Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 12:07
Behavioral task
behavioral1
Sample
46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23_NeikiAnalytics.exe
-
Size
328KB
-
MD5
80d599f3a116bea8867625098bf51160
-
SHA1
1df09ce73ccc6d51d4dcdccaf0a974a0d6094529
-
SHA256
46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23
-
SHA512
bc014c7bd33eca7be0fac4f37b6bf0b28cbc310855ad80d97505b42850758f11035d6e1b18ac475191eb20eb8f3b670f61a61d86b5711b7f898b97489caa367e
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbem:R4wFHoSHYHUrAwfMp3CDm
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
Processes:
resource yara_rule behavioral1/memory/2288-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1204-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-56-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2392-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1916-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1584-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1144-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1232-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/784-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/868-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-519-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1836-536-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-581-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-602-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/992-745-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-816-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-851-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-6357-0x0000000076B30000-0x0000000076C2A000-memory.dmp family_blackmoon behavioral1/memory/3032-15060-0x0000000076C30000-0x0000000076D4F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpjpv.exejjpjj.exetbhttn.exerlrxffr.exenttbbb.exevjvvv.exe5frflfl.exebnbbhh.exe1pvdv.exelxfxflr.exenhtbhh.exevpjpd.exexrxxfll.exenbnbbt.exejdvjp.exelflxxrf.exe3btbhn.exedvjpv.exelxlflxf.exebhthnh.exepjpjv.exefrxxrrx.exe9bttbb.exedpvdd.exe5ffrlll.exe3bhthh.exevpdvp.exexrlxxlr.exe5vppv.exexxrflrf.exefxllrrf.exevvvjv.exefrrflrx.exebtnnbh.exevvjpv.exe9dvdp.exe3rllrrr.exexlxflfl.exe9bnnnn.exe1djpp.exejdpjj.exefrffxxf.exeffxffrx.exehtnbbh.exe5pdjj.exevjpvj.exe9xllrff.exe3nntth.exehbnbhh.exevjpjj.exe3lllrrx.exellrfxff.exe1htnbb.exehtnntt.exepdjpd.exexlfxxfl.exelfxxfff.exe5bhhtt.exedvppv.exefrlffff.exexlxlxxf.exe7tbntn.exehbtnnh.exe3vpvv.exepid process 1204 vpjpv.exe 2072 jjpjj.exe 2576 tbhttn.exe 2484 rlrxffr.exe 2384 nttbbb.exe 2700 vjvvv.exe 2544 5frflfl.exe 2392 bnbbhh.exe 2876 1pvdv.exe 2108 lxfxflr.exe 2676 nhtbhh.exe 2720 vpjpd.exe 2752 xrxxfll.exe 1584 nbnbbt.exe 1916 jdvjp.exe 320 lflxxrf.exe 1612 3btbhn.exe 2636 dvjpv.exe 1144 lxlflxf.exe 2996 bhthnh.exe 2324 pjpjv.exe 2236 frxxrrx.exe 2176 9bttbb.exe 2816 dpvdd.exe 488 5ffrlll.exe 2340 3bhthh.exe 3016 vpdvp.exe 1492 xrlxxlr.exe 240 5vppv.exe 1728 xxrflrf.exe 2836 fxllrrf.exe 2040 vvvjv.exe 380 frrflrx.exe 656 btnnbh.exe 1232 vvjpv.exe 2280 9dvdp.exe 1840 3rllrrr.exe 2288 xlxflfl.exe 872 9bnnnn.exe 1660 1djpp.exe 2508 jdpjj.exe 2616 frffxxf.exe 2504 ffxffrx.exe 2592 htnbbh.exe 2496 5pdjj.exe 2656 vjpvj.exe 2700 9xllrff.exe 2440 3nntth.exe 2372 hbnbhh.exe 2392 vjpjj.exe 784 3lllrrx.exe 1592 llrfxff.exe 2712 1htnbb.exe 2732 htnntt.exe 1636 pdjpd.exe 1696 xlfxxfl.exe 300 lfxxfff.exe 1532 5bhhtt.exe 1652 dvppv.exe 1368 frlffff.exe 1364 xlxlxxf.exe 1456 7tbntn.exe 2852 hbtnnh.exe 2476 3vpvv.exe -
Processes:
resource yara_rule behavioral1/memory/2288-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpjpv.exe upx behavioral1/memory/2288-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1204-10-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjpjj.exe upx C:\tbhttn.exe upx behavioral1/memory/2072-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2576-24-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlrxffr.exe upx behavioral1/memory/2576-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nttbbb.exe upx behavioral1/memory/2484-40-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjvvv.exe upx behavioral1/memory/2700-58-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5frflfl.exe upx C:\bnbbhh.exe upx behavioral1/memory/2392-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1pvdv.exe upx behavioral1/memory/2392-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2108-83-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxfxflr.exe upx C:\nhtbhh.exe upx behavioral1/memory/2108-91-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpjpd.exe upx C:\xrxxfll.exe upx behavioral1/memory/2720-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2752-108-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbnbbt.exe upx C:\jdvjp.exe upx behavioral1/memory/1916-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1584-122-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lflxxrf.exe upx C:\3btbhn.exe upx C:\dvjpv.exe upx behavioral1/memory/1612-145-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxlflxf.exe upx behavioral1/memory/2636-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1144-155-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhthnh.exe upx C:\pjpjv.exe upx behavioral1/memory/2996-169-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frxxrrx.exe upx behavioral1/memory/2236-178-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9bttbb.exe upx C:\dpvdd.exe upx C:\5ffrlll.exe upx C:\3bhthh.exe upx C:\vpdvp.exe upx \??\c:\xrlxxlr.exe upx behavioral1/memory/1492-221-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5vppv.exe upx C:\xxrflrf.exe upx behavioral1/memory/1728-236-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxllrrf.exe upx C:\vvvjv.exe upx behavioral1/memory/2040-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2040-258-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1232-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1660-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2592-322-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2496-323-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2656-329-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2372-346-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2392-352-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23_NeikiAnalytics.exevpjpv.exejjpjj.exetbhttn.exerlrxffr.exenttbbb.exevjvvv.exe5frflfl.exebnbbhh.exe1pvdv.exelxfxflr.exenhtbhh.exevpjpd.exexrxxfll.exenbnbbt.exejdvjp.exedescription pid process target process PID 2288 wrote to memory of 1204 2288 46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23_NeikiAnalytics.exe vpjpv.exe PID 2288 wrote to memory of 1204 2288 46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23_NeikiAnalytics.exe vpjpv.exe PID 2288 wrote to memory of 1204 2288 46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23_NeikiAnalytics.exe vpjpv.exe PID 2288 wrote to memory of 1204 2288 46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23_NeikiAnalytics.exe vpjpv.exe PID 1204 wrote to memory of 2072 1204 vpjpv.exe jjpjj.exe PID 1204 wrote to memory of 2072 1204 vpjpv.exe jjpjj.exe PID 1204 wrote to memory of 2072 1204 vpjpv.exe jjpjj.exe PID 1204 wrote to memory of 2072 1204 vpjpv.exe jjpjj.exe PID 2072 wrote to memory of 2576 2072 jjpjj.exe tbhttn.exe PID 2072 wrote to memory of 2576 2072 jjpjj.exe tbhttn.exe PID 2072 wrote to memory of 2576 2072 jjpjj.exe tbhttn.exe PID 2072 wrote to memory of 2576 2072 jjpjj.exe tbhttn.exe PID 2576 wrote to memory of 2484 2576 tbhttn.exe rlrxffr.exe PID 2576 wrote to memory of 2484 2576 tbhttn.exe rlrxffr.exe PID 2576 wrote to memory of 2484 2576 tbhttn.exe rlrxffr.exe PID 2576 wrote to memory of 2484 2576 tbhttn.exe rlrxffr.exe PID 2484 wrote to memory of 2384 2484 rlrxffr.exe nttbbb.exe PID 2484 wrote to memory of 2384 2484 rlrxffr.exe nttbbb.exe PID 2484 wrote to memory of 2384 2484 rlrxffr.exe nttbbb.exe PID 2484 wrote to memory of 2384 2484 rlrxffr.exe nttbbb.exe PID 2384 wrote to memory of 2700 2384 nttbbb.exe vjvvv.exe PID 2384 wrote to memory of 2700 2384 nttbbb.exe vjvvv.exe PID 2384 wrote to memory of 2700 2384 nttbbb.exe vjvvv.exe PID 2384 wrote to memory of 2700 2384 nttbbb.exe vjvvv.exe PID 2700 wrote to memory of 2544 2700 vjvvv.exe 5frflfl.exe PID 2700 wrote to memory of 2544 2700 vjvvv.exe 5frflfl.exe PID 2700 wrote to memory of 2544 2700 vjvvv.exe 5frflfl.exe PID 2700 wrote to memory of 2544 2700 vjvvv.exe 5frflfl.exe PID 2544 wrote to memory of 2392 2544 5frflfl.exe bnbbhh.exe PID 2544 wrote to memory of 2392 2544 5frflfl.exe bnbbhh.exe PID 2544 wrote to memory of 2392 2544 5frflfl.exe bnbbhh.exe PID 2544 wrote to memory of 2392 2544 5frflfl.exe bnbbhh.exe PID 2392 wrote to memory of 2876 2392 bnbbhh.exe 1pvdv.exe PID 2392 wrote to memory of 2876 2392 bnbbhh.exe 1pvdv.exe PID 2392 wrote to memory of 2876 2392 bnbbhh.exe 1pvdv.exe PID 2392 wrote to memory of 2876 2392 bnbbhh.exe 1pvdv.exe PID 2876 wrote to memory of 2108 2876 1pvdv.exe lxfxflr.exe PID 2876 wrote to memory of 2108 2876 1pvdv.exe lxfxflr.exe PID 2876 wrote to memory of 2108 2876 1pvdv.exe lxfxflr.exe PID 2876 wrote to memory of 2108 2876 1pvdv.exe lxfxflr.exe PID 2108 wrote to memory of 2676 2108 lxfxflr.exe nhtbhh.exe PID 2108 wrote to memory of 2676 2108 lxfxflr.exe nhtbhh.exe PID 2108 wrote to memory of 2676 2108 lxfxflr.exe nhtbhh.exe PID 2108 wrote to memory of 2676 2108 lxfxflr.exe nhtbhh.exe PID 2676 wrote to memory of 2720 2676 nhtbhh.exe vpjpd.exe PID 2676 wrote to memory of 2720 2676 nhtbhh.exe vpjpd.exe PID 2676 wrote to memory of 2720 2676 nhtbhh.exe vpjpd.exe PID 2676 wrote to memory of 2720 2676 nhtbhh.exe vpjpd.exe PID 2720 wrote to memory of 2752 2720 vpjpd.exe xrxxfll.exe PID 2720 wrote to memory of 2752 2720 vpjpd.exe xrxxfll.exe PID 2720 wrote to memory of 2752 2720 vpjpd.exe xrxxfll.exe PID 2720 wrote to memory of 2752 2720 vpjpd.exe xrxxfll.exe PID 2752 wrote to memory of 1584 2752 xrxxfll.exe nbnbbt.exe PID 2752 wrote to memory of 1584 2752 xrxxfll.exe nbnbbt.exe PID 2752 wrote to memory of 1584 2752 xrxxfll.exe nbnbbt.exe PID 2752 wrote to memory of 1584 2752 xrxxfll.exe nbnbbt.exe PID 1584 wrote to memory of 1916 1584 nbnbbt.exe jdvjp.exe PID 1584 wrote to memory of 1916 1584 nbnbbt.exe jdvjp.exe PID 1584 wrote to memory of 1916 1584 nbnbbt.exe jdvjp.exe PID 1584 wrote to memory of 1916 1584 nbnbbt.exe jdvjp.exe PID 1916 wrote to memory of 320 1916 jdvjp.exe lflxxrf.exe PID 1916 wrote to memory of 320 1916 jdvjp.exe lflxxrf.exe PID 1916 wrote to memory of 320 1916 jdvjp.exe lflxxrf.exe PID 1916 wrote to memory of 320 1916 jdvjp.exe lflxxrf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjpv.exec:\vpjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjpjj.exec:\jjpjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbhttn.exec:\tbhttn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlrxffr.exec:\rlrxffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nttbbb.exec:\nttbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjvvv.exec:\vjvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5frflfl.exec:\5frflfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnbbhh.exec:\bnbbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1pvdv.exec:\1pvdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxfxflr.exec:\lxfxflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhtbhh.exec:\nhtbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjpd.exec:\vpjpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrxxfll.exec:\xrxxfll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbnbbt.exec:\nbnbbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvjp.exec:\jdvjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lflxxrf.exec:\lflxxrf.exe17⤵
- Executes dropped EXE
-
\??\c:\3btbhn.exec:\3btbhn.exe18⤵
- Executes dropped EXE
-
\??\c:\dvjpv.exec:\dvjpv.exe19⤵
- Executes dropped EXE
-
\??\c:\lxlflxf.exec:\lxlflxf.exe20⤵
- Executes dropped EXE
-
\??\c:\bhthnh.exec:\bhthnh.exe21⤵
- Executes dropped EXE
-
\??\c:\pjpjv.exec:\pjpjv.exe22⤵
- Executes dropped EXE
-
\??\c:\frxxrrx.exec:\frxxrrx.exe23⤵
- Executes dropped EXE
-
\??\c:\9bttbb.exec:\9bttbb.exe24⤵
- Executes dropped EXE
-
\??\c:\dpvdd.exec:\dpvdd.exe25⤵
- Executes dropped EXE
-
\??\c:\5ffrlll.exec:\5ffrlll.exe26⤵
- Executes dropped EXE
-
\??\c:\3bhthh.exec:\3bhthh.exe27⤵
- Executes dropped EXE
-
\??\c:\vpdvp.exec:\vpdvp.exe28⤵
- Executes dropped EXE
-
\??\c:\xrlxxlr.exec:\xrlxxlr.exe29⤵
- Executes dropped EXE
-
\??\c:\5vppv.exec:\5vppv.exe30⤵
- Executes dropped EXE
-
\??\c:\xxrflrf.exec:\xxrflrf.exe31⤵
- Executes dropped EXE
-
\??\c:\fxllrrf.exec:\fxllrrf.exe32⤵
- Executes dropped EXE
-
\??\c:\vvvjv.exec:\vvvjv.exe33⤵
- Executes dropped EXE
-
\??\c:\frrflrx.exec:\frrflrx.exe34⤵
- Executes dropped EXE
-
\??\c:\btnnbh.exec:\btnnbh.exe35⤵
- Executes dropped EXE
-
\??\c:\vvjpv.exec:\vvjpv.exe36⤵
- Executes dropped EXE
-
\??\c:\9dvdp.exec:\9dvdp.exe37⤵
- Executes dropped EXE
-
\??\c:\3rllrrr.exec:\3rllrrr.exe38⤵
- Executes dropped EXE
-
\??\c:\xlxflfl.exec:\xlxflfl.exe39⤵
- Executes dropped EXE
-
\??\c:\9bnnnn.exec:\9bnnnn.exe40⤵
- Executes dropped EXE
-
\??\c:\1djpp.exec:\1djpp.exe41⤵
- Executes dropped EXE
-
\??\c:\jdpjj.exec:\jdpjj.exe42⤵
- Executes dropped EXE
-
\??\c:\frffxxf.exec:\frffxxf.exe43⤵
- Executes dropped EXE
-
\??\c:\ffxffrx.exec:\ffxffrx.exe44⤵
- Executes dropped EXE
-
\??\c:\htnbbh.exec:\htnbbh.exe45⤵
- Executes dropped EXE
-
\??\c:\5pdjj.exec:\5pdjj.exe46⤵
- Executes dropped EXE
-
\??\c:\vjpvj.exec:\vjpvj.exe47⤵
- Executes dropped EXE
-
\??\c:\9xllrff.exec:\9xllrff.exe48⤵
- Executes dropped EXE
-
\??\c:\3nntth.exec:\3nntth.exe49⤵
- Executes dropped EXE
-
\??\c:\hbnbhh.exec:\hbnbhh.exe50⤵
- Executes dropped EXE
-
\??\c:\vjpjj.exec:\vjpjj.exe51⤵
- Executes dropped EXE
-
\??\c:\3lllrrx.exec:\3lllrrx.exe52⤵
- Executes dropped EXE
-
\??\c:\llrfxff.exec:\llrfxff.exe53⤵
- Executes dropped EXE
-
\??\c:\1htnbb.exec:\1htnbb.exe54⤵
- Executes dropped EXE
-
\??\c:\htnntt.exec:\htnntt.exe55⤵
- Executes dropped EXE
-
\??\c:\pdjpd.exec:\pdjpd.exe56⤵
- Executes dropped EXE
-
\??\c:\xlfxxfl.exec:\xlfxxfl.exe57⤵
- Executes dropped EXE
-
\??\c:\lfxxfff.exec:\lfxxfff.exe58⤵
- Executes dropped EXE
-
\??\c:\5bhhtt.exec:\5bhhtt.exe59⤵
- Executes dropped EXE
-
\??\c:\dvppv.exec:\dvppv.exe60⤵
- Executes dropped EXE
-
\??\c:\frlffff.exec:\frlffff.exe61⤵
- Executes dropped EXE
-
\??\c:\xlxlxxf.exec:\xlxlxxf.exe62⤵
- Executes dropped EXE
-
\??\c:\7tbntn.exec:\7tbntn.exe63⤵
- Executes dropped EXE
-
\??\c:\hbtnnh.exec:\hbtnnh.exe64⤵
- Executes dropped EXE
-
\??\c:\3vpvv.exec:\3vpvv.exe65⤵
- Executes dropped EXE
-
\??\c:\xfxffxf.exec:\xfxffxf.exe66⤵
-
\??\c:\frffrxf.exec:\frffrxf.exe67⤵
-
\??\c:\5btntb.exec:\5btntb.exe68⤵
-
\??\c:\3pppd.exec:\3pppd.exe69⤵
-
\??\c:\xrffxxx.exec:\xrffxxx.exe70⤵
-
\??\c:\fxlxfff.exec:\fxlxfff.exe71⤵
-
\??\c:\tnnntt.exec:\tnnntt.exe72⤵
-
\??\c:\ddpvj.exec:\ddpvj.exe73⤵
-
\??\c:\frxrrrx.exec:\frxrrrx.exe74⤵
-
\??\c:\xxfxfxf.exec:\xxfxfxf.exe75⤵
-
\??\c:\hthtbb.exec:\hthtbb.exe76⤵
-
\??\c:\vvjpd.exec:\vvjpd.exe77⤵
-
\??\c:\7xllrxl.exec:\7xllrxl.exe78⤵
-
\??\c:\5lxxlrf.exec:\5lxxlrf.exe79⤵
-
\??\c:\nbnhhh.exec:\nbnhhh.exe80⤵
-
\??\c:\pjdpd.exec:\pjdpd.exe81⤵
-
\??\c:\frrxlrl.exec:\frrxlrl.exe82⤵
-
\??\c:\xrllrlr.exec:\xrllrlr.exe83⤵
-
\??\c:\ttnnbt.exec:\ttnnbt.exe84⤵
-
\??\c:\hnhbnb.exec:\hnhbnb.exe85⤵
-
\??\c:\pvddp.exec:\pvddp.exe86⤵
-
\??\c:\jddpd.exec:\jddpd.exe87⤵
-
\??\c:\3xllrrx.exec:\3xllrrx.exe88⤵
-
\??\c:\ttnntb.exec:\ttnntb.exe89⤵
-
\??\c:\jdpjp.exec:\jdpjp.exe90⤵
-
\??\c:\vpdjj.exec:\vpdjj.exe91⤵
-
\??\c:\lxfxxfl.exec:\lxfxxfl.exe92⤵
-
\??\c:\bbthbh.exec:\bbthbh.exe93⤵
-
\??\c:\hbhtnt.exec:\hbhtnt.exe94⤵
-
\??\c:\dpddj.exec:\dpddj.exe95⤵
-
\??\c:\rlrrlrl.exec:\rlrrlrl.exe96⤵
-
\??\c:\bbtbnb.exec:\bbtbnb.exe97⤵
-
\??\c:\5pjpv.exec:\5pjpv.exe98⤵
-
\??\c:\fffrlrl.exec:\fffrlrl.exe99⤵
-
\??\c:\rxfrlll.exec:\rxfrlll.exe100⤵
-
\??\c:\hnhnhn.exec:\hnhnhn.exe101⤵
-
\??\c:\vpvvd.exec:\vpvvd.exe102⤵
-
\??\c:\1ddvd.exec:\1ddvd.exe103⤵
-
\??\c:\fxlxlxf.exec:\fxlxlxf.exe104⤵
-
\??\c:\nntnhh.exec:\nntnhh.exe105⤵
-
\??\c:\nhbntb.exec:\nhbntb.exe106⤵
-
\??\c:\pvjvd.exec:\pvjvd.exe107⤵
-
\??\c:\xxlfffr.exec:\xxlfffr.exe108⤵
-
\??\c:\nhttbh.exec:\nhttbh.exe109⤵
-
\??\c:\htbhhn.exec:\htbhhn.exe110⤵
-
\??\c:\pjvdd.exec:\pjvdd.exe111⤵
-
\??\c:\pjjvj.exec:\pjjvj.exe112⤵
-
\??\c:\frlrlxl.exec:\frlrlxl.exe113⤵
-
\??\c:\3btttb.exec:\3btttb.exe114⤵
-
\??\c:\vvppp.exec:\vvppp.exe115⤵
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe116⤵
-
\??\c:\5rrxflr.exec:\5rrxflr.exe117⤵
-
\??\c:\tnthnn.exec:\tnthnn.exe118⤵
-
\??\c:\thbttt.exec:\thbttt.exe119⤵
-
\??\c:\pjvdd.exec:\pjvdd.exe120⤵
-
\??\c:\9rfxlxl.exec:\9rfxlxl.exe121⤵
-
\??\c:\3lrrrrf.exec:\3lrrrrf.exe122⤵
-
\??\c:\nbnhnn.exec:\nbnhnn.exe123⤵
-
\??\c:\jpdjp.exec:\jpdjp.exe124⤵
-
\??\c:\jvdvd.exec:\jvdvd.exe125⤵
-
\??\c:\rlxlrxx.exec:\rlxlrxx.exe126⤵
-
\??\c:\5thhnn.exec:\5thhnn.exe127⤵
-
\??\c:\hbbbbt.exec:\hbbbbt.exe128⤵
-
\??\c:\ddpdd.exec:\ddpdd.exe129⤵
-
\??\c:\pdjjp.exec:\pdjjp.exe130⤵
-
\??\c:\xrxrrlx.exec:\xrxrrlx.exe131⤵
-
\??\c:\nhbntn.exec:\nhbntn.exe132⤵
-
\??\c:\1nhnbn.exec:\1nhnbn.exe133⤵
-
\??\c:\5ddpv.exec:\5ddpv.exe134⤵
-
\??\c:\flxrxrx.exec:\flxrxrx.exe135⤵
-
\??\c:\nttbbh.exec:\nttbbh.exe136⤵
-
\??\c:\7nhhtb.exec:\7nhhtb.exe137⤵
-
\??\c:\jdvdp.exec:\jdvdp.exe138⤵
-
\??\c:\pjvpd.exec:\pjvpd.exe139⤵
-
\??\c:\lflfffl.exec:\lflfffl.exe140⤵
-
\??\c:\rlflrrx.exec:\rlflrrx.exe141⤵
-
\??\c:\bbthbb.exec:\bbthbb.exe142⤵
-
\??\c:\vvjvd.exec:\vvjvd.exe143⤵
-
\??\c:\tnbbhb.exec:\tnbbhb.exe144⤵
-
\??\c:\jdvdj.exec:\jdvdj.exe145⤵
-
\??\c:\xfrlfxx.exec:\xfrlfxx.exe146⤵
-
\??\c:\thhtnt.exec:\thhtnt.exe147⤵
-
\??\c:\dvvdd.exec:\dvvdd.exe148⤵
-
\??\c:\jvpjd.exec:\jvpjd.exe149⤵
-
\??\c:\xxlrfxl.exec:\xxlrfxl.exe150⤵
-
\??\c:\9xxllll.exec:\9xxllll.exe151⤵
-
\??\c:\bbbbht.exec:\bbbbht.exe152⤵
-
\??\c:\pjjjv.exec:\pjjjv.exe153⤵
-
\??\c:\rxxrrlr.exec:\rxxrrlr.exe154⤵
-
\??\c:\xrllrlr.exec:\xrllrlr.exe155⤵
-
\??\c:\btnnbh.exec:\btnnbh.exe156⤵
-
\??\c:\jdvdd.exec:\jdvdd.exe157⤵
-
\??\c:\ppjvp.exec:\ppjvp.exe158⤵
-
\??\c:\lxrrffl.exec:\lxrrffl.exe159⤵
-
\??\c:\lllxffr.exec:\lllxffr.exe160⤵
-
\??\c:\hbttbb.exec:\hbttbb.exe161⤵
-
\??\c:\tttbhn.exec:\tttbhn.exe162⤵
-
\??\c:\pdvdd.exec:\pdvdd.exe163⤵
-
\??\c:\llfrfxx.exec:\llfrfxx.exe164⤵
-
\??\c:\1lxxxxf.exec:\1lxxxxf.exe165⤵
-
\??\c:\nhhhtb.exec:\nhhhtb.exe166⤵
-
\??\c:\7nntnh.exec:\7nntnh.exe167⤵
-
\??\c:\jjpvp.exec:\jjpvp.exe168⤵
-
\??\c:\vpjjd.exec:\vpjjd.exe169⤵
-
\??\c:\rlxfllf.exec:\rlxfllf.exe170⤵
-
\??\c:\7rxfxfr.exec:\7rxfxfr.exe171⤵
-
\??\c:\nhtttt.exec:\nhtttt.exe172⤵
-
\??\c:\ppdjj.exec:\ppdjj.exe173⤵
-
\??\c:\ppjjp.exec:\ppjjp.exe174⤵
-
\??\c:\ffxfrxf.exec:\ffxfrxf.exe175⤵
-
\??\c:\llfllll.exec:\llfllll.exe176⤵
-
\??\c:\hthbhh.exec:\hthbhh.exe177⤵
-
\??\c:\5vpvp.exec:\5vpvp.exe178⤵
-
\??\c:\frfxxxl.exec:\frfxxxl.exe179⤵
-
\??\c:\frrxxxf.exec:\frrxxxf.exe180⤵
-
\??\c:\5tbttt.exec:\5tbttt.exe181⤵
-
\??\c:\nhbnbh.exec:\nhbnbh.exe182⤵
-
\??\c:\djvpp.exec:\djvpp.exe183⤵
-
\??\c:\dpddj.exec:\dpddj.exe184⤵
-
\??\c:\5lxfflx.exec:\5lxfflx.exe185⤵
-
\??\c:\ttnbht.exec:\ttnbht.exe186⤵
-
\??\c:\btnnhn.exec:\btnnhn.exe187⤵
-
\??\c:\vvjpj.exec:\vvjpj.exe188⤵
-
\??\c:\jjdjj.exec:\jjdjj.exe189⤵
-
\??\c:\ffxlfxr.exec:\ffxlfxr.exe190⤵
-
\??\c:\rrflxfl.exec:\rrflxfl.exe191⤵
-
\??\c:\hntntn.exec:\hntntn.exe192⤵
-
\??\c:\dvjvd.exec:\dvjvd.exe193⤵
-
\??\c:\jvddd.exec:\jvddd.exe194⤵
-
\??\c:\9rfxrrx.exec:\9rfxrrx.exe195⤵
-
\??\c:\bnbbhb.exec:\bnbbhb.exe196⤵
-
\??\c:\tnbnht.exec:\tnbnht.exe197⤵
-
\??\c:\9jpvd.exec:\9jpvd.exe198⤵
-
\??\c:\3dddd.exec:\3dddd.exe199⤵
-
\??\c:\1xlllrf.exec:\1xlllrf.exe200⤵
-
\??\c:\3lflrrx.exec:\3lflrrx.exe201⤵
-
\??\c:\nbnhtb.exec:\nbnhtb.exe202⤵
-
\??\c:\dvjjj.exec:\dvjjj.exe203⤵
-
\??\c:\pjppp.exec:\pjppp.exe204⤵
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe205⤵
-
\??\c:\5rxfrll.exec:\5rxfrll.exe206⤵
-
\??\c:\bhhnnh.exec:\bhhnnh.exe207⤵
-
\??\c:\jdddp.exec:\jdddp.exe208⤵
-
\??\c:\jvpvv.exec:\jvpvv.exe209⤵
-
\??\c:\llfrflx.exec:\llfrflx.exe210⤵
-
\??\c:\rlfffrx.exec:\rlfffrx.exe211⤵
-
\??\c:\nhnhhn.exec:\nhnhhn.exe212⤵
-
\??\c:\bththh.exec:\bththh.exe213⤵
-
\??\c:\vjdpv.exec:\vjdpv.exe214⤵
-
\??\c:\5xllrrf.exec:\5xllrrf.exe215⤵
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe216⤵
-
\??\c:\tttthn.exec:\tttthn.exe217⤵
-
\??\c:\hhthnb.exec:\hhthnb.exe218⤵
-
\??\c:\jjddj.exec:\jjddj.exe219⤵
-
\??\c:\xrffllf.exec:\xrffllf.exe220⤵
-
\??\c:\xrxflxf.exec:\xrxflxf.exe221⤵
-
\??\c:\bbtthn.exec:\bbtthn.exe222⤵
-
\??\c:\9bbntb.exec:\9bbntb.exe223⤵
-
\??\c:\9pppp.exec:\9pppp.exe224⤵
-
\??\c:\7frrxff.exec:\7frrxff.exe225⤵
-
\??\c:\xrxxfrx.exec:\xrxxfrx.exe226⤵
-
\??\c:\bbbhtb.exec:\bbbhtb.exe227⤵
-
\??\c:\ntnnnh.exec:\ntnnnh.exe228⤵
-
\??\c:\5vjpp.exec:\5vjpp.exe229⤵
-
\??\c:\7jjjj.exec:\7jjjj.exe230⤵
-
\??\c:\rlrflrf.exec:\rlrflrf.exe231⤵
-
\??\c:\rrllxxl.exec:\rrllxxl.exe232⤵
-
\??\c:\7hnhbn.exec:\7hnhbn.exe233⤵
-
\??\c:\vjddd.exec:\vjddd.exe234⤵
-
\??\c:\1jjpp.exec:\1jjpp.exe235⤵
-
\??\c:\xlrrllr.exec:\xlrrllr.exe236⤵
-
\??\c:\7fxxlrf.exec:\7fxxlrf.exe237⤵
-
\??\c:\thbbbt.exec:\thbbbt.exe238⤵
-
\??\c:\dpppj.exec:\dpppj.exe239⤵
-
\??\c:\jvdpv.exec:\jvdpv.exe240⤵
-
\??\c:\lflrlrr.exec:\lflrlrr.exe241⤵