Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 18:51
Behavioral task
behavioral1
Sample
6988e26cb1a2b99968301742db4cb230_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
6988e26cb1a2b99968301742db4cb230_NeikiAnalytics.exe
-
Size
273KB
-
MD5
6988e26cb1a2b99968301742db4cb230
-
SHA1
984ea435853848745b77be55ad0b9cf4f6cb4337
-
SHA256
0e60b37cb2a6e95760ceeb01c5909a247489f5a0a9540a40b263da4ca058d0f0
-
SHA512
27700d372444ab4c582c0a8118226b53fbaa9d827731087578096e01bf0a131c80149bea34fb2e7175b6d9d9a87100fa749c4202de2c9f5d99e842e67b918da7
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBuItR8pTsg8QO6GIouixsp+CvM56ATgLa:9cm4FmowdHoS4BftapTs8Hoo+6MjTVVZ
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
Processes:
resource yara_rule behavioral1/memory/1920-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1572-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1440-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1460-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1144-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1244-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-589-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-621-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1572-926-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/780-1307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1264-989-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-688-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2320-654-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-648-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-624-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1304-575-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1456-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1456-492-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1244-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/940-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1260-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1020-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1684-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/996-1375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-1466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lxffflf.exepjdjv.exeppvpd.exe3rfxlxr.exeffffllf.exennhnnn.exe3pjpj.exepjdvv.exe5xrrfrx.exe1rlxlxf.exehnbbnb.exejdvdp.exepjdjp.exelfffllf.exenhbnth.exenhbhnn.exe5pjvj.exexfxlxxr.exerrlxrxl.exe7httth.exeddvpj.exe9ppvd.exe9lxxflr.exe5nbbnb.exenhtthn.exeddvjv.exexxllfxf.exe7hhhth.exe9hbhbn.exevvjpv.exefxllrrx.exexrrfrfx.exe1nhntb.exedvjpv.exerrlrxff.exe9bnbnn.exethbhbb.exe9pjdj.exelfxxllr.exe5fxlxff.exe9btbnn.exe1btttb.exedvpdp.exejdpvd.exerrxflfl.exefrfrxfr.exenhbbnn.exejdpdp.exejvppv.exe1rflxxx.exe5xrrxfl.exe1tnbth.exentnntt.exe9dvpv.exerlfrllx.exexrfflrl.exebtntbb.exe5bnntt.exejjpvp.exerfllrlx.exe1rlfrrx.exe3tbbbh.exetnbttn.exe1dppv.exepid process 3040 lxffflf.exe 2568 pjdjv.exe 2612 ppvpd.exe 2756 3rfxlxr.exe 2724 ffffllf.exe 2524 nnhnnn.exe 2432 3pjpj.exe 2840 pjdvv.exe 2180 5xrrfrx.exe 1572 1rlxlxf.exe 1440 hnbbnb.exe 1684 jdvdp.exe 1460 pjdjp.exe 1020 lfffllf.exe 2324 nhbnth.exe 1648 nhbhnn.exe 1260 5pjvj.exe 3036 xfxlxxr.exe 2240 rrlxrxl.exe 2508 7httth.exe 2060 ddvpj.exe 676 9ppvd.exe 1428 9lxxflr.exe 1768 5nbbnb.exe 1144 nhtthn.exe 1612 ddvjv.exe 940 xxllfxf.exe 1244 7hhhth.exe 3016 9hbhbn.exe 2992 vvjpv.exe 2976 fxllrrx.exe 2044 xrrfrfx.exe 2344 1nhntb.exe 1996 dvjpv.exe 1704 rrlrxff.exe 2628 9bnbnn.exe 2516 thbhbb.exe 2644 9pjdj.exe 2756 lfxxllr.exe 2736 5fxlxff.exe 2524 9btbnn.exe 3020 1btttb.exe 884 dvpdp.exe 2340 jdpvd.exe 1476 rrxflfl.exe 636 frfrxfr.exe 1624 nhbbnn.exe 2420 jdpdp.exe 1776 jvppv.exe 284 1rflxxx.exe 2328 5xrrxfl.exe 844 1tnbth.exe 2484 ntnntt.exe 1952 9dvpv.exe 2452 rlfrllx.exe 2828 xrfflrl.exe 1960 btntbb.exe 780 5bnntt.exe 2308 jjpvp.exe 676 rfllrlx.exe 656 1rlfrrx.exe 1724 3tbbbh.exe 388 tnbttn.exe 1456 1dppv.exe -
Processes:
resource yara_rule behavioral1/memory/1920-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1920-3-0x00000000002A0000-0x00000000002C7000-memory.dmp upx behavioral1/memory/1920-8-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxffflf.exe upx behavioral1/memory/3040-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2568-20-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ppvpd.exe upx \??\c:\3rfxlxr.exe upx \??\c:\nnhnnn.exe upx C:\3pjpj.exe upx \??\c:\1rlxlxf.exe upx behavioral1/memory/1572-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1440-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1460-125-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhbhnn.exe upx C:\rrlxrxl.exe upx behavioral1/memory/2508-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2060-199-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9ppvd.exe upx \??\c:\9lxxflr.exe upx behavioral1/memory/1144-225-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xxllfxf.exe upx behavioral1/memory/1244-252-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxllrrx.exe upx behavioral1/memory/3016-526-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2980-589-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2836-621-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/280-715-0x00000000003A0000-0x00000000003C7000-memory.dmp upx behavioral1/memory/2064-732-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1028-808-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2056-872-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1572-926-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2372-957-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2576-970-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-1157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2500-1293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/780-1307-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1236-1262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1752-1255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1016-1226-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2976-1089-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1284-1046-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/572-1014-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1264-989-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1652-907-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2056-869-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1820-765-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1124-745-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2536-681-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/280-667-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2320-654-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2480-648-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2460-602-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1304-575-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2016-512-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1456-499-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1456-492-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1960-449-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2828-442-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1952-429-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/884-362-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-337-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2628-324-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2628-317-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6988e26cb1a2b99968301742db4cb230_NeikiAnalytics.exelxffflf.exepjdjv.exeppvpd.exe3rfxlxr.exeffffllf.exennhnnn.exe3pjpj.exepjdvv.exe5xrrfrx.exe1rlxlxf.exehnbbnb.exejdvdp.exepjdjp.exelfffllf.exenhbnth.exedescription pid process target process PID 1920 wrote to memory of 3040 1920 6988e26cb1a2b99968301742db4cb230_NeikiAnalytics.exe lxffflf.exe PID 1920 wrote to memory of 3040 1920 6988e26cb1a2b99968301742db4cb230_NeikiAnalytics.exe lxffflf.exe PID 1920 wrote to memory of 3040 1920 6988e26cb1a2b99968301742db4cb230_NeikiAnalytics.exe lxffflf.exe PID 1920 wrote to memory of 3040 1920 6988e26cb1a2b99968301742db4cb230_NeikiAnalytics.exe lxffflf.exe PID 3040 wrote to memory of 2568 3040 lxffflf.exe pjdjv.exe PID 3040 wrote to memory of 2568 3040 lxffflf.exe pjdjv.exe PID 3040 wrote to memory of 2568 3040 lxffflf.exe pjdjv.exe PID 3040 wrote to memory of 2568 3040 lxffflf.exe pjdjv.exe PID 2568 wrote to memory of 2612 2568 pjdjv.exe ppvpd.exe PID 2568 wrote to memory of 2612 2568 pjdjv.exe ppvpd.exe PID 2568 wrote to memory of 2612 2568 pjdjv.exe ppvpd.exe PID 2568 wrote to memory of 2612 2568 pjdjv.exe ppvpd.exe PID 2612 wrote to memory of 2756 2612 ppvpd.exe 3rfxlxr.exe PID 2612 wrote to memory of 2756 2612 ppvpd.exe 3rfxlxr.exe PID 2612 wrote to memory of 2756 2612 ppvpd.exe 3rfxlxr.exe PID 2612 wrote to memory of 2756 2612 ppvpd.exe 3rfxlxr.exe PID 2756 wrote to memory of 2724 2756 3rfxlxr.exe ffffllf.exe PID 2756 wrote to memory of 2724 2756 3rfxlxr.exe ffffllf.exe PID 2756 wrote to memory of 2724 2756 3rfxlxr.exe ffffllf.exe PID 2756 wrote to memory of 2724 2756 3rfxlxr.exe ffffllf.exe PID 2724 wrote to memory of 2524 2724 ffffllf.exe nnhnnn.exe PID 2724 wrote to memory of 2524 2724 ffffllf.exe nnhnnn.exe PID 2724 wrote to memory of 2524 2724 ffffllf.exe nnhnnn.exe PID 2724 wrote to memory of 2524 2724 ffffllf.exe nnhnnn.exe PID 2524 wrote to memory of 2432 2524 nnhnnn.exe 3pjpj.exe PID 2524 wrote to memory of 2432 2524 nnhnnn.exe 3pjpj.exe PID 2524 wrote to memory of 2432 2524 nnhnnn.exe 3pjpj.exe PID 2524 wrote to memory of 2432 2524 nnhnnn.exe 3pjpj.exe PID 2432 wrote to memory of 2840 2432 3pjpj.exe pjdvv.exe PID 2432 wrote to memory of 2840 2432 3pjpj.exe pjdvv.exe PID 2432 wrote to memory of 2840 2432 3pjpj.exe pjdvv.exe PID 2432 wrote to memory of 2840 2432 3pjpj.exe pjdvv.exe PID 2840 wrote to memory of 2180 2840 pjdvv.exe 5xrrfrx.exe PID 2840 wrote to memory of 2180 2840 pjdvv.exe 5xrrfrx.exe PID 2840 wrote to memory of 2180 2840 pjdvv.exe 5xrrfrx.exe PID 2840 wrote to memory of 2180 2840 pjdvv.exe 5xrrfrx.exe PID 2180 wrote to memory of 1572 2180 5xrrfrx.exe 1rlxlxf.exe PID 2180 wrote to memory of 1572 2180 5xrrfrx.exe 1rlxlxf.exe PID 2180 wrote to memory of 1572 2180 5xrrfrx.exe 1rlxlxf.exe PID 2180 wrote to memory of 1572 2180 5xrrfrx.exe 1rlxlxf.exe PID 1572 wrote to memory of 1440 1572 1rlxlxf.exe hnbbnb.exe PID 1572 wrote to memory of 1440 1572 1rlxlxf.exe hnbbnb.exe PID 1572 wrote to memory of 1440 1572 1rlxlxf.exe hnbbnb.exe PID 1572 wrote to memory of 1440 1572 1rlxlxf.exe hnbbnb.exe PID 1440 wrote to memory of 1684 1440 hnbbnb.exe jdvdp.exe PID 1440 wrote to memory of 1684 1440 hnbbnb.exe jdvdp.exe PID 1440 wrote to memory of 1684 1440 hnbbnb.exe jdvdp.exe PID 1440 wrote to memory of 1684 1440 hnbbnb.exe jdvdp.exe PID 1684 wrote to memory of 1460 1684 jdvdp.exe pjdjp.exe PID 1684 wrote to memory of 1460 1684 jdvdp.exe pjdjp.exe PID 1684 wrote to memory of 1460 1684 jdvdp.exe pjdjp.exe PID 1684 wrote to memory of 1460 1684 jdvdp.exe pjdjp.exe PID 1460 wrote to memory of 1020 1460 pjdjp.exe lfffllf.exe PID 1460 wrote to memory of 1020 1460 pjdjp.exe lfffllf.exe PID 1460 wrote to memory of 1020 1460 pjdjp.exe lfffllf.exe PID 1460 wrote to memory of 1020 1460 pjdjp.exe lfffllf.exe PID 1020 wrote to memory of 2324 1020 lfffllf.exe nhbnth.exe PID 1020 wrote to memory of 2324 1020 lfffllf.exe nhbnth.exe PID 1020 wrote to memory of 2324 1020 lfffllf.exe nhbnth.exe PID 1020 wrote to memory of 2324 1020 lfffllf.exe nhbnth.exe PID 2324 wrote to memory of 1648 2324 nhbnth.exe nhbhnn.exe PID 2324 wrote to memory of 1648 2324 nhbnth.exe nhbhnn.exe PID 2324 wrote to memory of 1648 2324 nhbnth.exe nhbhnn.exe PID 2324 wrote to memory of 1648 2324 nhbnth.exe nhbhnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6988e26cb1a2b99968301742db4cb230_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6988e26cb1a2b99968301742db4cb230_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\lxffflf.exec:\lxffflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjdjv.exec:\pjdjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppvpd.exec:\ppvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3rfxlxr.exec:\3rfxlxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffffllf.exec:\ffffllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhnnn.exec:\nnhnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3pjpj.exec:\3pjpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjdvv.exec:\pjdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5xrrfrx.exec:\5xrrfrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1rlxlxf.exec:\1rlxlxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnbbnb.exec:\hnbbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvdp.exec:\jdvdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjdjp.exec:\pjdjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfffllf.exec:\lfffllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbnth.exec:\nhbnth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbhnn.exec:\nhbhnn.exe17⤵
- Executes dropped EXE
-
\??\c:\5pjvj.exec:\5pjvj.exe18⤵
- Executes dropped EXE
-
\??\c:\xfxlxxr.exec:\xfxlxxr.exe19⤵
- Executes dropped EXE
-
\??\c:\rrlxrxl.exec:\rrlxrxl.exe20⤵
- Executes dropped EXE
-
\??\c:\7httth.exec:\7httth.exe21⤵
- Executes dropped EXE
-
\??\c:\ddvpj.exec:\ddvpj.exe22⤵
- Executes dropped EXE
-
\??\c:\9ppvd.exec:\9ppvd.exe23⤵
- Executes dropped EXE
-
\??\c:\9lxxflr.exec:\9lxxflr.exe24⤵
- Executes dropped EXE
-
\??\c:\5nbbnb.exec:\5nbbnb.exe25⤵
- Executes dropped EXE
-
\??\c:\nhtthn.exec:\nhtthn.exe26⤵
- Executes dropped EXE
-
\??\c:\ddvjv.exec:\ddvjv.exe27⤵
- Executes dropped EXE
-
\??\c:\xxllfxf.exec:\xxllfxf.exe28⤵
- Executes dropped EXE
-
\??\c:\7hhhth.exec:\7hhhth.exe29⤵
- Executes dropped EXE
-
\??\c:\9hbhbn.exec:\9hbhbn.exe30⤵
- Executes dropped EXE
-
\??\c:\vvjpv.exec:\vvjpv.exe31⤵
- Executes dropped EXE
-
\??\c:\fxllrrx.exec:\fxllrrx.exe32⤵
- Executes dropped EXE
-
\??\c:\xrrfrfx.exec:\xrrfrfx.exe33⤵
- Executes dropped EXE
-
\??\c:\1nhntb.exec:\1nhntb.exe34⤵
- Executes dropped EXE
-
\??\c:\dvjpv.exec:\dvjpv.exe35⤵
- Executes dropped EXE
-
\??\c:\7xffxff.exec:\7xffxff.exe36⤵
-
\??\c:\rrlrxff.exec:\rrlrxff.exe37⤵
- Executes dropped EXE
-
\??\c:\9bnbnn.exec:\9bnbnn.exe38⤵
- Executes dropped EXE
-
\??\c:\thbhbb.exec:\thbhbb.exe39⤵
- Executes dropped EXE
-
\??\c:\9pjdj.exec:\9pjdj.exe40⤵
- Executes dropped EXE
-
\??\c:\lfxxllr.exec:\lfxxllr.exe41⤵
- Executes dropped EXE
-
\??\c:\5fxlxff.exec:\5fxlxff.exe42⤵
- Executes dropped EXE
-
\??\c:\9btbnn.exec:\9btbnn.exe43⤵
- Executes dropped EXE
-
\??\c:\1btttb.exec:\1btttb.exe44⤵
- Executes dropped EXE
-
\??\c:\dvpdp.exec:\dvpdp.exe45⤵
- Executes dropped EXE
-
\??\c:\jdpvd.exec:\jdpvd.exe46⤵
- Executes dropped EXE
-
\??\c:\rrxflfl.exec:\rrxflfl.exe47⤵
- Executes dropped EXE
-
\??\c:\frfrxfr.exec:\frfrxfr.exe48⤵
- Executes dropped EXE
-
\??\c:\nhbbnn.exec:\nhbbnn.exe49⤵
- Executes dropped EXE
-
\??\c:\jdpdp.exec:\jdpdp.exe50⤵
- Executes dropped EXE
-
\??\c:\jvppv.exec:\jvppv.exe51⤵
- Executes dropped EXE
-
\??\c:\1rflxxx.exec:\1rflxxx.exe52⤵
- Executes dropped EXE
-
\??\c:\5xrrxfl.exec:\5xrrxfl.exe53⤵
- Executes dropped EXE
-
\??\c:\1tnbth.exec:\1tnbth.exe54⤵
- Executes dropped EXE
-
\??\c:\ntnntt.exec:\ntnntt.exe55⤵
- Executes dropped EXE
-
\??\c:\9dvpv.exec:\9dvpv.exe56⤵
- Executes dropped EXE
-
\??\c:\rlfrllx.exec:\rlfrllx.exe57⤵
- Executes dropped EXE
-
\??\c:\xrfflrl.exec:\xrfflrl.exe58⤵
- Executes dropped EXE
-
\??\c:\btntbb.exec:\btntbb.exe59⤵
- Executes dropped EXE
-
\??\c:\5bnntt.exec:\5bnntt.exe60⤵
- Executes dropped EXE
-
\??\c:\jjpvp.exec:\jjpvp.exe61⤵
- Executes dropped EXE
-
\??\c:\rfllrlx.exec:\rfllrlx.exe62⤵
- Executes dropped EXE
-
\??\c:\1rlfrrx.exec:\1rlfrrx.exe63⤵
- Executes dropped EXE
-
\??\c:\3tbbbh.exec:\3tbbbh.exe64⤵
- Executes dropped EXE
-
\??\c:\tnbttn.exec:\tnbttn.exe65⤵
- Executes dropped EXE
-
\??\c:\1dppv.exec:\1dppv.exe66⤵
- Executes dropped EXE
-
\??\c:\lxffrrx.exec:\lxffrrx.exe67⤵
-
\??\c:\xrlrxff.exec:\xrlrxff.exe68⤵
-
\??\c:\hbbhtt.exec:\hbbhtt.exe69⤵
-
\??\c:\9ththn.exec:\9ththn.exe70⤵
-
\??\c:\dvdpp.exec:\dvdpp.exe71⤵
-
\??\c:\9dvjv.exec:\9dvjv.exe72⤵
-
\??\c:\ffxxlrx.exec:\ffxxlrx.exe73⤵
-
\??\c:\9lxxlrr.exec:\9lxxlrr.exe74⤵
-
\??\c:\bthbbb.exec:\bthbbb.exe75⤵
-
\??\c:\1nhhnt.exec:\1nhhnt.exe76⤵
-
\??\c:\vpddp.exec:\vpddp.exe77⤵
-
\??\c:\5vvdp.exec:\5vvdp.exe78⤵
-
\??\c:\lxllrrr.exec:\lxllrrr.exe79⤵
-
\??\c:\hthntt.exec:\hthntt.exe80⤵
-
\??\c:\tnbhnt.exec:\tnbhnt.exe81⤵
-
\??\c:\1jjpd.exec:\1jjpd.exe82⤵
-
\??\c:\7ppvv.exec:\7ppvv.exe83⤵
-
\??\c:\lfxflll.exec:\lfxflll.exe84⤵
-
\??\c:\1xlrxfr.exec:\1xlrxfr.exe85⤵
-
\??\c:\nhtnnh.exec:\nhtnnh.exe86⤵
-
\??\c:\bnhntt.exec:\bnhntt.exe87⤵
-
\??\c:\pjppv.exec:\pjppv.exe88⤵
-
\??\c:\9rffrlr.exec:\9rffrlr.exe89⤵
-
\??\c:\xlrrxrx.exec:\xlrrxrx.exe90⤵
-
\??\c:\tnbttn.exec:\tnbttn.exe91⤵
-
\??\c:\btnhbh.exec:\btnhbh.exe92⤵
-
\??\c:\jdpjp.exec:\jdpjp.exe93⤵
-
\??\c:\vpvdj.exec:\vpvdj.exe94⤵
-
\??\c:\7rlrlrr.exec:\7rlrlrr.exe95⤵
-
\??\c:\xrxlrxl.exec:\xrxlrxl.exe96⤵
-
\??\c:\bbtthh.exec:\bbtthh.exe97⤵
-
\??\c:\tnbnhh.exec:\tnbnhh.exe98⤵
-
\??\c:\3pjpv.exec:\3pjpv.exe99⤵
-
\??\c:\rfrflff.exec:\rfrflff.exe100⤵
-
\??\c:\5ffrrfr.exec:\5ffrrfr.exe101⤵
-
\??\c:\9nnthh.exec:\9nnthh.exe102⤵
-
\??\c:\1bbnnb.exec:\1bbnnb.exe103⤵
-
\??\c:\ppjvd.exec:\ppjvd.exe104⤵
-
\??\c:\djjpv.exec:\djjpv.exe105⤵
-
\??\c:\ffrxfrx.exec:\ffrxfrx.exe106⤵
-
\??\c:\nbnbtb.exec:\nbnbtb.exe107⤵
-
\??\c:\hbnhtn.exec:\hbnhtn.exe108⤵
-
\??\c:\9pjdj.exec:\9pjdj.exe109⤵
-
\??\c:\vvppd.exec:\vvppd.exe110⤵
-
\??\c:\9lffrrr.exec:\9lffrrr.exe111⤵
-
\??\c:\rffrrrx.exec:\rffrrrx.exe112⤵
-
\??\c:\5hhtnn.exec:\5hhtnn.exe113⤵
-
\??\c:\ttbthn.exec:\ttbthn.exe114⤵
-
\??\c:\jjvjd.exec:\jjvjd.exe115⤵
-
\??\c:\ppjpp.exec:\ppjpp.exe116⤵
-
\??\c:\fxlrfxl.exec:\fxlrfxl.exe117⤵
-
\??\c:\xrrrxxl.exec:\xrrrxxl.exe118⤵
-
\??\c:\1bnbnh.exec:\1bnbnh.exe119⤵
-
\??\c:\hbhnnt.exec:\hbhnnt.exe120⤵
-
\??\c:\vvvjj.exec:\vvvjj.exe121⤵
-
\??\c:\pjvvv.exec:\pjvvv.exe122⤵
-
\??\c:\fxlxrxx.exec:\fxlxrxx.exe123⤵
-
\??\c:\lfrfffl.exec:\lfrfffl.exe124⤵
-
\??\c:\nhbnhn.exec:\nhbnhn.exe125⤵
-
\??\c:\tnnbtb.exec:\tnnbtb.exe126⤵
-
\??\c:\ppjpj.exec:\ppjpj.exe127⤵
-
\??\c:\vjdjv.exec:\vjdjv.exe128⤵
-
\??\c:\xxrxxrx.exec:\xxrxxrx.exe129⤵
-
\??\c:\rlrxrrf.exec:\rlrxrrf.exe130⤵
-
\??\c:\1lrrrxr.exec:\1lrrrxr.exe131⤵
-
\??\c:\ththnh.exec:\ththnh.exe132⤵
-
\??\c:\hhbhhn.exec:\hhbhhn.exe133⤵
-
\??\c:\pdpvv.exec:\pdpvv.exe134⤵
-
\??\c:\5jdvd.exec:\5jdvd.exe135⤵
-
\??\c:\llflxfr.exec:\llflxfr.exe136⤵
-
\??\c:\rlflxxl.exec:\rlflxxl.exe137⤵
-
\??\c:\nnhbhn.exec:\nnhbhn.exe138⤵
-
\??\c:\5ntbhn.exec:\5ntbhn.exe139⤵
-
\??\c:\pdpvp.exec:\pdpvp.exe140⤵
-
\??\c:\5dpvv.exec:\5dpvv.exe141⤵
-
\??\c:\fffrrxf.exec:\fffrrxf.exe142⤵
-
\??\c:\lxrxfll.exec:\lxrxfll.exe143⤵
-
\??\c:\1btbhn.exec:\1btbhn.exe144⤵
-
\??\c:\nhbbbh.exec:\nhbbbh.exe145⤵
-
\??\c:\dpdpd.exec:\dpdpd.exe146⤵
-
\??\c:\5jpvd.exec:\5jpvd.exe147⤵
-
\??\c:\xllfrrx.exec:\xllfrrx.exe148⤵
-
\??\c:\5xrrxff.exec:\5xrrxff.exe149⤵
-
\??\c:\fxfllxx.exec:\fxfllxx.exe150⤵
-
\??\c:\9bhbhb.exec:\9bhbhb.exe151⤵
-
\??\c:\vpdvv.exec:\vpdvv.exe152⤵
-
\??\c:\vpddj.exec:\vpddj.exe153⤵
-
\??\c:\fxxlllx.exec:\fxxlllx.exe154⤵
-
\??\c:\rrflfll.exec:\rrflfll.exe155⤵
-
\??\c:\ttnhhn.exec:\ttnhhn.exe156⤵
-
\??\c:\5bhhbn.exec:\5bhhbn.exe157⤵
-
\??\c:\pvjjd.exec:\pvjjd.exe158⤵
-
\??\c:\dvdjj.exec:\dvdjj.exe159⤵
-
\??\c:\rlfxrlx.exec:\rlfxrlx.exe160⤵
-
\??\c:\rlrrfxl.exec:\rlrrfxl.exe161⤵
-
\??\c:\thtbhn.exec:\thtbhn.exe162⤵
-
\??\c:\bnbhtb.exec:\bnbhtb.exe163⤵
-
\??\c:\jdpvv.exec:\jdpvv.exe164⤵
-
\??\c:\jdjjp.exec:\jdjjp.exe165⤵
-
\??\c:\rfrxlrx.exec:\rfrxlrx.exe166⤵
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe167⤵
-
\??\c:\bbnntt.exec:\bbnntt.exe168⤵
-
\??\c:\nnhnbb.exec:\nnhnbb.exe169⤵
-
\??\c:\vvjvj.exec:\vvjvj.exe170⤵
-
\??\c:\dvdjj.exec:\dvdjj.exe171⤵
-
\??\c:\jjvvd.exec:\jjvvd.exe172⤵
-
\??\c:\frflrfx.exec:\frflrfx.exe173⤵
-
\??\c:\tnnbtb.exec:\tnnbtb.exe174⤵
-
\??\c:\nttnth.exec:\nttnth.exe175⤵
-
\??\c:\bthtbh.exec:\bthtbh.exe176⤵
-
\??\c:\vpjdj.exec:\vpjdj.exe177⤵
-
\??\c:\vppvv.exec:\vppvv.exe178⤵
-
\??\c:\7xllxll.exec:\7xllxll.exe179⤵
-
\??\c:\9lfrffr.exec:\9lfrffr.exe180⤵
-
\??\c:\bnbhnn.exec:\bnbhnn.exe181⤵
-
\??\c:\btntbh.exec:\btntbh.exe182⤵
-
\??\c:\dvvjp.exec:\dvvjp.exe183⤵
-
\??\c:\1vpdd.exec:\1vpdd.exe184⤵
-
\??\c:\7lflrfl.exec:\7lflrfl.exe185⤵
-
\??\c:\xlrxflx.exec:\xlrxflx.exe186⤵
-
\??\c:\5nnhtb.exec:\5nnhtb.exe187⤵
-
\??\c:\bbttbn.exec:\bbttbn.exe188⤵
-
\??\c:\dpdjd.exec:\dpdjd.exe189⤵
-
\??\c:\pdvvd.exec:\pdvvd.exe190⤵
-
\??\c:\3xxlfrl.exec:\3xxlfrl.exe191⤵
-
\??\c:\frxflrx.exec:\frxflrx.exe192⤵
-
\??\c:\nhnntt.exec:\nhnntt.exe193⤵
-
\??\c:\tnhnbb.exec:\tnhnbb.exe194⤵
-
\??\c:\pdpvv.exec:\pdpvv.exe195⤵
-
\??\c:\vjjdv.exec:\vjjdv.exe196⤵
-
\??\c:\3xfffll.exec:\3xfffll.exe197⤵
-
\??\c:\xrfrxrx.exec:\xrfrxrx.exe198⤵
-
\??\c:\nhttbh.exec:\nhttbh.exe199⤵
-
\??\c:\7xfxrrx.exec:\7xfxrrx.exe200⤵
-
\??\c:\hthttn.exec:\hthttn.exe201⤵
-
\??\c:\lfxlflx.exec:\lfxlflx.exe202⤵
-
\??\c:\bnntnh.exec:\bnntnh.exe203⤵
-
\??\c:\vpdvd.exec:\vpdvd.exe204⤵
-
\??\c:\hbbhhh.exec:\hbbhhh.exe205⤵
-
\??\c:\rlxfrfl.exec:\rlxfrfl.exe206⤵
-
\??\c:\1rxxfff.exec:\1rxxfff.exe207⤵
-
\??\c:\pjddp.exec:\pjddp.exe208⤵
-
\??\c:\pdvdd.exec:\pdvdd.exe209⤵
-
\??\c:\fxflfrf.exec:\fxflfrf.exe210⤵
-
\??\c:\hbttbt.exec:\hbttbt.exe211⤵
-
\??\c:\rrxlxfx.exec:\rrxlxfx.exe212⤵
-
\??\c:\bthhnb.exec:\bthhnb.exe213⤵
-
\??\c:\vdvdv.exec:\vdvdv.exe214⤵
-
\??\c:\xlrxxfl.exec:\xlrxxfl.exe215⤵
-
\??\c:\vpddd.exec:\vpddd.exe216⤵
-
\??\c:\fxlfxfl.exec:\fxlfxfl.exe217⤵
-
\??\c:\ddppv.exec:\ddppv.exe218⤵
-
\??\c:\rllrlxr.exec:\rllrlxr.exe219⤵
-
\??\c:\frxxllr.exec:\frxxllr.exe220⤵
-
\??\c:\nthbbb.exec:\nthbbb.exe221⤵
-
\??\c:\vjvdd.exec:\vjvdd.exe222⤵
-
\??\c:\1lfrlrx.exec:\1lfrlrx.exe223⤵
-
\??\c:\bttbhn.exec:\bttbhn.exe224⤵
-
\??\c:\pjvjd.exec:\pjvjd.exe225⤵
-
\??\c:\tnbbnn.exec:\tnbbnn.exe226⤵
-
\??\c:\9vjjd.exec:\9vjjd.exe227⤵
-
\??\c:\rxxxlff.exec:\rxxxlff.exe228⤵
-
\??\c:\pvvjj.exec:\pvvjj.exe229⤵
-
\??\c:\1jdvd.exec:\1jdvd.exe230⤵
-
\??\c:\3flfxrx.exec:\3flfxrx.exe231⤵
-
\??\c:\jdpvj.exec:\jdpvj.exe232⤵
-
\??\c:\3thbbb.exec:\3thbbb.exe233⤵
-
\??\c:\tnbbbh.exec:\tnbbbh.exe234⤵
-
\??\c:\lxrrxfl.exec:\lxrrxfl.exe235⤵
-
\??\c:\hbbthh.exec:\hbbthh.exe236⤵
-
\??\c:\1vjjp.exec:\1vjjp.exe237⤵
-
\??\c:\nthhnt.exec:\nthhnt.exe238⤵
-
\??\c:\pjjpp.exec:\pjjpp.exe239⤵
-
\??\c:\jvvvv.exec:\jvvvv.exe240⤵
-
\??\c:\xfxxxff.exec:\xfxxxff.exe241⤵