Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 21:13
Behavioral task
behavioral1
Sample
0324cd61c19561c3618a73220be611b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0324cd61c19561c3618a73220be611b0_NeikiAnalytics.exe
-
Size
381KB
-
MD5
0324cd61c19561c3618a73220be611b0
-
SHA1
cf6c73403b1cc8ae1127ad44793618da872bc55d
-
SHA256
420e3d0bc65f5da8b1fd9973cc5e0dcb676f83a459e6713e8a7fb382273b9d30
-
SHA512
55fbbe5d85ba8d9005d2aef7fffd8ba5fa08ddda1f68150b5c18b613c07a80d8efcd8f589060ff05f78f094662dbf2652f06b50229d0b92124e39469385a12c0
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpSwp9OD0IbswYTU:y4wFHoS3eFaKHpNKbbsweU
Malware Config
Signatures
-
Detect Blackmoon payload 50 IoCs
Processes:
resource yara_rule behavioral1/memory/2804-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2424-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-47-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2480-48-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2480-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/324-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/760-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-138-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2144-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1156-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1368-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/808-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/436-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/832-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1564-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1980-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/908-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/240-305-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2248-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1856-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1856-430-0x0000000000320000-0x0000000000347000-memory.dmp family_blackmoon behavioral1/memory/1488-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1488-437-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2168-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1956-502-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2576-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1160-561-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1216-639-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-650-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2844-652-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2188-704-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1936-758-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1184-877-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-957-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1360-1086-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1360-1117-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2748-1125-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2748-1124-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hdxnj.exehtrtdd.exeffhhldn.exelfddb.exefxndr.exefptdbv.exenfvnxff.exejdndb.exedjdtfn.exefjxvhdr.exenvxfvhn.exejxrtf.exenrhbntv.exeffnfdxt.exebvhfxn.exevntjx.exebnhnnd.exedtdrnp.exexftrdbx.exephfbr.exenhnphvf.exeblvbdtn.exerjlldbt.exevpppfd.exervnxn.exejdvpvjx.exehjlxt.exexdnbj.exelnpnjlr.exejfjlpl.exebdxjbrl.exejffnh.exepllpp.exevntrprh.exefhftblr.exenbhfn.exebfhvrfr.exendrjhjj.exehjxth.exedfbhd.exefvrbjb.exejnxtjf.exenfjvffh.exedpttn.exenbhvvjf.exettrnt.exelfvvt.exevtlbdrp.exelllbhj.exejxhfb.exennbrhn.exelvrddx.exejjrddv.exetblnbht.exevrppdf.exefjthtl.exedntvvjv.exedljvllj.exeddbvd.exehdxhprf.exexptdpxd.exefnjfv.exerblfjff.exeftxdjn.exepid process 2940 hdxnj.exe 2816 htrtdd.exe 2424 ffhhldn.exe 2480 lfddb.exe 2528 fxndr.exe 2356 fptdbv.exe 2152 nfvnxff.exe 2376 jdndb.exe 2388 djdtfn.exe 324 fjxvhdr.exe 760 nvxfvhn.exe 1432 jxrtf.exe 1212 nrhbntv.exe 2144 ffnfdxt.exe 1704 bvhfxn.exe 1156 vntjx.exe 1368 bnhnnd.exe 2020 dtdrnp.exe 764 xftrdbx.exe 1592 phfbr.exe 808 nhnphvf.exe 2960 blvbdtn.exe 2420 rjlldbt.exe 2120 vpppfd.exe 436 rvnxn.exe 832 jdvpvjx.exe 1564 hjlxt.exe 1620 xdnbj.exe 1980 lnpnjlr.exe 908 jfjlpl.exe 3008 bdxjbrl.exe 2272 jffnh.exe 240 pllpp.exe 1720 vntrprh.exe 2092 fhftblr.exe 2248 nbhfn.exe 1712 bfhvrfr.exe 2632 ndrjhjj.exe 3016 hjxth.exe 2680 dfbhd.exe 2932 fvrbjb.exe 2488 jnxtjf.exe 2616 nfjvffh.exe 2468 dpttn.exe 2380 nbhvvjf.exe 2344 ttrnt.exe 2404 lfvvt.exe 1856 vtlbdrp.exe 776 lllbhj.exe 2016 jxhfb.exe 1348 nnbrhn.exe 552 lvrddx.exe 1488 jjrddv.exe 2172 tblnbht.exe 2304 vrppdf.exe 2168 fjthtl.exe 1664 dntvvjv.exe 2012 dljvllj.exe 2284 ddbvd.exe 936 hdxhprf.exe 1708 xptdpxd.exe 952 fnjfv.exe 1956 rblfjff.exe 2792 ftxdjn.exe -
Processes:
resource yara_rule behavioral1/memory/2804-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hdxnj.exe upx behavioral1/memory/2940-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2940-18-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htrtdd.exe upx behavioral1/memory/2424-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-28-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffhhldn.exe upx C:\lfddb.exe upx behavioral1/memory/2424-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2480-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxndr.exe upx C:\fptdbv.exe upx behavioral1/memory/2528-58-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nfvnxff.exe upx C:\jdndb.exe upx C:\djdtfn.exe upx behavioral1/memory/2388-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2376-84-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fjxvhdr.exe upx C:\nvxfvhn.exe upx behavioral1/memory/324-102-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jxrtf.exe upx behavioral1/memory/760-111-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nrhbntv.exe upx C:\ffnfdxt.exe upx C:\bvhfxn.exe upx behavioral1/memory/2144-136-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vntjx.exe upx C:\bnhnnd.exe upx behavioral1/memory/1156-154-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dtdrnp.exe upx behavioral1/memory/1368-163-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xftrdbx.exe upx behavioral1/memory/2020-172-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\phfbr.exe upx behavioral1/memory/808-190-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhnphvf.exe upx C:\blvbdtn.exe upx behavioral1/memory/808-198-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rjlldbt.exe upx behavioral1/memory/2960-207-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vpppfd.exe upx \??\c:\rvnxn.exe upx behavioral1/memory/436-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/832-235-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdvpvjx.exe upx \??\c:\hjlxt.exe upx C:\xdnbj.exe upx behavioral1/memory/1564-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1620-252-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lnpnjlr.exe upx behavioral1/memory/1980-268-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jfjlpl.exe upx behavioral1/memory/908-271-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bdxjbrl.exe upx \??\c:\jffnh.exe upx behavioral1/memory/3008-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1720-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2248-326-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1712-329-0x0000000000320000-0x0000000000347000-memory.dmp upx behavioral1/memory/2680-353-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0324cd61c19561c3618a73220be611b0_NeikiAnalytics.exehdxnj.exehtrtdd.exeffhhldn.exelfddb.exefxndr.exefptdbv.exenfvnxff.exejdndb.exedjdtfn.exefjxvhdr.exenvxfvhn.exejxrtf.exenrhbntv.exeffnfdxt.exebvhfxn.exedescription pid process target process PID 2804 wrote to memory of 2940 2804 0324cd61c19561c3618a73220be611b0_NeikiAnalytics.exe hdxnj.exe PID 2804 wrote to memory of 2940 2804 0324cd61c19561c3618a73220be611b0_NeikiAnalytics.exe hdxnj.exe PID 2804 wrote to memory of 2940 2804 0324cd61c19561c3618a73220be611b0_NeikiAnalytics.exe hdxnj.exe PID 2804 wrote to memory of 2940 2804 0324cd61c19561c3618a73220be611b0_NeikiAnalytics.exe hdxnj.exe PID 2940 wrote to memory of 2816 2940 hdxnj.exe htrtdd.exe PID 2940 wrote to memory of 2816 2940 hdxnj.exe htrtdd.exe PID 2940 wrote to memory of 2816 2940 hdxnj.exe htrtdd.exe PID 2940 wrote to memory of 2816 2940 hdxnj.exe htrtdd.exe PID 2816 wrote to memory of 2424 2816 htrtdd.exe ffhhldn.exe PID 2816 wrote to memory of 2424 2816 htrtdd.exe ffhhldn.exe PID 2816 wrote to memory of 2424 2816 htrtdd.exe ffhhldn.exe PID 2816 wrote to memory of 2424 2816 htrtdd.exe ffhhldn.exe PID 2424 wrote to memory of 2480 2424 ffhhldn.exe lfddb.exe PID 2424 wrote to memory of 2480 2424 ffhhldn.exe lfddb.exe PID 2424 wrote to memory of 2480 2424 ffhhldn.exe lfddb.exe PID 2424 wrote to memory of 2480 2424 ffhhldn.exe lfddb.exe PID 2480 wrote to memory of 2528 2480 lfddb.exe fxndr.exe PID 2480 wrote to memory of 2528 2480 lfddb.exe fxndr.exe PID 2480 wrote to memory of 2528 2480 lfddb.exe fxndr.exe PID 2480 wrote to memory of 2528 2480 lfddb.exe fxndr.exe PID 2528 wrote to memory of 2356 2528 fxndr.exe fptdbv.exe PID 2528 wrote to memory of 2356 2528 fxndr.exe fptdbv.exe PID 2528 wrote to memory of 2356 2528 fxndr.exe fptdbv.exe PID 2528 wrote to memory of 2356 2528 fxndr.exe fptdbv.exe PID 2356 wrote to memory of 2152 2356 fptdbv.exe nfvnxff.exe PID 2356 wrote to memory of 2152 2356 fptdbv.exe nfvnxff.exe PID 2356 wrote to memory of 2152 2356 fptdbv.exe nfvnxff.exe PID 2356 wrote to memory of 2152 2356 fptdbv.exe nfvnxff.exe PID 2152 wrote to memory of 2376 2152 nfvnxff.exe jdndb.exe PID 2152 wrote to memory of 2376 2152 nfvnxff.exe jdndb.exe PID 2152 wrote to memory of 2376 2152 nfvnxff.exe jdndb.exe PID 2152 wrote to memory of 2376 2152 nfvnxff.exe jdndb.exe PID 2376 wrote to memory of 2388 2376 jdndb.exe djdtfn.exe PID 2376 wrote to memory of 2388 2376 jdndb.exe djdtfn.exe PID 2376 wrote to memory of 2388 2376 jdndb.exe djdtfn.exe PID 2376 wrote to memory of 2388 2376 jdndb.exe djdtfn.exe PID 2388 wrote to memory of 324 2388 djdtfn.exe fjxvhdr.exe PID 2388 wrote to memory of 324 2388 djdtfn.exe fjxvhdr.exe PID 2388 wrote to memory of 324 2388 djdtfn.exe fjxvhdr.exe PID 2388 wrote to memory of 324 2388 djdtfn.exe fjxvhdr.exe PID 324 wrote to memory of 760 324 fjxvhdr.exe nvxfvhn.exe PID 324 wrote to memory of 760 324 fjxvhdr.exe nvxfvhn.exe PID 324 wrote to memory of 760 324 fjxvhdr.exe nvxfvhn.exe PID 324 wrote to memory of 760 324 fjxvhdr.exe nvxfvhn.exe PID 760 wrote to memory of 1432 760 nvxfvhn.exe jxrtf.exe PID 760 wrote to memory of 1432 760 nvxfvhn.exe jxrtf.exe PID 760 wrote to memory of 1432 760 nvxfvhn.exe jxrtf.exe PID 760 wrote to memory of 1432 760 nvxfvhn.exe jxrtf.exe PID 1432 wrote to memory of 1212 1432 jxrtf.exe nrhbntv.exe PID 1432 wrote to memory of 1212 1432 jxrtf.exe nrhbntv.exe PID 1432 wrote to memory of 1212 1432 jxrtf.exe nrhbntv.exe PID 1432 wrote to memory of 1212 1432 jxrtf.exe nrhbntv.exe PID 1212 wrote to memory of 2144 1212 nrhbntv.exe ffnfdxt.exe PID 1212 wrote to memory of 2144 1212 nrhbntv.exe ffnfdxt.exe PID 1212 wrote to memory of 2144 1212 nrhbntv.exe ffnfdxt.exe PID 1212 wrote to memory of 2144 1212 nrhbntv.exe ffnfdxt.exe PID 2144 wrote to memory of 1704 2144 ffnfdxt.exe bvhfxn.exe PID 2144 wrote to memory of 1704 2144 ffnfdxt.exe bvhfxn.exe PID 2144 wrote to memory of 1704 2144 ffnfdxt.exe bvhfxn.exe PID 2144 wrote to memory of 1704 2144 ffnfdxt.exe bvhfxn.exe PID 1704 wrote to memory of 1156 1704 bvhfxn.exe vntjx.exe PID 1704 wrote to memory of 1156 1704 bvhfxn.exe vntjx.exe PID 1704 wrote to memory of 1156 1704 bvhfxn.exe vntjx.exe PID 1704 wrote to memory of 1156 1704 bvhfxn.exe vntjx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0324cd61c19561c3618a73220be611b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0324cd61c19561c3618a73220be611b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\hdxnj.exec:\hdxnj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\htrtdd.exec:\htrtdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\ffhhldn.exec:\ffhhldn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\lfddb.exec:\lfddb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\fxndr.exec:\fxndr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\fptdbv.exec:\fptdbv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\nfvnxff.exec:\nfvnxff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\jdndb.exec:\jdndb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\djdtfn.exec:\djdtfn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\fjxvhdr.exec:\fjxvhdr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\nvxfvhn.exec:\nvxfvhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\jxrtf.exec:\jxrtf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\nrhbntv.exec:\nrhbntv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\ffnfdxt.exec:\ffnfdxt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\bvhfxn.exec:\bvhfxn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\vntjx.exec:\vntjx.exe17⤵
- Executes dropped EXE
PID:1156 -
\??\c:\bnhnnd.exec:\bnhnnd.exe18⤵
- Executes dropped EXE
PID:1368 -
\??\c:\dtdrnp.exec:\dtdrnp.exe19⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xftrdbx.exec:\xftrdbx.exe20⤵
- Executes dropped EXE
PID:764 -
\??\c:\phfbr.exec:\phfbr.exe21⤵
- Executes dropped EXE
PID:1592 -
\??\c:\nhnphvf.exec:\nhnphvf.exe22⤵
- Executes dropped EXE
PID:808 -
\??\c:\blvbdtn.exec:\blvbdtn.exe23⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rjlldbt.exec:\rjlldbt.exe24⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vpppfd.exec:\vpppfd.exe25⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rvnxn.exec:\rvnxn.exe26⤵
- Executes dropped EXE
PID:436 -
\??\c:\jdvpvjx.exec:\jdvpvjx.exe27⤵
- Executes dropped EXE
PID:832 -
\??\c:\hjlxt.exec:\hjlxt.exe28⤵
- Executes dropped EXE
PID:1564 -
\??\c:\xdnbj.exec:\xdnbj.exe29⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lnpnjlr.exec:\lnpnjlr.exe30⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jfjlpl.exec:\jfjlpl.exe31⤵
- Executes dropped EXE
PID:908 -
\??\c:\bdxjbrl.exec:\bdxjbrl.exe32⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jffnh.exec:\jffnh.exe33⤵
- Executes dropped EXE
PID:2272 -
\??\c:\pllpp.exec:\pllpp.exe34⤵
- Executes dropped EXE
PID:240 -
\??\c:\vntrprh.exec:\vntrprh.exe35⤵
- Executes dropped EXE
PID:1720 -
\??\c:\fhftblr.exec:\fhftblr.exe36⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nbhfn.exec:\nbhfn.exe37⤵
- Executes dropped EXE
PID:2248 -
\??\c:\bfhvrfr.exec:\bfhvrfr.exe38⤵
- Executes dropped EXE
PID:1712 -
\??\c:\ndrjhjj.exec:\ndrjhjj.exe39⤵
- Executes dropped EXE
PID:2632 -
\??\c:\hjxth.exec:\hjxth.exe40⤵
- Executes dropped EXE
PID:3016 -
\??\c:\dfbhd.exec:\dfbhd.exe41⤵
- Executes dropped EXE
PID:2680 -
\??\c:\fvrbjb.exec:\fvrbjb.exe42⤵
- Executes dropped EXE
PID:2932 -
\??\c:\jnxtjf.exec:\jnxtjf.exe43⤵
- Executes dropped EXE
PID:2488 -
\??\c:\nfjvffh.exec:\nfjvffh.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\dpttn.exec:\dpttn.exe45⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nbhvvjf.exec:\nbhvvjf.exe46⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ttrnt.exec:\ttrnt.exe47⤵
- Executes dropped EXE
PID:2344 -
\??\c:\lfvvt.exec:\lfvvt.exe48⤵
- Executes dropped EXE
PID:2404 -
\??\c:\vtlbdrp.exec:\vtlbdrp.exe49⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lllbhj.exec:\lllbhj.exe50⤵
- Executes dropped EXE
PID:776 -
\??\c:\jxhfb.exec:\jxhfb.exe51⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nnbrhn.exec:\nnbrhn.exe52⤵
- Executes dropped EXE
PID:1348 -
\??\c:\lvrddx.exec:\lvrddx.exe53⤵
- Executes dropped EXE
PID:552 -
\??\c:\jjrddv.exec:\jjrddv.exe54⤵
- Executes dropped EXE
PID:1488 -
\??\c:\tblnbht.exec:\tblnbht.exe55⤵
- Executes dropped EXE
PID:2172 -
\??\c:\vrppdf.exec:\vrppdf.exe56⤵
- Executes dropped EXE
PID:2304 -
\??\c:\fjthtl.exec:\fjthtl.exe57⤵
- Executes dropped EXE
PID:2168 -
\??\c:\dntvvjv.exec:\dntvvjv.exe58⤵
- Executes dropped EXE
PID:1664 -
\??\c:\dljvllj.exec:\dljvllj.exe59⤵
- Executes dropped EXE
PID:2012 -
\??\c:\ddbvd.exec:\ddbvd.exe60⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hdxhprf.exec:\hdxhprf.exe61⤵
- Executes dropped EXE
PID:936 -
\??\c:\xptdpxd.exec:\xptdpxd.exe62⤵
- Executes dropped EXE
PID:1708 -
\??\c:\fnjfv.exec:\fnjfv.exe63⤵
- Executes dropped EXE
PID:952 -
\??\c:\rblfjff.exec:\rblfjff.exe64⤵
- Executes dropped EXE
PID:1956 -
\??\c:\ftxdjn.exec:\ftxdjn.exe65⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xfvdx.exec:\xfvdx.exe66⤵PID:2252
-
\??\c:\jjlvpl.exec:\jjlvpl.exe67⤵PID:2508
-
\??\c:\pdrfdp.exec:\pdrfdp.exe68⤵PID:2576
-
\??\c:\hbftj.exec:\hbftj.exe69⤵PID:2904
-
\??\c:\hxdnxrt.exec:\hxdnxrt.exe70⤵PID:1816
-
\??\c:\vvjlxv.exec:\vvjlxv.exe71⤵PID:1988
-
\??\c:\xlthrbf.exec:\xlthrbf.exe72⤵PID:1984
-
\??\c:\vtxhtdd.exec:\vtxhtdd.exe73⤵PID:1160
-
\??\c:\dtjvv.exec:\dtjvv.exe74⤵PID:876
-
\??\c:\jfrfpl.exec:\jfrfpl.exe75⤵PID:1948
-
\??\c:\htjfv.exec:\htjfv.exe76⤵PID:1976
-
\??\c:\jvfvvt.exec:\jvfvvt.exe77⤵PID:2124
-
\??\c:\bvpfvtn.exec:\bvpfvtn.exe78⤵PID:2976
-
\??\c:\tjfjp.exec:\tjfjp.exe79⤵PID:2088
-
\??\c:\nddfp.exec:\nddfp.exe80⤵PID:872
-
\??\c:\fldbr.exec:\fldbr.exe81⤵PID:880
-
\??\c:\bjdrptb.exec:\bjdrptb.exe82⤵PID:2892
-
\??\c:\bbjrdl.exec:\bbjrdl.exe83⤵PID:2212
-
\??\c:\dnvnl.exec:\dnvnl.exe84⤵PID:2220
-
\??\c:\ndrbtt.exec:\ndrbtt.exe85⤵PID:2204
-
\??\c:\frftf.exec:\frftf.exe86⤵PID:1216
-
\??\c:\fhhnlp.exec:\fhhnlp.exe87⤵PID:2844
-
\??\c:\vrtvhx.exec:\vrtvhx.exe88⤵PID:2440
-
\??\c:\dvnnj.exec:\dvnnj.exe89⤵PID:2608
-
\??\c:\ntttj.exec:\ntttj.exe90⤵PID:2620
-
\??\c:\jvfhlj.exec:\jvfhlj.exe91⤵PID:1344
-
\??\c:\dnbxr.exec:\dnbxr.exe92⤵PID:2500
-
\??\c:\npntd.exec:\npntd.exe93⤵PID:2328
-
\??\c:\jtrlt.exec:\jtrlt.exe94⤵PID:2392
-
\??\c:\vnfnbjx.exec:\vnfnbjx.exe95⤵PID:2188
-
\??\c:\jbxxppf.exec:\jbxxppf.exe96⤵PID:2784
-
\??\c:\nlxpn.exec:\nlxpn.exe97⤵PID:1952
-
\??\c:\rxfvftx.exec:\rxfvftx.exe98⤵PID:1848
-
\??\c:\jvllflb.exec:\jvllflb.exe99⤵PID:2532
-
\??\c:\ljtpdvv.exec:\ljtpdvv.exe100⤵PID:1840
-
\??\c:\xlndnpr.exec:\xlndnpr.exe101⤵PID:572
-
\??\c:\xdflvt.exec:\xdflvt.exe102⤵PID:112
-
\??\c:\npnrjr.exec:\npnrjr.exe103⤵PID:1936
-
\??\c:\hjvhnrt.exec:\hjvhnrt.exe104⤵PID:2000
-
\??\c:\rbvrn.exec:\rbvrn.exe105⤵PID:948
-
\??\c:\trbxdtv.exec:\trbxdtv.exe106⤵PID:1656
-
\??\c:\jntbfpp.exec:\jntbfpp.exe107⤵PID:860
-
\??\c:\drlffvv.exec:\drlffvv.exe108⤵PID:1596
-
\??\c:\xvjhprb.exec:\xvjhprb.exe109⤵PID:2164
-
\??\c:\vvbbjd.exec:\vvbbjd.exe110⤵PID:1944
-
\??\c:\vljvbnn.exec:\vljvbnn.exe111⤵PID:2788
-
\??\c:\tbbdrvv.exec:\tbbdrvv.exe112⤵PID:2748
-
\??\c:\tdddt.exec:\tdddt.exe113⤵PID:2960
-
\??\c:\rlpvrfv.exec:\rlpvrfv.exe114⤵PID:2420
-
\??\c:\hjdvfj.exec:\hjdvfj.exe115⤵PID:2120
-
\??\c:\bjthdt.exec:\bjthdt.exe116⤵PID:436
-
\??\c:\nblrnpf.exec:\nblrnpf.exe117⤵PID:2884
-
\??\c:\pphnhrv.exec:\pphnhrv.exe118⤵PID:1816
-
\??\c:\nfrvtp.exec:\nfrvtp.exe119⤵PID:1768
-
\??\c:\bhnfh.exec:\bhnfh.exe120⤵PID:2984
-
\??\c:\bjfvbjd.exec:\bjfvbjd.exe121⤵PID:1160
-
\??\c:\pnjjdrf.exec:\pnjjdrf.exe122⤵PID:876
-
\??\c:\bpxrj.exec:\bpxrj.exe123⤵PID:1184
-
\??\c:\vppbddb.exec:\vppbddb.exe124⤵PID:1976
-
\??\c:\pdjfp.exec:\pdjfp.exe125⤵PID:368
-
\??\c:\jffrd.exec:\jffrd.exe126⤵PID:2992
-
\??\c:\vblhd.exec:\vblhd.exe127⤵PID:2088
-
\??\c:\hbtxh.exec:\hbtxh.exe128⤵PID:1536
-
\??\c:\pbfhtr.exec:\pbfhtr.exe129⤵PID:292
-
\??\c:\btjvplt.exec:\btjvplt.exe130⤵PID:2820
-
\??\c:\prxxn.exec:\prxxn.exe131⤵PID:2212
-
\??\c:\bjhxbh.exec:\bjhxbh.exe132⤵PID:2080
-
\??\c:\frdfnp.exec:\frdfnp.exe133⤵PID:1392
-
\??\c:\xfbbxv.exec:\xfbbxv.exe134⤵PID:2868
-
\??\c:\tjxhdxp.exec:\tjxhdxp.exe135⤵PID:2524
-
\??\c:\njrdh.exec:\njrdh.exe136⤵PID:2768
-
\??\c:\fbtpnhp.exec:\fbtpnhp.exe137⤵PID:2460
-
\??\c:\fflnbt.exec:\fflnbt.exe138⤵PID:2484
-
\??\c:\rrtjjth.exec:\rrtjjth.exe139⤵PID:2504
-
\??\c:\bdtjlr.exec:\bdtjlr.exe140⤵PID:1344
-
\??\c:\tlfpb.exec:\tlfpb.exe141⤵PID:2344
-
\??\c:\fnlnpr.exec:\fnlnpr.exe142⤵PID:2396
-
\??\c:\jffvr.exec:\jffvr.exe143⤵PID:2404
-
\??\c:\xthpjn.exec:\xthpjn.exe144⤵PID:2856
-
\??\c:\fvndrrh.exec:\fvndrrh.exe145⤵PID:2128
-
\??\c:\rfndr.exec:\rfndr.exe146⤵PID:1952
-
\??\c:\hffhdfv.exec:\hffhdfv.exe147⤵PID:904
-
\??\c:\jrvlhl.exec:\jrvlhl.exe148⤵PID:1308
-
\??\c:\dvjbl.exec:\dvjbl.exe149⤵PID:2300
-
\??\c:\htrtxt.exec:\htrtxt.exe150⤵PID:1252
-
\??\c:\nhpfj.exec:\nhpfj.exe151⤵PID:112
-
\??\c:\bbbjrb.exec:\bbbjrb.exe152⤵PID:1916
-
\??\c:\vfpppr.exec:\vfpppr.exe153⤵PID:1108
-
\??\c:\xfbjj.exec:\xfbjj.exe154⤵PID:948
-
\??\c:\nrnxfnv.exec:\nrnxfnv.exe155⤵PID:1360
-
\??\c:\xrxxlj.exec:\xrxxlj.exe156⤵PID:800
-
\??\c:\ptthh.exec:\ptthh.exe157⤵PID:1596
-
\??\c:\vnjvnl.exec:\vnjvnl.exe158⤵PID:2428
-
\??\c:\nphfflj.exec:\nphfflj.exe159⤵PID:2796
-
\??\c:\hntdtnb.exec:\hntdtnb.exe160⤵PID:2788
-
\??\c:\xdxff.exec:\xdxff.exe161⤵PID:2748
-
\??\c:\nlvhfnv.exec:\nlvhfnv.exe162⤵PID:1100
-
\??\c:\bxbnrdb.exec:\bxbnrdb.exe163⤵PID:1212
-
\??\c:\tlxpph.exec:\tlxpph.exe164⤵PID:1084
-
\??\c:\nftvnj.exec:\nftvnj.exe165⤵PID:1572
-
\??\c:\lfjxl.exec:\lfjxl.exe166⤵PID:1828
-
\??\c:\ntdprv.exec:\ntdprv.exe167⤵PID:1564
-
\??\c:\xfrthv.exec:\xfrthv.exe168⤵PID:1624
-
\??\c:\ddjpn.exec:\ddjpn.exe169⤵PID:2828
-
\??\c:\pndhv.exec:\pndhv.exe170⤵PID:1628
-
\??\c:\hvnvjdj.exec:\hvnvjdj.exe171⤵PID:1184
-
\??\c:\hnvpnb.exec:\hnvpnb.exe172⤵PID:1508
-
\??\c:\nvfvfxn.exec:\nvfvfxn.exe173⤵PID:1676
-
\??\c:\jhtbtr.exec:\jhtbtr.exe174⤵PID:2296
-
\??\c:\xvnntr.exec:\xvnntr.exe175⤵PID:240
-
\??\c:\fpfhd.exec:\fpfhd.exe176⤵PID:2236
-
\??\c:\drpfht.exec:\drpfht.exe177⤵PID:2268
-
\??\c:\hpnddht.exec:\hpnddht.exe178⤵PID:2628
-
\??\c:\xdrhf.exec:\xdrhf.exe179⤵PID:2216
-
\??\c:\nxnxf.exec:\nxnxf.exe180⤵PID:1324
-
\??\c:\fpxfhbh.exec:\fpxfhbh.exe181⤵PID:2940
-
\??\c:\hjjfdbb.exec:\hjjfdbb.exe182⤵PID:2684
-
\??\c:\vpfplhb.exec:\vpfplhb.exe183⤵PID:1740
-
\??\c:\rdtbjb.exec:\rdtbjb.exe184⤵PID:2440
-
\??\c:\hlxbr.exec:\hlxbr.exe185⤵PID:2672
-
\??\c:\fjrvd.exec:\fjrvd.exe186⤵PID:2464
-
\??\c:\rvhntl.exec:\rvhntl.exe187⤵PID:2332
-
\??\c:\rrflfbf.exec:\rrflfbf.exe188⤵PID:2380
-
\??\c:\ntvjjv.exec:\ntvjjv.exe189⤵PID:2764
-
\??\c:\tfjhnff.exec:\tfjhnff.exe190⤵PID:2376
-
\??\c:\nhbhl.exec:\nhbhl.exe191⤵PID:2404
-
\??\c:\tvhdp.exec:\tvhdp.exe192⤵PID:812
-
\??\c:\ddnlnfh.exec:\ddnlnfh.exe193⤵PID:1660
-
\??\c:\rbrxtn.exec:\rbrxtn.exe194⤵PID:1052
-
\??\c:\pfxblfh.exec:\pfxblfh.exe195⤵PID:1912
-
\??\c:\tjpjt.exec:\tjpjt.exe196⤵PID:1476
-
\??\c:\ndhph.exec:\ndhph.exe197⤵PID:1920
-
\??\c:\rxpffv.exec:\rxpffv.exe198⤵PID:2184
-
\??\c:\vpftnl.exec:\vpftnl.exe199⤵PID:1168
-
\??\c:\pxtjpj.exec:\pxtjpj.exe200⤵PID:1156
-
\??\c:\hndftnr.exec:\hndftnr.exe201⤵PID:2012
-
\??\c:\nvxtf.exec:\nvxtf.exe202⤵PID:944
-
\??\c:\nxrbjj.exec:\nxrbjj.exe203⤵PID:1756
-
\??\c:\vldxthv.exec:\vldxthv.exe204⤵PID:2400
-
\??\c:\rbrjt.exec:\rbrjt.exe205⤵PID:800
-
\??\c:\dtvfpb.exec:\dtvfpb.exe206⤵PID:808
-
\??\c:\dtpjf.exec:\dtpjf.exe207⤵PID:2792
-
\??\c:\vnblbh.exec:\vnblbh.exe208⤵PID:3020
-
\??\c:\ldtpbth.exec:\ldtpbth.exe209⤵PID:2252
-
\??\c:\brltxp.exec:\brltxp.exe210⤵PID:2724
-
\??\c:\ttllfhx.exec:\ttllfhx.exe211⤵PID:1048
-
\??\c:\pbhjp.exec:\pbhjp.exe212⤵PID:1212
-
\??\c:\pddrthl.exec:\pddrthl.exe213⤵PID:2884
-
\??\c:\vndpvr.exec:\vndpvr.exe214⤵PID:1700
-
\??\c:\rxljb.exec:\rxljb.exe215⤵PID:2208
-
\??\c:\rnthb.exec:\rnthb.exe216⤵PID:328
-
\??\c:\djfndr.exec:\djfndr.exe217⤵PID:2744
-
\??\c:\xhtppf.exec:\xhtppf.exe218⤵PID:1980
-
\??\c:\lpxjb.exec:\lpxjb.exe219⤵PID:840
-
\??\c:\npdhn.exec:\npdhn.exe220⤵PID:1088
-
\??\c:\nvpdx.exec:\nvpdx.exe221⤵PID:3000
-
\??\c:\lnhfbx.exec:\lnhfbx.exe222⤵PID:2116
-
\??\c:\prhfv.exec:\prhfv.exe223⤵PID:892
-
\??\c:\hrvxjp.exec:\hrvxjp.exe224⤵PID:1164
-
\??\c:\nbnvl.exec:\nbnvl.exe225⤵PID:2264
-
\??\c:\bbnftj.exec:\bbnftj.exe226⤵PID:2052
-
\??\c:\nvbdf.exec:\nvbdf.exe227⤵PID:1588
-
\??\c:\tbrvfdx.exec:\tbrvfdx.exe228⤵PID:2212
-
\??\c:\dxvdth.exec:\dxvdth.exe229⤵PID:1332
-
\??\c:\hfxlf.exec:\hfxlf.exe230⤵PID:2632
-
\??\c:\fhhrfr.exec:\fhhrfr.exe231⤵PID:2680
-
\??\c:\vfrpbx.exec:\vfrpbx.exe232⤵PID:2436
-
\??\c:\hlldltl.exec:\hlldltl.exe233⤵PID:2568
-
\??\c:\bhbjbtp.exec:\bhbjbtp.exe234⤵PID:2340
-
\??\c:\rrfvtbx.exec:\rrfvtbx.exe235⤵PID:908
-
\??\c:\bxjbtvx.exec:\bxjbtvx.exe236⤵PID:2332
-
\??\c:\hhjtnh.exec:\hhjtnh.exe237⤵PID:2336
-
\??\c:\htfptd.exec:\htfptd.exe238⤵PID:2380
-
\??\c:\ftbpvx.exec:\ftbpvx.exe239⤵PID:2776
-
\??\c:\plndln.exec:\plndln.exe240⤵PID:2396
-
\??\c:\pbxjdb.exec:\pbxjdb.exe241⤵PID:2856
-
\??\c:\nlldxx.exec:\nlldxx.exe242⤵PID:1424