Analysis
-
max time kernel
145s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 09:57
Behavioral task
behavioral1
Sample
314df789054f9db9dd75b6174ff56e108d9fb3ed6b1684dfee8fef7c2fe82b67_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
314df789054f9db9dd75b6174ff56e108d9fb3ed6b1684dfee8fef7c2fe82b67_NeikiAnalytics.exe
-
Size
90KB
-
MD5
9eec38a58b9981977df232ca070c7fb0
-
SHA1
16507f41d86b8f69ab40c8119f6cdafd0545dde5
-
SHA256
314df789054f9db9dd75b6174ff56e108d9fb3ed6b1684dfee8fef7c2fe82b67
-
SHA512
06009097369a47115480acd6e8c0e26797cd2460fb6ae3357940b1635632c0f8f8d2cdf24059dc693e0c759d90e755de1da46cd4b17a78d40ddf8be5e4703047
-
SSDEEP
1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8mVeygryFU2li0gx4EBbhnyLFW+d:chOmTsF93UYfwC6GIoutieyhC2lbgGiI
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
Processes:
resource yara_rule behavioral1/memory/1752-12-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/848-9-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2484-32-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2860-29-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2512-49-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2472-52-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2660-67-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2528-77-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2816-94-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/544-104-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1504-113-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2328-121-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2688-124-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1984-148-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1572-183-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2180-195-0x0000000000280000-0x00000000002B6000-memory.dmp family_blackmoon behavioral1/memory/1144-216-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1580-235-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1580-234-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1888-253-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2036-278-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2764-281-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2820-295-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2480-338-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2728-350-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2472-365-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2476-390-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/960-428-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1768-454-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3040-461-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3040-462-0x00000000001B0000-0x00000000001E6000-memory.dmp family_blackmoon behavioral1/memory/684-494-0x00000000003A0000-0x00000000003D6000-memory.dmp family_blackmoon behavioral1/memory/1696-508-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1884-528-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1404-531-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1892-549-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2776-563-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2776-562-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2712-650-0x00000000002B0000-0x00000000002E6000-memory.dmp family_blackmoon behavioral1/memory/1152-810-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1364-817-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1332-856-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2728-960-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2432-959-0x0000000001B60000-0x0000000001B96000-memory.dmp family_blackmoon behavioral1/memory/2476-973-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pbttvr.exednvxn.exexjppd.exefxrpjt.exevnvftn.exefhpvpt.exetfrxdbt.exevdjllh.exevtjhvr.exexbbvxtn.exejhhxr.exejpvbr.exehphprht.exebhxbnv.exehjfvrd.exenhxvjjd.exerntpjdd.exerfhfff.exevvlhtrf.exeldpvff.exedtllt.exertdtf.exetxptpt.exeljnrrr.exeblpvxn.exernrbr.exepvpnb.exejjvvnl.exebthplb.exeprrxn.exenjdfl.exepbnnn.exerpdxnb.exexxjrj.exexlphhj.exebdhrlhh.exellpbp.exenhdrtff.exejblvvv.exehhtprf.exexxhjd.exepflthh.exepvnhnf.exenvfhbx.exephtvdt.exenvtvj.exerfnrd.exebjplxh.exehjrnndn.exetdlff.exehrffdn.exerxhvl.exevxtll.exepjnvjxp.exexxpbj.exevjrjrff.exehxppr.exetnttpxt.exejpjnjn.exehvrrdbt.exerldrtjx.exenbrvrvr.exerrhnbr.exenhnfxjh.exepid process 1752 pbttvr.exe 2860 dnvxn.exe 2484 xjppd.exe 2512 fxrpjt.exe 2472 vnvftn.exe 2660 fhpvpt.exe 2528 tfrxdbt.exe 2376 vdjllh.exe 2816 vtjhvr.exe 544 xbbvxtn.exe 1504 jhhxr.exe 2328 jpvbr.exe 2688 hphprht.exe 2020 bhxbnv.exe 1984 hjfvrd.exe 2180 nhxvjjd.exe 2176 rntpjdd.exe 2252 rfhfff.exe 1572 vvlhtrf.exe 2096 ldpvff.exe 2160 dtllt.exe 1324 rtdtf.exe 1144 txptpt.exe 3052 ljnrrr.exe 1580 blpvxn.exe 1184 rnrbr.exe 1888 pvpnb.exe 2828 jjvvnl.exe 1332 bthplb.exe 2036 prrxn.exe 2764 njdfl.exe 2820 pbnnn.exe 2732 rpdxnb.exe 2704 xxjrj.exe 848 xlphhj.exe 1752 bdhrlhh.exe 2924 llpbp.exe 1716 nhdrtff.exe 2860 jblvvv.exe 2480 hhtprf.exe 2728 xxhjd.exe 2512 pflthh.exe 2472 pvnhnf.exe 2492 nvfhbx.exe 2520 phtvdt.exe 2420 nvtvj.exe 2476 rfnrd.exe 552 bjplxh.exe 1052 hjrnndn.exe 544 tdlff.exe 584 hrffdn.exe 2336 rxhvl.exe 960 vxtll.exe 3032 pjnvjxp.exe 2312 xxpbj.exe 2228 vjrjrff.exe 1768 hxppr.exe 3040 tnttpxt.exe 1672 jpjnjn.exe 2196 hvrrdbt.exe 1776 rldrtjx.exe 2736 nbrvrvr.exe 684 rrhnbr.exe 336 nhnfxjh.exe -
Processes:
resource yara_rule behavioral1/memory/848-0-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pbttvr.exe upx behavioral1/memory/1752-12-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/848-9-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2860-20-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dnvxn.exe upx C:\xjppd.exe upx behavioral1/memory/2484-32-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2860-29-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fxrpjt.exe upx behavioral1/memory/2512-40-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2512-49-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vnvftn.exe upx behavioral1/memory/2472-52-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fhpvpt.exe upx C:\tfrxdbt.exe upx behavioral1/memory/2660-67-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2528-69-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2528-77-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vdjllh.exe upx C:\vtjhvr.exe upx behavioral1/memory/2816-86-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2816-94-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xbbvxtn.exe upx C:\jhhxr.exe upx behavioral1/memory/544-104-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jpvbr.exe upx behavioral1/memory/1504-113-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2328-121-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hphprht.exe upx behavioral1/memory/2688-124-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\bhxbnv.exe upx C:\hjfvrd.exe upx behavioral1/memory/1984-148-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\nhxvjjd.exe upx C:\rntpjdd.exe upx C:\rfhfff.exe upx C:\vvlhtrf.exe upx behavioral1/memory/1572-183-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ldpvff.exe upx C:\dtllt.exe upx C:\rtdtf.exe upx C:\txptpt.exe upx C:\ljnrrr.exe upx C:\blpvxn.exe upx behavioral1/memory/1580-235-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rnrbr.exe upx C:\pvpnb.exe upx behavioral1/memory/1888-244-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1888-253-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jjvvnl.exe upx C:\bthplb.exe upx C:\prrxn.exe upx behavioral1/memory/2036-278-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\njdfl.exe upx behavioral1/memory/2764-281-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pbnnn.exe upx behavioral1/memory/2820-295-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2480-338-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2472-365-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2476-390-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/3032-429-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/960-428-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1768-454-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
314df789054f9db9dd75b6174ff56e108d9fb3ed6b1684dfee8fef7c2fe82b67_NeikiAnalytics.exepbttvr.exednvxn.exexjppd.exefxrpjt.exevnvftn.exefhpvpt.exetfrxdbt.exevdjllh.exevtjhvr.exexbbvxtn.exejhhxr.exejpvbr.exehphprht.exebhxbnv.exehjfvrd.exedescription pid process target process PID 848 wrote to memory of 1752 848 314df789054f9db9dd75b6174ff56e108d9fb3ed6b1684dfee8fef7c2fe82b67_NeikiAnalytics.exe pbttvr.exe PID 848 wrote to memory of 1752 848 314df789054f9db9dd75b6174ff56e108d9fb3ed6b1684dfee8fef7c2fe82b67_NeikiAnalytics.exe pbttvr.exe PID 848 wrote to memory of 1752 848 314df789054f9db9dd75b6174ff56e108d9fb3ed6b1684dfee8fef7c2fe82b67_NeikiAnalytics.exe pbttvr.exe PID 848 wrote to memory of 1752 848 314df789054f9db9dd75b6174ff56e108d9fb3ed6b1684dfee8fef7c2fe82b67_NeikiAnalytics.exe pbttvr.exe PID 1752 wrote to memory of 2860 1752 pbttvr.exe dnvxn.exe PID 1752 wrote to memory of 2860 1752 pbttvr.exe dnvxn.exe PID 1752 wrote to memory of 2860 1752 pbttvr.exe dnvxn.exe PID 1752 wrote to memory of 2860 1752 pbttvr.exe dnvxn.exe PID 2860 wrote to memory of 2484 2860 dnvxn.exe xjppd.exe PID 2860 wrote to memory of 2484 2860 dnvxn.exe xjppd.exe PID 2860 wrote to memory of 2484 2860 dnvxn.exe xjppd.exe PID 2860 wrote to memory of 2484 2860 dnvxn.exe xjppd.exe PID 2484 wrote to memory of 2512 2484 xjppd.exe fxrpjt.exe PID 2484 wrote to memory of 2512 2484 xjppd.exe fxrpjt.exe PID 2484 wrote to memory of 2512 2484 xjppd.exe fxrpjt.exe PID 2484 wrote to memory of 2512 2484 xjppd.exe fxrpjt.exe PID 2512 wrote to memory of 2472 2512 fxrpjt.exe vnvftn.exe PID 2512 wrote to memory of 2472 2512 fxrpjt.exe vnvftn.exe PID 2512 wrote to memory of 2472 2512 fxrpjt.exe vnvftn.exe PID 2512 wrote to memory of 2472 2512 fxrpjt.exe vnvftn.exe PID 2472 wrote to memory of 2660 2472 vnvftn.exe fhpvpt.exe PID 2472 wrote to memory of 2660 2472 vnvftn.exe fhpvpt.exe PID 2472 wrote to memory of 2660 2472 vnvftn.exe fhpvpt.exe PID 2472 wrote to memory of 2660 2472 vnvftn.exe fhpvpt.exe PID 2660 wrote to memory of 2528 2660 fhpvpt.exe tfrxdbt.exe PID 2660 wrote to memory of 2528 2660 fhpvpt.exe tfrxdbt.exe PID 2660 wrote to memory of 2528 2660 fhpvpt.exe tfrxdbt.exe PID 2660 wrote to memory of 2528 2660 fhpvpt.exe tfrxdbt.exe PID 2528 wrote to memory of 2376 2528 tfrxdbt.exe vdjllh.exe PID 2528 wrote to memory of 2376 2528 tfrxdbt.exe vdjllh.exe PID 2528 wrote to memory of 2376 2528 tfrxdbt.exe vdjllh.exe PID 2528 wrote to memory of 2376 2528 tfrxdbt.exe vdjllh.exe PID 2376 wrote to memory of 2816 2376 vdjllh.exe vtjhvr.exe PID 2376 wrote to memory of 2816 2376 vdjllh.exe vtjhvr.exe PID 2376 wrote to memory of 2816 2376 vdjllh.exe vtjhvr.exe PID 2376 wrote to memory of 2816 2376 vdjllh.exe vtjhvr.exe PID 2816 wrote to memory of 544 2816 vtjhvr.exe xbbvxtn.exe PID 2816 wrote to memory of 544 2816 vtjhvr.exe xbbvxtn.exe PID 2816 wrote to memory of 544 2816 vtjhvr.exe xbbvxtn.exe PID 2816 wrote to memory of 544 2816 vtjhvr.exe xbbvxtn.exe PID 544 wrote to memory of 1504 544 xbbvxtn.exe jhhxr.exe PID 544 wrote to memory of 1504 544 xbbvxtn.exe jhhxr.exe PID 544 wrote to memory of 1504 544 xbbvxtn.exe jhhxr.exe PID 544 wrote to memory of 1504 544 xbbvxtn.exe jhhxr.exe PID 1504 wrote to memory of 2328 1504 jhhxr.exe jpvbr.exe PID 1504 wrote to memory of 2328 1504 jhhxr.exe jpvbr.exe PID 1504 wrote to memory of 2328 1504 jhhxr.exe jpvbr.exe PID 1504 wrote to memory of 2328 1504 jhhxr.exe jpvbr.exe PID 2328 wrote to memory of 2688 2328 jpvbr.exe hphprht.exe PID 2328 wrote to memory of 2688 2328 jpvbr.exe hphprht.exe PID 2328 wrote to memory of 2688 2328 jpvbr.exe hphprht.exe PID 2328 wrote to memory of 2688 2328 jpvbr.exe hphprht.exe PID 2688 wrote to memory of 2020 2688 hphprht.exe bhxbnv.exe PID 2688 wrote to memory of 2020 2688 hphprht.exe bhxbnv.exe PID 2688 wrote to memory of 2020 2688 hphprht.exe bhxbnv.exe PID 2688 wrote to memory of 2020 2688 hphprht.exe bhxbnv.exe PID 2020 wrote to memory of 1984 2020 bhxbnv.exe hjfvrd.exe PID 2020 wrote to memory of 1984 2020 bhxbnv.exe hjfvrd.exe PID 2020 wrote to memory of 1984 2020 bhxbnv.exe hjfvrd.exe PID 2020 wrote to memory of 1984 2020 bhxbnv.exe hjfvrd.exe PID 1984 wrote to memory of 2180 1984 hjfvrd.exe nhxvjjd.exe PID 1984 wrote to memory of 2180 1984 hjfvrd.exe nhxvjjd.exe PID 1984 wrote to memory of 2180 1984 hjfvrd.exe nhxvjjd.exe PID 1984 wrote to memory of 2180 1984 hjfvrd.exe nhxvjjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\314df789054f9db9dd75b6174ff56e108d9fb3ed6b1684dfee8fef7c2fe82b67_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\314df789054f9db9dd75b6174ff56e108d9fb3ed6b1684dfee8fef7c2fe82b67_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\pbttvr.exec:\pbttvr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\dnvxn.exec:\dnvxn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\xjppd.exec:\xjppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\fxrpjt.exec:\fxrpjt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\vnvftn.exec:\vnvftn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\fhpvpt.exec:\fhpvpt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\tfrxdbt.exec:\tfrxdbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\vdjllh.exec:\vdjllh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\vtjhvr.exec:\vtjhvr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\xbbvxtn.exec:\xbbvxtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\jhhxr.exec:\jhhxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\jpvbr.exec:\jpvbr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\hphprht.exec:\hphprht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\bhxbnv.exec:\bhxbnv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\hjfvrd.exec:\hjfvrd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\nhxvjjd.exec:\nhxvjjd.exe17⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rntpjdd.exec:\rntpjdd.exe18⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rfhfff.exec:\rfhfff.exe19⤵
- Executes dropped EXE
PID:2252 -
\??\c:\vvlhtrf.exec:\vvlhtrf.exe20⤵
- Executes dropped EXE
PID:1572 -
\??\c:\ldpvff.exec:\ldpvff.exe21⤵
- Executes dropped EXE
PID:2096 -
\??\c:\dtllt.exec:\dtllt.exe22⤵
- Executes dropped EXE
PID:2160 -
\??\c:\rtdtf.exec:\rtdtf.exe23⤵
- Executes dropped EXE
PID:1324 -
\??\c:\txptpt.exec:\txptpt.exe24⤵
- Executes dropped EXE
PID:1144 -
\??\c:\ljnrrr.exec:\ljnrrr.exe25⤵
- Executes dropped EXE
PID:3052 -
\??\c:\blpvxn.exec:\blpvxn.exe26⤵
- Executes dropped EXE
PID:1580 -
\??\c:\rnrbr.exec:\rnrbr.exe27⤵
- Executes dropped EXE
PID:1184 -
\??\c:\pvpnb.exec:\pvpnb.exe28⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jjvvnl.exec:\jjvvnl.exe29⤵
- Executes dropped EXE
PID:2828 -
\??\c:\bthplb.exec:\bthplb.exe30⤵
- Executes dropped EXE
PID:1332 -
\??\c:\prrxn.exec:\prrxn.exe31⤵
- Executes dropped EXE
PID:2036 -
\??\c:\njdfl.exec:\njdfl.exe32⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pbnnn.exec:\pbnnn.exe33⤵
- Executes dropped EXE
PID:2820 -
\??\c:\rpdxnb.exec:\rpdxnb.exe34⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xxjrj.exec:\xxjrj.exe35⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xlphhj.exec:\xlphhj.exe36⤵
- Executes dropped EXE
PID:848 -
\??\c:\bdhrlhh.exec:\bdhrlhh.exe37⤵
- Executes dropped EXE
PID:1752 -
\??\c:\llpbp.exec:\llpbp.exe38⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nhdrtff.exec:\nhdrtff.exe39⤵
- Executes dropped EXE
PID:1716 -
\??\c:\jblvvv.exec:\jblvvv.exe40⤵
- Executes dropped EXE
PID:2860 -
\??\c:\hhtprf.exec:\hhtprf.exe41⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xxhjd.exec:\xxhjd.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\pflthh.exec:\pflthh.exe43⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pvnhnf.exec:\pvnhnf.exe44⤵
- Executes dropped EXE
PID:2472 -
\??\c:\nvfhbx.exec:\nvfhbx.exe45⤵
- Executes dropped EXE
PID:2492 -
\??\c:\phtvdt.exec:\phtvdt.exe46⤵
- Executes dropped EXE
PID:2520 -
\??\c:\nvtvj.exec:\nvtvj.exe47⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rfnrd.exec:\rfnrd.exe48⤵
- Executes dropped EXE
PID:2476 -
\??\c:\bjplxh.exec:\bjplxh.exe49⤵
- Executes dropped EXE
PID:552 -
\??\c:\hjrnndn.exec:\hjrnndn.exe50⤵
- Executes dropped EXE
PID:1052 -
\??\c:\tdlff.exec:\tdlff.exe51⤵
- Executes dropped EXE
PID:544 -
\??\c:\hrffdn.exec:\hrffdn.exe52⤵
- Executes dropped EXE
PID:584 -
\??\c:\rxhvl.exec:\rxhvl.exe53⤵
- Executes dropped EXE
PID:2336 -
\??\c:\vxtll.exec:\vxtll.exe54⤵
- Executes dropped EXE
PID:960 -
\??\c:\pjnvjxp.exec:\pjnvjxp.exe55⤵
- Executes dropped EXE
PID:3032 -
\??\c:\xxpbj.exec:\xxpbj.exe56⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vjrjrff.exec:\vjrjrff.exe57⤵
- Executes dropped EXE
PID:2228 -
\??\c:\hxppr.exec:\hxppr.exe58⤵
- Executes dropped EXE
PID:1768 -
\??\c:\tnttpxt.exec:\tnttpxt.exe59⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jpjnjn.exec:\jpjnjn.exe60⤵
- Executes dropped EXE
PID:1672 -
\??\c:\hvrrdbt.exec:\hvrrdbt.exe61⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rldrtjx.exec:\rldrtjx.exe62⤵
- Executes dropped EXE
PID:1776 -
\??\c:\nbrvrvr.exec:\nbrvrvr.exe63⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rrhnbr.exec:\rrhnbr.exe64⤵
- Executes dropped EXE
PID:684 -
\??\c:\nhnfxjh.exec:\nhnfxjh.exe65⤵
- Executes dropped EXE
PID:336 -
\??\c:\fxbvd.exec:\fxbvd.exe66⤵PID:1696
-
\??\c:\xbpvft.exec:\xbpvft.exe67⤵PID:1144
-
\??\c:\hjdjt.exec:\hjdjt.exe68⤵PID:3048
-
\??\c:\xfhfxbl.exec:\xfhfxbl.exe69⤵PID:1884
-
\??\c:\djfhxbb.exec:\djfhxbb.exe70⤵PID:1404
-
\??\c:\tfxtf.exec:\tfxtf.exe71⤵PID:1940
-
\??\c:\blnvlhd.exec:\blnvlhd.exe72⤵PID:1892
-
\??\c:\jjpvftj.exec:\jjpvftj.exe73⤵PID:1956
-
\??\c:\ltrprj.exec:\ltrprj.exe74⤵PID:2776
-
\??\c:\rlbppv.exec:\rlbppv.exe75⤵PID:2092
-
\??\c:\tnhld.exec:\tnhld.exe76⤵PID:2948
-
\??\c:\fvrhn.exec:\fvrhn.exe77⤵PID:2304
-
\??\c:\bvnltnn.exec:\bvnltnn.exe78⤵PID:2840
-
\??\c:\xpdhrr.exec:\xpdhrr.exe79⤵PID:2240
-
\??\c:\fdjxxdn.exec:\fdjxxdn.exe80⤵PID:1340
-
\??\c:\nhntn.exec:\nhntn.exe81⤵PID:2448
-
\??\c:\vldnhfb.exec:\vldnhfb.exe82⤵PID:2884
-
\??\c:\lbvnx.exec:\lbvnx.exe83⤵PID:1620
-
\??\c:\hdtplpp.exec:\hdtplpp.exe84⤵PID:2496
-
\??\c:\hbdvp.exec:\hbdvp.exe85⤵PID:2504
-
\??\c:\bfjdnl.exec:\bfjdnl.exe86⤵PID:2488
-
\??\c:\brtrv.exec:\brtrv.exe87⤵PID:2616
-
\??\c:\bxtndx.exec:\bxtndx.exe88⤵PID:2712
-
\??\c:\hjplln.exec:\hjplln.exe89⤵PID:2652
-
\??\c:\jtrhnx.exec:\jtrhnx.exe90⤵PID:2356
-
\??\c:\xffrlv.exec:\xffrlv.exe91⤵PID:2528
-
\??\c:\rldtxjp.exec:\rldtxjp.exe92⤵PID:2376
-
\??\c:\ttjvr.exec:\ttjvr.exe93⤵PID:2788
-
\??\c:\prxtnht.exec:\prxtnht.exe94⤵PID:556
-
\??\c:\nhrrdx.exec:\nhrrdx.exe95⤵PID:880
-
\??\c:\fhfdd.exec:\fhfdd.exe96⤵PID:940
-
\??\c:\vdbfttx.exec:\vdbfttx.exe97⤵PID:372
-
\??\c:\jtxfpvv.exec:\jtxfpvv.exe98⤵PID:2328
-
\??\c:\hlhlf.exec:\hlhlf.exe99⤵PID:1480
-
\??\c:\pjxnll.exec:\pjxnll.exe100⤵PID:1044
-
\??\c:\htvdddn.exec:\htvdddn.exe101⤵PID:312
-
\??\c:\vdpvnhr.exec:\vdpvnhr.exe102⤵PID:2324
-
\??\c:\txxjxbt.exec:\txxjxbt.exe103⤵PID:2200
-
\??\c:\xrtxdv.exec:\xrtxdv.exe104⤵PID:2180
-
\??\c:\vfhrlf.exec:\vfhrlf.exe105⤵PID:2972
-
\??\c:\lbpnxr.exec:\lbpnxr.exe106⤵PID:1640
-
\??\c:\xxhpvd.exec:\xxhpvd.exe107⤵PID:324
-
\??\c:\pdtxvlp.exec:\pdtxvlp.exe108⤵PID:1660
-
\??\c:\dhldpx.exec:\dhldpx.exe109⤵PID:1776
-
\??\c:\xjbbdh.exec:\xjbbdh.exe110⤵PID:2736
-
\??\c:\njhtrdr.exec:\njhtrdr.exe111⤵PID:684
-
\??\c:\vhjxbb.exec:\vhjxbb.exe112⤵PID:2160
-
\??\c:\vlhrt.exec:\vlhrt.exe113⤵PID:2156
-
\??\c:\hxhvlvl.exec:\hxhvlvl.exe114⤵PID:1152
-
\??\c:\jrbfvxd.exec:\jrbfvxd.exe115⤵PID:1104
-
\??\c:\rrrjxnr.exec:\rrrjxnr.exe116⤵PID:1364
-
\??\c:\bxdrr.exec:\bxdrr.exe117⤵PID:1072
-
\??\c:\rhtnj.exec:\rhtnj.exe118⤵PID:2956
-
\??\c:\xbltj.exec:\xbltj.exe119⤵PID:568
-
\??\c:\rnhhp.exec:\rnhhp.exe120⤵PID:2344
-
\??\c:\djfpj.exec:\djfpj.exe121⤵PID:1332
-
\??\c:\ppnblf.exec:\ppnblf.exe122⤵PID:2832
-
\??\c:\fbltvp.exec:\fbltvp.exe123⤵PID:2852
-
\??\c:\bnxfb.exec:\bnxfb.exe124⤵PID:2892
-
\??\c:\vjdvvf.exec:\vjdvvf.exe125⤵PID:892
-
\??\c:\blvnldx.exec:\blvnldx.exe126⤵PID:2720
-
\??\c:\dbfjn.exec:\dbfjn.exe127⤵PID:1352
-
\??\c:\hxxhfx.exec:\hxxhfx.exe128⤵PID:848
-
\??\c:\ltvpxj.exec:\ltvpxj.exe129⤵PID:1624
-
\??\c:\xfdhjt.exec:\xfdhjt.exe130⤵PID:2936
-
\??\c:\xjtthxb.exec:\xjtthxb.exe131⤵PID:1620
-
\??\c:\ldplnbn.exec:\ldplnbn.exe132⤵PID:2716
-
\??\c:\ndrjx.exec:\ndrjx.exe133⤵PID:1520
-
\??\c:\jjjtxhx.exec:\jjjtxhx.exe134⤵PID:2728
-
\??\c:\pxrjdtf.exec:\pxrjdtf.exe135⤵PID:2392
-
\??\c:\vttfv.exec:\vttfv.exe136⤵PID:2712
-
\??\c:\hflvj.exec:\hflvj.exe137⤵PID:2544
-
\??\c:\dnhjdrd.exec:\dnhjdrd.exe138⤵PID:2432
-
\??\c:\pppfffb.exec:\pppfffb.exe139⤵PID:2388
-
\??\c:\djrxxx.exec:\djrxxx.exe140⤵PID:2476
-
\??\c:\hbvjnxb.exec:\hbvjnxb.exe141⤵PID:1500
-
\??\c:\lblbx.exec:\lblbx.exe142⤵PID:240
-
\??\c:\dpftjd.exec:\dpftjd.exe143⤵PID:544
-
\??\c:\tdrbn.exec:\tdrbn.exe144⤵PID:2532
-
\??\c:\bxnxdr.exec:\bxnxdr.exe145⤵PID:2784
-
\??\c:\blfnx.exec:\blfnx.exe146⤵PID:1812
-
\??\c:\hvfxhdv.exec:\hvfxhdv.exe147⤵PID:1480
-
\??\c:\xfblbx.exec:\xfblbx.exe148⤵PID:2220
-
\??\c:\ntljh.exec:\ntljh.exe149⤵PID:312
-
\??\c:\fvrjb.exec:\fvrjb.exe150⤵PID:1772
-
\??\c:\tbnpfxt.exec:\tbnpfxt.exe151⤵PID:2200
-
\??\c:\njxvttd.exec:\njxvttd.exe152⤵PID:3044
-
\??\c:\xdrnnhp.exec:\xdrnnhp.exe153⤵PID:1644
-
\??\c:\bxltb.exec:\bxltb.exe154⤵PID:2060
-
\??\c:\dxxxx.exec:\dxxxx.exe155⤵PID:324
-
\??\c:\fnhlx.exec:\fnhlx.exe156⤵PID:2096
-
\??\c:\bnjxrn.exec:\bnjxrn.exe157⤵PID:468
-
\??\c:\fphdjr.exec:\fphdjr.exe158⤵PID:2736
-
\??\c:\nxxdr.exec:\nxxdr.exe159⤵PID:684
-
\??\c:\ththdpn.exec:\ththdpn.exe160⤵PID:3064
-
\??\c:\dbxndrf.exec:\dbxndrf.exe161⤵PID:1324
-
\??\c:\bnbvlfx.exec:\bnbvlfx.exe162⤵PID:2024
-
\??\c:\jbftlt.exec:\jbftlt.exe163⤵PID:1580
-
\??\c:\drvhj.exec:\drvhj.exe164⤵PID:1844
-
\??\c:\pnvdnp.exec:\pnvdnp.exe165⤵PID:2768
-
\??\c:\bfdlf.exec:\bfdlf.exe166⤵PID:1940
-
\??\c:\ntvntpj.exec:\ntvntpj.exe167⤵PID:2912
-
\??\c:\nxpbdh.exec:\nxpbdh.exe168⤵PID:2760
-
\??\c:\bhvnxd.exec:\bhvnxd.exe169⤵PID:2440
-
\??\c:\dphffd.exec:\dphffd.exe170⤵PID:2092
-
\??\c:\xfjld.exec:\xfjld.exe171⤵PID:2332
-
\??\c:\pjpvnn.exec:\pjpvnn.exe172⤵PID:1524
-
\??\c:\jlnvrlp.exec:\jlnvrlp.exe173⤵PID:1528
-
\??\c:\vnjbnx.exec:\vnjbnx.exe174⤵PID:2732
-
\??\c:\vrvjj.exec:\vrvjj.exe175⤵PID:1176
-
\??\c:\xbftflj.exec:\xbftflj.exe176⤵PID:2448
-
\??\c:\rpbrdd.exec:\rpbrdd.exe177⤵PID:1720
-
\??\c:\hffvr.exec:\hffvr.exe178⤵PID:1716
-
\??\c:\hpdvr.exec:\hpdvr.exe179⤵PID:2856
-
\??\c:\jtbhpxj.exec:\jtbhpxj.exe180⤵PID:2508
-
\??\c:\pnfjn.exec:\pnfjn.exe181⤵PID:2584
-
\??\c:\vxnbplx.exec:\vxnbplx.exe182⤵PID:2612
-
\??\c:\bpdrld.exec:\bpdrld.exe183⤵PID:2472
-
\??\c:\jlbtrlf.exec:\jlbtrlf.exe184⤵PID:2548
-
\??\c:\vjxhtf.exec:\vjxhtf.exe185⤵PID:2408
-
\??\c:\pfxfv.exec:\pfxfv.exe186⤵PID:2360
-
\??\c:\nttrj.exec:\nttrj.exe187⤵PID:2432
-
\??\c:\hnrbnph.exec:\hnrbnph.exe188⤵PID:2816
-
\??\c:\ptvhft.exec:\ptvhft.exe189⤵PID:1124
-
\??\c:\trnpfxn.exec:\trnpfxn.exe190⤵PID:1500
-
\??\c:\pbhnb.exec:\pbhnb.exe191⤵PID:964
-
\??\c:\djnxtfb.exec:\djnxtfb.exe192⤵PID:2288
-
\??\c:\nlpph.exec:\nlpph.exe193⤵PID:372
-
\??\c:\fxvrt.exec:\fxvrt.exe194⤵PID:2396
-
\??\c:\jtbxn.exec:\jtbxn.exe195⤵PID:2168
-
\??\c:\pnptjbn.exec:\pnptjbn.exe196⤵PID:1044
-
\??\c:\pfhlldx.exec:\pfhlldx.exe197⤵PID:1484
-
\??\c:\dflvvx.exec:\dflvvx.exe198⤵PID:2216
-
\??\c:\flfhpnp.exec:\flfhpnp.exe199⤵PID:1984
-
\??\c:\vlxjpjp.exec:\vlxjpjp.exe200⤵PID:2180
-
\??\c:\vplfb.exec:\vplfb.exe201⤵PID:2252
-
\??\c:\hpdjvh.exec:\hpdjvh.exe202⤵PID:1992
-
\??\c:\txfbd.exec:\txfbd.exe203⤵PID:1288
-
\??\c:\dbbnpdf.exec:\dbbnpdf.exe204⤵PID:1988
-
\??\c:\xnxdnp.exec:\xnxdnp.exe205⤵PID:2104
-
\??\c:\bxvbbbx.exec:\bxvbbbx.exe206⤵PID:2916
-
\??\c:\lhnbtvb.exec:\lhnbtvb.exe207⤵PID:336
-
\??\c:\bhtjb.exec:\bhtjb.exe208⤵PID:1248
-
\??\c:\xffff.exec:\xffff.exe209⤵PID:1696
-
\??\c:\tvjbb.exec:\tvjbb.exe210⤵PID:1856
-
\??\c:\xbhlhlj.exec:\xbhlhlj.exe211⤵PID:1840
-
\??\c:\rtdxv.exec:\rtdxv.exe212⤵PID:2572
-
\??\c:\hlhfdd.exec:\hlhfdd.exe213⤵PID:1800
-
\??\c:\dtxvhtp.exec:\dtxvhtp.exe214⤵PID:1632
-
\??\c:\nxdnd.exec:\nxdnd.exe215⤵PID:1892
-
\??\c:\npppn.exec:\npppn.exe216⤵PID:2256
-
\??\c:\xndxj.exec:\xndxj.exe217⤵PID:1112
-
\??\c:\dxrnvlr.exec:\dxrnvlr.exe218⤵PID:1764
-
\??\c:\nlvbv.exec:\nlvbv.exe219⤵PID:2244
-
\??\c:\tldddl.exec:\tldddl.exe220⤵PID:1692
-
\??\c:\bvphv.exec:\bvphv.exe221⤵PID:956
-
\??\c:\lhtfhj.exec:\lhtfhj.exe222⤵PID:2632
-
\??\c:\nrpdrp.exec:\nrpdrp.exe223⤵PID:2016
-
\??\c:\lfbhptl.exec:\lfbhptl.exe224⤵PID:1736
-
\??\c:\fjrhp.exec:\fjrhp.exe225⤵PID:2136
-
\??\c:\xnjrv.exec:\xnjrv.exe226⤵PID:2588
-
\??\c:\fhptnbt.exec:\fhptnbt.exe227⤵PID:2600
-
\??\c:\jljlj.exec:\jljlj.exe228⤵PID:2464
-
\??\c:\ffpxj.exec:\ffpxj.exe229⤵PID:1092
-
\??\c:\xthnll.exec:\xthnll.exe230⤵PID:2812
-
\??\c:\nnjrx.exec:\nnjrx.exe231⤵PID:2612
-
\??\c:\jlpjd.exec:\jlpjd.exe232⤵PID:2636
-
\??\c:\jrdvrh.exec:\jrdvrh.exe233⤵PID:2352
-
\??\c:\ltvrjb.exec:\ltvrjb.exe234⤵PID:2544
-
\??\c:\rrdjp.exec:\rrdjp.exe235⤵PID:2420
-
\??\c:\jrxlp.exec:\jrxlp.exe236⤵PID:2388
-
\??\c:\vhnxd.exec:\vhnxd.exe237⤵PID:1336
-
\??\c:\nxbnj.exec:\nxbnj.exe238⤵PID:1168
-
\??\c:\xlnnhp.exec:\xlnnhp.exe239⤵PID:1996
-
\??\c:\ffftxh.exec:\ffftxh.exe240⤵PID:584
-
\??\c:\jjdrtph.exec:\jjdrtph.exe241⤵PID:2340
-
\??\c:\vtlnfl.exec:\vtlnfl.exe242⤵PID:2328