Analysis
-
max time kernel
107s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 00:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1279219da5e932773ca9c7700b9e5120_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
1279219da5e932773ca9c7700b9e5120_NeikiAnalytics.exe
-
Size
77KB
-
MD5
1279219da5e932773ca9c7700b9e5120
-
SHA1
b6a384a64f7e98e6d7bf3e53caf7683e64bc9c51
-
SHA256
23b620fe474bbfff2e3ca855052e8cc4cea83cdfae7ae47d63be29ea3a4ad8cd
-
SHA512
ae19b7c4d188c53d87e30ae8f3b3a3cfe99d2e9f758da6301f7f35325b51274a344cc4616d95e235ba081948bc7b059604b6e05d2042cf5190c6c3ee5a577ec5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgJb31HgxGc+gmvZQCM:ymb3NkkiQ3mdBjFIUb31HgxL+gmvZjM
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/4776-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2872-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4184-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1484-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lxlllrr.exejpppd.exevjdjd.exenbbtnn.exevvjjp.exebttbtb.exe9ppjd.exevpjvv.exelxfxrrl.exetnnnnb.exenhthnb.exejjvdj.exe9rxlfxx.exelfrxrxf.exenbbttt.exejpddv.exeffxxxll.exehbhbbt.exebbhhbt.exevjvdj.exelfllrfx.exettbnht.exejvjdd.exefrffflf.exe1tbtnn.exedpjjj.exefxrfxxx.exe7xlfxfx.exenbhhnn.exedvjpv.exevpppd.exelrrlxxr.exe7httnt.exepvjvp.exedvjpj.exe9bhnbb.exennnnbt.exepjdvp.exedpjjd.exelfflxxf.exelxflxlx.exenhbhnh.exehnnttn.exejpppd.exe3vvpd.exelxflrff.exeffllflf.exe9nnhbb.exedvddv.exejpjvd.exerrllrrl.exexrrfffl.exehnbnhn.exejpdvd.exellrrrxl.exerfrlffr.exetttbbt.exejvvvj.exevjjjp.exerffllxl.exefxlfxxx.exehnthhh.exebtbbnb.exevjvjp.exepid process 4164 lxlllrr.exe 3044 jpppd.exe 4372 vjdjd.exe 4032 nbbtnn.exe 4756 vvjjp.exe 2496 bttbtb.exe 3996 9ppjd.exe 756 vpjvv.exe 3192 lxfxrrl.exe 1536 tnnnnb.exe 4888 nhthnb.exe 3308 jjvdj.exe 3692 9rxlfxx.exe 2872 lfrxrxf.exe 4184 nbbttt.exe 1636 jpddv.exe 3580 ffxxxll.exe 4828 hbhbbt.exe 3536 bbhhbt.exe 1976 vjvdj.exe 4964 lfllrfx.exe 1692 ttbnht.exe 1676 jvjdd.exe 4608 frffflf.exe 2552 1tbtnn.exe 3296 dpjjj.exe 2056 fxrfxxx.exe 3372 7xlfxfx.exe 1484 nbhhnn.exe 4904 dvjpv.exe 1004 vpppd.exe 112 lrrlxxr.exe 1584 7httnt.exe 4384 pvjvp.exe 4444 dvjpj.exe 4392 9bhnbb.exe 3784 nnnnbt.exe 4100 pjdvp.exe 4372 dpjjd.exe 2944 lfflxxf.exe 1924 lxflxlx.exe 2448 nhbhnh.exe 1868 hnnttn.exe 2940 jpppd.exe 5004 3vvpd.exe 3240 lxflrff.exe 3252 ffllflf.exe 4988 9nnhbb.exe 3504 dvddv.exe 2004 jpjvd.exe 3988 rrllrrl.exe 1248 xrrfffl.exe 4620 hnbnhn.exe 1200 jpdvd.exe 1836 llrrrxl.exe 3676 rfrlffr.exe 2596 tttbbt.exe 1948 jvvvj.exe 1520 vjjjp.exe 4964 rffllxl.exe 1660 fxlfxxx.exe 4180 hnthhh.exe 1456 btbbnb.exe 2992 vjvjp.exe -
Processes:
resource yara_rule behavioral2/memory/4776-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1484-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-178-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1279219da5e932773ca9c7700b9e5120_NeikiAnalytics.exelxlllrr.exejpppd.exevjdjd.exenbbtnn.exevvjjp.exebttbtb.exe9ppjd.exevpjvv.exelxfxrrl.exetnnnnb.exenhthnb.exejjvdj.exe9rxlfxx.exelfrxrxf.exenbbttt.exejpddv.exeffxxxll.exehbhbbt.exebbhhbt.exevjvdj.exelfllrfx.exedescription pid process target process PID 4776 wrote to memory of 4164 4776 1279219da5e932773ca9c7700b9e5120_NeikiAnalytics.exe bhhbnb.exe PID 4776 wrote to memory of 4164 4776 1279219da5e932773ca9c7700b9e5120_NeikiAnalytics.exe bhhbnb.exe PID 4776 wrote to memory of 4164 4776 1279219da5e932773ca9c7700b9e5120_NeikiAnalytics.exe bhhbnb.exe PID 4164 wrote to memory of 3044 4164 lxlllrr.exe jpppd.exe PID 4164 wrote to memory of 3044 4164 lxlllrr.exe jpppd.exe PID 4164 wrote to memory of 3044 4164 lxlllrr.exe jpppd.exe PID 3044 wrote to memory of 4372 3044 jpppd.exe dpjjd.exe PID 3044 wrote to memory of 4372 3044 jpppd.exe dpjjd.exe PID 3044 wrote to memory of 4372 3044 jpppd.exe dpjjd.exe PID 4372 wrote to memory of 4032 4372 vjdjd.exe nbbtnn.exe PID 4372 wrote to memory of 4032 4372 vjdjd.exe nbbtnn.exe PID 4372 wrote to memory of 4032 4372 vjdjd.exe nbbtnn.exe PID 4032 wrote to memory of 4756 4032 nbbtnn.exe jvddd.exe PID 4032 wrote to memory of 4756 4032 nbbtnn.exe jvddd.exe PID 4032 wrote to memory of 4756 4032 nbbtnn.exe jvddd.exe PID 4756 wrote to memory of 2496 4756 vvjjp.exe bttbtb.exe PID 4756 wrote to memory of 2496 4756 vvjjp.exe bttbtb.exe PID 4756 wrote to memory of 2496 4756 vvjjp.exe bttbtb.exe PID 2496 wrote to memory of 3996 2496 bttbtb.exe 9ppjd.exe PID 2496 wrote to memory of 3996 2496 bttbtb.exe 9ppjd.exe PID 2496 wrote to memory of 3996 2496 bttbtb.exe 9ppjd.exe PID 3996 wrote to memory of 756 3996 9ppjd.exe vpjvv.exe PID 3996 wrote to memory of 756 3996 9ppjd.exe vpjvv.exe PID 3996 wrote to memory of 756 3996 9ppjd.exe vpjvv.exe PID 756 wrote to memory of 3192 756 vpjvv.exe lxfxrrl.exe PID 756 wrote to memory of 3192 756 vpjvv.exe lxfxrrl.exe PID 756 wrote to memory of 3192 756 vpjvv.exe lxfxrrl.exe PID 3192 wrote to memory of 1536 3192 lxfxrrl.exe bhbtht.exe PID 3192 wrote to memory of 1536 3192 lxfxrrl.exe bhbtht.exe PID 3192 wrote to memory of 1536 3192 lxfxrrl.exe bhbtht.exe PID 1536 wrote to memory of 4888 1536 tnnnnb.exe nhthnb.exe PID 1536 wrote to memory of 4888 1536 tnnnnb.exe nhthnb.exe PID 1536 wrote to memory of 4888 1536 tnnnnb.exe nhthnb.exe PID 4888 wrote to memory of 3308 4888 nhthnb.exe 5lllflf.exe PID 4888 wrote to memory of 3308 4888 nhthnb.exe 5lllflf.exe PID 4888 wrote to memory of 3308 4888 nhthnb.exe 5lllflf.exe PID 3308 wrote to memory of 3692 3308 jjvdj.exe 9rxlfxx.exe PID 3308 wrote to memory of 3692 3308 jjvdj.exe 9rxlfxx.exe PID 3308 wrote to memory of 3692 3308 jjvdj.exe 9rxlfxx.exe PID 3692 wrote to memory of 2872 3692 9rxlfxx.exe dvvpp.exe PID 3692 wrote to memory of 2872 3692 9rxlfxx.exe dvvpp.exe PID 3692 wrote to memory of 2872 3692 9rxlfxx.exe dvvpp.exe PID 2872 wrote to memory of 4184 2872 lfrxrxf.exe nbbttt.exe PID 2872 wrote to memory of 4184 2872 lfrxrxf.exe nbbttt.exe PID 2872 wrote to memory of 4184 2872 lfrxrxf.exe nbbttt.exe PID 4184 wrote to memory of 1636 4184 nbbttt.exe 1nhbnn.exe PID 4184 wrote to memory of 1636 4184 nbbttt.exe 1nhbnn.exe PID 4184 wrote to memory of 1636 4184 nbbttt.exe 1nhbnn.exe PID 1636 wrote to memory of 3580 1636 jpddv.exe ffxxxll.exe PID 1636 wrote to memory of 3580 1636 jpddv.exe ffxxxll.exe PID 1636 wrote to memory of 3580 1636 jpddv.exe ffxxxll.exe PID 3580 wrote to memory of 4828 3580 ffxxxll.exe hbhbbt.exe PID 3580 wrote to memory of 4828 3580 ffxxxll.exe hbhbbt.exe PID 3580 wrote to memory of 4828 3580 ffxxxll.exe hbhbbt.exe PID 4828 wrote to memory of 3536 4828 hbhbbt.exe bbhhbt.exe PID 4828 wrote to memory of 3536 4828 hbhbbt.exe bbhhbt.exe PID 4828 wrote to memory of 3536 4828 hbhbbt.exe bbhhbt.exe PID 3536 wrote to memory of 1976 3536 bbhhbt.exe vjvdj.exe PID 3536 wrote to memory of 1976 3536 bbhhbt.exe vjvdj.exe PID 3536 wrote to memory of 1976 3536 bbhhbt.exe vjvdj.exe PID 1976 wrote to memory of 4964 1976 vjvdj.exe jddvp.exe PID 1976 wrote to memory of 4964 1976 vjvdj.exe jddvp.exe PID 1976 wrote to memory of 4964 1976 vjvdj.exe jddvp.exe PID 4964 wrote to memory of 1692 4964 lfllrfx.exe lllxxlr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1279219da5e932773ca9c7700b9e5120_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1279219da5e932773ca9c7700b9e5120_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\lxlllrr.exec:\lxlllrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpppd.exec:\jpppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjdjd.exec:\vjdjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbbtnn.exec:\nbbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjjp.exec:\vvjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bttbtb.exec:\bttbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9ppjd.exec:\9ppjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjvv.exec:\vpjvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnnnnb.exec:\tnnnnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhthnb.exec:\nhthnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjvdj.exec:\jjvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9rxlfxx.exec:\9rxlfxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfrxrxf.exec:\lfrxrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbbttt.exec:\nbbttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpddv.exec:\jpddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxxxll.exec:\ffxxxll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhbbt.exec:\hbhbbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbhhbt.exec:\bbhhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjvdj.exec:\vjvdj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfllrfx.exec:\lfllrfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttbnht.exec:\ttbnht.exe23⤵
- Executes dropped EXE
-
\??\c:\jvjdd.exec:\jvjdd.exe24⤵
- Executes dropped EXE
-
\??\c:\frffflf.exec:\frffflf.exe25⤵
- Executes dropped EXE
-
\??\c:\1tbtnn.exec:\1tbtnn.exe26⤵
- Executes dropped EXE
-
\??\c:\dpjjj.exec:\dpjjj.exe27⤵
- Executes dropped EXE
-
\??\c:\fxrfxxx.exec:\fxrfxxx.exe28⤵
- Executes dropped EXE
-
\??\c:\7xlfxfx.exec:\7xlfxfx.exe29⤵
- Executes dropped EXE
-
\??\c:\nbhhnn.exec:\nbhhnn.exe30⤵
- Executes dropped EXE
-
\??\c:\dvjpv.exec:\dvjpv.exe31⤵
- Executes dropped EXE
-
\??\c:\vpppd.exec:\vpppd.exe32⤵
- Executes dropped EXE
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe33⤵
- Executes dropped EXE
-
\??\c:\7httnt.exec:\7httnt.exe34⤵
- Executes dropped EXE
-
\??\c:\pvjvp.exec:\pvjvp.exe35⤵
- Executes dropped EXE
-
\??\c:\dvjpj.exec:\dvjpj.exe36⤵
- Executes dropped EXE
-
\??\c:\xrlfflf.exec:\xrlfflf.exe37⤵
-
\??\c:\9bhnbb.exec:\9bhnbb.exe38⤵
- Executes dropped EXE
-
\??\c:\nnnnbt.exec:\nnnnbt.exe39⤵
- Executes dropped EXE
-
\??\c:\pjdvp.exec:\pjdvp.exe40⤵
- Executes dropped EXE
-
\??\c:\dpjjd.exec:\dpjjd.exe41⤵
- Executes dropped EXE
-
\??\c:\lfflxxf.exec:\lfflxxf.exe42⤵
- Executes dropped EXE
-
\??\c:\lxflxlx.exec:\lxflxlx.exe43⤵
- Executes dropped EXE
-
\??\c:\nhbhnh.exec:\nhbhnh.exe44⤵
- Executes dropped EXE
-
\??\c:\hnnttn.exec:\hnnttn.exe45⤵
- Executes dropped EXE
-
\??\c:\jpppd.exec:\jpppd.exe46⤵
- Executes dropped EXE
-
\??\c:\3vvpd.exec:\3vvpd.exe47⤵
- Executes dropped EXE
-
\??\c:\lxflrff.exec:\lxflrff.exe48⤵
- Executes dropped EXE
-
\??\c:\ffllflf.exec:\ffllflf.exe49⤵
- Executes dropped EXE
-
\??\c:\9nnhbb.exec:\9nnhbb.exe50⤵
- Executes dropped EXE
-
\??\c:\dvddv.exec:\dvddv.exe51⤵
- Executes dropped EXE
-
\??\c:\jpjvd.exec:\jpjvd.exe52⤵
- Executes dropped EXE
-
\??\c:\rrllrrl.exec:\rrllrrl.exe53⤵
- Executes dropped EXE
-
\??\c:\xrrfffl.exec:\xrrfffl.exe54⤵
- Executes dropped EXE
-
\??\c:\hnbnhn.exec:\hnbnhn.exe55⤵
- Executes dropped EXE
-
\??\c:\jpdvd.exec:\jpdvd.exe56⤵
- Executes dropped EXE
-
\??\c:\llrrrxl.exec:\llrrrxl.exe57⤵
- Executes dropped EXE
-
\??\c:\rfrlffr.exec:\rfrlffr.exe58⤵
- Executes dropped EXE
-
\??\c:\tttbbt.exec:\tttbbt.exe59⤵
- Executes dropped EXE
-
\??\c:\jvvvj.exec:\jvvvj.exe60⤵
- Executes dropped EXE
-
\??\c:\vjjjp.exec:\vjjjp.exe61⤵
- Executes dropped EXE
-
\??\c:\rffllxl.exec:\rffllxl.exe62⤵
- Executes dropped EXE
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe63⤵
- Executes dropped EXE
-
\??\c:\hnthhh.exec:\hnthhh.exe64⤵
- Executes dropped EXE
-
\??\c:\btbbnb.exec:\btbbnb.exe65⤵
- Executes dropped EXE
-
\??\c:\vjvjp.exec:\vjvjp.exe66⤵
- Executes dropped EXE
-
\??\c:\rrllrlf.exec:\rrllrlf.exe67⤵
-
\??\c:\rlrfxlf.exec:\rlrfxlf.exe68⤵
-
\??\c:\ntnnnb.exec:\ntnnnb.exe69⤵
-
\??\c:\nbtntb.exec:\nbtntb.exe70⤵
-
\??\c:\jdvpp.exec:\jdvpp.exe71⤵
-
\??\c:\ffxrrxx.exec:\ffxrrxx.exe72⤵
-
\??\c:\flxxrlf.exec:\flxxrlf.exe73⤵
-
\??\c:\vjpjv.exec:\vjpjv.exe74⤵
-
\??\c:\vjdvp.exec:\vjdvp.exe75⤵
-
\??\c:\ffflrrr.exec:\ffflrrr.exe76⤵
-
\??\c:\rflxrfr.exec:\rflxrfr.exe77⤵
-
\??\c:\bhhbnb.exec:\bhhbnb.exe78⤵
-
\??\c:\bttbtn.exec:\bttbtn.exe79⤵
-
\??\c:\vpdpp.exec:\vpdpp.exe80⤵
-
\??\c:\ddvpd.exec:\ddvpd.exe81⤵
-
\??\c:\rfrxxrl.exec:\rfrxxrl.exe82⤵
-
\??\c:\rfffrrx.exec:\rfffrrx.exe83⤵
-
\??\c:\7thttn.exec:\7thttn.exe84⤵
-
\??\c:\btbbbh.exec:\btbbbh.exe85⤵
-
\??\c:\vppvj.exec:\vppvj.exe86⤵
-
\??\c:\vjvpj.exec:\vjvpj.exe87⤵
-
\??\c:\xrrxlrr.exec:\xrrxlrr.exe88⤵
-
\??\c:\lrffxxx.exec:\lrffxxx.exe89⤵
-
\??\c:\hbnhbh.exec:\hbnhbh.exe90⤵
-
\??\c:\bhbtht.exec:\bhbtht.exe91⤵
-
\??\c:\pjjjv.exec:\pjjjv.exe92⤵
-
\??\c:\pjdpp.exec:\pjdpp.exe93⤵
-
\??\c:\llrlfff.exec:\llrlfff.exe94⤵
-
\??\c:\xrfllff.exec:\xrfllff.exe95⤵
-
\??\c:\hnbbbb.exec:\hnbbbb.exe96⤵
-
\??\c:\1nhbnn.exec:\1nhbnn.exe97⤵
-
\??\c:\thttnn.exec:\thttnn.exe98⤵
-
\??\c:\3pddp.exec:\3pddp.exe99⤵
-
\??\c:\vdddd.exec:\vdddd.exe100⤵
-
\??\c:\9lrrlrr.exec:\9lrrlrr.exe101⤵
-
\??\c:\fflfxff.exec:\fflfxff.exe102⤵
-
\??\c:\nnbbbb.exec:\nnbbbb.exe103⤵
-
\??\c:\nnhhnn.exec:\nnhhnn.exe104⤵
-
\??\c:\jddvp.exec:\jddvp.exe105⤵
-
\??\c:\jddvp.exec:\jddvp.exe106⤵
-
\??\c:\rllfxxx.exec:\rllfxxx.exe107⤵
-
\??\c:\fffxxfx.exec:\fffxxfx.exe108⤵
-
\??\c:\xxrrxxr.exec:\xxrrxxr.exe109⤵
-
\??\c:\thnnnn.exec:\thnnnn.exe110⤵
-
\??\c:\1htnhh.exec:\1htnhh.exe111⤵
-
\??\c:\pddvp.exec:\pddvp.exe112⤵
-
\??\c:\9pvpj.exec:\9pvpj.exe113⤵
-
\??\c:\1xfxrrl.exec:\1xfxrrl.exe114⤵
-
\??\c:\flrllrl.exec:\flrllrl.exe115⤵
-
\??\c:\lxffflf.exec:\lxffflf.exe116⤵
-
\??\c:\hbhtth.exec:\hbhtth.exe117⤵
-
\??\c:\thhtht.exec:\thhtht.exe118⤵
-
\??\c:\vdvpv.exec:\vdvpv.exe119⤵
-
\??\c:\pjpvp.exec:\pjpvp.exe120⤵
-
\??\c:\rrxxxlr.exec:\rrxxxlr.exe121⤵
-
\??\c:\xxrlxlf.exec:\xxrlxlf.exe122⤵
-
\??\c:\tntbbh.exec:\tntbbh.exe123⤵
-
\??\c:\vdddv.exec:\vdddv.exe124⤵
-
\??\c:\pjjpv.exec:\pjjpv.exe125⤵
-
\??\c:\xrrfxfl.exec:\xrrfxfl.exe126⤵
-
\??\c:\fxrxrfx.exec:\fxrxrfx.exe127⤵
-
\??\c:\nbtbnt.exec:\nbtbnt.exe128⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe129⤵
-
\??\c:\ppdvd.exec:\ppdvd.exe130⤵
-
\??\c:\frrlfll.exec:\frrlfll.exe131⤵
-
\??\c:\fxxlfxf.exec:\fxxlfxf.exe132⤵
-
\??\c:\7rlfrrl.exec:\7rlfrrl.exe133⤵
-
\??\c:\5lllflf.exec:\5lllflf.exe134⤵
-
\??\c:\3ntnnn.exec:\3ntnnn.exe135⤵
-
\??\c:\httnnn.exec:\httnnn.exe136⤵
-
\??\c:\vdppd.exec:\vdppd.exe137⤵
-
\??\c:\rllfrrx.exec:\rllfrrx.exe138⤵
-
\??\c:\xrllxxf.exec:\xrllxxf.exe139⤵
-
\??\c:\hbhhnn.exec:\hbhhnn.exe140⤵
-
\??\c:\djvvj.exec:\djvvj.exe141⤵
-
\??\c:\vpvpj.exec:\vpvpj.exe142⤵
-
\??\c:\lxxrrxx.exec:\lxxrrxx.exe143⤵
-
\??\c:\9frxfff.exec:\9frxfff.exe144⤵
-
\??\c:\hntnnh.exec:\hntnnh.exe145⤵
-
\??\c:\bttnhh.exec:\bttnhh.exe146⤵
-
\??\c:\ppvpj.exec:\ppvpj.exe147⤵
-
\??\c:\vvpjd.exec:\vvpjd.exe148⤵
-
\??\c:\rllrlrx.exec:\rllrlrx.exe149⤵
-
\??\c:\fflfrxx.exec:\fflfrxx.exe150⤵
-
\??\c:\hbtthh.exec:\hbtthh.exe151⤵
-
\??\c:\nbbbtt.exec:\nbbbtt.exe152⤵
-
\??\c:\djjdd.exec:\djjdd.exe153⤵
-
\??\c:\3jjdv.exec:\3jjdv.exe154⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe155⤵
-
\??\c:\fxfrlxx.exec:\fxfrlxx.exe156⤵
-
\??\c:\rlfflxl.exec:\rlfflxl.exe157⤵
-
\??\c:\htbttt.exec:\htbttt.exe158⤵
-
\??\c:\5nhbbh.exec:\5nhbbh.exe159⤵
-
\??\c:\pdjdd.exec:\pdjdd.exe160⤵
-
\??\c:\vdpvv.exec:\vdpvv.exe161⤵
-
\??\c:\xflflll.exec:\xflflll.exe162⤵
-
\??\c:\fxrrllf.exec:\fxrrllf.exe163⤵
-
\??\c:\5nnbbb.exec:\5nnbbb.exe164⤵
-
\??\c:\btbbhn.exec:\btbbhn.exe165⤵
-
\??\c:\jdvdv.exec:\jdvdv.exe166⤵
-
\??\c:\dvppp.exec:\dvppp.exe167⤵
-
\??\c:\rfllfff.exec:\rfllfff.exe168⤵
-
\??\c:\xrffrlr.exec:\xrffrlr.exe169⤵
-
\??\c:\hhbtnn.exec:\hhbtnn.exe170⤵
-
\??\c:\nnnnhh.exec:\nnnnhh.exe171⤵
-
\??\c:\dpjvv.exec:\dpjvv.exe172⤵
-
\??\c:\dvvpp.exec:\dvvpp.exe173⤵
-
\??\c:\frrrlfl.exec:\frrrlfl.exe174⤵
-
\??\c:\fffffrr.exec:\fffffrr.exe175⤵
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe176⤵
-
\??\c:\nbbbbb.exec:\nbbbbb.exe177⤵
-
\??\c:\9ntnnh.exec:\9ntnnh.exe178⤵
-
\??\c:\nnnhbb.exec:\nnnhbb.exe179⤵
-
\??\c:\jdpjd.exec:\jdpjd.exe180⤵
-
\??\c:\vdjvp.exec:\vdjvp.exe181⤵
-
\??\c:\fllfxff.exec:\fllfxff.exe182⤵
-
\??\c:\lxlxxxr.exec:\lxlxxxr.exe183⤵
-
\??\c:\nttnhh.exec:\nttnhh.exe184⤵
-
\??\c:\jvvpj.exec:\jvvpj.exe185⤵
-
\??\c:\rllfxxx.exec:\rllfxxx.exe186⤵
-
\??\c:\frfxfxx.exec:\frfxfxx.exe187⤵
-
\??\c:\hhthhh.exec:\hhthhh.exe188⤵
-
\??\c:\htbtnh.exec:\htbtnh.exe189⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe190⤵
-
\??\c:\5vjdj.exec:\5vjdj.exe191⤵
-
\??\c:\xfffrxf.exec:\xfffrxf.exe192⤵
-
\??\c:\xxlfxrf.exec:\xxlfxrf.exe193⤵
-
\??\c:\bhbhnh.exec:\bhbhnh.exe194⤵
-
\??\c:\tnnnnn.exec:\tnnnnn.exe195⤵
-
\??\c:\jvddd.exec:\jvddd.exe196⤵
-
\??\c:\5djpp.exec:\5djpp.exe197⤵
-
\??\c:\xffxllf.exec:\xffxllf.exe198⤵
-
\??\c:\xrrrllf.exec:\xrrrllf.exe199⤵
-
\??\c:\thnnnt.exec:\thnnnt.exe200⤵
-
\??\c:\bhtnhn.exec:\bhtnhn.exe201⤵
-
\??\c:\3jpjp.exec:\3jpjp.exe202⤵
-
\??\c:\1ppvv.exec:\1ppvv.exe203⤵
-
\??\c:\xrflrxx.exec:\xrflrxx.exe204⤵
-
\??\c:\fxxfllr.exec:\fxxfllr.exe205⤵
-
\??\c:\bhhbtn.exec:\bhhbtn.exe206⤵
-
\??\c:\hbbnnb.exec:\hbbnnb.exe207⤵
-
\??\c:\jpppp.exec:\jpppp.exe208⤵
-
\??\c:\jvjdp.exec:\jvjdp.exe209⤵
-
\??\c:\rxrllxx.exec:\rxrllxx.exe210⤵
-
\??\c:\thnthn.exec:\thnthn.exe211⤵
-
\??\c:\nbtbnn.exec:\nbtbnn.exe212⤵
-
\??\c:\pppjd.exec:\pppjd.exe213⤵
-
\??\c:\lrllffr.exec:\lrllffr.exe214⤵
-
\??\c:\5tnhbb.exec:\5tnhbb.exe215⤵
-
\??\c:\tbnttb.exec:\tbnttb.exe216⤵
-
\??\c:\vvjpp.exec:\vvjpp.exe217⤵
-
\??\c:\xxrlrxf.exec:\xxrlrxf.exe218⤵
-
\??\c:\1rffllf.exec:\1rffllf.exe219⤵
-
\??\c:\9hhhbh.exec:\9hhhbh.exe220⤵
-
\??\c:\hbhhbn.exec:\hbhhbn.exe221⤵
-
\??\c:\djjjj.exec:\djjjj.exe222⤵
-
\??\c:\jjppp.exec:\jjppp.exe223⤵
-
\??\c:\1rfflrx.exec:\1rfflrx.exe224⤵
-
\??\c:\rlxllrr.exec:\rlxllrr.exe225⤵
-
\??\c:\ntthhn.exec:\ntthhn.exe226⤵
-
\??\c:\nttnnn.exec:\nttnnn.exe227⤵
-
\??\c:\bhhnnb.exec:\bhhnnb.exe228⤵
-
\??\c:\jddjj.exec:\jddjj.exe229⤵
-
\??\c:\ffrffff.exec:\ffrffff.exe230⤵
-
\??\c:\llrllfr.exec:\llrllfr.exe231⤵
-
\??\c:\hntbhb.exec:\hntbhb.exe232⤵
-
\??\c:\htbbbh.exec:\htbbbh.exe233⤵
-
\??\c:\jdvvv.exec:\jdvvv.exe234⤵
-
\??\c:\vjppv.exec:\vjppv.exe235⤵
-
\??\c:\5fffxxx.exec:\5fffxxx.exe236⤵
-
\??\c:\3bbbbh.exec:\3bbbbh.exe237⤵
-
\??\c:\frxfxxf.exec:\frxfxxf.exe238⤵
-
\??\c:\5xrxfrx.exec:\5xrxfrx.exe239⤵
-
\??\c:\9bnnbh.exec:\9bnnbh.exe240⤵
-
\??\c:\hthhtt.exec:\hthhtt.exe241⤵