Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-06-2024 08:15
Behavioral task
behavioral1
Sample
4af8c1d0f2b8f768e83295104e18bd30_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
4af8c1d0f2b8f768e83295104e18bd30_NeikiAnalytics.exe
-
Size
190KB
-
MD5
4af8c1d0f2b8f768e83295104e18bd30
-
SHA1
a68a3c55f49efa66834e67da5b57ca2b08890d24
-
SHA256
19269998dc620b5d4b7e33c3be75464240bbb8f8db4fd652d79e4d3d4f4c9861
-
SHA512
43a5c4afec54e61c7ec42876cff0aed3f26dc5fc5759d3caf40050efa24e0a61fe68eb4cefba1a824f89145b244a2d3fb70c52709d8aff52533c295601a1ec7c
-
SSDEEP
3072:YhOmTsF93UYfwC6GIoutLmxHxae5yLpcgDE4JBuItR8pTsgnKbQFe3+Ly:Ycm4FmowdHoSLEaTBftapTsyFeOu
Malware Config
Signatures
-
Detect Blackmoon payload 48 IoCs
Processes:
resource yara_rule behavioral1/memory/640-7-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2944-18-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2448-28-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2580-37-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2628-48-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2264-57-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2636-68-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2388-80-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2412-76-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2952-95-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1780-105-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2044-114-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/944-131-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/916-141-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1964-149-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1964-148-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/312-159-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1768-165-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/2972-178-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1556-188-0x0000000000430000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2160-207-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1324-215-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1144-225-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/3056-236-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1364-253-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1324-261-0x00000000002D0000-0x0000000000300000-memory.dmp family_blackmoon behavioral1/memory/1844-270-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2852-295-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1528-310-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/2188-317-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1708-332-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2188-345-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/2500-371-0x0000000000430000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2524-378-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2404-398-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1768-475-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1152-526-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1676-600-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/544-696-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/544-725-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/2140-847-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2464-941-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/1976-1032-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/1848-1033-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1276-1052-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/1680-1055-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/3016-1104-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/2008-1210-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 33 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\dxjvnf.exe family_berbew \??\c:\nhppfp.exe family_berbew \??\c:\jpvhdx.exe family_berbew C:\vlrlp.exe family_berbew C:\bxppxh.exe family_berbew C:\rntlf.exe family_berbew C:\dlrtpl.exe family_berbew \??\c:\rrnpfn.exe family_berbew C:\xlxfhvx.exe family_berbew C:\bfnlh.exe family_berbew C:\jxfvbxx.exe family_berbew C:\lfjtp.exe family_berbew C:\xbdbxd.exe family_berbew C:\blftffp.exe family_berbew C:\xnfvb.exe family_berbew C:\fpnhh.exe family_berbew C:\xfvvd.exe family_berbew C:\vtlddn.exe family_berbew C:\bfdvjd.exe family_berbew behavioral1/memory/312-190-0x00000000005C0000-0x00000000005F0000-memory.dmp family_berbew C:\fxjhrp.exe family_berbew C:\vvtjxtr.exe family_berbew C:\ppbpfbn.exe family_berbew C:\ptlnnn.exe family_berbew C:\lnrxl.exe family_berbew C:\bvvdfhj.exe family_berbew C:\lbbphhl.exe family_berbew C:\ftltj.exe family_berbew C:\xtjnb.exe family_berbew C:\xvhxhpl.exe family_berbew C:\tjvvfrj.exe family_berbew C:\vhlrxn.exe family_berbew C:\fnjhdvh.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
dxjvnf.exenhppfp.exejpvhdx.exevlrlp.exebxppxh.exerntlf.exedlrtpl.exerrnpfn.exexlxfhvx.exebfnlh.exejxfvbxx.exelfjtp.exexbdbxd.exeblftffp.exexnfvb.exefpnhh.exexfvvd.exevtlddn.exebfdvjd.exefxjhrp.exevvtjxtr.exeppbpfbn.exeptlnnn.exelnrxl.exebvvdfhj.exelbbphhl.exeftltj.exextjnb.exexvhxhpl.exetjvvfrj.exevhlrxn.exefnjhdvh.exepbrfvvf.exedhdvhf.exeprxbxv.exejxndrdj.exexlfhbb.exefvlvf.exenhnpn.exedrtlpx.exelnrdpt.exepvnbpd.exedtttdp.exehfvnxf.exevhvbnj.exelbrvvh.exervpdph.exethhhd.exehdnfn.exefthvft.exefjntxl.exepddvl.exebfjhb.exexrbff.exefdvrr.exerjbjnj.exejrblnd.exexxbhtb.exeftpnt.exehpbbb.exetvdpdbr.exeljfnf.exeppjjfl.exevlrth.exepid process 2944 dxjvnf.exe 2448 nhppfp.exe 2580 jpvhdx.exe 2628 vlrlp.exe 2264 bxppxh.exe 2636 rntlf.exe 2412 dlrtpl.exe 2388 rrnpfn.exe 2952 xlxfhvx.exe 1780 bfnlh.exe 2044 jxfvbxx.exe 2640 lfjtp.exe 944 xbdbxd.exe 916 blftffp.exe 1964 xnfvb.exe 312 fpnhh.exe 1768 xfvvd.exe 2972 vtlddn.exe 1556 bfdvjd.exe 1096 fxjhrp.exe 2160 vvtjxtr.exe 1324 ppbpfbn.exe 1144 ptlnnn.exe 3056 lnrxl.exe 1392 bvvdfhj.exe 1364 lbbphhl.exe 1852 ftltj.exe 1844 xtjnb.exe 568 xvhxhpl.exe 2708 tjvvfrj.exe 2852 vhlrxn.exe 1732 fnjhdvh.exe 1528 pbrfvvf.exe 2188 dhdvhf.exe 1352 prxbxv.exe 1708 jxndrdj.exe 2504 xlfhbb.exe 2500 fvlvf.exe 2580 nhnpn.exe 2888 drtlpx.exe 2552 lnrdpt.exe 2392 pvnbpd.exe 2524 dtttdp.exe 2468 hfvnxf.exe 2376 vhvbnj.exe 2404 lbrvvh.exe 2792 rvpdph.exe 1980 thhhd.exe 2424 hdnfn.exe 2044 fthvft.exe 2696 fjntxl.exe 2396 pddvl.exe 1824 bfjhb.exe 1836 xrbff.exe 1484 fdvrr.exe 2208 rjbjnj.exe 312 jrblnd.exe 1768 xxbhtb.exe 2252 ftpnt.exe 1776 hpbbb.exe 2260 tvdpdbr.exe 772 ljfnf.exe 712 ppjjfl.exe 600 vlrth.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4af8c1d0f2b8f768e83295104e18bd30_NeikiAnalytics.exedxjvnf.exenhppfp.exejpvhdx.exevlrlp.exebxppxh.exerntlf.exedlrtpl.exerrnpfn.exexlxfhvx.exebfnlh.exejxfvbxx.exelfjtp.exexbdbxd.exeblftffp.exexnfvb.exedescription pid process target process PID 640 wrote to memory of 2944 640 4af8c1d0f2b8f768e83295104e18bd30_NeikiAnalytics.exe dxjvnf.exe PID 640 wrote to memory of 2944 640 4af8c1d0f2b8f768e83295104e18bd30_NeikiAnalytics.exe dxjvnf.exe PID 640 wrote to memory of 2944 640 4af8c1d0f2b8f768e83295104e18bd30_NeikiAnalytics.exe dxjvnf.exe PID 640 wrote to memory of 2944 640 4af8c1d0f2b8f768e83295104e18bd30_NeikiAnalytics.exe dxjvnf.exe PID 2944 wrote to memory of 2448 2944 dxjvnf.exe nhppfp.exe PID 2944 wrote to memory of 2448 2944 dxjvnf.exe nhppfp.exe PID 2944 wrote to memory of 2448 2944 dxjvnf.exe nhppfp.exe PID 2944 wrote to memory of 2448 2944 dxjvnf.exe nhppfp.exe PID 2448 wrote to memory of 2580 2448 nhppfp.exe jpvhdx.exe PID 2448 wrote to memory of 2580 2448 nhppfp.exe jpvhdx.exe PID 2448 wrote to memory of 2580 2448 nhppfp.exe jpvhdx.exe PID 2448 wrote to memory of 2580 2448 nhppfp.exe jpvhdx.exe PID 2580 wrote to memory of 2628 2580 jpvhdx.exe vlrlp.exe PID 2580 wrote to memory of 2628 2580 jpvhdx.exe vlrlp.exe PID 2580 wrote to memory of 2628 2580 jpvhdx.exe vlrlp.exe PID 2580 wrote to memory of 2628 2580 jpvhdx.exe vlrlp.exe PID 2628 wrote to memory of 2264 2628 vlrlp.exe bxppxh.exe PID 2628 wrote to memory of 2264 2628 vlrlp.exe bxppxh.exe PID 2628 wrote to memory of 2264 2628 vlrlp.exe bxppxh.exe PID 2628 wrote to memory of 2264 2628 vlrlp.exe bxppxh.exe PID 2264 wrote to memory of 2636 2264 bxppxh.exe rntlf.exe PID 2264 wrote to memory of 2636 2264 bxppxh.exe rntlf.exe PID 2264 wrote to memory of 2636 2264 bxppxh.exe rntlf.exe PID 2264 wrote to memory of 2636 2264 bxppxh.exe rntlf.exe PID 2636 wrote to memory of 2412 2636 rntlf.exe dlrtpl.exe PID 2636 wrote to memory of 2412 2636 rntlf.exe dlrtpl.exe PID 2636 wrote to memory of 2412 2636 rntlf.exe dlrtpl.exe PID 2636 wrote to memory of 2412 2636 rntlf.exe dlrtpl.exe PID 2412 wrote to memory of 2388 2412 dlrtpl.exe rrnpfn.exe PID 2412 wrote to memory of 2388 2412 dlrtpl.exe rrnpfn.exe PID 2412 wrote to memory of 2388 2412 dlrtpl.exe rrnpfn.exe PID 2412 wrote to memory of 2388 2412 dlrtpl.exe rrnpfn.exe PID 2388 wrote to memory of 2952 2388 rrnpfn.exe xlxfhvx.exe PID 2388 wrote to memory of 2952 2388 rrnpfn.exe xlxfhvx.exe PID 2388 wrote to memory of 2952 2388 rrnpfn.exe xlxfhvx.exe PID 2388 wrote to memory of 2952 2388 rrnpfn.exe xlxfhvx.exe PID 2952 wrote to memory of 1780 2952 xlxfhvx.exe bfnlh.exe PID 2952 wrote to memory of 1780 2952 xlxfhvx.exe bfnlh.exe PID 2952 wrote to memory of 1780 2952 xlxfhvx.exe bfnlh.exe PID 2952 wrote to memory of 1780 2952 xlxfhvx.exe bfnlh.exe PID 1780 wrote to memory of 2044 1780 bfnlh.exe jxfvbxx.exe PID 1780 wrote to memory of 2044 1780 bfnlh.exe jxfvbxx.exe PID 1780 wrote to memory of 2044 1780 bfnlh.exe jxfvbxx.exe PID 1780 wrote to memory of 2044 1780 bfnlh.exe jxfvbxx.exe PID 2044 wrote to memory of 2640 2044 jxfvbxx.exe lfjtp.exe PID 2044 wrote to memory of 2640 2044 jxfvbxx.exe lfjtp.exe PID 2044 wrote to memory of 2640 2044 jxfvbxx.exe lfjtp.exe PID 2044 wrote to memory of 2640 2044 jxfvbxx.exe lfjtp.exe PID 2640 wrote to memory of 944 2640 lfjtp.exe xbdbxd.exe PID 2640 wrote to memory of 944 2640 lfjtp.exe xbdbxd.exe PID 2640 wrote to memory of 944 2640 lfjtp.exe xbdbxd.exe PID 2640 wrote to memory of 944 2640 lfjtp.exe xbdbxd.exe PID 944 wrote to memory of 916 944 xbdbxd.exe blftffp.exe PID 944 wrote to memory of 916 944 xbdbxd.exe blftffp.exe PID 944 wrote to memory of 916 944 xbdbxd.exe blftffp.exe PID 944 wrote to memory of 916 944 xbdbxd.exe blftffp.exe PID 916 wrote to memory of 1964 916 blftffp.exe xnfvb.exe PID 916 wrote to memory of 1964 916 blftffp.exe xnfvb.exe PID 916 wrote to memory of 1964 916 blftffp.exe xnfvb.exe PID 916 wrote to memory of 1964 916 blftffp.exe xnfvb.exe PID 1964 wrote to memory of 312 1964 xnfvb.exe fpnhh.exe PID 1964 wrote to memory of 312 1964 xnfvb.exe fpnhh.exe PID 1964 wrote to memory of 312 1964 xnfvb.exe fpnhh.exe PID 1964 wrote to memory of 312 1964 xnfvb.exe fpnhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4af8c1d0f2b8f768e83295104e18bd30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4af8c1d0f2b8f768e83295104e18bd30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\dxjvnf.exec:\dxjvnf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhppfp.exec:\nhppfp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpvhdx.exec:\jpvhdx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vlrlp.exec:\vlrlp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bxppxh.exec:\bxppxh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rntlf.exec:\rntlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dlrtpl.exec:\dlrtpl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrnpfn.exec:\rrnpfn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlxfhvx.exec:\xlxfhvx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bfnlh.exec:\bfnlh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jxfvbxx.exec:\jxfvbxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfjtp.exec:\lfjtp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xbdbxd.exec:\xbdbxd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\blftffp.exec:\blftffp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xnfvb.exec:\xnfvb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fpnhh.exec:\fpnhh.exe17⤵
- Executes dropped EXE
-
\??\c:\xfvvd.exec:\xfvvd.exe18⤵
- Executes dropped EXE
-
\??\c:\vtlddn.exec:\vtlddn.exe19⤵
- Executes dropped EXE
-
\??\c:\bfdvjd.exec:\bfdvjd.exe20⤵
- Executes dropped EXE
-
\??\c:\fxjhrp.exec:\fxjhrp.exe21⤵
- Executes dropped EXE
-
\??\c:\vvtjxtr.exec:\vvtjxtr.exe22⤵
- Executes dropped EXE
-
\??\c:\ppbpfbn.exec:\ppbpfbn.exe23⤵
- Executes dropped EXE
-
\??\c:\ptlnnn.exec:\ptlnnn.exe24⤵
- Executes dropped EXE
-
\??\c:\lnrxl.exec:\lnrxl.exe25⤵
- Executes dropped EXE
-
\??\c:\bvvdfhj.exec:\bvvdfhj.exe26⤵
- Executes dropped EXE
-
\??\c:\lbbphhl.exec:\lbbphhl.exe27⤵
- Executes dropped EXE
-
\??\c:\ftltj.exec:\ftltj.exe28⤵
- Executes dropped EXE
-
\??\c:\xtjnb.exec:\xtjnb.exe29⤵
- Executes dropped EXE
-
\??\c:\xvhxhpl.exec:\xvhxhpl.exe30⤵
- Executes dropped EXE
-
\??\c:\tjvvfrj.exec:\tjvvfrj.exe31⤵
- Executes dropped EXE
-
\??\c:\vhlrxn.exec:\vhlrxn.exe32⤵
- Executes dropped EXE
-
\??\c:\fnjhdvh.exec:\fnjhdvh.exe33⤵
- Executes dropped EXE
-
\??\c:\pbrfvvf.exec:\pbrfvvf.exe34⤵
- Executes dropped EXE
-
\??\c:\dhdvhf.exec:\dhdvhf.exe35⤵
- Executes dropped EXE
-
\??\c:\prxbxv.exec:\prxbxv.exe36⤵
- Executes dropped EXE
-
\??\c:\jxndrdj.exec:\jxndrdj.exe37⤵
- Executes dropped EXE
-
\??\c:\xlfhbb.exec:\xlfhbb.exe38⤵
- Executes dropped EXE
-
\??\c:\fvlvf.exec:\fvlvf.exe39⤵
- Executes dropped EXE
-
\??\c:\nhnpn.exec:\nhnpn.exe40⤵
- Executes dropped EXE
-
\??\c:\drtlpx.exec:\drtlpx.exe41⤵
- Executes dropped EXE
-
\??\c:\lnrdpt.exec:\lnrdpt.exe42⤵
- Executes dropped EXE
-
\??\c:\pvnbpd.exec:\pvnbpd.exe43⤵
- Executes dropped EXE
-
\??\c:\dtttdp.exec:\dtttdp.exe44⤵
- Executes dropped EXE
-
\??\c:\hfvnxf.exec:\hfvnxf.exe45⤵
- Executes dropped EXE
-
\??\c:\vhvbnj.exec:\vhvbnj.exe46⤵
- Executes dropped EXE
-
\??\c:\lbrvvh.exec:\lbrvvh.exe47⤵
- Executes dropped EXE
-
\??\c:\rvpdph.exec:\rvpdph.exe48⤵
- Executes dropped EXE
-
\??\c:\thhhd.exec:\thhhd.exe49⤵
- Executes dropped EXE
-
\??\c:\hdnfn.exec:\hdnfn.exe50⤵
- Executes dropped EXE
-
\??\c:\fthvft.exec:\fthvft.exe51⤵
- Executes dropped EXE
-
\??\c:\fjntxl.exec:\fjntxl.exe52⤵
- Executes dropped EXE
-
\??\c:\pddvl.exec:\pddvl.exe53⤵
- Executes dropped EXE
-
\??\c:\bfjhb.exec:\bfjhb.exe54⤵
- Executes dropped EXE
-
\??\c:\xrbff.exec:\xrbff.exe55⤵
- Executes dropped EXE
-
\??\c:\fdvrr.exec:\fdvrr.exe56⤵
- Executes dropped EXE
-
\??\c:\rjbjnj.exec:\rjbjnj.exe57⤵
- Executes dropped EXE
-
\??\c:\jrblnd.exec:\jrblnd.exe58⤵
- Executes dropped EXE
-
\??\c:\xxbhtb.exec:\xxbhtb.exe59⤵
- Executes dropped EXE
-
\??\c:\ftpnt.exec:\ftpnt.exe60⤵
- Executes dropped EXE
-
\??\c:\hpbbb.exec:\hpbbb.exe61⤵
- Executes dropped EXE
-
\??\c:\tvdpdbr.exec:\tvdpdbr.exe62⤵
- Executes dropped EXE
-
\??\c:\ljfnf.exec:\ljfnf.exe63⤵
- Executes dropped EXE
-
\??\c:\ppjjfl.exec:\ppjjfl.exe64⤵
- Executes dropped EXE
-
\??\c:\vlrth.exec:\vlrth.exe65⤵
- Executes dropped EXE
-
\??\c:\lrbphl.exec:\lrbphl.exe66⤵
-
\??\c:\fnfptrd.exec:\fnfptrd.exe67⤵
-
\??\c:\vrjdnld.exec:\vrjdnld.exe68⤵
-
\??\c:\tdtvrfl.exec:\tdtvrfl.exe69⤵
-
\??\c:\xrlhn.exec:\xrlhn.exe70⤵
-
\??\c:\dpvxhfh.exec:\dpvxhfh.exe71⤵
-
\??\c:\bbrxlr.exec:\bbrxlr.exe72⤵
-
\??\c:\jfrvd.exec:\jfrvd.exe73⤵
-
\??\c:\tlrljv.exec:\tlrljv.exe74⤵
-
\??\c:\ndrnndl.exec:\ndrnndl.exe75⤵
-
\??\c:\bxtbhdn.exec:\bxtbhdn.exe76⤵
-
\??\c:\pppdbn.exec:\pppdbn.exe77⤵
-
\??\c:\hbbxbdh.exec:\hbbxbdh.exe78⤵
-
\??\c:\jllvv.exec:\jllvv.exe79⤵
-
\??\c:\fbfdt.exec:\fbfdt.exe80⤵
-
\??\c:\ppvhvn.exec:\ppvhvn.exe81⤵
-
\??\c:\bxhxj.exec:\bxhxj.exe82⤵
-
\??\c:\nxthh.exec:\nxthh.exe83⤵
-
\??\c:\fjdddvr.exec:\fjdddvr.exe84⤵
-
\??\c:\nlnfd.exec:\nlnfd.exe85⤵
-
\??\c:\jrdnxf.exec:\jrdnxf.exe86⤵
-
\??\c:\vjpnxbd.exec:\vjpnxbd.exe87⤵
-
\??\c:\tdbbjhh.exec:\tdbbjhh.exe88⤵
-
\??\c:\dbndt.exec:\dbndt.exe89⤵
-
\??\c:\flnhjrn.exec:\flnhjrn.exe90⤵
-
\??\c:\xptrlf.exec:\xptrlf.exe91⤵
-
\??\c:\vnrlvd.exec:\vnrlvd.exe92⤵
-
\??\c:\ppvplv.exec:\ppvplv.exe93⤵
-
\??\c:\xrhjfp.exec:\xrhjfp.exe94⤵
-
\??\c:\jndhfn.exec:\jndhfn.exe95⤵
-
\??\c:\tfplhfb.exec:\tfplhfb.exe96⤵
-
\??\c:\bdxbdrn.exec:\bdxbdrn.exe97⤵
-
\??\c:\htrhjl.exec:\htrhjl.exe98⤵
-
\??\c:\dfnprhl.exec:\dfnprhl.exe99⤵
-
\??\c:\rhvbphp.exec:\rhvbphp.exe100⤵
-
\??\c:\vpphf.exec:\vpphf.exe101⤵
-
\??\c:\bhrrfr.exec:\bhrrfr.exe102⤵
-
\??\c:\jjxvpl.exec:\jjxvpl.exe103⤵
-
\??\c:\nfpfh.exec:\nfpfh.exe104⤵
-
\??\c:\bpbfflf.exec:\bpbfflf.exe105⤵
-
\??\c:\bprhrj.exec:\bprhrj.exe106⤵
-
\??\c:\jvvnbfh.exec:\jvvnbfh.exe107⤵
-
\??\c:\pbfflb.exec:\pbfflb.exe108⤵
-
\??\c:\vlxdrph.exec:\vlxdrph.exe109⤵
-
\??\c:\xrnbxjr.exec:\xrnbxjr.exe110⤵
-
\??\c:\jprbjrn.exec:\jprbjrn.exe111⤵
-
\??\c:\rnxhltl.exec:\rnxhltl.exe112⤵
-
\??\c:\dnnjbf.exec:\dnnjbf.exe113⤵
-
\??\c:\xxfvt.exec:\xxfvt.exe114⤵
-
\??\c:\rrvlxlt.exec:\rrvlxlt.exe115⤵
-
\??\c:\lrvvpt.exec:\lrvvpt.exe116⤵
-
\??\c:\vfpdtf.exec:\vfpdtf.exe117⤵
-
\??\c:\ntvxdr.exec:\ntvxdr.exe118⤵
-
\??\c:\dbbndbp.exec:\dbbndbp.exe119⤵
-
\??\c:\llntbfp.exec:\llntbfp.exe120⤵
-
\??\c:\blnvp.exec:\blnvp.exe121⤵
-
\??\c:\fjhtfhl.exec:\fjhtfhl.exe122⤵
-
\??\c:\jrhlr.exec:\jrhlr.exe123⤵
-
\??\c:\xrldrf.exec:\xrldrf.exe124⤵
-
\??\c:\hndtr.exec:\hndtr.exe125⤵
-
\??\c:\rhfdv.exec:\rhfdv.exe126⤵
-
\??\c:\llvnr.exec:\llvnr.exe127⤵
-
\??\c:\pxltdln.exec:\pxltdln.exe128⤵
-
\??\c:\bfftbxl.exec:\bfftbxl.exe129⤵
-
\??\c:\btpxlp.exec:\btpxlp.exe130⤵
-
\??\c:\vfvlxd.exec:\vfvlxd.exe131⤵
-
\??\c:\bnhrjh.exec:\bnhrjh.exe132⤵
-
\??\c:\pdpjlll.exec:\pdpjlll.exe133⤵
-
\??\c:\jtnbbr.exec:\jtnbbr.exe134⤵
-
\??\c:\fpnnv.exec:\fpnnv.exe135⤵
-
\??\c:\xfhflvp.exec:\xfhflvp.exe136⤵
-
\??\c:\lvbnpl.exec:\lvbnpl.exe137⤵
-
\??\c:\ndvfx.exec:\ndvfx.exe138⤵
-
\??\c:\djrvjfx.exec:\djrvjfx.exe139⤵
-
\??\c:\fnflnvh.exec:\fnflnvh.exe140⤵
-
\??\c:\djfjt.exec:\djfjt.exe141⤵
-
\??\c:\fvntb.exec:\fvntb.exe142⤵
-
\??\c:\hfdjb.exec:\hfdjb.exe143⤵
-
\??\c:\dttbvn.exec:\dttbvn.exe144⤵
-
\??\c:\jntlpdl.exec:\jntlpdl.exe145⤵
-
\??\c:\tvbtlfx.exec:\tvbtlfx.exe146⤵
-
\??\c:\ptvhvln.exec:\ptvhvln.exe147⤵
-
\??\c:\vpfblj.exec:\vpfblj.exe148⤵
-
\??\c:\bbpjb.exec:\bbpjb.exe149⤵
-
\??\c:\fvhfnv.exec:\fvhfnv.exe150⤵
-
\??\c:\ttbnhx.exec:\ttbnhx.exe151⤵
-
\??\c:\rpxnlt.exec:\rpxnlt.exe152⤵
-
\??\c:\xjndnb.exec:\xjndnb.exe153⤵
-
\??\c:\jlbrxbx.exec:\jlbrxbx.exe154⤵
-
\??\c:\ntxjprb.exec:\ntxjprb.exe155⤵
-
\??\c:\xtjdvjv.exec:\xtjdvjv.exe156⤵
-
\??\c:\tltfx.exec:\tltfx.exe157⤵
-
\??\c:\djhdjpn.exec:\djhdjpn.exe158⤵
-
\??\c:\vhjpjp.exec:\vhjpjp.exe159⤵
-
\??\c:\ffdrb.exec:\ffdrb.exe160⤵
-
\??\c:\nrbfx.exec:\nrbfx.exe161⤵
-
\??\c:\xbfdxl.exec:\xbfdxl.exe162⤵
-
\??\c:\nrprf.exec:\nrprf.exe163⤵
-
\??\c:\hnxjfhv.exec:\hnxjfhv.exe164⤵
-
\??\c:\xhvxvt.exec:\xhvxvt.exe165⤵
-
\??\c:\lbxpp.exec:\lbxpp.exe166⤵
-
\??\c:\vhdxd.exec:\vhdxd.exe167⤵
-
\??\c:\nbvbnj.exec:\nbvbnj.exe168⤵
-
\??\c:\hvrxbdv.exec:\hvrxbdv.exe169⤵
-
\??\c:\rdppf.exec:\rdppf.exe170⤵
-
\??\c:\pnffnv.exec:\pnffnv.exe171⤵
-
\??\c:\bdflr.exec:\bdflr.exe172⤵
-
\??\c:\xtxtftx.exec:\xtxtftx.exe173⤵
-
\??\c:\xbbljt.exec:\xbbljt.exe174⤵
-
\??\c:\pbdldv.exec:\pbdldv.exe175⤵
-
\??\c:\lvhphj.exec:\lvhphj.exe176⤵
-
\??\c:\pdvrnh.exec:\pdvrnh.exe177⤵
-
\??\c:\bnfxbf.exec:\bnfxbf.exe178⤵
-
\??\c:\rhntrhx.exec:\rhntrhx.exe179⤵
-
\??\c:\ffjfnfd.exec:\ffjfnfd.exe180⤵
-
\??\c:\bjltp.exec:\bjltp.exe181⤵
-
\??\c:\rfjblvd.exec:\rfjblvd.exe182⤵
-
\??\c:\rxntr.exec:\rxntr.exe183⤵
-
\??\c:\fxtfvvb.exec:\fxtfvvb.exe184⤵
-
\??\c:\hjvrx.exec:\hjvrx.exe185⤵
-
\??\c:\tdvlj.exec:\tdvlj.exe186⤵
-
\??\c:\djfjlhd.exec:\djfjlhd.exe187⤵
-
\??\c:\bjbvdh.exec:\bjbvdh.exe188⤵
-
\??\c:\rvvjvf.exec:\rvvjvf.exe189⤵
-
\??\c:\hxdpdvh.exec:\hxdpdvh.exe190⤵
-
\??\c:\jbthtt.exec:\jbthtt.exe191⤵
-
\??\c:\jdxtxv.exec:\jdxtxv.exe192⤵
-
\??\c:\pnjpvpp.exec:\pnjpvpp.exe193⤵
-
\??\c:\vdnfjnb.exec:\vdnfjnb.exe194⤵
-
\??\c:\pnvlx.exec:\pnvlx.exe195⤵
-
\??\c:\ftxhh.exec:\ftxhh.exe196⤵
-
\??\c:\lvdvxl.exec:\lvdvxl.exe197⤵
-
\??\c:\vxfxp.exec:\vxfxp.exe198⤵
-
\??\c:\xxptht.exec:\xxptht.exe199⤵
-
\??\c:\rfjptnh.exec:\rfjptnh.exe200⤵
-
\??\c:\xrdnp.exec:\xrdnp.exe201⤵
-
\??\c:\hhffjl.exec:\hhffjl.exe202⤵
-
\??\c:\drbvjx.exec:\drbvjx.exe203⤵
-
\??\c:\flxfvr.exec:\flxfvr.exe204⤵
-
\??\c:\hjvdtvf.exec:\hjvdtvf.exe205⤵
-
\??\c:\xrvtp.exec:\xrvtp.exe206⤵
-
\??\c:\flntnh.exec:\flntnh.exe207⤵
-
\??\c:\hdrlj.exec:\hdrlj.exe208⤵
-
\??\c:\jnrjd.exec:\jnrjd.exe209⤵
-
\??\c:\rtdjpf.exec:\rtdjpf.exe210⤵
-
\??\c:\fjrxf.exec:\fjrxf.exe211⤵
-
\??\c:\bdbdh.exec:\bdbdh.exe212⤵
-
\??\c:\tvntjfh.exec:\tvntjfh.exe213⤵
-
\??\c:\ldflv.exec:\ldflv.exe214⤵
-
\??\c:\ltvnvn.exec:\ltvnvn.exe215⤵
-
\??\c:\tnvrl.exec:\tnvrl.exe216⤵
-
\??\c:\plvtbb.exec:\plvtbb.exe217⤵
-
\??\c:\rxrhvr.exec:\rxrhvr.exe218⤵
-
\??\c:\xlffj.exec:\xlffj.exe219⤵
-
\??\c:\ntfxdhd.exec:\ntfxdhd.exe220⤵
-
\??\c:\vvhjdp.exec:\vvhjdp.exe221⤵
-
\??\c:\jlfbd.exec:\jlfbd.exe222⤵
-
\??\c:\vrnlhnb.exec:\vrnlhnb.exe223⤵
-
\??\c:\lhhxlt.exec:\lhhxlt.exe224⤵
-
\??\c:\hbxnddh.exec:\hbxnddh.exe225⤵
-
\??\c:\vfrnp.exec:\vfrnp.exe226⤵
-
\??\c:\txxjrrr.exec:\txxjrrr.exe227⤵
-
\??\c:\fhndxx.exec:\fhndxx.exe228⤵
-
\??\c:\dpdhnj.exec:\dpdhnj.exe229⤵
-
\??\c:\rbjnpx.exec:\rbjnpx.exe230⤵
-
\??\c:\vdfbj.exec:\vdfbj.exe231⤵
-
\??\c:\vpnhfl.exec:\vpnhfl.exe232⤵
-
\??\c:\bpnbljp.exec:\bpnbljp.exe233⤵
-
\??\c:\jvjfnv.exec:\jvjfnv.exe234⤵
-
\??\c:\lrjlv.exec:\lrjlv.exe235⤵
-
\??\c:\flnph.exec:\flnph.exe236⤵
-
\??\c:\xlpnt.exec:\xlpnt.exe237⤵
-
\??\c:\rftvbh.exec:\rftvbh.exe238⤵
-
\??\c:\hxvprp.exec:\hxvprp.exe239⤵
-
\??\c:\xbvvl.exec:\xbvvl.exe240⤵
-
\??\c:\dvrptd.exec:\dvrptd.exe241⤵