Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 17:45
Behavioral task
behavioral1
Sample
2d06dc20b8fe2704b1c86da70fe913b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2d06dc20b8fe2704b1c86da70fe913b0_NeikiAnalytics.exe
-
Size
453KB
-
MD5
2d06dc20b8fe2704b1c86da70fe913b0
-
SHA1
b05fd18fdfdf28e51fc6ec045f95ac25290e603d
-
SHA256
811ed67606e34d4a9adfdb5c819278537957684db1fb97c8a37b85d04f3d5105
-
SHA512
3fcaa8dc1fd4a98b268ff4566802e3e70d5ed745e147ec22a83ed85d2660d6fe4b43bea7d688d58e821fa04d22f97e4f44a7a43c0caee35726845b2c2988adb1
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNm9:x4wFHoS3eFaKHpv/VycgE81lg+
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
Processes:
resource yara_rule behavioral1/memory/2032-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-31-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2200-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-343-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2480-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1724-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1252-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/856-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/872-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1956-207-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1132-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1616-189-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1508-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1668-170-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1900-153-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1932-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-135-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1936-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/692-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-88-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2788-98-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2544-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-68-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2384-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2160-487-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1028-506-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2092-513-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-544-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-620-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1388-1066-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1284-1431-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hxndf.exedtrpfnt.exenhxtvvp.exevdjthpt.exellvpfpn.exelpvtfr.exellhfxb.exelrxpp.exedfjrdpn.exelvfpvbb.exehvtthn.exevrdflrj.exebprrpdf.exetdfxdd.exefrnhp.exerjpfx.exextnrv.exevtvllrf.exeplhdbfh.exerdbfp.exervjrvfx.exetltvnn.exehtdhbhb.exepnbbtx.exelfxjh.exexfldf.exevxpjh.exerdvdn.exelfpfbj.exedhfldpl.exebdbhjvn.exefnvnf.exevlrdhb.exedvljjb.exepbjtx.exephdfljl.exeblbbhr.exebxbpndh.exepnfdlrl.exefhfflxb.exenjrtllj.exehndjdp.exejhptpv.exedhtdfxp.exepttxnt.exetrtbtl.exehjhfhnb.exedjxfpd.exerxbdl.exerrfft.exevlxfth.exenxxnrf.exepdhnhr.exenjfhjp.exebnrhr.exenfrxbxn.exexxlfb.exetldlvfn.exevnjbrhf.exepbvjt.exenblfn.exenhthd.exepnnjnl.exefxxxd.exepid process 2080 hxndf.exe 1972 dtrpfnt.exe 2564 nhxtvvp.exe 2200 vdjthpt.exe 2580 llvpfpn.exe 2384 lpvtfr.exe 2636 llhfxb.exe 2544 lrxpp.exe 2396 dfjrdpn.exe 2788 lvfpvbb.exe 2360 hvtthn.exe 692 vrdflrj.exe 1188 bprrpdf.exe 1936 tdfxdd.exe 1932 frnhp.exe 1900 rjpfx.exe 828 xtnrv.exe 1668 vtvllrf.exe 1508 plhdbfh.exe 1616 rdbfp.exe 1132 rvjrvfx.exe 1956 tltvnn.exe 2236 htdhbhb.exe 1644 pnbbtx.exe 2720 lfxjh.exe 872 xfldf.exe 1512 vxpjh.exe 1676 rdvdn.exe 1628 lfpfbj.exe 592 dhfldpl.exe 2892 bdbhjvn.exe 2756 fnvnf.exe 3048 vlrdhb.exe 856 dvljjb.exe 2940 pbjtx.exe 1252 phdfljl.exe 1548 blbbhr.exe 1724 bxbpndh.exe 2652 pnfdlrl.exe 2212 fhfflxb.exe 2516 njrtllj.exe 2612 hndjdp.exe 2856 jhptpv.exe 2504 dhtdfxp.exe 2480 pttxnt.exe 2408 trtbtl.exe 2520 hjhfhnb.exe 2304 djxfpd.exe 764 rxbdl.exe 2524 rrfft.exe 1356 vlxfth.exe 2604 nxxnrf.exe 1692 pdhnhr.exe 2316 njfhjp.exe 828 bnrhr.exe 744 nfrxbxn.exe 2816 xxlfb.exe 1552 tldlvfn.exe 580 vnjbrhf.exe 2764 pbvjt.exe 2140 nblfn.exe 2236 nhthd.exe 2160 pnnjnl.exe 268 fxxxd.exe -
Processes:
resource yara_rule behavioral1/memory/2032-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hxndf.exe upx behavioral1/memory/2032-9-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dtrpfnt.exe upx behavioral1/memory/2080-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2564-29-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhxtvvp.exe upx C:\vdjthpt.exe upx \??\c:\llvpfpn.exe upx behavioral1/memory/2200-44-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lpvtfr.exe upx \??\c:\llhfxb.exe upx C:\dfjrdpn.exe upx behavioral1/memory/2396-85-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hvtthn.exe upx C:\bprrpdf.exe upx C:\xtnrv.exe upx \??\c:\plhdbfh.exe upx \??\c:\rvjrvfx.exe upx C:\htdhbhb.exe upx \??\c:\lfxjh.exe upx \??\c:\vxpjh.exe upx behavioral1/memory/2480-374-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2504-367-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2612-360-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1724-327-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2652-334-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1252-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/856-301-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fnvnf.exe upx \??\c:\bdbhjvn.exe upx \??\c:\dhfldpl.exe upx \??\c:\rdvdn.exe upx \??\c:\lfpfbj.exe upx behavioral1/memory/872-246-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xfldf.exe upx behavioral1/memory/2720-231-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pnbbtx.exe upx behavioral1/memory/2236-214-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tltvnn.exe upx \??\c:\rdbfp.exe upx behavioral1/memory/1132-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1508-177-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vtvllrf.exe upx behavioral1/memory/1668-170-0x00000000002B0000-0x00000000002D7000-memory.dmp upx \??\c:\rjpfx.exe upx behavioral1/memory/1932-142-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\frnhp.exe upx behavioral1/memory/1936-132-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tdfxdd.exe upx behavioral1/memory/692-115-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vrdflrj.exe upx behavioral1/memory/2360-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-95-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lvfpvbb.exe upx behavioral1/memory/2396-88-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2544-82-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lrxpp.exe upx behavioral1/memory/2636-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-68-0x00000000003A0000-0x00000000003C7000-memory.dmp upx behavioral1/memory/2384-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2384-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2580-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1356-411-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2d06dc20b8fe2704b1c86da70fe913b0_NeikiAnalytics.exehxndf.exedtrpfnt.exenhxtvvp.exevdjthpt.exellvpfpn.exelpvtfr.exellhfxb.exelrxpp.exedfjrdpn.exelvfpvbb.exehvtthn.exevrdflrj.exebprrpdf.exetdfxdd.exefrnhp.exedescription pid process target process PID 2032 wrote to memory of 2080 2032 2d06dc20b8fe2704b1c86da70fe913b0_NeikiAnalytics.exe hxndf.exe PID 2032 wrote to memory of 2080 2032 2d06dc20b8fe2704b1c86da70fe913b0_NeikiAnalytics.exe hxndf.exe PID 2032 wrote to memory of 2080 2032 2d06dc20b8fe2704b1c86da70fe913b0_NeikiAnalytics.exe hxndf.exe PID 2032 wrote to memory of 2080 2032 2d06dc20b8fe2704b1c86da70fe913b0_NeikiAnalytics.exe hxndf.exe PID 2080 wrote to memory of 1972 2080 hxndf.exe dtrpfnt.exe PID 2080 wrote to memory of 1972 2080 hxndf.exe dtrpfnt.exe PID 2080 wrote to memory of 1972 2080 hxndf.exe dtrpfnt.exe PID 2080 wrote to memory of 1972 2080 hxndf.exe dtrpfnt.exe PID 1972 wrote to memory of 2564 1972 dtrpfnt.exe nhxtvvp.exe PID 1972 wrote to memory of 2564 1972 dtrpfnt.exe nhxtvvp.exe PID 1972 wrote to memory of 2564 1972 dtrpfnt.exe nhxtvvp.exe PID 1972 wrote to memory of 2564 1972 dtrpfnt.exe nhxtvvp.exe PID 2564 wrote to memory of 2200 2564 nhxtvvp.exe vdjthpt.exe PID 2564 wrote to memory of 2200 2564 nhxtvvp.exe vdjthpt.exe PID 2564 wrote to memory of 2200 2564 nhxtvvp.exe vdjthpt.exe PID 2564 wrote to memory of 2200 2564 nhxtvvp.exe vdjthpt.exe PID 2200 wrote to memory of 2580 2200 vdjthpt.exe llvpfpn.exe PID 2200 wrote to memory of 2580 2200 vdjthpt.exe llvpfpn.exe PID 2200 wrote to memory of 2580 2200 vdjthpt.exe llvpfpn.exe PID 2200 wrote to memory of 2580 2200 vdjthpt.exe llvpfpn.exe PID 2580 wrote to memory of 2384 2580 llvpfpn.exe lpvtfr.exe PID 2580 wrote to memory of 2384 2580 llvpfpn.exe lpvtfr.exe PID 2580 wrote to memory of 2384 2580 llvpfpn.exe lpvtfr.exe PID 2580 wrote to memory of 2384 2580 llvpfpn.exe lpvtfr.exe PID 2384 wrote to memory of 2636 2384 lpvtfr.exe llhfxb.exe PID 2384 wrote to memory of 2636 2384 lpvtfr.exe llhfxb.exe PID 2384 wrote to memory of 2636 2384 lpvtfr.exe llhfxb.exe PID 2384 wrote to memory of 2636 2384 lpvtfr.exe llhfxb.exe PID 2636 wrote to memory of 2544 2636 llhfxb.exe lrxpp.exe PID 2636 wrote to memory of 2544 2636 llhfxb.exe lrxpp.exe PID 2636 wrote to memory of 2544 2636 llhfxb.exe lrxpp.exe PID 2636 wrote to memory of 2544 2636 llhfxb.exe lrxpp.exe PID 2544 wrote to memory of 2396 2544 lrxpp.exe dfjrdpn.exe PID 2544 wrote to memory of 2396 2544 lrxpp.exe dfjrdpn.exe PID 2544 wrote to memory of 2396 2544 lrxpp.exe dfjrdpn.exe PID 2544 wrote to memory of 2396 2544 lrxpp.exe dfjrdpn.exe PID 2396 wrote to memory of 2788 2396 dfjrdpn.exe lvfpvbb.exe PID 2396 wrote to memory of 2788 2396 dfjrdpn.exe lvfpvbb.exe PID 2396 wrote to memory of 2788 2396 dfjrdpn.exe lvfpvbb.exe PID 2396 wrote to memory of 2788 2396 dfjrdpn.exe lvfpvbb.exe PID 2788 wrote to memory of 2360 2788 lvfpvbb.exe hvtthn.exe PID 2788 wrote to memory of 2360 2788 lvfpvbb.exe hvtthn.exe PID 2788 wrote to memory of 2360 2788 lvfpvbb.exe hvtthn.exe PID 2788 wrote to memory of 2360 2788 lvfpvbb.exe hvtthn.exe PID 2360 wrote to memory of 692 2360 hvtthn.exe vrdflrj.exe PID 2360 wrote to memory of 692 2360 hvtthn.exe vrdflrj.exe PID 2360 wrote to memory of 692 2360 hvtthn.exe vrdflrj.exe PID 2360 wrote to memory of 692 2360 hvtthn.exe vrdflrj.exe PID 692 wrote to memory of 1188 692 vrdflrj.exe bprrpdf.exe PID 692 wrote to memory of 1188 692 vrdflrj.exe bprrpdf.exe PID 692 wrote to memory of 1188 692 vrdflrj.exe bprrpdf.exe PID 692 wrote to memory of 1188 692 vrdflrj.exe bprrpdf.exe PID 1188 wrote to memory of 1936 1188 bprrpdf.exe tdfxdd.exe PID 1188 wrote to memory of 1936 1188 bprrpdf.exe tdfxdd.exe PID 1188 wrote to memory of 1936 1188 bprrpdf.exe tdfxdd.exe PID 1188 wrote to memory of 1936 1188 bprrpdf.exe tdfxdd.exe PID 1936 wrote to memory of 1932 1936 tdfxdd.exe frnhp.exe PID 1936 wrote to memory of 1932 1936 tdfxdd.exe frnhp.exe PID 1936 wrote to memory of 1932 1936 tdfxdd.exe frnhp.exe PID 1936 wrote to memory of 1932 1936 tdfxdd.exe frnhp.exe PID 1932 wrote to memory of 1900 1932 frnhp.exe rjpfx.exe PID 1932 wrote to memory of 1900 1932 frnhp.exe rjpfx.exe PID 1932 wrote to memory of 1900 1932 frnhp.exe rjpfx.exe PID 1932 wrote to memory of 1900 1932 frnhp.exe rjpfx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d06dc20b8fe2704b1c86da70fe913b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2d06dc20b8fe2704b1c86da70fe913b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\hxndf.exec:\hxndf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dtrpfnt.exec:\dtrpfnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhxtvvp.exec:\nhxtvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdjthpt.exec:\vdjthpt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llvpfpn.exec:\llvpfpn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lpvtfr.exec:\lpvtfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llhfxb.exec:\llhfxb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrxpp.exec:\lrxpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dfjrdpn.exec:\dfjrdpn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lvfpvbb.exec:\lvfpvbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hvtthn.exec:\hvtthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vrdflrj.exec:\vrdflrj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bprrpdf.exec:\bprrpdf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tdfxdd.exec:\tdfxdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frnhp.exec:\frnhp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rjpfx.exec:\rjpfx.exe17⤵
- Executes dropped EXE
-
\??\c:\xtnrv.exec:\xtnrv.exe18⤵
- Executes dropped EXE
-
\??\c:\vtvllrf.exec:\vtvllrf.exe19⤵
- Executes dropped EXE
-
\??\c:\plhdbfh.exec:\plhdbfh.exe20⤵
- Executes dropped EXE
-
\??\c:\rdbfp.exec:\rdbfp.exe21⤵
- Executes dropped EXE
-
\??\c:\rvjrvfx.exec:\rvjrvfx.exe22⤵
- Executes dropped EXE
-
\??\c:\tltvnn.exec:\tltvnn.exe23⤵
- Executes dropped EXE
-
\??\c:\htdhbhb.exec:\htdhbhb.exe24⤵
- Executes dropped EXE
-
\??\c:\pnbbtx.exec:\pnbbtx.exe25⤵
- Executes dropped EXE
-
\??\c:\lfxjh.exec:\lfxjh.exe26⤵
- Executes dropped EXE
-
\??\c:\xfldf.exec:\xfldf.exe27⤵
- Executes dropped EXE
-
\??\c:\vxpjh.exec:\vxpjh.exe28⤵
- Executes dropped EXE
-
\??\c:\rdvdn.exec:\rdvdn.exe29⤵
- Executes dropped EXE
-
\??\c:\lfpfbj.exec:\lfpfbj.exe30⤵
- Executes dropped EXE
-
\??\c:\dhfldpl.exec:\dhfldpl.exe31⤵
- Executes dropped EXE
-
\??\c:\bdbhjvn.exec:\bdbhjvn.exe32⤵
- Executes dropped EXE
-
\??\c:\fnvnf.exec:\fnvnf.exe33⤵
- Executes dropped EXE
-
\??\c:\vlrdhb.exec:\vlrdhb.exe34⤵
- Executes dropped EXE
-
\??\c:\dvljjb.exec:\dvljjb.exe35⤵
- Executes dropped EXE
-
\??\c:\pbjtx.exec:\pbjtx.exe36⤵
- Executes dropped EXE
-
\??\c:\phdfljl.exec:\phdfljl.exe37⤵
- Executes dropped EXE
-
\??\c:\blbbhr.exec:\blbbhr.exe38⤵
- Executes dropped EXE
-
\??\c:\bxbpndh.exec:\bxbpndh.exe39⤵
- Executes dropped EXE
-
\??\c:\pnfdlrl.exec:\pnfdlrl.exe40⤵
- Executes dropped EXE
-
\??\c:\fhfflxb.exec:\fhfflxb.exe41⤵
- Executes dropped EXE
-
\??\c:\njrtllj.exec:\njrtllj.exe42⤵
- Executes dropped EXE
-
\??\c:\hndjdp.exec:\hndjdp.exe43⤵
- Executes dropped EXE
-
\??\c:\jhptpv.exec:\jhptpv.exe44⤵
- Executes dropped EXE
-
\??\c:\dhtdfxp.exec:\dhtdfxp.exe45⤵
- Executes dropped EXE
-
\??\c:\pttxnt.exec:\pttxnt.exe46⤵
- Executes dropped EXE
-
\??\c:\trtbtl.exec:\trtbtl.exe47⤵
- Executes dropped EXE
-
\??\c:\hjhfhnb.exec:\hjhfhnb.exe48⤵
- Executes dropped EXE
-
\??\c:\djxfpd.exec:\djxfpd.exe49⤵
- Executes dropped EXE
-
\??\c:\rxbdl.exec:\rxbdl.exe50⤵
- Executes dropped EXE
-
\??\c:\rrfft.exec:\rrfft.exe51⤵
- Executes dropped EXE
-
\??\c:\vlxfth.exec:\vlxfth.exe52⤵
- Executes dropped EXE
-
\??\c:\nxxnrf.exec:\nxxnrf.exe53⤵
- Executes dropped EXE
-
\??\c:\pdhnhr.exec:\pdhnhr.exe54⤵
- Executes dropped EXE
-
\??\c:\njfhjp.exec:\njfhjp.exe55⤵
- Executes dropped EXE
-
\??\c:\bnrhr.exec:\bnrhr.exe56⤵
- Executes dropped EXE
-
\??\c:\nfrxbxn.exec:\nfrxbxn.exe57⤵
- Executes dropped EXE
-
\??\c:\xxlfb.exec:\xxlfb.exe58⤵
- Executes dropped EXE
-
\??\c:\tldlvfn.exec:\tldlvfn.exe59⤵
- Executes dropped EXE
-
\??\c:\vnjbrhf.exec:\vnjbrhf.exe60⤵
- Executes dropped EXE
-
\??\c:\pbvjt.exec:\pbvjt.exe61⤵
- Executes dropped EXE
-
\??\c:\nblfn.exec:\nblfn.exe62⤵
- Executes dropped EXE
-
\??\c:\nhthd.exec:\nhthd.exe63⤵
- Executes dropped EXE
-
\??\c:\pnnjnl.exec:\pnnjnl.exe64⤵
- Executes dropped EXE
-
\??\c:\fxxxd.exec:\fxxxd.exe65⤵
- Executes dropped EXE
-
\??\c:\vxrdtr.exec:\vxrdtr.exe66⤵
-
\??\c:\dbfdn.exec:\dbfdn.exe67⤵
-
\??\c:\hvdfvn.exec:\hvdfvn.exe68⤵
-
\??\c:\ppbhxrh.exec:\ppbhxrh.exe69⤵
-
\??\c:\rfhvpvd.exec:\rfhvpvd.exe70⤵
-
\??\c:\jfjfxt.exec:\jfjfxt.exe71⤵
-
\??\c:\xnblhhl.exec:\xnblhhl.exe72⤵
-
\??\c:\bblbp.exec:\bblbp.exe73⤵
-
\??\c:\jlpprxh.exec:\jlpprxh.exe74⤵
-
\??\c:\jbhtb.exec:\jbhtb.exe75⤵
-
\??\c:\pvdnr.exec:\pvdnr.exe76⤵
-
\??\c:\vfftdvj.exec:\vfftdvj.exe77⤵
-
\??\c:\lnbthp.exec:\lnbthp.exe78⤵
-
\??\c:\txlnff.exec:\txlnff.exe79⤵
-
\??\c:\fhtbvxp.exec:\fhtbvxp.exe80⤵
-
\??\c:\bxlxxfd.exec:\bxlxxfd.exe81⤵
-
\??\c:\nrjdx.exec:\nrjdx.exe82⤵
-
\??\c:\rtprvvn.exec:\rtprvvn.exe83⤵
-
\??\c:\lxhtn.exec:\lxhtn.exe84⤵
-
\??\c:\lnhrpx.exec:\lnhrpx.exe85⤵
-
\??\c:\hhdhpxp.exec:\hhdhpxp.exe86⤵
-
\??\c:\bhrftd.exec:\bhrftd.exe87⤵
-
\??\c:\lljlh.exec:\lljlh.exe88⤵
-
\??\c:\fxpxv.exec:\fxpxv.exe89⤵
-
\??\c:\hvfrrx.exec:\hvfrrx.exe90⤵
-
\??\c:\lxlxftb.exec:\lxlxftb.exe91⤵
-
\??\c:\tjfxt.exec:\tjfxt.exe92⤵
-
\??\c:\hnhxf.exec:\hnhxf.exe93⤵
-
\??\c:\fhlpvvx.exec:\fhlpvvx.exe94⤵
-
\??\c:\pthpjvp.exec:\pthpjvp.exe95⤵
-
\??\c:\dnvjht.exec:\dnvjht.exe96⤵
-
\??\c:\vdbpxp.exec:\vdbpxp.exe97⤵
-
\??\c:\tvjptt.exec:\tvjptt.exe98⤵
-
\??\c:\lhfvj.exec:\lhfvj.exe99⤵
-
\??\c:\vxnxvnn.exec:\vxnxvnn.exe100⤵
-
\??\c:\dddxp.exec:\dddxp.exe101⤵
-
\??\c:\ftlfvlp.exec:\ftlfvlp.exe102⤵
-
\??\c:\ffrlh.exec:\ffrlh.exe103⤵
-
\??\c:\jvrlnnt.exec:\jvrlnnt.exe104⤵
-
\??\c:\nxxrd.exec:\nxxrd.exe105⤵
-
\??\c:\nxnbxlx.exec:\nxnbxlx.exe106⤵
-
\??\c:\ntfpl.exec:\ntfpl.exe107⤵
-
\??\c:\ftlpxxp.exec:\ftlpxxp.exe108⤵
-
\??\c:\rxtbnd.exec:\rxtbnd.exe109⤵
-
\??\c:\dhxffxn.exec:\dhxffxn.exe110⤵
-
\??\c:\fjxft.exec:\fjxft.exe111⤵
-
\??\c:\nlpvbhn.exec:\nlpvbhn.exe112⤵
-
\??\c:\dthxd.exec:\dthxd.exe113⤵
-
\??\c:\njtvdp.exec:\njtvdp.exe114⤵
-
\??\c:\flddjjr.exec:\flddjjr.exe115⤵
-
\??\c:\btpttrp.exec:\btpttrp.exe116⤵
-
\??\c:\xpjjp.exec:\xpjjp.exe117⤵
-
\??\c:\fxnhn.exec:\fxnhn.exe118⤵
-
\??\c:\hxfthhv.exec:\hxfthhv.exe119⤵
-
\??\c:\fdhfjt.exec:\fdhfjt.exe120⤵
-
\??\c:\xhnhxld.exec:\xhnhxld.exe121⤵
-
\??\c:\tfdph.exec:\tfdph.exe122⤵
-
\??\c:\tbdftl.exec:\tbdftl.exe123⤵
-
\??\c:\flnrptr.exec:\flnrptr.exe124⤵
-
\??\c:\hxfvv.exec:\hxfvv.exe125⤵
-
\??\c:\ldbnhn.exec:\ldbnhn.exe126⤵
-
\??\c:\ldxpprj.exec:\ldxpprj.exe127⤵
-
\??\c:\pxjbxjt.exec:\pxjbxjt.exe128⤵
-
\??\c:\ttbtlhx.exec:\ttbtlhx.exe129⤵
-
\??\c:\tbnfrp.exec:\tbnfrp.exe130⤵
-
\??\c:\vvtdbl.exec:\vvtdbl.exe131⤵
-
\??\c:\rbflhlx.exec:\rbflhlx.exe132⤵
-
\??\c:\bxdjlfl.exec:\bxdjlfl.exe133⤵
-
\??\c:\nprhhhh.exec:\nprhhhh.exe134⤵
-
\??\c:\jhjnr.exec:\jhjnr.exe135⤵
-
\??\c:\nbxhdbn.exec:\nbxhdbn.exe136⤵
-
\??\c:\dpltnfn.exec:\dpltnfn.exe137⤵
-
\??\c:\hhfpxnd.exec:\hhfpxnd.exe138⤵
-
\??\c:\fbhhv.exec:\fbhhv.exe139⤵
-
\??\c:\hjxhv.exec:\hjxhv.exe140⤵
-
\??\c:\vvtbjrd.exec:\vvtbjrd.exe141⤵
-
\??\c:\nvfnxrv.exec:\nvfnxrv.exe142⤵
-
\??\c:\pjbxxv.exec:\pjbxxv.exe143⤵
-
\??\c:\xbrnp.exec:\xbrnp.exe144⤵
-
\??\c:\txblhnp.exec:\txblhnp.exe145⤵
-
\??\c:\lxhfhhr.exec:\lxhfhhr.exe146⤵
-
\??\c:\pvvlxx.exec:\pvvlxx.exe147⤵
-
\??\c:\xrfvtf.exec:\xrfvtf.exe148⤵
-
\??\c:\phvxfxt.exec:\phvxfxt.exe149⤵
-
\??\c:\lxddd.exec:\lxddd.exe150⤵
-
\??\c:\nnlvhlh.exec:\nnlvhlh.exe151⤵
-
\??\c:\vxjxn.exec:\vxjxn.exe152⤵
-
\??\c:\ltdvhv.exec:\ltdvhv.exe153⤵
-
\??\c:\tjtbfx.exec:\tjtbfx.exe154⤵
-
\??\c:\tlbptnt.exec:\tlbptnt.exe155⤵
-
\??\c:\vfpbdxb.exec:\vfpbdxb.exe156⤵
-
\??\c:\ttfrj.exec:\ttfrj.exe157⤵
-
\??\c:\ntfdlft.exec:\ntfdlft.exe158⤵
-
\??\c:\xxjbbh.exec:\xxjbbh.exe159⤵
-
\??\c:\vhdpr.exec:\vhdpr.exe160⤵
-
\??\c:\rnfthh.exec:\rnfthh.exe161⤵
-
\??\c:\lvprb.exec:\lvprb.exe162⤵
-
\??\c:\thpvf.exec:\thpvf.exe163⤵
-
\??\c:\xdxblvh.exec:\xdxblvh.exe164⤵
-
\??\c:\vffvlvl.exec:\vffvlvl.exe165⤵
-
\??\c:\rvhfpdb.exec:\rvhfpdb.exe166⤵
-
\??\c:\xvlvpp.exec:\xvlvpp.exe167⤵
-
\??\c:\hdxph.exec:\hdxph.exe168⤵
-
\??\c:\nfhjf.exec:\nfhjf.exe169⤵
-
\??\c:\lrrrjpj.exec:\lrrrjpj.exe170⤵
-
\??\c:\pxlpv.exec:\pxlpv.exe171⤵
-
\??\c:\njtvl.exec:\njtvl.exe172⤵
-
\??\c:\lhthf.exec:\lhthf.exe173⤵
-
\??\c:\djbthp.exec:\djbthp.exe174⤵
-
\??\c:\tpfxdph.exec:\tpfxdph.exe175⤵
-
\??\c:\drdrfbj.exec:\drdrfbj.exe176⤵
-
\??\c:\drnbx.exec:\drnbx.exe177⤵
-
\??\c:\flndr.exec:\flndr.exe178⤵
-
\??\c:\hlbdt.exec:\hlbdt.exe179⤵
-
\??\c:\ndxdxxf.exec:\ndxdxxf.exe180⤵
-
\??\c:\pfvtlx.exec:\pfvtlx.exe181⤵
-
\??\c:\rpxrnd.exec:\rpxrnd.exe182⤵
-
\??\c:\tjvddj.exec:\tjvddj.exe183⤵
-
\??\c:\jfrdv.exec:\jfrdv.exe184⤵
-
\??\c:\brfbfpj.exec:\brfbfpj.exe185⤵
-
\??\c:\xddxrxp.exec:\xddxrxp.exe186⤵
-
\??\c:\nxjnfbl.exec:\nxjnfbl.exe187⤵
-
\??\c:\dftxnh.exec:\dftxnh.exe188⤵
-
\??\c:\npdjrrp.exec:\npdjrrp.exe189⤵
-
\??\c:\jthxf.exec:\jthxf.exe190⤵
-
\??\c:\rhpljj.exec:\rhpljj.exe191⤵
-
\??\c:\pnfxhxn.exec:\pnfxhxn.exe192⤵
-
\??\c:\pplvfl.exec:\pplvfl.exe193⤵
-
\??\c:\xdlfbh.exec:\xdlfbh.exe194⤵
-
\??\c:\trfvj.exec:\trfvj.exe195⤵
-
\??\c:\vfnhdf.exec:\vfnhdf.exe196⤵
-
\??\c:\fjfnr.exec:\fjfnr.exe197⤵
-
\??\c:\dbrbvxn.exec:\dbrbvxn.exe198⤵
-
\??\c:\nhrxjxd.exec:\nhrxjxd.exe199⤵
-
\??\c:\vjpht.exec:\vjpht.exe200⤵
-
\??\c:\ndvjhxr.exec:\ndvjhxr.exe201⤵
-
\??\c:\bxhrnd.exec:\bxhrnd.exe202⤵
-
\??\c:\nhfvxv.exec:\nhfvxv.exe203⤵
-
\??\c:\jdfblh.exec:\jdfblh.exe204⤵
-
\??\c:\tnhhl.exec:\tnhhl.exe205⤵
-
\??\c:\xtvhbd.exec:\xtvhbd.exe206⤵
-
\??\c:\pfxdt.exec:\pfxdt.exe207⤵
-
\??\c:\lxdtnhh.exec:\lxdtnhh.exe208⤵
-
\??\c:\jnbtfr.exec:\jnbtfr.exe209⤵
-
\??\c:\tphjb.exec:\tphjb.exe210⤵
-
\??\c:\dptfh.exec:\dptfh.exe211⤵
-
\??\c:\pnhjhf.exec:\pnhjhf.exe212⤵
-
\??\c:\dhxrj.exec:\dhxrj.exe213⤵
-
\??\c:\fbdfhv.exec:\fbdfhv.exe214⤵
-
\??\c:\rjdrpd.exec:\rjdrpd.exe215⤵
-
\??\c:\nfltj.exec:\nfltj.exe216⤵
-
\??\c:\nhlxv.exec:\nhlxv.exe217⤵
-
\??\c:\ttvnlbj.exec:\ttvnlbj.exe218⤵
-
\??\c:\ltllfx.exec:\ltllfx.exe219⤵
-
\??\c:\dbfttl.exec:\dbfttl.exe220⤵
-
\??\c:\dpldp.exec:\dpldp.exe221⤵
-
\??\c:\fxdtprj.exec:\fxdtprj.exe222⤵
-
\??\c:\hvdtx.exec:\hvdtx.exe223⤵
-
\??\c:\xrnbhbl.exec:\xrnbhbl.exe224⤵
-
\??\c:\bvtfdlt.exec:\bvtfdlt.exe225⤵
-
\??\c:\vvltft.exec:\vvltft.exe226⤵
-
\??\c:\hlxdp.exec:\hlxdp.exe227⤵
-
\??\c:\lvtdvf.exec:\lvtdvf.exe228⤵
-
\??\c:\nrfdhnx.exec:\nrfdhnx.exe229⤵
-
\??\c:\lblxf.exec:\lblxf.exe230⤵
-
\??\c:\vftfjp.exec:\vftfjp.exe231⤵
-
\??\c:\pfrnb.exec:\pfrnb.exe232⤵
-
\??\c:\tlhbnl.exec:\tlhbnl.exe233⤵
-
\??\c:\pxdfnvp.exec:\pxdfnvp.exe234⤵
-
\??\c:\nbbbdnh.exec:\nbbbdnh.exe235⤵
-
\??\c:\thhpdj.exec:\thhpdj.exe236⤵
-
\??\c:\trttl.exec:\trttl.exe237⤵
-
\??\c:\thtjft.exec:\thtjft.exe238⤵
-
\??\c:\drnfrjh.exec:\drnfrjh.exe239⤵
-
\??\c:\pxdlfhh.exec:\pxdlfhh.exe240⤵
-
\??\c:\rhtltd.exec:\rhtltd.exe241⤵