Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 18:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ff48901e33b5dfa2bd63370d90309c0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0ff48901e33b5dfa2bd63370d90309c0_NeikiAnalytics.exe
-
Size
81KB
-
MD5
0ff48901e33b5dfa2bd63370d90309c0
-
SHA1
c6674393162e8827070d5556160f63d636a19531
-
SHA256
346ee574c788467e61c7f7603080d82fdc1f94e688761edfdcc0a6d2515521f7
-
SHA512
23c73b3f1e147607edbb10dd789051c3067a9daadc5cf41325411817e399a5452dcbadb4eb2469e93cdc9c569c7ff66e8cfd8974b2964f627577d061270f0b4f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MwIYSPExIa8:ymb3NkkiQ3mdBjFo73t+SMp8
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/1932-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1220-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/552-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1160-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/268-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/664-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rrtxlv.exedtnntj.exetxvbltp.exerbhhp.exepvxvvfp.exeflfxjj.exefplldbf.exejndnpr.exennrhxn.exenlhllft.exeppdnxjl.exelvlnnlh.exefvvdpfb.exextnjpj.exebhfllb.exexbhvr.exevnhfrr.exelvdrfx.exelrlll.exebflnr.exefndpr.exehnbvpvh.exefvdfvj.exefdnnt.exefbrfjd.exedtfhpxx.exehxtdrt.exepdntnvh.exedlvvtx.exennnnpv.exepfvnnj.exentplhfj.exejhbhn.exenhtpr.exepfflft.exehnjnnfd.exelvprlx.exendvldjh.exevxdvxdn.exerppxlfd.exedxjlb.exenfttvvl.exerrlxlft.exertrrbt.exentxttb.exevxftj.exedpxlh.exevtbrhln.exejrxbnrr.exetbhblr.exetthvvn.exepxdpnt.exeflnnjh.exethjnntb.exejdnvf.exertvvn.exeldnljd.exeddnpdl.exejjlnnr.exepvrjhx.exedtvrpn.exexphdflx.exehjrfh.exevpljjbh.exepid process 1220 rrtxlv.exe 1608 dtnntj.exe 2984 txvbltp.exe 2636 rbhhp.exe 2496 pvxvvfp.exe 2624 flfxjj.exe 2532 fplldbf.exe 2408 jndnpr.exe 552 nnrhxn.exe 1668 nlhllft.exe 1820 ppdnxjl.exe 2728 lvlnnlh.exe 1160 fvvdpfb.exe 2256 xtnjpj.exe 2000 bhfllb.exe 2664 xbhvr.exe 780 vnhfrr.exe 2724 lvdrfx.exe 2740 lrlll.exe 2076 bflnr.exe 268 fndpr.exe 1152 hnbvpvh.exe 2928 fvdfvj.exe 1392 fdnnt.exe 1580 fbrfjd.exe 2796 dtfhpxx.exe 2956 hxtdrt.exe 664 pdntnvh.exe 2164 dlvvtx.exe 2816 nnnnpv.exe 2284 pfvnnj.exe 1540 ntplhfj.exe 2904 jhbhn.exe 2200 nhtpr.exe 1728 pfflft.exe 2228 hnjnnfd.exe 944 lvprlx.exe 2148 ndvldjh.exe 2556 vxdvxdn.exe 1752 rppxlfd.exe 2604 dxjlb.exe 2480 nfttvvl.exe 2580 rrlxlft.exe 2624 rtrrbt.exe 2380 ntxttb.exe 2840 vxftj.exe 1060 dpxlh.exe 1496 vtbrhln.exe 1844 jrxbnrr.exe 2352 tbhblr.exe 1820 tthvvn.exe 1988 pxdpnt.exe 1036 flnnjh.exe 2464 thjnntb.exe 2672 jdnvf.exe 2692 rtvvn.exe 896 ldnljd.exe 1772 ddnpdl.exe 2700 jjlnnr.exe 2276 pvrjhx.exe 476 dtvrpn.exe 528 xphdflx.exe 3024 hjrfh.exe 2552 vpljjbh.exe -
Processes:
resource yara_rule behavioral1/memory/1932-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1220-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1220-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1220-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/552-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1160-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/268-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/664-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-307-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0ff48901e33b5dfa2bd63370d90309c0_NeikiAnalytics.exerrtxlv.exedtnntj.exetxvbltp.exerbhhp.exepvxvvfp.exeflfxjj.exefplldbf.exejndnpr.exennrhxn.exenlhllft.exeppdnxjl.exelvlnnlh.exefvvdpfb.exextnjpj.exebhfllb.exedescription pid process target process PID 1932 wrote to memory of 1220 1932 0ff48901e33b5dfa2bd63370d90309c0_NeikiAnalytics.exe rrtxlv.exe PID 1932 wrote to memory of 1220 1932 0ff48901e33b5dfa2bd63370d90309c0_NeikiAnalytics.exe rrtxlv.exe PID 1932 wrote to memory of 1220 1932 0ff48901e33b5dfa2bd63370d90309c0_NeikiAnalytics.exe rrtxlv.exe PID 1932 wrote to memory of 1220 1932 0ff48901e33b5dfa2bd63370d90309c0_NeikiAnalytics.exe rrtxlv.exe PID 1220 wrote to memory of 1608 1220 rrtxlv.exe dtnntj.exe PID 1220 wrote to memory of 1608 1220 rrtxlv.exe dtnntj.exe PID 1220 wrote to memory of 1608 1220 rrtxlv.exe dtnntj.exe PID 1220 wrote to memory of 1608 1220 rrtxlv.exe dtnntj.exe PID 1608 wrote to memory of 2984 1608 dtnntj.exe txvbltp.exe PID 1608 wrote to memory of 2984 1608 dtnntj.exe txvbltp.exe PID 1608 wrote to memory of 2984 1608 dtnntj.exe txvbltp.exe PID 1608 wrote to memory of 2984 1608 dtnntj.exe txvbltp.exe PID 2984 wrote to memory of 2636 2984 txvbltp.exe rbhhp.exe PID 2984 wrote to memory of 2636 2984 txvbltp.exe rbhhp.exe PID 2984 wrote to memory of 2636 2984 txvbltp.exe rbhhp.exe PID 2984 wrote to memory of 2636 2984 txvbltp.exe rbhhp.exe PID 2636 wrote to memory of 2496 2636 rbhhp.exe pvxvvfp.exe PID 2636 wrote to memory of 2496 2636 rbhhp.exe pvxvvfp.exe PID 2636 wrote to memory of 2496 2636 rbhhp.exe pvxvvfp.exe PID 2636 wrote to memory of 2496 2636 rbhhp.exe pvxvvfp.exe PID 2496 wrote to memory of 2624 2496 pvxvvfp.exe flfxjj.exe PID 2496 wrote to memory of 2624 2496 pvxvvfp.exe flfxjj.exe PID 2496 wrote to memory of 2624 2496 pvxvvfp.exe flfxjj.exe PID 2496 wrote to memory of 2624 2496 pvxvvfp.exe flfxjj.exe PID 2624 wrote to memory of 2532 2624 flfxjj.exe fplldbf.exe PID 2624 wrote to memory of 2532 2624 flfxjj.exe fplldbf.exe PID 2624 wrote to memory of 2532 2624 flfxjj.exe fplldbf.exe PID 2624 wrote to memory of 2532 2624 flfxjj.exe fplldbf.exe PID 2532 wrote to memory of 2408 2532 fplldbf.exe jndnpr.exe PID 2532 wrote to memory of 2408 2532 fplldbf.exe jndnpr.exe PID 2532 wrote to memory of 2408 2532 fplldbf.exe jndnpr.exe PID 2532 wrote to memory of 2408 2532 fplldbf.exe jndnpr.exe PID 2408 wrote to memory of 552 2408 jndnpr.exe nnrhxn.exe PID 2408 wrote to memory of 552 2408 jndnpr.exe nnrhxn.exe PID 2408 wrote to memory of 552 2408 jndnpr.exe nnrhxn.exe PID 2408 wrote to memory of 552 2408 jndnpr.exe nnrhxn.exe PID 552 wrote to memory of 1668 552 nnrhxn.exe nlhllft.exe PID 552 wrote to memory of 1668 552 nnrhxn.exe nlhllft.exe PID 552 wrote to memory of 1668 552 nnrhxn.exe nlhllft.exe PID 552 wrote to memory of 1668 552 nnrhxn.exe nlhllft.exe PID 1668 wrote to memory of 1820 1668 nlhllft.exe ppdnxjl.exe PID 1668 wrote to memory of 1820 1668 nlhllft.exe ppdnxjl.exe PID 1668 wrote to memory of 1820 1668 nlhllft.exe ppdnxjl.exe PID 1668 wrote to memory of 1820 1668 nlhllft.exe ppdnxjl.exe PID 1820 wrote to memory of 2728 1820 ppdnxjl.exe lvlnnlh.exe PID 1820 wrote to memory of 2728 1820 ppdnxjl.exe lvlnnlh.exe PID 1820 wrote to memory of 2728 1820 ppdnxjl.exe lvlnnlh.exe PID 1820 wrote to memory of 2728 1820 ppdnxjl.exe lvlnnlh.exe PID 2728 wrote to memory of 1160 2728 lvlnnlh.exe fvvdpfb.exe PID 2728 wrote to memory of 1160 2728 lvlnnlh.exe fvvdpfb.exe PID 2728 wrote to memory of 1160 2728 lvlnnlh.exe fvvdpfb.exe PID 2728 wrote to memory of 1160 2728 lvlnnlh.exe fvvdpfb.exe PID 1160 wrote to memory of 2256 1160 fvvdpfb.exe xtnjpj.exe PID 1160 wrote to memory of 2256 1160 fvvdpfb.exe xtnjpj.exe PID 1160 wrote to memory of 2256 1160 fvvdpfb.exe xtnjpj.exe PID 1160 wrote to memory of 2256 1160 fvvdpfb.exe xtnjpj.exe PID 2256 wrote to memory of 2000 2256 xtnjpj.exe bhfllb.exe PID 2256 wrote to memory of 2000 2256 xtnjpj.exe bhfllb.exe PID 2256 wrote to memory of 2000 2256 xtnjpj.exe bhfllb.exe PID 2256 wrote to memory of 2000 2256 xtnjpj.exe bhfllb.exe PID 2000 wrote to memory of 2664 2000 bhfllb.exe xbhvr.exe PID 2000 wrote to memory of 2664 2000 bhfllb.exe xbhvr.exe PID 2000 wrote to memory of 2664 2000 bhfllb.exe xbhvr.exe PID 2000 wrote to memory of 2664 2000 bhfllb.exe xbhvr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ff48901e33b5dfa2bd63370d90309c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0ff48901e33b5dfa2bd63370d90309c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\rrtxlv.exec:\rrtxlv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\dtnntj.exec:\dtnntj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\txvbltp.exec:\txvbltp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\rbhhp.exec:\rbhhp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\pvxvvfp.exec:\pvxvvfp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\flfxjj.exec:\flfxjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\fplldbf.exec:\fplldbf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jndnpr.exec:\jndnpr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\nnrhxn.exec:\nnrhxn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\nlhllft.exec:\nlhllft.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\ppdnxjl.exec:\ppdnxjl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\lvlnnlh.exec:\lvlnnlh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\fvvdpfb.exec:\fvvdpfb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\xtnjpj.exec:\xtnjpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\bhfllb.exec:\bhfllb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\xbhvr.exec:\xbhvr.exe17⤵
- Executes dropped EXE
PID:2664 -
\??\c:\vnhfrr.exec:\vnhfrr.exe18⤵
- Executes dropped EXE
PID:780 -
\??\c:\lvdrfx.exec:\lvdrfx.exe19⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lrlll.exec:\lrlll.exe20⤵
- Executes dropped EXE
PID:2740 -
\??\c:\bflnr.exec:\bflnr.exe21⤵
- Executes dropped EXE
PID:2076 -
\??\c:\fndpr.exec:\fndpr.exe22⤵
- Executes dropped EXE
PID:268 -
\??\c:\hnbvpvh.exec:\hnbvpvh.exe23⤵
- Executes dropped EXE
PID:1152 -
\??\c:\fvdfvj.exec:\fvdfvj.exe24⤵
- Executes dropped EXE
PID:2928 -
\??\c:\fdnnt.exec:\fdnnt.exe25⤵
- Executes dropped EXE
PID:1392 -
\??\c:\fbrfjd.exec:\fbrfjd.exe26⤵
- Executes dropped EXE
PID:1580 -
\??\c:\dtfhpxx.exec:\dtfhpxx.exe27⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hxtdrt.exec:\hxtdrt.exe28⤵
- Executes dropped EXE
PID:2956 -
\??\c:\pdntnvh.exec:\pdntnvh.exe29⤵
- Executes dropped EXE
PID:664 -
\??\c:\dlvvtx.exec:\dlvvtx.exe30⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nnnnpv.exec:\nnnnpv.exe31⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pfvnnj.exec:\pfvnnj.exe32⤵
- Executes dropped EXE
PID:2284 -
\??\c:\ntplhfj.exec:\ntplhfj.exe33⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jhbhn.exec:\jhbhn.exe34⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nhtpr.exec:\nhtpr.exe35⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pfflft.exec:\pfflft.exe36⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hnjnnfd.exec:\hnjnnfd.exe37⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lvprlx.exec:\lvprlx.exe38⤵
- Executes dropped EXE
PID:944 -
\??\c:\ndvldjh.exec:\ndvldjh.exe39⤵
- Executes dropped EXE
PID:2148 -
\??\c:\vxdvxdn.exec:\vxdvxdn.exe40⤵
- Executes dropped EXE
PID:2556 -
\??\c:\rppxlfd.exec:\rppxlfd.exe41⤵
- Executes dropped EXE
PID:1752 -
\??\c:\dxjlb.exec:\dxjlb.exe42⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nfttvvl.exec:\nfttvvl.exe43⤵
- Executes dropped EXE
PID:2480 -
\??\c:\rrlxlft.exec:\rrlxlft.exe44⤵
- Executes dropped EXE
PID:2580 -
\??\c:\rtrrbt.exec:\rtrrbt.exe45⤵
- Executes dropped EXE
PID:2624 -
\??\c:\ntxttb.exec:\ntxttb.exe46⤵
- Executes dropped EXE
PID:2380 -
\??\c:\vxftj.exec:\vxftj.exe47⤵
- Executes dropped EXE
PID:2840 -
\??\c:\dpxlh.exec:\dpxlh.exe48⤵
- Executes dropped EXE
PID:1060 -
\??\c:\vtbrhln.exec:\vtbrhln.exe49⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jrxbnrr.exec:\jrxbnrr.exe50⤵
- Executes dropped EXE
PID:1844 -
\??\c:\tbhblr.exec:\tbhblr.exe51⤵
- Executes dropped EXE
PID:2352 -
\??\c:\tthvvn.exec:\tthvvn.exe52⤵
- Executes dropped EXE
PID:1820 -
\??\c:\pxdpnt.exec:\pxdpnt.exe53⤵
- Executes dropped EXE
PID:1988 -
\??\c:\flnnjh.exec:\flnnjh.exe54⤵
- Executes dropped EXE
PID:1036 -
\??\c:\thjnntb.exec:\thjnntb.exe55⤵
- Executes dropped EXE
PID:2464 -
\??\c:\jdnvf.exec:\jdnvf.exe56⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rtvvn.exec:\rtvvn.exe57⤵
- Executes dropped EXE
PID:2692 -
\??\c:\ldnljd.exec:\ldnljd.exe58⤵
- Executes dropped EXE
PID:896 -
\??\c:\ddnpdl.exec:\ddnpdl.exe59⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jjlnnr.exec:\jjlnnr.exe60⤵
- Executes dropped EXE
PID:2700 -
\??\c:\pvrjhx.exec:\pvrjhx.exe61⤵
- Executes dropped EXE
PID:2276 -
\??\c:\dtvrpn.exec:\dtvrpn.exe62⤵
- Executes dropped EXE
PID:476 -
\??\c:\xphdflx.exec:\xphdflx.exe63⤵
- Executes dropped EXE
PID:528 -
\??\c:\hjrfh.exec:\hjrfh.exe64⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vpljjbh.exec:\vpljjbh.exe65⤵
- Executes dropped EXE
PID:2552 -
\??\c:\dfphdj.exec:\dfphdj.exe66⤵PID:1476
-
\??\c:\bfjdfjb.exec:\bfjdfjb.exe67⤵PID:1692
-
\??\c:\nblrfht.exec:\nblrfht.exe68⤵PID:1552
-
\??\c:\rblbdrx.exec:\rblbdrx.exe69⤵PID:2092
-
\??\c:\lxpjbb.exec:\lxpjbb.exe70⤵PID:1480
-
\??\c:\bjlpvh.exec:\bjlpvh.exe71⤵PID:3056
-
\??\c:\rltpt.exec:\rltpt.exe72⤵PID:2944
-
\??\c:\nrnjnv.exec:\nrnjnv.exe73⤵PID:2140
-
\??\c:\vrblr.exec:\vrblr.exe74⤵PID:1508
-
\??\c:\dbrhh.exec:\dbrhh.exe75⤵PID:2340
-
\??\c:\fvbvn.exec:\fvbvn.exe76⤵PID:1324
-
\??\c:\fptnhf.exec:\fptnhf.exe77⤵PID:2968
-
\??\c:\xlrhvf.exec:\xlrhvf.exe78⤵PID:640
-
\??\c:\lhvhx.exec:\lhvhx.exe79⤵PID:1732
-
\??\c:\dpbfb.exec:\dpbfb.exe80⤵PID:1760
-
\??\c:\lxlxvl.exec:\lxlxvl.exe81⤵PID:1220
-
\??\c:\rhrvnr.exec:\rhrvnr.exe82⤵PID:1804
-
\??\c:\nbdxpb.exec:\nbdxpb.exe83⤵PID:2512
-
\??\c:\nvrrnnv.exec:\nvrrnnv.exe84⤵PID:2504
-
\??\c:\ljhjlj.exec:\ljhjlj.exe85⤵PID:2584
-
\??\c:\rdxtn.exec:\rdxtn.exe86⤵PID:2600
-
\??\c:\hfxpx.exec:\hfxpx.exe87⤵PID:2616
-
\??\c:\blldhlp.exec:\blldhlp.exe88⤵PID:2688
-
\??\c:\pnfxvvv.exec:\pnfxvvv.exe89⤵PID:2396
-
\??\c:\rvntl.exec:\rvntl.exe90⤵PID:2484
-
\??\c:\blhpnvv.exec:\blhpnvv.exe91⤵PID:2408
-
\??\c:\blhbhl.exec:\blhbhl.exe92⤵PID:648
-
\??\c:\lhfrlrv.exec:\lhfrlrv.exe93⤵PID:276
-
\??\c:\lvfptb.exec:\lvfptb.exe94⤵PID:2704
-
\??\c:\pbfnln.exec:\pbfnln.exe95⤵PID:564
-
\??\c:\dfjhj.exec:\dfjhj.exe96⤵PID:1380
-
\??\c:\dxhprj.exec:\dxhprj.exe97⤵PID:1864
-
\??\c:\dhtxht.exec:\dhtxht.exe98⤵PID:1800
-
\??\c:\htblbnl.exec:\htblbnl.exe99⤵PID:2256
-
\??\c:\trbtrvt.exec:\trbtrvt.exe100⤵PID:2680
-
\??\c:\dpndprd.exec:\dpndprd.exe101⤵PID:1888
-
\??\c:\ntfdhx.exec:\ntfdhx.exe102⤵PID:2684
-
\??\c:\hhpvpnf.exec:\hhpvpnf.exe103⤵PID:952
-
\??\c:\hdfdl.exec:\hdfdl.exe104⤵PID:2460
-
\??\c:\tlbxjpx.exec:\tlbxjpx.exe105⤵PID:604
-
\??\c:\rrlbdt.exec:\rrlbdt.exe106⤵PID:792
-
\??\c:\drnbt.exec:\drnbt.exe107⤵PID:2272
-
\??\c:\dvbbdn.exec:\dvbbdn.exe108⤵PID:300
-
\??\c:\jvbtrl.exec:\jvbtrl.exe109⤵PID:1152
-
\??\c:\lbdlt.exec:\lbdlt.exe110⤵PID:1100
-
\??\c:\jdhlvv.exec:\jdhlvv.exe111⤵PID:988
-
\??\c:\fdjrdhl.exec:\fdjrdhl.exe112⤵PID:112
-
\??\c:\vrfnff.exec:\vrfnff.exe113⤵PID:1884
-
\??\c:\hjfpnr.exec:\hjfpnr.exe114⤵PID:1992
-
\??\c:\dvvplp.exec:\dvvplp.exe115⤵PID:2024
-
\??\c:\lhbvdxt.exec:\lhbvdxt.exe116⤵PID:1140
-
\??\c:\nvjnl.exec:\nvjnl.exe117⤵PID:2820
-
\??\c:\jxvpld.exec:\jxvpld.exe118⤵PID:1156
-
\??\c:\nvxrn.exec:\nvxrn.exe119⤵PID:2124
-
\??\c:\vpvhh.exec:\vpvhh.exe120⤵PID:3012
-
\??\c:\bvphf.exec:\bvphf.exe121⤵PID:2804
-
\??\c:\trltx.exec:\trltx.exe122⤵PID:2968
-
\??\c:\fnftj.exec:\fnftj.exe123⤵PID:2312
-
\??\c:\fjtjl.exec:\fjtjl.exe124⤵PID:2188
-
\??\c:\bflbl.exec:\bflbl.exe125⤵PID:2060
-
\??\c:\xffvltt.exec:\xffvltt.exe126⤵PID:2916
-
\??\c:\pdbhr.exec:\pdbhr.exe127⤵PID:2564
-
\??\c:\trjlr.exec:\trjlr.exe128⤵PID:2572
-
\??\c:\tdxrj.exec:\tdxrj.exe129⤵PID:2588
-
\??\c:\jlpldp.exec:\jlpldp.exe130⤵PID:848
-
\??\c:\rbnvhj.exec:\rbnvhj.exe131⤵PID:2372
-
\??\c:\rxbtxp.exec:\rxbtxp.exe132⤵PID:2880
-
\??\c:\lvfvn.exec:\lvfvn.exe133⤵PID:2644
-
\??\c:\jvnblbn.exec:\jvnblbn.exe134⤵PID:2376
-
\??\c:\pjnftj.exec:\pjnftj.exe135⤵PID:2848
-
\??\c:\jhlbrv.exec:\jhlbrv.exe136⤵PID:1316
-
\??\c:\vfhld.exec:\vfhld.exe137⤵PID:1968
-
\??\c:\nhhhf.exec:\nhhhf.exe138⤵PID:2240
-
\??\c:\fhtpfxr.exec:\fhtpfxr.exe139⤵PID:2628
-
\??\c:\bbrhn.exec:\bbrhn.exe140⤵PID:564
-
\??\c:\fpfvnfl.exec:\fpfvnfl.exe141⤵PID:1420
-
\??\c:\bxdhbj.exec:\bxdhbj.exe142⤵PID:2020
-
\??\c:\fnxhtt.exec:\fnxhtt.exe143⤵PID:1800
-
\??\c:\bhlbbnf.exec:\bhlbbnf.exe144⤵PID:1048
-
\??\c:\lnbjn.exec:\lnbjn.exe145⤵PID:2680
-
\??\c:\vvbffn.exec:\vvbffn.exe146⤵PID:784
-
\??\c:\hnbhlfr.exec:\hnbhlfr.exe147⤵PID:824
-
\??\c:\fdlnjnp.exec:\fdlnjnp.exe148⤵PID:892
-
\??\c:\ppdttdx.exec:\ppdttdx.exe149⤵PID:2724
-
\??\c:\vndvtfh.exec:\vndvtfh.exe150⤵PID:2276
-
\??\c:\nbbnv.exec:\nbbnv.exe151⤵PID:2120
-
\??\c:\hhjxfj.exec:\hhjxfj.exe152⤵PID:704
-
\??\c:\rbvfdvl.exec:\rbvfdvl.exe153⤵PID:436
-
\??\c:\jvfnx.exec:\jvfnx.exe154⤵PID:1168
-
\??\c:\pndfftf.exec:\pndfftf.exe155⤵PID:1100
-
\??\c:\jbllbpl.exec:\jbllbpl.exe156⤵PID:2928
-
\??\c:\ntlfflf.exec:\ntlfflf.exe157⤵PID:1564
-
\??\c:\bxdlj.exec:\bxdlj.exe158⤵PID:856
-
\??\c:\xvprj.exec:\xvprj.exe159⤵PID:3060
-
\??\c:\bbrjv.exec:\bbrjv.exe160⤵PID:968
-
\??\c:\jjfhvn.exec:\jjfhvn.exe161⤵PID:2324
-
\??\c:\rxljth.exec:\rxljth.exe162⤵PID:2872
-
\??\c:\bhdxxxj.exec:\bhdxxxj.exe163⤵PID:1660
-
\??\c:\dthljx.exec:\dthljx.exe164⤵PID:2764
-
\??\c:\hfjxp.exec:\hfjxp.exe165⤵PID:240
-
\??\c:\dlfpdb.exec:\dlfpdb.exe166⤵PID:2216
-
\??\c:\pldpht.exec:\pldpht.exe167⤵PID:2200
-
\??\c:\rrrxfb.exec:\rrrxfb.exe168⤵PID:1732
-
\??\c:\tbnlx.exec:\tbnlx.exe169⤵PID:2456
-
\??\c:\dxrfxrx.exec:\dxrfxrx.exe170⤵PID:2492
-
\??\c:\rdhll.exec:\rdhll.exe171⤵PID:2468
-
\??\c:\nxdjtt.exec:\nxdjtt.exe172⤵PID:2784
-
\??\c:\xfdfj.exec:\xfdfj.exe173⤵PID:2612
-
\??\c:\vhhpdf.exec:\vhhpdf.exe174⤵PID:2584
-
\??\c:\xppjn.exec:\xppjn.exe175⤵PID:2480
-
\??\c:\jlprf.exec:\jlprf.exe176⤵PID:2524
-
\??\c:\rxvpnjv.exec:\rxvpnjv.exe177⤵PID:1244
-
\??\c:\brbdnx.exec:\brbdnx.exe178⤵PID:2380
-
\??\c:\jrfvth.exec:\jrfvth.exe179⤵PID:2396
-
\??\c:\xnxlrjn.exec:\xnxlrjn.exe180⤵PID:2484
-
\??\c:\fbnlbh.exec:\fbnlbh.exe181⤵PID:2408
-
\??\c:\prdfnb.exec:\prdfnb.exe182⤵PID:2632
-
\??\c:\djvnp.exec:\djvnp.exe183⤵PID:2352
-
\??\c:\dvthv.exec:\dvthv.exe184⤵PID:2044
-
\??\c:\nnjfh.exec:\nnjfh.exe185⤵PID:2508
-
\??\c:\npbvpfj.exec:\npbvpfj.exe186⤵PID:1864
-
\??\c:\tlldrp.exec:\tlldrp.exe187⤵PID:1036
-
\??\c:\vdxttpj.exec:\vdxttpj.exe188⤵PID:2464
-
\??\c:\jdbvf.exec:\jdbvf.exe189⤵PID:1672
-
\??\c:\frrbr.exec:\frrbr.exe190⤵PID:2828
-
\??\c:\fvldxj.exec:\fvldxj.exe191⤵PID:2404
-
\??\c:\fbbtp.exec:\fbbtp.exe192⤵PID:2684
-
\??\c:\hddnh.exec:\hddnh.exe193⤵PID:1776
-
\??\c:\rphrt.exec:\rphrt.exe194⤵PID:604
-
\??\c:\rpfpjb.exec:\rpfpjb.exe195⤵PID:792
-
\??\c:\vnvrrtb.exec:\vnvrrtb.exe196⤵PID:2948
-
\??\c:\vdhhrbx.exec:\vdhhrbx.exe197⤵PID:2272
-
\??\c:\vrjjdbn.exec:\vrjjdbn.exe198⤵PID:300
-
\??\c:\lpfpn.exec:\lpfpn.exe199⤵PID:1152
-
\??\c:\llfxn.exec:\llfxn.exe200⤵PID:2128
-
\??\c:\dnrltj.exec:\dnrltj.exe201⤵PID:2108
-
\??\c:\xdrprf.exec:\xdrprf.exe202⤵PID:912
-
\??\c:\nnvvt.exec:\nnvvt.exe203⤵PID:1996
-
\??\c:\rxthv.exec:\rxthv.exe204⤵PID:1980
-
\??\c:\brnjf.exec:\brnjf.exe205⤵PID:2944
-
\??\c:\bnntd.exec:\bnntd.exe206⤵PID:664
-
\??\c:\jdvhfbb.exec:\jdvhfbb.exe207⤵PID:2820
-
\??\c:\hrtvrd.exec:\hrtvrd.exe208⤵PID:1156
-
\??\c:\xpjjhr.exec:\xpjjhr.exe209⤵PID:900
-
\??\c:\lrbjd.exec:\lrbjd.exe210⤵PID:3012
-
\??\c:\nbrdr.exec:\nbrdr.exe211⤵PID:2116
-
\??\c:\hfjbxd.exec:\hfjbxd.exe212⤵PID:640
-
\??\c:\tdjjtxd.exec:\tdjjtxd.exe213⤵PID:1732
-
\??\c:\bbdrjn.exec:\bbdrjn.exe214⤵PID:2920
-
\??\c:\fhntxn.exec:\fhntxn.exe215⤵PID:2936
-
\??\c:\dlhhl.exec:\dlhhl.exe216⤵PID:2984
-
\??\c:\lbnlv.exec:\lbnlv.exe217⤵PID:2784
-
\??\c:\lrlnv.exec:\lrlnv.exe218⤵PID:2604
-
\??\c:\phflvn.exec:\phflvn.exe219⤵PID:2584
-
\??\c:\dfpppx.exec:\dfpppx.exe220⤵PID:2364
-
\??\c:\fvxtxbx.exec:\fvxtxbx.exe221⤵PID:2880
-
\??\c:\vfjhh.exec:\vfjhh.exe222⤵PID:2644
-
\??\c:\vnvdhlh.exec:\vnvdhlh.exe223⤵PID:1512
-
\??\c:\pvddjj.exec:\pvddjj.exe224⤵PID:1504
-
\??\c:\jtdll.exec:\jtdll.exe225⤵PID:2348
-
\??\c:\htlvv.exec:\htlvv.exe226⤵PID:1780
-
\??\c:\xtfthxl.exec:\xtfthxl.exe227⤵PID:2240
-
\??\c:\lrvpxxt.exec:\lrvpxxt.exe228⤵PID:1952
-
\??\c:\hnldb.exec:\hnldb.exe229⤵PID:1820
-
\??\c:\pfhnj.exec:\pfhnj.exe230⤵PID:1104
-
\??\c:\dpbhx.exec:\dpbhx.exe231⤵PID:1876
-
\??\c:\jvhtxd.exec:\jvhtxd.exe232⤵PID:2196
-
\??\c:\nfphdt.exec:\nfphdt.exe233⤵PID:2712
-
\??\c:\bphjvf.exec:\bphjvf.exe234⤵PID:1840
-
\??\c:\nrjvtp.exec:\nrjvtp.exe235⤵PID:2828
-
\??\c:\dtvlfhd.exec:\dtvlfhd.exe236⤵PID:2280
-
\??\c:\lpdfbb.exec:\lpdfbb.exe237⤵PID:1484
-
\??\c:\nbdppv.exec:\nbdppv.exe238⤵PID:528
-
\??\c:\lltxt.exec:\lltxt.exe239⤵PID:592
-
\??\c:\xvrbrbv.exec:\xvrbrbv.exe240⤵PID:704
-
\??\c:\dvtvpb.exec:\dvtvpb.exe241⤵PID:436
-
\??\c:\tnvtvh.exec:\tnvtvh.exe242⤵PID:1348