Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 19:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe
-
Size
74KB
-
MD5
062fbc89edfabbe4d40646eaaa1df6f0
-
SHA1
deb31373d58cbe019bc3df1758aee381151444e3
-
SHA256
006eca97dc6bb8d62ffd77d69cd7a8977a8b8ba321f21a9825c673a08764a80a
-
SHA512
ef116305234975e178c54d8f8d412f2c3e908e3904ebfdc4127c1f71729c6d95c71c85ad7ddb42bc01f4763eba13413ef4588deb165cb069787c63c6e4e9893f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJSsD+cGUFzJI:ymb3NkkiQ3mdBjFIwsDhbN6
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/1752-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1252-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/712-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1256-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/772-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jdpjd.exebhnbbb.exehnhthb.exejjddv.exelxlxlrx.exenhnbnh.exebnnhtt.exejdjjd.exelxlrfxr.exelxxlfxr.exenhtntt.exevvjdd.exe9xrllll.exebtbttt.exehbnhhh.exeddddv.exeffrxlxf.exe7hbbtb.exettnbtt.exedppvd.exerxlrrfl.exe9bhhbh.exehhbbnt.exe5ddvj.exexffrllf.exefxfxffr.exehnnnnn.exevjpjd.exexflxfrl.exehhbtbb.exe7djjd.exevpvdv.exellrllff.exe3xxrllf.exetnntbb.exe3bthhh.exe7jdvp.exe3ffxffx.exexlrxxfx.exebbbbbb.exebtthnn.exe1xfxrrr.exefllfxrr.exe3nnhbh.exebttthh.exevdvvd.exe9pjvp.exerlxxxxr.exe3rxfrrr.exehttnnn.exetbbtbb.exevjjjd.exerffxxrr.exetthhnn.exehhhbtt.exepjjdv.exeffrlfff.exelrxxxxf.exe9bhhhh.exevvjjv.exevpvpd.exerrlflfx.exebtbbbt.exeththnh.exepid process 2280 jdpjd.exe 1764 bhnbbb.exe 1084 hnhthb.exe 1508 jjddv.exe 3524 lxlxlrx.exe 1668 nhnbnh.exe 1448 bnnhtt.exe 1108 jdjjd.exe 5052 lxlrfxr.exe 5040 lxxlfxr.exe 1252 nhtntt.exe 4056 vvjdd.exe 4624 9xrllll.exe 1496 btbttt.exe 5084 hbnhhh.exe 4088 ddddv.exe 3184 ffrxlxf.exe 4168 7hbbtb.exe 4500 ttnbtt.exe 2220 dppvd.exe 2292 rxlrrfl.exe 1080 9bhhbh.exe 712 hhbbnt.exe 3408 5ddvj.exe 2644 xffrllf.exe 3772 fxfxffr.exe 396 hnnnnn.exe 1200 vjpjd.exe 1256 xflxfrl.exe 772 hhbtbb.exe 3276 7djjd.exe 4888 vpvdv.exe 4476 llrllff.exe 4760 3xxrllf.exe 4788 tnntbb.exe 2828 3bthhh.exe 1420 7jdvp.exe 1048 3ffxffx.exe 2612 xlrxxfx.exe 2324 bbbbbb.exe 1336 btthnn.exe 2800 1xfxrrr.exe 216 fllfxrr.exe 3724 3nnhbh.exe 2980 bttthh.exe 3544 vdvvd.exe 5040 9pjvp.exe 3100 rlxxxxr.exe 4056 3rxfrrr.exe 460 httnnn.exe 2872 tbbtbb.exe 3984 vjjjd.exe 4532 rffxxrr.exe 2056 tthhnn.exe 3900 hhhbtt.exe 4168 pjjdv.exe 4084 ffrlfff.exe 2220 lrxxxxf.exe 4988 9bhhhh.exe 1080 vvjjv.exe 4960 vpvpd.exe 3940 rrlflfx.exe 4076 btbbbt.exe 2644 ththnh.exe -
Processes:
resource yara_rule behavioral2/memory/1752-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1252-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/712-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1200-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1256-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/772-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exejdpjd.exebhnbbb.exehnhthb.exejjddv.exelxlxlrx.exenhnbnh.exebnnhtt.exejdjjd.exelxlrfxr.exelxxlfxr.exenhtntt.exevvjdd.exe9xrllll.exebtbttt.exehbnhhh.exeddddv.exeffrxlxf.exe7hbbtb.exettnbtt.exedppvd.exerxlrrfl.exedescription pid process target process PID 1752 wrote to memory of 2280 1752 062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe jdpjd.exe PID 1752 wrote to memory of 2280 1752 062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe jdpjd.exe PID 1752 wrote to memory of 2280 1752 062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe jdpjd.exe PID 2280 wrote to memory of 1764 2280 jdpjd.exe bhnbbb.exe PID 2280 wrote to memory of 1764 2280 jdpjd.exe bhnbbb.exe PID 2280 wrote to memory of 1764 2280 jdpjd.exe bhnbbb.exe PID 1764 wrote to memory of 1084 1764 bhnbbb.exe hnhthb.exe PID 1764 wrote to memory of 1084 1764 bhnbbb.exe hnhthb.exe PID 1764 wrote to memory of 1084 1764 bhnbbb.exe hnhthb.exe PID 1084 wrote to memory of 1508 1084 hnhthb.exe jjddv.exe PID 1084 wrote to memory of 1508 1084 hnhthb.exe jjddv.exe PID 1084 wrote to memory of 1508 1084 hnhthb.exe jjddv.exe PID 1508 wrote to memory of 3524 1508 jjddv.exe lxlxlrx.exe PID 1508 wrote to memory of 3524 1508 jjddv.exe lxlxlrx.exe PID 1508 wrote to memory of 3524 1508 jjddv.exe lxlxlrx.exe PID 3524 wrote to memory of 1668 3524 lxlxlrx.exe nhnbnh.exe PID 3524 wrote to memory of 1668 3524 lxlxlrx.exe nhnbnh.exe PID 3524 wrote to memory of 1668 3524 lxlxlrx.exe nhnbnh.exe PID 1668 wrote to memory of 1448 1668 nhnbnh.exe bnnhtt.exe PID 1668 wrote to memory of 1448 1668 nhnbnh.exe bnnhtt.exe PID 1668 wrote to memory of 1448 1668 nhnbnh.exe bnnhtt.exe PID 1448 wrote to memory of 1108 1448 bnnhtt.exe jdjjd.exe PID 1448 wrote to memory of 1108 1448 bnnhtt.exe jdjjd.exe PID 1448 wrote to memory of 1108 1448 bnnhtt.exe jdjjd.exe PID 1108 wrote to memory of 5052 1108 jdjjd.exe lxlrfxr.exe PID 1108 wrote to memory of 5052 1108 jdjjd.exe lxlrfxr.exe PID 1108 wrote to memory of 5052 1108 jdjjd.exe lxlrfxr.exe PID 5052 wrote to memory of 5040 5052 lxlrfxr.exe lxxlfxr.exe PID 5052 wrote to memory of 5040 5052 lxlrfxr.exe lxxlfxr.exe PID 5052 wrote to memory of 5040 5052 lxlrfxr.exe lxxlfxr.exe PID 5040 wrote to memory of 1252 5040 lxxlfxr.exe nhtntt.exe PID 5040 wrote to memory of 1252 5040 lxxlfxr.exe nhtntt.exe PID 5040 wrote to memory of 1252 5040 lxxlfxr.exe nhtntt.exe PID 1252 wrote to memory of 4056 1252 nhtntt.exe vvjdd.exe PID 1252 wrote to memory of 4056 1252 nhtntt.exe vvjdd.exe PID 1252 wrote to memory of 4056 1252 nhtntt.exe vvjdd.exe PID 4056 wrote to memory of 4624 4056 vvjdd.exe 9xrllll.exe PID 4056 wrote to memory of 4624 4056 vvjdd.exe 9xrllll.exe PID 4056 wrote to memory of 4624 4056 vvjdd.exe 9xrllll.exe PID 4624 wrote to memory of 1496 4624 9xrllll.exe btbttt.exe PID 4624 wrote to memory of 1496 4624 9xrllll.exe btbttt.exe PID 4624 wrote to memory of 1496 4624 9xrllll.exe btbttt.exe PID 1496 wrote to memory of 5084 1496 btbttt.exe hbnhhh.exe PID 1496 wrote to memory of 5084 1496 btbttt.exe hbnhhh.exe PID 1496 wrote to memory of 5084 1496 btbttt.exe hbnhhh.exe PID 5084 wrote to memory of 4088 5084 hbnhhh.exe ddddv.exe PID 5084 wrote to memory of 4088 5084 hbnhhh.exe ddddv.exe PID 5084 wrote to memory of 4088 5084 hbnhhh.exe ddddv.exe PID 4088 wrote to memory of 3184 4088 ddddv.exe ffrxlxf.exe PID 4088 wrote to memory of 3184 4088 ddddv.exe ffrxlxf.exe PID 4088 wrote to memory of 3184 4088 ddddv.exe ffrxlxf.exe PID 3184 wrote to memory of 4168 3184 ffrxlxf.exe 7hbbtb.exe PID 3184 wrote to memory of 4168 3184 ffrxlxf.exe 7hbbtb.exe PID 3184 wrote to memory of 4168 3184 ffrxlxf.exe 7hbbtb.exe PID 4168 wrote to memory of 4500 4168 7hbbtb.exe ttnbtt.exe PID 4168 wrote to memory of 4500 4168 7hbbtb.exe ttnbtt.exe PID 4168 wrote to memory of 4500 4168 7hbbtb.exe ttnbtt.exe PID 4500 wrote to memory of 2220 4500 ttnbtt.exe dppvd.exe PID 4500 wrote to memory of 2220 4500 ttnbtt.exe dppvd.exe PID 4500 wrote to memory of 2220 4500 ttnbtt.exe dppvd.exe PID 2220 wrote to memory of 2292 2220 dppvd.exe rxlrrfl.exe PID 2220 wrote to memory of 2292 2220 dppvd.exe rxlrrfl.exe PID 2220 wrote to memory of 2292 2220 dppvd.exe rxlrrfl.exe PID 2292 wrote to memory of 1080 2292 rxlrrfl.exe 9bhhbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\jdpjd.exec:\jdpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhnbbb.exec:\bhnbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnhthb.exec:\hnhthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjddv.exec:\jjddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxlxlrx.exec:\lxlxlrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhnbnh.exec:\nhnbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnnhtt.exec:\bnnhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjjd.exec:\jdjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxlrfxr.exec:\lxlrfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhtntt.exec:\nhtntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjdd.exec:\vvjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9xrllll.exec:\9xrllll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btbttt.exec:\btbttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbnhhh.exec:\hbnhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddddv.exec:\ddddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrxlxf.exec:\ffrxlxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7hbbtb.exec:\7hbbtb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttnbtt.exec:\ttnbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dppvd.exec:\dppvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxlrrfl.exec:\rxlrrfl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9bhhbh.exec:\9bhhbh.exe23⤵
- Executes dropped EXE
-
\??\c:\hhbbnt.exec:\hhbbnt.exe24⤵
- Executes dropped EXE
-
\??\c:\5ddvj.exec:\5ddvj.exe25⤵
- Executes dropped EXE
-
\??\c:\xffrllf.exec:\xffrllf.exe26⤵
- Executes dropped EXE
-
\??\c:\fxfxffr.exec:\fxfxffr.exe27⤵
- Executes dropped EXE
-
\??\c:\hnnnnn.exec:\hnnnnn.exe28⤵
- Executes dropped EXE
-
\??\c:\vjpjd.exec:\vjpjd.exe29⤵
- Executes dropped EXE
-
\??\c:\xflxfrl.exec:\xflxfrl.exe30⤵
- Executes dropped EXE
-
\??\c:\hhbtbb.exec:\hhbtbb.exe31⤵
- Executes dropped EXE
-
\??\c:\7djjd.exec:\7djjd.exe32⤵
- Executes dropped EXE
-
\??\c:\vpvdv.exec:\vpvdv.exe33⤵
- Executes dropped EXE
-
\??\c:\llrllff.exec:\llrllff.exe34⤵
- Executes dropped EXE
-
\??\c:\3xxrllf.exec:\3xxrllf.exe35⤵
- Executes dropped EXE
-
\??\c:\tnntbb.exec:\tnntbb.exe36⤵
- Executes dropped EXE
-
\??\c:\3bthhh.exec:\3bthhh.exe37⤵
- Executes dropped EXE
-
\??\c:\7jdvp.exec:\7jdvp.exe38⤵
- Executes dropped EXE
-
\??\c:\3ffxffx.exec:\3ffxffx.exe39⤵
- Executes dropped EXE
-
\??\c:\xlrxxfx.exec:\xlrxxfx.exe40⤵
- Executes dropped EXE
-
\??\c:\bbbbbb.exec:\bbbbbb.exe41⤵
- Executes dropped EXE
-
\??\c:\btthnn.exec:\btthnn.exe42⤵
- Executes dropped EXE
-
\??\c:\1xfxrrr.exec:\1xfxrrr.exe43⤵
- Executes dropped EXE
-
\??\c:\fllfxrr.exec:\fllfxrr.exe44⤵
- Executes dropped EXE
-
\??\c:\3nnhbh.exec:\3nnhbh.exe45⤵
- Executes dropped EXE
-
\??\c:\bttthh.exec:\bttthh.exe46⤵
- Executes dropped EXE
-
\??\c:\vdvvd.exec:\vdvvd.exe47⤵
- Executes dropped EXE
-
\??\c:\9pjvp.exec:\9pjvp.exe48⤵
- Executes dropped EXE
-
\??\c:\rlxxxxr.exec:\rlxxxxr.exe49⤵
- Executes dropped EXE
-
\??\c:\3rxfrrr.exec:\3rxfrrr.exe50⤵
- Executes dropped EXE
-
\??\c:\httnnn.exec:\httnnn.exe51⤵
- Executes dropped EXE
-
\??\c:\tbbtbb.exec:\tbbtbb.exe52⤵
- Executes dropped EXE
-
\??\c:\vjjjd.exec:\vjjjd.exe53⤵
- Executes dropped EXE
-
\??\c:\rffxxrr.exec:\rffxxrr.exe54⤵
- Executes dropped EXE
-
\??\c:\tthhnn.exec:\tthhnn.exe55⤵
- Executes dropped EXE
-
\??\c:\hhhbtt.exec:\hhhbtt.exe56⤵
- Executes dropped EXE
-
\??\c:\pjjdv.exec:\pjjdv.exe57⤵
- Executes dropped EXE
-
\??\c:\ffrlfff.exec:\ffrlfff.exe58⤵
- Executes dropped EXE
-
\??\c:\lrxxxxf.exec:\lrxxxxf.exe59⤵
- Executes dropped EXE
-
\??\c:\9bhhhh.exec:\9bhhhh.exe60⤵
- Executes dropped EXE
-
\??\c:\vvjjv.exec:\vvjjv.exe61⤵
- Executes dropped EXE
-
\??\c:\vpvpd.exec:\vpvpd.exe62⤵
- Executes dropped EXE
-
\??\c:\rrlflfx.exec:\rrlflfx.exe63⤵
- Executes dropped EXE
-
\??\c:\btbbbt.exec:\btbbbt.exe64⤵
- Executes dropped EXE
-
\??\c:\ththnh.exec:\ththnh.exe65⤵
- Executes dropped EXE
-
\??\c:\3jdvd.exec:\3jdvd.exe66⤵
-
\??\c:\ppdpd.exec:\ppdpd.exe67⤵
-
\??\c:\rfxrlfr.exec:\rfxrlfr.exe68⤵
-
\??\c:\5nthbt.exec:\5nthbt.exe69⤵
-
\??\c:\vjdjj.exec:\vjdjj.exe70⤵
-
\??\c:\pdjjv.exec:\pdjjv.exe71⤵
-
\??\c:\llxrllf.exec:\llxrllf.exe72⤵
-
\??\c:\bhtbht.exec:\bhtbht.exe73⤵
-
\??\c:\dvjpd.exec:\dvjpd.exe74⤵
-
\??\c:\vjdvj.exec:\vjdvj.exe75⤵
-
\??\c:\7pjdv.exec:\7pjdv.exe76⤵
-
\??\c:\9rlfrlx.exec:\9rlfrlx.exe77⤵
-
\??\c:\7nthtn.exec:\7nthtn.exe78⤵
-
\??\c:\pvjvd.exec:\pvjvd.exe79⤵
-
\??\c:\dvpdv.exec:\dvpdv.exe80⤵
-
\??\c:\7llfxxr.exec:\7llfxxr.exe81⤵
-
\??\c:\xrlxlfr.exec:\xrlxlfr.exe82⤵
-
\??\c:\bnhbtn.exec:\bnhbtn.exe83⤵
-
\??\c:\dpppv.exec:\dpppv.exe84⤵
-
\??\c:\flrxxxl.exec:\flrxxxl.exe85⤵
-
\??\c:\rlllxll.exec:\rlllxll.exe86⤵
-
\??\c:\hnnhbt.exec:\hnnhbt.exe87⤵
-
\??\c:\3ddpj.exec:\3ddpj.exe88⤵
-
\??\c:\7pppv.exec:\7pppv.exe89⤵
-
\??\c:\xrlxlxr.exec:\xrlxlxr.exe90⤵
-
\??\c:\llffflr.exec:\llffflr.exe91⤵
-
\??\c:\bnbttn.exec:\bnbttn.exe92⤵
-
\??\c:\1djvp.exec:\1djvp.exe93⤵
-
\??\c:\vjppd.exec:\vjppd.exe94⤵
-
\??\c:\1xlxlfx.exec:\1xlxlfx.exe95⤵
-
\??\c:\frfrrrr.exec:\frfrrrr.exe96⤵
-
\??\c:\tbtnhb.exec:\tbtnhb.exe97⤵
-
\??\c:\ntnhbt.exec:\ntnhbt.exe98⤵
-
\??\c:\vpppv.exec:\vpppv.exe99⤵
-
\??\c:\llxrxlr.exec:\llxrxlr.exe100⤵
-
\??\c:\fxlfrlf.exec:\fxlfrlf.exe101⤵
-
\??\c:\bhbthh.exec:\bhbthh.exe102⤵
-
\??\c:\nbthnh.exec:\nbthnh.exe103⤵
-
\??\c:\jpjdd.exec:\jpjdd.exe104⤵
-
\??\c:\jddvj.exec:\jddvj.exe105⤵
-
\??\c:\fxlxrlf.exec:\fxlxrlf.exe106⤵
-
\??\c:\hbbhhb.exec:\hbbhhb.exe107⤵
-
\??\c:\nnbthh.exec:\nnbthh.exe108⤵
-
\??\c:\pppdp.exec:\pppdp.exe109⤵
-
\??\c:\jdvvj.exec:\jdvvj.exe110⤵
-
\??\c:\xrrllff.exec:\xrrllff.exe111⤵
-
\??\c:\xlfxxxr.exec:\xlfxxxr.exe112⤵
-
\??\c:\3tttnn.exec:\3tttnn.exe113⤵
-
\??\c:\5hbthn.exec:\5hbthn.exe114⤵
-
\??\c:\3jvjp.exec:\3jvjp.exe115⤵
-
\??\c:\ppvjp.exec:\ppvjp.exe116⤵
-
\??\c:\frxxrfx.exec:\frxxrfx.exe117⤵
-
\??\c:\bbbtbt.exec:\bbbtbt.exe118⤵
-
\??\c:\nthbnh.exec:\nthbnh.exe119⤵
-
\??\c:\3jpjj.exec:\3jpjj.exe120⤵
-
\??\c:\vpppj.exec:\vpppj.exe121⤵
-
\??\c:\frrxxfx.exec:\frrxxfx.exe122⤵
-
\??\c:\rflfrxl.exec:\rflfrxl.exe123⤵
-
\??\c:\7hhhtt.exec:\7hhhtt.exe124⤵
-
\??\c:\hthtnn.exec:\hthtnn.exe125⤵
-
\??\c:\5djvd.exec:\5djvd.exe126⤵
-
\??\c:\9rfxlff.exec:\9rfxlff.exe127⤵
-
\??\c:\rffrfxr.exec:\rffrfxr.exe128⤵
-
\??\c:\bbnbtn.exec:\bbnbtn.exe129⤵
-
\??\c:\5ddvj.exec:\5ddvj.exe130⤵
-
\??\c:\djjpj.exec:\djjpj.exe131⤵
-
\??\c:\xffrxff.exec:\xffrxff.exe132⤵
-
\??\c:\jvvjd.exec:\jvvjd.exe133⤵
-
\??\c:\pvddj.exec:\pvddj.exe134⤵
-
\??\c:\xlxrfxl.exec:\xlxrfxl.exe135⤵
-
\??\c:\1bbtnn.exec:\1bbtnn.exe136⤵
-
\??\c:\tthhhn.exec:\tthhhn.exe137⤵
-
\??\c:\dvdvj.exec:\dvdvj.exe138⤵
-
\??\c:\xllxrlf.exec:\xllxrlf.exe139⤵
-
\??\c:\5lffrrl.exec:\5lffrrl.exe140⤵
-
\??\c:\tntntn.exec:\tntntn.exe141⤵
-
\??\c:\9dvvd.exec:\9dvvd.exe142⤵
-
\??\c:\jpjdp.exec:\jpjdp.exe143⤵
-
\??\c:\xxrfrlf.exec:\xxrfrlf.exe144⤵
-
\??\c:\xxlfrlx.exec:\xxlfrlx.exe145⤵
-
\??\c:\hbthnh.exec:\hbthnh.exe146⤵
-
\??\c:\tnhtbn.exec:\tnhtbn.exe147⤵
-
\??\c:\vddpd.exec:\vddpd.exe148⤵
-
\??\c:\7djvp.exec:\7djvp.exe149⤵
-
\??\c:\5rlxrlf.exec:\5rlxrlf.exe150⤵
-
\??\c:\9llxrlf.exec:\9llxrlf.exe151⤵
-
\??\c:\bnhbtn.exec:\bnhbtn.exe152⤵
-
\??\c:\5bbnnh.exec:\5bbnnh.exe153⤵
-
\??\c:\pjdpj.exec:\pjdpj.exe154⤵
-
\??\c:\lxxrffx.exec:\lxxrffx.exe155⤵
-
\??\c:\lfxrlll.exec:\lfxrlll.exe156⤵
-
\??\c:\nttbbt.exec:\nttbbt.exe157⤵
-
\??\c:\tnbnhh.exec:\tnbnhh.exe158⤵
-
\??\c:\dvvpv.exec:\dvvpv.exe159⤵
-
\??\c:\llffxrl.exec:\llffxrl.exe160⤵
-
\??\c:\fxrlxrr.exec:\fxrlxrr.exe161⤵
-
\??\c:\1xxlfrr.exec:\1xxlfrr.exe162⤵
-
\??\c:\tnnbbb.exec:\tnnbbb.exe163⤵
-
\??\c:\bttnth.exec:\bttnth.exe164⤵
-
\??\c:\jjjdj.exec:\jjjdj.exe165⤵
-
\??\c:\jdjdp.exec:\jdjdp.exe166⤵
-
\??\c:\3xrxlfr.exec:\3xrxlfr.exe167⤵
-
\??\c:\htnnbh.exec:\htnnbh.exe168⤵
-
\??\c:\7ttnhh.exec:\7ttnhh.exe169⤵
-
\??\c:\djjdv.exec:\djjdv.exe170⤵
-
\??\c:\5rlfxxf.exec:\5rlfxxf.exe171⤵
-
\??\c:\rlxxxxr.exec:\rlxxxxr.exe172⤵
-
\??\c:\bbnbbb.exec:\bbnbbb.exe173⤵
-
\??\c:\bthbtb.exec:\bthbtb.exe174⤵
-
\??\c:\djppj.exec:\djppj.exe175⤵
-
\??\c:\vjdjv.exec:\vjdjv.exe176⤵
-
\??\c:\fxxlrlx.exec:\fxxlrlx.exe177⤵
-
\??\c:\hhhthb.exec:\hhhthb.exe178⤵
-
\??\c:\vjvjp.exec:\vjvjp.exe179⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe180⤵
-
\??\c:\fxfrrrl.exec:\fxfrrrl.exe181⤵
-
\??\c:\bhbhhh.exec:\bhbhhh.exe182⤵
-
\??\c:\nhbbnn.exec:\nhbbnn.exe183⤵
-
\??\c:\9vdjd.exec:\9vdjd.exe184⤵
-
\??\c:\5lrrfff.exec:\5lrrfff.exe185⤵
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe186⤵
-
\??\c:\tnhbnh.exec:\tnhbnh.exe187⤵
-
\??\c:\hnhhhn.exec:\hnhhhn.exe188⤵
-
\??\c:\vpdvd.exec:\vpdvd.exe189⤵
-
\??\c:\jvddp.exec:\jvddp.exe190⤵
-
\??\c:\fxfrfrx.exec:\fxfrfrx.exe191⤵
-
\??\c:\ffffllr.exec:\ffffllr.exe192⤵
-
\??\c:\nbbtnn.exec:\nbbtnn.exe193⤵
-
\??\c:\dppdv.exec:\dppdv.exe194⤵
-
\??\c:\pjpdp.exec:\pjpdp.exe195⤵
-
\??\c:\rxrlfrl.exec:\rxrlfrl.exe196⤵
-
\??\c:\3hhhbb.exec:\3hhhbb.exe197⤵
-
\??\c:\tbtnht.exec:\tbtnht.exe198⤵
-
\??\c:\7vjjd.exec:\7vjjd.exe199⤵
-
\??\c:\1vpjd.exec:\1vpjd.exe200⤵
-
\??\c:\lxxrllf.exec:\lxxrllf.exe201⤵
-
\??\c:\1nnhtn.exec:\1nnhtn.exe202⤵
-
\??\c:\nhbbbb.exec:\nhbbbb.exe203⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe204⤵
-
\??\c:\djvvp.exec:\djvvp.exe205⤵
-
\??\c:\rrlxxxf.exec:\rrlxxxf.exe206⤵
-
\??\c:\xlfrfxl.exec:\xlfrfxl.exe207⤵
-
\??\c:\1tthbt.exec:\1tthbt.exe208⤵
-
\??\c:\djpjv.exec:\djpjv.exe209⤵
-
\??\c:\pdjdv.exec:\pdjdv.exe210⤵
-
\??\c:\flffxxx.exec:\flffxxx.exe211⤵
-
\??\c:\rflfxrl.exec:\rflfxrl.exe212⤵
-
\??\c:\lxrfrrf.exec:\lxrfrrf.exe213⤵
-
\??\c:\bthhnn.exec:\bthhnn.exe214⤵
-
\??\c:\hbthbb.exec:\hbthbb.exe215⤵
-
\??\c:\3jjdp.exec:\3jjdp.exe216⤵
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe217⤵
-
\??\c:\fffxrrl.exec:\fffxrrl.exe218⤵
-
\??\c:\tthbhh.exec:\tthbhh.exe219⤵
-
\??\c:\thhbhh.exec:\thhbhh.exe220⤵
-
\??\c:\dvpjd.exec:\dvpjd.exe221⤵
-
\??\c:\vjddv.exec:\vjddv.exe222⤵
-
\??\c:\xxrrllf.exec:\xxrrllf.exe223⤵
-
\??\c:\flxlxrl.exec:\flxlxrl.exe224⤵
-
\??\c:\hhhnbb.exec:\hhhnbb.exe225⤵
-
\??\c:\hbtnbn.exec:\hbtnbn.exe226⤵
-
\??\c:\jdpdv.exec:\jdpdv.exe227⤵
-
\??\c:\jppjd.exec:\jppjd.exe228⤵
-
\??\c:\ffrlxfx.exec:\ffrlxfx.exe229⤵
-
\??\c:\lfxxxrx.exec:\lfxxxrx.exe230⤵
-
\??\c:\jjjdv.exec:\jjjdv.exe231⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe232⤵
-
\??\c:\fllfxxr.exec:\fllfxxr.exe233⤵
-
\??\c:\rlffllx.exec:\rlffllx.exe234⤵
-
\??\c:\hhhthh.exec:\hhhthh.exe235⤵
-
\??\c:\vdjpj.exec:\vdjpj.exe236⤵
-
\??\c:\5rlxrrr.exec:\5rlxrrr.exe237⤵
-
\??\c:\fxxxlfx.exec:\fxxxlfx.exe238⤵
-
\??\c:\btbttt.exec:\btbttt.exe239⤵
-
\??\c:\btbbtt.exec:\btbbtt.exe240⤵
-
\??\c:\1vpdd.exec:\1vpdd.exe241⤵