Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 04:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a5a194b3646b2a9554f6c77a0d11c470_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
a5a194b3646b2a9554f6c77a0d11c470_NeikiAnalytics.exe
-
Size
720KB
-
MD5
a5a194b3646b2a9554f6c77a0d11c470
-
SHA1
8c0ab1b62e8ddbde1e7a9a29073928b7dc76adab
-
SHA256
6341ae78463bb26d5efe5d04048f7a6f002b01acd33f2b1551e628045d34ac52
-
SHA512
076e41c2b55fe0ead2853067150e49a595f694ddaa380c09160b03653c855719b92cc1117a2d6c460ba613d8ffe2ee385993360b6f77159398f27a0e2c0c5692
-
SSDEEP
12288:n3C9yMo+S0L9xRnoq7H9xqYL5oeEF5rna9sUxg7udOxPJVSjYg8lcmJ1MZxEkTsC:SgD4bhoqLDqYLS7w4u
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/600-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1368-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/364-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2784-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5hbtnn.exepdjdv.exe1lrlxrr.exelxlflxf.exebnthnh.exerfrlrrf.exeddvdv.exexffxrrl.exepjpdv.exe5xrlrrl.exehhnnhh.exevvvvv.exevpdvv.exe5lflfrl.exedpvpj.exehthbbt.exelffxxrl.exe1hnhbt.exedvdvv.exenhbbtt.exerrxxxxr.exexfrrfrr.exe7ntnnn.exe5rrfxrl.exe3vvpj.exejdjvj.exeffxrlrl.exebbtntn.exedjjdd.exethhhbt.exefxlfrrl.exe5djjd.exe5hthnn.exebbbttn.exedvddj.exefxxrlfx.exebbhbtt.exe9bnhtn.exevvjvp.exelrflffr.exehbbttt.exepddpj.exexlrlffr.exenbnhhh.exevdpjd.exe9xxrffx.exennhbtn.exedppjj.exerxfxxxr.exehnnhbb.exe3ntnhb.exedjjdv.exe1fxrffx.exe3nnnnn.exedppvp.exeffxrllf.exebnnhnh.exepdjdd.exexlxrlrl.exehnbtnn.exe7jjjv.exedpdvp.exerlffrrl.exebhnhbb.exepid process 3696 5hbtnn.exe 2752 pdjdv.exe 2980 1lrlxrr.exe 2876 lxlflxf.exe 2460 bnthnh.exe 2604 rfrlrrf.exe 8 ddvdv.exe 2360 xffxrrl.exe 4908 pjpdv.exe 4960 5xrlrrl.exe 2080 hhnnhh.exe 4404 vvvvv.exe 4684 vpdvv.exe 1560 5lflfrl.exe 1776 dpvpj.exe 3944 hthbbt.exe 1376 lffxxrl.exe 4368 1hnhbt.exe 1764 dvdvv.exe 4048 nhbbtt.exe 3860 rrxxxxr.exe 1368 xfrrfrr.exe 4712 7ntnnn.exe 364 5rrfxrl.exe 4880 3vvpj.exe 3504 jdjvj.exe 2784 ffxrlrl.exe 4704 bbtntn.exe 3248 djjdd.exe 3320 thhhbt.exe 2920 fxlfrrl.exe 3412 5djjd.exe 3816 5hthnn.exe 2508 bbbttn.exe 600 dvddj.exe 3520 fxxrlfx.exe 4588 bbhbtt.exe 1532 9bnhtn.exe 3156 vvjvp.exe 2876 lrflffr.exe 2780 hbbttt.exe 2396 pddpj.exe 1088 xlrlffr.exe 1052 nbnhhh.exe 3852 vdpjd.exe 2948 9xxrffx.exe 1524 nnhbtn.exe 2080 dppjj.exe 3812 rxfxxxr.exe 2836 hnnhbb.exe 1548 3ntnhb.exe 3840 djjdv.exe 4116 1fxrffx.exe 3472 3nnnnn.exe 4932 dppvp.exe 1148 ffxrllf.exe 4076 bnnhnh.exe 2656 pdjdd.exe 4188 xlxrlrl.exe 1612 hnbtnn.exe 2144 7jjjv.exe 2564 dpdvp.exe 2488 rlffrrl.exe 4248 bhnhbb.exe -
Processes:
resource yara_rule behavioral2/memory/600-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2360-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1368-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/364-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a5a194b3646b2a9554f6c77a0d11c470_NeikiAnalytics.exe5hbtnn.exepdjdv.exe1lrlxrr.exelxlflxf.exebnthnh.exerfrlrrf.exeddvdv.exexffxrrl.exepjpdv.exe5xrlrrl.exehhnnhh.exevvvvv.exevpdvv.exe5lflfrl.exedpvpj.exehthbbt.exelffxxrl.exe1hnhbt.exedvdvv.exenhbbtt.exerrxxxxr.exedescription pid process target process PID 600 wrote to memory of 3696 600 a5a194b3646b2a9554f6c77a0d11c470_NeikiAnalytics.exe 5hbtnn.exe PID 600 wrote to memory of 3696 600 a5a194b3646b2a9554f6c77a0d11c470_NeikiAnalytics.exe 5hbtnn.exe PID 600 wrote to memory of 3696 600 a5a194b3646b2a9554f6c77a0d11c470_NeikiAnalytics.exe 5hbtnn.exe PID 3696 wrote to memory of 2752 3696 5hbtnn.exe pdjdv.exe PID 3696 wrote to memory of 2752 3696 5hbtnn.exe pdjdv.exe PID 3696 wrote to memory of 2752 3696 5hbtnn.exe pdjdv.exe PID 2752 wrote to memory of 2980 2752 pdjdv.exe 1lrlxrr.exe PID 2752 wrote to memory of 2980 2752 pdjdv.exe 1lrlxrr.exe PID 2752 wrote to memory of 2980 2752 pdjdv.exe 1lrlxrr.exe PID 2980 wrote to memory of 2876 2980 1lrlxrr.exe lxlflxf.exe PID 2980 wrote to memory of 2876 2980 1lrlxrr.exe lxlflxf.exe PID 2980 wrote to memory of 2876 2980 1lrlxrr.exe lxlflxf.exe PID 2876 wrote to memory of 2460 2876 lxlflxf.exe bnthnh.exe PID 2876 wrote to memory of 2460 2876 lxlflxf.exe bnthnh.exe PID 2876 wrote to memory of 2460 2876 lxlflxf.exe bnthnh.exe PID 2460 wrote to memory of 2604 2460 bnthnh.exe rfrlrrf.exe PID 2460 wrote to memory of 2604 2460 bnthnh.exe rfrlrrf.exe PID 2460 wrote to memory of 2604 2460 bnthnh.exe rfrlrrf.exe PID 2604 wrote to memory of 8 2604 rfrlrrf.exe ddvdv.exe PID 2604 wrote to memory of 8 2604 rfrlrrf.exe ddvdv.exe PID 2604 wrote to memory of 8 2604 rfrlrrf.exe ddvdv.exe PID 8 wrote to memory of 2360 8 ddvdv.exe xffxrrl.exe PID 8 wrote to memory of 2360 8 ddvdv.exe xffxrrl.exe PID 8 wrote to memory of 2360 8 ddvdv.exe xffxrrl.exe PID 2360 wrote to memory of 4908 2360 xffxrrl.exe pjpdv.exe PID 2360 wrote to memory of 4908 2360 xffxrrl.exe pjpdv.exe PID 2360 wrote to memory of 4908 2360 xffxrrl.exe pjpdv.exe PID 4908 wrote to memory of 4960 4908 pjpdv.exe 5xrlrrl.exe PID 4908 wrote to memory of 4960 4908 pjpdv.exe 5xrlrrl.exe PID 4908 wrote to memory of 4960 4908 pjpdv.exe 5xrlrrl.exe PID 4960 wrote to memory of 2080 4960 5xrlrrl.exe hhnnhh.exe PID 4960 wrote to memory of 2080 4960 5xrlrrl.exe hhnnhh.exe PID 4960 wrote to memory of 2080 4960 5xrlrrl.exe hhnnhh.exe PID 2080 wrote to memory of 4404 2080 hhnnhh.exe vvvvv.exe PID 2080 wrote to memory of 4404 2080 hhnnhh.exe vvvvv.exe PID 2080 wrote to memory of 4404 2080 hhnnhh.exe vvvvv.exe PID 4404 wrote to memory of 4684 4404 vvvvv.exe vpdvv.exe PID 4404 wrote to memory of 4684 4404 vvvvv.exe vpdvv.exe PID 4404 wrote to memory of 4684 4404 vvvvv.exe vpdvv.exe PID 4684 wrote to memory of 1560 4684 vpdvv.exe 5lflfrl.exe PID 4684 wrote to memory of 1560 4684 vpdvv.exe 5lflfrl.exe PID 4684 wrote to memory of 1560 4684 vpdvv.exe 5lflfrl.exe PID 1560 wrote to memory of 1776 1560 5lflfrl.exe dpvpj.exe PID 1560 wrote to memory of 1776 1560 5lflfrl.exe dpvpj.exe PID 1560 wrote to memory of 1776 1560 5lflfrl.exe dpvpj.exe PID 1776 wrote to memory of 3944 1776 dpvpj.exe hthbbt.exe PID 1776 wrote to memory of 3944 1776 dpvpj.exe hthbbt.exe PID 1776 wrote to memory of 3944 1776 dpvpj.exe hthbbt.exe PID 3944 wrote to memory of 1376 3944 hthbbt.exe lffxxrl.exe PID 3944 wrote to memory of 1376 3944 hthbbt.exe lffxxrl.exe PID 3944 wrote to memory of 1376 3944 hthbbt.exe lffxxrl.exe PID 1376 wrote to memory of 4368 1376 lffxxrl.exe 1hnhbt.exe PID 1376 wrote to memory of 4368 1376 lffxxrl.exe 1hnhbt.exe PID 1376 wrote to memory of 4368 1376 lffxxrl.exe 1hnhbt.exe PID 4368 wrote to memory of 1764 4368 1hnhbt.exe dvdvv.exe PID 4368 wrote to memory of 1764 4368 1hnhbt.exe dvdvv.exe PID 4368 wrote to memory of 1764 4368 1hnhbt.exe dvdvv.exe PID 1764 wrote to memory of 4048 1764 dvdvv.exe nhbbtt.exe PID 1764 wrote to memory of 4048 1764 dvdvv.exe nhbbtt.exe PID 1764 wrote to memory of 4048 1764 dvdvv.exe nhbbtt.exe PID 4048 wrote to memory of 3860 4048 nhbbtt.exe rrxxxxr.exe PID 4048 wrote to memory of 3860 4048 nhbbtt.exe rrxxxxr.exe PID 4048 wrote to memory of 3860 4048 nhbbtt.exe rrxxxxr.exe PID 3860 wrote to memory of 1368 3860 rrxxxxr.exe xfrrfrr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5a194b3646b2a9554f6c77a0d11c470_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a5a194b3646b2a9554f6c77a0d11c470_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\5hbtnn.exec:\5hbtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdjdv.exec:\pdjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1lrlxrr.exec:\1lrlxrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxlflxf.exec:\lxlflxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnthnh.exec:\bnthnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfrlrrf.exec:\rfrlrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddvdv.exec:\ddvdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xffxrrl.exec:\xffxrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjpdv.exec:\pjpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5xrlrrl.exec:\5xrlrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhnnhh.exec:\hhnnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvvvv.exec:\vvvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpdvv.exec:\vpdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5lflfrl.exec:\5lflfrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpvpj.exec:\dpvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hthbbt.exec:\hthbbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lffxxrl.exec:\lffxxrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1hnhbt.exec:\1hnhbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdvv.exec:\dvdvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbbtt.exec:\nhbbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrxxxxr.exec:\rrxxxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfrrfrr.exec:\xfrrfrr.exe23⤵
- Executes dropped EXE
-
\??\c:\7ntnnn.exec:\7ntnnn.exe24⤵
- Executes dropped EXE
-
\??\c:\5rrfxrl.exec:\5rrfxrl.exe25⤵
- Executes dropped EXE
-
\??\c:\3vvpj.exec:\3vvpj.exe26⤵
- Executes dropped EXE
-
\??\c:\jdjvj.exec:\jdjvj.exe27⤵
- Executes dropped EXE
-
\??\c:\ffxrlrl.exec:\ffxrlrl.exe28⤵
- Executes dropped EXE
-
\??\c:\bbtntn.exec:\bbtntn.exe29⤵
- Executes dropped EXE
-
\??\c:\djjdd.exec:\djjdd.exe30⤵
- Executes dropped EXE
-
\??\c:\thhhbt.exec:\thhhbt.exe31⤵
- Executes dropped EXE
-
\??\c:\fxlfrrl.exec:\fxlfrrl.exe32⤵
- Executes dropped EXE
-
\??\c:\5djjd.exec:\5djjd.exe33⤵
- Executes dropped EXE
-
\??\c:\5hthnn.exec:\5hthnn.exe34⤵
- Executes dropped EXE
-
\??\c:\lxlfxxf.exec:\lxlfxxf.exe35⤵
-
\??\c:\bbbttn.exec:\bbbttn.exe36⤵
- Executes dropped EXE
-
\??\c:\dvddj.exec:\dvddj.exe37⤵
- Executes dropped EXE
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe38⤵
- Executes dropped EXE
-
\??\c:\bbhbtt.exec:\bbhbtt.exe39⤵
- Executes dropped EXE
-
\??\c:\9bnhtn.exec:\9bnhtn.exe40⤵
- Executes dropped EXE
-
\??\c:\vvjvp.exec:\vvjvp.exe41⤵
- Executes dropped EXE
-
\??\c:\lrflffr.exec:\lrflffr.exe42⤵
- Executes dropped EXE
-
\??\c:\hbbttt.exec:\hbbttt.exe43⤵
- Executes dropped EXE
-
\??\c:\pddpj.exec:\pddpj.exe44⤵
- Executes dropped EXE
-
\??\c:\xlrlffr.exec:\xlrlffr.exe45⤵
- Executes dropped EXE
-
\??\c:\nbnhhh.exec:\nbnhhh.exe46⤵
- Executes dropped EXE
-
\??\c:\vdpjd.exec:\vdpjd.exe47⤵
- Executes dropped EXE
-
\??\c:\9xxrffx.exec:\9xxrffx.exe48⤵
- Executes dropped EXE
-
\??\c:\nnhbtn.exec:\nnhbtn.exe49⤵
- Executes dropped EXE
-
\??\c:\dppjj.exec:\dppjj.exe50⤵
- Executes dropped EXE
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe51⤵
- Executes dropped EXE
-
\??\c:\hnnhbb.exec:\hnnhbb.exe52⤵
- Executes dropped EXE
-
\??\c:\3ntnhb.exec:\3ntnhb.exe53⤵
- Executes dropped EXE
-
\??\c:\djjdv.exec:\djjdv.exe54⤵
- Executes dropped EXE
-
\??\c:\1fxrffx.exec:\1fxrffx.exe55⤵
- Executes dropped EXE
-
\??\c:\3nnnnn.exec:\3nnnnn.exe56⤵
- Executes dropped EXE
-
\??\c:\dppvp.exec:\dppvp.exe57⤵
- Executes dropped EXE
-
\??\c:\ffxrllf.exec:\ffxrllf.exe58⤵
- Executes dropped EXE
-
\??\c:\bnnhnh.exec:\bnnhnh.exe59⤵
- Executes dropped EXE
-
\??\c:\pdjdd.exec:\pdjdd.exe60⤵
- Executes dropped EXE
-
\??\c:\xlxrlrl.exec:\xlxrlrl.exe61⤵
- Executes dropped EXE
-
\??\c:\hnbtnn.exec:\hnbtnn.exe62⤵
- Executes dropped EXE
-
\??\c:\7jjjv.exec:\7jjjv.exe63⤵
- Executes dropped EXE
-
\??\c:\dpdvp.exec:\dpdvp.exe64⤵
- Executes dropped EXE
-
\??\c:\rlffrrl.exec:\rlffrrl.exe65⤵
- Executes dropped EXE
-
\??\c:\bhnhbb.exec:\bhnhbb.exe66⤵
- Executes dropped EXE
-
\??\c:\9jvpd.exec:\9jvpd.exe67⤵
-
\??\c:\fxlfxrx.exec:\fxlfxrx.exe68⤵
-
\??\c:\3nnbtt.exec:\3nnbtt.exe69⤵
-
\??\c:\dppjd.exec:\dppjd.exe70⤵
-
\??\c:\xllfxrr.exec:\xllfxrr.exe71⤵
-
\??\c:\lrlxllx.exec:\lrlxllx.exe72⤵
-
\??\c:\dpjdv.exec:\dpjdv.exe73⤵
-
\??\c:\rfflxrl.exec:\rfflxrl.exe74⤵
-
\??\c:\rrxlfxr.exec:\rrxlfxr.exe75⤵
-
\??\c:\nttnhb.exec:\nttnhb.exe76⤵
-
\??\c:\pjddv.exec:\pjddv.exe77⤵
-
\??\c:\rxffxlf.exec:\rxffxlf.exe78⤵
-
\??\c:\nttnhn.exec:\nttnhn.exe79⤵
-
\??\c:\jdvpp.exec:\jdvpp.exe80⤵
-
\??\c:\lfffrrl.exec:\lfffrrl.exe81⤵
-
\??\c:\1bnnbb.exec:\1bnnbb.exe82⤵
-
\??\c:\7jpjv.exec:\7jpjv.exe83⤵
-
\??\c:\xfllfll.exec:\xfllfll.exe84⤵
-
\??\c:\httnhn.exec:\httnhn.exe85⤵
-
\??\c:\thbttn.exec:\thbttn.exe86⤵
-
\??\c:\ddjpj.exec:\ddjpj.exe87⤵
-
\??\c:\rxfrlfx.exec:\rxfrlfx.exe88⤵
-
\??\c:\nbbtnh.exec:\nbbtnh.exe89⤵
-
\??\c:\7vjvp.exec:\7vjvp.exe90⤵
-
\??\c:\flllfxr.exec:\flllfxr.exe91⤵
-
\??\c:\btbthh.exec:\btbthh.exe92⤵
-
\??\c:\jdpjv.exec:\jdpjv.exe93⤵
-
\??\c:\xffxlrr.exec:\xffxlrr.exe94⤵
-
\??\c:\hbhbnh.exec:\hbhbnh.exe95⤵
-
\??\c:\7vddv.exec:\7vddv.exe96⤵
-
\??\c:\lllffxf.exec:\lllffxf.exe97⤵
-
\??\c:\dppjj.exec:\dppjj.exe98⤵
-
\??\c:\jjjdd.exec:\jjjdd.exe99⤵
-
\??\c:\btbtnt.exec:\btbtnt.exe100⤵
-
\??\c:\dddvp.exec:\dddvp.exe101⤵
-
\??\c:\fxfxllx.exec:\fxfxllx.exe102⤵
-
\??\c:\bbnnhh.exec:\bbnnhh.exe103⤵
-
\??\c:\ntbtnh.exec:\ntbtnh.exe104⤵
-
\??\c:\jdddv.exec:\jdddv.exe105⤵
-
\??\c:\lxxlfxl.exec:\lxxlfxl.exe106⤵
-
\??\c:\bhnhhh.exec:\bhnhhh.exe107⤵
-
\??\c:\dpdvd.exec:\dpdvd.exe108⤵
-
\??\c:\ffxrlll.exec:\ffxrlll.exe109⤵
-
\??\c:\nbnbbn.exec:\nbnbbn.exe110⤵
-
\??\c:\tttnhb.exec:\tttnhb.exe111⤵
-
\??\c:\7dpjp.exec:\7dpjp.exe112⤵
-
\??\c:\xrllfxx.exec:\xrllfxx.exe113⤵
-
\??\c:\7nhbtn.exec:\7nhbtn.exe114⤵
-
\??\c:\pvppj.exec:\pvppj.exe115⤵
-
\??\c:\xflffxx.exec:\xflffxx.exe116⤵
-
\??\c:\3hnhbb.exec:\3hnhbb.exe117⤵
-
\??\c:\7djdv.exec:\7djdv.exe118⤵
-
\??\c:\3djdv.exec:\3djdv.exe119⤵
-
\??\c:\lxrlfxx.exec:\lxrlfxx.exe120⤵
-
\??\c:\hbnnhh.exec:\hbnnhh.exe121⤵
-
\??\c:\pdvpv.exec:\pdvpv.exe122⤵
-
\??\c:\fffxrlf.exec:\fffxrlf.exe123⤵
-
\??\c:\httnhh.exec:\httnhh.exe124⤵
-
\??\c:\pjpdd.exec:\pjpdd.exe125⤵
-
\??\c:\frrlfxr.exec:\frrlfxr.exe126⤵
-
\??\c:\ttnhhn.exec:\ttnhhn.exe127⤵
-
\??\c:\7jpdv.exec:\7jpdv.exe128⤵
-
\??\c:\rffxrlr.exec:\rffxrlr.exe129⤵
-
\??\c:\7nbthh.exec:\7nbthh.exe130⤵
-
\??\c:\jdjjd.exec:\jdjjd.exe131⤵
-
\??\c:\lffxrlf.exec:\lffxrlf.exe132⤵
-
\??\c:\1hthbb.exec:\1hthbb.exe133⤵
-
\??\c:\tnhbtn.exec:\tnhbtn.exe134⤵
-
\??\c:\vppdv.exec:\vppdv.exe135⤵
-
\??\c:\lfllfrr.exec:\lfllfrr.exe136⤵
-
\??\c:\hnnnnt.exec:\hnnnnt.exe137⤵
-
\??\c:\ppvpd.exec:\ppvpd.exe138⤵
-
\??\c:\xxrrlll.exec:\xxrrlll.exe139⤵
-
\??\c:\nnhbtt.exec:\nnhbtt.exe140⤵
-
\??\c:\jjjdv.exec:\jjjdv.exe141⤵
-
\??\c:\vpdpv.exec:\vpdpv.exe142⤵
-
\??\c:\1flxxxl.exec:\1flxxxl.exe143⤵
-
\??\c:\vvddd.exec:\vvddd.exe144⤵
-
\??\c:\fxfxfrr.exec:\fxfxfrr.exe145⤵
-
\??\c:\fffxlfx.exec:\fffxlfx.exe146⤵
-
\??\c:\bbbtnh.exec:\bbbtnh.exe147⤵
-
\??\c:\jddvd.exec:\jddvd.exe148⤵
-
\??\c:\5xxrxxr.exec:\5xxrxxr.exe149⤵
-
\??\c:\hhhbbb.exec:\hhhbbb.exe150⤵
-
\??\c:\vvvpv.exec:\vvvpv.exe151⤵
-
\??\c:\fxrlxxl.exec:\fxrlxxl.exe152⤵
-
\??\c:\tbbtnh.exec:\tbbtnh.exe153⤵
-
\??\c:\pddjv.exec:\pddjv.exe154⤵
-
\??\c:\xlxrllr.exec:\xlxrllr.exe155⤵
-
\??\c:\ntbtnh.exec:\ntbtnh.exe156⤵
-
\??\c:\vjdvv.exec:\vjdvv.exe157⤵
-
\??\c:\rfrlfxx.exec:\rfrlfxx.exe158⤵
-
\??\c:\bbtnhb.exec:\bbtnhb.exe159⤵
-
\??\c:\dvpjv.exec:\dvpjv.exe160⤵
-
\??\c:\xllfxrl.exec:\xllfxrl.exe161⤵
-
\??\c:\nnbbhn.exec:\nnbbhn.exe162⤵
-
\??\c:\3dpdv.exec:\3dpdv.exe163⤵
-
\??\c:\llrlfrr.exec:\llrlfrr.exe164⤵
-
\??\c:\nhhbbh.exec:\nhhbbh.exe165⤵
-
\??\c:\bnnhbt.exec:\bnnhbt.exe166⤵
-
\??\c:\ppddj.exec:\ppddj.exe167⤵
-
\??\c:\fxllxxr.exec:\fxllxxr.exe168⤵
-
\??\c:\tbbttt.exec:\tbbttt.exe169⤵
-
\??\c:\dddvv.exec:\dddvv.exe170⤵
-
\??\c:\xrxxxff.exec:\xrxxxff.exe171⤵
-
\??\c:\3bbbtt.exec:\3bbbtt.exe172⤵
-
\??\c:\vdddp.exec:\vdddp.exe173⤵
-
\??\c:\rfxrlxx.exec:\rfxrlxx.exe174⤵
-
\??\c:\tnntnh.exec:\tnntnh.exe175⤵
-
\??\c:\vpdpj.exec:\vpdpj.exe176⤵
-
\??\c:\fxrfxrl.exec:\fxrfxrl.exe177⤵
-
\??\c:\btbbbb.exec:\btbbbb.exe178⤵
-
\??\c:\jpvpd.exec:\jpvpd.exe179⤵
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe180⤵
-
\??\c:\ffxfrxx.exec:\ffxfrxx.exe181⤵
-
\??\c:\5ttnhh.exec:\5ttnhh.exe182⤵
-
\??\c:\lfrrfff.exec:\lfrrfff.exe183⤵
-
\??\c:\xxlllrr.exec:\xxlllrr.exe184⤵
-
\??\c:\tnnnbb.exec:\tnnnbb.exe185⤵
-
\??\c:\vvvvp.exec:\vvvvp.exe186⤵
-
\??\c:\flxxffr.exec:\flxxffr.exe187⤵
-
\??\c:\bttnhb.exec:\bttnhb.exe188⤵
-
\??\c:\7jjjd.exec:\7jjjd.exe189⤵
-
\??\c:\llfflrf.exec:\llfflrf.exe190⤵
-
\??\c:\tthhnt.exec:\tthhnt.exe191⤵
-
\??\c:\3jppp.exec:\3jppp.exe192⤵
-
\??\c:\xrxrlrl.exec:\xrxrlrl.exe193⤵
-
\??\c:\7hnhnt.exec:\7hnhnt.exe194⤵
-
\??\c:\vpvvv.exec:\vpvvv.exe195⤵
-
\??\c:\3frrrrr.exec:\3frrrrr.exe196⤵
-
\??\c:\nttbbb.exec:\nttbbb.exe197⤵
-
\??\c:\jjdjj.exec:\jjdjj.exe198⤵
-
\??\c:\9rflxfr.exec:\9rflxfr.exe199⤵
-
\??\c:\llffxrr.exec:\llffxrr.exe200⤵
-
\??\c:\jpjvd.exec:\jpjvd.exe201⤵
-
\??\c:\5xrlxxl.exec:\5xrlxxl.exe202⤵
-
\??\c:\nbbhhn.exec:\nbbhhn.exe203⤵
-
\??\c:\5pvvv.exec:\5pvvv.exe204⤵
-
\??\c:\frxxflx.exec:\frxxflx.exe205⤵
-
\??\c:\1htthh.exec:\1htthh.exe206⤵
-
\??\c:\jvdvj.exec:\jvdvj.exe207⤵
-
\??\c:\1lxrrrr.exec:\1lxrrrr.exe208⤵
-
\??\c:\nnbbtt.exec:\nnbbtt.exe209⤵
-
\??\c:\pvddp.exec:\pvddp.exe210⤵
-
\??\c:\xrxrllf.exec:\xrxrllf.exe211⤵
-
\??\c:\tbhhhh.exec:\tbhhhh.exe212⤵
-
\??\c:\ddjjj.exec:\ddjjj.exe213⤵
-
\??\c:\lfxrrll.exec:\lfxrrll.exe214⤵
-
\??\c:\hhbhbb.exec:\hhbhbb.exe215⤵
-
\??\c:\5vjjd.exec:\5vjjd.exe216⤵
-
\??\c:\rxrlrfx.exec:\rxrlrfx.exe217⤵
-
\??\c:\nntbbh.exec:\nntbbh.exe218⤵
-
\??\c:\jdpvv.exec:\jdpvv.exe219⤵
-
\??\c:\lfrxxxx.exec:\lfrxxxx.exe220⤵
-
\??\c:\bnbbhh.exec:\bnbbhh.exe221⤵
-
\??\c:\jpvdd.exec:\jpvdd.exe222⤵
-
\??\c:\3xfllxf.exec:\3xfllxf.exe223⤵
-
\??\c:\hhnnnh.exec:\hhnnnh.exe224⤵
-
\??\c:\vpdjv.exec:\vpdjv.exe225⤵
-
\??\c:\llrrrxx.exec:\llrrrxx.exe226⤵
-
\??\c:\3hnhht.exec:\3hnhht.exe227⤵
-
\??\c:\nhttbb.exec:\nhttbb.exe228⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe229⤵
-
\??\c:\hhhbbh.exec:\hhhbbh.exe230⤵
-
\??\c:\ppjdj.exec:\ppjdj.exe231⤵
-
\??\c:\jdpjv.exec:\jdpjv.exe232⤵
-
\??\c:\9ntbnt.exec:\9ntbnt.exe233⤵
-
\??\c:\tttttb.exec:\tttttb.exe234⤵
-
\??\c:\5vjjj.exec:\5vjjj.exe235⤵
-
\??\c:\xxrxlrr.exec:\xxrxlrr.exe236⤵
-
\??\c:\hbnntt.exec:\hbnntt.exe237⤵
-
\??\c:\dvvvv.exec:\dvvvv.exe238⤵
-
\??\c:\fffxxxx.exec:\fffxxxx.exe239⤵
-
\??\c:\5hhhhh.exec:\5hhhhh.exe240⤵
-
\??\c:\5vppp.exec:\5vppp.exe241⤵