Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 11:55
Behavioral task
behavioral1
Sample
44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe
Resource
win7-20240215-en
General
-
Target
44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe
-
Size
352KB
-
MD5
1382b1da38a9b96dbf4de51472b03f50
-
SHA1
840c3e04324f408acc54ef5ebea0c4ab3ebd161d
-
SHA256
44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6
-
SHA512
854d6a0e41723980dfd0255a5a5b1a6bd555c50fe7471651d00181f8bdbff656721eae772693398428999fb29a78c89b30e672d84612a9769d2f48af5e565b09
-
SSDEEP
6144:bcm4FmowdHoSgWrXD486jCpoAhlq1mEjBqLyOSlhNFF23e:h4wFHoSgWj168w1VjsyvhNFF2u
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
Processes:
resource yara_rule behavioral1/memory/2952-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1340-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/500-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1544-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1300-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/112-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2348-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1340-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-376-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1060-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1040-565-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1864-566-0x0000000077780000-0x000000007789F000-memory.dmp family_blackmoon behavioral1/memory/1724-575-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2684-682-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-688-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-734-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1572-769-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/328-828-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 34 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\rfrxffr.exe family_berbew \??\c:\lfxfxfr.exe family_berbew C:\tnbhnb.exe family_berbew C:\rflffrx.exe family_berbew C:\nhtbnt.exe family_berbew C:\9jpvj.exe family_berbew C:\hbttbh.exe family_berbew C:\tthbhb.exe family_berbew C:\pdpvd.exe family_berbew C:\frflffr.exe family_berbew C:\bnthbh.exe family_berbew C:\jjdvv.exe family_berbew C:\9hbhhh.exe family_berbew C:\nbhtbt.exe family_berbew C:\xrrxfrr.exe family_berbew C:\nnhtnb.exe family_berbew C:\5jjjj.exe family_berbew C:\rrlffrf.exe family_berbew C:\xlxxrrx.exe family_berbew C:\ddpdj.exe family_berbew C:\rrxfrfx.exe family_berbew C:\9btbbb.exe family_berbew C:\vvpvd.exe family_berbew C:\3jpdv.exe family_berbew C:\hbhhtt.exe family_berbew C:\vvjjj.exe family_berbew C:\bbbbtn.exe family_berbew C:\dvdpp.exe family_berbew C:\lfrxrlr.exe family_berbew C:\ffrxrrf.exe family_berbew C:\5vpvd.exe family_berbew C:\lllrxxl.exe family_berbew behavioral1/memory/1864-23672-0x0000000077680000-0x000000007777A000-memory.dmp family_berbew behavioral1/memory/1864-26299-0x0000000077680000-0x000000007777A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
rfrxffr.exelfxfxfr.exetnbhnb.exerflffrx.exenhtbnt.exe9jpvj.exehbttbh.exetthbhb.exepdpvd.exefrflffr.exebnthbh.exejjdvv.exe9hbhhh.exenbhtbt.exexrrxfrr.exennhtnb.exe5jjjj.exerrlffrf.exexlxxrrx.exeddpdj.exerrxfrfx.exe9btbbb.exevvpvd.exe3jpdv.exehbhhtt.exevvjjj.exebbbbtn.exedvdpp.exelfrxrlr.exeffrxrrf.exe5vpvd.exelllrxxl.exe5bnhtt.exedpvdp.exe7dpdj.exellflxxl.exehtbttt.exeddppd.exevpjvd.exellllrrl.exebbhnbh.exe9hhtbh.exevpvvd.exerxxlxrf.exe5bnttb.exedjjpj.exe1jpvd.exerrrlxlx.exehnnhbh.exedpdjd.exefxrlxrf.exebnbhhh.exe1btnbh.exejvpvd.exe7rfllxx.exeththbn.exepdvpp.exejdjpp.exe1lrfrfr.exe7hbhnt.exetnbnbh.exejdvvv.exerlfrxxf.exeffxfxfr.exepid process 2972 rfrxffr.exe 2900 lfxfxfr.exe 1340 tnbhnb.exe 2636 rflffrx.exe 2568 nhtbnt.exe 2756 9jpvj.exe 2668 hbttbh.exe 2552 tthbhb.exe 2448 pdpvd.exe 2560 frflffr.exe 1312 bnthbh.exe 2876 jjdvv.exe 2476 9hbhhh.exe 2328 nbhtbt.exe 2496 xrrxfrr.exe 2692 nnhtnb.exe 2772 5jjjj.exe 500 rrlffrf.exe 2880 xlxxrrx.exe 1544 ddpdj.exe 1548 rrxfrfx.exe 1744 9btbbb.exe 2420 vvpvd.exe 2288 3jpdv.exe 1300 hbhhtt.exe 112 vvjjj.exe 1100 bbbbtn.exe 1420 dvdpp.exe 1652 lfrxrlr.exe 1656 ffrxrrf.exe 2372 5vpvd.exe 2916 lllrxxl.exe 2344 5bnhtt.exe 2348 dpvdp.exe 768 7dpdj.exe 2276 llflxxl.exe 2400 htbttt.exe 2976 ddppd.exe 2968 vpjvd.exe 2972 llllrrl.exe 1924 bbhnbh.exe 2024 9hhtbh.exe 1736 vpvvd.exe 1340 rxxlxrf.exe 2564 5bnttb.exe 2748 djjpj.exe 2728 1jpvd.exe 3032 rrrlxlx.exe 2492 hnnhbh.exe 2456 dpdjd.exe 2448 fxrlxrf.exe 2508 bnbhhh.exe 2560 1btnbh.exe 1312 jvpvd.exe 2104 7rfllxx.exe 2876 ththbn.exe 2476 pdvpp.exe 2768 jdjpp.exe 1636 1lrfrfr.exe 1464 7hbhnt.exe 2680 tnbnbh.exe 2536 jdvvv.exe 1520 rlfrxxf.exe 1468 ffxfxfr.exe -
Processes:
resource yara_rule behavioral1/memory/2952-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfrxffr.exe upx behavioral1/memory/2952-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2972-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-18-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfxfxfr.exe upx C:\tnbhnb.exe upx behavioral1/memory/2900-23-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/memory/1340-32-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rflffrx.exe upx C:\nhtbnt.exe upx behavioral1/memory/2636-41-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9jpvj.exe upx behavioral1/memory/2568-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-58-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbttbh.exe upx C:\tthbhb.exe upx C:\pdpvd.exe upx behavioral1/memory/2552-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2448-81-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frflffr.exe upx C:\bnthbh.exe upx behavioral1/memory/1312-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1312-100-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjdvv.exe upx C:\9hbhhh.exe upx behavioral1/memory/2876-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2476-118-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbhtbt.exe upx behavioral1/memory/2328-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrrxfrr.exe upx C:\nnhtnb.exe upx C:\5jjjj.exe upx C:\rrlffrf.exe upx behavioral1/memory/500-149-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlxxrrx.exe upx C:\ddpdj.exe upx behavioral1/memory/1544-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1544-171-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrxfrfx.exe upx C:\9btbbb.exe upx behavioral1/memory/1744-180-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvpvd.exe upx C:\3jpdv.exe upx behavioral1/memory/2288-202-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhhtt.exe upx behavioral1/memory/1300-205-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvjjj.exe upx C:\bbbbtn.exe upx behavioral1/memory/112-218-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvdpp.exe upx behavioral1/memory/1420-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1100-227-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfrxrlr.exe upx C:\ffrxrrf.exe upx C:\5vpvd.exe upx C:\lllrxxl.exe upx behavioral1/memory/2916-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2344-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2348-270-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/768-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2400-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1340-323-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exerfrxffr.exelfxfxfr.exetnbhnb.exerflffrx.exenhtbnt.exe9jpvj.exehbttbh.exetthbhb.exepdpvd.exefrflffr.exebnthbh.exejjdvv.exe9hbhhh.exenbhtbt.exexrrxfrr.exedescription pid process target process PID 2952 wrote to memory of 2972 2952 44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe rfrxffr.exe PID 2952 wrote to memory of 2972 2952 44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe rfrxffr.exe PID 2952 wrote to memory of 2972 2952 44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe rfrxffr.exe PID 2952 wrote to memory of 2972 2952 44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe rfrxffr.exe PID 2972 wrote to memory of 2900 2972 rfrxffr.exe lfxfxfr.exe PID 2972 wrote to memory of 2900 2972 rfrxffr.exe lfxfxfr.exe PID 2972 wrote to memory of 2900 2972 rfrxffr.exe lfxfxfr.exe PID 2972 wrote to memory of 2900 2972 rfrxffr.exe lfxfxfr.exe PID 2900 wrote to memory of 1340 2900 lfxfxfr.exe tnbhnb.exe PID 2900 wrote to memory of 1340 2900 lfxfxfr.exe tnbhnb.exe PID 2900 wrote to memory of 1340 2900 lfxfxfr.exe tnbhnb.exe PID 2900 wrote to memory of 1340 2900 lfxfxfr.exe tnbhnb.exe PID 1340 wrote to memory of 2636 1340 tnbhnb.exe rflffrx.exe PID 1340 wrote to memory of 2636 1340 tnbhnb.exe rflffrx.exe PID 1340 wrote to memory of 2636 1340 tnbhnb.exe rflffrx.exe PID 1340 wrote to memory of 2636 1340 tnbhnb.exe rflffrx.exe PID 2636 wrote to memory of 2568 2636 rflffrx.exe nhtbnt.exe PID 2636 wrote to memory of 2568 2636 rflffrx.exe nhtbnt.exe PID 2636 wrote to memory of 2568 2636 rflffrx.exe nhtbnt.exe PID 2636 wrote to memory of 2568 2636 rflffrx.exe nhtbnt.exe PID 2568 wrote to memory of 2756 2568 nhtbnt.exe 9jpvj.exe PID 2568 wrote to memory of 2756 2568 nhtbnt.exe 9jpvj.exe PID 2568 wrote to memory of 2756 2568 nhtbnt.exe 9jpvj.exe PID 2568 wrote to memory of 2756 2568 nhtbnt.exe 9jpvj.exe PID 2756 wrote to memory of 2668 2756 9jpvj.exe hbttbh.exe PID 2756 wrote to memory of 2668 2756 9jpvj.exe hbttbh.exe PID 2756 wrote to memory of 2668 2756 9jpvj.exe hbttbh.exe PID 2756 wrote to memory of 2668 2756 9jpvj.exe hbttbh.exe PID 2668 wrote to memory of 2552 2668 hbttbh.exe tthbhb.exe PID 2668 wrote to memory of 2552 2668 hbttbh.exe tthbhb.exe PID 2668 wrote to memory of 2552 2668 hbttbh.exe tthbhb.exe PID 2668 wrote to memory of 2552 2668 hbttbh.exe tthbhb.exe PID 2552 wrote to memory of 2448 2552 tthbhb.exe pdpvd.exe PID 2552 wrote to memory of 2448 2552 tthbhb.exe pdpvd.exe PID 2552 wrote to memory of 2448 2552 tthbhb.exe pdpvd.exe PID 2552 wrote to memory of 2448 2552 tthbhb.exe pdpvd.exe PID 2448 wrote to memory of 2560 2448 pdpvd.exe frflffr.exe PID 2448 wrote to memory of 2560 2448 pdpvd.exe frflffr.exe PID 2448 wrote to memory of 2560 2448 pdpvd.exe frflffr.exe PID 2448 wrote to memory of 2560 2448 pdpvd.exe frflffr.exe PID 2560 wrote to memory of 1312 2560 frflffr.exe bnthbh.exe PID 2560 wrote to memory of 1312 2560 frflffr.exe bnthbh.exe PID 2560 wrote to memory of 1312 2560 frflffr.exe bnthbh.exe PID 2560 wrote to memory of 1312 2560 frflffr.exe bnthbh.exe PID 1312 wrote to memory of 2876 1312 bnthbh.exe jjdvv.exe PID 1312 wrote to memory of 2876 1312 bnthbh.exe jjdvv.exe PID 1312 wrote to memory of 2876 1312 bnthbh.exe jjdvv.exe PID 1312 wrote to memory of 2876 1312 bnthbh.exe jjdvv.exe PID 2876 wrote to memory of 2476 2876 jjdvv.exe 9hbhhh.exe PID 2876 wrote to memory of 2476 2876 jjdvv.exe 9hbhhh.exe PID 2876 wrote to memory of 2476 2876 jjdvv.exe 9hbhhh.exe PID 2876 wrote to memory of 2476 2876 jjdvv.exe 9hbhhh.exe PID 2476 wrote to memory of 2328 2476 9hbhhh.exe nbhtbt.exe PID 2476 wrote to memory of 2328 2476 9hbhhh.exe nbhtbt.exe PID 2476 wrote to memory of 2328 2476 9hbhhh.exe nbhtbt.exe PID 2476 wrote to memory of 2328 2476 9hbhhh.exe nbhtbt.exe PID 2328 wrote to memory of 2496 2328 nbhtbt.exe xrrxfrr.exe PID 2328 wrote to memory of 2496 2328 nbhtbt.exe xrrxfrr.exe PID 2328 wrote to memory of 2496 2328 nbhtbt.exe xrrxfrr.exe PID 2328 wrote to memory of 2496 2328 nbhtbt.exe xrrxfrr.exe PID 2496 wrote to memory of 2692 2496 xrrxfrr.exe nnhtnb.exe PID 2496 wrote to memory of 2692 2496 xrrxfrr.exe nnhtnb.exe PID 2496 wrote to memory of 2692 2496 xrrxfrr.exe nnhtnb.exe PID 2496 wrote to memory of 2692 2496 xrrxfrr.exe nnhtnb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\rfrxffr.exec:\rfrxffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxfxfr.exec:\lfxfxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbhnb.exec:\tnbhnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rflffrx.exec:\rflffrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhtbnt.exec:\nhtbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9jpvj.exec:\9jpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbttbh.exec:\hbttbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tthbhb.exec:\tthbhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdpvd.exec:\pdpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frflffr.exec:\frflffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnthbh.exec:\bnthbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjdvv.exec:\jjdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9hbhhh.exec:\9hbhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbhtbt.exec:\nbhtbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrrxfrr.exec:\xrrxfrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhtnb.exec:\nnhtnb.exe17⤵
- Executes dropped EXE
-
\??\c:\5jjjj.exec:\5jjjj.exe18⤵
- Executes dropped EXE
-
\??\c:\rrlffrf.exec:\rrlffrf.exe19⤵
- Executes dropped EXE
-
\??\c:\xlxxrrx.exec:\xlxxrrx.exe20⤵
- Executes dropped EXE
-
\??\c:\ddpdj.exec:\ddpdj.exe21⤵
- Executes dropped EXE
-
\??\c:\rrxfrfx.exec:\rrxfrfx.exe22⤵
- Executes dropped EXE
-
\??\c:\9btbbb.exec:\9btbbb.exe23⤵
- Executes dropped EXE
-
\??\c:\vvpvd.exec:\vvpvd.exe24⤵
- Executes dropped EXE
-
\??\c:\3jpdv.exec:\3jpdv.exe25⤵
- Executes dropped EXE
-
\??\c:\hbhhtt.exec:\hbhhtt.exe26⤵
- Executes dropped EXE
-
\??\c:\vvjjj.exec:\vvjjj.exe27⤵
- Executes dropped EXE
-
\??\c:\bbbbtn.exec:\bbbbtn.exe28⤵
- Executes dropped EXE
-
\??\c:\dvdpp.exec:\dvdpp.exe29⤵
- Executes dropped EXE
-
\??\c:\lfrxrlr.exec:\lfrxrlr.exe30⤵
- Executes dropped EXE
-
\??\c:\ffrxrrf.exec:\ffrxrrf.exe31⤵
- Executes dropped EXE
-
\??\c:\5vpvd.exec:\5vpvd.exe32⤵
- Executes dropped EXE
-
\??\c:\lllrxxl.exec:\lllrxxl.exe33⤵
- Executes dropped EXE
-
\??\c:\5bnhtt.exec:\5bnhtt.exe34⤵
- Executes dropped EXE
-
\??\c:\dpvdp.exec:\dpvdp.exe35⤵
- Executes dropped EXE
-
\??\c:\7dpdj.exec:\7dpdj.exe36⤵
- Executes dropped EXE
-
\??\c:\llflxxl.exec:\llflxxl.exe37⤵
- Executes dropped EXE
-
\??\c:\htbttt.exec:\htbttt.exe38⤵
- Executes dropped EXE
-
\??\c:\ddppd.exec:\ddppd.exe39⤵
- Executes dropped EXE
-
\??\c:\vpjvd.exec:\vpjvd.exe40⤵
- Executes dropped EXE
-
\??\c:\llllrrl.exec:\llllrrl.exe41⤵
- Executes dropped EXE
-
\??\c:\bbhnbh.exec:\bbhnbh.exe42⤵
- Executes dropped EXE
-
\??\c:\9hhtbh.exec:\9hhtbh.exe43⤵
- Executes dropped EXE
-
\??\c:\vpvvd.exec:\vpvvd.exe44⤵
- Executes dropped EXE
-
\??\c:\rxxlxrf.exec:\rxxlxrf.exe45⤵
- Executes dropped EXE
-
\??\c:\5bnttb.exec:\5bnttb.exe46⤵
- Executes dropped EXE
-
\??\c:\djjpj.exec:\djjpj.exe47⤵
- Executes dropped EXE
-
\??\c:\1jpvd.exec:\1jpvd.exe48⤵
- Executes dropped EXE
-
\??\c:\rrrlxlx.exec:\rrrlxlx.exe49⤵
- Executes dropped EXE
-
\??\c:\hnnhbh.exec:\hnnhbh.exe50⤵
- Executes dropped EXE
-
\??\c:\dpdjd.exec:\dpdjd.exe51⤵
- Executes dropped EXE
-
\??\c:\fxrlxrf.exec:\fxrlxrf.exe52⤵
- Executes dropped EXE
-
\??\c:\bnbhhh.exec:\bnbhhh.exe53⤵
- Executes dropped EXE
-
\??\c:\1btnbh.exec:\1btnbh.exe54⤵
- Executes dropped EXE
-
\??\c:\jvpvd.exec:\jvpvd.exe55⤵
- Executes dropped EXE
-
\??\c:\7rfllxx.exec:\7rfllxx.exe56⤵
- Executes dropped EXE
-
\??\c:\ththbn.exec:\ththbn.exe57⤵
- Executes dropped EXE
-
\??\c:\pdvpp.exec:\pdvpp.exe58⤵
- Executes dropped EXE
-
\??\c:\jdjpp.exec:\jdjpp.exe59⤵
- Executes dropped EXE
-
\??\c:\1lrfrfr.exec:\1lrfrfr.exe60⤵
- Executes dropped EXE
-
\??\c:\7hbhnt.exec:\7hbhnt.exe61⤵
- Executes dropped EXE
-
\??\c:\tnbnbh.exec:\tnbnbh.exe62⤵
- Executes dropped EXE
-
\??\c:\jdvvv.exec:\jdvvv.exe63⤵
- Executes dropped EXE
-
\??\c:\rlfrxxf.exec:\rlfrxxf.exe64⤵
- Executes dropped EXE
-
\??\c:\ffxfxfr.exec:\ffxfxfr.exe65⤵
- Executes dropped EXE
-
\??\c:\bbnhtt.exec:\bbnhtt.exe66⤵
-
\??\c:\5pdjd.exec:\5pdjd.exe67⤵
-
\??\c:\rlrxlfl.exec:\rlrxlfl.exe68⤵
-
\??\c:\rrllrfr.exec:\rrllrfr.exe69⤵
-
\??\c:\bnbbhh.exec:\bnbbhh.exe70⤵
-
\??\c:\dvvdj.exec:\dvvdj.exe71⤵
-
\??\c:\pjvpv.exec:\pjvpv.exe72⤵
-
\??\c:\rrflxff.exec:\rrflxff.exe73⤵
-
\??\c:\3tnnnh.exec:\3tnnnh.exe74⤵
-
\??\c:\djdvj.exec:\djdvj.exe75⤵
-
\??\c:\vpjjp.exec:\vpjjp.exe76⤵
-
\??\c:\rfrrrrf.exec:\rfrrrrf.exe77⤵
-
\??\c:\7thhhb.exec:\7thhhb.exe78⤵
-
\??\c:\nhbhnh.exec:\nhbhnh.exe79⤵
-
\??\c:\ppjdp.exec:\ppjdp.exe80⤵
-
\??\c:\jvvdv.exec:\jvvdv.exe81⤵
-
\??\c:\rrfxxrf.exec:\rrfxxrf.exe82⤵
-
\??\c:\nbbntt.exec:\nbbntt.exe83⤵
-
\??\c:\jdpjv.exec:\jdpjv.exe84⤵
-
\??\c:\jjddj.exec:\jjddj.exe85⤵
-
\??\c:\rlfflll.exec:\rlfflll.exe86⤵
-
\??\c:\9ntnbb.exec:\9ntnbb.exe87⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe88⤵
-
\??\c:\7ppjd.exec:\7ppjd.exe89⤵
-
\??\c:\tthntb.exec:\tthntb.exe90⤵
-
\??\c:\vvpvp.exec:\vvpvp.exe91⤵
-
\??\c:\3vpjp.exec:\3vpjp.exe92⤵
-
\??\c:\lxrfrxl.exec:\lxrfrxl.exe93⤵
-
\??\c:\ttnnbt.exec:\ttnnbt.exe94⤵
-
\??\c:\3thhhn.exec:\3thhhn.exe95⤵
-
\??\c:\pjdvd.exec:\pjdvd.exe96⤵
-
\??\c:\lxllrrx.exec:\lxllrrx.exe97⤵
-
\??\c:\xrxfrrf.exec:\xrxfrrf.exe98⤵
-
\??\c:\bnthhh.exec:\bnthhh.exe99⤵
-
\??\c:\jdpvd.exec:\jdpvd.exe100⤵
-
\??\c:\pdjjp.exec:\pdjjp.exe101⤵
-
\??\c:\7lfxlrr.exec:\7lfxlrr.exe102⤵
-
\??\c:\lfffllr.exec:\lfffllr.exe103⤵
-
\??\c:\tbbtbt.exec:\tbbtbt.exe104⤵
-
\??\c:\5dvdp.exec:\5dvdp.exe105⤵
-
\??\c:\jdpdj.exec:\jdpdj.exe106⤵
-
\??\c:\9fllfff.exec:\9fllfff.exe107⤵
-
\??\c:\3thnnn.exec:\3thnnn.exe108⤵
-
\??\c:\nhbhhb.exec:\nhbhhb.exe109⤵
-
\??\c:\jvjpd.exec:\jvjpd.exe110⤵
-
\??\c:\pjpvv.exec:\pjpvv.exe111⤵
-
\??\c:\1fxfxxf.exec:\1fxfxxf.exe112⤵
-
\??\c:\1htbnt.exec:\1htbnt.exe113⤵
-
\??\c:\nhbhhn.exec:\nhbhhn.exe114⤵
-
\??\c:\ppjpd.exec:\ppjpd.exe115⤵
-
\??\c:\3xlrrxf.exec:\3xlrrxf.exe116⤵
-
\??\c:\nbbbhn.exec:\nbbbhn.exe117⤵
-
\??\c:\hbnntb.exec:\hbnntb.exe118⤵
-
\??\c:\dvjdd.exec:\dvjdd.exe119⤵
-
\??\c:\xrrrffx.exec:\xrrrffx.exe120⤵
-
\??\c:\xlfrxff.exec:\xlfrxff.exe121⤵
-
\??\c:\hbnnth.exec:\hbnnth.exe122⤵
-
\??\c:\5jdjv.exec:\5jdjv.exe123⤵
-
\??\c:\ddvdp.exec:\ddvdp.exe124⤵
-
\??\c:\xrfflrf.exec:\xrfflrf.exe125⤵
-
\??\c:\1nbnht.exec:\1nbnht.exe126⤵
-
\??\c:\dddjv.exec:\dddjv.exe127⤵
-
\??\c:\1dvvd.exec:\1dvvd.exe128⤵
-
\??\c:\xfrllxf.exec:\xfrllxf.exe129⤵
-
\??\c:\nbnbnt.exec:\nbnbnt.exe130⤵
-
\??\c:\btntnt.exec:\btntnt.exe131⤵
-
\??\c:\vpddj.exec:\vpddj.exe132⤵
-
\??\c:\rfrxrfl.exec:\rfrxrfl.exe133⤵
-
\??\c:\frflxfr.exec:\frflxfr.exe134⤵
-
\??\c:\hthnnb.exec:\hthnnb.exe135⤵
-
\??\c:\lfrfxxx.exec:\lfrfxxx.exe136⤵
-
\??\c:\vpdjd.exec:\vpdjd.exe137⤵
-
\??\c:\frflxfl.exec:\frflxfl.exe138⤵
-
\??\c:\tthnbb.exec:\tthnbb.exe139⤵
-
\??\c:\dvjvd.exec:\dvjvd.exe140⤵
-
\??\c:\5ddvd.exec:\5ddvd.exe141⤵
-
\??\c:\3rfrrxx.exec:\3rfrrxx.exe142⤵
-
\??\c:\bhthbt.exec:\bhthbt.exe143⤵
-
\??\c:\5jdvv.exec:\5jdvv.exe144⤵
-
\??\c:\9jvvd.exec:\9jvvd.exe145⤵
-
\??\c:\7rlrrfl.exec:\7rlrrfl.exe146⤵
-
\??\c:\xfffrxr.exec:\xfffrxr.exe147⤵
-
\??\c:\nhnntt.exec:\nhnntt.exe148⤵
-
\??\c:\dvdpv.exec:\dvdpv.exe149⤵
-
\??\c:\vjvvd.exec:\vjvvd.exe150⤵
-
\??\c:\fxrrllf.exec:\fxrrllf.exe151⤵
-
\??\c:\frfrllx.exec:\frfrllx.exe152⤵
-
\??\c:\hbtbhh.exec:\hbtbhh.exe153⤵
-
\??\c:\vppdv.exec:\vppdv.exe154⤵
-
\??\c:\5vppp.exec:\5vppp.exe155⤵
-
\??\c:\xrxrfrf.exec:\xrxrfrf.exe156⤵
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe157⤵
-
\??\c:\hhhtnb.exec:\hhhtnb.exe158⤵
-
\??\c:\5vjvd.exec:\5vjvd.exe159⤵
-
\??\c:\dvjpd.exec:\dvjpd.exe160⤵
-
\??\c:\7lfffxf.exec:\7lfffxf.exe161⤵
-
\??\c:\rrlxfrf.exec:\rrlxfrf.exe162⤵
-
\??\c:\bttbnh.exec:\bttbnh.exe163⤵
-
\??\c:\jdjpp.exec:\jdjpp.exe164⤵
-
\??\c:\pjjvj.exec:\pjjvj.exe165⤵
-
\??\c:\fxrxxxf.exec:\fxrxxxf.exe166⤵
-
\??\c:\3flffll.exec:\3flffll.exe167⤵
-
\??\c:\tnhbbt.exec:\tnhbbt.exe168⤵
-
\??\c:\ppjdp.exec:\ppjdp.exe169⤵
-
\??\c:\7vvpv.exec:\7vvpv.exe170⤵
-
\??\c:\7rflflx.exec:\7rflflx.exe171⤵
-
\??\c:\3bbbbn.exec:\3bbbbn.exe172⤵
-
\??\c:\nhtthh.exec:\nhtthh.exe173⤵
-
\??\c:\pppjp.exec:\pppjp.exe174⤵
-
\??\c:\3fxfrll.exec:\3fxfrll.exe175⤵
-
\??\c:\rflflrf.exec:\rflflrf.exe176⤵
-
\??\c:\bntntn.exec:\bntntn.exe177⤵
-
\??\c:\ddjpd.exec:\ddjpd.exe178⤵
-
\??\c:\dpvvj.exec:\dpvvj.exe179⤵
-
\??\c:\lxlxxxx.exec:\lxlxxxx.exe180⤵
-
\??\c:\thnthh.exec:\thnthh.exe181⤵
-
\??\c:\thtntt.exec:\thtntt.exe182⤵
-
\??\c:\5vvpp.exec:\5vvpp.exe183⤵
-
\??\c:\1ppvp.exec:\1ppvp.exe184⤵
-
\??\c:\llfxxlr.exec:\llfxxlr.exe185⤵
-
\??\c:\5thbhn.exec:\5thbhn.exe186⤵
-
\??\c:\bhttnn.exec:\bhttnn.exe187⤵
-
\??\c:\3jvdd.exec:\3jvdd.exe188⤵
-
\??\c:\lfxxllr.exec:\lfxxllr.exe189⤵
-
\??\c:\rrffxrf.exec:\rrffxrf.exe190⤵
-
\??\c:\nthnbh.exec:\nthnbh.exe191⤵
-
\??\c:\1hbhhn.exec:\1hbhhn.exe192⤵
-
\??\c:\dvpvp.exec:\dvpvp.exe193⤵
-
\??\c:\dvppv.exec:\dvppv.exe194⤵
-
\??\c:\xxlrflx.exec:\xxlrflx.exe195⤵
-
\??\c:\7hbbhh.exec:\7hbbhh.exe196⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe197⤵
-
\??\c:\jvpjp.exec:\jvpjp.exe198⤵
-
\??\c:\3rxxffr.exec:\3rxxffr.exe199⤵
-
\??\c:\5xfxxxx.exec:\5xfxxxx.exe200⤵
-
\??\c:\3thntb.exec:\3thntb.exe201⤵
-
\??\c:\vjvvv.exec:\vjvvv.exe202⤵
-
\??\c:\7vppp.exec:\7vppp.exe203⤵
-
\??\c:\xrlfffl.exec:\xrlfffl.exe204⤵
-
\??\c:\1htttn.exec:\1htttn.exe205⤵
-
\??\c:\hhtbtt.exec:\hhtbtt.exe206⤵
-
\??\c:\pdjjd.exec:\pdjjd.exe207⤵
-
\??\c:\lxlxrrl.exec:\lxlxrrl.exe208⤵
-
\??\c:\1fffrrf.exec:\1fffrrf.exe209⤵
-
\??\c:\nbhhnh.exec:\nbhhnh.exe210⤵
-
\??\c:\bbhbbt.exec:\bbhbbt.exe211⤵
-
\??\c:\jdjjd.exec:\jdjjd.exe212⤵
-
\??\c:\pvjpv.exec:\pvjpv.exe213⤵
-
\??\c:\3ffxxff.exec:\3ffxxff.exe214⤵
-
\??\c:\rflrflr.exec:\rflrflr.exe215⤵
-
\??\c:\btnttn.exec:\btnttn.exe216⤵
-
\??\c:\tnbhbh.exec:\tnbhbh.exe217⤵
-
\??\c:\vpvjj.exec:\vpvjj.exe218⤵
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe219⤵
-
\??\c:\lfrfxxf.exec:\lfrfxxf.exe220⤵
-
\??\c:\hthhbh.exec:\hthhbh.exe221⤵
-
\??\c:\tnhntt.exec:\tnhntt.exe222⤵
-
\??\c:\jdjpj.exec:\jdjpj.exe223⤵
-
\??\c:\rflrxxl.exec:\rflrxxl.exe224⤵
-
\??\c:\lflrfff.exec:\lflrfff.exe225⤵
-
\??\c:\btbhnt.exec:\btbhnt.exe226⤵
-
\??\c:\3hntnn.exec:\3hntnn.exe227⤵
-
\??\c:\7vdvv.exec:\7vdvv.exe228⤵
-
\??\c:\pjvvv.exec:\pjvvv.exe229⤵
-
\??\c:\lxllrxf.exec:\lxllrxf.exe230⤵
-
\??\c:\thntnn.exec:\thntnn.exe231⤵
-
\??\c:\hnbhnn.exec:\hnbhnn.exe232⤵
-
\??\c:\9pddj.exec:\9pddj.exe233⤵
-
\??\c:\pdjvd.exec:\pdjvd.exe234⤵
-
\??\c:\9fflflr.exec:\9fflflr.exe235⤵
-
\??\c:\lxrlxfl.exec:\lxrlxfl.exe236⤵
-
\??\c:\htttnb.exec:\htttnb.exe237⤵
-
\??\c:\vjvjp.exec:\vjvjp.exe238⤵
-
\??\c:\vvjjj.exec:\vvjjj.exe239⤵
-
\??\c:\5rrxlrf.exec:\5rrxlrf.exe240⤵
-
\??\c:\tnhthn.exec:\tnhthn.exe241⤵