Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 12:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
49efc7f95d951dc1e2ddecbd3b56de6143fb9483c4ebe6f461b53bb47bd4a108_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
49efc7f95d951dc1e2ddecbd3b56de6143fb9483c4ebe6f461b53bb47bd4a108_NeikiAnalytics.exe
-
Size
67KB
-
MD5
becb4a34a27fcfb62240bb397f2be0a0
-
SHA1
826c3f6df2d1f4cc60b9a94558a652ca1ef622a1
-
SHA256
49efc7f95d951dc1e2ddecbd3b56de6143fb9483c4ebe6f461b53bb47bd4a108
-
SHA512
f0e309c37440ec93c2f57e4f48ac968fd48a240e4093a9f4ac4042617caab33e393a9c9a8aa1fd1e8b2f4e3f1ad9a09d2182959f96aeb50634d50a0a78f9a066
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJ/RWPqBjfjD:ymb3NkkiQ3mdBjFIqsjH
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/3036-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1208-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1208-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/732-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1112-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1096-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1776-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
drvnb.exefbdpjn.exetntbp.exedpxhtxn.exevtnxlrp.exernpthd.exehvbppd.exenxprjxb.exetjbrrtf.exetrxdjb.exelflhp.exedbxthtp.exehrxxhnr.exetjthp.exertnxdp.exerxlrdld.exexdhnxh.exelfplnl.exetrnntn.exeppdbhvl.exexdxnf.exexjvrn.exetjxxj.exenptxxv.exetthvtp.exejprfr.exenblhv.exelrdhj.exedppnrnx.exedfpdt.exexhnjljj.exedrhfjf.exepjrdx.exelltjjfb.exelbpfhxf.exehhljjth.exevrtjbf.exenrhrv.exerbldvb.exevnbbrb.exejtbbrtr.exetftnp.exeftnlbf.exendvrltd.exepbbxdj.exenllbxr.exenjrnv.exelbprv.exepddvh.exerrrnhf.exetpdrf.exejrvtl.exeppfpd.exefnlvhv.exenvntjrr.exebvjppd.exernvlhnj.exertlhlb.exevlpnhb.exehpnvbx.exexjnhbf.exebhlvdj.exexdvnxvf.exelfjjbrh.exepid process 1984 drvnb.exe 2632 fbdpjn.exe 2420 tntbp.exe 2448 dpxhtxn.exe 2576 vtnxlrp.exe 2432 rnpthd.exe 1208 hvbppd.exe 732 nxprjxb.exe 1256 tjbrrtf.exe 564 trxdjb.exe 2852 lflhp.exe 2512 dbxthtp.exe 2656 hrxxhnr.exe 1924 tjthp.exe 1336 rtnxdp.exe 2760 rxlrdld.exe 1112 xdhnxh.exe 1096 lfplnl.exe 2272 trnntn.exe 2088 ppdbhvl.exe 1980 xdxnf.exe 2060 xjvrn.exe 3016 tjxxj.exe 1316 nptxxv.exe 1776 tthvtp.exe 1132 jprfr.exe 2204 nblhv.exe 1060 lrdhj.exe 2924 dppnrnx.exe 1008 dfpdt.exe 2008 xhnjljj.exe 1688 drhfjf.exe 1740 pjrdx.exe 3044 lltjjfb.exe 1988 lbpfhxf.exe 2560 hhljjth.exe 2564 vrtjbf.exe 2632 nrhrv.exe 2832 rbldvb.exe 2436 vnbbrb.exe 2580 jtbbrtr.exe 2416 tftnp.exe 2992 ftnlbf.exe 2980 ndvrltd.exe 1208 pbbxdj.exe 2592 nllbxr.exe 1468 njrnv.exe 1256 lbprv.exe 2856 pddvh.exe 2508 rrrnhf.exe 2588 tpdrf.exe 2680 jrvtl.exe 1588 ppfpd.exe 972 fnlvhv.exe 2748 nvntjrr.exe 1900 bvjppd.exe 608 rnvlhnj.exe 1748 rtlhlb.exe 1096 vlpnhb.exe 1188 hpnvbx.exe 1948 xjnhbf.exe 2908 bhlvdj.exe 2384 xdvnxvf.exe 1184 lfjjbrh.exe -
Processes:
resource yara_rule behavioral1/memory/3036-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1208-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1208-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1208-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/732-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/732-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/732-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/732-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/564-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1112-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1096-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1008-297-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-306-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
49efc7f95d951dc1e2ddecbd3b56de6143fb9483c4ebe6f461b53bb47bd4a108_NeikiAnalytics.exedrvnb.exefbdpjn.exetntbp.exedpxhtxn.exevtnxlrp.exernpthd.exehvbppd.exenxprjxb.exetjbrrtf.exetrxdjb.exelflhp.exedbxthtp.exehrxxhnr.exetjthp.exertnxdp.exedescription pid process target process PID 3036 wrote to memory of 1984 3036 49efc7f95d951dc1e2ddecbd3b56de6143fb9483c4ebe6f461b53bb47bd4a108_NeikiAnalytics.exe drvnb.exe PID 3036 wrote to memory of 1984 3036 49efc7f95d951dc1e2ddecbd3b56de6143fb9483c4ebe6f461b53bb47bd4a108_NeikiAnalytics.exe drvnb.exe PID 3036 wrote to memory of 1984 3036 49efc7f95d951dc1e2ddecbd3b56de6143fb9483c4ebe6f461b53bb47bd4a108_NeikiAnalytics.exe drvnb.exe PID 3036 wrote to memory of 1984 3036 49efc7f95d951dc1e2ddecbd3b56de6143fb9483c4ebe6f461b53bb47bd4a108_NeikiAnalytics.exe drvnb.exe PID 1984 wrote to memory of 2632 1984 drvnb.exe fbdpjn.exe PID 1984 wrote to memory of 2632 1984 drvnb.exe fbdpjn.exe PID 1984 wrote to memory of 2632 1984 drvnb.exe fbdpjn.exe PID 1984 wrote to memory of 2632 1984 drvnb.exe fbdpjn.exe PID 2632 wrote to memory of 2420 2632 fbdpjn.exe tntbp.exe PID 2632 wrote to memory of 2420 2632 fbdpjn.exe tntbp.exe PID 2632 wrote to memory of 2420 2632 fbdpjn.exe tntbp.exe PID 2632 wrote to memory of 2420 2632 fbdpjn.exe tntbp.exe PID 2420 wrote to memory of 2448 2420 tntbp.exe dpxhtxn.exe PID 2420 wrote to memory of 2448 2420 tntbp.exe dpxhtxn.exe PID 2420 wrote to memory of 2448 2420 tntbp.exe dpxhtxn.exe PID 2420 wrote to memory of 2448 2420 tntbp.exe dpxhtxn.exe PID 2448 wrote to memory of 2576 2448 dpxhtxn.exe vtnxlrp.exe PID 2448 wrote to memory of 2576 2448 dpxhtxn.exe vtnxlrp.exe PID 2448 wrote to memory of 2576 2448 dpxhtxn.exe vtnxlrp.exe PID 2448 wrote to memory of 2576 2448 dpxhtxn.exe vtnxlrp.exe PID 2576 wrote to memory of 2432 2576 vtnxlrp.exe rnpthd.exe PID 2576 wrote to memory of 2432 2576 vtnxlrp.exe rnpthd.exe PID 2576 wrote to memory of 2432 2576 vtnxlrp.exe rnpthd.exe PID 2576 wrote to memory of 2432 2576 vtnxlrp.exe rnpthd.exe PID 2432 wrote to memory of 1208 2432 rnpthd.exe hvbppd.exe PID 2432 wrote to memory of 1208 2432 rnpthd.exe hvbppd.exe PID 2432 wrote to memory of 1208 2432 rnpthd.exe hvbppd.exe PID 2432 wrote to memory of 1208 2432 rnpthd.exe hvbppd.exe PID 1208 wrote to memory of 732 1208 hvbppd.exe nxprjxb.exe PID 1208 wrote to memory of 732 1208 hvbppd.exe nxprjxb.exe PID 1208 wrote to memory of 732 1208 hvbppd.exe nxprjxb.exe PID 1208 wrote to memory of 732 1208 hvbppd.exe nxprjxb.exe PID 732 wrote to memory of 1256 732 nxprjxb.exe tjbrrtf.exe PID 732 wrote to memory of 1256 732 nxprjxb.exe tjbrrtf.exe PID 732 wrote to memory of 1256 732 nxprjxb.exe tjbrrtf.exe PID 732 wrote to memory of 1256 732 nxprjxb.exe tjbrrtf.exe PID 1256 wrote to memory of 564 1256 tjbrrtf.exe trxdjb.exe PID 1256 wrote to memory of 564 1256 tjbrrtf.exe trxdjb.exe PID 1256 wrote to memory of 564 1256 tjbrrtf.exe trxdjb.exe PID 1256 wrote to memory of 564 1256 tjbrrtf.exe trxdjb.exe PID 564 wrote to memory of 2852 564 trxdjb.exe lflhp.exe PID 564 wrote to memory of 2852 564 trxdjb.exe lflhp.exe PID 564 wrote to memory of 2852 564 trxdjb.exe lflhp.exe PID 564 wrote to memory of 2852 564 trxdjb.exe lflhp.exe PID 2852 wrote to memory of 2512 2852 lflhp.exe dbxthtp.exe PID 2852 wrote to memory of 2512 2852 lflhp.exe dbxthtp.exe PID 2852 wrote to memory of 2512 2852 lflhp.exe dbxthtp.exe PID 2852 wrote to memory of 2512 2852 lflhp.exe dbxthtp.exe PID 2512 wrote to memory of 2656 2512 dbxthtp.exe hrxxhnr.exe PID 2512 wrote to memory of 2656 2512 dbxthtp.exe hrxxhnr.exe PID 2512 wrote to memory of 2656 2512 dbxthtp.exe hrxxhnr.exe PID 2512 wrote to memory of 2656 2512 dbxthtp.exe hrxxhnr.exe PID 2656 wrote to memory of 1924 2656 hrxxhnr.exe tjthp.exe PID 2656 wrote to memory of 1924 2656 hrxxhnr.exe tjthp.exe PID 2656 wrote to memory of 1924 2656 hrxxhnr.exe tjthp.exe PID 2656 wrote to memory of 1924 2656 hrxxhnr.exe tjthp.exe PID 1924 wrote to memory of 1336 1924 tjthp.exe rtnxdp.exe PID 1924 wrote to memory of 1336 1924 tjthp.exe rtnxdp.exe PID 1924 wrote to memory of 1336 1924 tjthp.exe rtnxdp.exe PID 1924 wrote to memory of 1336 1924 tjthp.exe rtnxdp.exe PID 1336 wrote to memory of 2760 1336 rtnxdp.exe rxlrdld.exe PID 1336 wrote to memory of 2760 1336 rtnxdp.exe rxlrdld.exe PID 1336 wrote to memory of 2760 1336 rtnxdp.exe rxlrdld.exe PID 1336 wrote to memory of 2760 1336 rtnxdp.exe rxlrdld.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\49efc7f95d951dc1e2ddecbd3b56de6143fb9483c4ebe6f461b53bb47bd4a108_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\49efc7f95d951dc1e2ddecbd3b56de6143fb9483c4ebe6f461b53bb47bd4a108_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\drvnb.exec:\drvnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fbdpjn.exec:\fbdpjn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tntbp.exec:\tntbp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpxhtxn.exec:\dpxhtxn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vtnxlrp.exec:\vtnxlrp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rnpthd.exec:\rnpthd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hvbppd.exec:\hvbppd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nxprjxb.exec:\nxprjxb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tjbrrtf.exec:\tjbrrtf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\trxdjb.exec:\trxdjb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lflhp.exec:\lflhp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dbxthtp.exec:\dbxthtp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hrxxhnr.exec:\hrxxhnr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tjthp.exec:\tjthp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rtnxdp.exec:\rtnxdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxlrdld.exec:\rxlrdld.exe17⤵
- Executes dropped EXE
-
\??\c:\xdhnxh.exec:\xdhnxh.exe18⤵
- Executes dropped EXE
-
\??\c:\lfplnl.exec:\lfplnl.exe19⤵
- Executes dropped EXE
-
\??\c:\trnntn.exec:\trnntn.exe20⤵
- Executes dropped EXE
-
\??\c:\ppdbhvl.exec:\ppdbhvl.exe21⤵
- Executes dropped EXE
-
\??\c:\xdxnf.exec:\xdxnf.exe22⤵
- Executes dropped EXE
-
\??\c:\xjvrn.exec:\xjvrn.exe23⤵
- Executes dropped EXE
-
\??\c:\tjxxj.exec:\tjxxj.exe24⤵
- Executes dropped EXE
-
\??\c:\nptxxv.exec:\nptxxv.exe25⤵
- Executes dropped EXE
-
\??\c:\tthvtp.exec:\tthvtp.exe26⤵
- Executes dropped EXE
-
\??\c:\jprfr.exec:\jprfr.exe27⤵
- Executes dropped EXE
-
\??\c:\nblhv.exec:\nblhv.exe28⤵
- Executes dropped EXE
-
\??\c:\lrdhj.exec:\lrdhj.exe29⤵
- Executes dropped EXE
-
\??\c:\dppnrnx.exec:\dppnrnx.exe30⤵
- Executes dropped EXE
-
\??\c:\dfpdt.exec:\dfpdt.exe31⤵
- Executes dropped EXE
-
\??\c:\xhnjljj.exec:\xhnjljj.exe32⤵
- Executes dropped EXE
-
\??\c:\drhfjf.exec:\drhfjf.exe33⤵
- Executes dropped EXE
-
\??\c:\pjrdx.exec:\pjrdx.exe34⤵
- Executes dropped EXE
-
\??\c:\lltjjfb.exec:\lltjjfb.exe35⤵
- Executes dropped EXE
-
\??\c:\lbpfhxf.exec:\lbpfhxf.exe36⤵
- Executes dropped EXE
-
\??\c:\hhljjth.exec:\hhljjth.exe37⤵
- Executes dropped EXE
-
\??\c:\vrtjbf.exec:\vrtjbf.exe38⤵
- Executes dropped EXE
-
\??\c:\nrhrv.exec:\nrhrv.exe39⤵
- Executes dropped EXE
-
\??\c:\rbldvb.exec:\rbldvb.exe40⤵
- Executes dropped EXE
-
\??\c:\vnbbrb.exec:\vnbbrb.exe41⤵
- Executes dropped EXE
-
\??\c:\jtbbrtr.exec:\jtbbrtr.exe42⤵
- Executes dropped EXE
-
\??\c:\tftnp.exec:\tftnp.exe43⤵
- Executes dropped EXE
-
\??\c:\ftnlbf.exec:\ftnlbf.exe44⤵
- Executes dropped EXE
-
\??\c:\ndvrltd.exec:\ndvrltd.exe45⤵
- Executes dropped EXE
-
\??\c:\pbbxdj.exec:\pbbxdj.exe46⤵
- Executes dropped EXE
-
\??\c:\nllbxr.exec:\nllbxr.exe47⤵
- Executes dropped EXE
-
\??\c:\njrnv.exec:\njrnv.exe48⤵
- Executes dropped EXE
-
\??\c:\lbprv.exec:\lbprv.exe49⤵
- Executes dropped EXE
-
\??\c:\pddvh.exec:\pddvh.exe50⤵
- Executes dropped EXE
-
\??\c:\rrrnhf.exec:\rrrnhf.exe51⤵
- Executes dropped EXE
-
\??\c:\tpdrf.exec:\tpdrf.exe52⤵
- Executes dropped EXE
-
\??\c:\jrvtl.exec:\jrvtl.exe53⤵
- Executes dropped EXE
-
\??\c:\ppfpd.exec:\ppfpd.exe54⤵
- Executes dropped EXE
-
\??\c:\fnlvhv.exec:\fnlvhv.exe55⤵
- Executes dropped EXE
-
\??\c:\nvntjrr.exec:\nvntjrr.exe56⤵
- Executes dropped EXE
-
\??\c:\bvjppd.exec:\bvjppd.exe57⤵
- Executes dropped EXE
-
\??\c:\rnvlhnj.exec:\rnvlhnj.exe58⤵
- Executes dropped EXE
-
\??\c:\rtlhlb.exec:\rtlhlb.exe59⤵
- Executes dropped EXE
-
\??\c:\vlpnhb.exec:\vlpnhb.exe60⤵
- Executes dropped EXE
-
\??\c:\hpnvbx.exec:\hpnvbx.exe61⤵
- Executes dropped EXE
-
\??\c:\xjnhbf.exec:\xjnhbf.exe62⤵
- Executes dropped EXE
-
\??\c:\bhlvdj.exec:\bhlvdj.exe63⤵
- Executes dropped EXE
-
\??\c:\xdvnxvf.exec:\xdvnxvf.exe64⤵
- Executes dropped EXE
-
\??\c:\lfjjbrh.exec:\lfjjbrh.exe65⤵
- Executes dropped EXE
-
\??\c:\tndrhb.exec:\tndrhb.exe66⤵
-
\??\c:\pvnrxrl.exec:\pvnrxrl.exe67⤵
-
\??\c:\llvtttf.exec:\llvtttf.exe68⤵
-
\??\c:\ptlpxd.exec:\ptlpxd.exe69⤵
-
\??\c:\jlnhbhn.exec:\jlnhbhn.exe70⤵
-
\??\c:\dlrvx.exec:\dlrvx.exe71⤵
-
\??\c:\fdjrdfb.exec:\fdjrdfb.exe72⤵
-
\??\c:\dnpnh.exec:\dnpnh.exe73⤵
-
\??\c:\xfpjd.exec:\xfpjd.exe74⤵
-
\??\c:\rdxprnt.exec:\rdxprnt.exe75⤵
-
\??\c:\jvdrntl.exec:\jvdrntl.exe76⤵
-
\??\c:\btlfn.exec:\btlfn.exe77⤵
-
\??\c:\lxfnvd.exec:\lxfnvd.exe78⤵
-
\??\c:\xlxfl.exec:\xlxfl.exe79⤵
-
\??\c:\fldjp.exec:\fldjp.exe80⤵
-
\??\c:\hdxdhn.exec:\hdxdhn.exe81⤵
-
\??\c:\rxrhd.exec:\rxrhd.exe82⤵
-
\??\c:\vhfhlpd.exec:\vhfhlpd.exe83⤵
-
\??\c:\bjlpnf.exec:\bjlpnf.exe84⤵
-
\??\c:\vbpjn.exec:\vbpjn.exe85⤵
-
\??\c:\lnnrnx.exec:\lnnrnx.exe86⤵
-
\??\c:\xdbjvvf.exec:\xdbjvvf.exe87⤵
-
\??\c:\fjvdh.exec:\fjvdh.exe88⤵
-
\??\c:\ptbnbrx.exec:\ptbnbrx.exe89⤵
-
\??\c:\xhhlf.exec:\xhhlf.exe90⤵
-
\??\c:\dbdxpvv.exec:\dbdxpvv.exe91⤵
-
\??\c:\xrxffhr.exec:\xrxffhr.exe92⤵
-
\??\c:\jhxplf.exec:\jhxplf.exe93⤵
-
\??\c:\frdprhf.exec:\frdprhf.exe94⤵
-
\??\c:\hhthl.exec:\hhthl.exe95⤵
-
\??\c:\fhxhl.exec:\fhxhl.exe96⤵
-
\??\c:\pfdvn.exec:\pfdvn.exe97⤵
-
\??\c:\pjdbjrt.exec:\pjdbjrt.exe98⤵
-
\??\c:\pjrbr.exec:\pjrbr.exe99⤵
-
\??\c:\vlpjxh.exec:\vlpjxh.exe100⤵
-
\??\c:\lfvpbpn.exec:\lfvpbpn.exe101⤵
-
\??\c:\bdllj.exec:\bdllj.exe102⤵
-
\??\c:\tvdthj.exec:\tvdthj.exe103⤵
-
\??\c:\xbfxjt.exec:\xbfxjt.exe104⤵
-
\??\c:\tbrhbd.exec:\tbrhbd.exe105⤵
-
\??\c:\rftrt.exec:\rftrt.exe106⤵
-
\??\c:\rftnv.exec:\rftnv.exe107⤵
-
\??\c:\vnxvjf.exec:\vnxvjf.exe108⤵
-
\??\c:\lvjhvrf.exec:\lvjhvrf.exe109⤵
-
\??\c:\pphxbdf.exec:\pphxbdf.exe110⤵
-
\??\c:\jbhhhr.exec:\jbhhhr.exe111⤵
-
\??\c:\fjjjn.exec:\fjjjn.exe112⤵
-
\??\c:\bbhlvpp.exec:\bbhlvpp.exe113⤵
-
\??\c:\lxxfbx.exec:\lxxfbx.exe114⤵
-
\??\c:\jbvxx.exec:\jbvxx.exe115⤵
-
\??\c:\xnljbbf.exec:\xnljbbf.exe116⤵
-
\??\c:\rpvvdh.exec:\rpvvdh.exe117⤵
-
\??\c:\rftxnb.exec:\rftxnb.exe118⤵
-
\??\c:\lhtpv.exec:\lhtpv.exe119⤵
-
\??\c:\vdhxdf.exec:\vdhxdf.exe120⤵
-
\??\c:\hnlpv.exec:\hnlpv.exe121⤵
-
\??\c:\fvjhb.exec:\fvjhb.exe122⤵
-
\??\c:\jbdnpfh.exec:\jbdnpfh.exe123⤵
-
\??\c:\tljnv.exec:\tljnv.exe124⤵
-
\??\c:\ldptjb.exec:\ldptjb.exe125⤵
-
\??\c:\brfvnph.exec:\brfvnph.exe126⤵
-
\??\c:\njvhrn.exec:\njvhrn.exe127⤵
-
\??\c:\vdrlxxh.exec:\vdrlxxh.exe128⤵
-
\??\c:\hvfrd.exec:\hvfrd.exe129⤵
-
\??\c:\dprrr.exec:\dprrr.exe130⤵
-
\??\c:\vhrpxd.exec:\vhrpxd.exe131⤵
-
\??\c:\xdhnppf.exec:\xdhnppf.exe132⤵
-
\??\c:\dphhxdd.exec:\dphhxdd.exe133⤵
-
\??\c:\jxdtbxh.exec:\jxdtbxh.exe134⤵
-
\??\c:\lpxvd.exec:\lpxvd.exe135⤵
-
\??\c:\rdxpl.exec:\rdxpl.exe136⤵
-
\??\c:\npbhv.exec:\npbhv.exe137⤵
-
\??\c:\njthxxp.exec:\njthxxp.exe138⤵
-
\??\c:\tltbx.exec:\tltbx.exe139⤵
-
\??\c:\ljnxp.exec:\ljnxp.exe140⤵
-
\??\c:\nhbntpn.exec:\nhbntpn.exe141⤵
-
\??\c:\nxtjbrd.exec:\nxtjbrd.exe142⤵
-
\??\c:\vbpfvxx.exec:\vbpfvxx.exe143⤵
-
\??\c:\lbdlf.exec:\lbdlf.exe144⤵
-
\??\c:\xntrxt.exec:\xntrxt.exe145⤵
-
\??\c:\vhvfxlr.exec:\vhvfxlr.exe146⤵
-
\??\c:\rlvbl.exec:\rlvbl.exe147⤵
-
\??\c:\pvxbtf.exec:\pvxbtf.exe148⤵
-
\??\c:\pbnnr.exec:\pbnnr.exe149⤵
-
\??\c:\dxbnnp.exec:\dxbnnp.exe150⤵
-
\??\c:\rntrnn.exec:\rntrnn.exe151⤵
-
\??\c:\nvfdlrt.exec:\nvfdlrt.exe152⤵
-
\??\c:\vvrlh.exec:\vvrlh.exe153⤵
-
\??\c:\fnjtt.exec:\fnjtt.exe154⤵
-
\??\c:\drnrt.exec:\drnrt.exe155⤵
-
\??\c:\vtbhfp.exec:\vtbhfp.exe156⤵
-
\??\c:\lnrllf.exec:\lnrllf.exe157⤵
-
\??\c:\brbptn.exec:\brbptn.exe158⤵
-
\??\c:\lvbhh.exec:\lvbhh.exe159⤵
-
\??\c:\htxrn.exec:\htxrn.exe160⤵
-
\??\c:\rvhhtvr.exec:\rvhhtvr.exe161⤵
-
\??\c:\llphvfr.exec:\llphvfr.exe162⤵
-
\??\c:\nbhxhxn.exec:\nbhxhxn.exe163⤵
-
\??\c:\nxlthj.exec:\nxlthj.exe164⤵
-
\??\c:\ltrrbn.exec:\ltrrbn.exe165⤵
-
\??\c:\xflvxp.exec:\xflvxp.exe166⤵
-
\??\c:\xlfll.exec:\xlfll.exe167⤵
-
\??\c:\rxxjbdb.exec:\rxxjbdb.exe168⤵
-
\??\c:\xfvrl.exec:\xfvrl.exe169⤵
-
\??\c:\rnblhjr.exec:\rnblhjr.exe170⤵
-
\??\c:\dhblv.exec:\dhblv.exe171⤵
-
\??\c:\fvbfr.exec:\fvbfr.exe172⤵
-
\??\c:\lhdfxb.exec:\lhdfxb.exe173⤵
-
\??\c:\ntfxtnr.exec:\ntfxtnr.exe174⤵
-
\??\c:\jpxxhhh.exec:\jpxxhhh.exe175⤵
-
\??\c:\bvtdd.exec:\bvtdd.exe176⤵
-
\??\c:\nlvvnvv.exec:\nlvvnvv.exe177⤵
-
\??\c:\nrrhh.exec:\nrrhh.exe178⤵
-
\??\c:\nffrr.exec:\nffrr.exe179⤵
-
\??\c:\xffrhpl.exec:\xffrhpl.exe180⤵
-
\??\c:\rdfftj.exec:\rdfftj.exe181⤵
-
\??\c:\xvrlb.exec:\xvrlb.exe182⤵
-
\??\c:\htdphd.exec:\htdphd.exe183⤵
-
\??\c:\jhvnbnx.exec:\jhvnbnx.exe184⤵
-
\??\c:\vnnnrxr.exec:\vnnnrxr.exe185⤵
-
\??\c:\bbnbxrr.exec:\bbnbxrr.exe186⤵
-
\??\c:\bbxxlnv.exec:\bbxxlnv.exe187⤵
-
\??\c:\dxndlj.exec:\dxndlj.exe188⤵
-
\??\c:\dnxfhtn.exec:\dnxfhtn.exe189⤵
-
\??\c:\dvrfvt.exec:\dvrfvt.exe190⤵
-
\??\c:\thxtpln.exec:\thxtpln.exe191⤵
-
\??\c:\ljftdrp.exec:\ljftdrp.exe192⤵
-
\??\c:\vvbxlf.exec:\vvbxlf.exe193⤵
-
\??\c:\bbhfdn.exec:\bbhfdn.exe194⤵
-
\??\c:\xhlrb.exec:\xhlrb.exe195⤵
-
\??\c:\pjdrddl.exec:\pjdrddl.exe196⤵
-
\??\c:\rnlvt.exec:\rnlvt.exe197⤵
-
\??\c:\jlhdvb.exec:\jlhdvb.exe198⤵
-
\??\c:\lplbbfx.exec:\lplbbfx.exe199⤵
-
\??\c:\llhth.exec:\llhth.exe200⤵
-
\??\c:\prdnrth.exec:\prdnrth.exe201⤵
-
\??\c:\bndld.exec:\bndld.exe202⤵
-
\??\c:\hdrfnh.exec:\hdrfnh.exe203⤵
-
\??\c:\jjrnhp.exec:\jjrnhp.exe204⤵
-
\??\c:\jtvdf.exec:\jtvdf.exe205⤵
-
\??\c:\dlpbvvb.exec:\dlpbvvb.exe206⤵
-
\??\c:\blxhjdf.exec:\blxhjdf.exe207⤵
-
\??\c:\nhpphh.exec:\nhpphh.exe208⤵
-
\??\c:\xppjft.exec:\xppjft.exe209⤵
-
\??\c:\tdnnvhr.exec:\tdnnvhr.exe210⤵
-
\??\c:\jnnblfv.exec:\jnnblfv.exe211⤵
-
\??\c:\bhtfx.exec:\bhtfx.exe212⤵
-
\??\c:\rvnvhhr.exec:\rvnvhhr.exe213⤵
-
\??\c:\bjfdp.exec:\bjfdp.exe214⤵
-
\??\c:\vjrdt.exec:\vjrdt.exe215⤵
-
\??\c:\tltvv.exec:\tltvv.exe216⤵
-
\??\c:\fnjjbl.exec:\fnjjbl.exe217⤵
-
\??\c:\ffnpvpf.exec:\ffnpvpf.exe218⤵
-
\??\c:\lvxhdpl.exec:\lvxhdpl.exe219⤵
-
\??\c:\tlvrd.exec:\tlvrd.exe220⤵
-
\??\c:\fjflnd.exec:\fjflnd.exe221⤵
-
\??\c:\txxjff.exec:\txxjff.exe222⤵
-
\??\c:\vvhjd.exec:\vvhjd.exe223⤵
-
\??\c:\dxjnt.exec:\dxjnt.exe224⤵
-
\??\c:\xphbn.exec:\xphbn.exe225⤵
-
\??\c:\hlhlt.exec:\hlhlt.exe226⤵
-
\??\c:\tpdxbbp.exec:\tpdxbbp.exe227⤵
-
\??\c:\dndjx.exec:\dndjx.exe228⤵
-
\??\c:\btxhtrp.exec:\btxhtrp.exe229⤵
-
\??\c:\hbrfnxl.exec:\hbrfnxl.exe230⤵
-
\??\c:\bbjbv.exec:\bbjbv.exe231⤵
-
\??\c:\rndbb.exec:\rndbb.exe232⤵
-
\??\c:\rvbdb.exec:\rvbdb.exe233⤵
-
\??\c:\jhnppxj.exec:\jhnppxj.exe234⤵
-
\??\c:\pjpdf.exec:\pjpdf.exe235⤵
-
\??\c:\prhnlvp.exec:\prhnlvp.exe236⤵
-
\??\c:\dbjjd.exec:\dbjjd.exe237⤵
-
\??\c:\rlnjtt.exec:\rlnjtt.exe238⤵
-
\??\c:\ntttnlr.exec:\ntttnlr.exe239⤵
-
\??\c:\pjpdhrp.exec:\pjpdhrp.exe240⤵
-
\??\c:\bxxddh.exec:\bxxddh.exe241⤵