Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:41
Behavioral task
behavioral1
Sample
d9816cf137b90efe6e891ab6a5013460_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d9816cf137b90efe6e891ab6a5013460_NeikiAnalytics.exe
-
Size
537KB
-
MD5
d9816cf137b90efe6e891ab6a5013460
-
SHA1
1ac2b693f0657bba730250e2112920cd2e6426db
-
SHA256
797f5849d1a0363ad742a9f1fa1424a83700db2c9cfa56e9a6093ba864c6512c
-
SHA512
29ba28d3afb57c559a8cacdc62de1b41df0012e8c9e71a322529170624b52223d0a90c62d6ace0f73bbde98ac9471b764a28fe55856374eff60f8fec040dc752
-
SSDEEP
12288:y4wFHoS3eFp3IDvSbh5nP+UbGTHoSouKs8N0u/D6vIZR:HFp3lzZbGa5soR
Malware Config
Signatures
-
Detect Blackmoon payload 59 IoCs
Processes:
resource yara_rule behavioral1/memory/2168-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-32-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2232-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/680-103-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/680-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/744-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1596-159-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1596-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1308-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1772-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1092-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1352-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/896-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-292-0x0000000000350000-0x0000000000377000-memory.dmp family_blackmoon behavioral1/memory/2928-300-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2052-374-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2668-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/744-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/796-482-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1672-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/960-541-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1016-593-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1580-655-0x0000000000330000-0x0000000000357000-memory.dmp family_blackmoon behavioral1/memory/2500-658-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2424-700-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-703-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2336-733-0x0000000000360000-0x0000000000387000-memory.dmp family_blackmoon behavioral1/memory/1528-748-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2664-993-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2176-1129-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1996-1136-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1728-1151-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2844-1193-0x0000000000330000-0x0000000000357000-memory.dmp family_blackmoon behavioral1/memory/2076-1200-0x0000000000330000-0x0000000000357000-memory.dmp family_blackmoon behavioral1/memory/2240-1239-0x0000000000340000-0x0000000000367000-memory.dmp family_blackmoon behavioral1/memory/2952-1238-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2652-1254-0x0000000000330000-0x0000000000357000-memory.dmp family_blackmoon behavioral1/memory/2952-1268-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2212-1285-0x0000000000330000-0x0000000000357000-memory.dmp family_blackmoon behavioral1/memory/2444-1291-0x00000000002E0000-0x0000000000307000-memory.dmp family_blackmoon behavioral1/memory/2444-1293-0x00000000002E0000-0x0000000000307000-memory.dmp family_blackmoon behavioral1/memory/528-1305-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/528-1306-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ftbjbv.exexlpbhbt.exejphntjt.exepndlbx.exefptvdr.exexdfjjb.exeblttf.exenxfjlvt.exexpfpfr.exelhxdp.exepbnxfrv.exenhdtfr.exejhhdvvj.exelhjjfbd.exefntrhl.exerfnjj.exeflrxhr.exenxpfn.exepxhjr.exeftrnddl.exebnphnl.exexptvpj.exephpflr.exelthrx.exetpfhr.exedprjx.exefpxpfx.exephfrr.exetrxth.exejvlbjx.exehflnj.exednrjrx.exelhxpptt.exevddvp.exebhhblt.exehtjpnx.exelpjjvvf.exeddjlx.exejvbtvjh.exejplbdj.exellxxp.exellbvlxj.exejdjbjn.exepjpdvx.exexvnllxn.exefbfbpvf.exedtftxj.exevrbjlrj.exenrvxlt.exedlbxp.exebhnvv.exevhvfjbj.exejtlpl.exefjnbp.exelllnl.exehjfpn.exetnxxd.exebhtbnfj.exetttxl.exehljrhh.exedbrbtl.exevbnhtpt.exevrnvn.exepdptrxd.exepid process 2216 ftbjbv.exe 2232 xlpbhbt.exe 2716 jphntjt.exe 2536 pndlbx.exe 2648 fptvdr.exe 2884 xdfjjb.exe 2028 blttf.exe 2404 nxfjlvt.exe 2812 xpfpfr.exe 680 lhxdp.exe 2004 pbnxfrv.exe 744 nhdtfr.exe 1628 jhhdvvj.exe 2340 lhjjfbd.exe 1924 fntrhl.exe 1596 rfnjj.exe 2304 flrxhr.exe 1308 nxpfn.exe 1692 pxhjr.exe 2380 ftrnddl.exe 1772 bnphnl.exe 2112 xptvpj.exe 1932 phpflr.exe 1092 lthrx.exe 2128 tpfhr.exe 1764 dprjx.exe 1352 fpxpfx.exe 2960 phfrr.exe 896 trxth.exe 3064 jvlbjx.exe 2188 hflnj.exe 2928 dnrjrx.exe 1568 lhxpptt.exe 1152 vddvp.exe 2088 bhhblt.exe 2296 htjpnx.exe 2680 lpjjvvf.exe 2524 ddjlx.exe 3000 jvbtvjh.exe 1508 jplbdj.exe 2616 llxxp.exe 2620 llbvlxj.exe 2052 jdjbjn.exe 2556 pjpdvx.exe 2668 xvnllxn.exe 2424 fbfbpvf.exe 2468 dtftxj.exe 2824 vrbjlrj.exe 2812 nrvxlt.exe 324 dlbxp.exe 1532 bhnvv.exe 940 vhvfjbj.exe 744 jtlpl.exe 2312 fjnbp.exe 1796 lllnl.exe 1996 hjfpn.exe 2144 tnxxd.exe 968 bhtbnfj.exe 1036 tttxl.exe 796 hljrhh.exe 1672 dbrbtl.exe 856 vbnhtpt.exe 1324 vrnvn.exe 2284 pdptrxd.exe -
Processes:
resource yara_rule behavioral1/memory/2168-6-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ftbjbv.exe upx behavioral1/memory/2216-10-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xlpbhbt.exe upx behavioral1/memory/2232-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jphntjt.exe upx behavioral1/memory/2716-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2716-32-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2232-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pndlbx.exe upx behavioral1/memory/2536-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2536-47-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fptvdr.exe upx C:\xdfjjb.exe upx C:\blttf.exe upx behavioral1/memory/2884-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2404-80-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nxfjlvt.exe upx behavioral1/memory/2028-77-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xpfpfr.exe upx behavioral1/memory/2812-97-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lhxdp.exe upx behavioral1/memory/680-99-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pbnxfrv.exe upx behavioral1/memory/680-108-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhdtfr.exe upx behavioral1/memory/744-121-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jhhdvvj.exe upx behavioral1/memory/1628-137-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lhjjfbd.exe upx C:\fntrhl.exe upx C:\rfnjj.exe upx behavioral1/memory/1596-164-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flrxhr.exe upx C:\nxpfn.exe upx C:\pxhjr.exe upx behavioral1/memory/1308-181-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ftrnddl.exe upx behavioral1/memory/1692-189-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnphnl.exe upx behavioral1/memory/1772-206-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xptvpj.exe upx behavioral1/memory/2112-216-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\phpflr.exe upx \??\c:\lthrx.exe upx behavioral1/memory/1932-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1092-234-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tpfhr.exe upx \??\c:\dprjx.exe upx behavioral1/memory/2128-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1352-253-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fpxpfx.exe upx \??\c:\phfrr.exe upx C:\trxth.exe upx C:\hflnj.exe upx \??\c:\jvlbjx.exe upx behavioral1/memory/2188-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/896-275-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dnrjrx.exe upx behavioral1/memory/2928-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2188-295-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/896-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1508-349-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2556-381-0x0000000000340000-0x0000000000367000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d9816cf137b90efe6e891ab6a5013460_NeikiAnalytics.exeftbjbv.exexlpbhbt.exejphntjt.exepndlbx.exefptvdr.exexdfjjb.exeblttf.exenxfjlvt.exexpfpfr.exelhxdp.exepbnxfrv.exenhdtfr.exejhhdvvj.exelhjjfbd.exefntrhl.exedescription pid process target process PID 2168 wrote to memory of 2216 2168 d9816cf137b90efe6e891ab6a5013460_NeikiAnalytics.exe ftbjbv.exe PID 2168 wrote to memory of 2216 2168 d9816cf137b90efe6e891ab6a5013460_NeikiAnalytics.exe ftbjbv.exe PID 2168 wrote to memory of 2216 2168 d9816cf137b90efe6e891ab6a5013460_NeikiAnalytics.exe ftbjbv.exe PID 2168 wrote to memory of 2216 2168 d9816cf137b90efe6e891ab6a5013460_NeikiAnalytics.exe ftbjbv.exe PID 2216 wrote to memory of 2232 2216 ftbjbv.exe xlpbhbt.exe PID 2216 wrote to memory of 2232 2216 ftbjbv.exe xlpbhbt.exe PID 2216 wrote to memory of 2232 2216 ftbjbv.exe xlpbhbt.exe PID 2216 wrote to memory of 2232 2216 ftbjbv.exe xlpbhbt.exe PID 2232 wrote to memory of 2716 2232 xlpbhbt.exe jphntjt.exe PID 2232 wrote to memory of 2716 2232 xlpbhbt.exe jphntjt.exe PID 2232 wrote to memory of 2716 2232 xlpbhbt.exe jphntjt.exe PID 2232 wrote to memory of 2716 2232 xlpbhbt.exe jphntjt.exe PID 2716 wrote to memory of 2536 2716 jphntjt.exe pndlbx.exe PID 2716 wrote to memory of 2536 2716 jphntjt.exe pndlbx.exe PID 2716 wrote to memory of 2536 2716 jphntjt.exe pndlbx.exe PID 2716 wrote to memory of 2536 2716 jphntjt.exe pndlbx.exe PID 2536 wrote to memory of 2648 2536 pndlbx.exe fptvdr.exe PID 2536 wrote to memory of 2648 2536 pndlbx.exe fptvdr.exe PID 2536 wrote to memory of 2648 2536 pndlbx.exe fptvdr.exe PID 2536 wrote to memory of 2648 2536 pndlbx.exe fptvdr.exe PID 2648 wrote to memory of 2884 2648 fptvdr.exe xdfjjb.exe PID 2648 wrote to memory of 2884 2648 fptvdr.exe xdfjjb.exe PID 2648 wrote to memory of 2884 2648 fptvdr.exe xdfjjb.exe PID 2648 wrote to memory of 2884 2648 fptvdr.exe xdfjjb.exe PID 2884 wrote to memory of 2028 2884 xdfjjb.exe blttf.exe PID 2884 wrote to memory of 2028 2884 xdfjjb.exe blttf.exe PID 2884 wrote to memory of 2028 2884 xdfjjb.exe blttf.exe PID 2884 wrote to memory of 2028 2884 xdfjjb.exe blttf.exe PID 2028 wrote to memory of 2404 2028 blttf.exe nxfjlvt.exe PID 2028 wrote to memory of 2404 2028 blttf.exe nxfjlvt.exe PID 2028 wrote to memory of 2404 2028 blttf.exe nxfjlvt.exe PID 2028 wrote to memory of 2404 2028 blttf.exe nxfjlvt.exe PID 2404 wrote to memory of 2812 2404 nxfjlvt.exe xpfpfr.exe PID 2404 wrote to memory of 2812 2404 nxfjlvt.exe xpfpfr.exe PID 2404 wrote to memory of 2812 2404 nxfjlvt.exe xpfpfr.exe PID 2404 wrote to memory of 2812 2404 nxfjlvt.exe xpfpfr.exe PID 2812 wrote to memory of 680 2812 xpfpfr.exe lhxdp.exe PID 2812 wrote to memory of 680 2812 xpfpfr.exe lhxdp.exe PID 2812 wrote to memory of 680 2812 xpfpfr.exe lhxdp.exe PID 2812 wrote to memory of 680 2812 xpfpfr.exe lhxdp.exe PID 680 wrote to memory of 2004 680 lhxdp.exe pbnxfrv.exe PID 680 wrote to memory of 2004 680 lhxdp.exe pbnxfrv.exe PID 680 wrote to memory of 2004 680 lhxdp.exe pbnxfrv.exe PID 680 wrote to memory of 2004 680 lhxdp.exe pbnxfrv.exe PID 2004 wrote to memory of 744 2004 pbnxfrv.exe nhdtfr.exe PID 2004 wrote to memory of 744 2004 pbnxfrv.exe nhdtfr.exe PID 2004 wrote to memory of 744 2004 pbnxfrv.exe nhdtfr.exe PID 2004 wrote to memory of 744 2004 pbnxfrv.exe nhdtfr.exe PID 744 wrote to memory of 1628 744 nhdtfr.exe jhhdvvj.exe PID 744 wrote to memory of 1628 744 nhdtfr.exe jhhdvvj.exe PID 744 wrote to memory of 1628 744 nhdtfr.exe jhhdvvj.exe PID 744 wrote to memory of 1628 744 nhdtfr.exe jhhdvvj.exe PID 1628 wrote to memory of 2340 1628 jhhdvvj.exe lhjjfbd.exe PID 1628 wrote to memory of 2340 1628 jhhdvvj.exe lhjjfbd.exe PID 1628 wrote to memory of 2340 1628 jhhdvvj.exe lhjjfbd.exe PID 1628 wrote to memory of 2340 1628 jhhdvvj.exe lhjjfbd.exe PID 2340 wrote to memory of 1924 2340 lhjjfbd.exe fntrhl.exe PID 2340 wrote to memory of 1924 2340 lhjjfbd.exe fntrhl.exe PID 2340 wrote to memory of 1924 2340 lhjjfbd.exe fntrhl.exe PID 2340 wrote to memory of 1924 2340 lhjjfbd.exe fntrhl.exe PID 1924 wrote to memory of 1596 1924 fntrhl.exe rfnjj.exe PID 1924 wrote to memory of 1596 1924 fntrhl.exe rfnjj.exe PID 1924 wrote to memory of 1596 1924 fntrhl.exe rfnjj.exe PID 1924 wrote to memory of 1596 1924 fntrhl.exe rfnjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9816cf137b90efe6e891ab6a5013460_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d9816cf137b90efe6e891ab6a5013460_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\ftbjbv.exec:\ftbjbv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\xlpbhbt.exec:\xlpbhbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\jphntjt.exec:\jphntjt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\pndlbx.exec:\pndlbx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\fptvdr.exec:\fptvdr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\xdfjjb.exec:\xdfjjb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\blttf.exec:\blttf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\nxfjlvt.exec:\nxfjlvt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\xpfpfr.exec:\xpfpfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\lhxdp.exec:\lhxdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\pbnxfrv.exec:\pbnxfrv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\nhdtfr.exec:\nhdtfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\jhhdvvj.exec:\jhhdvvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\lhjjfbd.exec:\lhjjfbd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\fntrhl.exec:\fntrhl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\rfnjj.exec:\rfnjj.exe17⤵
- Executes dropped EXE
PID:1596 -
\??\c:\flrxhr.exec:\flrxhr.exe18⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nxpfn.exec:\nxpfn.exe19⤵
- Executes dropped EXE
PID:1308 -
\??\c:\pxhjr.exec:\pxhjr.exe20⤵
- Executes dropped EXE
PID:1692 -
\??\c:\ftrnddl.exec:\ftrnddl.exe21⤵
- Executes dropped EXE
PID:2380 -
\??\c:\bnphnl.exec:\bnphnl.exe22⤵
- Executes dropped EXE
PID:1772 -
\??\c:\xptvpj.exec:\xptvpj.exe23⤵
- Executes dropped EXE
PID:2112 -
\??\c:\phpflr.exec:\phpflr.exe24⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lthrx.exec:\lthrx.exe25⤵
- Executes dropped EXE
PID:1092 -
\??\c:\tpfhr.exec:\tpfhr.exe26⤵
- Executes dropped EXE
PID:2128 -
\??\c:\dprjx.exec:\dprjx.exe27⤵
- Executes dropped EXE
PID:1764 -
\??\c:\fpxpfx.exec:\fpxpfx.exe28⤵
- Executes dropped EXE
PID:1352 -
\??\c:\phfrr.exec:\phfrr.exe29⤵
- Executes dropped EXE
PID:2960 -
\??\c:\trxth.exec:\trxth.exe30⤵
- Executes dropped EXE
PID:896 -
\??\c:\jvlbjx.exec:\jvlbjx.exe31⤵
- Executes dropped EXE
PID:3064 -
\??\c:\hflnj.exec:\hflnj.exe32⤵
- Executes dropped EXE
PID:2188 -
\??\c:\dnrjrx.exec:\dnrjrx.exe33⤵
- Executes dropped EXE
PID:2928 -
\??\c:\lhxpptt.exec:\lhxpptt.exe34⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vddvp.exec:\vddvp.exe35⤵
- Executes dropped EXE
PID:1152 -
\??\c:\bhhblt.exec:\bhhblt.exe36⤵
- Executes dropped EXE
PID:2088 -
\??\c:\htjpnx.exec:\htjpnx.exe37⤵
- Executes dropped EXE
PID:2296 -
\??\c:\lpjjvvf.exec:\lpjjvvf.exe38⤵
- Executes dropped EXE
PID:2680 -
\??\c:\ddjlx.exec:\ddjlx.exe39⤵
- Executes dropped EXE
PID:2524 -
\??\c:\jvbtvjh.exec:\jvbtvjh.exe40⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jplbdj.exec:\jplbdj.exe41⤵
- Executes dropped EXE
PID:1508 -
\??\c:\llxxp.exec:\llxxp.exe42⤵
- Executes dropped EXE
PID:2616 -
\??\c:\llbvlxj.exec:\llbvlxj.exe43⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jdjbjn.exec:\jdjbjn.exe44⤵
- Executes dropped EXE
PID:2052 -
\??\c:\pjpdvx.exec:\pjpdvx.exe45⤵
- Executes dropped EXE
PID:2556 -
\??\c:\xvnllxn.exec:\xvnllxn.exe46⤵
- Executes dropped EXE
PID:2668 -
\??\c:\fbfbpvf.exec:\fbfbpvf.exe47⤵
- Executes dropped EXE
PID:2424 -
\??\c:\dtftxj.exec:\dtftxj.exe48⤵
- Executes dropped EXE
PID:2468 -
\??\c:\vrbjlrj.exec:\vrbjlrj.exe49⤵
- Executes dropped EXE
PID:2824 -
\??\c:\nrvxlt.exec:\nrvxlt.exe50⤵
- Executes dropped EXE
PID:2812 -
\??\c:\dlbxp.exec:\dlbxp.exe51⤵
- Executes dropped EXE
PID:324 -
\??\c:\bhnvv.exec:\bhnvv.exe52⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vhvfjbj.exec:\vhvfjbj.exe53⤵
- Executes dropped EXE
PID:940 -
\??\c:\jtlpl.exec:\jtlpl.exe54⤵
- Executes dropped EXE
PID:744 -
\??\c:\fjnbp.exec:\fjnbp.exe55⤵
- Executes dropped EXE
PID:2312 -
\??\c:\lllnl.exec:\lllnl.exe56⤵
- Executes dropped EXE
PID:1796 -
\??\c:\hjfpn.exec:\hjfpn.exe57⤵
- Executes dropped EXE
PID:1996 -
\??\c:\tnxxd.exec:\tnxxd.exe58⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bhtbnfj.exec:\bhtbnfj.exe59⤵
- Executes dropped EXE
PID:968 -
\??\c:\tttxl.exec:\tttxl.exe60⤵
- Executes dropped EXE
PID:1036 -
\??\c:\hljrhh.exec:\hljrhh.exe61⤵
- Executes dropped EXE
PID:796 -
\??\c:\dbrbtl.exec:\dbrbtl.exe62⤵
- Executes dropped EXE
PID:1672 -
\??\c:\vbnhtpt.exec:\vbnhtpt.exe63⤵
- Executes dropped EXE
PID:856 -
\??\c:\vrnvn.exec:\vrnvn.exe64⤵
- Executes dropped EXE
PID:1324 -
\??\c:\pdptrxd.exec:\pdptrxd.exe65⤵
- Executes dropped EXE
PID:2284 -
\??\c:\tfhlnl.exec:\tfhlnl.exe66⤵PID:2756
-
\??\c:\trfdddj.exec:\trfdddj.exe67⤵PID:1920
-
\??\c:\ftxtp.exec:\ftxtp.exe68⤵PID:2176
-
\??\c:\ffdvr.exec:\ffdvr.exe69⤵PID:2940
-
\??\c:\hltnvt.exec:\hltnvt.exe70⤵PID:1280
-
\??\c:\hfbbnbj.exec:\hfbbnbj.exe71⤵PID:960
-
\??\c:\pvpvjn.exec:\pvpvjn.exe72⤵PID:2752
-
\??\c:\fpbtjb.exec:\fpbtjb.exe73⤵PID:1032
-
\??\c:\bhbbt.exec:\bhbbt.exe74⤵PID:2876
-
\??\c:\dftrdt.exec:\dftrdt.exe75⤵PID:628
-
\??\c:\jftbvj.exec:\jftbvj.exe76⤵PID:1688
-
\??\c:\fffvxjv.exec:\fffvxjv.exe77⤵PID:2068
-
\??\c:\hthbnjv.exec:\hthbnjv.exe78⤵PID:1016
-
\??\c:\pbxdbt.exec:\pbxdbt.exe79⤵PID:2836
-
\??\c:\bhjbxl.exec:\bhjbxl.exe80⤵PID:2928
-
\??\c:\vrtvpxl.exec:\vrtvpxl.exe81⤵PID:1520
-
\??\c:\hpbxtdt.exec:\hpbxtdt.exe82⤵PID:1568
-
\??\c:\rvxhjvn.exec:\rvxhjvn.exe83⤵PID:2260
-
\??\c:\rjntrln.exec:\rjntrln.exe84⤵PID:2088
-
\??\c:\ftldvdl.exec:\ftldvdl.exe85⤵PID:2072
-
\??\c:\trjlb.exec:\trjlb.exe86⤵PID:2676
-
\??\c:\xfnpbd.exec:\xfnpbd.exe87⤵PID:2600
-
\??\c:\hbrjfbp.exec:\hbrjfbp.exe88⤵PID:1580
-
\??\c:\pnrrhbn.exec:\pnrrhbn.exe89⤵PID:2500
-
\??\c:\jbpxnpn.exec:\jbpxnpn.exe90⤵PID:2744
-
\??\c:\pldfv.exec:\pldfv.exe91⤵PID:2400
-
\??\c:\bpnjhbp.exec:\bpnjhbp.exe92⤵PID:2212
-
\??\c:\rllrpx.exec:\rllrpx.exe93⤵PID:2388
-
\??\c:\vvxxndr.exec:\vvxxndr.exe94⤵PID:2668
-
\??\c:\bltll.exec:\bltll.exe95⤵PID:2424
-
\??\c:\ttjnl.exec:\ttjnl.exe96⤵PID:2468
-
\??\c:\vbhpll.exec:\vbhpll.exe97⤵PID:1548
-
\??\c:\fhxltbv.exec:\fhxltbv.exe98⤵PID:552
-
\??\c:\hjprlh.exec:\hjprlh.exe99⤵PID:1528
-
\??\c:\prfbjn.exec:\prfbjn.exe100⤵PID:2336
-
\??\c:\ddxhhjn.exec:\ddxhhjn.exe101⤵PID:1328
-
\??\c:\nthplbh.exec:\nthplbh.exe102⤵PID:1864
-
\??\c:\fbddv.exec:\fbddv.exe103⤵PID:560
-
\??\c:\rpjrt.exec:\rpjrt.exe104⤵PID:1796
-
\??\c:\lvdpl.exec:\lvdpl.exe105⤵PID:1704
-
\??\c:\ptjtpjv.exec:\ptjtpjv.exe106⤵PID:1644
-
\??\c:\btllfd.exec:\btllfd.exe107⤵PID:932
-
\??\c:\vprrd.exec:\vprrd.exe108⤵PID:1740
-
\??\c:\hrhhjhd.exec:\hrhhjhd.exe109⤵PID:796
-
\??\c:\fbdtjfv.exec:\fbdtjfv.exe110⤵PID:1672
-
\??\c:\ljphtj.exec:\ljphtj.exe111⤵PID:856
-
\??\c:\xxfdt.exec:\xxfdt.exe112⤵PID:2748
-
\??\c:\xrlvpbr.exec:\xrlvpbr.exe113⤵PID:3016
-
\??\c:\hfvlf.exec:\hfvlf.exe114⤵PID:2096
-
\??\c:\pdvrtvl.exec:\pdvrtvl.exe115⤵PID:2584
-
\??\c:\pvnltfd.exec:\pvnltfd.exe116⤵PID:2492
-
\??\c:\ltndf.exec:\ltndf.exe117⤵PID:1936
-
\??\c:\rbtrd.exec:\rbtrd.exe118⤵PID:1028
-
\??\c:\xhrhfx.exec:\xhrhfx.exe119⤵PID:1976
-
\??\c:\plrltb.exec:\plrltb.exe120⤵PID:764
-
\??\c:\lbnvdj.exec:\lbnvdj.exe121⤵PID:1716
-
\??\c:\npxtbd.exec:\npxtbd.exe122⤵PID:1952
-
\??\c:\thpjxxh.exec:\thpjxxh.exe123⤵PID:1972
-
\??\c:\tjvbrj.exec:\tjvbrj.exe124⤵PID:2900
-
\??\c:\rblnrnv.exec:\rblnrnv.exe125⤵PID:1688
-
\??\c:\ftxvd.exec:\ftxvd.exe126⤵PID:2068
-
\??\c:\hpntpt.exec:\hpntpt.exe127⤵PID:1016
-
\??\c:\thljvn.exec:\thljvn.exe128⤵PID:1564
-
\??\c:\tndxrbd.exec:\tndxrbd.exe129⤵PID:2784
-
\??\c:\jnbvxf.exec:\jnbvxf.exe130⤵PID:2856
-
\??\c:\lvjpjdp.exec:\lvjpjdp.exe131⤵PID:2764
-
\??\c:\xtbphd.exec:\xtbphd.exe132⤵PID:1448
-
\??\c:\rjhtdrt.exec:\rjhtdrt.exe133⤵PID:2872
-
\??\c:\txxdhn.exec:\txxdhn.exe134⤵PID:2200
-
\??\c:\dbbxv.exec:\dbbxv.exe135⤵PID:2716
-
\??\c:\fnlxhfp.exec:\fnlxhfp.exe136⤵PID:1696
-
\??\c:\rhhjhv.exec:\rhhjhv.exe137⤵PID:2536
-
\??\c:\rbdvfv.exec:\rbdvfv.exe138⤵PID:2500
-
\??\c:\lxrlv.exec:\lxrlv.exe139⤵PID:2664
-
\??\c:\lbnpblv.exec:\lbnpblv.exe140⤵PID:2560
-
\??\c:\fpvldh.exec:\fpvldh.exe141⤵PID:2640
-
\??\c:\ntjprp.exec:\ntjprp.exe142⤵PID:2396
-
\??\c:\vxhplxr.exec:\vxhplxr.exe143⤵PID:2456
-
\??\c:\hlnhb.exec:\hlnhb.exe144⤵PID:2816
-
\??\c:\xlddlhx.exec:\xlddlhx.exe145⤵PID:772
-
\??\c:\lxblfnp.exec:\lxblfnp.exe146⤵PID:540
-
\??\c:\rdprlt.exec:\rdprlt.exe147⤵PID:324
-
\??\c:\tfpjvx.exec:\tfpjvx.exe148⤵PID:1792
-
\??\c:\lphnl.exec:\lphnl.exe149⤵PID:276
-
\??\c:\tntbbnd.exec:\tntbbnd.exe150⤵PID:1776
-
\??\c:\xjvhjnp.exec:\xjvhjnp.exe151⤵PID:2324
-
\??\c:\pdppd.exec:\pdppd.exe152⤵PID:1648
-
\??\c:\dbrhtx.exec:\dbrhtx.exe153⤵PID:1924
-
\??\c:\fhrxr.exec:\fhrxr.exe154⤵PID:1040
-
\??\c:\ltjtt.exec:\ltjtt.exe155⤵PID:2308
-
\??\c:\jffrbhh.exec:\jffrbhh.exe156⤵PID:1856
-
\??\c:\drpfdft.exec:\drpfdft.exe157⤵PID:928
-
\??\c:\tnblfj.exec:\tnblfj.exe158⤵PID:2644
-
\??\c:\lpjjt.exec:\lpjjt.exe159⤵PID:1044
-
\??\c:\jvnbrnb.exec:\jvnbrnb.exe160⤵PID:1904
-
\??\c:\vbnfn.exec:\vbnfn.exe161⤵PID:1772
-
\??\c:\hljxl.exec:\hljxl.exe162⤵PID:2924
-
\??\c:\xjfflff.exec:\xjfflff.exe163⤵PID:2756
-
\??\c:\tjrjj.exec:\tjrjj.exe164⤵PID:1932
-
\??\c:\rxdfptt.exec:\rxdfptt.exe165⤵PID:2176
-
\??\c:\jjrpl.exec:\jjrpl.exe166⤵PID:1996
-
\??\c:\rlldvn.exec:\rlldvn.exe167⤵PID:1844
-
\??\c:\jlphpjt.exec:\jlphpjt.exe168⤵PID:992
-
\??\c:\lljfn.exec:\lljfn.exe169⤵PID:1728
-
\??\c:\bjrdvrp.exec:\bjrdvrp.exe170⤵PID:2880
-
\??\c:\tjfptdr.exec:\tjfptdr.exe171⤵PID:1968
-
\??\c:\ppxjnrx.exec:\ppxjnrx.exe172⤵PID:1960
-
\??\c:\pblrr.exec:\pblrr.exe173⤵PID:2056
-
\??\c:\vltptrv.exec:\vltptrv.exe174⤵PID:3064
-
\??\c:\hdjxrx.exec:\hdjxrx.exe175⤵PID:2844
-
\??\c:\nrjjf.exec:\nrjjf.exe176⤵PID:2076
-
\??\c:\rtrtjn.exec:\rtrtjn.exe177⤵PID:2776
-
\??\c:\lrhld.exec:\lrhld.exe178⤵PID:2240
-
\??\c:\llbtfld.exec:\llbtfld.exe179⤵PID:1520
-
\??\c:\xfxrrdt.exec:\xfxrrdt.exe180⤵PID:2780
-
\??\c:\bttjt.exec:\bttjt.exe181⤵PID:2088
-
\??\c:\xhjlv.exec:\xhjlv.exe182⤵PID:2952
-
\??\c:\nnndhxn.exec:\nnndhxn.exe183⤵PID:2200
-
\??\c:\xffptd.exec:\xffptd.exe184⤵PID:2868
-
\??\c:\xfrpd.exec:\xfrpd.exe185⤵PID:2652
-
\??\c:\pxlhdh.exec:\pxlhdh.exe186⤵PID:2596
-
\??\c:\xrjbdvh.exec:\xrjbdvh.exe187⤵PID:2104
-
\??\c:\nxbrj.exec:\nxbrj.exe188⤵PID:2400
-
\??\c:\ppddlx.exec:\ppddlx.exe189⤵PID:2212
-
\??\c:\pnphhr.exec:\pnphhr.exe190⤵PID:2444
-
\??\c:\bpfhf.exec:\bpfhf.exe191⤵PID:2808
-
\??\c:\pbndb.exec:\pbndb.exe192⤵PID:528
-
\??\c:\vvbnh.exec:\vvbnh.exe193⤵PID:2376
-
\??\c:\hxdnjxr.exec:\hxdnjxr.exe194⤵PID:1636
-
\??\c:\llxrdt.exec:\llxrdt.exe195⤵PID:324
-
\??\c:\vndrff.exec:\vndrff.exe196⤵PID:1616
-
\??\c:\tjdll.exec:\tjdll.exe197⤵PID:2204
-
\??\c:\pdjjlvj.exec:\pdjjlvj.exe198⤵PID:1240
-
\??\c:\rrldt.exec:\rrldt.exe199⤵PID:1604
-
\??\c:\ptjtj.exec:\ptjtj.exe200⤵PID:1668
-
\??\c:\dhvnl.exec:\dhvnl.exe201⤵PID:1632
-
\??\c:\hjtxlnt.exec:\hjtxlnt.exe202⤵PID:1596
-
\??\c:\nttjhlj.exec:\nttjhlj.exe203⤵PID:2308
-
\??\c:\rtrrl.exec:\rtrrl.exe204⤵PID:1752
-
\??\c:\tvjnjft.exec:\tvjnjft.exe205⤵PID:2636
-
\??\c:\hlbfdr.exec:\hlbfdr.exe206⤵PID:748
-
\??\c:\hbbfhft.exec:\hbbfhft.exe207⤵PID:1784
-
\??\c:\rvlfrl.exec:\rvlfrl.exe208⤵PID:2120
-
\??\c:\hfjfxh.exec:\hfjfxh.exe209⤵PID:2112
-
\??\c:\ljppvxx.exec:\ljppvxx.exe210⤵PID:2628
-
\??\c:\xntjlhf.exec:\xntjlhf.exe211⤵PID:436
-
\??\c:\hddbb.exec:\hddbb.exe212⤵PID:1932
-
\??\c:\nxdnjf.exec:\nxdnjf.exe213⤵PID:2368
-
\??\c:\hrptdp.exec:\hrptdp.exe214⤵PID:2128
-
\??\c:\bdddp.exec:\bdddp.exe215⤵PID:1724
-
\??\c:\lvjnnlj.exec:\lvjnnlj.exe216⤵PID:992
-
\??\c:\rbbftl.exec:\rbbftl.exe217⤵PID:888
-
\??\c:\ndhxj.exec:\ndhxj.exe218⤵PID:2880
-
\??\c:\rpfhdhh.exec:\rpfhdhh.exe219⤵PID:1972
-
\??\c:\dlvnp.exec:\dlvnp.exe220⤵PID:1476
-
\??\c:\prnbpd.exec:\prnbpd.exe221⤵PID:2056
-
\??\c:\drjldj.exec:\drjldj.exe222⤵PID:1736
-
\??\c:\ptdlf.exec:\ptdlf.exe223⤵PID:2844
-
\??\c:\vlpfb.exec:\vlpfb.exe224⤵PID:1564
-
\??\c:\fnlhn.exec:\fnlhn.exe225⤵PID:2168
-
\??\c:\tphfx.exec:\tphfx.exe226⤵PID:1568
-
\??\c:\bvfthl.exec:\bvfthl.exe227⤵PID:2260
-
\??\c:\lptvblr.exec:\lptvblr.exe228⤵PID:2764
-
\??\c:\nlptljb.exec:\nlptljb.exe229⤵PID:3020
-
\??\c:\hvflppd.exec:\hvflppd.exe230⤵PID:840
-
\??\c:\ndndth.exec:\ndndth.exe231⤵PID:2676
-
\??\c:\prnpj.exec:\prnpj.exe232⤵PID:2680
-
\??\c:\jblbdjn.exec:\jblbdjn.exe233⤵PID:2868
-
\??\c:\ldhvnn.exec:\ldhvnn.exe234⤵PID:2652
-
\??\c:\fxbpnn.exec:\fxbpnn.exe235⤵PID:2512
-
\??\c:\lblxv.exec:\lblxv.exe236⤵PID:2392
-
\??\c:\lrndf.exec:\lrndf.exe237⤵PID:2448
-
\??\c:\brldth.exec:\brldth.exe238⤵PID:2388
-
\??\c:\rdplx.exec:\rdplx.exe239⤵PID:2840
-
\??\c:\dnbpdb.exec:\dnbpdb.exe240⤵PID:2424
-
\??\c:\pnfvbvr.exec:\pnfvbvr.exe241⤵PID:2468
-
\??\c:\xhdjbx.exec:\xhdjbx.exe242⤵PID:772