Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:28
Behavioral task
behavioral1
Sample
6d2258b03719a02e4562743503b8a070_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
6d2258b03719a02e4562743503b8a070_NeikiAnalytics.exe
-
Size
80KB
-
MD5
6d2258b03719a02e4562743503b8a070
-
SHA1
c10fd52056cb1ebac0627c9cf48c183d5696fd20
-
SHA256
22d2ff7d6a95ca9b505da69bd702bfa1557722bd593ae241f099e97e2a824d17
-
SHA512
097fda74c3bb5b49a646abf33427cab400e770f4de6d14dfb57ffdf2cf03c55ecc60d6fe511e12e7f22349c1819b49b7beb769e3ec9afa364d84d8ed4cb221b3
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6T7s:zhOmTsF93UYfwC6GIoutiTU2HVS63s
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
Processes:
resource yara_rule behavioral1/memory/2364-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1296-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/876-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1512-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/376-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1488-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1488-230-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1836-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/788-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/896-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1124-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-571-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-582-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2728-610-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/320-657-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1488-766-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1468-839-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-1186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-6715-0x0000000077120000-0x000000007723F000-memory.dmp family_blackmoon behavioral1/memory/2060-19303-0x0000000077120000-0x000000007723F000-memory.dmp family_blackmoon behavioral1/memory/2060-25339-0x0000000077120000-0x000000007723F000-memory.dmp family_blackmoon behavioral1/memory/2060-26481-0x0000000077120000-0x000000007723F000-memory.dmp family_blackmoon behavioral1/memory/2060-28163-0x0000000077120000-0x000000007723F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpvpd.exeflflxxl.exevpdjv.exerxfrlff.exerrfxlrl.exenttbtb.exejppjj.exevdvpd.exefrlfrxr.exenhhtht.exejdjjj.exejpvpd.exefffxrll.exe7bnhhb.exejjvpv.exellllxxf.exenhtbhn.exettnbtt.exe7djdp.exerlxfllx.exe5rllxfr.exenbhhbt.exeddpdv.exedppvd.exelfflfrx.exe7hbthn.exe7hhtht.exevdpjv.exeflrlrll.exehhthhb.exepvpdd.exefrrlrlr.exefxxlfrr.exepjvvd.exedvjpp.exefxlflrf.exexrxfffl.exenhnnbt.exevpjpv.exerxfxxlf.exehnnhht.exejvvdj.exeflrlxlf.exefxllllr.exebtbbbh.exepjdvd.exellxrxxf.exe5xfrxfr.exebnhhhh.exevvpdv.exerlfxfxl.exe1thbbh.exehbbnth.exejdjvd.exepjdjp.exeffxrflf.exetttnbn.exejvpjp.exepdpjd.exexrlfrxl.exenhbbtn.exepvppd.exe9pdpd.exexxrxlfx.exepid process 1296 vpvpd.exe 2044 flflxxl.exe 2740 vpdjv.exe 2568 rxfrlff.exe 2664 rrfxlrl.exe 2468 nttbtb.exe 2584 jppjj.exe 2676 vdvpd.exe 2516 frlfrxr.exe 2524 nhhtht.exe 2904 jdjjj.exe 1732 jpvpd.exe 1588 fffxrll.exe 1084 7bnhhb.exe 2180 jjvpv.exe 2116 llllxxf.exe 876 nhtbhn.exe 1316 ttnbtt.exe 1524 7djdp.exe 1512 rlxfllx.exe 2800 5rllxfr.exe 2272 nbhhbt.exe 2252 ddpdv.exe 1104 dppvd.exe 780 lfflfrx.exe 376 7hbthn.exe 1804 7hhtht.exe 1488 vdpjv.exe 1868 flrlrll.exe 2152 hhthhb.exe 1836 pvpdd.exe 1696 frrlrlr.exe 788 fxxlfrr.exe 3000 pjvvd.exe 564 dvjpp.exe 896 fxlflrf.exe 2852 xrxfffl.exe 2212 nhnnbt.exe 1612 vpjpv.exe 1124 rxfxxlf.exe 2808 hnnhht.exe 2804 jvvdj.exe 2964 flrlxlf.exe 2668 fxllllr.exe 2568 btbbbh.exe 2816 pjdvd.exe 2488 llxrxxf.exe 2768 5xfrxfr.exe 2712 bnhhhh.exe 2720 vvpdv.exe 2776 rlfxfxl.exe 2972 1thbbh.exe 3044 hbbnth.exe 2300 jdjvd.exe 320 pjdjp.exe 1704 ffxrflf.exe 2528 tttnbn.exe 952 jvpjp.exe 1984 pdpjd.exe 820 xrlfrxl.exe 1480 nhbbtn.exe 2112 pvppd.exe 1592 9pdpd.exe 2636 xxrxlfx.exe -
Processes:
resource yara_rule behavioral1/memory/2364-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2364-6-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpvpd.exe upx behavioral1/memory/1296-10-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flflxxl.exe upx C:\vpdjv.exe upx behavioral1/memory/2044-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2740-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2740-32-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxfrlff.exe upx behavioral1/memory/2568-41-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrfxlrl.exe upx behavioral1/memory/2664-44-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nttbtb.exe upx behavioral1/memory/2468-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2468-58-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jppjj.exe upx C:\vdvpd.exe upx behavioral1/memory/2584-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2516-78-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\frlfrxr.exe upx C:\nhhtht.exe upx C:\jdjjj.exe upx behavioral1/memory/2904-98-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpvpd.exe upx behavioral1/memory/1732-99-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fffxrll.exe upx behavioral1/memory/1732-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1588-115-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7bnhhb.exe upx C:\jjvpv.exe upx C:\llllxxf.exe upx behavioral1/memory/2180-130-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhtbhn.exe upx behavioral1/memory/876-139-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttnbtt.exe upx C:\7djdp.exe upx behavioral1/memory/1524-156-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlxfllx.exe upx behavioral1/memory/1512-163-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5rllxfr.exe upx C:\nbhhbt.exe upx behavioral1/memory/2800-177-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddpdv.exe upx behavioral1/memory/2272-185-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dppvd.exe upx C:\lfflfrx.exe upx C:\7hbthn.exe upx behavioral1/memory/376-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/376-214-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7hhtht.exe upx C:\vdpjv.exe upx behavioral1/memory/1488-224-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flrlrll.exe upx C:\hhthhb.exe upx C:\pvpdd.exe upx C:\frrlrlr.exe upx behavioral1/memory/1836-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1696-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/788-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/564-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/896-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2852-289-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6d2258b03719a02e4562743503b8a070_NeikiAnalytics.exevpvpd.exeflflxxl.exevpdjv.exerxfrlff.exerrfxlrl.exenttbtb.exejppjj.exevdvpd.exefrlfrxr.exenhhtht.exejdjjj.exejpvpd.exefffxrll.exe7bnhhb.exejjvpv.exedescription pid process target process PID 2364 wrote to memory of 1296 2364 6d2258b03719a02e4562743503b8a070_NeikiAnalytics.exe vpvpd.exe PID 2364 wrote to memory of 1296 2364 6d2258b03719a02e4562743503b8a070_NeikiAnalytics.exe vpvpd.exe PID 2364 wrote to memory of 1296 2364 6d2258b03719a02e4562743503b8a070_NeikiAnalytics.exe vpvpd.exe PID 2364 wrote to memory of 1296 2364 6d2258b03719a02e4562743503b8a070_NeikiAnalytics.exe vpvpd.exe PID 1296 wrote to memory of 2044 1296 vpvpd.exe flflxxl.exe PID 1296 wrote to memory of 2044 1296 vpvpd.exe flflxxl.exe PID 1296 wrote to memory of 2044 1296 vpvpd.exe flflxxl.exe PID 1296 wrote to memory of 2044 1296 vpvpd.exe flflxxl.exe PID 2044 wrote to memory of 2740 2044 flflxxl.exe vpdjv.exe PID 2044 wrote to memory of 2740 2044 flflxxl.exe vpdjv.exe PID 2044 wrote to memory of 2740 2044 flflxxl.exe vpdjv.exe PID 2044 wrote to memory of 2740 2044 flflxxl.exe vpdjv.exe PID 2740 wrote to memory of 2568 2740 vpdjv.exe rxfrlff.exe PID 2740 wrote to memory of 2568 2740 vpdjv.exe rxfrlff.exe PID 2740 wrote to memory of 2568 2740 vpdjv.exe rxfrlff.exe PID 2740 wrote to memory of 2568 2740 vpdjv.exe rxfrlff.exe PID 2568 wrote to memory of 2664 2568 rxfrlff.exe rrfxlrl.exe PID 2568 wrote to memory of 2664 2568 rxfrlff.exe rrfxlrl.exe PID 2568 wrote to memory of 2664 2568 rxfrlff.exe rrfxlrl.exe PID 2568 wrote to memory of 2664 2568 rxfrlff.exe rrfxlrl.exe PID 2664 wrote to memory of 2468 2664 rrfxlrl.exe nttbtb.exe PID 2664 wrote to memory of 2468 2664 rrfxlrl.exe nttbtb.exe PID 2664 wrote to memory of 2468 2664 rrfxlrl.exe nttbtb.exe PID 2664 wrote to memory of 2468 2664 rrfxlrl.exe nttbtb.exe PID 2468 wrote to memory of 2584 2468 nttbtb.exe jppjj.exe PID 2468 wrote to memory of 2584 2468 nttbtb.exe jppjj.exe PID 2468 wrote to memory of 2584 2468 nttbtb.exe jppjj.exe PID 2468 wrote to memory of 2584 2468 nttbtb.exe jppjj.exe PID 2584 wrote to memory of 2676 2584 jppjj.exe vdvpd.exe PID 2584 wrote to memory of 2676 2584 jppjj.exe vdvpd.exe PID 2584 wrote to memory of 2676 2584 jppjj.exe vdvpd.exe PID 2584 wrote to memory of 2676 2584 jppjj.exe vdvpd.exe PID 2676 wrote to memory of 2516 2676 vdvpd.exe frlfrxr.exe PID 2676 wrote to memory of 2516 2676 vdvpd.exe frlfrxr.exe PID 2676 wrote to memory of 2516 2676 vdvpd.exe frlfrxr.exe PID 2676 wrote to memory of 2516 2676 vdvpd.exe frlfrxr.exe PID 2516 wrote to memory of 2524 2516 frlfrxr.exe nhhtht.exe PID 2516 wrote to memory of 2524 2516 frlfrxr.exe nhhtht.exe PID 2516 wrote to memory of 2524 2516 frlfrxr.exe nhhtht.exe PID 2516 wrote to memory of 2524 2516 frlfrxr.exe nhhtht.exe PID 2524 wrote to memory of 2904 2524 nhhtht.exe jdjjj.exe PID 2524 wrote to memory of 2904 2524 nhhtht.exe jdjjj.exe PID 2524 wrote to memory of 2904 2524 nhhtht.exe jdjjj.exe PID 2524 wrote to memory of 2904 2524 nhhtht.exe jdjjj.exe PID 2904 wrote to memory of 1732 2904 jdjjj.exe jpvpd.exe PID 2904 wrote to memory of 1732 2904 jdjjj.exe jpvpd.exe PID 2904 wrote to memory of 1732 2904 jdjjj.exe jpvpd.exe PID 2904 wrote to memory of 1732 2904 jdjjj.exe jpvpd.exe PID 1732 wrote to memory of 1588 1732 jpvpd.exe fffxrll.exe PID 1732 wrote to memory of 1588 1732 jpvpd.exe fffxrll.exe PID 1732 wrote to memory of 1588 1732 jpvpd.exe fffxrll.exe PID 1732 wrote to memory of 1588 1732 jpvpd.exe fffxrll.exe PID 1588 wrote to memory of 1084 1588 fffxrll.exe 7bnhhb.exe PID 1588 wrote to memory of 1084 1588 fffxrll.exe 7bnhhb.exe PID 1588 wrote to memory of 1084 1588 fffxrll.exe 7bnhhb.exe PID 1588 wrote to memory of 1084 1588 fffxrll.exe 7bnhhb.exe PID 1084 wrote to memory of 2180 1084 7bnhhb.exe jjvpv.exe PID 1084 wrote to memory of 2180 1084 7bnhhb.exe jjvpv.exe PID 1084 wrote to memory of 2180 1084 7bnhhb.exe jjvpv.exe PID 1084 wrote to memory of 2180 1084 7bnhhb.exe jjvpv.exe PID 2180 wrote to memory of 2116 2180 jjvpv.exe llllxxf.exe PID 2180 wrote to memory of 2116 2180 jjvpv.exe llllxxf.exe PID 2180 wrote to memory of 2116 2180 jjvpv.exe llllxxf.exe PID 2180 wrote to memory of 2116 2180 jjvpv.exe llllxxf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d2258b03719a02e4562743503b8a070_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6d2258b03719a02e4562743503b8a070_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvpd.exec:\vpvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flflxxl.exec:\flflxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpdjv.exec:\vpdjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxfrlff.exec:\rxfrlff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrfxlrl.exec:\rrfxlrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nttbtb.exec:\nttbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jppjj.exec:\jppjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdvpd.exec:\vdvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frlfrxr.exec:\frlfrxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhtht.exec:\nhhtht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjjj.exec:\jdjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpvpd.exec:\jpvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fffxrll.exec:\fffxrll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7bnhhb.exec:\7bnhhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjvpv.exec:\jjvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llllxxf.exec:\llllxxf.exe17⤵
- Executes dropped EXE
-
\??\c:\nhtbhn.exec:\nhtbhn.exe18⤵
- Executes dropped EXE
-
\??\c:\ttnbtt.exec:\ttnbtt.exe19⤵
- Executes dropped EXE
-
\??\c:\7djdp.exec:\7djdp.exe20⤵
- Executes dropped EXE
-
\??\c:\rlxfllx.exec:\rlxfllx.exe21⤵
- Executes dropped EXE
-
\??\c:\5rllxfr.exec:\5rllxfr.exe22⤵
- Executes dropped EXE
-
\??\c:\nbhhbt.exec:\nbhhbt.exe23⤵
- Executes dropped EXE
-
\??\c:\ddpdv.exec:\ddpdv.exe24⤵
- Executes dropped EXE
-
\??\c:\dppvd.exec:\dppvd.exe25⤵
- Executes dropped EXE
-
\??\c:\lfflfrx.exec:\lfflfrx.exe26⤵
- Executes dropped EXE
-
\??\c:\7hbthn.exec:\7hbthn.exe27⤵
- Executes dropped EXE
-
\??\c:\7hhtht.exec:\7hhtht.exe28⤵
- Executes dropped EXE
-
\??\c:\vdpjv.exec:\vdpjv.exe29⤵
- Executes dropped EXE
-
\??\c:\flrlrll.exec:\flrlrll.exe30⤵
- Executes dropped EXE
-
\??\c:\hhthhb.exec:\hhthhb.exe31⤵
- Executes dropped EXE
-
\??\c:\pvpdd.exec:\pvpdd.exe32⤵
- Executes dropped EXE
-
\??\c:\frrlrlr.exec:\frrlrlr.exe33⤵
- Executes dropped EXE
-
\??\c:\fxxlfrr.exec:\fxxlfrr.exe34⤵
- Executes dropped EXE
-
\??\c:\pjvvd.exec:\pjvvd.exe35⤵
- Executes dropped EXE
-
\??\c:\dvjpp.exec:\dvjpp.exe36⤵
- Executes dropped EXE
-
\??\c:\fxlflrf.exec:\fxlflrf.exe37⤵
- Executes dropped EXE
-
\??\c:\xrxfffl.exec:\xrxfffl.exe38⤵
- Executes dropped EXE
-
\??\c:\nhnnbt.exec:\nhnnbt.exe39⤵
- Executes dropped EXE
-
\??\c:\vpjpv.exec:\vpjpv.exe40⤵
- Executes dropped EXE
-
\??\c:\rxfxxlf.exec:\rxfxxlf.exe41⤵
- Executes dropped EXE
-
\??\c:\hnnhht.exec:\hnnhht.exe42⤵
- Executes dropped EXE
-
\??\c:\jvvdj.exec:\jvvdj.exe43⤵
- Executes dropped EXE
-
\??\c:\flrlxlf.exec:\flrlxlf.exe44⤵
- Executes dropped EXE
-
\??\c:\fxllllr.exec:\fxllllr.exe45⤵
- Executes dropped EXE
-
\??\c:\btbbbh.exec:\btbbbh.exe46⤵
- Executes dropped EXE
-
\??\c:\pjdvd.exec:\pjdvd.exe47⤵
- Executes dropped EXE
-
\??\c:\llxrxxf.exec:\llxrxxf.exe48⤵
- Executes dropped EXE
-
\??\c:\5xfrxfr.exec:\5xfrxfr.exe49⤵
- Executes dropped EXE
-
\??\c:\bnhhhh.exec:\bnhhhh.exe50⤵
- Executes dropped EXE
-
\??\c:\vvpdv.exec:\vvpdv.exe51⤵
- Executes dropped EXE
-
\??\c:\rlfxfxl.exec:\rlfxfxl.exe52⤵
- Executes dropped EXE
-
\??\c:\1thbbh.exec:\1thbbh.exe53⤵
- Executes dropped EXE
-
\??\c:\hbbnth.exec:\hbbnth.exe54⤵
- Executes dropped EXE
-
\??\c:\jdjvd.exec:\jdjvd.exe55⤵
- Executes dropped EXE
-
\??\c:\pjdjp.exec:\pjdjp.exe56⤵
- Executes dropped EXE
-
\??\c:\ffxrflf.exec:\ffxrflf.exe57⤵
- Executes dropped EXE
-
\??\c:\tttnbn.exec:\tttnbn.exe58⤵
- Executes dropped EXE
-
\??\c:\jvpjp.exec:\jvpjp.exe59⤵
- Executes dropped EXE
-
\??\c:\pdpjd.exec:\pdpjd.exe60⤵
- Executes dropped EXE
-
\??\c:\xrlfrxl.exec:\xrlfrxl.exe61⤵
- Executes dropped EXE
-
\??\c:\nhbbtn.exec:\nhbbtn.exe62⤵
- Executes dropped EXE
-
\??\c:\pvppd.exec:\pvppd.exe63⤵
- Executes dropped EXE
-
\??\c:\9pdpd.exec:\9pdpd.exe64⤵
- Executes dropped EXE
-
\??\c:\xxrxlfx.exec:\xxrxlfx.exe65⤵
- Executes dropped EXE
-
\??\c:\bbhhnh.exec:\bbhhnh.exe66⤵
-
\??\c:\btnntn.exec:\btnntn.exe67⤵
-
\??\c:\dddpp.exec:\dddpp.exe68⤵
-
\??\c:\1vvvv.exec:\1vvvv.exe69⤵
-
\??\c:\xxxxxxf.exec:\xxxxxxf.exe70⤵
-
\??\c:\tbtnnh.exec:\tbtnnh.exe71⤵
-
\??\c:\nnnbtb.exec:\nnnbtb.exe72⤵
-
\??\c:\pdjpj.exec:\pdjpj.exe73⤵
-
\??\c:\dddpv.exec:\dddpv.exe74⤵
-
\??\c:\xflxfrl.exec:\xflxfrl.exe75⤵
-
\??\c:\flrflll.exec:\flrflll.exe76⤵
-
\??\c:\hnnbnn.exec:\hnnbnn.exe77⤵
-
\??\c:\3nbhbb.exec:\3nbhbb.exe78⤵
-
\??\c:\jpdvd.exec:\jpdvd.exe79⤵
-
\??\c:\1fflrlr.exec:\1fflrlr.exe80⤵
-
\??\c:\rlxlrxf.exec:\rlxlrxf.exe81⤵
-
\??\c:\thtnnn.exec:\thtnnn.exe82⤵
-
\??\c:\tnbhtt.exec:\tnbhtt.exe83⤵
-
\??\c:\pjjvd.exec:\pjjvd.exe84⤵
-
\??\c:\3dvdp.exec:\3dvdp.exe85⤵
-
\??\c:\rffxxxf.exec:\rffxxxf.exe86⤵
-
\??\c:\xxxlxrr.exec:\xxxlxrr.exe87⤵
-
\??\c:\tbnbhb.exec:\tbnbhb.exe88⤵
-
\??\c:\5htntb.exec:\5htntb.exe89⤵
-
\??\c:\dpdpd.exec:\dpdpd.exe90⤵
-
\??\c:\jvvdp.exec:\jvvdp.exe91⤵
-
\??\c:\lrlfxrr.exec:\lrlfxrr.exe92⤵
-
\??\c:\bnbntt.exec:\bnbntt.exe93⤵
-
\??\c:\bbthtn.exec:\bbthtn.exe94⤵
-
\??\c:\vvjvj.exec:\vvjvj.exe95⤵
-
\??\c:\xrxffxr.exec:\xrxffxr.exe96⤵
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe97⤵
-
\??\c:\3thtbh.exec:\3thtbh.exe98⤵
-
\??\c:\jppvj.exec:\jppvj.exe99⤵
-
\??\c:\dvvvv.exec:\dvvvv.exe100⤵
-
\??\c:\llrxrff.exec:\llrxrff.exe101⤵
-
\??\c:\fxlfrfl.exec:\fxlfrfl.exe102⤵
-
\??\c:\rffrffl.exec:\rffrffl.exe103⤵
-
\??\c:\tnbhnn.exec:\tnbhnn.exe104⤵
-
\??\c:\3ttbnt.exec:\3ttbnt.exe105⤵
-
\??\c:\5djpv.exec:\5djpv.exe106⤵
-
\??\c:\xxfrlxr.exec:\xxfrlxr.exe107⤵
-
\??\c:\ffrflrf.exec:\ffrflrf.exe108⤵
-
\??\c:\nhbttn.exec:\nhbttn.exe109⤵
-
\??\c:\5ttnbh.exec:\5ttnbh.exe110⤵
-
\??\c:\vpvdj.exec:\vpvdj.exe111⤵
-
\??\c:\vpjdj.exec:\vpjdj.exe112⤵
-
\??\c:\frfllll.exec:\frfllll.exe113⤵
-
\??\c:\9rlfxrf.exec:\9rlfxrf.exe114⤵
-
\??\c:\hbnbtb.exec:\hbnbtb.exe115⤵
-
\??\c:\9pdjj.exec:\9pdjj.exe116⤵
-
\??\c:\dvdjp.exec:\dvdjp.exe117⤵
-
\??\c:\fxlffxf.exec:\fxlffxf.exe118⤵
-
\??\c:\7llfrxx.exec:\7llfrxx.exe119⤵
-
\??\c:\hnnbnh.exec:\hnnbnh.exe120⤵
-
\??\c:\tbnbhh.exec:\tbnbhh.exe121⤵
-
\??\c:\pjpvv.exec:\pjpvv.exe122⤵
-
\??\c:\dvvdj.exec:\dvvdj.exe123⤵
-
\??\c:\7fxflll.exec:\7fxflll.exe124⤵
-
\??\c:\fxlflrr.exec:\fxlflrr.exe125⤵
-
\??\c:\thnttt.exec:\thnttt.exe126⤵
-
\??\c:\htnnht.exec:\htnnht.exe127⤵
-
\??\c:\jjvpp.exec:\jjvpp.exe128⤵
-
\??\c:\1ppvd.exec:\1ppvd.exe129⤵
-
\??\c:\5ffrxxx.exec:\5ffrxxx.exe130⤵
-
\??\c:\ffxlrxf.exec:\ffxlrxf.exe131⤵
-
\??\c:\tntbbb.exec:\tntbbb.exe132⤵
-
\??\c:\btnbhn.exec:\btnbhn.exe133⤵
-
\??\c:\jdvjd.exec:\jdvjd.exe134⤵
-
\??\c:\llxffrl.exec:\llxffrl.exe135⤵
-
\??\c:\lfrlrxl.exec:\lfrlrxl.exe136⤵
-
\??\c:\1bnntn.exec:\1bnntn.exe137⤵
-
\??\c:\1vdjd.exec:\1vdjd.exe138⤵
-
\??\c:\7ppvj.exec:\7ppvj.exe139⤵
-
\??\c:\fxlxxxf.exec:\fxlxxxf.exe140⤵
-
\??\c:\rlfrrlr.exec:\rlfrrlr.exe141⤵
-
\??\c:\bhhtnh.exec:\bhhtnh.exe142⤵
-
\??\c:\bthbbb.exec:\bthbbb.exe143⤵
-
\??\c:\pdvdp.exec:\pdvdp.exe144⤵
-
\??\c:\rllfrfr.exec:\rllfrfr.exe145⤵
-
\??\c:\hnttnn.exec:\hnttnn.exe146⤵
-
\??\c:\tthhbb.exec:\tthhbb.exe147⤵
-
\??\c:\1dvvd.exec:\1dvvd.exe148⤵
-
\??\c:\pjvvj.exec:\pjvvj.exe149⤵
-
\??\c:\3rlxxlf.exec:\3rlxxlf.exe150⤵
-
\??\c:\frflxxr.exec:\frflxxr.exe151⤵
-
\??\c:\bnnnbh.exec:\bnnnbh.exe152⤵
-
\??\c:\7hbhht.exec:\7hbhht.exe153⤵
-
\??\c:\5jvdv.exec:\5jvdv.exe154⤵
-
\??\c:\5lxlllx.exec:\5lxlllx.exe155⤵
-
\??\c:\xrxrxfl.exec:\xrxrxfl.exe156⤵
-
\??\c:\nhnbbt.exec:\nhnbbt.exe157⤵
-
\??\c:\tnhbnt.exec:\tnhbnt.exe158⤵
-
\??\c:\pjvjj.exec:\pjvjj.exe159⤵
-
\??\c:\5djjv.exec:\5djjv.exe160⤵
-
\??\c:\7xflxff.exec:\7xflxff.exe161⤵
-
\??\c:\lfrxxfl.exec:\lfrxxfl.exe162⤵
-
\??\c:\djpvv.exec:\djpvv.exe163⤵
-
\??\c:\hhbhnb.exec:\hhbhnb.exe164⤵
-
\??\c:\pppjv.exec:\pppjv.exe165⤵
-
\??\c:\llflrrx.exec:\llflrrx.exe166⤵
-
\??\c:\7rlxfrf.exec:\7rlxfrf.exe167⤵
-
\??\c:\nhtbnt.exec:\nhtbnt.exe168⤵
-
\??\c:\nhthtb.exec:\nhthtb.exe169⤵
-
\??\c:\ddpjj.exec:\ddpjj.exe170⤵
-
\??\c:\xrrxxrx.exec:\xrrxxrx.exe171⤵
-
\??\c:\xlxflfl.exec:\xlxflfl.exe172⤵
-
\??\c:\3nhtbb.exec:\3nhtbb.exe173⤵
-
\??\c:\bttthn.exec:\bttthn.exe174⤵
-
\??\c:\vpvdp.exec:\vpvdp.exe175⤵
-
\??\c:\1lffrrx.exec:\1lffrrx.exe176⤵
-
\??\c:\xxrxlff.exec:\xxrxlff.exe177⤵
-
\??\c:\frlllrl.exec:\frlllrl.exe178⤵
-
\??\c:\htttbt.exec:\htttbt.exe179⤵
-
\??\c:\jdpvd.exec:\jdpvd.exe180⤵
-
\??\c:\9jdjv.exec:\9jdjv.exe181⤵
-
\??\c:\frlfrfr.exec:\frlfrfr.exe182⤵
-
\??\c:\xlxllrf.exec:\xlxllrf.exe183⤵
-
\??\c:\5tnnbt.exec:\5tnnbt.exe184⤵
-
\??\c:\ntnnhb.exec:\ntnnhb.exe185⤵
-
\??\c:\tnhtth.exec:\tnhtth.exe186⤵
-
\??\c:\vvjpv.exec:\vvjpv.exe187⤵
-
\??\c:\3llxxfr.exec:\3llxxfr.exe188⤵
-
\??\c:\xxxlflr.exec:\xxxlflr.exe189⤵
-
\??\c:\hbbnbh.exec:\hbbnbh.exe190⤵
-
\??\c:\jpdpp.exec:\jpdpp.exe191⤵
-
\??\c:\pdvvd.exec:\pdvvd.exe192⤵
-
\??\c:\lfrrflx.exec:\lfrrflx.exe193⤵
-
\??\c:\xxrflrf.exec:\xxrflrf.exe194⤵
-
\??\c:\hbthbb.exec:\hbthbb.exe195⤵
-
\??\c:\3tnhnb.exec:\3tnhnb.exe196⤵
-
\??\c:\jpdjv.exec:\jpdjv.exe197⤵
-
\??\c:\rrfxffr.exec:\rrfxffr.exe198⤵
-
\??\c:\rlxlffx.exec:\rlxlffx.exe199⤵
-
\??\c:\hhtntn.exec:\hhtntn.exe200⤵
-
\??\c:\dpjvd.exec:\dpjvd.exe201⤵
-
\??\c:\jvppp.exec:\jvppp.exe202⤵
-
\??\c:\pdpvj.exec:\pdpvj.exe203⤵
-
\??\c:\ffxfrrl.exec:\ffxfrrl.exe204⤵
-
\??\c:\9rfrrlf.exec:\9rfrrlf.exe205⤵
-
\??\c:\thttbb.exec:\thttbb.exe206⤵
-
\??\c:\ppjvj.exec:\ppjvj.exe207⤵
-
\??\c:\jvpdj.exec:\jvpdj.exe208⤵
-
\??\c:\rrxrrrl.exec:\rrxrrrl.exe209⤵
-
\??\c:\btttbt.exec:\btttbt.exe210⤵
-
\??\c:\nbnhhh.exec:\nbnhhh.exe211⤵
-
\??\c:\vvddj.exec:\vvddj.exe212⤵
-
\??\c:\vpddv.exec:\vpddv.exe213⤵
-
\??\c:\llxflxf.exec:\llxflxf.exe214⤵
-
\??\c:\bbhtbh.exec:\bbhtbh.exe215⤵
-
\??\c:\hbthhn.exec:\hbthhn.exe216⤵
-
\??\c:\vjvdd.exec:\vjvdd.exe217⤵
-
\??\c:\ddjjv.exec:\ddjjv.exe218⤵
-
\??\c:\xrllffx.exec:\xrllffx.exe219⤵
-
\??\c:\xxllxlr.exec:\xxllxlr.exe220⤵
-
\??\c:\nnhhbb.exec:\nnhhbb.exe221⤵
-
\??\c:\bhhthn.exec:\bhhthn.exe222⤵
-
\??\c:\5ppdj.exec:\5ppdj.exe223⤵
-
\??\c:\7pddp.exec:\7pddp.exe224⤵
-
\??\c:\rrxrrxf.exec:\rrxrrxf.exe225⤵
-
\??\c:\llfxxll.exec:\llfxxll.exe226⤵
-
\??\c:\lrrfrxl.exec:\lrrfrxl.exe227⤵
-
\??\c:\hbthhn.exec:\hbthhn.exe228⤵
-
\??\c:\9nnhnt.exec:\9nnhnt.exe229⤵
-
\??\c:\vdjpp.exec:\vdjpp.exe230⤵
-
\??\c:\jjddp.exec:\jjddp.exe231⤵
-
\??\c:\xlxfrff.exec:\xlxfrff.exe232⤵
-
\??\c:\ffxrfff.exec:\ffxrfff.exe233⤵
-
\??\c:\tnntth.exec:\tnntth.exe234⤵
-
\??\c:\bththt.exec:\bththt.exe235⤵
-
\??\c:\pvpjv.exec:\pvpjv.exe236⤵
-
\??\c:\dpdvd.exec:\dpdvd.exe237⤵
-
\??\c:\9rrfrrx.exec:\9rrfrrx.exe238⤵
-
\??\c:\xrxlxrx.exec:\xrxlxrx.exe239⤵
-
\??\c:\ttbnbn.exec:\ttbnbn.exe240⤵
-
\??\c:\tttttt.exec:\tttttt.exe241⤵