.exe232⤵PID:2644
-
\??\c:\vbhpbt.exec:\vbhpbt.exe233⤵PID:2656
-
\??\c:\lxlpr.exec:\lxlpr.exe234⤵PID:928
-
\??\c:\hdfbd.exec:\hdfbd.exe235⤵PID:2684
-
\??\c:\llpfl.exec:\llpfl.exe236⤵PID:2592
-
\??\c:\rrfplb.exec:\rrfplb.exe237⤵PID:1828
-
\??\c:\fbfjd.exec:\fbfjd.exe238⤵PID:2328
-
\??\c:\hvlhv.exec:\hvlhv.exe239⤵PID:1028
-
\??\c:\tjrdlf.exec:\tjrdlf.exe240⤵PID:1668
-
\??\c:\ljbhrfx.exec:\ljbhrfx.exe241⤵PID:812
-
\??\c:\rlbxv.exec:\rlbxv.exe242⤵PID:2036