Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 05:06
Behavioral task
behavioral1
Sample
af689e9ade44e44317421df36090f9f0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
af689e9ade44e44317421df36090f9f0_NeikiAnalytics.exe
-
Size
251KB
-
MD5
af689e9ade44e44317421df36090f9f0
-
SHA1
042433e50d04eb277f8c0796e216b100c5284bc6
-
SHA256
d80382a7ff9e24e217528ebb64e5633bfdfa8a9bd9ac823e1b8e075c1536d81f
-
SHA512
25e6a434061f0688f6f5cba6816e197041725470276224fb23f9d79e01502ce4b9ba62b6d3f8611569d2a63607e6628ad72a1af3b761179aa2b4fe8ed67c7b32
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+g:ccm4FmowdHoSi9EIBftapTs4WZazb
Malware Config
Signatures
-
Detect Blackmoon payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/1676-7-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1672-10-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2640-30-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2072-27-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2588-45-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2824-48-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2780-63-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2708-72-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/992-99-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2512-107-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2768-117-0x00000000001B0000-0x00000000001E6000-memory.dmp family_blackmoon behavioral1/memory/1216-141-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1244-152-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2040-168-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/668-205-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2300-203-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/592-220-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1732-229-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1964-278-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1488-293-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2812-318-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2724-349-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2580-357-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2340-371-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2496-378-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2128-410-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1344-435-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/320-498-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3004-511-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/944-526-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1112-539-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2376-579-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2852-779-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2160-967-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1196-1026-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\ffrfllx.exe family_berbew C:\jdppv.exe family_berbew C:\5lrfflr.exe family_berbew C:\nhnhnn.exe family_berbew C:\1xxlxxf.exe family_berbew C:\5rxflrx.exe family_berbew C:\jjjjj.exe family_berbew C:\xxlllrr.exe family_berbew C:\nnhtnh.exe family_berbew C:\3djpp.exe family_berbew C:\rfxxllx.exe family_berbew C:\1vppv.exe family_berbew C:\frxfffl.exe family_berbew C:\3bntbt.exe family_berbew C:\dvpjd.exe family_berbew C:\llfxflf.exe family_berbew C:\9vddj.exe family_berbew C:\7jvjv.exe family_berbew C:\thtbbh.exe family_berbew C:\dvppj.exe family_berbew C:\xrlfllr.exe family_berbew C:\3htthh.exe family_berbew C:\jdvpd.exe family_berbew C:\fxrxlrf.exe family_berbew C:\ttbhtn.exe family_berbew C:\llfrxlf.exe family_berbew C:\tntbhn.exe family_berbew C:\1dpdd.exe family_berbew C:\xrllxfl.exe family_berbew C:\hhbbbh.exe family_berbew C:\dpvvd.exe family_berbew C:\xxlrllx.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
ffrfllx.exejdppv.exe5lrfflr.exenhnhnn.exe1xxlxxf.exe5rxflrx.exejjjjj.exexxlllrr.exennhtnh.exe3djpp.exerfxxllx.exe1vppv.exefrxfffl.exe3bntbt.exedvpjd.exellfxflf.exe9vddj.exe7jvjv.exethtbbh.exedvppj.exexrlfllr.exe3htthh.exejdvpd.exefxrxlrf.exettbhtn.exellfrxlf.exetntbhn.exe1dpdd.exexrllxfl.exehhbbbh.exedpvvd.exexxlrllx.exenbnhnn.exejdpvj.exeffrxflr.exelfrfrxf.exebhbthn.exevvpjd.exe1lxffrx.exexrrfffx.exebbtnbb.exe1dvpd.exexrfrfrf.exe3xrfxlr.exe7httbh.exeththbt.exevvpdd.exeffxlflx.exebntbnn.exebbbtnt.exedddjd.exejvppd.exe1ffllxl.exe9bttnn.exetnhhht.exeddppd.exe5xrrxxx.exetnbhtt.exe7tbhht.exe1jvdv.exelxrlxxx.exerrflflr.exetnhnhn.exe9jvdd.exepid process 1672 ffrfllx.exe 2072 jdppv.exe 2640 5lrfflr.exe 2588 nhnhnn.exe 2824 1xxlxxf.exe 2780 5rxflrx.exe 2708 jjjjj.exe 2516 xxlllrr.exe 1708 nnhtnh.exe 992 3djpp.exe 2512 rfxxllx.exe 2768 1vppv.exe 2248 frxfffl.exe 1220 3bntbt.exe 1216 dvpjd.exe 1740 llfxflf.exe 1244 9vddj.exe 2040 7jvjv.exe 2024 thtbbh.exe 2944 dvppj.exe 1948 xrlfllr.exe 2300 3htthh.exe 668 jdvpd.exe 592 fxrxlrf.exe 1732 ttbhtn.exe 1436 llfrxlf.exe 1552 tntbhn.exe 1684 1dpdd.exe 1068 xrllxfl.exe 1940 hhbbbh.exe 1964 dpvvd.exe 3000 xxlrllx.exe 1488 nbnhnn.exe 2028 jdpvj.exe 1652 ffrxflr.exe 2812 lfrfrxf.exe 2584 bhbthn.exe 2664 vvpjd.exe 2576 1lxffrx.exe 2720 xrrfffx.exe 2724 bbtnbb.exe 2580 1dvpd.exe 2468 xrfrfrf.exe 2340 3xrfxlr.exe 2496 7httbh.exe 2964 ththbt.exe 2504 vvpdd.exe 2684 ffxlflx.exe 2512 bntbnn.exe 1312 bbbtnt.exe 2128 dddjd.exe 2148 jvppd.exe 1600 1ffllxl.exe 1596 9bttnn.exe 1344 tnhhht.exe 1740 ddppd.exe 1172 5xrrxxx.exe 1692 tnbhtt.exe 2924 7tbhht.exe 2304 1jvdv.exe 2944 lxrlxxx.exe 1972 rrflflr.exe 536 tnhnhn.exe 988 9jvdd.exe -
Processes:
resource yara_rule behavioral1/memory/1676-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1676-7-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ffrfllx.exe upx behavioral1/memory/1672-10-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jdppv.exe upx behavioral1/memory/2072-18-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\5lrfflr.exe upx behavioral1/memory/2640-30-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2072-27-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nhnhnn.exe upx C:\1xxlxxf.exe upx behavioral1/memory/2588-45-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2824-48-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\5rxflrx.exe upx C:\jjjjj.exe upx behavioral1/memory/2708-64-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2780-63-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xxlllrr.exe upx behavioral1/memory/2708-72-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nnhtnh.exe upx C:\3djpp.exe upx C:\rfxxllx.exe upx behavioral1/memory/992-99-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\1vppv.exe upx behavioral1/memory/2512-107-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\frxfffl.exe upx C:\3bntbt.exe upx C:\dvpjd.exe upx behavioral1/memory/1216-141-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\llfxflf.exe upx C:\9vddj.exe upx behavioral1/memory/1244-152-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\7jvjv.exe upx C:\thtbbh.exe upx behavioral1/memory/2040-168-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dvppj.exe upx behavioral1/memory/2944-177-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xrlfllr.exe upx C:\3htthh.exe upx behavioral1/memory/2300-194-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jdvpd.exe upx behavioral1/memory/668-205-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2300-203-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fxrxlrf.exe upx behavioral1/memory/592-220-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ttbhtn.exe upx behavioral1/memory/1732-229-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\llfrxlf.exe upx C:\tntbhn.exe upx C:\1dpdd.exe upx C:\xrllxfl.exe upx C:\hhbbbh.exe upx C:\dpvvd.exe upx C:\xxlrllx.exe upx behavioral1/memory/1964-278-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1488-293-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2028-294-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2812-318-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2724-349-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2580-350-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2580-357-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2340-364-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2340-371-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2496-378-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
af689e9ade44e44317421df36090f9f0_NeikiAnalytics.exeffrfllx.exejdppv.exe5lrfflr.exenhnhnn.exe1xxlxxf.exe5rxflrx.exejjjjj.exexxlllrr.exennhtnh.exe3djpp.exerfxxllx.exe1vppv.exefrxfffl.exe3bntbt.exedvpjd.exedescription pid process target process PID 1676 wrote to memory of 1672 1676 af689e9ade44e44317421df36090f9f0_NeikiAnalytics.exe ffrfllx.exe PID 1676 wrote to memory of 1672 1676 af689e9ade44e44317421df36090f9f0_NeikiAnalytics.exe ffrfllx.exe PID 1676 wrote to memory of 1672 1676 af689e9ade44e44317421df36090f9f0_NeikiAnalytics.exe ffrfllx.exe PID 1676 wrote to memory of 1672 1676 af689e9ade44e44317421df36090f9f0_NeikiAnalytics.exe ffrfllx.exe PID 1672 wrote to memory of 2072 1672 ffrfllx.exe jdppv.exe PID 1672 wrote to memory of 2072 1672 ffrfllx.exe jdppv.exe PID 1672 wrote to memory of 2072 1672 ffrfllx.exe jdppv.exe PID 1672 wrote to memory of 2072 1672 ffrfllx.exe jdppv.exe PID 2072 wrote to memory of 2640 2072 jdppv.exe 5lrfflr.exe PID 2072 wrote to memory of 2640 2072 jdppv.exe 5lrfflr.exe PID 2072 wrote to memory of 2640 2072 jdppv.exe 5lrfflr.exe PID 2072 wrote to memory of 2640 2072 jdppv.exe 5lrfflr.exe PID 2640 wrote to memory of 2588 2640 5lrfflr.exe nhnhnn.exe PID 2640 wrote to memory of 2588 2640 5lrfflr.exe nhnhnn.exe PID 2640 wrote to memory of 2588 2640 5lrfflr.exe nhnhnn.exe PID 2640 wrote to memory of 2588 2640 5lrfflr.exe nhnhnn.exe PID 2588 wrote to memory of 2824 2588 nhnhnn.exe 1xxlxxf.exe PID 2588 wrote to memory of 2824 2588 nhnhnn.exe 1xxlxxf.exe PID 2588 wrote to memory of 2824 2588 nhnhnn.exe 1xxlxxf.exe PID 2588 wrote to memory of 2824 2588 nhnhnn.exe 1xxlxxf.exe PID 2824 wrote to memory of 2780 2824 1xxlxxf.exe 5rxflrx.exe PID 2824 wrote to memory of 2780 2824 1xxlxxf.exe 5rxflrx.exe PID 2824 wrote to memory of 2780 2824 1xxlxxf.exe 5rxflrx.exe PID 2824 wrote to memory of 2780 2824 1xxlxxf.exe 5rxflrx.exe PID 2780 wrote to memory of 2708 2780 5rxflrx.exe jjjjj.exe PID 2780 wrote to memory of 2708 2780 5rxflrx.exe jjjjj.exe PID 2780 wrote to memory of 2708 2780 5rxflrx.exe jjjjj.exe PID 2780 wrote to memory of 2708 2780 5rxflrx.exe jjjjj.exe PID 2708 wrote to memory of 2516 2708 jjjjj.exe xxlllrr.exe PID 2708 wrote to memory of 2516 2708 jjjjj.exe xxlllrr.exe PID 2708 wrote to memory of 2516 2708 jjjjj.exe xxlllrr.exe PID 2708 wrote to memory of 2516 2708 jjjjj.exe xxlllrr.exe PID 2516 wrote to memory of 1708 2516 xxlllrr.exe nnhtnh.exe PID 2516 wrote to memory of 1708 2516 xxlllrr.exe nnhtnh.exe PID 2516 wrote to memory of 1708 2516 xxlllrr.exe nnhtnh.exe PID 2516 wrote to memory of 1708 2516 xxlllrr.exe nnhtnh.exe PID 1708 wrote to memory of 992 1708 nnhtnh.exe 3djpp.exe PID 1708 wrote to memory of 992 1708 nnhtnh.exe 3djpp.exe PID 1708 wrote to memory of 992 1708 nnhtnh.exe 3djpp.exe PID 1708 wrote to memory of 992 1708 nnhtnh.exe 3djpp.exe PID 992 wrote to memory of 2512 992 3djpp.exe rfxxllx.exe PID 992 wrote to memory of 2512 992 3djpp.exe rfxxllx.exe PID 992 wrote to memory of 2512 992 3djpp.exe rfxxllx.exe PID 992 wrote to memory of 2512 992 3djpp.exe rfxxllx.exe PID 2512 wrote to memory of 2768 2512 rfxxllx.exe 1vppv.exe PID 2512 wrote to memory of 2768 2512 rfxxllx.exe 1vppv.exe PID 2512 wrote to memory of 2768 2512 rfxxllx.exe 1vppv.exe PID 2512 wrote to memory of 2768 2512 rfxxllx.exe 1vppv.exe PID 2768 wrote to memory of 2248 2768 1vppv.exe frxfffl.exe PID 2768 wrote to memory of 2248 2768 1vppv.exe frxfffl.exe PID 2768 wrote to memory of 2248 2768 1vppv.exe frxfffl.exe PID 2768 wrote to memory of 2248 2768 1vppv.exe frxfffl.exe PID 2248 wrote to memory of 1220 2248 frxfffl.exe 3bntbt.exe PID 2248 wrote to memory of 1220 2248 frxfffl.exe 3bntbt.exe PID 2248 wrote to memory of 1220 2248 frxfffl.exe 3bntbt.exe PID 2248 wrote to memory of 1220 2248 frxfffl.exe 3bntbt.exe PID 1220 wrote to memory of 1216 1220 3bntbt.exe dvpjd.exe PID 1220 wrote to memory of 1216 1220 3bntbt.exe dvpjd.exe PID 1220 wrote to memory of 1216 1220 3bntbt.exe dvpjd.exe PID 1220 wrote to memory of 1216 1220 3bntbt.exe dvpjd.exe PID 1216 wrote to memory of 1740 1216 dvpjd.exe llfxflf.exe PID 1216 wrote to memory of 1740 1216 dvpjd.exe llfxflf.exe PID 1216 wrote to memory of 1740 1216 dvpjd.exe llfxflf.exe PID 1216 wrote to memory of 1740 1216 dvpjd.exe llfxflf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af689e9ade44e44317421df36090f9f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\af689e9ade44e44317421df36090f9f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrfllx.exec:\ffrfllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdppv.exec:\jdppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5lrfflr.exec:\5lrfflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhnhnn.exec:\nhnhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1xxlxxf.exec:\1xxlxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5rxflrx.exec:\5rxflrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjjjj.exec:\jjjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxlllrr.exec:\xxlllrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhtnh.exec:\nnhtnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3djpp.exec:\3djpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfxxllx.exec:\rfxxllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1vppv.exec:\1vppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frxfffl.exec:\frxfffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3bntbt.exec:\3bntbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvpjd.exec:\dvpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llfxflf.exec:\llfxflf.exe17⤵
- Executes dropped EXE
-
\??\c:\9vddj.exec:\9vddj.exe18⤵
- Executes dropped EXE
-
\??\c:\7jvjv.exec:\7jvjv.exe19⤵
- Executes dropped EXE
-
\??\c:\thtbbh.exec:\thtbbh.exe20⤵
- Executes dropped EXE
-
\??\c:\dvppj.exec:\dvppj.exe21⤵
- Executes dropped EXE
-
\??\c:\xrlfllr.exec:\xrlfllr.exe22⤵
- Executes dropped EXE
-
\??\c:\3htthh.exec:\3htthh.exe23⤵
- Executes dropped EXE
-
\??\c:\jdvpd.exec:\jdvpd.exe24⤵
- Executes dropped EXE
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe25⤵
- Executes dropped EXE
-
\??\c:\ttbhtn.exec:\ttbhtn.exe26⤵
- Executes dropped EXE
-
\??\c:\llfrxlf.exec:\llfrxlf.exe27⤵
- Executes dropped EXE
-
\??\c:\tntbhn.exec:\tntbhn.exe28⤵
- Executes dropped EXE
-
\??\c:\1dpdd.exec:\1dpdd.exe29⤵
- Executes dropped EXE
-
\??\c:\xrllxfl.exec:\xrllxfl.exe30⤵
- Executes dropped EXE
-
\??\c:\hhbbbh.exec:\hhbbbh.exe31⤵
- Executes dropped EXE
-
\??\c:\dpvvd.exec:\dpvvd.exe32⤵
- Executes dropped EXE
-
\??\c:\xxlrllx.exec:\xxlrllx.exe33⤵
- Executes dropped EXE
-
\??\c:\nbnhnn.exec:\nbnhnn.exe34⤵
- Executes dropped EXE
-
\??\c:\jdpvj.exec:\jdpvj.exe35⤵
- Executes dropped EXE
-
\??\c:\ffrxflr.exec:\ffrxflr.exe36⤵
- Executes dropped EXE
-
\??\c:\lfrfrxf.exec:\lfrfrxf.exe37⤵
- Executes dropped EXE
-
\??\c:\bhbthn.exec:\bhbthn.exe38⤵
- Executes dropped EXE
-
\??\c:\vvpjd.exec:\vvpjd.exe39⤵
- Executes dropped EXE
-
\??\c:\1lxffrx.exec:\1lxffrx.exe40⤵
- Executes dropped EXE
-
\??\c:\xrrfffx.exec:\xrrfffx.exe41⤵
- Executes dropped EXE
-
\??\c:\bbtnbb.exec:\bbtnbb.exe42⤵
- Executes dropped EXE
-
\??\c:\1dvpd.exec:\1dvpd.exe43⤵
- Executes dropped EXE
-
\??\c:\xrfrfrf.exec:\xrfrfrf.exe44⤵
- Executes dropped EXE
-
\??\c:\3xrfxlr.exec:\3xrfxlr.exe45⤵
- Executes dropped EXE
-
\??\c:\7httbh.exec:\7httbh.exe46⤵
- Executes dropped EXE
-
\??\c:\ththbt.exec:\ththbt.exe47⤵
- Executes dropped EXE
-
\??\c:\vvpdd.exec:\vvpdd.exe48⤵
- Executes dropped EXE
-
\??\c:\ffxlflx.exec:\ffxlflx.exe49⤵
- Executes dropped EXE
-
\??\c:\bntbnn.exec:\bntbnn.exe50⤵
- Executes dropped EXE
-
\??\c:\bbbtnt.exec:\bbbtnt.exe51⤵
- Executes dropped EXE
-
\??\c:\dddjd.exec:\dddjd.exe52⤵
- Executes dropped EXE
-
\??\c:\jvppd.exec:\jvppd.exe53⤵
- Executes dropped EXE
-
\??\c:\1ffllxl.exec:\1ffllxl.exe54⤵
- Executes dropped EXE
-
\??\c:\9bttnn.exec:\9bttnn.exe55⤵
- Executes dropped EXE
-
\??\c:\tnhhht.exec:\tnhhht.exe56⤵
- Executes dropped EXE
-
\??\c:\ddppd.exec:\ddppd.exe57⤵
- Executes dropped EXE
-
\??\c:\5xrrxxx.exec:\5xrrxxx.exe58⤵
- Executes dropped EXE
-
\??\c:\tnbhtt.exec:\tnbhtt.exe59⤵
- Executes dropped EXE
-
\??\c:\7tbhht.exec:\7tbhht.exe60⤵
- Executes dropped EXE
-
\??\c:\1jvdv.exec:\1jvdv.exe61⤵
- Executes dropped EXE
-
\??\c:\lxrlxxx.exec:\lxrlxxx.exe62⤵
- Executes dropped EXE
-
\??\c:\rrflflr.exec:\rrflflr.exe63⤵
- Executes dropped EXE
-
\??\c:\tnhnhn.exec:\tnhnhn.exe64⤵
- Executes dropped EXE
-
\??\c:\9jvdd.exec:\9jvdd.exe65⤵
- Executes dropped EXE
-
\??\c:\5ppvj.exec:\5ppvj.exe66⤵
-
\??\c:\3llxlxx.exec:\3llxlxx.exe67⤵
-
\??\c:\nnnthh.exec:\nnnthh.exe68⤵
-
\??\c:\hnhbnt.exec:\hnhbnt.exe69⤵
-
\??\c:\pjvpd.exec:\pjvpd.exe70⤵
-
\??\c:\9fxlxxr.exec:\9fxlxxr.exe71⤵
-
\??\c:\5nbntt.exec:\5nbntt.exe72⤵
-
\??\c:\hhnttt.exec:\hhnttt.exe73⤵
-
\??\c:\jjvjv.exec:\jjvjv.exe74⤵
-
\??\c:\7rfxxrx.exec:\7rfxxrx.exe75⤵
-
\??\c:\lrlrflr.exec:\lrlrflr.exe76⤵
-
\??\c:\5bbttt.exec:\5bbttt.exe77⤵
-
\??\c:\5ppjp.exec:\5ppjp.exe78⤵
-
\??\c:\pjpdp.exec:\pjpdp.exe79⤵
-
\??\c:\9xxfrxf.exec:\9xxfrxf.exe80⤵
-
\??\c:\1ntbhh.exec:\1ntbhh.exe81⤵
-
\??\c:\btbhnt.exec:\btbhnt.exe82⤵
-
\??\c:\dvdpv.exec:\dvdpv.exe83⤵
-
\??\c:\jjdjj.exec:\jjdjj.exe84⤵
-
\??\c:\frllfxl.exec:\frllfxl.exe85⤵
-
\??\c:\hbttht.exec:\hbttht.exe86⤵
-
\??\c:\nbnhtb.exec:\nbnhtb.exe87⤵
-
\??\c:\pjdvd.exec:\pjdvd.exe88⤵
-
\??\c:\xxlxlrf.exec:\xxlxlrf.exe89⤵
-
\??\c:\frfllrr.exec:\frfllrr.exe90⤵
-
\??\c:\5bnttb.exec:\5bnttb.exe91⤵
-
\??\c:\jvjvv.exec:\jvjvv.exe92⤵
-
\??\c:\vvjdd.exec:\vvjdd.exe93⤵
-
\??\c:\5fxfrrx.exec:\5fxfrrx.exe94⤵
-
\??\c:\nhnnht.exec:\nhnnht.exe95⤵
-
\??\c:\7nbhnn.exec:\7nbhnn.exe96⤵
-
\??\c:\5vddj.exec:\5vddj.exe97⤵
-
\??\c:\xlflxxf.exec:\xlflxxf.exe98⤵
-
\??\c:\rxrrllx.exec:\rxrrllx.exe99⤵
-
\??\c:\tntbhn.exec:\tntbhn.exe100⤵
-
\??\c:\ddddv.exec:\ddddv.exe101⤵
-
\??\c:\3vppv.exec:\3vppv.exe102⤵
-
\??\c:\lllrfrl.exec:\lllrfrl.exe103⤵
-
\??\c:\9hthbb.exec:\9hthbb.exe104⤵
-
\??\c:\ttntbh.exec:\ttntbh.exe105⤵
-
\??\c:\7vjjp.exec:\7vjjp.exe106⤵
-
\??\c:\rfxxlfr.exec:\rfxxlfr.exe107⤵
-
\??\c:\rrrrlrl.exec:\rrrrlrl.exe108⤵
-
\??\c:\hbnbhn.exec:\hbnbhn.exe109⤵
-
\??\c:\1tnbbn.exec:\1tnbbn.exe110⤵
-
\??\c:\vvjjd.exec:\vvjjd.exe111⤵
-
\??\c:\rlxrlxl.exec:\rlxrlxl.exe112⤵
-
\??\c:\7xfxflr.exec:\7xfxflr.exe113⤵
-
\??\c:\nhnthb.exec:\nhnthb.exe114⤵
-
\??\c:\pjjjp.exec:\pjjjp.exe115⤵
-
\??\c:\1dvdd.exec:\1dvdd.exe116⤵
-
\??\c:\flxrrff.exec:\flxrrff.exe117⤵
-
\??\c:\hbbbbb.exec:\hbbbbb.exe118⤵
-
\??\c:\htntnt.exec:\htntnt.exe119⤵
-
\??\c:\djjjv.exec:\djjjv.exe120⤵
-
\??\c:\rrflxxf.exec:\rrflxxf.exe121⤵
-
\??\c:\5rfxfxf.exec:\5rfxfxf.exe122⤵
-
\??\c:\1bttbt.exec:\1bttbt.exe123⤵
-
\??\c:\btnnbh.exec:\btnnbh.exe124⤵
-
\??\c:\1pdpj.exec:\1pdpj.exe125⤵
-
\??\c:\rfxfffl.exec:\rfxfffl.exe126⤵
-
\??\c:\ffrfrxf.exec:\ffrfrxf.exe127⤵
-
\??\c:\btnthb.exec:\btnthb.exe128⤵
-
\??\c:\9bbttb.exec:\9bbttb.exe129⤵
-
\??\c:\9jjvj.exec:\9jjvj.exe130⤵
-
\??\c:\rfxflrf.exec:\rfxflrf.exe131⤵
-
\??\c:\1bnnht.exec:\1bnnht.exe132⤵
-
\??\c:\hbnbnt.exec:\hbnbnt.exe133⤵
-
\??\c:\vvppd.exec:\vvppd.exe134⤵
-
\??\c:\ddppv.exec:\ddppv.exe135⤵
-
\??\c:\fffllfx.exec:\fffllfx.exe136⤵
-
\??\c:\3xrxrrx.exec:\3xrxrrx.exe137⤵
-
\??\c:\nbtbnt.exec:\nbtbnt.exe138⤵
-
\??\c:\7dvvd.exec:\7dvvd.exe139⤵
-
\??\c:\5vppp.exec:\5vppp.exe140⤵
-
\??\c:\lfflxlr.exec:\lfflxlr.exe141⤵
-
\??\c:\ddvdd.exec:\ddvdd.exe142⤵
-
\??\c:\vpjpj.exec:\vpjpj.exe143⤵
-
\??\c:\rllrflf.exec:\rllrflf.exe144⤵
-
\??\c:\1nhnnt.exec:\1nhnnt.exe145⤵
-
\??\c:\bnhtbb.exec:\bnhtbb.exe146⤵
-
\??\c:\ppjdj.exec:\ppjdj.exe147⤵
-
\??\c:\rlffrrx.exec:\rlffrrx.exe148⤵
-
\??\c:\ttnnbb.exec:\ttnnbb.exe149⤵
-
\??\c:\pdjpv.exec:\pdjpv.exe150⤵
-
\??\c:\rfffxxl.exec:\rfffxxl.exe151⤵
-
\??\c:\7flfllx.exec:\7flfllx.exe152⤵
-
\??\c:\btnhbh.exec:\btnhbh.exe153⤵
-
\??\c:\7pvjd.exec:\7pvjd.exe154⤵
-
\??\c:\5ppvv.exec:\5ppvv.exe155⤵
-
\??\c:\5xxxfxl.exec:\5xxxfxl.exe156⤵
-
\??\c:\bthntn.exec:\bthntn.exe157⤵
-
\??\c:\nbntbb.exec:\nbntbb.exe158⤵
-
\??\c:\vvvjv.exec:\vvvjv.exe159⤵
-
\??\c:\rflxfff.exec:\rflxfff.exe160⤵
-
\??\c:\lfllllr.exec:\lfllllr.exe161⤵
-
\??\c:\bnbbhb.exec:\bnbbhb.exe162⤵
-
\??\c:\btbbnt.exec:\btbbnt.exe163⤵
-
\??\c:\pjjjv.exec:\pjjjv.exe164⤵
-
\??\c:\xrlfrrr.exec:\xrlfrrr.exe165⤵
-
\??\c:\lfrrfxf.exec:\lfrrfxf.exe166⤵
-
\??\c:\nhttnt.exec:\nhttnt.exe167⤵
-
\??\c:\hbhhhh.exec:\hbhhhh.exe168⤵
-
\??\c:\dvpvd.exec:\dvpvd.exe169⤵
-
\??\c:\frrlrrx.exec:\frrlrrx.exe170⤵
-
\??\c:\frlflrx.exec:\frlflrx.exe171⤵
-
\??\c:\1hnttt.exec:\1hnttt.exe172⤵
-
\??\c:\htbttn.exec:\htbttn.exe173⤵
-
\??\c:\jdjpd.exec:\jdjpd.exe174⤵
-
\??\c:\vpvdj.exec:\vpvdj.exe175⤵
-
\??\c:\lfxlffr.exec:\lfxlffr.exe176⤵
-
\??\c:\xrllxfl.exec:\xrllxfl.exe177⤵
-
\??\c:\1btbbt.exec:\1btbbt.exe178⤵
-
\??\c:\7hthhn.exec:\7hthhn.exe179⤵
-
\??\c:\pjpvd.exec:\pjpvd.exe180⤵
-
\??\c:\5jjpd.exec:\5jjpd.exe181⤵
-
\??\c:\xrxxlfl.exec:\xrxxlfl.exe182⤵
-
\??\c:\hbtntn.exec:\hbtntn.exe183⤵
-
\??\c:\thtbhh.exec:\thtbhh.exe184⤵
-
\??\c:\5jdjp.exec:\5jdjp.exe185⤵
-
\??\c:\pjvjp.exec:\pjvjp.exe186⤵
-
\??\c:\1rffffl.exec:\1rffffl.exe187⤵
-
\??\c:\nhnnbh.exec:\nhnnbh.exe188⤵
-
\??\c:\nnhnbn.exec:\nnhnbn.exe189⤵
-
\??\c:\nhbbnb.exec:\nhbbnb.exe190⤵
-
\??\c:\jdpdp.exec:\jdpdp.exe191⤵
-
\??\c:\3rfllrl.exec:\3rfllrl.exe192⤵
-
\??\c:\3xxxxfx.exec:\3xxxxfx.exe193⤵
-
\??\c:\bhthnh.exec:\bhthnh.exe194⤵
-
\??\c:\thtbhh.exec:\thtbhh.exe195⤵
-
\??\c:\9dpjj.exec:\9dpjj.exe196⤵
-
\??\c:\dvvdd.exec:\dvvdd.exe197⤵
-
\??\c:\1rfflrl.exec:\1rfflrl.exe198⤵
-
\??\c:\nhbhhn.exec:\nhbhhn.exe199⤵
-
\??\c:\hhthbn.exec:\hhthbn.exe200⤵
-
\??\c:\3vvjv.exec:\3vvjv.exe201⤵
-
\??\c:\vvjvd.exec:\vvjvd.exe202⤵
-
\??\c:\rfrxffl.exec:\rfrxffl.exe203⤵
-
\??\c:\5thhhb.exec:\5thhhb.exe204⤵
-
\??\c:\tthbtt.exec:\tthbtt.exe205⤵
-
\??\c:\ddpdp.exec:\ddpdp.exe206⤵
-
\??\c:\1dvjp.exec:\1dvjp.exe207⤵
-
\??\c:\3lxflll.exec:\3lxflll.exe208⤵
-
\??\c:\5tthnn.exec:\5tthnn.exe209⤵
-
\??\c:\hbnnhh.exec:\hbnnhh.exe210⤵
-
\??\c:\dvdjp.exec:\dvdjp.exe211⤵
-
\??\c:\1vpjj.exec:\1vpjj.exe212⤵
-
\??\c:\xlfrflr.exec:\xlfrflr.exe213⤵
-
\??\c:\fxxfffl.exec:\fxxfffl.exe214⤵
-
\??\c:\tnbhnt.exec:\tnbhnt.exe215⤵
-
\??\c:\7jvvd.exec:\7jvvd.exe216⤵
-
\??\c:\ppdvj.exec:\ppdvj.exe217⤵
-
\??\c:\rffrrrf.exec:\rffrrrf.exe218⤵
-
\??\c:\7lxfrrr.exec:\7lxfrrr.exe219⤵
-
\??\c:\nthhbb.exec:\nthhbb.exe220⤵
-
\??\c:\btbbnt.exec:\btbbnt.exe221⤵
-
\??\c:\pddvp.exec:\pddvp.exe222⤵
-
\??\c:\xfrlrll.exec:\xfrlrll.exe223⤵
-
\??\c:\rlfrxxf.exec:\rlfrxxf.exe224⤵
-
\??\c:\9tnntn.exec:\9tnntn.exe225⤵
-
\??\c:\bhttnn.exec:\bhttnn.exe226⤵
-
\??\c:\jvpjp.exec:\jvpjp.exe227⤵
-
\??\c:\1jjjd.exec:\1jjjd.exe228⤵
-
\??\c:\1lxfxxx.exec:\1lxfxxx.exe229⤵
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe230⤵
-
\??\c:\5bnbhh.exec:\5bnbhh.exe231⤵
-
\??\c:\bnbtbb.exec:\bnbtbb.exe232⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe233⤵
-
\??\c:\jdjdv.exec:\jdjdv.exe234⤵
-
\??\c:\frxlrrx.exec:\frxlrrx.exe235⤵
-
\??\c:\frrrxxf.exec:\frrrxxf.exe236⤵
-
\??\c:\httnhh.exec:\httnhh.exe237⤵
-
\??\c:\3jjjp.exec:\3jjjp.exe238⤵
-
\??\c:\jpppv.exec:\jpppv.exe239⤵
-
\??\c:\7xxxrrr.exec:\7xxxrrr.exe240⤵
-
\??\c:\rxfffxx.exec:\rxfffxx.exe241⤵