Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 07:50
Behavioral task
behavioral1
Sample
8a0ef55e78bd004717cb93c0dc2d5fb0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
8a0ef55e78bd004717cb93c0dc2d5fb0_NeikiAnalytics.exe
-
Size
89KB
-
MD5
8a0ef55e78bd004717cb93c0dc2d5fb0
-
SHA1
926735d3e9c51b8f5e0bc1f1fbd73e5f42defd32
-
SHA256
c496982ff541c076154dc230d7a34c026fd77cea00c964f73ad4e5a55b174d31
-
SHA512
62ab225d72542b8cf35b60009f206f8f54d48c6886259fda83360c995522bb5cc2f9ec87700d26307f6a7b3c128fa6124fa7c50a4a8d8971647b048a050a5730
-
SSDEEP
1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8mVeygryFU2li0gx4EBbhnyLFW+O:chOmTsF93UYfwC6GIoutieyhC2lbgGiB
Malware Config
Signatures
-
Detect Blackmoon payload 50 IoCs
Processes:
resource yara_rule behavioral1/memory/1712-1-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1432-20-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3004-23-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2864-38-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2644-47-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2680-57-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2544-82-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1392-100-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1604-108-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2348-118-0x00000000002F0000-0x0000000000326000-memory.dmp family_blackmoon behavioral1/memory/2800-128-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2940-136-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2272-149-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2524-164-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1660-182-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/840-191-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3012-200-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2104-208-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2104-212-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2076-220-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1356-230-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2368-240-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1836-257-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1836-255-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2840-294-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1596-311-0x0000000000230000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/2572-331-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2580-344-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2604-357-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2476-398-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2408-412-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2928-425-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1964-427-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1964-426-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1296-450-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2080-484-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/940-492-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3048-530-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/692-532-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2964-605-0x00000000001B0000-0x00000000001E6000-memory.dmp family_blackmoon behavioral1/memory/2572-638-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2564-645-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2456-676-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1988-737-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2136-751-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1520-778-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/580-1014-0x0000000000230000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/580-1012-0x0000000000230000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/952-1035-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2212-1072-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fndlht.exerhhfrn.exervjrr.exebddrdt.exehvxvx.exervjpj.exebdltlvl.exerlrjp.exefbxptj.exelbbvtp.exerllhjx.exehlxpvp.exeflfrbt.exetlldb.exebjrjb.exedddvrfd.exedrvbn.exebtxlnd.exetbjnrh.exelrpjjb.exejnldr.exennhfhr.exedlrhdld.exernxbln.exejfpptpx.exebtlvdv.exerhffvx.exelhdnxtr.exevfhrnnr.exenfvbb.exefhvhn.exeldnnh.exefrbhv.exevrvhv.exerfhfpd.exerppxtt.exervlpp.exertdnnl.exebrbfp.exenbtbpfr.exetbfnl.exetlrjpn.exefvxjpxj.exejntbtnx.exejpnnhfl.exerpnnnxb.exedrlrh.exejfhfjn.exevdtvnht.exexhvpfl.exephxhfd.exextjdr.exefdxxl.exendpthn.exentjtdd.exevbnvt.exepfpjxjb.exedrfhxt.exedjdnxt.exephbxhdv.exejxxlhlf.exevlrpld.exexjttp.exejnjdflv.exepid process 1432 fndlht.exe 3004 rhhfrn.exe 2864 rvjrr.exe 2644 bddrdt.exe 2680 hvxvx.exe 2028 rvjpj.exe 2424 bdltlvl.exe 2544 rlrjp.exe 1164 fbxptj.exe 1392 lbbvtp.exe 1604 rllhjx.exe 2348 hlxpvp.exe 2800 flfrbt.exe 2940 tlldb.exe 2672 bjrjb.exe 2272 dddvrfd.exe 2524 drvbn.exe 1036 btxlnd.exe 1660 tbjnrh.exe 840 lrpjjb.exe 3012 jnldr.exe 2104 nnhfhr.exe 2076 dlrhdld.exe 1356 rnxbln.exe 2368 jfpptpx.exe 1476 btlvdv.exe 1836 rhffvx.exe 1816 lhdnxtr.exe 916 vfhrnnr.exe 1204 nfvbb.exe 2840 fhvhn.exe 2120 ldnnh.exe 2340 frbhv.exe 1596 vrvhv.exe 2956 rfhfpd.exe 1560 rppxtt.exe 1340 rvlpp.exe 2572 rtdnnl.exe 2580 brbfp.exe 2632 nbtbpfr.exe 2604 tbfnl.exe 2644 tlrjpn.exe 2584 fvxjpxj.exe 2696 jntbtnx.exe 2500 jpnnhfl.exe 2928 rpnnnxb.exe 2476 drlrh.exe 2932 jfhfjn.exe 2408 vdtvnht.exe 580 xhvpfl.exe 1964 phxhfd.exe 2268 xtjdr.exe 2808 fdxxl.exe 956 ndpthn.exe 1296 ntjtdd.exe 1776 vbnvt.exe 2744 pfpjxjb.exe 2524 drfhxt.exe 2732 djdnxt.exe 2080 phbxhdv.exe 940 jxxlhlf.exe 1288 vlrpld.exe 3032 xjttp.exe 3052 jnjdflv.exe -
Processes:
resource yara_rule behavioral1/memory/1712-1-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1712-3-0x0000000000230000-0x0000000000266000-memory.dmp upx C:\fndlht.exe upx behavioral1/memory/1432-9-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\rhhfrn.exe upx behavioral1/memory/1432-20-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/3004-23-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rvjrr.exe upx behavioral1/memory/2864-38-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\bddrdt.exe upx behavioral1/memory/2644-47-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2680-48-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hvxvx.exe upx behavioral1/memory/2680-57-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\rvjpj.exe upx \??\c:\bdltlvl.exe upx C:\rlrjp.exe upx behavioral1/memory/2544-82-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1164-84-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\fbxptj.exe upx C:\lbbvtp.exe upx behavioral1/memory/1392-100-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rllhjx.exe upx C:\hlxpvp.exe upx C:\flfrbt.exe upx behavioral1/memory/2800-120-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\tlldb.exe upx behavioral1/memory/2800-128-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\bjrjb.exe upx behavioral1/memory/2940-136-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2272-149-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\dddvrfd.exe upx C:\drvbn.exe upx \??\c:\btxlnd.exe upx behavioral1/memory/2524-164-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\tbjnrh.exe upx behavioral1/memory/1660-173-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1660-182-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\lrpjjb.exe upx behavioral1/memory/840-191-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jnldr.exe upx behavioral1/memory/3012-192-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/3012-200-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nnhfhr.exe upx behavioral1/memory/2104-208-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/memory/2104-212-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dlrhdld.exe upx behavioral1/memory/1356-223-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\rnxbln.exe upx behavioral1/memory/2076-220-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jfpptpx.exe upx behavioral1/memory/1356-230-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\btlvdv.exe upx behavioral1/memory/2368-240-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rhffvx.exe upx \??\c:\lhdnxtr.exe upx C:\vfhrnnr.exe upx \??\c:\nfvbb.exe upx C:\fhvhn.exe upx \??\c:\ldnnh.exe upx behavioral1/memory/1560-318-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2572-331-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2580-344-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2604-357-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8a0ef55e78bd004717cb93c0dc2d5fb0_NeikiAnalytics.exefndlht.exerhhfrn.exervjrr.exebddrdt.exehvxvx.exervjpj.exebdltlvl.exerlrjp.exefbxptj.exelbbvtp.exerllhjx.exehlxpvp.exeflfrbt.exetlldb.exebjrjb.exedescription pid process target process PID 1712 wrote to memory of 1432 1712 8a0ef55e78bd004717cb93c0dc2d5fb0_NeikiAnalytics.exe fndlht.exe PID 1712 wrote to memory of 1432 1712 8a0ef55e78bd004717cb93c0dc2d5fb0_NeikiAnalytics.exe fndlht.exe PID 1712 wrote to memory of 1432 1712 8a0ef55e78bd004717cb93c0dc2d5fb0_NeikiAnalytics.exe fndlht.exe PID 1712 wrote to memory of 1432 1712 8a0ef55e78bd004717cb93c0dc2d5fb0_NeikiAnalytics.exe fndlht.exe PID 1432 wrote to memory of 3004 1432 fndlht.exe rhhfrn.exe PID 1432 wrote to memory of 3004 1432 fndlht.exe rhhfrn.exe PID 1432 wrote to memory of 3004 1432 fndlht.exe rhhfrn.exe PID 1432 wrote to memory of 3004 1432 fndlht.exe rhhfrn.exe PID 3004 wrote to memory of 2864 3004 rhhfrn.exe rvjrr.exe PID 3004 wrote to memory of 2864 3004 rhhfrn.exe rvjrr.exe PID 3004 wrote to memory of 2864 3004 rhhfrn.exe rvjrr.exe PID 3004 wrote to memory of 2864 3004 rhhfrn.exe rvjrr.exe PID 2864 wrote to memory of 2644 2864 rvjrr.exe bddrdt.exe PID 2864 wrote to memory of 2644 2864 rvjrr.exe bddrdt.exe PID 2864 wrote to memory of 2644 2864 rvjrr.exe bddrdt.exe PID 2864 wrote to memory of 2644 2864 rvjrr.exe bddrdt.exe PID 2644 wrote to memory of 2680 2644 bddrdt.exe hvxvx.exe PID 2644 wrote to memory of 2680 2644 bddrdt.exe hvxvx.exe PID 2644 wrote to memory of 2680 2644 bddrdt.exe hvxvx.exe PID 2644 wrote to memory of 2680 2644 bddrdt.exe hvxvx.exe PID 2680 wrote to memory of 2028 2680 hvxvx.exe rvjpj.exe PID 2680 wrote to memory of 2028 2680 hvxvx.exe rvjpj.exe PID 2680 wrote to memory of 2028 2680 hvxvx.exe rvjpj.exe PID 2680 wrote to memory of 2028 2680 hvxvx.exe rvjpj.exe PID 2028 wrote to memory of 2424 2028 rvjpj.exe bdltlvl.exe PID 2028 wrote to memory of 2424 2028 rvjpj.exe bdltlvl.exe PID 2028 wrote to memory of 2424 2028 rvjpj.exe bdltlvl.exe PID 2028 wrote to memory of 2424 2028 rvjpj.exe bdltlvl.exe PID 2424 wrote to memory of 2544 2424 bdltlvl.exe rlrjp.exe PID 2424 wrote to memory of 2544 2424 bdltlvl.exe rlrjp.exe PID 2424 wrote to memory of 2544 2424 bdltlvl.exe rlrjp.exe PID 2424 wrote to memory of 2544 2424 bdltlvl.exe rlrjp.exe PID 2544 wrote to memory of 1164 2544 rlrjp.exe fbxptj.exe PID 2544 wrote to memory of 1164 2544 rlrjp.exe fbxptj.exe PID 2544 wrote to memory of 1164 2544 rlrjp.exe fbxptj.exe PID 2544 wrote to memory of 1164 2544 rlrjp.exe fbxptj.exe PID 1164 wrote to memory of 1392 1164 fbxptj.exe lbbvtp.exe PID 1164 wrote to memory of 1392 1164 fbxptj.exe lbbvtp.exe PID 1164 wrote to memory of 1392 1164 fbxptj.exe lbbvtp.exe PID 1164 wrote to memory of 1392 1164 fbxptj.exe lbbvtp.exe PID 1392 wrote to memory of 1604 1392 lbbvtp.exe rllhjx.exe PID 1392 wrote to memory of 1604 1392 lbbvtp.exe rllhjx.exe PID 1392 wrote to memory of 1604 1392 lbbvtp.exe rllhjx.exe PID 1392 wrote to memory of 1604 1392 lbbvtp.exe rllhjx.exe PID 1604 wrote to memory of 2348 1604 rllhjx.exe hlxpvp.exe PID 1604 wrote to memory of 2348 1604 rllhjx.exe hlxpvp.exe PID 1604 wrote to memory of 2348 1604 rllhjx.exe hlxpvp.exe PID 1604 wrote to memory of 2348 1604 rllhjx.exe hlxpvp.exe PID 2348 wrote to memory of 2800 2348 hlxpvp.exe flfrbt.exe PID 2348 wrote to memory of 2800 2348 hlxpvp.exe flfrbt.exe PID 2348 wrote to memory of 2800 2348 hlxpvp.exe flfrbt.exe PID 2348 wrote to memory of 2800 2348 hlxpvp.exe flfrbt.exe PID 2800 wrote to memory of 2940 2800 flfrbt.exe tlldb.exe PID 2800 wrote to memory of 2940 2800 flfrbt.exe tlldb.exe PID 2800 wrote to memory of 2940 2800 flfrbt.exe tlldb.exe PID 2800 wrote to memory of 2940 2800 flfrbt.exe tlldb.exe PID 2940 wrote to memory of 2672 2940 tlldb.exe bjrjb.exe PID 2940 wrote to memory of 2672 2940 tlldb.exe bjrjb.exe PID 2940 wrote to memory of 2672 2940 tlldb.exe bjrjb.exe PID 2940 wrote to memory of 2672 2940 tlldb.exe bjrjb.exe PID 2672 wrote to memory of 2272 2672 bjrjb.exe dddvrfd.exe PID 2672 wrote to memory of 2272 2672 bjrjb.exe dddvrfd.exe PID 2672 wrote to memory of 2272 2672 bjrjb.exe dddvrfd.exe PID 2672 wrote to memory of 2272 2672 bjrjb.exe dddvrfd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a0ef55e78bd004717cb93c0dc2d5fb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8a0ef55e78bd004717cb93c0dc2d5fb0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\fndlht.exec:\fndlht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rhhfrn.exec:\rhhfrn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rvjrr.exec:\rvjrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bddrdt.exec:\bddrdt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hvxvx.exec:\hvxvx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rvjpj.exec:\rvjpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bdltlvl.exec:\bdltlvl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlrjp.exec:\rlrjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fbxptj.exec:\fbxptj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lbbvtp.exec:\lbbvtp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rllhjx.exec:\rllhjx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hlxpvp.exec:\hlxpvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flfrbt.exec:\flfrbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tlldb.exec:\tlldb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bjrjb.exec:\bjrjb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dddvrfd.exec:\dddvrfd.exe17⤵
- Executes dropped EXE
-
\??\c:\drvbn.exec:\drvbn.exe18⤵
- Executes dropped EXE
-
\??\c:\btxlnd.exec:\btxlnd.exe19⤵
- Executes dropped EXE
-
\??\c:\tbjnrh.exec:\tbjnrh.exe20⤵
- Executes dropped EXE
-
\??\c:\lrpjjb.exec:\lrpjjb.exe21⤵
- Executes dropped EXE
-
\??\c:\jnldr.exec:\jnldr.exe22⤵
- Executes dropped EXE
-
\??\c:\nnhfhr.exec:\nnhfhr.exe23⤵
- Executes dropped EXE
-
\??\c:\dlrhdld.exec:\dlrhdld.exe24⤵
- Executes dropped EXE
-
\??\c:\rnxbln.exec:\rnxbln.exe25⤵
- Executes dropped EXE
-
\??\c:\jfpptpx.exec:\jfpptpx.exe26⤵
- Executes dropped EXE
-
\??\c:\btlvdv.exec:\btlvdv.exe27⤵
- Executes dropped EXE
-
\??\c:\rhffvx.exec:\rhffvx.exe28⤵
- Executes dropped EXE
-
\??\c:\lhdnxtr.exec:\lhdnxtr.exe29⤵
- Executes dropped EXE
-
\??\c:\vfhrnnr.exec:\vfhrnnr.exe30⤵
- Executes dropped EXE
-
\??\c:\nfvbb.exec:\nfvbb.exe31⤵
- Executes dropped EXE
-
\??\c:\fhvhn.exec:\fhvhn.exe32⤵
- Executes dropped EXE
-
\??\c:\ldnnh.exec:\ldnnh.exe33⤵
- Executes dropped EXE
-
\??\c:\frbhv.exec:\frbhv.exe34⤵
- Executes dropped EXE
-
\??\c:\vrvhv.exec:\vrvhv.exe35⤵
- Executes dropped EXE
-
\??\c:\rfhfpd.exec:\rfhfpd.exe36⤵
- Executes dropped EXE
-
\??\c:\rppxtt.exec:\rppxtt.exe37⤵
- Executes dropped EXE
-
\??\c:\rvlpp.exec:\rvlpp.exe38⤵
- Executes dropped EXE
-
\??\c:\rtdnnl.exec:\rtdnnl.exe39⤵
- Executes dropped EXE
-
\??\c:\brbfp.exec:\brbfp.exe40⤵
- Executes dropped EXE
-
\??\c:\nbtbpfr.exec:\nbtbpfr.exe41⤵
- Executes dropped EXE
-
\??\c:\tbfnl.exec:\tbfnl.exe42⤵
- Executes dropped EXE
-
\??\c:\tlrjpn.exec:\tlrjpn.exe43⤵
- Executes dropped EXE
-
\??\c:\fvxjpxj.exec:\fvxjpxj.exe44⤵
- Executes dropped EXE
-
\??\c:\jntbtnx.exec:\jntbtnx.exe45⤵
- Executes dropped EXE
-
\??\c:\jpnnhfl.exec:\jpnnhfl.exe46⤵
- Executes dropped EXE
-
\??\c:\rpnnnxb.exec:\rpnnnxb.exe47⤵
- Executes dropped EXE
-
\??\c:\drlrh.exec:\drlrh.exe48⤵
- Executes dropped EXE
-
\??\c:\jfhfjn.exec:\jfhfjn.exe49⤵
- Executes dropped EXE
-
\??\c:\vdtvnht.exec:\vdtvnht.exe50⤵
- Executes dropped EXE
-
\??\c:\xhvpfl.exec:\xhvpfl.exe51⤵
- Executes dropped EXE
-
\??\c:\phxhfd.exec:\phxhfd.exe52⤵
- Executes dropped EXE
-
\??\c:\xtjdr.exec:\xtjdr.exe53⤵
- Executes dropped EXE
-
\??\c:\fdxxl.exec:\fdxxl.exe54⤵
- Executes dropped EXE
-
\??\c:\ndpthn.exec:\ndpthn.exe55⤵
- Executes dropped EXE
-
\??\c:\ntjtdd.exec:\ntjtdd.exe56⤵
- Executes dropped EXE
-
\??\c:\vbnvt.exec:\vbnvt.exe57⤵
- Executes dropped EXE
-
\??\c:\pfpjxjb.exec:\pfpjxjb.exe58⤵
- Executes dropped EXE
-
\??\c:\drfhxt.exec:\drfhxt.exe59⤵
- Executes dropped EXE
-
\??\c:\djdnxt.exec:\djdnxt.exe60⤵
- Executes dropped EXE
-
\??\c:\phbxhdv.exec:\phbxhdv.exe61⤵
- Executes dropped EXE
-
\??\c:\jxxlhlf.exec:\jxxlhlf.exe62⤵
- Executes dropped EXE
-
\??\c:\vlrpld.exec:\vlrpld.exe63⤵
- Executes dropped EXE
-
\??\c:\xjttp.exec:\xjttp.exe64⤵
- Executes dropped EXE
-
\??\c:\jnjdflv.exec:\jnjdflv.exe65⤵
- Executes dropped EXE
-
\??\c:\tbbvlv.exec:\tbbvlv.exe66⤵
-
\??\c:\dpfrf.exec:\dpfrf.exe67⤵
-
\??\c:\rltpnv.exec:\rltpnv.exe68⤵
-
\??\c:\jdvprx.exec:\jdvprx.exe69⤵
-
\??\c:\jltnl.exec:\jltnl.exe70⤵
-
\??\c:\dnvblhl.exec:\dnvblhl.exe71⤵
-
\??\c:\xtbndv.exec:\xtbndv.exe72⤵
-
\??\c:\dpvxdf.exec:\dpvxdf.exe73⤵
-
\??\c:\htlhjr.exec:\htlhjr.exe74⤵
-
\??\c:\ldxbrl.exec:\ldxbrl.exe75⤵
-
\??\c:\vpbhd.exec:\vpbhd.exe76⤵
-
\??\c:\hbnblr.exec:\hbnblr.exe77⤵
-
\??\c:\fltjdbt.exec:\fltjdbt.exe78⤵
-
\??\c:\trbjhv.exec:\trbjhv.exe79⤵
-
\??\c:\xptplv.exec:\xptplv.exe80⤵
-
\??\c:\vnvxhxv.exec:\vnvxhxv.exe81⤵
-
\??\c:\djntn.exec:\djntn.exe82⤵
-
\??\c:\tppfrjt.exec:\tppfrjt.exe83⤵
-
\??\c:\vjnbdj.exec:\vjnbdj.exe84⤵
-
\??\c:\hvtbnlb.exec:\hvtbnlb.exe85⤵
-
\??\c:\hhlbhd.exec:\hhlbhd.exe86⤵
-
\??\c:\tbrjtj.exec:\tbrjtj.exe87⤵
-
\??\c:\bbnhlf.exec:\bbnhlf.exe88⤵
-
\??\c:\fbrvr.exec:\fbrvr.exe89⤵
-
\??\c:\vffld.exec:\vffld.exe90⤵
-
\??\c:\txftp.exec:\txftp.exe91⤵
-
\??\c:\drtbdxn.exec:\drtbdxn.exe92⤵
-
\??\c:\trppp.exec:\trppp.exe93⤵
-
\??\c:\rdthhbd.exec:\rdthhbd.exe94⤵
-
\??\c:\fllbdpn.exec:\fllbdpn.exe95⤵
-
\??\c:\nphrtv.exec:\nphrtv.exe96⤵
-
\??\c:\xptvd.exec:\xptvd.exe97⤵
-
\??\c:\hvntbxp.exec:\hvntbxp.exe98⤵
-
\??\c:\prxvfhd.exec:\prxvfhd.exe99⤵
-
\??\c:\dxjrfb.exec:\dxjrfb.exe100⤵
-
\??\c:\xxbrfr.exec:\xxbrfr.exe101⤵
-
\??\c:\xnlvvr.exec:\xnlvvr.exe102⤵
-
\??\c:\vprlp.exec:\vprlp.exe103⤵
-
\??\c:\txfvn.exec:\txfvn.exe104⤵
-
\??\c:\pxxlfn.exec:\pxxlfn.exe105⤵
-
\??\c:\vfnbh.exec:\vfnbh.exe106⤵
-
\??\c:\ldxtlb.exec:\ldxtlb.exe107⤵
-
\??\c:\fljjrfr.exec:\fljjrfr.exe108⤵
-
\??\c:\tfnrtvn.exec:\tfnrtvn.exe109⤵
-
\??\c:\hnnrn.exec:\hnnrn.exe110⤵
-
\??\c:\txlrjd.exec:\txlrjd.exe111⤵
-
\??\c:\trrhhvx.exec:\trrhhvx.exe112⤵
-
\??\c:\xfppr.exec:\xfppr.exe113⤵
-
\??\c:\llnnrf.exec:\llnnrf.exe114⤵
-
\??\c:\rrbthl.exec:\rrbthl.exe115⤵
-
\??\c:\nlbltn.exec:\nlbltn.exe116⤵
-
\??\c:\trxnjl.exec:\trxnjl.exe117⤵
-
\??\c:\vnrjvn.exec:\vnrjvn.exe118⤵
-
\??\c:\fdpxdp.exec:\fdpxdp.exe119⤵
-
\??\c:\dpvnvx.exec:\dpvnvx.exe120⤵
-
\??\c:\lrpjpjt.exec:\lrpjpjt.exe121⤵
-
\??\c:\jxxhdf.exec:\jxxhdf.exe122⤵
-
\??\c:\xrrrp.exec:\xrrrp.exe123⤵
-
\??\c:\ftfvfpn.exec:\ftfvfpn.exe124⤵
-
\??\c:\tvtbfn.exec:\tvtbfn.exe125⤵
-
\??\c:\dbnxn.exec:\dbnxn.exe126⤵
-
\??\c:\pnbjpn.exec:\pnbjpn.exe127⤵
-
\??\c:\trfftjl.exec:\trfftjl.exe128⤵
-
\??\c:\bldfl.exec:\bldfl.exe129⤵
-
\??\c:\trrlphh.exec:\trrlphh.exe130⤵
-
\??\c:\nfxpvd.exec:\nfxpvd.exe131⤵
-
\??\c:\ntxlft.exec:\ntxlft.exe132⤵
-
\??\c:\xxbdr.exec:\xxbdr.exe133⤵
-
\??\c:\ttrxpr.exec:\ttrxpr.exe134⤵
-
\??\c:\rdhljfb.exec:\rdhljfb.exe135⤵
-
\??\c:\dlnfnxl.exec:\dlnfnxl.exe136⤵
-
\??\c:\bvxvj.exec:\bvxvj.exe137⤵
-
\??\c:\bxxrxxl.exec:\bxxrxxl.exe138⤵
-
\??\c:\ppxrh.exec:\ppxrh.exe139⤵
-
\??\c:\trfrd.exec:\trfrd.exe140⤵
-
\??\c:\fxnfj.exec:\fxnfj.exe141⤵
-
\??\c:\fldvbt.exec:\fldvbt.exe142⤵
-
\??\c:\xtjxbvb.exec:\xtjxbvb.exe143⤵
-
\??\c:\dbntv.exec:\dbntv.exe144⤵
-
\??\c:\btvbfl.exec:\btvbfl.exe145⤵
-
\??\c:\ffflr.exec:\ffflr.exe146⤵
-
\??\c:\xddlr.exec:\xddlr.exe147⤵
-
\??\c:\tdfrpt.exec:\tdfrpt.exe148⤵
-
\??\c:\fndjt.exec:\fndjt.exe149⤵
-
\??\c:\hfpbllp.exec:\hfpbllp.exe150⤵
-
\??\c:\vrnpdj.exec:\vrnpdj.exe151⤵
-
\??\c:\vjlhfv.exec:\vjlhfv.exe152⤵
-
\??\c:\nxfnd.exec:\nxfnd.exe153⤵
-
\??\c:\rdttnrf.exec:\rdttnrf.exe154⤵
-
\??\c:\jtdbvf.exec:\jtdbvf.exe155⤵
-
\??\c:\ndvtlb.exec:\ndvtlb.exe156⤵
-
\??\c:\bxvpn.exec:\bxvpn.exe157⤵
-
\??\c:\nnnxbl.exec:\nnnxbl.exe158⤵
-
\??\c:\dxvlfl.exec:\dxvlfl.exe159⤵
-
\??\c:\rvjtdf.exec:\rvjtdf.exe160⤵
-
\??\c:\brvjpx.exec:\brvjpx.exe161⤵
-
\??\c:\bhttp.exec:\bhttp.exe162⤵
-
\??\c:\nvthtrh.exec:\nvthtrh.exe163⤵
-
\??\c:\ldndvn.exec:\ldndvn.exe164⤵
-
\??\c:\lvtdvd.exec:\lvtdvd.exe165⤵
-
\??\c:\hdbpjxt.exec:\hdbpjxt.exe166⤵
-
\??\c:\rnldtpr.exec:\rnldtpr.exe167⤵
-
\??\c:\fjjjpb.exec:\fjjjpb.exe168⤵
-
\??\c:\vdbvj.exec:\vdbvj.exe169⤵
-
\??\c:\nhvrtp.exec:\nhvrtp.exe170⤵
-
\??\c:\jbndn.exec:\jbndn.exe171⤵
-
\??\c:\xjtjj.exec:\xjtjj.exe172⤵
-
\??\c:\xrtfrf.exec:\xrtfrf.exe173⤵
-
\??\c:\hnlvf.exec:\hnlvf.exe174⤵
-
\??\c:\fdhpn.exec:\fdhpn.exe175⤵
-
\??\c:\prpjpn.exec:\prpjpn.exe176⤵
-
\??\c:\tnltvp.exec:\tnltvp.exe177⤵
-
\??\c:\fjhjfn.exec:\fjhjfn.exe178⤵
-
\??\c:\lprvlj.exec:\lprvlj.exe179⤵
-
\??\c:\ftrdj.exec:\ftrdj.exe180⤵
-
\??\c:\vllrj.exec:\vllrj.exe181⤵
-
\??\c:\ndhlr.exec:\ndhlr.exe182⤵
-
\??\c:\hjdnxp.exec:\hjdnxp.exe183⤵
-
\??\c:\lbvtfn.exec:\lbvtfn.exe184⤵
-
\??\c:\vppfddt.exec:\vppfddt.exe185⤵
-
\??\c:\fjxxhh.exec:\fjxxhh.exe186⤵
-
\??\c:\dvdxrf.exec:\dvdxrf.exe187⤵
-
\??\c:\dxrhpt.exec:\dxrhpt.exe188⤵
-
\??\c:\rjndp.exec:\rjndp.exe189⤵
-
\??\c:\fjfvnh.exec:\fjfvnh.exe190⤵
-
\??\c:\jrvnf.exec:\jrvnf.exe191⤵
-
\??\c:\dprfdpj.exec:\dprfdpj.exe192⤵
-
\??\c:\drfdtn.exec:\drfdtn.exe193⤵
-
\??\c:\fnnrlf.exec:\fnnrlf.exe194⤵
-
\??\c:\bptptfr.exec:\bptptfr.exe195⤵
-
\??\c:\nbfphpn.exec:\nbfphpn.exe196⤵
-
\??\c:\dnjxj.exec:\dnjxj.exe197⤵
-
\??\c:\tljlb.exec:\tljlb.exe198⤵
-
\??\c:\ppvrd.exec:\ppvrd.exe199⤵
-
\??\c:\vbnnxbj.exec:\vbnnxbj.exe200⤵
-
\??\c:\bndxn.exec:\bndxn.exe201⤵
-
\??\c:\hbtpvhv.exec:\hbtpvhv.exe202⤵
-
\??\c:\rdhjl.exec:\rdhjl.exe203⤵
-
\??\c:\jnbhp.exec:\jnbhp.exe204⤵
-
\??\c:\lppvn.exec:\lppvn.exe205⤵
-
\??\c:\pxlfbt.exec:\pxlfbt.exe206⤵
-
\??\c:\dblbr.exec:\dblbr.exe207⤵
-
\??\c:\bnjjt.exec:\bnjjt.exe208⤵
-
\??\c:\hltxljr.exec:\hltxljr.exe209⤵
-
\??\c:\pbblxxt.exec:\pbblxxt.exe210⤵
-
\??\c:\nfrbh.exec:\nfrbh.exe211⤵
-
\??\c:\phrfnt.exec:\phrfnt.exe212⤵
-
\??\c:\vdhbphl.exec:\vdhbphl.exe213⤵
-
\??\c:\flxfr.exec:\flxfr.exe214⤵
-
\??\c:\llvjtd.exec:\llvjtd.exe215⤵
-
\??\c:\dfhtrtx.exec:\dfhtrtx.exe216⤵
-
\??\c:\jxbnfpl.exec:\jxbnfpl.exe217⤵
-
\??\c:\dhjpx.exec:\dhjpx.exe218⤵
-
\??\c:\jxtll.exec:\jxtll.exe219⤵
-
\??\c:\lbjft.exec:\lbjft.exe220⤵
-
\??\c:\xlndf.exec:\xlndf.exe221⤵
-
\??\c:\vtvldn.exec:\vtvldn.exe222⤵
-
\??\c:\nhvxljf.exec:\nhvxljf.exe223⤵
-
\??\c:\ddvhpb.exec:\ddvhpb.exe224⤵
-
\??\c:\hnfftf.exec:\hnfftf.exe225⤵
-
\??\c:\bdnpvpr.exec:\bdnpvpr.exe226⤵
-
\??\c:\bbtntbt.exec:\bbtntbt.exe227⤵
-
\??\c:\nbbldt.exec:\nbbldt.exe228⤵
-
\??\c:\htdfxjb.exec:\htdfxjb.exe229⤵
-
\??\c:\nhlrjv.exec:\nhlrjv.exe230⤵
-
\??\c:\tnbfb.exec:\tnbfb.exe231⤵
-
\??\c:\hpxdl.exec:\hpxdl.exe232⤵
-
\??\c:\tjdxjjl.exec:\tjdxjjl.exe233⤵
-
\??\c:\lfvxtlj.exec:\lfvxtlj.exe234⤵
-
\??\c:\rtdbvr.exec:\rtdbvr.exe235⤵
-
\??\c:\nxxhntj.exec:\nxxhntj.exe236⤵
-
\??\c:\xbbxr.exec:\xbbxr.exe237⤵
-
\??\c:\lnlftl.exec:\lnlftl.exe238⤵
-
\??\c:\vvptf.exec:\vvptf.exe239⤵
-
\??\c:\htlbd.exec:\htlbd.exe240⤵
-
\??\c:\ptprx.exec:\ptprx.exe241⤵