Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:57
Behavioral task
behavioral1
Sample
1922618342dfb1d62f1cedce4c6b7d90_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
1922618342dfb1d62f1cedce4c6b7d90_NeikiAnalytics.exe
-
Size
75KB
-
MD5
1922618342dfb1d62f1cedce4c6b7d90
-
SHA1
0f8b9beaac510c54e413e6c450426dc99ced2816
-
SHA256
f92a5ef402178f316dabef6a2e5d87fef0c65770fac7f087d2907ccb923b2528
-
SHA512
b678b8a607152c4d721fce53eb83006a0827dd0860b180e576861c5d089acdb8140230260a1bd52d2733701f925ff631d297801ee2ae5c46f664d0c92cfd4116
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWoFLAxZhMDzE8V:9hOmTsF93UYfwC6GIoutz5yLpOSDv
Malware Config
Signatures
-
Detect Blackmoon payload 46 IoCs
Processes:
resource yara_rule behavioral1/memory/836-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-346-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2148-345-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1008-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-317-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1288-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-291-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1816-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1844-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1092-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1512-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/888-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1292-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1488-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1028-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1616-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-549-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/364-637-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-674-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-736-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2792-907-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2844-982-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-1161-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2672-1218-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2200-1272-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2912-1420-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1736-1460-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
phfbb.exerdpxfd.exeflbfdfl.exejxdfn.exefdjpj.exenjdrxdh.exendprht.exeljrbxpp.exeplltbnh.exethxhbx.exejjttndl.exexbdnpff.exerfbnht.exelvvttf.exetjpldl.exerpblx.exerrvlt.exexllhtj.exehfldthd.exejjrpdjl.exerxbdxh.exevxfxtlf.exebbhhv.exehdldvv.exetjpdxd.exebbrbbt.exexblnfpt.exedbrdnbd.exerbnvh.exevrxvft.exepjptp.exeffhdv.exexlhph.exenpfvpd.exexhjtlrd.exexdpxp.exexlxrrd.exebjbpfr.exexxxfdl.exedfvprvj.exelrjfnn.exebvbnhjp.exedpjdpjh.exerfbvhd.exefxndbxl.exedbdvnbd.exettrrf.exebnfbnb.exethbhf.exedtxpnh.exedthhrpl.exedprddfl.exedvjfdhx.exepptfxx.exexlxpfj.exeptdlvtt.exerlrlbv.exejxlpxpt.exejjxbt.exefjxrv.exedtpdhxf.exefhhvffn.exetnlfrfd.exepvdtlh.exepid process 2604 phfbb.exe 2084 rdpxfd.exe 1028 flbfdfl.exe 1724 jxdfn.exe 2804 fdjpj.exe 1488 njdrxdh.exe 1824 ndprht.exe 2600 ljrbxpp.exe 2556 plltbnh.exe 2676 thxhbx.exe 2548 jjttndl.exe 2448 xbdnpff.exe 2588 rfbnht.exe 2128 lvvttf.exe 2208 tjpldl.exe 2196 rpblx.exe 1292 rrvlt.exe 2228 xllhtj.exe 888 hfldthd.exe 1512 jjrpdjl.exe 1656 rxbdxh.exe 1616 vxfxtlf.exe 1624 bbhhv.exe 1092 hdldvv.exe 1776 tjpdxd.exe 1844 bbrbbt.exe 696 xblnfpt.exe 1972 dbrdnbd.exe 1816 rbnvh.exe 2708 vrxvft.exe 2144 pjptp.exe 2028 ffhdv.exe 2108 xlhph.exe 3044 npfvpd.exe 1288 xhjtlrd.exe 2148 xdpxp.exe 2956 xlxrrd.exe 3032 bjbpfr.exe 1008 xxxfdl.exe 1728 dfvprvj.exe 1716 lrjfnn.exe 2864 bvbnhjp.exe 2804 dpjdpjh.exe 836 rfbvhd.exe 1872 fxndbxl.exe 2500 dbdvnbd.exe 2992 ttrrf.exe 2560 bnfbnb.exe 2676 thbhf.exe 2548 dtxpnh.exe 2448 dthhrpl.exe 2536 dprddfl.exe 2624 dvjfdhx.exe 3048 pptfxx.exe 2456 xlxpfj.exe 2252 ptdlvtt.exe 2192 rlrlbv.exe 1924 jxlpxpt.exe 1596 jjxbt.exe 1676 fjxrv.exe 1648 dtpdhxf.exe 1764 fhhvffn.exe 932 tnlfrfd.exe 1684 pvdtlh.exe -
Processes:
resource yara_rule behavioral1/memory/836-374-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-361-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-360-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1716-347-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1008-338-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3032-331-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1288-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1872-381-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ffhdv.exe upx \??\c:\pjptp.exe upx \??\c:\vrxvft.exe upx behavioral1/memory/1816-266-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rbnvh.exe upx behavioral1/memory/1972-257-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dbrdnbd.exe upx \??\c:\xblnfpt.exe upx behavioral1/memory/1844-240-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bbrbbt.exe upx \??\c:\tjpdxd.exe upx behavioral1/memory/1092-224-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hdldvv.exe upx behavioral1/memory/1092-215-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bbhhv.exe upx \??\c:\vxfxtlf.exe upx \??\c:\rxbdxh.exe upx behavioral1/memory/1512-189-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjrpdjl.exe upx behavioral1/memory/888-180-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hfldthd.exe upx behavioral1/memory/2228-172-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xllhtj.exe upx behavioral1/memory/1292-162-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrvlt.exe upx behavioral1/memory/2196-153-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rpblx.exe upx behavioral1/memory/2196-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2208-145-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tjpldl.exe upx \??\c:\lvvttf.exe upx behavioral1/memory/2128-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2588-127-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rfbnht.exe upx behavioral1/memory/2588-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2448-117-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xbdnpff.exe upx behavioral1/memory/2548-108-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjttndl.exe upx \??\c:\thxhbx.exe upx behavioral1/memory/2556-91-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\plltbnh.exe upx behavioral1/memory/2600-82-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ljrbxpp.exe upx behavioral1/memory/1824-73-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ndprht.exe upx behavioral1/memory/1824-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1488-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2992-388-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\njdrxdh.exe upx behavioral1/memory/2804-54-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fdjpj.exe upx \??\c:\jxdfn.exe upx behavioral1/memory/1028-37-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\flbfdfl.exe upx behavioral1/memory/1028-28-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1922618342dfb1d62f1cedce4c6b7d90_NeikiAnalytics.exephfbb.exerdpxfd.exeflbfdfl.exejxdfn.exefdjpj.exenjdrxdh.exendprht.exeljrbxpp.exeplltbnh.exethxhbx.exejjttndl.exexbdnpff.exerfbnht.exelvvttf.exetjpldl.exedescription pid process target process PID 2148 wrote to memory of 2604 2148 1922618342dfb1d62f1cedce4c6b7d90_NeikiAnalytics.exe phfbb.exe PID 2148 wrote to memory of 2604 2148 1922618342dfb1d62f1cedce4c6b7d90_NeikiAnalytics.exe phfbb.exe PID 2148 wrote to memory of 2604 2148 1922618342dfb1d62f1cedce4c6b7d90_NeikiAnalytics.exe phfbb.exe PID 2148 wrote to memory of 2604 2148 1922618342dfb1d62f1cedce4c6b7d90_NeikiAnalytics.exe phfbb.exe PID 2604 wrote to memory of 2084 2604 phfbb.exe rdpxfd.exe PID 2604 wrote to memory of 2084 2604 phfbb.exe rdpxfd.exe PID 2604 wrote to memory of 2084 2604 phfbb.exe rdpxfd.exe PID 2604 wrote to memory of 2084 2604 phfbb.exe rdpxfd.exe PID 2084 wrote to memory of 1028 2084 rdpxfd.exe flbfdfl.exe PID 2084 wrote to memory of 1028 2084 rdpxfd.exe flbfdfl.exe PID 2084 wrote to memory of 1028 2084 rdpxfd.exe flbfdfl.exe PID 2084 wrote to memory of 1028 2084 rdpxfd.exe flbfdfl.exe PID 1028 wrote to memory of 1724 1028 flbfdfl.exe jxdfn.exe PID 1028 wrote to memory of 1724 1028 flbfdfl.exe jxdfn.exe PID 1028 wrote to memory of 1724 1028 flbfdfl.exe jxdfn.exe PID 1028 wrote to memory of 1724 1028 flbfdfl.exe jxdfn.exe PID 1724 wrote to memory of 2804 1724 jxdfn.exe fdjpj.exe PID 1724 wrote to memory of 2804 1724 jxdfn.exe fdjpj.exe PID 1724 wrote to memory of 2804 1724 jxdfn.exe fdjpj.exe PID 1724 wrote to memory of 2804 1724 jxdfn.exe fdjpj.exe PID 2804 wrote to memory of 1488 2804 fdjpj.exe njdrxdh.exe PID 2804 wrote to memory of 1488 2804 fdjpj.exe njdrxdh.exe PID 2804 wrote to memory of 1488 2804 fdjpj.exe njdrxdh.exe PID 2804 wrote to memory of 1488 2804 fdjpj.exe njdrxdh.exe PID 1488 wrote to memory of 1824 1488 njdrxdh.exe ndprht.exe PID 1488 wrote to memory of 1824 1488 njdrxdh.exe ndprht.exe PID 1488 wrote to memory of 1824 1488 njdrxdh.exe ndprht.exe PID 1488 wrote to memory of 1824 1488 njdrxdh.exe ndprht.exe PID 1824 wrote to memory of 2600 1824 ndprht.exe ljrbxpp.exe PID 1824 wrote to memory of 2600 1824 ndprht.exe ljrbxpp.exe PID 1824 wrote to memory of 2600 1824 ndprht.exe ljrbxpp.exe PID 1824 wrote to memory of 2600 1824 ndprht.exe ljrbxpp.exe PID 2600 wrote to memory of 2556 2600 ljrbxpp.exe plltbnh.exe PID 2600 wrote to memory of 2556 2600 ljrbxpp.exe plltbnh.exe PID 2600 wrote to memory of 2556 2600 ljrbxpp.exe plltbnh.exe PID 2600 wrote to memory of 2556 2600 ljrbxpp.exe plltbnh.exe PID 2556 wrote to memory of 2676 2556 plltbnh.exe thbhf.exe PID 2556 wrote to memory of 2676 2556 plltbnh.exe thbhf.exe PID 2556 wrote to memory of 2676 2556 plltbnh.exe thbhf.exe PID 2556 wrote to memory of 2676 2556 plltbnh.exe thbhf.exe PID 2676 wrote to memory of 2548 2676 thxhbx.exe dtxpnh.exe PID 2676 wrote to memory of 2548 2676 thxhbx.exe dtxpnh.exe PID 2676 wrote to memory of 2548 2676 thxhbx.exe dtxpnh.exe PID 2676 wrote to memory of 2548 2676 thxhbx.exe dtxpnh.exe PID 2548 wrote to memory of 2448 2548 jjttndl.exe dthhrpl.exe PID 2548 wrote to memory of 2448 2548 jjttndl.exe dthhrpl.exe PID 2548 wrote to memory of 2448 2548 jjttndl.exe dthhrpl.exe PID 2548 wrote to memory of 2448 2548 jjttndl.exe dthhrpl.exe PID 2448 wrote to memory of 2588 2448 xbdnpff.exe rfbnht.exe PID 2448 wrote to memory of 2588 2448 xbdnpff.exe rfbnht.exe PID 2448 wrote to memory of 2588 2448 xbdnpff.exe rfbnht.exe PID 2448 wrote to memory of 2588 2448 xbdnpff.exe rfbnht.exe PID 2588 wrote to memory of 2128 2588 rfbnht.exe lvvttf.exe PID 2588 wrote to memory of 2128 2588 rfbnht.exe lvvttf.exe PID 2588 wrote to memory of 2128 2588 rfbnht.exe lvvttf.exe PID 2588 wrote to memory of 2128 2588 rfbnht.exe lvvttf.exe PID 2128 wrote to memory of 2208 2128 lvvttf.exe tjpldl.exe PID 2128 wrote to memory of 2208 2128 lvvttf.exe tjpldl.exe PID 2128 wrote to memory of 2208 2128 lvvttf.exe tjpldl.exe PID 2128 wrote to memory of 2208 2128 lvvttf.exe tjpldl.exe PID 2208 wrote to memory of 2196 2208 tjpldl.exe rpblx.exe PID 2208 wrote to memory of 2196 2208 tjpldl.exe rpblx.exe PID 2208 wrote to memory of 2196 2208 tjpldl.exe rpblx.exe PID 2208 wrote to memory of 2196 2208 tjpldl.exe rpblx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1922618342dfb1d62f1cedce4c6b7d90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1922618342dfb1d62f1cedce4c6b7d90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\phfbb.exec:\phfbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rdpxfd.exec:\rdpxfd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flbfdfl.exec:\flbfdfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jxdfn.exec:\jxdfn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fdjpj.exec:\fdjpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\njdrxdh.exec:\njdrxdh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ndprht.exec:\ndprht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ljrbxpp.exec:\ljrbxpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\plltbnh.exec:\plltbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thxhbx.exec:\thxhbx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjttndl.exec:\jjttndl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xbdnpff.exec:\xbdnpff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfbnht.exec:\rfbnht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lvvttf.exec:\lvvttf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tjpldl.exec:\tjpldl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rpblx.exec:\rpblx.exe17⤵
- Executes dropped EXE
-
\??\c:\rrvlt.exec:\rrvlt.exe18⤵
- Executes dropped EXE
-
\??\c:\xllhtj.exec:\xllhtj.exe19⤵
- Executes dropped EXE
-
\??\c:\hfldthd.exec:\hfldthd.exe20⤵
- Executes dropped EXE
-
\??\c:\jjrpdjl.exec:\jjrpdjl.exe21⤵
- Executes dropped EXE
-
\??\c:\rxbdxh.exec:\rxbdxh.exe22⤵
- Executes dropped EXE
-
\??\c:\vxfxtlf.exec:\vxfxtlf.exe23⤵
- Executes dropped EXE
-
\??\c:\bbhhv.exec:\bbhhv.exe24⤵
- Executes dropped EXE
-
\??\c:\hdldvv.exec:\hdldvv.exe25⤵
- Executes dropped EXE
-
\??\c:\tjpdxd.exec:\tjpdxd.exe26⤵
- Executes dropped EXE
-
\??\c:\bbrbbt.exec:\bbrbbt.exe27⤵
- Executes dropped EXE
-
\??\c:\xblnfpt.exec:\xblnfpt.exe28⤵
- Executes dropped EXE
-
\??\c:\dbrdnbd.exec:\dbrdnbd.exe29⤵
- Executes dropped EXE
-
\??\c:\rbnvh.exec:\rbnvh.exe30⤵
- Executes dropped EXE
-
\??\c:\vrxvft.exec:\vrxvft.exe31⤵
- Executes dropped EXE
-
\??\c:\pjptp.exec:\pjptp.exe32⤵
- Executes dropped EXE
-
\??\c:\ffhdv.exec:\ffhdv.exe33⤵
- Executes dropped EXE
-
\??\c:\xlhph.exec:\xlhph.exe34⤵
- Executes dropped EXE
-
\??\c:\npfvpd.exec:\npfvpd.exe35⤵
- Executes dropped EXE
-
\??\c:\xhjtlrd.exec:\xhjtlrd.exe36⤵
- Executes dropped EXE
-
\??\c:\xdpxp.exec:\xdpxp.exe37⤵
- Executes dropped EXE
-
\??\c:\xlxrrd.exec:\xlxrrd.exe38⤵
- Executes dropped EXE
-
\??\c:\bjbpfr.exec:\bjbpfr.exe39⤵
- Executes dropped EXE
-
\??\c:\xxxfdl.exec:\xxxfdl.exe40⤵
- Executes dropped EXE
-
\??\c:\dfvprvj.exec:\dfvprvj.exe41⤵
- Executes dropped EXE
-
\??\c:\lrjfnn.exec:\lrjfnn.exe42⤵
- Executes dropped EXE
-
\??\c:\bvbnhjp.exec:\bvbnhjp.exe43⤵
- Executes dropped EXE
-
\??\c:\dpjdpjh.exec:\dpjdpjh.exe44⤵
- Executes dropped EXE
-
\??\c:\rfbvhd.exec:\rfbvhd.exe45⤵
- Executes dropped EXE
-
\??\c:\fxndbxl.exec:\fxndbxl.exe46⤵
- Executes dropped EXE
-
\??\c:\dbdvnbd.exec:\dbdvnbd.exe47⤵
- Executes dropped EXE
-
\??\c:\ttrrf.exec:\ttrrf.exe48⤵
- Executes dropped EXE
-
\??\c:\bnfbnb.exec:\bnfbnb.exe49⤵
- Executes dropped EXE
-
\??\c:\thbhf.exec:\thbhf.exe50⤵
- Executes dropped EXE
-
\??\c:\dtxpnh.exec:\dtxpnh.exe51⤵
- Executes dropped EXE
-
\??\c:\dthhrpl.exec:\dthhrpl.exe52⤵
- Executes dropped EXE
-
\??\c:\dprddfl.exec:\dprddfl.exe53⤵
- Executes dropped EXE
-
\??\c:\dvjfdhx.exec:\dvjfdhx.exe54⤵
- Executes dropped EXE
-
\??\c:\pptfxx.exec:\pptfxx.exe55⤵
- Executes dropped EXE
-
\??\c:\xlxpfj.exec:\xlxpfj.exe56⤵
- Executes dropped EXE
-
\??\c:\ptdlvtt.exec:\ptdlvtt.exe57⤵
- Executes dropped EXE
-
\??\c:\rlrlbv.exec:\rlrlbv.exe58⤵
- Executes dropped EXE
-
\??\c:\jxlpxpt.exec:\jxlpxpt.exe59⤵
- Executes dropped EXE
-
\??\c:\jjxbt.exec:\jjxbt.exe60⤵
- Executes dropped EXE
-
\??\c:\fjxrv.exec:\fjxrv.exe61⤵
- Executes dropped EXE
-
\??\c:\dtpdhxf.exec:\dtpdhxf.exe62⤵
- Executes dropped EXE
-
\??\c:\fhhvffn.exec:\fhhvffn.exe63⤵
- Executes dropped EXE
-
\??\c:\tnlfrfd.exec:\tnlfrfd.exe64⤵
- Executes dropped EXE
-
\??\c:\pvdtlh.exec:\pvdtlh.exe65⤵
- Executes dropped EXE
-
\??\c:\rxhvld.exec:\rxhvld.exe66⤵
-
\??\c:\lnljbpt.exec:\lnljbpt.exe67⤵
-
\??\c:\tfhpvhp.exec:\tfhpvhp.exe68⤵
-
\??\c:\pfvbh.exec:\pfvbh.exe69⤵
-
\??\c:\brdbbdt.exec:\brdbbdt.exe70⤵
-
\??\c:\bddnf.exec:\bddnf.exe71⤵
-
\??\c:\ljlhxnl.exec:\ljlhxnl.exe72⤵
-
\??\c:\lnhbh.exec:\lnhbh.exe73⤵
-
\??\c:\nbrxrf.exec:\nbrxrf.exe74⤵
-
\??\c:\lxlvtdh.exec:\lxlvtdh.exe75⤵
-
\??\c:\nfjlbjj.exec:\nfjlbjj.exe76⤵
-
\??\c:\tfhbjtj.exec:\tfhbjtj.exe77⤵
-
\??\c:\tpddhbh.exec:\tpddhbh.exe78⤵
-
\??\c:\nttlj.exec:\nttlj.exe79⤵
-
\??\c:\xlvtjl.exec:\xlvtjl.exe80⤵
-
\??\c:\lrbnld.exec:\lrbnld.exe81⤵
-
\??\c:\jlnnlfh.exec:\jlnnlfh.exe82⤵
-
\??\c:\ptthpbn.exec:\ptthpbn.exe83⤵
-
\??\c:\lrtlvf.exec:\lrtlvf.exe84⤵
-
\??\c:\rnhbhdx.exec:\rnhbhdx.exe85⤵
-
\??\c:\flpfpf.exec:\flpfpf.exe86⤵
-
\??\c:\phflhxr.exec:\phflhxr.exe87⤵
-
\??\c:\vjrbhld.exec:\vjrbhld.exe88⤵
-
\??\c:\hthpt.exec:\hthpt.exe89⤵
-
\??\c:\hptxv.exec:\hptxv.exe90⤵
-
\??\c:\xtvhjvt.exec:\xtvhjvt.exe91⤵
-
\??\c:\lpvbtt.exec:\lpvbtt.exe92⤵
-
\??\c:\hhdtvph.exec:\hhdtvph.exe93⤵
-
\??\c:\ftdnf.exec:\ftdnf.exe94⤵
-
\??\c:\tlbjbnb.exec:\tlbjbnb.exe95⤵
-
\??\c:\nvrhlln.exec:\nvrhlln.exe96⤵
-
\??\c:\xdhpt.exec:\xdhpt.exe97⤵
-
\??\c:\bjnhp.exec:\bjnhp.exe98⤵
-
\??\c:\rhthrfb.exec:\rhthrfb.exe99⤵
-
\??\c:\rbdjfv.exec:\rbdjfv.exe100⤵
-
\??\c:\jpbtvrv.exec:\jpbtvrv.exe101⤵
-
\??\c:\jhlll.exec:\jhlll.exe102⤵
-
\??\c:\ptnpdl.exec:\ptnpdl.exe103⤵
-
\??\c:\tbjfnn.exec:\tbjfnn.exe104⤵
-
\??\c:\xltlbn.exec:\xltlbn.exe105⤵
-
\??\c:\lxnbhv.exec:\lxnbhv.exe106⤵
-
\??\c:\xbnthr.exec:\xbnthr.exe107⤵
-
\??\c:\tdfbh.exec:\tdfbh.exe108⤵
-
\??\c:\fvjlnvj.exec:\fvjlnvj.exe109⤵
-
\??\c:\rrjtlpn.exec:\rrjtlpn.exe110⤵
-
\??\c:\lnlrd.exec:\lnlrd.exe111⤵
-
\??\c:\drxtxnp.exec:\drxtxnp.exe112⤵
-
\??\c:\tdnfrxx.exec:\tdnfrxx.exe113⤵
-
\??\c:\rptjf.exec:\rptjf.exe114⤵
-
\??\c:\txldrr.exec:\txldrr.exe115⤵
-
\??\c:\drbtrj.exec:\drbtrj.exe116⤵
-
\??\c:\hlxtjj.exec:\hlxtjj.exe117⤵
-
\??\c:\hhbvfdl.exec:\hhbvfdl.exe118⤵
-
\??\c:\pjjpjd.exec:\pjjpjd.exe119⤵
-
\??\c:\xprxhbt.exec:\xprxhbt.exe120⤵
-
\??\c:\rblpr.exec:\rblpr.exe121⤵
-
\??\c:\dlvhj.exec:\dlvhj.exe122⤵
-
\??\c:\frxbnb.exec:\frxbnb.exe123⤵
-
\??\c:\dfdbl.exec:\dfdbl.exe124⤵
-
\??\c:\xjxlvjf.exec:\xjxlvjf.exe125⤵
-
\??\c:\trftf.exec:\trftf.exe126⤵
-
\??\c:\lddnp.exec:\lddnp.exe127⤵
-
\??\c:\jfppxlr.exec:\jfppxlr.exe128⤵
-
\??\c:\phhnv.exec:\phhnv.exe129⤵
-
\??\c:\rvdfr.exec:\rvdfr.exe130⤵
-
\??\c:\ptphxhx.exec:\ptphxhx.exe131⤵
-
\??\c:\xpptx.exec:\xpptx.exe132⤵
-
\??\c:\tlfxjfv.exec:\tlfxjfv.exe133⤵
-
\??\c:\fndfrr.exec:\fndfrr.exe134⤵
-
\??\c:\vbptp.exec:\vbptp.exe135⤵
-
\??\c:\bdrbx.exec:\bdrbx.exe136⤵
-
\??\c:\ljtphlv.exec:\ljtphlv.exe137⤵
-
\??\c:\rhxlp.exec:\rhxlp.exe138⤵
-
\??\c:\pdxvbph.exec:\pdxvbph.exe139⤵
-
\??\c:\hftbt.exec:\hftbt.exe140⤵
-
\??\c:\bfvpdxx.exec:\bfvpdxx.exe141⤵
-
\??\c:\rxfpvnd.exec:\rxfpvnd.exe142⤵
-
\??\c:\lbblbb.exec:\lbblbb.exe143⤵
-
\??\c:\bfpbxf.exec:\bfpbxf.exe144⤵
-
\??\c:\lxpfpl.exec:\lxpfpl.exe145⤵
-
\??\c:\jrblf.exec:\jrblf.exe146⤵
-
\??\c:\fjjjnx.exec:\fjjjnx.exe147⤵
-
\??\c:\djljll.exec:\djljll.exe148⤵
-
\??\c:\drfdfrl.exec:\drfdfrl.exe149⤵
-
\??\c:\vtrfj.exec:\vtrfj.exe150⤵
-
\??\c:\vvtlrxl.exec:\vvtlrxl.exe151⤵
-
\??\c:\ljpbhh.exec:\ljpbhh.exe152⤵
-
\??\c:\vhjnb.exec:\vhjnb.exe153⤵
-
\??\c:\dbnddnv.exec:\dbnddnv.exe154⤵
-
\??\c:\hdjhl.exec:\hdjhl.exe155⤵
-
\??\c:\dfrbx.exec:\dfrbx.exe156⤵
-
\??\c:\bbrhnl.exec:\bbrhnl.exe157⤵
-
\??\c:\tvfbr.exec:\tvfbr.exe158⤵
-
\??\c:\llxbtb.exec:\llxbtb.exe159⤵
-
\??\c:\drfbvrd.exec:\drfbvrd.exe160⤵
-
\??\c:\xvpdpfv.exec:\xvpdpfv.exe161⤵
-
\??\c:\tfhhnjd.exec:\tfhhnjd.exe162⤵
-
\??\c:\vjbtfb.exec:\vjbtfb.exe163⤵
-
\??\c:\xpbxp.exec:\xpbxp.exe164⤵
-
\??\c:\bprptt.exec:\bprptt.exe165⤵
-
\??\c:\jbddd.exec:\jbddd.exe166⤵
-
\??\c:\vtvpb.exec:\vtvpb.exe167⤵
-
\??\c:\njtlv.exec:\njtlv.exe168⤵
-
\??\c:\fdrbfxh.exec:\fdrbfxh.exe169⤵
-
\??\c:\ptdbx.exec:\ptdbx.exe170⤵
-
\??\c:\vhfjdx.exec:\vhfjdx.exe171⤵
-
\??\c:\dbxbrdv.exec:\dbxbrdv.exe172⤵
-
\??\c:\dtfhj.exec:\dtfhj.exe173⤵
-
\??\c:\rbhfrxb.exec:\rbhfrxb.exe174⤵
-
\??\c:\tpbrl.exec:\tpbrl.exe175⤵
-
\??\c:\bfldnxb.exec:\bfldnxb.exe176⤵
-
\??\c:\dbvpb.exec:\dbvpb.exe177⤵
-
\??\c:\trtxblp.exec:\trtxblp.exe178⤵
-
\??\c:\rjbtjtv.exec:\rjbtjtv.exe179⤵
-
\??\c:\hvxbxfb.exec:\hvxbxfb.exe180⤵
-
\??\c:\jxvxjt.exec:\jxvxjt.exe181⤵
-
\??\c:\lxpdvvl.exec:\lxpdvvl.exe182⤵
-
\??\c:\xpfbdrp.exec:\xpfbdrp.exe183⤵
-
\??\c:\bnrdh.exec:\bnrdh.exe184⤵
-
\??\c:\rnpbnf.exec:\rnpbnf.exe185⤵
-
\??\c:\dllpnpr.exec:\dllpnpr.exe186⤵
-
\??\c:\ddtfb.exec:\ddtfb.exe187⤵
-
\??\c:\bxbjtjv.exec:\bxbjtjv.exe188⤵
-
\??\c:\npjtt.exec:\npjtt.exe189⤵
-
\??\c:\tnvxnnx.exec:\tnvxnnx.exe190⤵
-
\??\c:\bnhnxpr.exec:\bnhnxpr.exe191⤵
-
\??\c:\tfnbnp.exec:\tfnbnp.exe192⤵
-
\??\c:\hjjrlr.exec:\hjjrlr.exe193⤵
-
\??\c:\hrvpv.exec:\hrvpv.exe194⤵
-
\??\c:\rrnlxf.exec:\rrnlxf.exe195⤵
-
\??\c:\bdrtpr.exec:\bdrtpr.exe196⤵
-
\??\c:\tbbhn.exec:\tbbhn.exe197⤵
-
\??\c:\vplbp.exec:\vplbp.exe198⤵
-
\??\c:\pfbjxd.exec:\pfbjxd.exe199⤵
-
\??\c:\pdxnnd.exec:\pdxnnd.exe200⤵
-
\??\c:\xrbdpt.exec:\xrbdpt.exe201⤵
-
\??\c:\fnjjfh.exec:\fnjjfh.exe202⤵
-
\??\c:\nlnrjr.exec:\nlnrjr.exe203⤵
-
\??\c:\nrdjj.exec:\nrdjj.exe204⤵
-
\??\c:\ddhdxpj.exec:\ddhdxpj.exe205⤵
-
\??\c:\rhrvff.exec:\rhrvff.exe206⤵
-
\??\c:\jhptt.exec:\jhptt.exe207⤵
-
\??\c:\fpjpnrf.exec:\fpjpnrf.exe208⤵
-
\??\c:\jrbxvjd.exec:\jrbxvjd.exe209⤵
-
\??\c:\tdpxxv.exec:\tdpxxv.exe210⤵
-
\??\c:\pphdlhp.exec:\pphdlhp.exe211⤵
-
\??\c:\hxptf.exec:\hxptf.exe212⤵
-
\??\c:\nhrjx.exec:\nhrjx.exe213⤵
-
\??\c:\vnlxll.exec:\vnlxll.exe214⤵
-
\??\c:\htnvdl.exec:\htnvdl.exe215⤵
-
\??\c:\jnfbxl.exec:\jnfbxl.exe216⤵
-
\??\c:\njxfjj.exec:\njxfjj.exe217⤵
-
\??\c:\phbbdhf.exec:\phbbdhf.exe218⤵
-
\??\c:\flvbvr.exec:\flvbvr.exe219⤵
-
\??\c:\brrxrx.exec:\brrxrx.exe220⤵
-
\??\c:\tprpbdb.exec:\tprpbdb.exe221⤵
-
\??\c:\ttvldr.exec:\ttvldr.exe222⤵
-
\??\c:\ltttttv.exec:\ltttttv.exe223⤵
-
\??\c:\pphdfj.exec:\pphdfj.exe224⤵
-
\??\c:\hddvj.exec:\hddvj.exe225⤵
-
\??\c:\xdfhrfb.exec:\xdfhrfb.exe226⤵
-
\??\c:\pjprr.exec:\pjprr.exe227⤵
-
\??\c:\hxtrj.exec:\hxtrj.exe228⤵
-
\??\c:\rhltlvr.exec:\rhltlvr.exe229⤵
-
\??\c:\vxbbr.exec:\vxbbr.exe230⤵
-
\??\c:\fbphrtj.exec:\fbphrtj.exe231⤵
-
\??\c:\dtddrjv.exec:\dtddrjv.exe232⤵
-
\??\c:\lnlhhx.exec:\lnlhhx.exe233⤵
-
\??\c:\vbbnb.exec:\vbbnb.exe234⤵
-
\??\c:\pxjjj.exec:\pxjjj.exe235⤵
-
\??\c:\rrrjx.exec:\rrrjx.exe236⤵
-
\??\c:\lrpjhnh.exec:\lrpjhnh.exe237⤵
-
\??\c:\fhptblf.exec:\fhptblf.exe238⤵
-
\??\c:\rxxdblr.exec:\rxxdblr.exe239⤵
-
\??\c:\rdjjbht.exec:\rdjjbht.exe240⤵
-
\??\c:\vpxfpl.exec:\vpxfpl.exe241⤵