Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 21:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
00f3bb2a1cb8c52766d4a8ccb13fd3e0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
00f3bb2a1cb8c52766d4a8ccb13fd3e0_NeikiAnalytics.exe
-
Size
104KB
-
MD5
00f3bb2a1cb8c52766d4a8ccb13fd3e0
-
SHA1
8ce46497761da9755a9a504f4deaa8963ac6669e
-
SHA256
c1a7161990678415c176e4164ffbebcdbb949fc9e77a708d841a60200e8ad5d0
-
SHA512
c83f9a484d7b3995e3dc2a35e493f16507e62d09ca278aadfe07fc77ef2f08c95d648deffb08c9f6c5303747f54d4591eb1794ba314f648dea601181d5c026d4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoTNKDeS98hPUdHV7RNzfJNc:ymb3NkkiQ3mdBjFo5KDe88g1fDc
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral1/memory/1704-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1600-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/628-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/780-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1888-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/980-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1832-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/608-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/468-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/948-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
drxxhx.exefbhlnjf.exeljpvjxh.exedxnlrl.exetrblh.exenrlxnb.exevjhftb.exedlxfbf.exexxxbrhf.exellbrxf.exeddlppxf.exevfjtj.exeltvdrx.exennhfddx.exevxlnrjp.exebrnntn.exevjlrj.exehtblnrb.exejdpphvx.exernjxvdj.exelvhpjhp.exenrxlrd.exexxdxdt.exefbvjdfx.exehxfpptd.exebtjfvlt.exehdlxd.exehtprrtp.exejlnhp.exerxpprl.exerlpnhb.exedlrjxn.exexnvpx.exepvpxb.exejbhvpf.exexdpnppd.exertdlfxl.exetprttt.exevdnjdtx.exefhdvj.exerpvfj.exednfhdl.exerttdb.exejbjpdjp.exeppfxll.exefbvjfdf.exevrxlnvt.exeflpnp.exerrhvxtx.exertljtrf.exejthhtr.exexdlfj.exebpttrjx.exeljjbhlv.exehjdtvxx.exeptpvfr.exejprhl.exephrbjf.exebfrxltn.exerhxnj.exevdnvn.exexbjdl.exetnxvl.exeprrbhr.exepid process 2612 drxxhx.exe 2616 fbhlnjf.exe 2528 ljpvjxh.exe 2724 dxnlrl.exe 2028 trblh.exe 2428 nrlxnb.exe 2944 vjhftb.exe 1172 dlxfbf.exe 1600 xxxbrhf.exe 628 llbrxf.exe 2792 ddlppxf.exe 1652 vfjtj.exe 1048 ltvdrx.exe 948 nnhfddx.exe 1988 vxlnrjp.exe 1952 brnntn.exe 1636 vjlrj.exe 468 htblnrb.exe 2316 jdpphvx.exe 780 rnjxvdj.exe 988 lvhpjhp.exe 440 nrxlrd.exe 1112 xxdxdt.exe 980 fbvjdfx.exe 1888 hxfpptd.exe 1832 btjfvlt.exe 608 hdlxd.exe 1268 htprrtp.exe 2188 jlnhp.exe 2340 rxpprl.exe 1596 rlpnhb.exe 1284 dlrjxn.exe 1572 xnvpx.exe 1456 pvpxb.exe 2640 jbhvpf.exe 2852 xdpnppd.exe 2656 rtdlfxl.exe 2664 tprttt.exe 2560 vdnjdtx.exe 2028 fhdvj.exe 2472 rpvfj.exe 2380 dnfhdl.exe 1056 rttdb.exe 2404 jbjpdjp.exe 2920 ppfxll.exe 1020 fbvjfdf.exe 2788 vrxlnvt.exe 2940 flpnp.exe 2832 rrhvxtx.exe 2804 rtljtrf.exe 944 jthhtr.exe 948 xdlfj.exe 1992 bpttrjx.exe 1536 ljjbhlv.exe 2288 hjdtvxx.exe 2860 ptpvfr.exe 940 jprhl.exe 380 phrbjf.exe 3048 bfrxltn.exe 816 rhxnj.exe 960 vdnvn.exe 1976 xbjdl.exe 692 tnxvl.exe 1384 prrbhr.exe -
Processes:
resource yara_rule behavioral1/memory/1704-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1600-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/628-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/780-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/608-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/468-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/948-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1172-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1172-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1172-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-47-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
00f3bb2a1cb8c52766d4a8ccb13fd3e0_NeikiAnalytics.exedrxxhx.exefbhlnjf.exeljpvjxh.exedxnlrl.exetrblh.exenrlxnb.exevjhftb.exedlxfbf.exexxxbrhf.exellbrxf.exeddlppxf.exevfjtj.exeltvdrx.exennhfddx.exevxlnrjp.exedescription pid process target process PID 1704 wrote to memory of 2612 1704 00f3bb2a1cb8c52766d4a8ccb13fd3e0_NeikiAnalytics.exe drxxhx.exe PID 1704 wrote to memory of 2612 1704 00f3bb2a1cb8c52766d4a8ccb13fd3e0_NeikiAnalytics.exe drxxhx.exe PID 1704 wrote to memory of 2612 1704 00f3bb2a1cb8c52766d4a8ccb13fd3e0_NeikiAnalytics.exe drxxhx.exe PID 1704 wrote to memory of 2612 1704 00f3bb2a1cb8c52766d4a8ccb13fd3e0_NeikiAnalytics.exe drxxhx.exe PID 2612 wrote to memory of 2616 2612 drxxhx.exe fbhlnjf.exe PID 2612 wrote to memory of 2616 2612 drxxhx.exe fbhlnjf.exe PID 2612 wrote to memory of 2616 2612 drxxhx.exe fbhlnjf.exe PID 2612 wrote to memory of 2616 2612 drxxhx.exe fbhlnjf.exe PID 2616 wrote to memory of 2528 2616 fbhlnjf.exe ljpvjxh.exe PID 2616 wrote to memory of 2528 2616 fbhlnjf.exe ljpvjxh.exe PID 2616 wrote to memory of 2528 2616 fbhlnjf.exe ljpvjxh.exe PID 2616 wrote to memory of 2528 2616 fbhlnjf.exe ljpvjxh.exe PID 2528 wrote to memory of 2724 2528 ljpvjxh.exe dxnlrl.exe PID 2528 wrote to memory of 2724 2528 ljpvjxh.exe dxnlrl.exe PID 2528 wrote to memory of 2724 2528 ljpvjxh.exe dxnlrl.exe PID 2528 wrote to memory of 2724 2528 ljpvjxh.exe dxnlrl.exe PID 2724 wrote to memory of 2028 2724 dxnlrl.exe trblh.exe PID 2724 wrote to memory of 2028 2724 dxnlrl.exe trblh.exe PID 2724 wrote to memory of 2028 2724 dxnlrl.exe trblh.exe PID 2724 wrote to memory of 2028 2724 dxnlrl.exe trblh.exe PID 2028 wrote to memory of 2428 2028 trblh.exe nrlxnb.exe PID 2028 wrote to memory of 2428 2028 trblh.exe nrlxnb.exe PID 2028 wrote to memory of 2428 2028 trblh.exe nrlxnb.exe PID 2028 wrote to memory of 2428 2028 trblh.exe nrlxnb.exe PID 2428 wrote to memory of 2944 2428 nrlxnb.exe vjhftb.exe PID 2428 wrote to memory of 2944 2428 nrlxnb.exe vjhftb.exe PID 2428 wrote to memory of 2944 2428 nrlxnb.exe vjhftb.exe PID 2428 wrote to memory of 2944 2428 nrlxnb.exe vjhftb.exe PID 2944 wrote to memory of 1172 2944 vjhftb.exe dlxfbf.exe PID 2944 wrote to memory of 1172 2944 vjhftb.exe dlxfbf.exe PID 2944 wrote to memory of 1172 2944 vjhftb.exe dlxfbf.exe PID 2944 wrote to memory of 1172 2944 vjhftb.exe dlxfbf.exe PID 1172 wrote to memory of 1600 1172 dlxfbf.exe xxxbrhf.exe PID 1172 wrote to memory of 1600 1172 dlxfbf.exe xxxbrhf.exe PID 1172 wrote to memory of 1600 1172 dlxfbf.exe xxxbrhf.exe PID 1172 wrote to memory of 1600 1172 dlxfbf.exe xxxbrhf.exe PID 1600 wrote to memory of 628 1600 xxxbrhf.exe llbrxf.exe PID 1600 wrote to memory of 628 1600 xxxbrhf.exe llbrxf.exe PID 1600 wrote to memory of 628 1600 xxxbrhf.exe llbrxf.exe PID 1600 wrote to memory of 628 1600 xxxbrhf.exe llbrxf.exe PID 628 wrote to memory of 2792 628 llbrxf.exe ddlppxf.exe PID 628 wrote to memory of 2792 628 llbrxf.exe ddlppxf.exe PID 628 wrote to memory of 2792 628 llbrxf.exe ddlppxf.exe PID 628 wrote to memory of 2792 628 llbrxf.exe ddlppxf.exe PID 2792 wrote to memory of 1652 2792 ddlppxf.exe vfjtj.exe PID 2792 wrote to memory of 1652 2792 ddlppxf.exe vfjtj.exe PID 2792 wrote to memory of 1652 2792 ddlppxf.exe vfjtj.exe PID 2792 wrote to memory of 1652 2792 ddlppxf.exe vfjtj.exe PID 1652 wrote to memory of 1048 1652 vfjtj.exe ltvdrx.exe PID 1652 wrote to memory of 1048 1652 vfjtj.exe ltvdrx.exe PID 1652 wrote to memory of 1048 1652 vfjtj.exe ltvdrx.exe PID 1652 wrote to memory of 1048 1652 vfjtj.exe ltvdrx.exe PID 1048 wrote to memory of 948 1048 ltvdrx.exe nnhfddx.exe PID 1048 wrote to memory of 948 1048 ltvdrx.exe nnhfddx.exe PID 1048 wrote to memory of 948 1048 ltvdrx.exe nnhfddx.exe PID 1048 wrote to memory of 948 1048 ltvdrx.exe nnhfddx.exe PID 948 wrote to memory of 1988 948 nnhfddx.exe vxlnrjp.exe PID 948 wrote to memory of 1988 948 nnhfddx.exe vxlnrjp.exe PID 948 wrote to memory of 1988 948 nnhfddx.exe vxlnrjp.exe PID 948 wrote to memory of 1988 948 nnhfddx.exe vxlnrjp.exe PID 1988 wrote to memory of 1952 1988 vxlnrjp.exe brnntn.exe PID 1988 wrote to memory of 1952 1988 vxlnrjp.exe brnntn.exe PID 1988 wrote to memory of 1952 1988 vxlnrjp.exe brnntn.exe PID 1988 wrote to memory of 1952 1988 vxlnrjp.exe brnntn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00f3bb2a1cb8c52766d4a8ccb13fd3e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\00f3bb2a1cb8c52766d4a8ccb13fd3e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\drxxhx.exec:\drxxhx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\fbhlnjf.exec:\fbhlnjf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ljpvjxh.exec:\ljpvjxh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\dxnlrl.exec:\dxnlrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\trblh.exec:\trblh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\nrlxnb.exec:\nrlxnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\vjhftb.exec:\vjhftb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\dlxfbf.exec:\dlxfbf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\xxxbrhf.exec:\xxxbrhf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\llbrxf.exec:\llbrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\ddlppxf.exec:\ddlppxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\vfjtj.exec:\vfjtj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\ltvdrx.exec:\ltvdrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\nnhfddx.exec:\nnhfddx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\vxlnrjp.exec:\vxlnrjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\brnntn.exec:\brnntn.exe17⤵
- Executes dropped EXE
PID:1952 -
\??\c:\vjlrj.exec:\vjlrj.exe18⤵
- Executes dropped EXE
PID:1636 -
\??\c:\htblnrb.exec:\htblnrb.exe19⤵
- Executes dropped EXE
PID:468 -
\??\c:\jdpphvx.exec:\jdpphvx.exe20⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rnjxvdj.exec:\rnjxvdj.exe21⤵
- Executes dropped EXE
PID:780 -
\??\c:\lvhpjhp.exec:\lvhpjhp.exe22⤵
- Executes dropped EXE
PID:988 -
\??\c:\nrxlrd.exec:\nrxlrd.exe23⤵
- Executes dropped EXE
PID:440 -
\??\c:\xxdxdt.exec:\xxdxdt.exe24⤵
- Executes dropped EXE
PID:1112 -
\??\c:\fbvjdfx.exec:\fbvjdfx.exe25⤵
- Executes dropped EXE
PID:980 -
\??\c:\hxfpptd.exec:\hxfpptd.exe26⤵
- Executes dropped EXE
PID:1888 -
\??\c:\btjfvlt.exec:\btjfvlt.exe27⤵
- Executes dropped EXE
PID:1832 -
\??\c:\hdlxd.exec:\hdlxd.exe28⤵
- Executes dropped EXE
PID:608 -
\??\c:\htprrtp.exec:\htprrtp.exe29⤵
- Executes dropped EXE
PID:1268 -
\??\c:\jlnhp.exec:\jlnhp.exe30⤵
- Executes dropped EXE
PID:2188 -
\??\c:\rxpprl.exec:\rxpprl.exe31⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rlpnhb.exec:\rlpnhb.exe32⤵
- Executes dropped EXE
PID:1596 -
\??\c:\dlrjxn.exec:\dlrjxn.exe33⤵
- Executes dropped EXE
PID:1284 -
\??\c:\xnvpx.exec:\xnvpx.exe34⤵
- Executes dropped EXE
PID:1572 -
\??\c:\pvpxb.exec:\pvpxb.exe35⤵
- Executes dropped EXE
PID:1456 -
\??\c:\jbhvpf.exec:\jbhvpf.exe36⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xdpnppd.exec:\xdpnppd.exe37⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rtdlfxl.exec:\rtdlfxl.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\tprttt.exec:\tprttt.exe39⤵
- Executes dropped EXE
PID:2664 -
\??\c:\vdnjdtx.exec:\vdnjdtx.exe40⤵
- Executes dropped EXE
PID:2560 -
\??\c:\fhdvj.exec:\fhdvj.exe41⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rpvfj.exec:\rpvfj.exe42⤵
- Executes dropped EXE
PID:2472 -
\??\c:\dnfhdl.exec:\dnfhdl.exe43⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rttdb.exec:\rttdb.exe44⤵
- Executes dropped EXE
PID:1056 -
\??\c:\jbjpdjp.exec:\jbjpdjp.exe45⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ppfxll.exec:\ppfxll.exe46⤵
- Executes dropped EXE
PID:2920 -
\??\c:\fbvjfdf.exec:\fbvjfdf.exe47⤵
- Executes dropped EXE
PID:1020 -
\??\c:\vrxlnvt.exec:\vrxlnvt.exe48⤵
- Executes dropped EXE
PID:2788 -
\??\c:\flpnp.exec:\flpnp.exe49⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rrhvxtx.exec:\rrhvxtx.exe50⤵
- Executes dropped EXE
PID:2832 -
\??\c:\rtljtrf.exec:\rtljtrf.exe51⤵
- Executes dropped EXE
PID:2804 -
\??\c:\jthhtr.exec:\jthhtr.exe52⤵
- Executes dropped EXE
PID:944 -
\??\c:\xdlfj.exec:\xdlfj.exe53⤵
- Executes dropped EXE
PID:948 -
\??\c:\bpttrjx.exec:\bpttrjx.exe54⤵
- Executes dropped EXE
PID:1992 -
\??\c:\ljjbhlv.exec:\ljjbhlv.exe55⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hjdtvxx.exec:\hjdtvxx.exe56⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ptpvfr.exec:\ptpvfr.exe57⤵
- Executes dropped EXE
PID:2860 -
\??\c:\jprhl.exec:\jprhl.exe58⤵
- Executes dropped EXE
PID:940 -
\??\c:\phrbjf.exec:\phrbjf.exe59⤵
- Executes dropped EXE
PID:380 -
\??\c:\bfrxltn.exec:\bfrxltn.exe60⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rhxnj.exec:\rhxnj.exe61⤵
- Executes dropped EXE
PID:816 -
\??\c:\vdnvn.exec:\vdnvn.exe62⤵
- Executes dropped EXE
PID:960 -
\??\c:\xbjdl.exec:\xbjdl.exe63⤵
- Executes dropped EXE
PID:1976 -
\??\c:\tnxvl.exec:\tnxvl.exe64⤵
- Executes dropped EXE
PID:692 -
\??\c:\prrbhr.exec:\prrbhr.exe65⤵
- Executes dropped EXE
PID:1384 -
\??\c:\djbhn.exec:\djbhn.exe66⤵PID:1800
-
\??\c:\xdnpbfn.exec:\xdnpbfn.exe67⤵PID:1672
-
\??\c:\jfrdpjr.exec:\jfrdpjr.exe68⤵PID:1728
-
\??\c:\pbrbppp.exec:\pbrbppp.exe69⤵PID:884
-
\??\c:\bhlljd.exec:\bhlljd.exe70⤵PID:2904
-
\??\c:\njbdrhh.exec:\njbdrhh.exe71⤵PID:1668
-
\??\c:\jdxlf.exec:\jdxlf.exe72⤵PID:1628
-
\??\c:\lvxjr.exec:\lvxjr.exe73⤵PID:2916
-
\??\c:\lbjtfvt.exec:\lbjtfvt.exe74⤵PID:2356
-
\??\c:\vrnpf.exec:\vrnpf.exe75⤵PID:2912
-
\??\c:\njfdbd.exec:\njfdbd.exe76⤵PID:2668
-
\??\c:\lpphvv.exec:\lpphvv.exe77⤵PID:2612
-
\??\c:\hvhlfrp.exec:\hvhlfrp.exe78⤵PID:2692
-
\??\c:\tbjjlj.exec:\tbjjlj.exe79⤵PID:2676
-
\??\c:\fddrjnp.exec:\fddrjnp.exe80⤵PID:2680
-
\??\c:\ldlfd.exec:\ldlfd.exe81⤵PID:2608
-
\??\c:\rjtdd.exec:\rjtdd.exe82⤵PID:3008
-
\??\c:\rxvvv.exec:\rxvvv.exe83⤵PID:2588
-
\??\c:\htdplx.exec:\htdplx.exe84⤵PID:1336
-
\??\c:\jtpxx.exec:\jtpxx.exe85⤵PID:2476
-
\??\c:\xppbrnt.exec:\xppbrnt.exe86⤵PID:2424
-
\??\c:\rfjdt.exec:\rfjdt.exe87⤵PID:1172
-
\??\c:\hjdfhxl.exec:\hjdfhxl.exe88⤵PID:2376
-
\??\c:\bpdrxx.exec:\bpdrxx.exe89⤵PID:308
-
\??\c:\tbbbfnn.exec:\tbbbfnn.exe90⤵PID:2760
-
\??\c:\nnpvp.exec:\nnpvp.exe91⤵PID:3028
-
\??\c:\jllvx.exec:\jllvx.exe92⤵PID:2672
-
\??\c:\vfxpvjn.exec:\vfxpvjn.exe93⤵PID:1252
-
\??\c:\lpnrtp.exec:\lpnrtp.exe94⤵PID:2012
-
\??\c:\dpjbjf.exec:\dpjbjf.exe95⤵PID:760
-
\??\c:\tvxdrbl.exec:\tvxdrbl.exe96⤵PID:1736
-
\??\c:\plxnt.exec:\plxnt.exe97⤵PID:1448
-
\??\c:\vttdpn.exec:\vttdpn.exe98⤵PID:1664
-
\??\c:\jndbl.exec:\jndbl.exe99⤵PID:2876
-
\??\c:\hlhlx.exec:\hlhlx.exe100⤵PID:468
-
\??\c:\xplpxd.exec:\xplpxd.exe101⤵PID:2060
-
\??\c:\hbhlh.exec:\hbhlh.exe102⤵PID:3044
-
\??\c:\ljlrx.exec:\ljlrx.exe103⤵PID:2248
-
\??\c:\rbtpj.exec:\rbtpj.exe104⤵PID:3068
-
\??\c:\xxbthf.exec:\xxbthf.exe105⤵PID:2240
-
\??\c:\bxfjr.exec:\bxfjr.exe106⤵PID:1060
-
\??\c:\rfnhd.exec:\rfnhd.exe107⤵PID:1812
-
\??\c:\tbxbf.exec:\tbxbf.exe108⤵PID:1128
-
\??\c:\fxnpld.exec:\fxnpld.exe109⤵PID:2324
-
\??\c:\xhxjfhp.exec:\xhxjfhp.exe110⤵PID:1672
-
\??\c:\trhbvv.exec:\trhbvv.exe111⤵PID:1948
-
\??\c:\hdptd.exec:\hdptd.exe112⤵PID:916
-
\??\c:\djvhfnp.exec:\djvhfnp.exe113⤵PID:1724
-
\??\c:\xdflh.exec:\xdflh.exe114⤵PID:1748
-
\??\c:\drnttlt.exec:\drnttlt.exe115⤵PID:2340
-
\??\c:\brxltnt.exec:\brxltnt.exe116⤵PID:2836
-
\??\c:\xlpft.exec:\xlpft.exe117⤵PID:1368
-
\??\c:\jfvlhp.exec:\jfvlhp.exe118⤵PID:1284
-
\??\c:\vhnddx.exec:\vhnddx.exe119⤵PID:1572
-
\??\c:\tfjvprt.exec:\tfjvprt.exe120⤵PID:1456
-
\??\c:\lndlbvv.exec:\lndlbvv.exe121⤵PID:2640
-
\??\c:\lfhnl.exec:\lfhnl.exe122⤵PID:2584
-
\??\c:\rdpvxv.exec:\rdpvxv.exe123⤵PID:2656
-
\??\c:\dxtvpx.exec:\dxtvpx.exe124⤵PID:2540
-
\??\c:\bntbllp.exec:\bntbllp.exe125⤵PID:2444
-
\??\c:\fnffj.exec:\fnffj.exe126⤵PID:2440
-
\??\c:\vrnxfhn.exec:\vrnxfhn.exe127⤵PID:2472
-
\??\c:\dlbbndl.exec:\dlbbndl.exe128⤵PID:2408
-
\??\c:\vpbbt.exec:\vpbbt.exe129⤵PID:2488
-
\??\c:\pphnhrx.exec:\pphnhrx.exe130⤵PID:1604
-
\??\c:\pxbnvfj.exec:\pxbnvfj.exe131⤵PID:2348
-
\??\c:\lrjbftv.exec:\lrjbftv.exe132⤵PID:2388
-
\??\c:\bnbdbp.exec:\bnbdbp.exe133⤵PID:1676
-
\??\c:\thdtv.exec:\thdtv.exe134⤵PID:1892
-
\??\c:\rttxxhr.exec:\rttxxhr.exe135⤵PID:1848
-
\??\c:\bnlvth.exec:\bnlvth.exe136⤵PID:2824
-
\??\c:\vjhbb.exec:\vjhbb.exe137⤵PID:1776
-
\??\c:\lblpp.exec:\lblpp.exe138⤵PID:2144
-
\??\c:\xvlnr.exec:\xvlnr.exe139⤵PID:2312
-
\??\c:\jjxbbb.exec:\jjxbbb.exe140⤵PID:596
-
\??\c:\vpfhxbl.exec:\vpfhxbl.exe141⤵PID:2872
-
\??\c:\fnhljfh.exec:\fnhljfh.exe142⤵PID:2860
-
\??\c:\jrhxp.exec:\jrhxp.exe143⤵PID:1680
-
\??\c:\xhnbvxr.exec:\xhnbvxr.exe144⤵PID:2880
-
\??\c:\hdbpx.exec:\hdbpx.exe145⤵PID:3048
-
\??\c:\vvhlrx.exec:\vvhlrx.exe146⤵PID:3032
-
\??\c:\hljpfdv.exec:\hljpfdv.exe147⤵PID:960
-
\??\c:\jtnlxj.exec:\jtnlxj.exe148⤵PID:1588
-
\??\c:\xvtdjpr.exec:\xvtdjpr.exe149⤵PID:1148
-
\??\c:\jnnpb.exec:\jnnpb.exe150⤵PID:1384
-
\??\c:\nbltnvf.exec:\nbltnvf.exe151⤵PID:772
-
\??\c:\hdlptbv.exec:\hdlptbv.exe152⤵PID:1796
-
\??\c:\hhthjj.exec:\hhthjj.exe153⤵PID:2020
-
\??\c:\xtvpn.exec:\xtvpn.exe154⤵PID:2196
-
\??\c:\nrvjp.exec:\nrvjp.exe155⤵PID:1180
-
\??\c:\lldvr.exec:\lldvr.exe156⤵PID:2188
-
\??\c:\trxrlf.exec:\trxrlf.exe157⤵PID:1872
-
\??\c:\nrxpjx.exec:\nrxpjx.exe158⤵PID:2660
-
\??\c:\xtnlttx.exec:\xtnlttx.exe159⤵PID:1512
-
\??\c:\dpfjh.exec:\dpfjh.exe160⤵PID:1704
-
\??\c:\phtpft.exec:\phtpft.exe161⤵PID:1752
-
\??\c:\bhlrfrj.exec:\bhlrfrj.exe162⤵PID:2624
-
\??\c:\rjnlj.exec:\rjnlj.exe163⤵PID:2688
-
\??\c:\lldrrl.exec:\lldrrl.exe164⤵PID:2640
-
\??\c:\dtbpt.exec:\dtbpt.exe165⤵PID:2680
-
\??\c:\xbhbb.exec:\xbhbb.exe166⤵PID:2436
-
\??\c:\fblrhl.exec:\fblrhl.exe167⤵PID:2596
-
\??\c:\ffbdfx.exec:\ffbdfx.exe168⤵PID:2992
-
\??\c:\vxrdh.exec:\vxrdh.exe169⤵PID:2428
-
\??\c:\hplprr.exec:\hplprr.exe170⤵PID:2380
-
\??\c:\lrrnnpt.exec:\lrrnnpt.exe171⤵PID:1056
-
\??\c:\prrtd.exec:\prrtd.exe172⤵PID:1956
-
\??\c:\rrhtv.exec:\rrhtv.exe173⤵PID:2920
-
\??\c:\phtbb.exec:\phtbb.exe174⤵PID:580
-
\??\c:\tvphlxd.exec:\tvphlxd.exe175⤵PID:1616
-
\??\c:\lpnbhpx.exec:\lpnbhpx.exe176⤵PID:2768
-
\??\c:\tfbxl.exec:\tfbxl.exe177⤵PID:2832
-
\??\c:\dldpp.exec:\dldpp.exe178⤵PID:2772
-
\??\c:\bdfhr.exec:\bdfhr.exe179⤵PID:1376
-
\??\c:\lprxt.exec:\lprxt.exe180⤵PID:1516
-
\??\c:\pjxthh.exec:\pjxthh.exe181⤵PID:1952
-
\??\c:\jjpfp.exec:\jjpfp.exe182⤵PID:2180
-
\??\c:\lljjjl.exec:\lljjjl.exe183⤵PID:1636
-
\??\c:\bptptbt.exec:\bptptbt.exe184⤵PID:1412
-
\??\c:\phtvjj.exec:\phtvjj.exe185⤵PID:1396
-
\??\c:\dvvjrpl.exec:\dvvjrpl.exe186⤵PID:2052
-
\??\c:\blfflph.exec:\blfflph.exe187⤵PID:112
-
\??\c:\tlttpbv.exec:\tlttpbv.exe188⤵PID:2072
-
\??\c:\rrbvt.exec:\rrbvt.exe189⤵PID:1444
-
\??\c:\btfhd.exec:\btfhd.exe190⤵PID:1440
-
\??\c:\hltfvpp.exec:\hltfvpp.exe191⤵PID:3060
-
\??\c:\tjlvpl.exec:\tjlvpl.exe192⤵PID:1888
-
\??\c:\blthhv.exec:\blthhv.exe193⤵PID:320
-
\??\c:\vttdvx.exec:\vttdvx.exe194⤵PID:1816
-
\??\c:\jbpxhdv.exec:\jbpxhdv.exe195⤵PID:2116
-
\??\c:\jbfvv.exec:\jbfvv.exe196⤵PID:844
-
\??\c:\ntpbdjp.exec:\ntpbdjp.exe197⤵PID:1044
-
\??\c:\hlnjn.exec:\hlnjn.exe198⤵PID:1316
-
\??\c:\pvlpf.exec:\pvlpf.exe199⤵PID:2064
-
\??\c:\jvlbhvr.exec:\jvlbhvr.exe200⤵PID:588
-
\??\c:\hxdfbl.exec:\hxdfbl.exe201⤵PID:900
-
\??\c:\xlrphr.exec:\xlrphr.exe202⤵PID:1768
-
\??\c:\rfjjj.exec:\rfjjj.exe203⤵PID:2572
-
\??\c:\llxtdhp.exec:\llxtdhp.exe204⤵PID:2568
-
\??\c:\lntnptp.exec:\lntnptp.exe205⤵PID:2564
-
\??\c:\vndfvbv.exec:\vndfvbv.exe206⤵PID:2692
-
\??\c:\bbnfnrf.exec:\bbnfnrf.exe207⤵PID:2004
-
\??\c:\jvfpbn.exec:\jvfpbn.exe208⤵PID:2592
-
\??\c:\xfvxjjb.exec:\xfvxjjb.exe209⤵PID:2608
-
\??\c:\nhdrllf.exec:\nhdrllf.exe210⤵PID:3008
-
\??\c:\vnpxn.exec:\vnpxn.exe211⤵PID:2588
-
\??\c:\ffdlb.exec:\ffdlb.exe212⤵PID:2472
-
\??\c:\ntthbhv.exec:\ntthbhv.exe213⤵PID:636
-
\??\c:\vbxhhj.exec:\vbxhhj.exe214⤵PID:2268
-
\??\c:\nnlrxl.exec:\nnlrxl.exe215⤵PID:2784
-
\??\c:\pbhff.exec:\pbhff.exe216⤵PID:2796
-
\??\c:\hvhxhv.exec:\hvhxhv.exe217⤵PID:2812
-
\??\c:\lpnfn.exec:\lpnfn.exe218⤵PID:2388
-
\??\c:\dlrphnn.exec:\dlrphnn.exe219⤵PID:1936
-
\??\c:\hhfxbtl.exec:\hhfxbtl.exe220⤵PID:812
-
\??\c:\xlbhrdj.exec:\xlbhrdj.exe221⤵PID:956
-
\??\c:\jtphdr.exec:\jtphdr.exe222⤵PID:768
-
\??\c:\vxbbh.exec:\vxbbh.exe223⤵PID:1032
-
\??\c:\rpjltf.exec:\rpjltf.exe224⤵PID:1640
-
\??\c:\ljttbnt.exec:\ljttbnt.exe225⤵PID:2288
-
\??\c:\lpxllfd.exec:\lpxllfd.exe226⤵PID:3052
-
\??\c:\fblfx.exec:\fblfx.exe227⤵PID:2272
-
\??\c:\xjhdjdh.exec:\xjhdjdh.exe228⤵PID:780
-
\??\c:\hxpld.exec:\hxpld.exe229⤵PID:3016
-
\??\c:\fdvpxd.exec:\fdvpxd.exe230⤵PID:1984
-
\??\c:\vhttbd.exec:\vhttbd.exe231⤵PID:1852
-
\??\c:\fffxvdl.exec:\fffxvdl.exe232⤵PID:1416
-
\??\c:\hrxbdx.exec:\hrxbdx.exe233⤵PID:692
-
\??\c:\rrbvp.exec:\rrbvp.exe234⤵PID:1140
-
\??\c:\bdbjnxr.exec:\bdbjnxr.exe235⤵PID:1008
-
\??\c:\hdxxplr.exec:\hdxxplr.exe236⤵PID:1128
-
\??\c:\tfplrp.exec:\tfplrp.exe237⤵PID:772
-
\??\c:\pfbjtn.exec:\pfbjtn.exe238⤵PID:2140
-
\??\c:\lbbnpn.exec:\lbbnpn.exe239⤵PID:1828
-
\??\c:\jhvdt.exec:\jhvdt.exe240⤵PID:2196
-
\??\c:\rbrlnbr.exec:\rbrlnbr.exe241⤵PID:2896
-
\??\c:\xtpltr.exec:\xtpltr.exe242⤵PID:1748