Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 14:17
Behavioral task
behavioral1
Sample
57d8a826b9abf3ffce55ceccc115cee834d43b0a2286975d0685526a7cf8465e_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
57d8a826b9abf3ffce55ceccc115cee834d43b0a2286975d0685526a7cf8465e_NeikiAnalytics.exe
-
Size
164KB
-
MD5
48980abad55cb02a25a723a4344d25e0
-
SHA1
1468663d38d9db614f08dbaae273fb4ea9acfa5e
-
SHA256
57d8a826b9abf3ffce55ceccc115cee834d43b0a2286975d0685526a7cf8465e
-
SHA512
d7b3030bf00bdb8c4138d3641b944230e81f8f90f78c5d909d6f4f65b1de4f8573f5b16612bb3f8c2a966c95b5dbf9cb1fd31abf60de74ecee5af9b49c93c8cb
-
SSDEEP
3072:xhOmTsF93UYfwC6GIout0fmCiiiXAQ5lpBoGYwNNhu0CzhKPJFk:xcm4FmowdHoSgWrXF5lpKGYV0wh6Je
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
Processes:
resource yara_rule behavioral1/memory/2116-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1252-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-74-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2568-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1780-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1896-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/336-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1332-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-342-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2756-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2308-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1380-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/372-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1780-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1332-693-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-905-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1996-1240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-19756-0x00000000776C0000-0x00000000777DF000-memory.dmp family_blackmoon behavioral1/memory/2004-21213-0x00000000776C0000-0x00000000777DF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lfxxflr.exehtbhtt.exe7dvvj.exe5thnnt.exetttbbb.exejvjvj.exe1xrxfrx.exe5bntnb.exe7pdjp.exe9lrllrr.exefxlxllr.exettnnbh.exehhtnbb.exepdvvv.exerlxflfl.exerlxxxxl.exebhhbbh.exebbthhh.exejdvvj.exepppdj.exexrrlxlf.exe5xlxfxf.exennhbhn.exe1bntbb.exejdppp.exexrxrxff.exerfflxxf.exebtntth.exenhtnnt.exeddvvp.exejdpvd.exexxrxrrf.exe5lffffl.exe9bhnbt.exenhnbnt.exe3vvjp.exe3rlxlrf.exefxfxrlf.exerlrrxxf.exebnhbhh.exetnnhtt.exevpdpj.exe9vjpj.exe3jdjp.exerfrflxx.exerrrrfxf.exetnbbhn.exe9nbbhh.exehbnbbb.exejvjjp.exepjddp.exe7llxllf.exe3rlrlrf.exe5lflrxr.exetnbhhn.exenhtthn.exe3pjdd.exejdjdj.exeththnn.exethnthh.exehbtttb.exejvppv.exedpdvd.exejdjvp.exepid process 1624 lfxxflr.exe 2928 htbhtt.exe 1252 7dvvj.exe 2748 5thnnt.exe 2636 tttbbb.exe 2808 jvjvj.exe 2696 1xrxfrx.exe 2568 5bntnb.exe 2544 7pdjp.exe 2564 9lrllrr.exe 2016 fxlxllr.exe 2772 ttnnbh.exe 2920 hhtnbb.exe 1780 pdvvv.exe 1332 rlxflfl.exe 1896 rlxxxxl.exe 392 bhhbbh.exe 756 bbthhh.exe 2796 jdvvj.exe 308 pppdj.exe 372 xrrlxlf.exe 1608 5xlxfxf.exe 2608 nnhbhn.exe 336 1bntbb.exe 836 jdppp.exe 1732 xrxrxff.exe 1068 rfflxxf.exe 2296 btntth.exe 1380 nhtnnt.exe 944 ddvvp.exe 2952 jdpvd.exe 1736 xxrxrrf.exe 2308 5lffffl.exe 3008 9bhnbt.exe 2108 nhnbnt.exe 1820 3vvjp.exe 1768 3rlxlrf.exe 2024 fxfxrlf.exe 2992 rlrrxxf.exe 2472 bnhbhh.exe 1580 tnnhtt.exe 2604 vpdpj.exe 2620 9vjpj.exe 2132 3jdjp.exe 2956 rfrflxx.exe 2756 rrrrfxf.exe 2940 tnbbhn.exe 2288 9nbbhh.exe 2648 hbnbbb.exe 2516 jvjjp.exe 2576 pjddp.exe 2528 7llxllf.exe 1216 3rlrlrf.exe 2564 5lflrxr.exe 2872 tnbhhn.exe 2876 nhtthn.exe 2232 3pjdd.exe 1052 jdjdj.exe 2156 ththnn.exe 1332 thnthh.exe 1700 hbtttb.exe 2760 jvppv.exe 548 dpdvd.exe 1696 jdjvp.exe -
Processes:
resource yara_rule behavioral1/memory/2116-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2116-3-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2116-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfxxflr.exe upx \??\c:\htbhtt.exe upx behavioral1/memory/1624-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2928-18-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7dvvj.exe upx behavioral1/memory/1252-25-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5thnnt.exe upx behavioral1/memory/1252-32-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tttbbb.exe upx behavioral1/memory/2748-41-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvjvj.exe upx behavioral1/memory/2636-49-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1xrxfrx.exe upx behavioral1/memory/2808-57-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5bntnb.exe upx behavioral1/memory/2696-65-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7pdjp.exe upx behavioral1/memory/2568-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2544-82-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9lrllrr.exe upx behavioral1/memory/2564-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxlxllr.exe upx behavioral1/memory/2564-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2016-100-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttnnbh.exe upx C:\hhtnbb.exe upx behavioral1/memory/2920-115-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdvvv.exe upx behavioral1/memory/1780-117-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlxxxxl.exe upx behavioral1/memory/1896-139-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbthhh.exe upx \??\c:\bhhbbh.exe upx behavioral1/memory/392-140-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rlxflfl.exe upx \??\c:\jdvvj.exe upx \??\c:\pppdj.exe upx C:\nnhbhn.exe upx \??\c:\1bntbb.exe upx C:\jdppp.exe upx behavioral1/memory/336-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2296-224-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhtnnt.exe upx C:\ddvvp.exe upx \??\c:\jdpvd.exe upx \??\c:\xxrxrrf.exe upx behavioral1/memory/2108-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2620-319-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1216-371-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2872-387-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2232-393-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1332-409-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1700-415-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2576-360-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2648-349-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2940-343-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-336-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2956-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2472-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2024-288-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2308-260-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
57d8a826b9abf3ffce55ceccc115cee834d43b0a2286975d0685526a7cf8465e_NeikiAnalytics.exelfxxflr.exehtbhtt.exe7dvvj.exe5thnnt.exetttbbb.exejvjvj.exe1xrxfrx.exe5bntnb.exe7pdjp.exe9lrllrr.exefxlxllr.exettnnbh.exehhtnbb.exepdvvv.exerlxflfl.exedescription pid process target process PID 2116 wrote to memory of 1624 2116 57d8a826b9abf3ffce55ceccc115cee834d43b0a2286975d0685526a7cf8465e_NeikiAnalytics.exe lfxxflr.exe PID 2116 wrote to memory of 1624 2116 57d8a826b9abf3ffce55ceccc115cee834d43b0a2286975d0685526a7cf8465e_NeikiAnalytics.exe lfxxflr.exe PID 2116 wrote to memory of 1624 2116 57d8a826b9abf3ffce55ceccc115cee834d43b0a2286975d0685526a7cf8465e_NeikiAnalytics.exe lfxxflr.exe PID 2116 wrote to memory of 1624 2116 57d8a826b9abf3ffce55ceccc115cee834d43b0a2286975d0685526a7cf8465e_NeikiAnalytics.exe lfxxflr.exe PID 1624 wrote to memory of 2928 1624 lfxxflr.exe htbhtt.exe PID 1624 wrote to memory of 2928 1624 lfxxflr.exe htbhtt.exe PID 1624 wrote to memory of 2928 1624 lfxxflr.exe htbhtt.exe PID 1624 wrote to memory of 2928 1624 lfxxflr.exe htbhtt.exe PID 2928 wrote to memory of 1252 2928 htbhtt.exe 7dvvj.exe PID 2928 wrote to memory of 1252 2928 htbhtt.exe 7dvvj.exe PID 2928 wrote to memory of 1252 2928 htbhtt.exe 7dvvj.exe PID 2928 wrote to memory of 1252 2928 htbhtt.exe 7dvvj.exe PID 1252 wrote to memory of 2748 1252 7dvvj.exe 5thnnt.exe PID 1252 wrote to memory of 2748 1252 7dvvj.exe 5thnnt.exe PID 1252 wrote to memory of 2748 1252 7dvvj.exe 5thnnt.exe PID 1252 wrote to memory of 2748 1252 7dvvj.exe 5thnnt.exe PID 2748 wrote to memory of 2636 2748 5thnnt.exe tttbbb.exe PID 2748 wrote to memory of 2636 2748 5thnnt.exe tttbbb.exe PID 2748 wrote to memory of 2636 2748 5thnnt.exe tttbbb.exe PID 2748 wrote to memory of 2636 2748 5thnnt.exe tttbbb.exe PID 2636 wrote to memory of 2808 2636 tttbbb.exe jvjvj.exe PID 2636 wrote to memory of 2808 2636 tttbbb.exe jvjvj.exe PID 2636 wrote to memory of 2808 2636 tttbbb.exe jvjvj.exe PID 2636 wrote to memory of 2808 2636 tttbbb.exe jvjvj.exe PID 2808 wrote to memory of 2696 2808 jvjvj.exe 1xrxfrx.exe PID 2808 wrote to memory of 2696 2808 jvjvj.exe 1xrxfrx.exe PID 2808 wrote to memory of 2696 2808 jvjvj.exe 1xrxfrx.exe PID 2808 wrote to memory of 2696 2808 jvjvj.exe 1xrxfrx.exe PID 2696 wrote to memory of 2568 2696 1xrxfrx.exe 5bntnb.exe PID 2696 wrote to memory of 2568 2696 1xrxfrx.exe 5bntnb.exe PID 2696 wrote to memory of 2568 2696 1xrxfrx.exe 5bntnb.exe PID 2696 wrote to memory of 2568 2696 1xrxfrx.exe 5bntnb.exe PID 2568 wrote to memory of 2544 2568 5bntnb.exe 7pdjp.exe PID 2568 wrote to memory of 2544 2568 5bntnb.exe 7pdjp.exe PID 2568 wrote to memory of 2544 2568 5bntnb.exe 7pdjp.exe PID 2568 wrote to memory of 2544 2568 5bntnb.exe 7pdjp.exe PID 2544 wrote to memory of 2564 2544 7pdjp.exe 5lflrxr.exe PID 2544 wrote to memory of 2564 2544 7pdjp.exe 5lflrxr.exe PID 2544 wrote to memory of 2564 2544 7pdjp.exe 5lflrxr.exe PID 2544 wrote to memory of 2564 2544 7pdjp.exe 5lflrxr.exe PID 2564 wrote to memory of 2016 2564 9lrllrr.exe fxlxllr.exe PID 2564 wrote to memory of 2016 2564 9lrllrr.exe fxlxllr.exe PID 2564 wrote to memory of 2016 2564 9lrllrr.exe fxlxllr.exe PID 2564 wrote to memory of 2016 2564 9lrllrr.exe fxlxllr.exe PID 2016 wrote to memory of 2772 2016 fxlxllr.exe ttnnbh.exe PID 2016 wrote to memory of 2772 2016 fxlxllr.exe ttnnbh.exe PID 2016 wrote to memory of 2772 2016 fxlxllr.exe ttnnbh.exe PID 2016 wrote to memory of 2772 2016 fxlxllr.exe ttnnbh.exe PID 2772 wrote to memory of 2920 2772 ttnnbh.exe hhtnbb.exe PID 2772 wrote to memory of 2920 2772 ttnnbh.exe hhtnbb.exe PID 2772 wrote to memory of 2920 2772 ttnnbh.exe hhtnbb.exe PID 2772 wrote to memory of 2920 2772 ttnnbh.exe hhtnbb.exe PID 2920 wrote to memory of 1780 2920 hhtnbb.exe pdvvv.exe PID 2920 wrote to memory of 1780 2920 hhtnbb.exe pdvvv.exe PID 2920 wrote to memory of 1780 2920 hhtnbb.exe pdvvv.exe PID 2920 wrote to memory of 1780 2920 hhtnbb.exe pdvvv.exe PID 1780 wrote to memory of 1332 1780 pdvvv.exe rlxflfl.exe PID 1780 wrote to memory of 1332 1780 pdvvv.exe rlxflfl.exe PID 1780 wrote to memory of 1332 1780 pdvvv.exe rlxflfl.exe PID 1780 wrote to memory of 1332 1780 pdvvv.exe rlxflfl.exe PID 1332 wrote to memory of 1896 1332 rlxflfl.exe rlxxxxl.exe PID 1332 wrote to memory of 1896 1332 rlxflfl.exe rlxxxxl.exe PID 1332 wrote to memory of 1896 1332 rlxflfl.exe rlxxxxl.exe PID 1332 wrote to memory of 1896 1332 rlxflfl.exe rlxxxxl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57d8a826b9abf3ffce55ceccc115cee834d43b0a2286975d0685526a7cf8465e_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\57d8a826b9abf3ffce55ceccc115cee834d43b0a2286975d0685526a7cf8465e_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxxflr.exec:\lfxxflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htbhtt.exec:\htbhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7dvvj.exec:\7dvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5thnnt.exec:\5thnnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tttbbb.exec:\tttbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvjvj.exec:\jvjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1xrxfrx.exec:\1xrxfrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5bntnb.exec:\5bntnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7pdjp.exec:\7pdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9lrllrr.exec:\9lrllrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxlxllr.exec:\fxlxllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttnnbh.exec:\ttnnbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhtnbb.exec:\hhtnbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdvvv.exec:\pdvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxflfl.exec:\rlxflfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxxxxl.exec:\rlxxxxl.exe17⤵
- Executes dropped EXE
-
\??\c:\bhhbbh.exec:\bhhbbh.exe18⤵
- Executes dropped EXE
-
\??\c:\bbthhh.exec:\bbthhh.exe19⤵
- Executes dropped EXE
-
\??\c:\jdvvj.exec:\jdvvj.exe20⤵
- Executes dropped EXE
-
\??\c:\pppdj.exec:\pppdj.exe21⤵
- Executes dropped EXE
-
\??\c:\xrrlxlf.exec:\xrrlxlf.exe22⤵
- Executes dropped EXE
-
\??\c:\5xlxfxf.exec:\5xlxfxf.exe23⤵
- Executes dropped EXE
-
\??\c:\nnhbhn.exec:\nnhbhn.exe24⤵
- Executes dropped EXE
-
\??\c:\1bntbb.exec:\1bntbb.exe25⤵
- Executes dropped EXE
-
\??\c:\jdppp.exec:\jdppp.exe26⤵
- Executes dropped EXE
-
\??\c:\xrxrxff.exec:\xrxrxff.exe27⤵
- Executes dropped EXE
-
\??\c:\rfflxxf.exec:\rfflxxf.exe28⤵
- Executes dropped EXE
-
\??\c:\btntth.exec:\btntth.exe29⤵
- Executes dropped EXE
-
\??\c:\nhtnnt.exec:\nhtnnt.exe30⤵
- Executes dropped EXE
-
\??\c:\ddvvp.exec:\ddvvp.exe31⤵
- Executes dropped EXE
-
\??\c:\jdpvd.exec:\jdpvd.exe32⤵
- Executes dropped EXE
-
\??\c:\xxrxrrf.exec:\xxrxrrf.exe33⤵
- Executes dropped EXE
-
\??\c:\5lffffl.exec:\5lffffl.exe34⤵
- Executes dropped EXE
-
\??\c:\9bhnbt.exec:\9bhnbt.exe35⤵
- Executes dropped EXE
-
\??\c:\nhnbnt.exec:\nhnbnt.exe36⤵
- Executes dropped EXE
-
\??\c:\3vvjp.exec:\3vvjp.exe37⤵
- Executes dropped EXE
-
\??\c:\3rlxlrf.exec:\3rlxlrf.exe38⤵
- Executes dropped EXE
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe39⤵
- Executes dropped EXE
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe40⤵
- Executes dropped EXE
-
\??\c:\bnhbhh.exec:\bnhbhh.exe41⤵
- Executes dropped EXE
-
\??\c:\tnnhtt.exec:\tnnhtt.exe42⤵
- Executes dropped EXE
-
\??\c:\vpdpj.exec:\vpdpj.exe43⤵
- Executes dropped EXE
-
\??\c:\9vjpj.exec:\9vjpj.exe44⤵
- Executes dropped EXE
-
\??\c:\3jdjp.exec:\3jdjp.exe45⤵
- Executes dropped EXE
-
\??\c:\rfrflxx.exec:\rfrflxx.exe46⤵
- Executes dropped EXE
-
\??\c:\rrrrfxf.exec:\rrrrfxf.exe47⤵
- Executes dropped EXE
-
\??\c:\tnbbhn.exec:\tnbbhn.exe48⤵
- Executes dropped EXE
-
\??\c:\9nbbhh.exec:\9nbbhh.exe49⤵
- Executes dropped EXE
-
\??\c:\hbnbbb.exec:\hbnbbb.exe50⤵
- Executes dropped EXE
-
\??\c:\jvjjp.exec:\jvjjp.exe51⤵
- Executes dropped EXE
-
\??\c:\pjddp.exec:\pjddp.exe52⤵
- Executes dropped EXE
-
\??\c:\7llxllf.exec:\7llxllf.exe53⤵
- Executes dropped EXE
-
\??\c:\3rlrlrf.exec:\3rlrlrf.exe54⤵
- Executes dropped EXE
-
\??\c:\5lflrxr.exec:\5lflrxr.exe55⤵
- Executes dropped EXE
-
\??\c:\tnbhhn.exec:\tnbhhn.exe56⤵
- Executes dropped EXE
-
\??\c:\nhtthn.exec:\nhtthn.exe57⤵
- Executes dropped EXE
-
\??\c:\3pjdd.exec:\3pjdd.exe58⤵
- Executes dropped EXE
-
\??\c:\jdjdj.exec:\jdjdj.exe59⤵
- Executes dropped EXE
-
\??\c:\ththnn.exec:\ththnn.exe60⤵
- Executes dropped EXE
-
\??\c:\thnthh.exec:\thnthh.exe61⤵
- Executes dropped EXE
-
\??\c:\hbtttb.exec:\hbtttb.exe62⤵
- Executes dropped EXE
-
\??\c:\jvppv.exec:\jvppv.exe63⤵
- Executes dropped EXE
-
\??\c:\dpdvd.exec:\dpdvd.exe64⤵
- Executes dropped EXE
-
\??\c:\jdjvp.exec:\jdjvp.exe65⤵
- Executes dropped EXE
-
\??\c:\rfrrffl.exec:\rfrrffl.exe66⤵
-
\??\c:\rlflrfr.exec:\rlflrfr.exe67⤵
-
\??\c:\nbbbbh.exec:\nbbbbh.exe68⤵
-
\??\c:\ddddp.exec:\ddddp.exe69⤵
-
\??\c:\nhntbh.exec:\nhntbh.exe70⤵
-
\??\c:\ddvdj.exec:\ddvdj.exe71⤵
-
\??\c:\fxflxxf.exec:\fxflxxf.exe72⤵
-
\??\c:\dpdjp.exec:\dpdjp.exe73⤵
-
\??\c:\lxrlrlr.exec:\lxrlrlr.exe74⤵
-
\??\c:\7httbh.exec:\7httbh.exe75⤵
-
\??\c:\pjvvj.exec:\pjvvj.exe76⤵
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe77⤵
-
\??\c:\7frrllr.exec:\7frrllr.exe78⤵
-
\??\c:\vpvpv.exec:\vpvpv.exe79⤵
-
\??\c:\vvpvj.exec:\vvpvj.exe80⤵
-
\??\c:\3rlfrlr.exec:\3rlfrlr.exe81⤵
-
\??\c:\nhbbnn.exec:\nhbbnn.exe82⤵
-
\??\c:\9bttbb.exec:\9bttbb.exe83⤵
-
\??\c:\dvvdd.exec:\dvvdd.exe84⤵
-
\??\c:\rflrfxl.exec:\rflrfxl.exe85⤵
-
\??\c:\5nthtb.exec:\5nthtb.exe86⤵
-
\??\c:\hthnbh.exec:\hthnbh.exe87⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe88⤵
-
\??\c:\xlfflrr.exec:\xlfflrr.exe89⤵
-
\??\c:\tnhtth.exec:\tnhtth.exe90⤵
-
\??\c:\hbnthh.exec:\hbnthh.exe91⤵
-
\??\c:\vpddj.exec:\vpddj.exe92⤵
-
\??\c:\7lfflrf.exec:\7lfflrf.exe93⤵
-
\??\c:\9rlrllr.exec:\9rlrllr.exe94⤵
-
\??\c:\hbtbbh.exec:\hbtbbh.exe95⤵
-
\??\c:\vpjpd.exec:\vpjpd.exe96⤵
-
\??\c:\pdvdj.exec:\pdvdj.exe97⤵
-
\??\c:\5xllxrx.exec:\5xllxrx.exe98⤵
-
\??\c:\fxxxllx.exec:\fxxxllx.exe99⤵
-
\??\c:\bthtnn.exec:\bthtnn.exe100⤵
-
\??\c:\1nhhth.exec:\1nhhth.exe101⤵
-
\??\c:\9vjpv.exec:\9vjpv.exe102⤵
-
\??\c:\dvdjv.exec:\dvdjv.exe103⤵
-
\??\c:\lllxxxf.exec:\lllxxxf.exe104⤵
-
\??\c:\nbhhbb.exec:\nbhhbb.exe105⤵
-
\??\c:\hbnntt.exec:\hbnntt.exe106⤵
-
\??\c:\dvddv.exec:\dvddv.exe107⤵
-
\??\c:\vpvdj.exec:\vpvdj.exe108⤵
-
\??\c:\fffrllx.exec:\fffrllx.exe109⤵
-
\??\c:\bthhtt.exec:\bthhtt.exe110⤵
-
\??\c:\hhntnb.exec:\hhntnb.exe111⤵
-
\??\c:\jdvjp.exec:\jdvjp.exe112⤵
-
\??\c:\dvdjd.exec:\dvdjd.exe113⤵
-
\??\c:\lxrxfxf.exec:\lxrxfxf.exe114⤵
-
\??\c:\3thtnt.exec:\3thtnt.exe115⤵
-
\??\c:\vpjpv.exec:\vpjpv.exe116⤵
-
\??\c:\jvdvj.exec:\jvdvj.exe117⤵
-
\??\c:\rlrxrrx.exec:\rlrxrrx.exe118⤵
-
\??\c:\lfxlxxf.exec:\lfxlxxf.exe119⤵
-
\??\c:\9hhnhn.exec:\9hhnhn.exe120⤵
-
\??\c:\9hbntt.exec:\9hbntt.exe121⤵
-
\??\c:\7pvpd.exec:\7pvpd.exe122⤵
-
\??\c:\9lrxllr.exec:\9lrxllr.exe123⤵
-
\??\c:\frxlxxf.exec:\frxlxxf.exe124⤵
-
\??\c:\btnbnt.exec:\btnbnt.exe125⤵
-
\??\c:\btbntt.exec:\btbntt.exe126⤵
-
\??\c:\vvjpd.exec:\vvjpd.exe127⤵
-
\??\c:\jddjj.exec:\jddjj.exe128⤵
-
\??\c:\7rffflr.exec:\7rffflr.exe129⤵
-
\??\c:\bnbntn.exec:\bnbntn.exe130⤵
-
\??\c:\1nbttt.exec:\1nbttt.exe131⤵
-
\??\c:\jpvvp.exec:\jpvvp.exe132⤵
-
\??\c:\jdvjd.exec:\jdvjd.exe133⤵
-
\??\c:\7rrllrr.exec:\7rrllrr.exe134⤵
-
\??\c:\5tnbnn.exec:\5tnbnn.exe135⤵
-
\??\c:\hththn.exec:\hththn.exe136⤵
-
\??\c:\1vpdj.exec:\1vpdj.exe137⤵
-
\??\c:\vvjdd.exec:\vvjdd.exe138⤵
-
\??\c:\lfrflrf.exec:\lfrflrf.exe139⤵
-
\??\c:\btbhnt.exec:\btbhnt.exe140⤵
-
\??\c:\thbhht.exec:\thbhht.exe141⤵
-
\??\c:\vpvjj.exec:\vpvjj.exe142⤵
-
\??\c:\jjjpj.exec:\jjjpj.exe143⤵
-
\??\c:\xlxxfff.exec:\xlxxfff.exe144⤵
-
\??\c:\frxxrlf.exec:\frxxrlf.exe145⤵
-
\??\c:\tnhnhh.exec:\tnhnhh.exe146⤵
-
\??\c:\ppvdd.exec:\ppvdd.exe147⤵
-
\??\c:\ddpvv.exec:\ddpvv.exe148⤵
-
\??\c:\rfllxrf.exec:\rfllxrf.exe149⤵
-
\??\c:\xlfrrfl.exec:\xlfrrfl.exe150⤵
-
\??\c:\tththn.exec:\tththn.exe151⤵
-
\??\c:\7hhttn.exec:\7hhttn.exe152⤵
-
\??\c:\ppppj.exec:\ppppj.exe153⤵
-
\??\c:\jdpjp.exec:\jdpjp.exe154⤵
-
\??\c:\rffxrxf.exec:\rffxrxf.exe155⤵
-
\??\c:\lfxllrr.exec:\lfxllrr.exe156⤵
-
\??\c:\nnhnbn.exec:\nnhnbn.exe157⤵
-
\??\c:\3htttb.exec:\3htttb.exe158⤵
-
\??\c:\vjpjj.exec:\vjpjj.exe159⤵
-
\??\c:\jvvpd.exec:\jvvpd.exe160⤵
-
\??\c:\frxxflr.exec:\frxxflr.exe161⤵
-
\??\c:\rxfxfff.exec:\rxfxfff.exe162⤵
-
\??\c:\thhhhb.exec:\thhhhb.exe163⤵
-
\??\c:\bbhthn.exec:\bbhthn.exe164⤵
-
\??\c:\9jddj.exec:\9jddj.exe165⤵
-
\??\c:\7dpjj.exec:\7dpjj.exe166⤵
-
\??\c:\rrrrfrl.exec:\rrrrfrl.exe167⤵
-
\??\c:\rlrxlfl.exec:\rlrxlfl.exe168⤵
-
\??\c:\htbttn.exec:\htbttn.exe169⤵
-
\??\c:\ddjjj.exec:\ddjjj.exe170⤵
-
\??\c:\lxfffxf.exec:\lxfffxf.exe171⤵
-
\??\c:\5xrlrxl.exec:\5xrlrxl.exe172⤵
-
\??\c:\nbnthh.exec:\nbnthh.exe173⤵
-
\??\c:\tnbhhn.exec:\tnbhhn.exe174⤵
-
\??\c:\pvvjd.exec:\pvvjd.exe175⤵
-
\??\c:\jddjv.exec:\jddjv.exe176⤵
-
\??\c:\1fflrrf.exec:\1fflrrf.exe177⤵
-
\??\c:\tnbthb.exec:\tnbthb.exe178⤵
-
\??\c:\dvvvd.exec:\dvvvd.exe179⤵
-
\??\c:\1rxfllf.exec:\1rxfllf.exe180⤵
-
\??\c:\rflxffl.exec:\rflxffl.exe181⤵
-
\??\c:\3htbnn.exec:\3htbnn.exe182⤵
-
\??\c:\thbhnt.exec:\thbhnt.exe183⤵
-
\??\c:\vpdvj.exec:\vpdvj.exe184⤵
-
\??\c:\rlxxrxx.exec:\rlxxrxx.exe185⤵
-
\??\c:\lxlxlfl.exec:\lxlxlfl.exe186⤵
-
\??\c:\hbnntt.exec:\hbnntt.exe187⤵
-
\??\c:\bnthnt.exec:\bnthnt.exe188⤵
-
\??\c:\1pvdd.exec:\1pvdd.exe189⤵
-
\??\c:\vjpjv.exec:\vjpjv.exe190⤵
-
\??\c:\xllrrff.exec:\xllrrff.exe191⤵
-
\??\c:\1rfxrrr.exec:\1rfxrrr.exe192⤵
-
\??\c:\hbhbhb.exec:\hbhbhb.exe193⤵
-
\??\c:\dvjvv.exec:\dvjvv.exe194⤵
-
\??\c:\jdjjp.exec:\jdjjp.exe195⤵
-
\??\c:\lxxrxrx.exec:\lxxrxrx.exe196⤵
-
\??\c:\fxfrfll.exec:\fxfrfll.exe197⤵
-
\??\c:\rlffffl.exec:\rlffffl.exe198⤵
-
\??\c:\tnnbtt.exec:\tnnbtt.exe199⤵
-
\??\c:\jvjjp.exec:\jvjjp.exe200⤵
-
\??\c:\pdddj.exec:\pdddj.exe201⤵
-
\??\c:\xrxrxfr.exec:\xrxrxfr.exe202⤵
-
\??\c:\9rrrlll.exec:\9rrrlll.exe203⤵
-
\??\c:\3nnhnn.exec:\3nnhnn.exe204⤵
-
\??\c:\hbthnh.exec:\hbthnh.exe205⤵
-
\??\c:\vpdpd.exec:\vpdpd.exe206⤵
-
\??\c:\pdvvd.exec:\pdvvd.exe207⤵
-
\??\c:\ffrxflr.exec:\ffrxflr.exe208⤵
-
\??\c:\5fxxxrx.exec:\5fxxxrx.exe209⤵
-
\??\c:\bbthbb.exec:\bbthbb.exe210⤵
-
\??\c:\nbbnth.exec:\nbbnth.exe211⤵
-
\??\c:\7vjpv.exec:\7vjpv.exe212⤵
-
\??\c:\xxllllx.exec:\xxllllx.exe213⤵
-
\??\c:\xxlxfrx.exec:\xxlxfrx.exe214⤵
-
\??\c:\ttnhtb.exec:\ttnhtb.exe215⤵
-
\??\c:\nbnbhn.exec:\nbnbhn.exe216⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe217⤵
-
\??\c:\xlxrrll.exec:\xlxrrll.exe218⤵
-
\??\c:\rllrfrx.exec:\rllrfrx.exe219⤵
-
\??\c:\nhbntt.exec:\nhbntt.exe220⤵
-
\??\c:\hbhhtb.exec:\hbhhtb.exe221⤵
-
\??\c:\vvpdd.exec:\vvpdd.exe222⤵
-
\??\c:\9pdjp.exec:\9pdjp.exe223⤵
-
\??\c:\1flxxfl.exec:\1flxxfl.exe224⤵
-
\??\c:\xfxlxrr.exec:\xfxlxrr.exe225⤵
-
\??\c:\nnbhtb.exec:\nnbhtb.exe226⤵
-
\??\c:\hhbhtb.exec:\hhbhtb.exe227⤵
-
\??\c:\vppdj.exec:\vppdj.exe228⤵
-
\??\c:\5jjdj.exec:\5jjdj.exe229⤵
-
\??\c:\fxlrxlx.exec:\fxlrxlx.exe230⤵
-
\??\c:\9xllrrx.exec:\9xllrrx.exe231⤵
-
\??\c:\btnbnt.exec:\btnbnt.exe232⤵
-
\??\c:\nbhhhn.exec:\nbhhhn.exe233⤵
-
\??\c:\ddpjp.exec:\ddpjp.exe234⤵
-
\??\c:\fxffllr.exec:\fxffllr.exe235⤵
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe236⤵
-
\??\c:\9bhhhh.exec:\9bhhhh.exe237⤵
-
\??\c:\1hthht.exec:\1hthht.exe238⤵
-
\??\c:\7jpvv.exec:\7jpvv.exe239⤵
-
\??\c:\pppjd.exec:\pppjd.exe240⤵
-
\??\c:\lxrxlfl.exec:\lxrxlfl.exe241⤵