Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 13:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
546cae22c7e3802d36bb7b16fee89d377cf8278bae31e031b38cf47acaed590c_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
546cae22c7e3802d36bb7b16fee89d377cf8278bae31e031b38cf47acaed590c_NeikiAnalytics.exe
-
Size
127KB
-
MD5
511e0d8284b4c30420f6c9eeffedd6c0
-
SHA1
ca1dcbbde8cbf8ea366b443e45b6c31ea1f8002d
-
SHA256
546cae22c7e3802d36bb7b16fee89d377cf8278bae31e031b38cf47acaed590c
-
SHA512
85b9f12defdfc05b9c61e413ae6c28d44448e74cd15176ff68d5749b0f6a52fffa8174ba264007199f78312a9b8bbed41a61144d90dfceccc48d8246ab4fc537
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afodnmm9Ao98h3dktX4/J3:n3C9BRW0j/tmm9nwytI9
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/4632-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1644-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-76-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frfxxxx.exenhnhbb.exeppdvd.exelxfxrrl.exejppjj.exefrrfxfx.exe1rxxxxx.exettnnhh.exetnbtbb.exe9lrfxxx.exe5xrllfx.exe7hnnhn.exejjjdj.exe5xlrllr.exe5tnnhh.exe3jpjv.exerlrrffx.exetnhbnn.exe7btthb.exejpjdp.exerlxxrrr.exetbbbbb.exepdjjv.exevvdvj.exe1lffflf.exentbthh.exejpdvp.exevdjdd.exerlrlffx.exenbthtn.exepppjd.exe5xxrllf.exebtbtnn.exeddvpv.exethhhbb.exejjjjd.exerffxrxr.exe9fffxfx.exenntnnn.exedjjdp.exepjppp.exerrrlfxx.exennnhbn.exentbtnh.exejvpjd.exe3ppjv.exefrfxlfx.exe9hbbtt.exennnntt.exepjdpj.exellfxxxx.exe5bbthb.exevpjdv.exerlrlllr.exelflfffx.exebbbtnn.exedvdvp.exefrlfrrl.exehttnhh.exebbbnbb.exe7ddpd.exexrrlllf.exe9flfxrl.exethtnbb.exepid process 1648 frfxxxx.exe 1644 nhnhbb.exe 5056 ppdvd.exe 3124 lxfxrrl.exe 1044 jppjj.exe 1440 frrfxfx.exe 1084 1rxxxxx.exe 4048 ttnnhh.exe 4644 tnbtbb.exe 4300 9lrfxxx.exe 4456 5xrllfx.exe 5052 7hnnhn.exe 3996 jjjdj.exe 748 5xlrllr.exe 2716 5tnnhh.exe 1900 3jpjv.exe 2168 rlrrffx.exe 1780 tnhbnn.exe 4780 7btthb.exe 1584 jpjdp.exe 4432 rlxxrrr.exe 4316 tbbbbb.exe 4080 pdjjv.exe 3912 vvdvj.exe 3940 1lffflf.exe 3428 ntbthh.exe 4520 jpdvp.exe 2224 vdjdd.exe 4180 rlrlffx.exe 2372 nbthtn.exe 4440 pppjd.exe 5104 5xxrllf.exe 1092 btbtnn.exe 3944 ddvpv.exe 208 thhhbb.exe 4448 jjjjd.exe 4832 rffxrxr.exe 376 9fffxfx.exe 3468 nntnnn.exe 1644 djjdp.exe 1796 pjppp.exe 2940 rrrlfxx.exe 4964 nnnhbn.exe 800 ntbtnh.exe 2912 jvpjd.exe 1952 3ppjv.exe 2044 frfxlfx.exe 2156 9hbbtt.exe 4524 nnnntt.exe 3012 pjdpj.exe 5028 llfxxxx.exe 3660 5bbthb.exe 4484 vpjdv.exe 1168 rlrlllr.exe 3088 lflfffx.exe 2320 bbbtnn.exe 3396 dvdvp.exe 3528 frlfrrl.exe 4308 httnhh.exe 4828 bbbnbb.exe 3516 7ddpd.exe 1572 xrrlllf.exe 4916 9flfxrl.exe 1888 thtnbb.exe -
Processes:
resource yara_rule behavioral2/memory/4632-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
546cae22c7e3802d36bb7b16fee89d377cf8278bae31e031b38cf47acaed590c_NeikiAnalytics.exefrfxxxx.exenhnhbb.exeppdvd.exelxfxrrl.exejppjj.exefrrfxfx.exe1rxxxxx.exettnnhh.exetnbtbb.exe9lrfxxx.exe5xrllfx.exe7hnnhn.exejjjdj.exe5xlrllr.exe5tnnhh.exe3jpjv.exerlrrffx.exetnhbnn.exe7btthb.exejpjdp.exerlxxrrr.exedescription pid process target process PID 4632 wrote to memory of 1648 4632 546cae22c7e3802d36bb7b16fee89d377cf8278bae31e031b38cf47acaed590c_NeikiAnalytics.exe frfxxxx.exe PID 4632 wrote to memory of 1648 4632 546cae22c7e3802d36bb7b16fee89d377cf8278bae31e031b38cf47acaed590c_NeikiAnalytics.exe frfxxxx.exe PID 4632 wrote to memory of 1648 4632 546cae22c7e3802d36bb7b16fee89d377cf8278bae31e031b38cf47acaed590c_NeikiAnalytics.exe frfxxxx.exe PID 1648 wrote to memory of 1644 1648 frfxxxx.exe nhnhbb.exe PID 1648 wrote to memory of 1644 1648 frfxxxx.exe nhnhbb.exe PID 1648 wrote to memory of 1644 1648 frfxxxx.exe nhnhbb.exe PID 1644 wrote to memory of 5056 1644 nhnhbb.exe ppdvd.exe PID 1644 wrote to memory of 5056 1644 nhnhbb.exe ppdvd.exe PID 1644 wrote to memory of 5056 1644 nhnhbb.exe ppdvd.exe PID 5056 wrote to memory of 3124 5056 ppdvd.exe lxfxrrl.exe PID 5056 wrote to memory of 3124 5056 ppdvd.exe lxfxrrl.exe PID 5056 wrote to memory of 3124 5056 ppdvd.exe lxfxrrl.exe PID 3124 wrote to memory of 1044 3124 lxfxrrl.exe jppjj.exe PID 3124 wrote to memory of 1044 3124 lxfxrrl.exe jppjj.exe PID 3124 wrote to memory of 1044 3124 lxfxrrl.exe jppjj.exe PID 1044 wrote to memory of 1440 1044 jppjj.exe frrfxfx.exe PID 1044 wrote to memory of 1440 1044 jppjj.exe frrfxfx.exe PID 1044 wrote to memory of 1440 1044 jppjj.exe frrfxfx.exe PID 1440 wrote to memory of 1084 1440 frrfxfx.exe 1rxxxxx.exe PID 1440 wrote to memory of 1084 1440 frrfxfx.exe 1rxxxxx.exe PID 1440 wrote to memory of 1084 1440 frrfxfx.exe 1rxxxxx.exe PID 1084 wrote to memory of 4048 1084 1rxxxxx.exe ttnnhh.exe PID 1084 wrote to memory of 4048 1084 1rxxxxx.exe ttnnhh.exe PID 1084 wrote to memory of 4048 1084 1rxxxxx.exe ttnnhh.exe PID 4048 wrote to memory of 4644 4048 ttnnhh.exe tnbtbb.exe PID 4048 wrote to memory of 4644 4048 ttnnhh.exe tnbtbb.exe PID 4048 wrote to memory of 4644 4048 ttnnhh.exe tnbtbb.exe PID 4644 wrote to memory of 4300 4644 tnbtbb.exe 9lrfxxx.exe PID 4644 wrote to memory of 4300 4644 tnbtbb.exe 9lrfxxx.exe PID 4644 wrote to memory of 4300 4644 tnbtbb.exe 9lrfxxx.exe PID 4300 wrote to memory of 4456 4300 9lrfxxx.exe 5xrllfx.exe PID 4300 wrote to memory of 4456 4300 9lrfxxx.exe 5xrllfx.exe PID 4300 wrote to memory of 4456 4300 9lrfxxx.exe 5xrllfx.exe PID 4456 wrote to memory of 5052 4456 5xrllfx.exe 7hnnhn.exe PID 4456 wrote to memory of 5052 4456 5xrllfx.exe 7hnnhn.exe PID 4456 wrote to memory of 5052 4456 5xrllfx.exe 7hnnhn.exe PID 5052 wrote to memory of 3996 5052 7hnnhn.exe jjjdj.exe PID 5052 wrote to memory of 3996 5052 7hnnhn.exe jjjdj.exe PID 5052 wrote to memory of 3996 5052 7hnnhn.exe jjjdj.exe PID 3996 wrote to memory of 748 3996 jjjdj.exe 5xlrllr.exe PID 3996 wrote to memory of 748 3996 jjjdj.exe 5xlrllr.exe PID 3996 wrote to memory of 748 3996 jjjdj.exe 5xlrllr.exe PID 748 wrote to memory of 2716 748 5xlrllr.exe 5tnnhh.exe PID 748 wrote to memory of 2716 748 5xlrllr.exe 5tnnhh.exe PID 748 wrote to memory of 2716 748 5xlrllr.exe 5tnnhh.exe PID 2716 wrote to memory of 1900 2716 5tnnhh.exe 3jpjv.exe PID 2716 wrote to memory of 1900 2716 5tnnhh.exe 3jpjv.exe PID 2716 wrote to memory of 1900 2716 5tnnhh.exe 3jpjv.exe PID 1900 wrote to memory of 2168 1900 3jpjv.exe rlrrffx.exe PID 1900 wrote to memory of 2168 1900 3jpjv.exe rlrrffx.exe PID 1900 wrote to memory of 2168 1900 3jpjv.exe rlrrffx.exe PID 2168 wrote to memory of 1780 2168 rlrrffx.exe tnhbnn.exe PID 2168 wrote to memory of 1780 2168 rlrrffx.exe tnhbnn.exe PID 2168 wrote to memory of 1780 2168 rlrrffx.exe tnhbnn.exe PID 1780 wrote to memory of 4780 1780 tnhbnn.exe 7btthb.exe PID 1780 wrote to memory of 4780 1780 tnhbnn.exe 7btthb.exe PID 1780 wrote to memory of 4780 1780 tnhbnn.exe 7btthb.exe PID 4780 wrote to memory of 1584 4780 7btthb.exe jpjdp.exe PID 4780 wrote to memory of 1584 4780 7btthb.exe jpjdp.exe PID 4780 wrote to memory of 1584 4780 7btthb.exe jpjdp.exe PID 1584 wrote to memory of 4432 1584 jpjdp.exe rlxxrrr.exe PID 1584 wrote to memory of 4432 1584 jpjdp.exe rlxxrrr.exe PID 1584 wrote to memory of 4432 1584 jpjdp.exe rlxxrrr.exe PID 4432 wrote to memory of 4316 4432 rlxxrrr.exe tbbbbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\546cae22c7e3802d36bb7b16fee89d377cf8278bae31e031b38cf47acaed590c_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\546cae22c7e3802d36bb7b16fee89d377cf8278bae31e031b38cf47acaed590c_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\frfxxxx.exec:\frfxxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhnhbb.exec:\nhnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppdvd.exec:\ppdvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jppjj.exec:\jppjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frrfxfx.exec:\frrfxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1rxxxxx.exec:\1rxxxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttnnhh.exec:\ttnnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbtbb.exec:\tnbtbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9lrfxxx.exec:\9lrfxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5xrllfx.exec:\5xrllfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7hnnhn.exec:\7hnnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjjdj.exec:\jjjdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5xlrllr.exec:\5xlrllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5tnnhh.exec:\5tnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3jpjv.exec:\3jpjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlrrffx.exec:\rlrrffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnhbnn.exec:\tnhbnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7btthb.exec:\7btthb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpjdp.exec:\jpjdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbbbbb.exec:\tbbbbb.exe23⤵
- Executes dropped EXE
-
\??\c:\pdjjv.exec:\pdjjv.exe24⤵
- Executes dropped EXE
-
\??\c:\vvdvj.exec:\vvdvj.exe25⤵
- Executes dropped EXE
-
\??\c:\1lffflf.exec:\1lffflf.exe26⤵
- Executes dropped EXE
-
\??\c:\ntbthh.exec:\ntbthh.exe27⤵
- Executes dropped EXE
-
\??\c:\jpdvp.exec:\jpdvp.exe28⤵
- Executes dropped EXE
-
\??\c:\vdjdd.exec:\vdjdd.exe29⤵
- Executes dropped EXE
-
\??\c:\rlrlffx.exec:\rlrlffx.exe30⤵
- Executes dropped EXE
-
\??\c:\nbthtn.exec:\nbthtn.exe31⤵
- Executes dropped EXE
-
\??\c:\pppjd.exec:\pppjd.exe32⤵
- Executes dropped EXE
-
\??\c:\5xxrllf.exec:\5xxrllf.exe33⤵
- Executes dropped EXE
-
\??\c:\btbtnn.exec:\btbtnn.exe34⤵
- Executes dropped EXE
-
\??\c:\ddvpv.exec:\ddvpv.exe35⤵
- Executes dropped EXE
-
\??\c:\thhhbb.exec:\thhhbb.exe36⤵
- Executes dropped EXE
-
\??\c:\jjjjd.exec:\jjjjd.exe37⤵
- Executes dropped EXE
-
\??\c:\rffxrxr.exec:\rffxrxr.exe38⤵
- Executes dropped EXE
-
\??\c:\9fffxfx.exec:\9fffxfx.exe39⤵
- Executes dropped EXE
-
\??\c:\nntnnn.exec:\nntnnn.exe40⤵
- Executes dropped EXE
-
\??\c:\djjdp.exec:\djjdp.exe41⤵
- Executes dropped EXE
-
\??\c:\pjppp.exec:\pjppp.exe42⤵
- Executes dropped EXE
-
\??\c:\rrrlfxx.exec:\rrrlfxx.exe43⤵
- Executes dropped EXE
-
\??\c:\nnnhbn.exec:\nnnhbn.exe44⤵
- Executes dropped EXE
-
\??\c:\ntbtnh.exec:\ntbtnh.exe45⤵
- Executes dropped EXE
-
\??\c:\jvpjd.exec:\jvpjd.exe46⤵
- Executes dropped EXE
-
\??\c:\3ppjv.exec:\3ppjv.exe47⤵
- Executes dropped EXE
-
\??\c:\frfxlfx.exec:\frfxlfx.exe48⤵
- Executes dropped EXE
-
\??\c:\9hbbtt.exec:\9hbbtt.exe49⤵
- Executes dropped EXE
-
\??\c:\nnnntt.exec:\nnnntt.exe50⤵
- Executes dropped EXE
-
\??\c:\pjdpj.exec:\pjdpj.exe51⤵
- Executes dropped EXE
-
\??\c:\llfxxxx.exec:\llfxxxx.exe52⤵
- Executes dropped EXE
-
\??\c:\5bbthb.exec:\5bbthb.exe53⤵
- Executes dropped EXE
-
\??\c:\vpjdv.exec:\vpjdv.exe54⤵
- Executes dropped EXE
-
\??\c:\rlrlllr.exec:\rlrlllr.exe55⤵
- Executes dropped EXE
-
\??\c:\lflfffx.exec:\lflfffx.exe56⤵
- Executes dropped EXE
-
\??\c:\bbbtnn.exec:\bbbtnn.exe57⤵
- Executes dropped EXE
-
\??\c:\dvdvp.exec:\dvdvp.exe58⤵
- Executes dropped EXE
-
\??\c:\frlfrrl.exec:\frlfrrl.exe59⤵
- Executes dropped EXE
-
\??\c:\httnhh.exec:\httnhh.exe60⤵
- Executes dropped EXE
-
\??\c:\bbbnbb.exec:\bbbnbb.exe61⤵
- Executes dropped EXE
-
\??\c:\7ddpd.exec:\7ddpd.exe62⤵
- Executes dropped EXE
-
\??\c:\xrrlllf.exec:\xrrlllf.exe63⤵
- Executes dropped EXE
-
\??\c:\9flfxrl.exec:\9flfxrl.exe64⤵
- Executes dropped EXE
-
\??\c:\thtnbb.exec:\thtnbb.exe65⤵
- Executes dropped EXE
-
\??\c:\ththhh.exec:\ththhh.exe66⤵
-
\??\c:\1jdvp.exec:\1jdvp.exe67⤵
-
\??\c:\9jvdp.exec:\9jvdp.exe68⤵
-
\??\c:\lxrrlrr.exec:\lxrrlrr.exe69⤵
-
\??\c:\hbtbtn.exec:\hbtbtn.exe70⤵
-
\??\c:\vpjdv.exec:\vpjdv.exe71⤵
-
\??\c:\vjpjv.exec:\vjpjv.exe72⤵
-
\??\c:\5rlxllx.exec:\5rlxllx.exe73⤵
-
\??\c:\lfxxrlf.exec:\lfxxrlf.exe74⤵
-
\??\c:\9bbttn.exec:\9bbttn.exe75⤵
-
\??\c:\pjppj.exec:\pjppj.exe76⤵
-
\??\c:\jjjvd.exec:\jjjvd.exe77⤵
-
\??\c:\1llfrlf.exec:\1llfrlf.exe78⤵
-
\??\c:\lllfxrl.exec:\lllfxrl.exe79⤵
-
\??\c:\hnhbbt.exec:\hnhbbt.exe80⤵
-
\??\c:\dvvvp.exec:\dvvvp.exe81⤵
-
\??\c:\vdjdp.exec:\vdjdp.exe82⤵
-
\??\c:\tnhbtt.exec:\tnhbtt.exe83⤵
-
\??\c:\1tbbnn.exec:\1tbbnn.exe84⤵
-
\??\c:\9djdj.exec:\9djdj.exe85⤵
-
\??\c:\vjjdp.exec:\vjjdp.exe86⤵
-
\??\c:\rxfxlll.exec:\rxfxlll.exe87⤵
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe88⤵
-
\??\c:\tnhhbb.exec:\tnhhbb.exe89⤵
-
\??\c:\jdpdv.exec:\jdpdv.exe90⤵
-
\??\c:\jppjd.exec:\jppjd.exe91⤵
-
\??\c:\rlffxxl.exec:\rlffxxl.exe92⤵
-
\??\c:\bnbbtt.exec:\bnbbtt.exe93⤵
-
\??\c:\tttnbb.exec:\tttnbb.exe94⤵
-
\??\c:\vvvpd.exec:\vvvpd.exe95⤵
-
\??\c:\pdddv.exec:\pdddv.exe96⤵
-
\??\c:\fxxrffx.exec:\fxxrffx.exe97⤵
-
\??\c:\3nhbhh.exec:\3nhbhh.exe98⤵
-
\??\c:\thhbnn.exec:\thhbnn.exe99⤵
-
\??\c:\jvjvj.exec:\jvjvj.exe100⤵
-
\??\c:\jddjv.exec:\jddjv.exe101⤵
-
\??\c:\rfxrxfr.exec:\rfxrxfr.exe102⤵
-
\??\c:\thhbtt.exec:\thhbtt.exe103⤵
-
\??\c:\nnhhtn.exec:\nnhhtn.exe104⤵
-
\??\c:\jjjdd.exec:\jjjdd.exe105⤵
-
\??\c:\jjvvj.exec:\jjvvj.exe106⤵
-
\??\c:\rrxfffx.exec:\rrxfffx.exe107⤵
-
\??\c:\lxfxllx.exec:\lxfxllx.exe108⤵
-
\??\c:\tthnnt.exec:\tthnnt.exe109⤵
-
\??\c:\llxrrrr.exec:\llxrrrr.exe110⤵
-
\??\c:\9rrrrrl.exec:\9rrrrrl.exe111⤵
-
\??\c:\httnhb.exec:\httnhb.exe112⤵
-
\??\c:\nbhttt.exec:\nbhttt.exe113⤵
-
\??\c:\dddjp.exec:\dddjp.exe114⤵
-
\??\c:\lfrfxrl.exec:\lfrfxrl.exe115⤵
-
\??\c:\frxrlfx.exec:\frxrlfx.exe116⤵
-
\??\c:\nhhbbt.exec:\nhhbbt.exe117⤵
-
\??\c:\3bbttt.exec:\3bbttt.exe118⤵
-
\??\c:\1vvpj.exec:\1vvpj.exe119⤵
-
\??\c:\5rfxrll.exec:\5rfxrll.exe120⤵
-
\??\c:\7ffxrrr.exec:\7ffxrrr.exe121⤵
-
\??\c:\btbtbb.exec:\btbtbb.exe122⤵
-
\??\c:\pddvp.exec:\pddvp.exe123⤵
-
\??\c:\pvpjv.exec:\pvpjv.exe124⤵
-
\??\c:\xrrlffx.exec:\xrrlffx.exe125⤵
-
\??\c:\lfxfrrl.exec:\lfxfrrl.exe126⤵
-
\??\c:\tnnhnh.exec:\tnnhnh.exe127⤵
-
\??\c:\nnnhtt.exec:\nnnhtt.exe128⤵
-
\??\c:\vvjjd.exec:\vvjjd.exe129⤵
-
\??\c:\ddppj.exec:\ddppj.exe130⤵
-
\??\c:\ffrfxrr.exec:\ffrfxrr.exe131⤵
-
\??\c:\bnnhhh.exec:\bnnhhh.exe132⤵
-
\??\c:\7hnhnh.exec:\7hnhnh.exe133⤵
-
\??\c:\jdddv.exec:\jdddv.exe134⤵
-
\??\c:\pddjj.exec:\pddjj.exe135⤵
-
\??\c:\1ddvp.exec:\1ddvp.exe136⤵
-
\??\c:\llrrxxf.exec:\llrrxxf.exe137⤵
-
\??\c:\ntbtnn.exec:\ntbtnn.exe138⤵
-
\??\c:\hbhbhb.exec:\hbhbhb.exe139⤵
-
\??\c:\dpvpp.exec:\dpvpp.exe140⤵
-
\??\c:\vvpvp.exec:\vvpvp.exe141⤵
-
\??\c:\xfxrffx.exec:\xfxrffx.exe142⤵
-
\??\c:\lfxlfrf.exec:\lfxlfrf.exe143⤵
-
\??\c:\pppjj.exec:\pppjj.exe144⤵
-
\??\c:\lrxrfrl.exec:\lrxrfrl.exe145⤵
-
\??\c:\hhtbbb.exec:\hhtbbb.exe146⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe147⤵
-
\??\c:\dvjdd.exec:\dvjdd.exe148⤵
-
\??\c:\xlxxxlf.exec:\xlxxxlf.exe149⤵
-
\??\c:\bnbtnn.exec:\bnbtnn.exe150⤵
-
\??\c:\tnnhbb.exec:\tnnhbb.exe151⤵
-
\??\c:\bthbnn.exec:\bthbnn.exe152⤵
-
\??\c:\3pvvj.exec:\3pvvj.exe153⤵
-
\??\c:\vjjdd.exec:\vjjdd.exe154⤵
-
\??\c:\xrrfxxr.exec:\xrrfxxr.exe155⤵
-
\??\c:\nnnnnn.exec:\nnnnnn.exe156⤵
-
\??\c:\nbhbtb.exec:\nbhbtb.exe157⤵
-
\??\c:\pppvp.exec:\pppvp.exe158⤵
-
\??\c:\jvppd.exec:\jvppd.exe159⤵
-
\??\c:\9flfffl.exec:\9flfffl.exe160⤵
-
\??\c:\btnhnn.exec:\btnhnn.exe161⤵
-
\??\c:\3bhthh.exec:\3bhthh.exe162⤵
-
\??\c:\pdjvj.exec:\pdjvj.exe163⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe164⤵
-
\??\c:\rlffxrr.exec:\rlffxrr.exe165⤵
-
\??\c:\ttbtbb.exec:\ttbtbb.exe166⤵
-
\??\c:\9bhbnn.exec:\9bhbnn.exe167⤵
-
\??\c:\jdpjd.exec:\jdpjd.exe168⤵
-
\??\c:\xfrlllr.exec:\xfrlllr.exe169⤵
-
\??\c:\bnttnn.exec:\bnttnn.exe170⤵
-
\??\c:\3tnhbt.exec:\3tnhbt.exe171⤵
-
\??\c:\dvddv.exec:\dvddv.exe172⤵
-
\??\c:\7pvvj.exec:\7pvvj.exe173⤵
-
\??\c:\fxfxrxr.exec:\fxfxrxr.exe174⤵
-
\??\c:\frxrllf.exec:\frxrllf.exe175⤵
-
\??\c:\hhbbtb.exec:\hhbbtb.exe176⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe177⤵
-
\??\c:\dvvjv.exec:\dvvjv.exe178⤵
-
\??\c:\frxlfff.exec:\frxlfff.exe179⤵
-
\??\c:\lfflxxr.exec:\lfflxxr.exe180⤵
-
\??\c:\nhtnhh.exec:\nhtnhh.exe181⤵
-
\??\c:\hntnbb.exec:\hntnbb.exe182⤵
-
\??\c:\ppdjv.exec:\ppdjv.exe183⤵
-
\??\c:\jvjdp.exec:\jvjdp.exe184⤵
-
\??\c:\xxfxflx.exec:\xxfxflx.exe185⤵
-
\??\c:\3bnnbb.exec:\3bnnbb.exe186⤵
-
\??\c:\thhhhb.exec:\thhhhb.exe187⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe188⤵
-
\??\c:\pjdvp.exec:\pjdvp.exe189⤵
-
\??\c:\flxrllf.exec:\flxrllf.exe190⤵
-
\??\c:\frrxfff.exec:\frrxfff.exe191⤵
-
\??\c:\ttbbtt.exec:\ttbbtt.exe192⤵
-
\??\c:\7dvdj.exec:\7dvdj.exe193⤵
-
\??\c:\pjdpp.exec:\pjdpp.exe194⤵
-
\??\c:\lxfxllf.exec:\lxfxllf.exe195⤵
-
\??\c:\frrrllf.exec:\frrrllf.exe196⤵
-
\??\c:\tnbbnn.exec:\tnbbnn.exe197⤵
-
\??\c:\tbhtbt.exec:\tbhtbt.exe198⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe199⤵
-
\??\c:\5pppd.exec:\5pppd.exe200⤵
-
\??\c:\frrlxxr.exec:\frrlxxr.exe201⤵
-
\??\c:\rffxllf.exec:\rffxllf.exe202⤵
-
\??\c:\hnbtnn.exec:\hnbtnn.exe203⤵
-
\??\c:\7jppd.exec:\7jppd.exe204⤵
-
\??\c:\pvjvp.exec:\pvjvp.exe205⤵
-
\??\c:\lllxrrr.exec:\lllxrrr.exe206⤵
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe207⤵
-
\??\c:\ttbtnh.exec:\ttbtnh.exe208⤵
-
\??\c:\jdppp.exec:\jdppp.exe209⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe210⤵
-
\??\c:\xlrrlll.exec:\xlrrlll.exe211⤵
-
\??\c:\9lrrrrr.exec:\9lrrrrr.exe212⤵
-
\??\c:\hbntnn.exec:\hbntnn.exe213⤵
-
\??\c:\pjjdd.exec:\pjjdd.exe214⤵
-
\??\c:\dpvjd.exec:\dpvjd.exe215⤵
-
\??\c:\rlrlfrr.exec:\rlrlfrr.exe216⤵
-
\??\c:\hbhntt.exec:\hbhntt.exe217⤵
-
\??\c:\5nthbb.exec:\5nthbb.exe218⤵
-
\??\c:\hhhbnt.exec:\hhhbnt.exe219⤵
-
\??\c:\pdjdp.exec:\pdjdp.exe220⤵
-
\??\c:\vpvpp.exec:\vpvpp.exe221⤵
-
\??\c:\9xflffl.exec:\9xflffl.exe222⤵
-
\??\c:\tnnhbb.exec:\tnnhbb.exe223⤵
-
\??\c:\hhhhbb.exec:\hhhhbb.exe224⤵
-
\??\c:\1nhhtt.exec:\1nhhtt.exe225⤵
-
\??\c:\vvpjj.exec:\vvpjj.exe226⤵
-
\??\c:\xrrfxxr.exec:\xrrfxxr.exe227⤵
-
\??\c:\3rxxffl.exec:\3rxxffl.exe228⤵
-
\??\c:\1ttnnn.exec:\1ttnnn.exe229⤵
-
\??\c:\htbhhh.exec:\htbhhh.exe230⤵
-
\??\c:\vvvdv.exec:\vvvdv.exe231⤵
-
\??\c:\lfrlfff.exec:\lfrlfff.exe232⤵
-
\??\c:\1xffrrl.exec:\1xffrrl.exe233⤵
-
\??\c:\tbhhth.exec:\tbhhth.exe234⤵
-
\??\c:\nhhbtt.exec:\nhhbtt.exe235⤵
-
\??\c:\ppdpv.exec:\ppdpv.exe236⤵
-
\??\c:\jpdpj.exec:\jpdpj.exe237⤵
-
\??\c:\7rllxxr.exec:\7rllxxr.exe238⤵
-
\??\c:\rlrxrrx.exec:\rlrxrrx.exe239⤵
-
\??\c:\tbhbbb.exec:\tbhbbb.exe240⤵
-
\??\c:\9vvvp.exec:\9vvvp.exe241⤵