Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 05:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
82b5b28bf10b2ab7ae51ccd0092a2450_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
82b5b28bf10b2ab7ae51ccd0092a2450_NeikiAnalytics.exe
-
Size
459KB
-
MD5
82b5b28bf10b2ab7ae51ccd0092a2450
-
SHA1
9f61740d4f5283742cf89d05e8417458d1f018e3
-
SHA256
65b81e8cef99e610763010f25351ff6503e786dc43047a23fe32cdbd2d1a6ff1
-
SHA512
4b803662c0b5e4eee384a7c3fa5645f477431f26076cb988ffe8bcc560df0b613afe4e71328c3c7b5c7852ecc5df95eccf54d1cb65297284f4f11e5d6c564fa2
-
SSDEEP
6144:Pcm7ImGddXtWrXD486jJq1BStv4Ib1Hmp:d7Tc9Wj16A3Stvxc
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
Processes:
resource yara_rule behavioral1/memory/1688-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-99-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1392-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1392-109-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2448-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1080-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-147-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2152-157-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2152-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1424-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1164-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/932-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/436-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-252-0x0000000001C60000-0x0000000001C89000-memory.dmp family_blackmoon behavioral1/memory/1992-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-268-0x00000000003B0000-0x00000000003D9000-memory.dmp family_blackmoon behavioral1/memory/1688-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-370-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-377-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-391-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1392-423-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-477-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-534-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-545-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-543-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-610-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-690-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1428-753-0x00000000003B0000-0x00000000003D9000-memory.dmp family_blackmoon behavioral1/memory/1812-776-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rrbxhfx.exejdnxrd.exeflrhrdx.exevvdrh.exenvrhl.exelprll.exevplfv.exerprbtb.exebnjvvn.exedpfln.exennrjrnl.exeplntp.exerdllh.exejbdplpj.exelthvdl.exefjxxr.exexlhvd.exehnvhnr.exehvddpt.exeplpvlv.exehnnndnn.exetpfhhvp.exertfxht.exebblnpdf.exelfjrxxl.exexfbhv.exetlrxjjl.exenxbpdd.exedhjfvx.exerdvlrht.exevrdnj.exerxvphxn.exedjlhvfr.exelfpfxv.exejrhtfxp.exepxphx.exerfhvft.exedfxrll.exefjbdt.exelbhjx.exenndxxvn.exenbjvpl.exevjprp.exefnrvxtt.exeffhvx.exendfvln.exebhlvp.exejvpbvf.exebbpfl.exepdrpvl.exextpdjj.exehvddx.exepffnp.exeprvpd.exefvbtfv.exevvrrfbn.exertbfx.exejhjvr.exerbxdj.exehhhdh.exexlfbv.exehffxl.exenpnff.exevnlrrv.exepid process 2228 rrbxhfx.exe 3024 jdnxrd.exe 2500 flrhrdx.exe 2504 vvdrh.exe 2356 nvrhl.exe 2436 lprll.exe 2360 vplfv.exe 2392 rprbtb.exe 1124 bnjvvn.exe 2328 dpfln.exe 1392 nnrjrnl.exe 2448 plntp.exe 2388 rdllh.exe 1672 jbdplpj.exe 1080 lthvdl.exe 2152 fjxxr.exe 1424 xlhvd.exe 1164 hnvhnr.exe 932 hvddpt.exe 2444 plpvlv.exe 2276 hnnndnn.exe 2896 tpfhhvp.exe 528 rtfxht.exe 436 bblnpdf.exe 1144 lfjrxxl.exe 2004 xfbhv.exe 1992 tlrxjjl.exe 2908 nxbpdd.exe 748 dhjfvx.exe 2912 rdvlrht.exe 1484 vrdnj.exe 2348 rxvphxn.exe 864 djlhvfr.exe 2104 lfpfxv.exe 1688 jrhtfxp.exe 2108 pxphx.exe 1596 rfhvft.exe 2552 dfxrll.exe 2608 fjbdt.exe 2456 lbhjx.exe 2504 nndxxvn.exe 2384 nbjvpl.exe 2376 vjprp.exe 2424 fnrvxtt.exe 2988 ffhvx.exe 564 ndfvln.exe 960 bhlvp.exe 536 jvpbvf.exe 1216 bbpfl.exe 1392 pdrpvl.exe 2792 xtpdjj.exe 1348 hvddx.exe 2320 pffnp.exe 1672 prvpd.exe 1668 fvbtfv.exe 1088 vvrrfbn.exe 1812 rtbfx.exe 1968 jhjvr.exe 924 rbxdj.exe 1344 hhhdh.exe 2264 xlfbv.exe 476 hffxl.exe 2736 npnff.exe 372 vnlrrv.exe -
Processes:
resource yara_rule behavioral1/memory/1688-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1392-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1164-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1164-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/932-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/436-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-323-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-343-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-350-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-370-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-377-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-391-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1392-423-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-457-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-470-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-477-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-491-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-534-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-545-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-543-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-570-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-610-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-722-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1428-753-0x00000000003B0000-0x00000000003D9000-memory.dmp upx behavioral1/memory/2172-754-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-776-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2276-811-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-843-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/804-852-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-866-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
82b5b28bf10b2ab7ae51ccd0092a2450_NeikiAnalytics.exerrbxhfx.exejdnxrd.exeflrhrdx.exevvdrh.exenvrhl.exelprll.exevplfv.exerprbtb.exebnjvvn.exedpfln.exennrjrnl.exeplntp.exerdllh.exejbdplpj.exelthvdl.exedescription pid process target process PID 1688 wrote to memory of 2228 1688 82b5b28bf10b2ab7ae51ccd0092a2450_NeikiAnalytics.exe rrbxhfx.exe PID 1688 wrote to memory of 2228 1688 82b5b28bf10b2ab7ae51ccd0092a2450_NeikiAnalytics.exe rrbxhfx.exe PID 1688 wrote to memory of 2228 1688 82b5b28bf10b2ab7ae51ccd0092a2450_NeikiAnalytics.exe rrbxhfx.exe PID 1688 wrote to memory of 2228 1688 82b5b28bf10b2ab7ae51ccd0092a2450_NeikiAnalytics.exe rrbxhfx.exe PID 2228 wrote to memory of 3024 2228 rrbxhfx.exe jdnxrd.exe PID 2228 wrote to memory of 3024 2228 rrbxhfx.exe jdnxrd.exe PID 2228 wrote to memory of 3024 2228 rrbxhfx.exe jdnxrd.exe PID 2228 wrote to memory of 3024 2228 rrbxhfx.exe jdnxrd.exe PID 3024 wrote to memory of 2500 3024 jdnxrd.exe flrhrdx.exe PID 3024 wrote to memory of 2500 3024 jdnxrd.exe flrhrdx.exe PID 3024 wrote to memory of 2500 3024 jdnxrd.exe flrhrdx.exe PID 3024 wrote to memory of 2500 3024 jdnxrd.exe flrhrdx.exe PID 2500 wrote to memory of 2504 2500 flrhrdx.exe vvdrh.exe PID 2500 wrote to memory of 2504 2500 flrhrdx.exe vvdrh.exe PID 2500 wrote to memory of 2504 2500 flrhrdx.exe vvdrh.exe PID 2500 wrote to memory of 2504 2500 flrhrdx.exe vvdrh.exe PID 2504 wrote to memory of 2356 2504 vvdrh.exe nvrhl.exe PID 2504 wrote to memory of 2356 2504 vvdrh.exe nvrhl.exe PID 2504 wrote to memory of 2356 2504 vvdrh.exe nvrhl.exe PID 2504 wrote to memory of 2356 2504 vvdrh.exe nvrhl.exe PID 2356 wrote to memory of 2436 2356 nvrhl.exe lprll.exe PID 2356 wrote to memory of 2436 2356 nvrhl.exe lprll.exe PID 2356 wrote to memory of 2436 2356 nvrhl.exe lprll.exe PID 2356 wrote to memory of 2436 2356 nvrhl.exe lprll.exe PID 2436 wrote to memory of 2360 2436 lprll.exe vplfv.exe PID 2436 wrote to memory of 2360 2436 lprll.exe vplfv.exe PID 2436 wrote to memory of 2360 2436 lprll.exe vplfv.exe PID 2436 wrote to memory of 2360 2436 lprll.exe vplfv.exe PID 2360 wrote to memory of 2392 2360 vplfv.exe rprbtb.exe PID 2360 wrote to memory of 2392 2360 vplfv.exe rprbtb.exe PID 2360 wrote to memory of 2392 2360 vplfv.exe rprbtb.exe PID 2360 wrote to memory of 2392 2360 vplfv.exe rprbtb.exe PID 2392 wrote to memory of 1124 2392 rprbtb.exe bnjvvn.exe PID 2392 wrote to memory of 1124 2392 rprbtb.exe bnjvvn.exe PID 2392 wrote to memory of 1124 2392 rprbtb.exe bnjvvn.exe PID 2392 wrote to memory of 1124 2392 rprbtb.exe bnjvvn.exe PID 1124 wrote to memory of 2328 1124 bnjvvn.exe dpfln.exe PID 1124 wrote to memory of 2328 1124 bnjvvn.exe dpfln.exe PID 1124 wrote to memory of 2328 1124 bnjvvn.exe dpfln.exe PID 1124 wrote to memory of 2328 1124 bnjvvn.exe dpfln.exe PID 2328 wrote to memory of 1392 2328 dpfln.exe nnrjrnl.exe PID 2328 wrote to memory of 1392 2328 dpfln.exe nnrjrnl.exe PID 2328 wrote to memory of 1392 2328 dpfln.exe nnrjrnl.exe PID 2328 wrote to memory of 1392 2328 dpfln.exe nnrjrnl.exe PID 1392 wrote to memory of 2448 1392 nnrjrnl.exe plntp.exe PID 1392 wrote to memory of 2448 1392 nnrjrnl.exe plntp.exe PID 1392 wrote to memory of 2448 1392 nnrjrnl.exe plntp.exe PID 1392 wrote to memory of 2448 1392 nnrjrnl.exe plntp.exe PID 2448 wrote to memory of 2388 2448 plntp.exe rdllh.exe PID 2448 wrote to memory of 2388 2448 plntp.exe rdllh.exe PID 2448 wrote to memory of 2388 2448 plntp.exe rdllh.exe PID 2448 wrote to memory of 2388 2448 plntp.exe rdllh.exe PID 2388 wrote to memory of 1672 2388 rdllh.exe jbdplpj.exe PID 2388 wrote to memory of 1672 2388 rdllh.exe jbdplpj.exe PID 2388 wrote to memory of 1672 2388 rdllh.exe jbdplpj.exe PID 2388 wrote to memory of 1672 2388 rdllh.exe jbdplpj.exe PID 1672 wrote to memory of 1080 1672 jbdplpj.exe lthvdl.exe PID 1672 wrote to memory of 1080 1672 jbdplpj.exe lthvdl.exe PID 1672 wrote to memory of 1080 1672 jbdplpj.exe lthvdl.exe PID 1672 wrote to memory of 1080 1672 jbdplpj.exe lthvdl.exe PID 1080 wrote to memory of 2152 1080 lthvdl.exe fjxxr.exe PID 1080 wrote to memory of 2152 1080 lthvdl.exe fjxxr.exe PID 1080 wrote to memory of 2152 1080 lthvdl.exe fjxxr.exe PID 1080 wrote to memory of 2152 1080 lthvdl.exe fjxxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\82b5b28bf10b2ab7ae51ccd0092a2450_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\82b5b28bf10b2ab7ae51ccd0092a2450_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\rrbxhfx.exec:\rrbxhfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\jdnxrd.exec:\jdnxrd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\flrhrdx.exec:\flrhrdx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\vvdrh.exec:\vvdrh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\nvrhl.exec:\nvrhl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\lprll.exec:\lprll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\vplfv.exec:\vplfv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\rprbtb.exec:\rprbtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\bnjvvn.exec:\bnjvvn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\dpfln.exec:\dpfln.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\nnrjrnl.exec:\nnrjrnl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\plntp.exec:\plntp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\rdllh.exec:\rdllh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\jbdplpj.exec:\jbdplpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\lthvdl.exec:\lthvdl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\fjxxr.exec:\fjxxr.exe17⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xlhvd.exec:\xlhvd.exe18⤵
- Executes dropped EXE
PID:1424 -
\??\c:\hnvhnr.exec:\hnvhnr.exe19⤵
- Executes dropped EXE
PID:1164 -
\??\c:\hvddpt.exec:\hvddpt.exe20⤵
- Executes dropped EXE
PID:932 -
\??\c:\plpvlv.exec:\plpvlv.exe21⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hnnndnn.exec:\hnnndnn.exe22⤵
- Executes dropped EXE
PID:2276 -
\??\c:\tpfhhvp.exec:\tpfhhvp.exe23⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rtfxht.exec:\rtfxht.exe24⤵
- Executes dropped EXE
PID:528 -
\??\c:\bblnpdf.exec:\bblnpdf.exe25⤵
- Executes dropped EXE
PID:436 -
\??\c:\lfjrxxl.exec:\lfjrxxl.exe26⤵
- Executes dropped EXE
PID:1144 -
\??\c:\xfbhv.exec:\xfbhv.exe27⤵
- Executes dropped EXE
PID:2004 -
\??\c:\tlrxjjl.exec:\tlrxjjl.exe28⤵
- Executes dropped EXE
PID:1992 -
\??\c:\nxbpdd.exec:\nxbpdd.exe29⤵
- Executes dropped EXE
PID:2908 -
\??\c:\dhjfvx.exec:\dhjfvx.exe30⤵
- Executes dropped EXE
PID:748 -
\??\c:\rdvlrht.exec:\rdvlrht.exe31⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vrdnj.exec:\vrdnj.exe32⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rxvphxn.exec:\rxvphxn.exe33⤵
- Executes dropped EXE
PID:2348 -
\??\c:\djlhvfr.exec:\djlhvfr.exe34⤵
- Executes dropped EXE
PID:864 -
\??\c:\lfpfxv.exec:\lfpfxv.exe35⤵
- Executes dropped EXE
PID:2104 -
\??\c:\jrhtfxp.exec:\jrhtfxp.exe36⤵
- Executes dropped EXE
PID:1688 -
\??\c:\pxphx.exec:\pxphx.exe37⤵
- Executes dropped EXE
PID:2108 -
\??\c:\rfhvft.exec:\rfhvft.exe38⤵
- Executes dropped EXE
PID:1596 -
\??\c:\dfxrll.exec:\dfxrll.exe39⤵
- Executes dropped EXE
PID:2552 -
\??\c:\fjbdt.exec:\fjbdt.exe40⤵
- Executes dropped EXE
PID:2608 -
\??\c:\lbhjx.exec:\lbhjx.exe41⤵
- Executes dropped EXE
PID:2456 -
\??\c:\nndxxvn.exec:\nndxxvn.exe42⤵
- Executes dropped EXE
PID:2504 -
\??\c:\nbjvpl.exec:\nbjvpl.exe43⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vjprp.exec:\vjprp.exe44⤵
- Executes dropped EXE
PID:2376 -
\??\c:\fnrvxtt.exec:\fnrvxtt.exe45⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ffhvx.exec:\ffhvx.exe46⤵
- Executes dropped EXE
PID:2988 -
\??\c:\ndfvln.exec:\ndfvln.exe47⤵
- Executes dropped EXE
PID:564 -
\??\c:\bhlvp.exec:\bhlvp.exe48⤵
- Executes dropped EXE
PID:960 -
\??\c:\jvpbvf.exec:\jvpbvf.exe49⤵
- Executes dropped EXE
PID:536 -
\??\c:\bbpfl.exec:\bbpfl.exe50⤵
- Executes dropped EXE
PID:1216 -
\??\c:\pdrpvl.exec:\pdrpvl.exe51⤵
- Executes dropped EXE
PID:1392 -
\??\c:\xtpdjj.exec:\xtpdjj.exe52⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hvddx.exec:\hvddx.exe53⤵
- Executes dropped EXE
PID:1348 -
\??\c:\pffnp.exec:\pffnp.exe54⤵
- Executes dropped EXE
PID:2320 -
\??\c:\prvpd.exec:\prvpd.exe55⤵
- Executes dropped EXE
PID:1672 -
\??\c:\fvbtfv.exec:\fvbtfv.exe56⤵
- Executes dropped EXE
PID:1668 -
\??\c:\vvrrfbn.exec:\vvrrfbn.exe57⤵
- Executes dropped EXE
PID:1088 -
\??\c:\rtbfx.exec:\rtbfx.exe58⤵
- Executes dropped EXE
PID:1812 -
\??\c:\jhjvr.exec:\jhjvr.exe59⤵
- Executes dropped EXE
PID:1968 -
\??\c:\rbxdj.exec:\rbxdj.exe60⤵
- Executes dropped EXE
PID:924 -
\??\c:\hhhdh.exec:\hhhdh.exe61⤵
- Executes dropped EXE
PID:1344 -
\??\c:\xlfbv.exec:\xlfbv.exe62⤵
- Executes dropped EXE
PID:2264 -
\??\c:\hffxl.exec:\hffxl.exe63⤵
- Executes dropped EXE
PID:476 -
\??\c:\npnff.exec:\npnff.exe64⤵
- Executes dropped EXE
PID:2736 -
\??\c:\vnlrrv.exec:\vnlrrv.exe65⤵
- Executes dropped EXE
PID:372 -
\??\c:\rfxrx.exec:\rfxrx.exe66⤵PID:644
-
\??\c:\phldr.exec:\phldr.exe67⤵PID:2248
-
\??\c:\tptjnhf.exec:\tptjnhf.exe68⤵PID:1800
-
\??\c:\lvbftx.exec:\lvbftx.exe69⤵PID:1796
-
\??\c:\jvhprb.exec:\jvhprb.exe70⤵PID:2268
-
\??\c:\dbhxjvn.exec:\dbhxjvn.exe71⤵PID:340
-
\??\c:\xvdpl.exec:\xvdpl.exe72⤵PID:1976
-
\??\c:\dbdvxj.exec:\dbdvxj.exe73⤵PID:1972
-
\??\c:\rddrbj.exec:\rddrbj.exe74⤵PID:2812
-
\??\c:\nvvtnrh.exec:\nvvtnrh.exe75⤵PID:2740
-
\??\c:\nrftf.exec:\nrftf.exe76⤵PID:2124
-
\??\c:\thdxxh.exec:\thdxxh.exe77⤵PID:2772
-
\??\c:\nbxtvp.exec:\nbxtvp.exe78⤵PID:3056
-
\??\c:\tbdtjd.exec:\tbdtjd.exe79⤵PID:1612
-
\??\c:\vttnl.exec:\vttnl.exe80⤵PID:1500
-
\??\c:\xnxxd.exec:\xnxxd.exe81⤵PID:2632
-
\??\c:\jplrdf.exec:\jplrdf.exe82⤵PID:2432
-
\??\c:\plbvjl.exec:\plbvjl.exe83⤵PID:2916
-
\??\c:\ddljh.exec:\ddljh.exe84⤵PID:2556
-
\??\c:\hxhhfj.exec:\hxhhfj.exe85⤵PID:2560
-
\??\c:\vnxbvxh.exec:\vnxbvxh.exe86⤵PID:2608
-
\??\c:\xbtndf.exec:\xbtndf.exe87⤵PID:2456
-
\??\c:\jjxblx.exec:\jjxblx.exe88⤵PID:2672
-
\??\c:\bnrhdp.exec:\bnrhdp.exe89⤵PID:2704
-
\??\c:\jnfxdvn.exec:\jnfxdvn.exe90⤵PID:2380
-
\??\c:\nptbf.exec:\nptbf.exe91⤵PID:2952
-
\??\c:\dnrdv.exec:\dnrdv.exe92⤵PID:1236
-
\??\c:\jffjbvn.exec:\jffjbvn.exe93⤵PID:1108
-
\??\c:\tljfdl.exec:\tljfdl.exe94⤵PID:628
-
\??\c:\fftnnxb.exec:\fftnnxb.exe95⤵PID:832
-
\??\c:\hpfxlr.exec:\hpfxlr.exe96⤵PID:2588
-
\??\c:\hjnrf.exec:\hjnrf.exe97⤵PID:2684
-
\??\c:\nbdnpt.exec:\nbdnpt.exe98⤵PID:2168
-
\??\c:\dlnhn.exec:\dlnhn.exe99⤵PID:2388
-
\??\c:\bphfv.exec:\bphfv.exe100⤵PID:2000
-
\??\c:\rddln.exec:\rddln.exe101⤵PID:1428
-
\??\c:\tvvtp.exec:\tvvtp.exe102⤵PID:2172
-
\??\c:\dhhbhth.exec:\dhhbhth.exe103⤵PID:2016
-
\??\c:\txvpvpj.exec:\txvpvpj.exe104⤵PID:1820
-
\??\c:\jfxvnfx.exec:\jfxvnfx.exe105⤵PID:1812
-
\??\c:\vprrfpx.exec:\vprrfpx.exe106⤵PID:1684
-
\??\c:\vtpljvn.exec:\vtpljvn.exe107⤵PID:816
-
\??\c:\lbnjxd.exec:\lbnjxd.exe108⤵PID:1256
-
\??\c:\btfjrjh.exec:\btfjrjh.exe109⤵PID:2724
-
\??\c:\prthpbb.exec:\prthpbb.exe110⤵PID:2728
-
\??\c:\jvnrfhr.exec:\jvnrfhr.exe111⤵PID:2276
-
\??\c:\tnvldjj.exec:\tnvldjj.exe112⤵PID:1764
-
\??\c:\xflxnfh.exec:\xflxnfh.exe113⤵PID:2136
-
\??\c:\hjjxfb.exec:\hjjxfb.exe114⤵PID:1924
-
\??\c:\fhblx.exec:\fhblx.exe115⤵PID:1560
-
\??\c:\llrnrxv.exec:\llrnrxv.exe116⤵PID:1780
-
\??\c:\xtpfpv.exec:\xtpfpv.exe117⤵PID:804
-
\??\c:\hrbvtv.exec:\hrbvtv.exe118⤵PID:1984
-
\??\c:\rvjtht.exec:\rvjtht.exe119⤵PID:320
-
\??\c:\tpjjvjh.exec:\tpjjvjh.exe120⤵PID:3040
-
\??\c:\lvdbxrr.exec:\lvdbxrr.exe121⤵PID:1520
-
\??\c:\vltnld.exec:\vltnld.exe122⤵PID:2740
-
\??\c:\hftnbj.exec:\hftnbj.exe123⤵PID:2028
-
\??\c:\lnnjpv.exec:\lnnjpv.exe124⤵PID:2772
-
\??\c:\lvnff.exec:\lvnff.exe125⤵PID:2348
-
\??\c:\vpldttb.exec:\vpldttb.exe126⤵PID:1504
-
\??\c:\nhxlnfd.exec:\nhxlnfd.exe127⤵PID:1664
-
\??\c:\pdhhnvx.exec:\pdhhnvx.exe128⤵PID:2460
-
\??\c:\tbflpb.exec:\tbflpb.exe129⤵PID:1604
-
\??\c:\ltnpndn.exec:\ltnpndn.exe130⤵PID:2496
-
\??\c:\nnlrf.exec:\nnlrf.exe131⤵PID:2584
-
\??\c:\llfjjh.exec:\llfjjh.exe132⤵PID:2492
-
\??\c:\rfdhb.exec:\rfdhb.exe133⤵PID:2572
-
\??\c:\xxjjtr.exec:\xxjjtr.exe134⤵PID:2600
-
\??\c:\pnlxlnj.exec:\pnlxlnj.exe135⤵PID:1212
-
\??\c:\pxdfhf.exec:\pxdfhf.exe136⤵PID:2616
-
\??\c:\ldrvf.exec:\ldrvf.exe137⤵PID:2056
-
\??\c:\vblptll.exec:\vblptll.exe138⤵PID:2472
-
\??\c:\xnlrlf.exec:\xnlrlf.exe139⤵PID:2392
-
\??\c:\fpntrvj.exec:\fpntrvj.exe140⤵PID:568
-
\??\c:\hrnll.exec:\hrnll.exe141⤵PID:960
-
\??\c:\vjhjxdn.exec:\vjhjxdn.exe142⤵PID:1100
-
\??\c:\xxbvf.exec:\xxbvf.exe143⤵PID:832
-
\??\c:\lpfvjtb.exec:\lpfvjtb.exe144⤵PID:2676
-
\??\c:\jpnrf.exec:\jpnrf.exe145⤵PID:2684
-
\??\c:\lnhlj.exec:\lnhlj.exe146⤵PID:1856
-
\??\c:\hdrtvxv.exec:\hdrtvxv.exe147⤵PID:2388
-
\??\c:\nbvvn.exec:\nbvvn.exe148⤵PID:1228
-
\??\c:\fhnbnjr.exec:\fhnbnjr.exe149⤵PID:928
-
\??\c:\frnnnn.exec:\frnnnn.exe150⤵PID:1168
-
\??\c:\ndlrnhb.exec:\ndlrnhb.exe151⤵PID:620
-
\??\c:\fpltt.exec:\fpltt.exe152⤵PID:1424
-
\??\c:\fntrffn.exec:\fntrffn.exe153⤵PID:1812
-
\??\c:\llrlhvj.exec:\llrlhvj.exe154⤵PID:2052
-
\??\c:\xjfhxf.exec:\xjfhxf.exe155⤵PID:816
-
\??\c:\rtdfpr.exec:\rtdfpr.exe156⤵PID:1256
-
\??\c:\lfxpn.exec:\lfxpn.exe157⤵PID:2724
-
\??\c:\vjdhhfj.exec:\vjdhhfj.exe158⤵PID:2896
-
\??\c:\ptpxtfx.exec:\ptpxtfx.exe159⤵PID:2736
-
\??\c:\fhbbn.exec:\fhbbn.exe160⤵PID:940
-
\??\c:\ptffnld.exec:\ptffnld.exe161⤵PID:2036
-
\??\c:\rtpvdd.exec:\rtpvdd.exe162⤵PID:1548
-
\??\c:\ttvfvj.exec:\ttvfvj.exe163⤵PID:1144
-
\??\c:\dlhdlp.exec:\dlhdlp.exe164⤵PID:2996
-
\??\c:\bnfhjx.exec:\bnfhjx.exe165⤵PID:1540
-
\??\c:\vbjndtn.exec:\vbjndtn.exe166⤵PID:1792
-
\??\c:\vxfjv.exec:\vxfjv.exe167⤵PID:1984
-
\??\c:\ppxdv.exec:\ppxdv.exe168⤵PID:3048
-
\??\c:\lhjxr.exec:\lhjxr.exe169⤵PID:1336
-
\??\c:\hhxhppj.exec:\hhxhppj.exe170⤵PID:2808
-
\??\c:\bdfdfp.exec:\bdfdfp.exe171⤵PID:2756
-
\??\c:\bjjpnlv.exec:\bjjpnlv.exe172⤵PID:876
-
\??\c:\htxtlr.exec:\htxtlr.exe173⤵PID:1724
-
\??\c:\vbbbfpv.exec:\vbbbfpv.exe174⤵PID:2212
-
\??\c:\xjbltf.exec:\xjbltf.exe175⤵PID:2228
-
\??\c:\dnfvpt.exec:\dnfvpt.exe176⤵PID:1576
-
\??\c:\lldvv.exec:\lldvv.exe177⤵PID:2532
-
\??\c:\rhptd.exec:\rhptd.exe178⤵PID:2440
-
\??\c:\jrvjfj.exec:\jrvjfj.exe179⤵PID:2712
-
\??\c:\ntxvtfh.exec:\ntxvtfh.exe180⤵PID:2560
-
\??\c:\rrbdtfd.exec:\rrbdtfd.exe181⤵PID:2708
-
\??\c:\xjddrbp.exec:\xjddrbp.exe182⤵PID:2572
-
\??\c:\vvhtr.exec:\vvhtr.exe183⤵PID:2396
-
\??\c:\vhtlxft.exec:\vhtlxft.exe184⤵PID:2376
-
\??\c:\fljnfd.exec:\fljnfd.exe185⤵PID:1956
-
\??\c:\rpxnl.exec:\rpxnl.exe186⤵PID:2156
-
\??\c:\rnnxbj.exec:\rnnxbj.exe187⤵PID:2472
-
\??\c:\ntvrph.exec:\ntvrph.exe188⤵PID:2392
-
\??\c:\dnfnfp.exec:\dnfnfp.exe189⤵PID:588
-
\??\c:\vnhlff.exec:\vnhlff.exe190⤵PID:960
-
\??\c:\npdbbrn.exec:\npdbbrn.exe191⤵PID:1100
-
\??\c:\fnbbvt.exec:\fnbbvt.exe192⤵PID:2648
-
\??\c:\fltnpd.exec:\fltnpd.exe193⤵PID:2308
-
\??\c:\fjhdf.exec:\fjhdf.exe194⤵PID:2684
-
\??\c:\rfjffr.exec:\rfjffr.exe195⤵PID:1196
-
\??\c:\lvbfbf.exec:\lvbfbf.exe196⤵PID:2388
-
\??\c:\jpbxdjx.exec:\jpbxdjx.exe197⤵PID:2172
-
\??\c:\tfpbnf.exec:\tfpbnf.exe198⤵PID:928
-
\??\c:\dxdrnh.exec:\dxdrnh.exe199⤵PID:1744
-
\??\c:\fbxdhvt.exec:\fbxdhvt.exe200⤵PID:620
-
\??\c:\btjvjjf.exec:\btjvjjf.exe201⤵PID:924
-
\??\c:\ddrrhr.exec:\ddrrhr.exe202⤵PID:1812
-
\??\c:\lnfhn.exec:\lnfhn.exe203⤵PID:1732
-
\??\c:\vxltjl.exec:\vxltjl.exe204⤵PID:2720
-
\??\c:\npddprj.exec:\npddprj.exe205⤵PID:2284
-
\??\c:\fbhvrv.exec:\fbhvrv.exe206⤵PID:1996
-
\??\c:\brjlvb.exec:\brjlvb.exe207⤵PID:2928
-
\??\c:\vppvfxx.exec:\vppvfxx.exe208⤵PID:3016
-
\??\c:\pvbxt.exec:\pvbxt.exe209⤵PID:560
-
\??\c:\nnlhpnv.exec:\nnlhpnv.exe210⤵PID:1836
-
\??\c:\ldhbxb.exec:\ldhbxb.exe211⤵PID:1784
-
\??\c:\xxnjrj.exec:\xxnjrj.exe212⤵PID:1780
-
\??\c:\brxttpd.exec:\brxttpd.exe213⤵PID:340
-
\??\c:\rlvrl.exec:\rlvrl.exe214⤵PID:900
-
\??\c:\hxlhdrl.exec:\hxlhdrl.exe215⤵PID:1980
-
\??\c:\hdfnrbf.exec:\hdfnrbf.exe216⤵PID:1984
-
\??\c:\fhpfv.exec:\fhpfv.exe217⤵PID:552
-
\??\c:\ppjdx.exec:\ppjdx.exe218⤵PID:2216
-
\??\c:\jhdlf.exec:\jhdlf.exe219⤵PID:1484
-
\??\c:\ptbfdr.exec:\ptbfdr.exe220⤵PID:2100
-
\??\c:\bxrvlff.exec:\bxrvlff.exe221⤵PID:2240
-
\??\c:\nlxhvv.exec:\nlxhvv.exe222⤵PID:2348
-
\??\c:\hblpdr.exec:\hblpdr.exe223⤵PID:1612
-
\??\c:\prbxx.exec:\prbxx.exe224⤵PID:2944
-
\??\c:\jdrrp.exec:\jdrrp.exe225⤵PID:2788
-
\??\c:\jxhpf.exec:\jxhpf.exe226⤵PID:1692
-
\??\c:\rjrdt.exec:\rjrdt.exe227⤵PID:2480
-
\??\c:\lfrvl.exec:\lfrvl.exe228⤵PID:2580
-
\??\c:\bdttrh.exec:\bdttrh.exe229⤵PID:2576
-
\??\c:\tnlprnt.exec:\tnlprnt.exe230⤵PID:2876
-
\??\c:\rdnrdx.exec:\rdnrdx.exe231⤵PID:2672
-
\??\c:\jjfxvn.exec:\jjfxvn.exe232⤵PID:2420
-
\??\c:\hbvfp.exec:\hbvfp.exe233⤵PID:2988
-
\??\c:\trdhhn.exec:\trdhhn.exe234⤵PID:1236
-
\??\c:\bdlbnjh.exec:\bdlbnjh.exe235⤵PID:1476
-
\??\c:\nbbpn.exec:\nbbpn.exe236⤵PID:536
-
\??\c:\xjdhdb.exec:\xjdhdb.exe237⤵PID:2680
-
\??\c:\bpnlvvb.exec:\bpnlvvb.exe238⤵PID:1392
-
\??\c:\jlvvdr.exec:\jlvvdr.exe239⤵PID:1100
-
\??\c:\ldxnjlr.exec:\ldxnjlr.exe240⤵PID:1960
-
\??\c:\plpbvb.exec:\plpbvb.exe241⤵PID:1304
-
\??\c:\tlhhprh.exec:\tlhhprh.exe242⤵PID:2684