Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 13:40
Behavioral task
behavioral1
Sample
57eb67bb8ac091aa44125f887dce308898fa16a04cdab2e2f51be3fbaed3b027_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
57eb67bb8ac091aa44125f887dce308898fa16a04cdab2e2f51be3fbaed3b027_NeikiAnalytics.exe
-
Size
75KB
-
MD5
ff86d0b17f550b2a583517a1974eb240
-
SHA1
3454c165e9bf13d4eed5ba0d38dbe73bd7485ede
-
SHA256
57eb67bb8ac091aa44125f887dce308898fa16a04cdab2e2f51be3fbaed3b027
-
SHA512
dc9e84a43b55da08893ee5941337c47ee8aee7725a3479bb3c6913ec49a9aafcff189349bd3af560ea0787a31d3251a2bd1326f71c3eb9a9a090699cb7456f8c
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWoFLAxZhMDzE8s:9hOmTsF93UYfwC6GIoutz5yLpOSDu
Malware Config
Signatures
-
Detect Blackmoon payload 54 IoCs
Processes:
resource yara_rule behavioral1/memory/2212-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1776-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1252-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1956-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/676-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/516-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1740-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/612-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-121-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2664-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1832-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-226-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2428-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/800-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-264-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2812-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-306-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2200-307-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1580-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/948-358-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/872-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1016-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/964-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-579-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2188-584-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-611-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/596-694-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2872-705-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2652-729-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1792-737-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2880-828-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/900-853-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/1744-960-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1816-1016-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1156-1158-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/920-1282-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/612-1306-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/768-1356-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2124-1461-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ndltx.exebhrppn.exelrvprv.exenhtjn.exerxbbh.exehttnjjl.exerrjjhhb.exehvftbxp.exeplnfdr.exejjlpfpt.exetxtxrxn.exebpflbv.exevprbjp.exethtrtt.exetvxhft.exefhfjppv.exepbrpnn.exehpfhx.exenlvhhh.exenpvrfft.exebxlhdj.exehddtp.exernrphbx.exejxddlv.exeddbltnr.exettrrjdr.exehfbfh.exetfnbnrf.exebllhv.exedbrfd.exejlbtxpj.exerrpvdr.exebfrrbbf.exevbjrt.exetptfrj.exepdprf.exedhptvbv.exernfjjbn.exenldvd.exedbllpbn.exerlnvhln.exefpdbnr.exexftjj.exedlltp.exephfjr.exetllfjdd.exefhxxh.exebhhtx.exefddxj.exepbnfv.exelflbjp.exetfblhf.exetptbh.exebbjlfd.exetvnbdjr.exedlxhd.exebhtjrn.exevtbxlpd.exelnxnh.exednhprn.exexdjvp.exedflnb.exevtfdxht.exeftdxjl.exepid process 2212 ndltx.exe 1776 bhrppn.exe 2360 lrvprv.exe 1252 nhtjn.exe 1956 rxbbh.exe 2352 httnjjl.exe 2004 rrjjhhb.exe 676 hvftbxp.exe 516 plnfdr.exe 1740 jjlpfpt.exe 612 txtxrxn.exe 2472 bpflbv.exe 2664 vprbjp.exe 2632 thtrtt.exe 2668 tvxhft.exe 2860 fhfjppv.exe 1832 pbrpnn.exe 1872 hpfhx.exe 2912 nlvhhh.exe 3024 npvrfft.exe 2104 bxlhdj.exe 1524 hddtp.exe 1404 rnrphbx.exe 2516 jxddlv.exe 2960 ddbltnr.exe 2428 ttrrjdr.exe 1472 hfbfh.exe 800 tfnbnrf.exe 2812 bllhv.exe 2128 dbrfd.exe 2144 jlbtxpj.exe 2124 rrpvdr.exe 2180 bfrrbbf.exe 2200 vbjrt.exe 2080 tptfrj.exe 1580 pdprf.exe 2220 dhptvbv.exe 1988 rnfjjbn.exe 1636 nldvd.exe 1972 dbllpbn.exe 948 rlnvhln.exe 1760 fpdbnr.exe 872 xftjj.exe 596 dlltp.exe 1388 phfjr.exe 1016 tllfjdd.exe 840 fhxxh.exe 1540 bhhtx.exe 1772 fddxj.exe 1348 pbnfv.exe 2452 lflbjp.exe 2628 tfblhf.exe 2836 tptbh.exe 2632 bbjlfd.exe 2684 tvnbdjr.exe 1896 dlxhd.exe 1824 bhtjrn.exe 2948 vtbxlpd.exe 1872 lnxnh.exe 3036 dnhprn.exe 1812 xdjvp.exe 3024 dflnb.exe 1516 vtfdxht.exe 3052 ftdxjl.exe -
Processes:
resource yara_rule behavioral1/memory/2180-1-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ndltx.exe upx behavioral1/memory/2212-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2180-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhrppn.exe upx behavioral1/memory/1776-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1776-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2360-29-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrvprv.exe upx C:\nhtjn.exe upx behavioral1/memory/1252-38-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rxbbh.exe upx behavioral1/memory/1252-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1956-58-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\httnjjl.exe upx behavioral1/memory/2004-67-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrjjhhb.exe upx C:\hvftbxp.exe upx behavioral1/memory/2004-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/676-79-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\plnfdr.exe upx behavioral1/memory/516-94-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjlpfpt.exe upx behavioral1/memory/1740-101-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\txtxrxn.exe upx C:\bpflbv.exe upx behavioral1/memory/612-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/612-103-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vprbjp.exe upx C:\thtrtt.exe upx behavioral1/memory/2664-132-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tvxhft.exe upx C:\fhfjppv.exe upx behavioral1/memory/2668-149-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pbrpnn.exe upx behavioral1/memory/2860-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1832-166-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hpfhx.exe upx C:\nlvhhh.exe upx behavioral1/memory/2912-184-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\npvrfft.exe upx C:\bxlhdj.exe upx C:\hddtp.exe upx C:\rnrphbx.exe upx behavioral1/memory/1524-209-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jxddlv.exe upx C:\ddbltnr.exe upx C:\ttrrjdr.exe upx C:\hfbfh.exe upx behavioral1/memory/2428-243-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tfnbnrf.exe upx C:\bllhv.exe upx behavioral1/memory/800-259-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dbrfd.exe upx behavioral1/memory/2812-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2128-278-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jlbtxpj.exe upx C:\rrpvdr.exe upx behavioral1/memory/2124-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2180-302-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1580-323-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1988-336-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1636-337-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1636-343-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
57eb67bb8ac091aa44125f887dce308898fa16a04cdab2e2f51be3fbaed3b027_NeikiAnalytics.exendltx.exebhrppn.exelrvprv.exenhtjn.exerxbbh.exehttnjjl.exerrjjhhb.exehvftbxp.exeplnfdr.exejjlpfpt.exetxtxrxn.exebpflbv.exevprbjp.exethtrtt.exetvxhft.exedescription pid process target process PID 2180 wrote to memory of 2212 2180 57eb67bb8ac091aa44125f887dce308898fa16a04cdab2e2f51be3fbaed3b027_NeikiAnalytics.exe ndltx.exe PID 2180 wrote to memory of 2212 2180 57eb67bb8ac091aa44125f887dce308898fa16a04cdab2e2f51be3fbaed3b027_NeikiAnalytics.exe ndltx.exe PID 2180 wrote to memory of 2212 2180 57eb67bb8ac091aa44125f887dce308898fa16a04cdab2e2f51be3fbaed3b027_NeikiAnalytics.exe ndltx.exe PID 2180 wrote to memory of 2212 2180 57eb67bb8ac091aa44125f887dce308898fa16a04cdab2e2f51be3fbaed3b027_NeikiAnalytics.exe ndltx.exe PID 2212 wrote to memory of 1776 2212 ndltx.exe bhrppn.exe PID 2212 wrote to memory of 1776 2212 ndltx.exe bhrppn.exe PID 2212 wrote to memory of 1776 2212 ndltx.exe bhrppn.exe PID 2212 wrote to memory of 1776 2212 ndltx.exe bhrppn.exe PID 1776 wrote to memory of 2360 1776 bhrppn.exe lrvprv.exe PID 1776 wrote to memory of 2360 1776 bhrppn.exe lrvprv.exe PID 1776 wrote to memory of 2360 1776 bhrppn.exe lrvprv.exe PID 1776 wrote to memory of 2360 1776 bhrppn.exe lrvprv.exe PID 2360 wrote to memory of 1252 2360 lrvprv.exe nhtjn.exe PID 2360 wrote to memory of 1252 2360 lrvprv.exe nhtjn.exe PID 2360 wrote to memory of 1252 2360 lrvprv.exe nhtjn.exe PID 2360 wrote to memory of 1252 2360 lrvprv.exe nhtjn.exe PID 1252 wrote to memory of 1956 1252 nhtjn.exe rxbbh.exe PID 1252 wrote to memory of 1956 1252 nhtjn.exe rxbbh.exe PID 1252 wrote to memory of 1956 1252 nhtjn.exe rxbbh.exe PID 1252 wrote to memory of 1956 1252 nhtjn.exe rxbbh.exe PID 1956 wrote to memory of 2352 1956 rxbbh.exe httnjjl.exe PID 1956 wrote to memory of 2352 1956 rxbbh.exe httnjjl.exe PID 1956 wrote to memory of 2352 1956 rxbbh.exe httnjjl.exe PID 1956 wrote to memory of 2352 1956 rxbbh.exe httnjjl.exe PID 2352 wrote to memory of 2004 2352 httnjjl.exe rrjjhhb.exe PID 2352 wrote to memory of 2004 2352 httnjjl.exe rrjjhhb.exe PID 2352 wrote to memory of 2004 2352 httnjjl.exe rrjjhhb.exe PID 2352 wrote to memory of 2004 2352 httnjjl.exe rrjjhhb.exe PID 2004 wrote to memory of 676 2004 rrjjhhb.exe hvftbxp.exe PID 2004 wrote to memory of 676 2004 rrjjhhb.exe hvftbxp.exe PID 2004 wrote to memory of 676 2004 rrjjhhb.exe hvftbxp.exe PID 2004 wrote to memory of 676 2004 rrjjhhb.exe hvftbxp.exe PID 676 wrote to memory of 516 676 hvftbxp.exe plnfdr.exe PID 676 wrote to memory of 516 676 hvftbxp.exe plnfdr.exe PID 676 wrote to memory of 516 676 hvftbxp.exe plnfdr.exe PID 676 wrote to memory of 516 676 hvftbxp.exe plnfdr.exe PID 516 wrote to memory of 1740 516 plnfdr.exe jjlpfpt.exe PID 516 wrote to memory of 1740 516 plnfdr.exe jjlpfpt.exe PID 516 wrote to memory of 1740 516 plnfdr.exe jjlpfpt.exe PID 516 wrote to memory of 1740 516 plnfdr.exe jjlpfpt.exe PID 1740 wrote to memory of 612 1740 jjlpfpt.exe txtxrxn.exe PID 1740 wrote to memory of 612 1740 jjlpfpt.exe txtxrxn.exe PID 1740 wrote to memory of 612 1740 jjlpfpt.exe txtxrxn.exe PID 1740 wrote to memory of 612 1740 jjlpfpt.exe txtxrxn.exe PID 612 wrote to memory of 2472 612 txtxrxn.exe bpflbv.exe PID 612 wrote to memory of 2472 612 txtxrxn.exe bpflbv.exe PID 612 wrote to memory of 2472 612 txtxrxn.exe bpflbv.exe PID 612 wrote to memory of 2472 612 txtxrxn.exe bpflbv.exe PID 2472 wrote to memory of 2664 2472 bpflbv.exe vprbjp.exe PID 2472 wrote to memory of 2664 2472 bpflbv.exe vprbjp.exe PID 2472 wrote to memory of 2664 2472 bpflbv.exe vprbjp.exe PID 2472 wrote to memory of 2664 2472 bpflbv.exe vprbjp.exe PID 2664 wrote to memory of 2632 2664 vprbjp.exe thtrtt.exe PID 2664 wrote to memory of 2632 2664 vprbjp.exe thtrtt.exe PID 2664 wrote to memory of 2632 2664 vprbjp.exe thtrtt.exe PID 2664 wrote to memory of 2632 2664 vprbjp.exe thtrtt.exe PID 2632 wrote to memory of 2668 2632 thtrtt.exe tvxhft.exe PID 2632 wrote to memory of 2668 2632 thtrtt.exe tvxhft.exe PID 2632 wrote to memory of 2668 2632 thtrtt.exe tvxhft.exe PID 2632 wrote to memory of 2668 2632 thtrtt.exe tvxhft.exe PID 2668 wrote to memory of 2860 2668 tvxhft.exe fhfjppv.exe PID 2668 wrote to memory of 2860 2668 tvxhft.exe fhfjppv.exe PID 2668 wrote to memory of 2860 2668 tvxhft.exe fhfjppv.exe PID 2668 wrote to memory of 2860 2668 tvxhft.exe fhfjppv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57eb67bb8ac091aa44125f887dce308898fa16a04cdab2e2f51be3fbaed3b027_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\57eb67bb8ac091aa44125f887dce308898fa16a04cdab2e2f51be3fbaed3b027_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\ndltx.exec:\ndltx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\bhrppn.exec:\bhrppn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\lrvprv.exec:\lrvprv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\nhtjn.exec:\nhtjn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\rxbbh.exec:\rxbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\httnjjl.exec:\httnjjl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\rrjjhhb.exec:\rrjjhhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\hvftbxp.exec:\hvftbxp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\plnfdr.exec:\plnfdr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\jjlpfpt.exec:\jjlpfpt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\txtxrxn.exec:\txtxrxn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\bpflbv.exec:\bpflbv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\vprbjp.exec:\vprbjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\thtrtt.exec:\thtrtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\tvxhft.exec:\tvxhft.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\fhfjppv.exec:\fhfjppv.exe17⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pbrpnn.exec:\pbrpnn.exe18⤵
- Executes dropped EXE
PID:1832 -
\??\c:\hpfhx.exec:\hpfhx.exe19⤵
- Executes dropped EXE
PID:1872 -
\??\c:\nlvhhh.exec:\nlvhhh.exe20⤵
- Executes dropped EXE
PID:2912 -
\??\c:\npvrfft.exec:\npvrfft.exe21⤵
- Executes dropped EXE
PID:3024 -
\??\c:\bxlhdj.exec:\bxlhdj.exe22⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hddtp.exec:\hddtp.exe23⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rnrphbx.exec:\rnrphbx.exe24⤵
- Executes dropped EXE
PID:1404 -
\??\c:\jxddlv.exec:\jxddlv.exe25⤵
- Executes dropped EXE
PID:2516 -
\??\c:\ddbltnr.exec:\ddbltnr.exe26⤵
- Executes dropped EXE
PID:2960 -
\??\c:\ttrrjdr.exec:\ttrrjdr.exe27⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hfbfh.exec:\hfbfh.exe28⤵
- Executes dropped EXE
PID:1472 -
\??\c:\tfnbnrf.exec:\tfnbnrf.exe29⤵
- Executes dropped EXE
PID:800 -
\??\c:\bllhv.exec:\bllhv.exe30⤵
- Executes dropped EXE
PID:2812 -
\??\c:\dbrfd.exec:\dbrfd.exe31⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jlbtxpj.exec:\jlbtxpj.exe32⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rrpvdr.exec:\rrpvdr.exe33⤵
- Executes dropped EXE
PID:2124 -
\??\c:\bfrrbbf.exec:\bfrrbbf.exe34⤵
- Executes dropped EXE
PID:2180 -
\??\c:\vbjrt.exec:\vbjrt.exe35⤵
- Executes dropped EXE
PID:2200 -
\??\c:\tptfrj.exec:\tptfrj.exe36⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pdprf.exec:\pdprf.exe37⤵
- Executes dropped EXE
PID:1580 -
\??\c:\dhptvbv.exec:\dhptvbv.exe38⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rnfjjbn.exec:\rnfjjbn.exe39⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nldvd.exec:\nldvd.exe40⤵
- Executes dropped EXE
PID:1636 -
\??\c:\dbllpbn.exec:\dbllpbn.exe41⤵
- Executes dropped EXE
PID:1972 -
\??\c:\rlnvhln.exec:\rlnvhln.exe42⤵
- Executes dropped EXE
PID:948 -
\??\c:\fpdbnr.exec:\fpdbnr.exe43⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xftjj.exec:\xftjj.exe44⤵
- Executes dropped EXE
PID:872 -
\??\c:\dlltp.exec:\dlltp.exe45⤵
- Executes dropped EXE
PID:596 -
\??\c:\phfjr.exec:\phfjr.exe46⤵
- Executes dropped EXE
PID:1388 -
\??\c:\tllfjdd.exec:\tllfjdd.exe47⤵
- Executes dropped EXE
PID:1016 -
\??\c:\fhxxh.exec:\fhxxh.exe48⤵
- Executes dropped EXE
PID:840 -
\??\c:\bhhtx.exec:\bhhtx.exe49⤵
- Executes dropped EXE
PID:1540 -
\??\c:\fddxj.exec:\fddxj.exe50⤵
- Executes dropped EXE
PID:1772 -
\??\c:\pbnfv.exec:\pbnfv.exe51⤵
- Executes dropped EXE
PID:1348 -
\??\c:\lflbjp.exec:\lflbjp.exe52⤵
- Executes dropped EXE
PID:2452 -
\??\c:\tfblhf.exec:\tfblhf.exe53⤵
- Executes dropped EXE
PID:2628 -
\??\c:\tptbh.exec:\tptbh.exe54⤵
- Executes dropped EXE
PID:2836 -
\??\c:\bbjlfd.exec:\bbjlfd.exe55⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tvnbdjr.exec:\tvnbdjr.exe56⤵
- Executes dropped EXE
PID:2684 -
\??\c:\dlxhd.exec:\dlxhd.exe57⤵
- Executes dropped EXE
PID:1896 -
\??\c:\bhtjrn.exec:\bhtjrn.exe58⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vtbxlpd.exec:\vtbxlpd.exe59⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lnxnh.exec:\lnxnh.exe60⤵
- Executes dropped EXE
PID:1872 -
\??\c:\dnhprn.exec:\dnhprn.exe61⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xdjvp.exec:\xdjvp.exe62⤵
- Executes dropped EXE
PID:1812 -
\??\c:\dflnb.exec:\dflnb.exe63⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vtfdxht.exec:\vtfdxht.exe64⤵
- Executes dropped EXE
PID:1516 -
\??\c:\ftdxjl.exec:\ftdxjl.exe65⤵
- Executes dropped EXE
PID:3052 -
\??\c:\tpdjpfn.exec:\tpdjpfn.exe66⤵PID:964
-
\??\c:\plltd.exec:\plltd.exe67⤵PID:2820
-
\??\c:\vlfdvhh.exec:\vlfdvhh.exe68⤵PID:2588
-
\??\c:\xdpfn.exec:\xdpfn.exe69⤵PID:2504
-
\??\c:\htljbxl.exec:\htljbxl.exe70⤵PID:2428
-
\??\c:\pntlx.exec:\pntlx.exe71⤵PID:848
-
\??\c:\ltvdp.exec:\ltvdp.exe72⤵PID:2892
-
\??\c:\thddppr.exec:\thddppr.exe73⤵PID:1732
-
\??\c:\btxxll.exec:\btxxll.exe74⤵PID:2824
-
\??\c:\trtlrvd.exec:\trtlrvd.exe75⤵PID:888
-
\??\c:\rffdpv.exec:\rffdpv.exe76⤵PID:1304
-
\??\c:\tnhdlt.exec:\tnhdlt.exe77⤵PID:2116
-
\??\c:\pdlbd.exec:\pdlbd.exe78⤵PID:988
-
\??\c:\lnnlfhj.exec:\lnnlfhj.exe79⤵PID:2188
-
\??\c:\pvlrx.exec:\pvlrx.exe80⤵PID:1036
-
\??\c:\tnrdvp.exec:\tnrdvp.exe81⤵PID:1592
-
\??\c:\pbxfn.exec:\pbxfn.exe82⤵PID:1552
-
\??\c:\dtxhb.exec:\dtxhb.exe83⤵PID:2340
-
\??\c:\vnhhb.exec:\vnhhb.exe84⤵PID:1268
-
\??\c:\ndnrlhd.exec:\ndnrlhd.exe85⤵PID:1416
-
\??\c:\ptlhl.exec:\ptlhl.exe86⤵PID:2244
-
\??\c:\hnpxd.exec:\hnpxd.exe87⤵PID:2324
-
\??\c:\vplnx.exec:\vplnx.exe88⤵PID:2352
-
\??\c:\bdlvf.exec:\bdlvf.exe89⤵PID:268
-
\??\c:\txdrf.exec:\txdrf.exe90⤵PID:464
-
\??\c:\nllbh.exec:\nllbh.exe91⤵PID:596
-
\??\c:\jpjlb.exec:\jpjlb.exe92⤵PID:2260
-
\??\c:\ffnbbjl.exec:\ffnbbjl.exe93⤵PID:1500
-
\??\c:\vhxxfbt.exec:\vhxxfbt.exe94⤵PID:2408
-
\??\c:\hnrbb.exec:\hnrbb.exe95⤵PID:656
-
\??\c:\lxtbr.exec:\lxtbr.exe96⤵PID:1540
-
\??\c:\phtbjjn.exec:\phtbjjn.exe97⤵PID:2872
-
\??\c:\hdxxlrd.exec:\hdxxlrd.exe98⤵PID:2532
-
\??\c:\xtrhjrr.exec:\xtrhjrr.exe99⤵PID:2848
-
\??\c:\xvfnfj.exec:\xvfnfj.exe100⤵PID:2644
-
\??\c:\lltdtd.exec:\lltdtd.exe101⤵PID:2652
-
\??\c:\nbnxfn.exec:\nbnxfn.exe102⤵PID:1792
-
\??\c:\xjlplp.exec:\xjlplp.exe103⤵PID:1808
-
\??\c:\vvfpfnj.exec:\vvfpfnj.exe104⤵PID:1804
-
\??\c:\nfxtn.exec:\nfxtn.exe105⤵PID:1780
-
\??\c:\bldxn.exec:\bldxn.exe106⤵PID:1872
-
\??\c:\jfvrvv.exec:\jfvrvv.exe107⤵PID:3036
-
\??\c:\hfxndn.exec:\hfxndn.exe108⤵PID:1812
-
\??\c:\hxtxvd.exec:\hxtxvd.exe109⤵PID:2956
-
\??\c:\rlxnj.exec:\rlxnj.exe110⤵PID:240
-
\??\c:\tlhhj.exec:\tlhhj.exe111⤵PID:1604
-
\??\c:\xddhn.exec:\xddhn.exe112⤵PID:2424
-
\??\c:\djxfhjf.exec:\djxfhjf.exe113⤵PID:796
-
\??\c:\jndxvh.exec:\jndxvh.exe114⤵PID:1576
-
\??\c:\jnpdxdf.exec:\jnpdxdf.exe115⤵PID:3044
-
\??\c:\bnbvnbf.exec:\bnbvnbf.exe116⤵PID:2060
-
\??\c:\drjxpp.exec:\drjxpp.exe117⤵PID:2880
-
\??\c:\rdndbnb.exec:\rdndbnb.exe118⤵PID:2064
-
\??\c:\ffxhh.exec:\ffxhh.exe119⤵PID:1728
-
\??\c:\vfjfxj.exec:\vfjfxj.exe120⤵PID:1784
-
\??\c:\vvbhjhb.exec:\vvbhjhb.exe121⤵PID:900
-
\??\c:\frhhr.exec:\frhhr.exe122⤵PID:1156
-
\??\c:\dxdbjtt.exec:\dxdbjtt.exe123⤵PID:2124
-
\??\c:\tjpjd.exec:\tjpjd.exe124⤵PID:1684
-
\??\c:\ldfvj.exec:\ldfvj.exe125⤵PID:2096
-
\??\c:\tlrdvxd.exec:\tlrdvxd.exe126⤵PID:2228
-
\??\c:\xdtxr.exec:\xdtxr.exe127⤵PID:1696
-
\??\c:\dhhxjt.exec:\dhhxjt.exe128⤵PID:2348
-
\??\c:\lfndxn.exec:\lfndxn.exe129⤵PID:1204
-
\??\c:\xnvdpjb.exec:\xnvdpjb.exe130⤵PID:1608
-
\??\c:\lnjptl.exec:\lnjptl.exe131⤵PID:1636
-
\??\c:\vpxjh.exec:\vpxjh.exe132⤵PID:1972
-
\??\c:\phjpj.exec:\phjpj.exe133⤵PID:2028
-
\??\c:\ftfpvvx.exec:\ftfpvvx.exe134⤵PID:2020
-
\??\c:\vlllpfl.exec:\vlllpfl.exe135⤵PID:524
-
\??\c:\lrvrb.exec:\lrvrb.exe136⤵PID:268
-
\??\c:\pfdlf.exec:\pfdlf.exe137⤵PID:2592
-
\??\c:\lhhhfn.exec:\lhhhfn.exe138⤵PID:1744
-
\??\c:\lrtlt.exec:\lrtlt.exe139⤵PID:1152
-
\??\c:\hxfnfbn.exec:\hxfnfbn.exe140⤵PID:940
-
\??\c:\hfhnvbp.exec:\hfhnvbp.exe141⤵PID:612
-
\??\c:\jblnb.exec:\jblnb.exe142⤵PID:920
-
\??\c:\jhdffl.exec:\jhdffl.exe143⤵PID:1136
-
\??\c:\jjnxpnt.exec:\jjnxpnt.exe144⤵PID:1260
-
\??\c:\nhdtn.exec:\nhdtn.exe145⤵PID:2664
-
\??\c:\xpfjrlj.exec:\xpfjrlj.exe146⤵PID:2688
-
\??\c:\vhhjhh.exec:\vhhjhh.exe147⤵PID:1352
-
\??\c:\rrfphj.exec:\rrfphj.exe148⤵PID:1816
-
\??\c:\vptphx.exec:\vptphx.exe149⤵PID:2860
-
\??\c:\tdxrdvh.exec:\tdxrdvh.exe150⤵PID:2972
-
\??\c:\nxrprtf.exec:\nxrprtf.exe151⤵PID:1808
-
\??\c:\xfvpr.exec:\xfvpr.exe152⤵PID:3020
-
\??\c:\djpfd.exec:\djpfd.exe153⤵PID:2912
-
\??\c:\tvbpd.exec:\tvbpd.exe154⤵PID:2976
-
\??\c:\bpjxp.exec:\bpjxp.exe155⤵PID:2992
-
\??\c:\jbpfbd.exec:\jbpfbd.exe156⤵PID:2984
-
\??\c:\pbhxr.exec:\pbhxr.exe157⤵PID:1516
-
\??\c:\dntjhn.exec:\dntjhn.exe158⤵PID:2816
-
\??\c:\hnxpv.exec:\hnxpv.exe159⤵PID:560
-
\??\c:\vrnbp.exec:\vrnbp.exe160⤵PID:2492
-
\??\c:\frlvxx.exec:\frlvxx.exe161⤵PID:896
-
\??\c:\rrnrnt.exec:\rrnrnt.exe162⤵PID:1576
-
\??\c:\djtblft.exec:\djtblft.exe163⤵PID:1432
-
\??\c:\dfrdtv.exec:\dfrdtv.exe164⤵PID:800
-
\??\c:\jnxvxtn.exec:\jnxvxtn.exe165⤵PID:2732
-
\??\c:\tndrd.exec:\tndrd.exe166⤵PID:1560
-
\??\c:\bbhrfpp.exec:\bbhrfpp.exe167⤵PID:1728
-
\??\c:\hhrldjf.exec:\hhrldjf.exe168⤵PID:2440
-
\??\c:\tjnrv.exec:\tjnrv.exe169⤵PID:2204
-
\??\c:\vxvdbpf.exec:\vxvdbpf.exe170⤵PID:1156
-
\??\c:\fxllnnb.exec:\fxllnnb.exe171⤵PID:2124
-
\??\c:\jrbvr.exec:\jrbvr.exe172⤵PID:2188
-
\??\c:\rdrtvp.exec:\rdrtvp.exe173⤵PID:2040
-
\??\c:\tjnpd.exec:\tjnpd.exe174⤵PID:1588
-
\??\c:\dfvbhbt.exec:\dfvbhbt.exe175⤵PID:1552
-
\??\c:\jfttjl.exec:\jfttjl.exe176⤵PID:2340
-
\??\c:\dhtlh.exec:\dhtlh.exe177⤵PID:2360
-
\??\c:\hbvrlvn.exec:\hbvrlvn.exe178⤵PID:1608
-
\??\c:\thbpvh.exec:\thbpvh.exe179⤵PID:1992
-
\??\c:\djlnbv.exec:\djlnbv.exe180⤵PID:2012
-
\??\c:\fxpnvb.exec:\fxpnvb.exe181⤵PID:1436
-
\??\c:\brpfbt.exec:\brpfbt.exe182⤵PID:1164
-
\??\c:\vpdnv.exec:\vpdnv.exe183⤵PID:580
-
\??\c:\blptlth.exec:\blptlth.exe184⤵PID:2052
-
\??\c:\tpdbvhr.exec:\tpdbvhr.exe185⤵PID:1752
-
\??\c:\fxtjv.exec:\fxtjv.exe186⤵PID:840
-
\??\c:\phhfl.exec:\phhfl.exe187⤵PID:564
-
\??\c:\rjvjjt.exec:\rjvjjt.exe188⤵PID:940
-
\??\c:\tntrlhd.exec:\tntrlhd.exe189⤵PID:612
-
\??\c:\xnrpd.exec:\xnrpd.exe190⤵PID:920
-
\??\c:\blthd.exec:\blthd.exe191⤵PID:2540
-
\??\c:\tlxptx.exec:\tlxptx.exe192⤵PID:2536
-
\??\c:\phptrvt.exec:\phptrvt.exe193⤵PID:2692
-
\??\c:\jlnjl.exec:\jlnjl.exe194⤵PID:1944
-
\??\c:\fnnhfp.exec:\fnnhfp.exe195⤵PID:2864
-
\??\c:\lxvrhtx.exec:\lxvrhtx.exe196⤵PID:1896
-
\??\c:\fnrlt.exec:\fnrlt.exe197⤵PID:1624
-
\??\c:\hnftxh.exec:\hnftxh.exe198⤵PID:2936
-
\??\c:\lxvvthf.exec:\lxvvthf.exe199⤵PID:1808
-
\??\c:\hlbbdbv.exec:\hlbbdbv.exe200⤵PID:1384
-
\??\c:\vbvvjbb.exec:\vbvvjbb.exe201⤵PID:1872
-
\??\c:\xtvrtd.exec:\xtvrtd.exe202⤵PID:768
-
\??\c:\dpxdd.exec:\dpxdd.exe203⤵PID:980
-
\??\c:\lhdxvvh.exec:\lhdxvvh.exe204⤵PID:2984
-
\??\c:\xhlxpp.exec:\xhlxpp.exe205⤵PID:1516
-
\??\c:\xtnrdd.exec:\xtnrdd.exe206⤵PID:2516
-
\??\c:\hpvrj.exec:\hpvrj.exe207⤵PID:560
-
\??\c:\hnlbpj.exec:\hnlbpj.exe208⤵PID:2820
-
\??\c:\hjbrt.exec:\hjbrt.exe209⤵PID:2904
-
\??\c:\httvhnp.exec:\httvhnp.exe210⤵PID:2504
-
\??\c:\rnxdjn.exec:\rnxdjn.exe211⤵PID:1032
-
\??\c:\tfvjljb.exec:\tfvjljb.exe212⤵PID:2892
-
\??\c:\ddtbp.exec:\ddtbp.exe213⤵PID:2140
-
\??\c:\fvtvt.exec:\fvtvt.exe214⤵PID:1560
-
\??\c:\fdlxpx.exec:\fdlxpx.exe215⤵PID:2288
-
\??\c:\llpxl.exec:\llpxl.exe216⤵PID:2264
-
\??\c:\vjxbfl.exec:\vjxbfl.exe217⤵PID:2280
-
\??\c:\rdbnt.exec:\rdbnt.exe218⤵PID:2224
-
\??\c:\nftnnnh.exec:\nftnnnh.exe219⤵PID:2124
-
\??\c:\jdbtv.exec:\jdbtv.exe220⤵PID:2120
-
\??\c:\hxbfxhd.exec:\hxbfxhd.exe221⤵PID:2392
-
\??\c:\pnhbjxl.exec:\pnhbjxl.exe222⤵PID:2076
-
\??\c:\pnxhbxf.exec:\pnxhbxf.exe223⤵PID:944
-
\??\c:\dbbfnh.exec:\dbbfnh.exe224⤵PID:2340
-
\??\c:\lvdfht.exec:\lvdfht.exe225⤵PID:1956
-
\??\c:\tddhl.exec:\tddhl.exe226⤵PID:2032
-
\??\c:\npbxf.exec:\npbxf.exe227⤵PID:2324
-
\??\c:\pphhdd.exec:\pphhdd.exe228⤵PID:2352
-
\??\c:\bxlvr.exec:\bxlvr.exe229⤵PID:2020
-
\??\c:\xjtnfbp.exec:\xjtnfbp.exe230⤵PID:784
-
\??\c:\pxndn.exec:\pxndn.exe231⤵PID:2008
-
\??\c:\xxhvn.exec:\xxhvn.exe232⤵PID:704
-
\??\c:\tjxvnh.exec:\tjxvnh.exe233⤵PID:1096
-
\??\c:\bvlnvxr.exec:\bvlnvxr.exe234⤵PID:1596
-
\??\c:\jvnpln.exec:\jvnpln.exe235⤵PID:1500
-
\??\c:\bftfjrh.exec:\bftfjrh.exe236⤵PID:1520
-
\??\c:\xtpvbx.exec:\xtpvbx.exe237⤵PID:1332
-
\??\c:\lpltdp.exec:\lpltdp.exe238⤵PID:2884
-
\??\c:\fntvtjr.exec:\fntvtjr.exe239⤵PID:2600
-
\??\c:\vxhhpjh.exec:\vxhhpjh.exe240⤵PID:2836
-
\??\c:\nxbtnn.exec:\nxbtnn.exe241⤵PID:2632
-