Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 19:39
Behavioral task
behavioral1
Sample
123b2faf7617c0b2948f3411fd76f3c0_NeikiAnalytics.exe
Resource
win7-20240220-en
General
-
Target
123b2faf7617c0b2948f3411fd76f3c0_NeikiAnalytics.exe
-
Size
253KB
-
MD5
123b2faf7617c0b2948f3411fd76f3c0
-
SHA1
12d6548df9e1f8c1275f307b64539502e5bd441e
-
SHA256
12a46cc515f1bf20b42e14ccb04b6afa0a6f6deebb3fcc6c0fd5e46605238907
-
SHA512
8880971ba0e3fcf7b9d976216ddf99d4c33af8be0ab1c9cb3dac65d0ec2b1e6fcddaaf79b06345258a3c15eb83fd0b6a265b1be19d7e9f46d3ea78abf49c741a
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+THk1:ccm4FmowdHoSi9EIBftapTs4WZazeE1X
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/2472-651-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2748-625-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1620-559-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/3068-552-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2908-539-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1516-532-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2120-469-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1872-442-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1260-411-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2828-368-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1964-305-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2292-298-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1672-291-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1072-276-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2084-273-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2084-266-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1516-239-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/336-208-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2928-206-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2728-191-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1616-188-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2808-172-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1220-170-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1776-122-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2332-120-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1576-102-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2584-84-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2416-68-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2660-66-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2448-57-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2540-47-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2652-38-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2888-20-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2856-11-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1664-9-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1512-767-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2316-960-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 33 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \??\c:\1xrxxxf.exe family_berbew \??\c:\pjjvj.exe family_berbew \??\c:\3hbhtb.exe family_berbew \??\c:\tthbnb.exe family_berbew \??\c:\lxfrflf.exe family_berbew \??\c:\9vpjp.exe family_berbew \??\c:\btbbbt.exe family_berbew \??\c:\7xxrfrf.exe family_berbew \??\c:\jjpvp.exe family_berbew \??\c:\9dvjd.exe family_berbew \??\c:\tbbtnh.exe family_berbew \??\c:\7xrxlrf.exe family_berbew \??\c:\7jdjv.exe family_berbew \??\c:\7thhtn.exe family_berbew \??\c:\lxrflxf.exe family_berbew \??\c:\rxrxxxr.exe family_berbew \??\c:\pvpdp.exe family_berbew \??\c:\7bthth.exe family_berbew \??\c:\lffflrr.exe family_berbew \??\c:\ddjvd.exe family_berbew \??\c:\jdvpp.exe family_berbew \??\c:\hhhttb.exe family_berbew behavioral1/memory/1576-101-0x0000000000220000-0x0000000000256000-memory.dmp family_berbew \??\c:\frxxlrx.exe family_berbew \??\c:\jdppd.exe family_berbew \??\c:\bhhhnn.exe family_berbew \??\c:\thnbtt.exe family_berbew \??\c:\xxrxflx.exe family_berbew \??\c:\7nthtb.exe family_berbew \??\c:\fflfrxl.exe family_berbew \??\c:\dpdvv.exe family_berbew \??\c:\1xxrxxf.exe family_berbew \??\c:\bbhtbn.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
bbhtbn.exe1xxrxxf.exedpdvv.exefflfrxl.exe7nthtb.exexxrxflx.exethnbtt.exebhhhnn.exejdppd.exefrxxlrx.exehhhttb.exejdvpp.exeddjvd.exelffflrr.exe7bthth.exepvpdp.exerxrxxxr.exelxrflxf.exe7thhtn.exe7jdjv.exe7xrxlrf.exetbbtnh.exe9dvjd.exejjpvp.exe7xxrfrf.exebtbbbt.exe9vpjp.exelxfrflf.exetthbnb.exe3hbhtb.exepjjvj.exe1xrxxxf.exettnttn.exevvpdp.exevvvjv.exellffxlf.exeffrfxlf.exevdvpj.exerrlfrxl.exerrlfxxr.exe9bbhbb.exejvdjp.exejdjpd.exe1llflxf.exe9flxfrr.exehbnbtt.exe9nnthn.exeppjvj.exevvdjv.exellfflrf.exelxllllx.exehhbthn.exepvpjd.exepjvdp.exexrlrflr.exelfrxrxl.exettnthn.exenthtbt.exeppvpp.exe1fxflrx.exe7lxfrxf.exebhhnbn.exebbttnt.exeddjvj.exepid process 2856 bbhtbn.exe 2888 1xxrxxf.exe 2652 dpdvv.exe 2540 fflfrxl.exe 2448 7nthtb.exe 2660 xxrxflx.exe 2416 thnbtt.exe 2584 bhhhnn.exe 2832 jdppd.exe 1576 frxxlrx.exe 2140 hhhttb.exe 2332 jdvpp.exe 1776 ddjvd.exe 2192 lffflrr.exe 1464 7bthth.exe 2476 pvpdp.exe 2164 rxrxxxr.exe 1220 lxrflxf.exe 2808 7thhtn.exe 1616 7jdjv.exe 2728 7xrxlrf.exe 2928 tbbtnh.exe 336 9dvjd.exe 1128 jjpvp.exe 2304 7xxrfrf.exe 1516 btbbbt.exe 1552 9vpjp.exe 776 lxfrflf.exe 996 tthbnb.exe 2084 3hbhtb.exe 1072 pjjvj.exe 1672 1xrxxxf.exe 2292 ttnttn.exe 1964 vvpdp.exe 2224 vvvjv.exe 2508 llffxlf.exe 2860 ffrfxlf.exe 2116 vdvpj.exe 2620 rrlfrxl.exe 2652 rrlfxxr.exe 2656 9bbhbb.exe 2724 jvdjp.exe 2448 jdjpd.exe 2432 1llflxf.exe 2828 9flxfrr.exe 2488 hbnbtt.exe 2156 9nnthn.exe 1564 ppjvj.exe 1656 vvdjv.exe 1196 llfflrf.exe 2140 lxllllx.exe 1260 hhbthn.exe 1456 pvpjd.exe 2328 pjvdp.exe 1512 xrlrflr.exe 1772 lfrxrxl.exe 1872 ttnthn.exe 848 nthtbt.exe 2452 ppvpp.exe 1692 1fxflrx.exe 2120 7lxfrxf.exe 1616 bhhnbn.exe 2112 bbttnt.exe 3028 ddjvj.exe -
Processes:
resource yara_rule behavioral1/memory/2332-702-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2160-677-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/memory/2124-658-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2472-651-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2748-625-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1504-599-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2012-586-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/896-573-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2100-566-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/3068-552-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2908-539-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1516-532-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1516-525-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/3028-488-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2120-469-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2452-456-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/848-449-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1872-442-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1260-411-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2140-404-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2828-368-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2508-312-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1964-305-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2292-298-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1672-291-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\1xrxxxf.exe upx behavioral1/memory/1072-276-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\pjjvj.exe upx behavioral1/memory/2084-273-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2084-266-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\3hbhtb.exe upx \??\c:\tthbnb.exe upx \??\c:\lxfrflf.exe upx \??\c:\9vpjp.exe upx behavioral1/memory/1516-239-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\btbbbt.exe upx \??\c:\7xxrfrf.exe upx \??\c:\jjpvp.exe upx behavioral1/memory/336-208-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\9dvjd.exe upx behavioral1/memory/2928-206-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\tbbtnh.exe upx behavioral1/memory/2728-191-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\7xrxlrf.exe upx behavioral1/memory/1616-188-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\7jdjv.exe upx behavioral1/memory/2808-172-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\7thhtn.exe upx behavioral1/memory/1220-170-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\lxrflxf.exe upx \??\c:\rxrxxxr.exe upx \??\c:\pvpdp.exe upx \??\c:\7bthth.exe upx \??\c:\lffflrr.exe upx behavioral1/memory/1776-122-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\ddjvd.exe upx behavioral1/memory/2332-120-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\jdvpp.exe upx \??\c:\hhhttb.exe upx behavioral1/memory/1576-102-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\frxxlrx.exe upx \??\c:\jdppd.exe upx behavioral1/memory/2832-85-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2584-84-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
123b2faf7617c0b2948f3411fd76f3c0_NeikiAnalytics.exebbhtbn.exe1xxrxxf.exedpdvv.exefflfrxl.exe7nthtb.exexxrxflx.exethnbtt.exebhhhnn.exejdppd.exefrxxlrx.exehhhttb.exejdvpp.exeddjvd.exelffflrr.exe7bthth.exedescription pid process target process PID 1664 wrote to memory of 2856 1664 123b2faf7617c0b2948f3411fd76f3c0_NeikiAnalytics.exe bbhtbn.exe PID 1664 wrote to memory of 2856 1664 123b2faf7617c0b2948f3411fd76f3c0_NeikiAnalytics.exe bbhtbn.exe PID 1664 wrote to memory of 2856 1664 123b2faf7617c0b2948f3411fd76f3c0_NeikiAnalytics.exe bbhtbn.exe PID 1664 wrote to memory of 2856 1664 123b2faf7617c0b2948f3411fd76f3c0_NeikiAnalytics.exe bbhtbn.exe PID 2856 wrote to memory of 2888 2856 bbhtbn.exe 1xxrxxf.exe PID 2856 wrote to memory of 2888 2856 bbhtbn.exe 1xxrxxf.exe PID 2856 wrote to memory of 2888 2856 bbhtbn.exe 1xxrxxf.exe PID 2856 wrote to memory of 2888 2856 bbhtbn.exe 1xxrxxf.exe PID 2888 wrote to memory of 2652 2888 1xxrxxf.exe dpdvv.exe PID 2888 wrote to memory of 2652 2888 1xxrxxf.exe dpdvv.exe PID 2888 wrote to memory of 2652 2888 1xxrxxf.exe dpdvv.exe PID 2888 wrote to memory of 2652 2888 1xxrxxf.exe dpdvv.exe PID 2652 wrote to memory of 2540 2652 dpdvv.exe fflfrxl.exe PID 2652 wrote to memory of 2540 2652 dpdvv.exe fflfrxl.exe PID 2652 wrote to memory of 2540 2652 dpdvv.exe fflfrxl.exe PID 2652 wrote to memory of 2540 2652 dpdvv.exe fflfrxl.exe PID 2540 wrote to memory of 2448 2540 fflfrxl.exe 7nthtb.exe PID 2540 wrote to memory of 2448 2540 fflfrxl.exe 7nthtb.exe PID 2540 wrote to memory of 2448 2540 fflfrxl.exe 7nthtb.exe PID 2540 wrote to memory of 2448 2540 fflfrxl.exe 7nthtb.exe PID 2448 wrote to memory of 2660 2448 7nthtb.exe xxrxflx.exe PID 2448 wrote to memory of 2660 2448 7nthtb.exe xxrxflx.exe PID 2448 wrote to memory of 2660 2448 7nthtb.exe xxrxflx.exe PID 2448 wrote to memory of 2660 2448 7nthtb.exe xxrxflx.exe PID 2660 wrote to memory of 2416 2660 xxrxflx.exe thnbtt.exe PID 2660 wrote to memory of 2416 2660 xxrxflx.exe thnbtt.exe PID 2660 wrote to memory of 2416 2660 xxrxflx.exe thnbtt.exe PID 2660 wrote to memory of 2416 2660 xxrxflx.exe thnbtt.exe PID 2416 wrote to memory of 2584 2416 thnbtt.exe bhhhnn.exe PID 2416 wrote to memory of 2584 2416 thnbtt.exe bhhhnn.exe PID 2416 wrote to memory of 2584 2416 thnbtt.exe bhhhnn.exe PID 2416 wrote to memory of 2584 2416 thnbtt.exe bhhhnn.exe PID 2584 wrote to memory of 2832 2584 bhhhnn.exe jdppd.exe PID 2584 wrote to memory of 2832 2584 bhhhnn.exe jdppd.exe PID 2584 wrote to memory of 2832 2584 bhhhnn.exe jdppd.exe PID 2584 wrote to memory of 2832 2584 bhhhnn.exe jdppd.exe PID 2832 wrote to memory of 1576 2832 jdppd.exe frxxlrx.exe PID 2832 wrote to memory of 1576 2832 jdppd.exe frxxlrx.exe PID 2832 wrote to memory of 1576 2832 jdppd.exe frxxlrx.exe PID 2832 wrote to memory of 1576 2832 jdppd.exe frxxlrx.exe PID 1576 wrote to memory of 2140 1576 frxxlrx.exe hhhttb.exe PID 1576 wrote to memory of 2140 1576 frxxlrx.exe hhhttb.exe PID 1576 wrote to memory of 2140 1576 frxxlrx.exe hhhttb.exe PID 1576 wrote to memory of 2140 1576 frxxlrx.exe hhhttb.exe PID 2140 wrote to memory of 2332 2140 hhhttb.exe jdvpp.exe PID 2140 wrote to memory of 2332 2140 hhhttb.exe jdvpp.exe PID 2140 wrote to memory of 2332 2140 hhhttb.exe jdvpp.exe PID 2140 wrote to memory of 2332 2140 hhhttb.exe jdvpp.exe PID 2332 wrote to memory of 1776 2332 jdvpp.exe ddjvd.exe PID 2332 wrote to memory of 1776 2332 jdvpp.exe ddjvd.exe PID 2332 wrote to memory of 1776 2332 jdvpp.exe ddjvd.exe PID 2332 wrote to memory of 1776 2332 jdvpp.exe ddjvd.exe PID 1776 wrote to memory of 2192 1776 ddjvd.exe lffflrr.exe PID 1776 wrote to memory of 2192 1776 ddjvd.exe lffflrr.exe PID 1776 wrote to memory of 2192 1776 ddjvd.exe lffflrr.exe PID 1776 wrote to memory of 2192 1776 ddjvd.exe lffflrr.exe PID 2192 wrote to memory of 1464 2192 lffflrr.exe 7bthth.exe PID 2192 wrote to memory of 1464 2192 lffflrr.exe 7bthth.exe PID 2192 wrote to memory of 1464 2192 lffflrr.exe 7bthth.exe PID 2192 wrote to memory of 1464 2192 lffflrr.exe 7bthth.exe PID 1464 wrote to memory of 2476 1464 7bthth.exe pvpdp.exe PID 1464 wrote to memory of 2476 1464 7bthth.exe pvpdp.exe PID 1464 wrote to memory of 2476 1464 7bthth.exe pvpdp.exe PID 1464 wrote to memory of 2476 1464 7bthth.exe pvpdp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\123b2faf7617c0b2948f3411fd76f3c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\123b2faf7617c0b2948f3411fd76f3c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\bbhtbn.exec:\bbhtbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1xxrxxf.exec:\1xxrxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpdvv.exec:\dpdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fflfrxl.exec:\fflfrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7nthtb.exec:\7nthtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxrxflx.exec:\xxrxflx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thnbtt.exec:\thnbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhhhnn.exec:\bhhhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdppd.exec:\jdppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frxxlrx.exec:\frxxlrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhttb.exec:\hhhttb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvpp.exec:\jdvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddjvd.exec:\ddjvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lffflrr.exec:\lffflrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7bthth.exec:\7bthth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvpdp.exec:\pvpdp.exe17⤵
- Executes dropped EXE
-
\??\c:\rxrxxxr.exec:\rxrxxxr.exe18⤵
- Executes dropped EXE
-
\??\c:\lxrflxf.exec:\lxrflxf.exe19⤵
- Executes dropped EXE
-
\??\c:\7thhtn.exec:\7thhtn.exe20⤵
- Executes dropped EXE
-
\??\c:\7jdjv.exec:\7jdjv.exe21⤵
- Executes dropped EXE
-
\??\c:\7xrxlrf.exec:\7xrxlrf.exe22⤵
- Executes dropped EXE
-
\??\c:\tbbtnh.exec:\tbbtnh.exe23⤵
- Executes dropped EXE
-
\??\c:\9dvjd.exec:\9dvjd.exe24⤵
- Executes dropped EXE
-
\??\c:\jjpvp.exec:\jjpvp.exe25⤵
- Executes dropped EXE
-
\??\c:\7xxrfrf.exec:\7xxrfrf.exe26⤵
- Executes dropped EXE
-
\??\c:\btbbbt.exec:\btbbbt.exe27⤵
- Executes dropped EXE
-
\??\c:\9vpjp.exec:\9vpjp.exe28⤵
- Executes dropped EXE
-
\??\c:\lxfrflf.exec:\lxfrflf.exe29⤵
- Executes dropped EXE
-
\??\c:\tthbnb.exec:\tthbnb.exe30⤵
- Executes dropped EXE
-
\??\c:\3hbhtb.exec:\3hbhtb.exe31⤵
- Executes dropped EXE
-
\??\c:\pjjvj.exec:\pjjvj.exe32⤵
- Executes dropped EXE
-
\??\c:\1xrxxxf.exec:\1xrxxxf.exe33⤵
- Executes dropped EXE
-
\??\c:\ttnttn.exec:\ttnttn.exe34⤵
- Executes dropped EXE
-
\??\c:\vvpdp.exec:\vvpdp.exe35⤵
- Executes dropped EXE
-
\??\c:\vvvjv.exec:\vvvjv.exe36⤵
- Executes dropped EXE
-
\??\c:\llffxlf.exec:\llffxlf.exe37⤵
- Executes dropped EXE
-
\??\c:\ffrfxlf.exec:\ffrfxlf.exe38⤵
- Executes dropped EXE
-
\??\c:\vdvpj.exec:\vdvpj.exe39⤵
- Executes dropped EXE
-
\??\c:\rrlfrxl.exec:\rrlfrxl.exe40⤵
- Executes dropped EXE
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe41⤵
- Executes dropped EXE
-
\??\c:\9bbhbb.exec:\9bbhbb.exe42⤵
- Executes dropped EXE
-
\??\c:\jvdjp.exec:\jvdjp.exe43⤵
- Executes dropped EXE
-
\??\c:\jdjpd.exec:\jdjpd.exe44⤵
- Executes dropped EXE
-
\??\c:\1llflxf.exec:\1llflxf.exe45⤵
- Executes dropped EXE
-
\??\c:\9flxfrr.exec:\9flxfrr.exe46⤵
- Executes dropped EXE
-
\??\c:\hbnbtt.exec:\hbnbtt.exe47⤵
- Executes dropped EXE
-
\??\c:\9nnthn.exec:\9nnthn.exe48⤵
- Executes dropped EXE
-
\??\c:\ppjvj.exec:\ppjvj.exe49⤵
- Executes dropped EXE
-
\??\c:\vvdjv.exec:\vvdjv.exe50⤵
- Executes dropped EXE
-
\??\c:\llfflrf.exec:\llfflrf.exe51⤵
- Executes dropped EXE
-
\??\c:\lxllllx.exec:\lxllllx.exe52⤵
- Executes dropped EXE
-
\??\c:\hhbthn.exec:\hhbthn.exe53⤵
- Executes dropped EXE
-
\??\c:\pvpjd.exec:\pvpjd.exe54⤵
- Executes dropped EXE
-
\??\c:\pjvdp.exec:\pjvdp.exe55⤵
- Executes dropped EXE
-
\??\c:\xrlrflr.exec:\xrlrflr.exe56⤵
- Executes dropped EXE
-
\??\c:\lfrxrxl.exec:\lfrxrxl.exe57⤵
- Executes dropped EXE
-
\??\c:\ttnthn.exec:\ttnthn.exe58⤵
- Executes dropped EXE
-
\??\c:\nthtbt.exec:\nthtbt.exe59⤵
- Executes dropped EXE
-
\??\c:\ppvpp.exec:\ppvpp.exe60⤵
- Executes dropped EXE
-
\??\c:\1fxflrx.exec:\1fxflrx.exe61⤵
- Executes dropped EXE
-
\??\c:\7lxfrxf.exec:\7lxfrxf.exe62⤵
- Executes dropped EXE
-
\??\c:\bhhnbn.exec:\bhhnbn.exe63⤵
- Executes dropped EXE
-
\??\c:\bbttnt.exec:\bbttnt.exe64⤵
- Executes dropped EXE
-
\??\c:\ddjvj.exec:\ddjvj.exe65⤵
- Executes dropped EXE
-
\??\c:\jdpjj.exec:\jdpjj.exe66⤵
-
\??\c:\rrlrfxr.exec:\rrlrfxr.exe67⤵
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe68⤵
-
\??\c:\btbhnb.exec:\btbhnb.exe69⤵
-
\??\c:\5bhttb.exec:\5bhttb.exe70⤵
-
\??\c:\3jjpd.exec:\3jjpd.exe71⤵
-
\??\c:\vvvvd.exec:\vvvvd.exe72⤵
-
\??\c:\rlfrfrf.exec:\rlfrfrf.exe73⤵
-
\??\c:\ttthnb.exec:\ttthnb.exe74⤵
-
\??\c:\hbbnnn.exec:\hbbnnn.exe75⤵
-
\??\c:\ppdvp.exec:\ppdvp.exe76⤵
-
\??\c:\jddpv.exec:\jddpv.exe77⤵
-
\??\c:\lfxxffr.exec:\lfxxffr.exe78⤵
-
\??\c:\tnhnhn.exec:\tnhnhn.exe79⤵
-
\??\c:\bbnhth.exec:\bbnhth.exe80⤵
-
\??\c:\ddppv.exec:\ddppv.exe81⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe82⤵
-
\??\c:\3xxfrrl.exec:\3xxfrrl.exe83⤵
-
\??\c:\lrrlxlf.exec:\lrrlxlf.exe84⤵
-
\??\c:\nhtbhn.exec:\nhtbhn.exe85⤵
-
\??\c:\vjdjp.exec:\vjdjp.exe86⤵
-
\??\c:\5jjvj.exec:\5jjvj.exe87⤵
-
\??\c:\ffffxxl.exec:\ffffxxl.exe88⤵
-
\??\c:\rxlrrxx.exec:\rxlrrxx.exe89⤵
-
\??\c:\bhtbhn.exec:\bhtbhn.exe90⤵
-
\??\c:\3tthnn.exec:\3tthnn.exe91⤵
-
\??\c:\3vjdp.exec:\3vjdp.exe92⤵
-
\??\c:\vppjv.exec:\vppjv.exe93⤵
-
\??\c:\ffrxlrl.exec:\ffrxlrl.exe94⤵
-
\??\c:\llfxlxl.exec:\llfxlxl.exe95⤵
-
\??\c:\hhbnbh.exec:\hhbnbh.exe96⤵
-
\??\c:\hbbhnn.exec:\hbbhnn.exe97⤵
-
\??\c:\jjjvj.exec:\jjjvj.exe98⤵
-
\??\c:\5flllrf.exec:\5flllrf.exe99⤵
-
\??\c:\tnhnht.exec:\tnhnht.exe100⤵
-
\??\c:\ddvpj.exec:\ddvpj.exe101⤵
-
\??\c:\xlfrxfl.exec:\xlfrxfl.exe102⤵
-
\??\c:\3xffllr.exec:\3xffllr.exe103⤵
-
\??\c:\tnnthn.exec:\tnnthn.exe104⤵
-
\??\c:\pvvvp.exec:\pvvvp.exe105⤵
-
\??\c:\rlfxflf.exec:\rlfxflf.exe106⤵
-
\??\c:\nbthtb.exec:\nbthtb.exe107⤵
-
\??\c:\vvpjv.exec:\vvpjv.exe108⤵
-
\??\c:\ffrxlxl.exec:\ffrxlxl.exe109⤵
-
\??\c:\bbhntb.exec:\bbhntb.exe110⤵
-
\??\c:\vvjjp.exec:\vvjjp.exe111⤵
-
\??\c:\dvppv.exec:\dvppv.exe112⤵
-
\??\c:\rxllrfl.exec:\rxllrfl.exe113⤵
-
\??\c:\9jpdj.exec:\9jpdj.exe114⤵
-
\??\c:\vdpjp.exec:\vdpjp.exe115⤵
-
\??\c:\5lllffx.exec:\5lllffx.exe116⤵
-
\??\c:\hbnntn.exec:\hbnntn.exe117⤵
-
\??\c:\7vjjd.exec:\7vjjd.exe118⤵
-
\??\c:\lrrlfrl.exec:\lrrlfrl.exe119⤵
-
\??\c:\3hbntb.exec:\3hbntb.exe120⤵
-
\??\c:\3rlrxlr.exec:\3rlrxlr.exe121⤵
-
\??\c:\djpjp.exec:\djpjp.exe122⤵
-
\??\c:\frrrlff.exec:\frrrlff.exe123⤵
-
\??\c:\hhhnbn.exec:\hhhnbn.exe124⤵
-
\??\c:\jpvdv.exec:\jpvdv.exe125⤵
-
\??\c:\ttbtnh.exec:\ttbtnh.exe126⤵
-
\??\c:\jjjdp.exec:\jjjdp.exe127⤵
-
\??\c:\xxlrlxl.exec:\xxlrlxl.exe128⤵
-
\??\c:\bttbnh.exec:\bttbnh.exe129⤵
-
\??\c:\ppjpd.exec:\ppjpd.exe130⤵
-
\??\c:\flffrll.exec:\flffrll.exe131⤵
-
\??\c:\nhtnnb.exec:\nhtnnb.exe132⤵
-
\??\c:\7hnnbh.exec:\7hnnbh.exe133⤵
-
\??\c:\pjjpv.exec:\pjjpv.exe134⤵
-
\??\c:\xfflxxr.exec:\xfflxxr.exe135⤵
-
\??\c:\3hhnth.exec:\3hhnth.exe136⤵
-
\??\c:\jpdpj.exec:\jpdpj.exe137⤵
-
\??\c:\dddpd.exec:\dddpd.exe138⤵
-
\??\c:\5fxflrx.exec:\5fxflrx.exe139⤵
-
\??\c:\tthnbh.exec:\tthnbh.exe140⤵
-
\??\c:\nnhtnt.exec:\nnhtnt.exe141⤵
-
\??\c:\7vvjp.exec:\7vvjp.exe142⤵
-
\??\c:\ttntnb.exec:\ttntnb.exe143⤵
-
\??\c:\vdjdj.exec:\vdjdj.exe144⤵
-
\??\c:\7dpdp.exec:\7dpdp.exe145⤵
-
\??\c:\xfrxffr.exec:\xfrxffr.exe146⤵
-
\??\c:\vdvpj.exec:\vdvpj.exe147⤵
-
\??\c:\jjjvd.exec:\jjjvd.exe148⤵
-
\??\c:\xxrxllf.exec:\xxrxllf.exe149⤵
-
\??\c:\bnthnn.exec:\bnthnn.exe150⤵
-
\??\c:\tbbhbb.exec:\tbbhbb.exe151⤵
-
\??\c:\djpjd.exec:\djpjd.exe152⤵
-
\??\c:\5xrfrxr.exec:\5xrfrxr.exe153⤵
-
\??\c:\1ntbnb.exec:\1ntbnb.exe154⤵
-
\??\c:\nnhnnh.exec:\nnhnnh.exe155⤵
-
\??\c:\vvpdp.exec:\vvpdp.exe156⤵
-
\??\c:\ffxlxrl.exec:\ffxlxrl.exe157⤵
-
\??\c:\1lffxlx.exec:\1lffxlx.exe158⤵
-
\??\c:\nhhbtt.exec:\nhhbtt.exe159⤵
-
\??\c:\vvjpd.exec:\vvjpd.exe160⤵
-
\??\c:\rfxrxll.exec:\rfxrxll.exe161⤵
-
\??\c:\lfflrxr.exec:\lfflrxr.exe162⤵
-
\??\c:\hnttbt.exec:\hnttbt.exe163⤵
-
\??\c:\1ttbbn.exec:\1ttbbn.exe164⤵
-
\??\c:\ddpdp.exec:\ddpdp.exe165⤵
-
\??\c:\jjjpd.exec:\jjjpd.exe166⤵
-
\??\c:\frxxfll.exec:\frxxfll.exe167⤵
-
\??\c:\bthhtt.exec:\bthhtt.exe168⤵
-
\??\c:\hbnbnb.exec:\hbnbnb.exe169⤵
-
\??\c:\ddjjj.exec:\ddjjj.exe170⤵
-
\??\c:\vdddp.exec:\vdddp.exe171⤵
-
\??\c:\lflrxff.exec:\lflrxff.exe172⤵
-
\??\c:\1nnhhb.exec:\1nnhhb.exe173⤵
-
\??\c:\7tbhhn.exec:\7tbhhn.exe174⤵
-
\??\c:\djjvv.exec:\djjvv.exe175⤵
-
\??\c:\vvpjp.exec:\vvpjp.exe176⤵
-
\??\c:\flllffr.exec:\flllffr.exe177⤵
-
\??\c:\lfrfrxf.exec:\lfrfrxf.exe178⤵
-
\??\c:\bbnhhn.exec:\bbnhhn.exe179⤵
-
\??\c:\jpvdj.exec:\jpvdj.exe180⤵
-
\??\c:\ffxxlxl.exec:\ffxxlxl.exe181⤵
-
\??\c:\3ffrllf.exec:\3ffrllf.exe182⤵
-
\??\c:\hbthth.exec:\hbthth.exe183⤵
-
\??\c:\9nhttb.exec:\9nhttb.exe184⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe185⤵
-
\??\c:\fxrxrfr.exec:\fxrxrfr.exe186⤵
-
\??\c:\lfxrfrx.exec:\lfxrfrx.exe187⤵
-
\??\c:\bttbbh.exec:\bttbbh.exe188⤵
-
\??\c:\1hntnt.exec:\1hntnt.exe189⤵
-
\??\c:\vdvdd.exec:\vdvdd.exe190⤵
-
\??\c:\ffrffrf.exec:\ffrffrf.exe191⤵
-
\??\c:\5rrxffr.exec:\5rrxffr.exe192⤵
-
\??\c:\nnhthn.exec:\nnhthn.exe193⤵
-
\??\c:\1tbttt.exec:\1tbttt.exe194⤵
-
\??\c:\jjdvv.exec:\jjdvv.exe195⤵
-
\??\c:\pjjpv.exec:\pjjpv.exe196⤵
-
\??\c:\frflxxr.exec:\frflxxr.exe197⤵
-
\??\c:\7llxfrf.exec:\7llxfrf.exe198⤵
-
\??\c:\nnbhtb.exec:\nnbhtb.exe199⤵
-
\??\c:\pjpjv.exec:\pjpjv.exe200⤵
-
\??\c:\5dvvv.exec:\5dvvv.exe201⤵
-
\??\c:\jpjvd.exec:\jpjvd.exe202⤵
-
\??\c:\fxlrfxl.exec:\fxlrfxl.exe203⤵
-
\??\c:\5hnthn.exec:\5hnthn.exe204⤵
-
\??\c:\hhhbnb.exec:\hhhbnb.exe205⤵
-
\??\c:\ppvdv.exec:\ppvdv.exe206⤵
-
\??\c:\jdjjv.exec:\jdjjv.exe207⤵
-
\??\c:\1lxfllf.exec:\1lxfllf.exe208⤵
-
\??\c:\lrlrlxx.exec:\lrlrlxx.exe209⤵
-
\??\c:\5btbnt.exec:\5btbnt.exe210⤵
-
\??\c:\hhhbhh.exec:\hhhbhh.exe211⤵
-
\??\c:\ddddp.exec:\ddddp.exe212⤵
-
\??\c:\pjdpp.exec:\pjdpp.exe213⤵
-
\??\c:\rrxrfxf.exec:\rrxrfxf.exe214⤵
-
\??\c:\thnbnn.exec:\thnbnn.exe215⤵
-
\??\c:\9nnhhh.exec:\9nnhhh.exe216⤵
-
\??\c:\pjjvj.exec:\pjjvj.exe217⤵
-
\??\c:\ddpvj.exec:\ddpvj.exe218⤵
-
\??\c:\3rxrrrr.exec:\3rxrrrr.exe219⤵
-
\??\c:\5btthh.exec:\5btthh.exe220⤵
-
\??\c:\5nthhn.exec:\5nthhn.exe221⤵
-
\??\c:\dvddd.exec:\dvddd.exe222⤵
-
\??\c:\ddvjd.exec:\ddvjd.exe223⤵
-
\??\c:\7fflffl.exec:\7fflffl.exe224⤵
-
\??\c:\llxrflx.exec:\llxrflx.exe225⤵
-
\??\c:\bnhhtb.exec:\bnhhtb.exe226⤵
-
\??\c:\bbtntb.exec:\bbtntb.exe227⤵
-
\??\c:\jdvjj.exec:\jdvjj.exe228⤵
-
\??\c:\5fxrfxf.exec:\5fxrfxf.exe229⤵
-
\??\c:\9fxflrf.exec:\9fxflrf.exe230⤵
-
\??\c:\tthbtn.exec:\tthbtn.exe231⤵
-
\??\c:\jvppj.exec:\jvppj.exe232⤵
-
\??\c:\ddppj.exec:\ddppj.exe233⤵
-
\??\c:\9fffllr.exec:\9fffllr.exe234⤵
-
\??\c:\ntbtnb.exec:\ntbtnb.exe235⤵
-
\??\c:\btntht.exec:\btntht.exe236⤵
-
\??\c:\3bthht.exec:\3bthht.exe237⤵
-
\??\c:\5vvdj.exec:\5vvdj.exe238⤵
-
\??\c:\9llfrxf.exec:\9llfrxf.exe239⤵
-
\??\c:\7lxfrxl.exec:\7lxfrxl.exe240⤵
-
\??\c:\tbtnth.exec:\tbtnth.exe241⤵