Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 08:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d02a4e7aa599765f28dfe866de403170_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d02a4e7aa599765f28dfe866de403170_NeikiAnalytics.exe
-
Size
83KB
-
MD5
d02a4e7aa599765f28dfe866de403170
-
SHA1
05df13b01d986ef31b6f53c89ed7dff21e3e0f80
-
SHA256
291c369bb187aaa8fdc0a3472aec7b19544c660150ba0c98206b4507953bfa9a
-
SHA512
a1a9e1e1c1fc729239e0c8616866d023a067d31c7e68175483da0e24fd3329f77cb7b379853a3f27c96bef02952e85f31c03d63afb4a4933fee6e70ef8e5ce0a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73yqKH/KjvHo+WdN1:ymb3NkkiQ3mdBjFo73yX+vI+qb
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/1112-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nhnhbn.exedvpjd.exevjdpd.exe1lrxxxx.exe9rrrrrx.exe9jjdd.exe1rrrlxr.exe5bnhnh.exejjjdd.exevjpjd.exe9xlflfl.exebttnnn.exepddpj.exexxrxxll.exerlxrrrx.exetnnnhh.exeppvpp.exedvvvd.exellrlxxr.exe5rrlffx.exe7pjdp.exedppjd.exexflfxxr.exe5hthbh.exedpvdj.exelxfrlfx.exefxfxfxr.exebbhbhh.exentnhtn.exepdpjd.exefxfrllf.exebnnhtn.exejddvp.exe9xxrllf.exe5xllrxf.exe9nhhbb.exehbbtnt.exeddddd.exe7flfxfl.exerlxxllr.exebntnhh.exeddvpj.exevddjv.exerfllflf.exellxfllx.exehthhhh.exebntnbt.exejvvvv.exefflfxxr.exethnbtn.exe3hhbnh.exebnhhtb.exepjvpd.exejjjvp.exefrlxfxr.exehtttnh.exennhbhh.exevvppd.exejdppd.exelrrfrrf.exelxxrlff.exebttnbb.exehbbtbt.exejpvjd.exepid process 2308 nhnhbn.exe 3628 dvpjd.exe 4112 vjdpd.exe 1904 1lrxxxx.exe 2016 9rrrrrx.exe 1416 9jjdd.exe 1752 1rrrlxr.exe 4168 5bnhnh.exe 3976 jjjdd.exe 4520 vjpjd.exe 2032 9xlflfl.exe 4848 bttnnn.exe 1384 pddpj.exe 3972 xxrxxll.exe 2636 rlxrrrx.exe 2140 tnnnhh.exe 32 ppvpp.exe 2320 dvvvd.exe 3604 llrlxxr.exe 3980 5rrlffx.exe 3448 7pjdp.exe 4732 dppjd.exe 1440 xflfxxr.exe 2288 5hthbh.exe 2480 dpvdj.exe 1828 lxfrlfx.exe 4472 fxfxfxr.exe 4760 bbhbhh.exe 1112 ntnhtn.exe 5020 pdpjd.exe 3628 fxfrllf.exe 1528 bnnhtn.exe 1564 jddvp.exe 5100 9xxrllf.exe 3916 5xllrxf.exe 3332 9nhhbb.exe 4992 hbbtnt.exe 4032 ddddd.exe 680 7flfxfl.exe 3108 rlxxllr.exe 732 bntnhh.exe 3948 ddvpj.exe 4140 vddjv.exe 1384 rfllflf.exe 3992 llxfllx.exe 5092 hthhhh.exe 4340 bntnbt.exe 32 jvvvv.exe 5088 fflfxxr.exe 2924 thnbtn.exe 3148 3hhbnh.exe 1504 bnhhtb.exe 2160 pjvpd.exe 4732 jjjvp.exe 1440 frlxfxr.exe 2808 htttnh.exe 4284 nnhbhh.exe 4488 vvppd.exe 4616 jdppd.exe 4472 lrrfrrf.exe 3544 lxxrlff.exe 1288 bttnbb.exe 624 hbbtbt.exe 2492 jpvjd.exe -
Processes:
resource yara_rule behavioral2/memory/1112-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-190-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d02a4e7aa599765f28dfe866de403170_NeikiAnalytics.exenhnhbn.exedvpjd.exevjdpd.exe1lrxxxx.exe9rrrrrx.exe9jjdd.exe1rrrlxr.exe5bnhnh.exejjjdd.exevjpjd.exe9xlflfl.exebttnnn.exepddpj.exexxrxxll.exerlxrrrx.exetnnnhh.exeppvpp.exedvvvd.exellrlxxr.exe5rrlffx.exe7pjdp.exedescription pid process target process PID 1112 wrote to memory of 2308 1112 d02a4e7aa599765f28dfe866de403170_NeikiAnalytics.exe nhnhbn.exe PID 1112 wrote to memory of 2308 1112 d02a4e7aa599765f28dfe866de403170_NeikiAnalytics.exe nhnhbn.exe PID 1112 wrote to memory of 2308 1112 d02a4e7aa599765f28dfe866de403170_NeikiAnalytics.exe nhnhbn.exe PID 2308 wrote to memory of 3628 2308 nhnhbn.exe dvpjd.exe PID 2308 wrote to memory of 3628 2308 nhnhbn.exe dvpjd.exe PID 2308 wrote to memory of 3628 2308 nhnhbn.exe dvpjd.exe PID 3628 wrote to memory of 4112 3628 dvpjd.exe vjdpd.exe PID 3628 wrote to memory of 4112 3628 dvpjd.exe vjdpd.exe PID 3628 wrote to memory of 4112 3628 dvpjd.exe vjdpd.exe PID 4112 wrote to memory of 1904 4112 vjdpd.exe 1lrxxxx.exe PID 4112 wrote to memory of 1904 4112 vjdpd.exe 1lrxxxx.exe PID 4112 wrote to memory of 1904 4112 vjdpd.exe 1lrxxxx.exe PID 1904 wrote to memory of 2016 1904 1lrxxxx.exe 9rrrrrx.exe PID 1904 wrote to memory of 2016 1904 1lrxxxx.exe 9rrrrrx.exe PID 1904 wrote to memory of 2016 1904 1lrxxxx.exe 9rrrrrx.exe PID 2016 wrote to memory of 1416 2016 9rrrrrx.exe 9jjdd.exe PID 2016 wrote to memory of 1416 2016 9rrrrrx.exe 9jjdd.exe PID 2016 wrote to memory of 1416 2016 9rrrrrx.exe 9jjdd.exe PID 1416 wrote to memory of 1752 1416 9jjdd.exe 1rrrlxr.exe PID 1416 wrote to memory of 1752 1416 9jjdd.exe 1rrrlxr.exe PID 1416 wrote to memory of 1752 1416 9jjdd.exe 1rrrlxr.exe PID 1752 wrote to memory of 4168 1752 1rrrlxr.exe 5bnhnh.exe PID 1752 wrote to memory of 4168 1752 1rrrlxr.exe 5bnhnh.exe PID 1752 wrote to memory of 4168 1752 1rrrlxr.exe 5bnhnh.exe PID 4168 wrote to memory of 3976 4168 5bnhnh.exe jjjdd.exe PID 4168 wrote to memory of 3976 4168 5bnhnh.exe jjjdd.exe PID 4168 wrote to memory of 3976 4168 5bnhnh.exe jjjdd.exe PID 3976 wrote to memory of 4520 3976 jjjdd.exe vjpjd.exe PID 3976 wrote to memory of 4520 3976 jjjdd.exe vjpjd.exe PID 3976 wrote to memory of 4520 3976 jjjdd.exe vjpjd.exe PID 4520 wrote to memory of 2032 4520 vjpjd.exe 9xlflfl.exe PID 4520 wrote to memory of 2032 4520 vjpjd.exe 9xlflfl.exe PID 4520 wrote to memory of 2032 4520 vjpjd.exe 9xlflfl.exe PID 2032 wrote to memory of 4848 2032 9xlflfl.exe bttnnn.exe PID 2032 wrote to memory of 4848 2032 9xlflfl.exe bttnnn.exe PID 2032 wrote to memory of 4848 2032 9xlflfl.exe bttnnn.exe PID 4848 wrote to memory of 1384 4848 bttnnn.exe pddpj.exe PID 4848 wrote to memory of 1384 4848 bttnnn.exe pddpj.exe PID 4848 wrote to memory of 1384 4848 bttnnn.exe pddpj.exe PID 1384 wrote to memory of 3972 1384 pddpj.exe xxrxxll.exe PID 1384 wrote to memory of 3972 1384 pddpj.exe xxrxxll.exe PID 1384 wrote to memory of 3972 1384 pddpj.exe xxrxxll.exe PID 3972 wrote to memory of 2636 3972 xxrxxll.exe rlxrrrx.exe PID 3972 wrote to memory of 2636 3972 xxrxxll.exe rlxrrrx.exe PID 3972 wrote to memory of 2636 3972 xxrxxll.exe rlxrrrx.exe PID 2636 wrote to memory of 2140 2636 rlxrrrx.exe tnnnhh.exe PID 2636 wrote to memory of 2140 2636 rlxrrrx.exe tnnnhh.exe PID 2636 wrote to memory of 2140 2636 rlxrrrx.exe tnnnhh.exe PID 2140 wrote to memory of 32 2140 tnnnhh.exe ppvpp.exe PID 2140 wrote to memory of 32 2140 tnnnhh.exe ppvpp.exe PID 2140 wrote to memory of 32 2140 tnnnhh.exe ppvpp.exe PID 32 wrote to memory of 2320 32 ppvpp.exe dvvvd.exe PID 32 wrote to memory of 2320 32 ppvpp.exe dvvvd.exe PID 32 wrote to memory of 2320 32 ppvpp.exe dvvvd.exe PID 2320 wrote to memory of 3604 2320 dvvvd.exe llrlxxr.exe PID 2320 wrote to memory of 3604 2320 dvvvd.exe llrlxxr.exe PID 2320 wrote to memory of 3604 2320 dvvvd.exe llrlxxr.exe PID 3604 wrote to memory of 3980 3604 llrlxxr.exe 5rrlffx.exe PID 3604 wrote to memory of 3980 3604 llrlxxr.exe 5rrlffx.exe PID 3604 wrote to memory of 3980 3604 llrlxxr.exe 5rrlffx.exe PID 3980 wrote to memory of 3448 3980 5rrlffx.exe 7pjdp.exe PID 3980 wrote to memory of 3448 3980 5rrlffx.exe 7pjdp.exe PID 3980 wrote to memory of 3448 3980 5rrlffx.exe 7pjdp.exe PID 3448 wrote to memory of 4732 3448 7pjdp.exe dppjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d02a4e7aa599765f28dfe866de403170_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d02a4e7aa599765f28dfe866de403170_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\nhnhbn.exec:\nhnhbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvpjd.exec:\dvpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjdpd.exec:\vjdpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1lrxxxx.exec:\1lrxxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9rrrrrx.exec:\9rrrrrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9jjdd.exec:\9jjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1rrrlxr.exec:\1rrrlxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5bnhnh.exec:\5bnhnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjjdd.exec:\jjjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjpjd.exec:\vjpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9xlflfl.exec:\9xlflfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bttnnn.exec:\bttnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pddpj.exec:\pddpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxrxxll.exec:\xxrxxll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnnnhh.exec:\tnnnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppvpp.exec:\ppvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvvvd.exec:\dvvvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llrlxxr.exec:\llrlxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5rrlffx.exec:\5rrlffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7pjdp.exec:\7pjdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dppjd.exec:\dppjd.exe23⤵
- Executes dropped EXE
-
\??\c:\xflfxxr.exec:\xflfxxr.exe24⤵
- Executes dropped EXE
-
\??\c:\5hthbh.exec:\5hthbh.exe25⤵
- Executes dropped EXE
-
\??\c:\dpvdj.exec:\dpvdj.exe26⤵
- Executes dropped EXE
-
\??\c:\lxfrlfx.exec:\lxfrlfx.exe27⤵
- Executes dropped EXE
-
\??\c:\fxfxfxr.exec:\fxfxfxr.exe28⤵
- Executes dropped EXE
-
\??\c:\bbhbhh.exec:\bbhbhh.exe29⤵
- Executes dropped EXE
-
\??\c:\ntnhtn.exec:\ntnhtn.exe30⤵
- Executes dropped EXE
-
\??\c:\pdpjd.exec:\pdpjd.exe31⤵
- Executes dropped EXE
-
\??\c:\fxfrllf.exec:\fxfrllf.exe32⤵
- Executes dropped EXE
-
\??\c:\bnnhtn.exec:\bnnhtn.exe33⤵
- Executes dropped EXE
-
\??\c:\jddvp.exec:\jddvp.exe34⤵
- Executes dropped EXE
-
\??\c:\9xxrllf.exec:\9xxrllf.exe35⤵
- Executes dropped EXE
-
\??\c:\5xllrxf.exec:\5xllrxf.exe36⤵
- Executes dropped EXE
-
\??\c:\9nhhbb.exec:\9nhhbb.exe37⤵
- Executes dropped EXE
-
\??\c:\hbbtnt.exec:\hbbtnt.exe38⤵
- Executes dropped EXE
-
\??\c:\ddddd.exec:\ddddd.exe39⤵
- Executes dropped EXE
-
\??\c:\7flfxfl.exec:\7flfxfl.exe40⤵
- Executes dropped EXE
-
\??\c:\rlxxllr.exec:\rlxxllr.exe41⤵
- Executes dropped EXE
-
\??\c:\bntnhh.exec:\bntnhh.exe42⤵
- Executes dropped EXE
-
\??\c:\ddvpj.exec:\ddvpj.exe43⤵
- Executes dropped EXE
-
\??\c:\vddjv.exec:\vddjv.exe44⤵
- Executes dropped EXE
-
\??\c:\rfllflf.exec:\rfllflf.exe45⤵
- Executes dropped EXE
-
\??\c:\llxfllx.exec:\llxfllx.exe46⤵
- Executes dropped EXE
-
\??\c:\hthhhh.exec:\hthhhh.exe47⤵
- Executes dropped EXE
-
\??\c:\bntnbt.exec:\bntnbt.exe48⤵
- Executes dropped EXE
-
\??\c:\jvvvv.exec:\jvvvv.exe49⤵
- Executes dropped EXE
-
\??\c:\fflfxxr.exec:\fflfxxr.exe50⤵
- Executes dropped EXE
-
\??\c:\thnbtn.exec:\thnbtn.exe51⤵
- Executes dropped EXE
-
\??\c:\3hhbnh.exec:\3hhbnh.exe52⤵
- Executes dropped EXE
-
\??\c:\bnhhtb.exec:\bnhhtb.exe53⤵
- Executes dropped EXE
-
\??\c:\pjvpd.exec:\pjvpd.exe54⤵
- Executes dropped EXE
-
\??\c:\jjjvp.exec:\jjjvp.exe55⤵
- Executes dropped EXE
-
\??\c:\frlxfxr.exec:\frlxfxr.exe56⤵
- Executes dropped EXE
-
\??\c:\htttnh.exec:\htttnh.exe57⤵
- Executes dropped EXE
-
\??\c:\nnhbhh.exec:\nnhbhh.exe58⤵
- Executes dropped EXE
-
\??\c:\vvppd.exec:\vvppd.exe59⤵
- Executes dropped EXE
-
\??\c:\jdppd.exec:\jdppd.exe60⤵
- Executes dropped EXE
-
\??\c:\lrrfrrf.exec:\lrrfrrf.exe61⤵
- Executes dropped EXE
-
\??\c:\lxxrlff.exec:\lxxrlff.exe62⤵
- Executes dropped EXE
-
\??\c:\bttnbb.exec:\bttnbb.exe63⤵
- Executes dropped EXE
-
\??\c:\hbbtbt.exec:\hbbtbt.exe64⤵
- Executes dropped EXE
-
\??\c:\jpvjd.exec:\jpvjd.exe65⤵
- Executes dropped EXE
-
\??\c:\lfxlxrl.exec:\lfxlxrl.exe66⤵
-
\??\c:\rrllrxf.exec:\rrllrxf.exe67⤵
-
\??\c:\htbtht.exec:\htbtht.exe68⤵
-
\??\c:\ttbnbt.exec:\ttbnbt.exe69⤵
-
\??\c:\vppvj.exec:\vppvj.exe70⤵
-
\??\c:\jppjd.exec:\jppjd.exe71⤵
-
\??\c:\rrrlfxx.exec:\rrrlfxx.exe72⤵
-
\??\c:\9frrllf.exec:\9frrllf.exe73⤵
-
\??\c:\hhnhbb.exec:\hhnhbb.exe74⤵
-
\??\c:\9btnbt.exec:\9btnbt.exe75⤵
-
\??\c:\jvvpd.exec:\jvvpd.exe76⤵
-
\??\c:\dvpjv.exec:\dvpjv.exe77⤵
-
\??\c:\ffxxfxf.exec:\ffxxfxf.exe78⤵
-
\??\c:\5llflfl.exec:\5llflfl.exe79⤵
-
\??\c:\pjjdp.exec:\pjjdp.exe80⤵
-
\??\c:\dpdpd.exec:\dpdpd.exe81⤵
-
\??\c:\9lrffxr.exec:\9lrffxr.exe82⤵
-
\??\c:\hbbtnn.exec:\hbbtnn.exe83⤵
-
\??\c:\ththbt.exec:\ththbt.exe84⤵
-
\??\c:\5jpdv.exec:\5jpdv.exe85⤵
-
\??\c:\1rfxlxr.exec:\1rfxlxr.exe86⤵
-
\??\c:\ntnhbb.exec:\ntnhbb.exe87⤵
-
\??\c:\1bbthb.exec:\1bbthb.exe88⤵
-
\??\c:\thtntn.exec:\thtntn.exe89⤵
-
\??\c:\dvvjv.exec:\dvvjv.exe90⤵
-
\??\c:\rflfrlr.exec:\rflfrlr.exe91⤵
-
\??\c:\5rxrrlx.exec:\5rxrrlx.exe92⤵
-
\??\c:\7ntnnn.exec:\7ntnnn.exe93⤵
-
\??\c:\hnnbnn.exec:\hnnbnn.exe94⤵
-
\??\c:\nhnhtn.exec:\nhnhtn.exe95⤵
-
\??\c:\dvjdp.exec:\dvjdp.exe96⤵
-
\??\c:\jvdvv.exec:\jvdvv.exe97⤵
-
\??\c:\fxlfxfx.exec:\fxlfxfx.exe98⤵
-
\??\c:\7fxllfr.exec:\7fxllfr.exe99⤵
-
\??\c:\1rllfxr.exec:\1rllfxr.exe100⤵
-
\??\c:\hhtnnh.exec:\hhtnnh.exe101⤵
-
\??\c:\7ththb.exec:\7ththb.exe102⤵
-
\??\c:\jvjvj.exec:\jvjvj.exe103⤵
-
\??\c:\dpdpd.exec:\dpdpd.exe104⤵
-
\??\c:\fxfxrll.exec:\fxfxrll.exe105⤵
-
\??\c:\rffxxxf.exec:\rffxxxf.exe106⤵
-
\??\c:\7btnbt.exec:\7btnbt.exe107⤵
-
\??\c:\5bthtn.exec:\5bthtn.exe108⤵
-
\??\c:\5tnhtt.exec:\5tnhtt.exe109⤵
-
\??\c:\djjjp.exec:\djjjp.exe110⤵
-
\??\c:\pdvpd.exec:\pdvpd.exe111⤵
-
\??\c:\rlfxrrx.exec:\rlfxrrx.exe112⤵
-
\??\c:\rfffxxr.exec:\rfffxxr.exe113⤵
-
\??\c:\bthnhn.exec:\bthnhn.exe114⤵
-
\??\c:\bbttnn.exec:\bbttnn.exe115⤵
-
\??\c:\1pvpj.exec:\1pvpj.exe116⤵
-
\??\c:\vpjjp.exec:\vpjjp.exe117⤵
-
\??\c:\xrxrfff.exec:\xrxrfff.exe118⤵
-
\??\c:\1xxxrrx.exec:\1xxxrrx.exe119⤵
-
\??\c:\hbbtnn.exec:\hbbtnn.exe120⤵
-
\??\c:\tnbbtt.exec:\tnbbtt.exe121⤵
-
\??\c:\pjpjd.exec:\pjpjd.exe122⤵
-
\??\c:\ddpjd.exec:\ddpjd.exe123⤵
-
\??\c:\9jjdp.exec:\9jjdp.exe124⤵
-
\??\c:\3llfrlf.exec:\3llfrlf.exe125⤵
-
\??\c:\lllfxxf.exec:\lllfxxf.exe126⤵
-
\??\c:\5nhbtt.exec:\5nhbtt.exe127⤵
-
\??\c:\tbbbbt.exec:\tbbbbt.exe128⤵
-
\??\c:\jvvpj.exec:\jvvpj.exe129⤵
-
\??\c:\flffxrl.exec:\flffxrl.exe130⤵
-
\??\c:\xlxxfff.exec:\xlxxfff.exe131⤵
-
\??\c:\nhhbtt.exec:\nhhbtt.exe132⤵
-
\??\c:\bttnnn.exec:\bttnnn.exe133⤵
-
\??\c:\1dvdd.exec:\1dvdd.exe134⤵
-
\??\c:\vvppd.exec:\vvppd.exe135⤵
-
\??\c:\rrlffff.exec:\rrlffff.exe136⤵
-
\??\c:\9ffxxxr.exec:\9ffxxxr.exe137⤵
-
\??\c:\hbttnt.exec:\hbttnt.exe138⤵
-
\??\c:\3thhhh.exec:\3thhhh.exe139⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe140⤵
-
\??\c:\djpjj.exec:\djpjj.exe141⤵
-
\??\c:\rrfxxff.exec:\rrfxxff.exe142⤵
-
\??\c:\fffflll.exec:\fffflll.exe143⤵
-
\??\c:\5thnhn.exec:\5thnhn.exe144⤵
-
\??\c:\5nhbth.exec:\5nhbth.exe145⤵
-
\??\c:\bhtnhb.exec:\bhtnhb.exe146⤵
-
\??\c:\vjvjj.exec:\vjvjj.exe147⤵
-
\??\c:\vjjjv.exec:\vjjjv.exe148⤵
-
\??\c:\xllxlfx.exec:\xllxlfx.exe149⤵
-
\??\c:\rffxllx.exec:\rffxllx.exe150⤵
-
\??\c:\5hbthh.exec:\5hbthh.exe151⤵
-
\??\c:\3nbthh.exec:\3nbthh.exe152⤵
-
\??\c:\pdpdv.exec:\pdpdv.exe153⤵
-
\??\c:\lrrfrlx.exec:\lrrfrlx.exe154⤵
-
\??\c:\rrlfxrr.exec:\rrlfxrr.exe155⤵
-
\??\c:\3tthhb.exec:\3tthhb.exe156⤵
-
\??\c:\jdvdv.exec:\jdvdv.exe157⤵
-
\??\c:\vdvjd.exec:\vdvjd.exe158⤵
-
\??\c:\frxxxrr.exec:\frxxxrr.exe159⤵
-
\??\c:\hhhhbt.exec:\hhhhbt.exe160⤵
-
\??\c:\tnnhbt.exec:\tnnhbt.exe161⤵
-
\??\c:\dpjvp.exec:\dpjvp.exe162⤵
-
\??\c:\dpppd.exec:\dpppd.exe163⤵
-
\??\c:\xrfxlfx.exec:\xrfxlfx.exe164⤵
-
\??\c:\1flffxr.exec:\1flffxr.exe165⤵
-
\??\c:\nbbtht.exec:\nbbtht.exe166⤵
-
\??\c:\3hbttn.exec:\3hbttn.exe167⤵
-
\??\c:\dvdpp.exec:\dvdpp.exe168⤵
-
\??\c:\fllxlfx.exec:\fllxlfx.exe169⤵
-
\??\c:\bnhbtn.exec:\bnhbtn.exe170⤵
-
\??\c:\nhnbbt.exec:\nhnbbt.exe171⤵
-
\??\c:\jvvpd.exec:\jvvpd.exe172⤵
-
\??\c:\nhbthb.exec:\nhbthb.exe173⤵
-
\??\c:\9hnbnh.exec:\9hnbnh.exe174⤵
-
\??\c:\ddpjd.exec:\ddpjd.exe175⤵
-
\??\c:\9ppdv.exec:\9ppdv.exe176⤵
-
\??\c:\7rrfrlx.exec:\7rrfrlx.exe177⤵
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe178⤵
-
\??\c:\btnhbt.exec:\btnhbt.exe179⤵
-
\??\c:\7pvpp.exec:\7pvpp.exe180⤵
-
\??\c:\fxrflfx.exec:\fxrflfx.exe181⤵
-
\??\c:\ppvvp.exec:\ppvvp.exe182⤵
-
\??\c:\lfxlfxl.exec:\lfxlfxl.exe183⤵
-
\??\c:\frrlxrf.exec:\frrlxrf.exe184⤵
-
\??\c:\rrlfrlf.exec:\rrlfrlf.exe185⤵
-
\??\c:\nnnbtn.exec:\nnnbtn.exe186⤵
-
\??\c:\3btnbt.exec:\3btnbt.exe187⤵
-
\??\c:\jvvjj.exec:\jvvjj.exe188⤵
-
\??\c:\dvjvv.exec:\dvjvv.exe189⤵
-
\??\c:\9xxrrxl.exec:\9xxrrxl.exe190⤵
-
\??\c:\rffxlff.exec:\rffxlff.exe191⤵
-
\??\c:\3nhbnh.exec:\3nhbnh.exe192⤵
-
\??\c:\hbhhhn.exec:\hbhhhn.exe193⤵
-
\??\c:\thnbnt.exec:\thnbnt.exe194⤵
-
\??\c:\vvppj.exec:\vvppj.exe195⤵
-
\??\c:\jpvvp.exec:\jpvvp.exe196⤵
-
\??\c:\9rrlffx.exec:\9rrlffx.exe197⤵
-
\??\c:\lfrrlll.exec:\lfrrlll.exe198⤵
-
\??\c:\tnnhhb.exec:\tnnhhb.exe199⤵
-
\??\c:\3hhhbh.exec:\3hhhbh.exe200⤵
-
\??\c:\btbbbb.exec:\btbbbb.exe201⤵
-
\??\c:\5jdvp.exec:\5jdvp.exe202⤵
-
\??\c:\5vpvj.exec:\5vpvj.exe203⤵
-
\??\c:\xlrlfff.exec:\xlrlfff.exe204⤵
-
\??\c:\rllllff.exec:\rllllff.exe205⤵
-
\??\c:\frfxffl.exec:\frfxffl.exe206⤵
-
\??\c:\1hnhnn.exec:\1hnhnn.exe207⤵
-
\??\c:\bhbbtt.exec:\bhbbtt.exe208⤵
-
\??\c:\pdjdp.exec:\pdjdp.exe209⤵
-
\??\c:\pddvv.exec:\pddvv.exe210⤵
-
\??\c:\rrxlxxr.exec:\rrxlxxr.exe211⤵
-
\??\c:\9frrllf.exec:\9frrllf.exe212⤵
-
\??\c:\nnbbbt.exec:\nnbbbt.exe213⤵
-
\??\c:\ttbnbb.exec:\ttbnbb.exe214⤵
-
\??\c:\djppv.exec:\djppv.exe215⤵
-
\??\c:\7vpjp.exec:\7vpjp.exe216⤵
-
\??\c:\frfxfxr.exec:\frfxfxr.exe217⤵
-
\??\c:\flxlfxl.exec:\flxlfxl.exe218⤵
-
\??\c:\ntttnb.exec:\ntttnb.exe219⤵
-
\??\c:\nnthtn.exec:\nnthtn.exe220⤵
-
\??\c:\ppvvv.exec:\ppvvv.exe221⤵
-
\??\c:\5vvjv.exec:\5vvjv.exe222⤵
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe223⤵
-
\??\c:\1nnbtt.exec:\1nnbtt.exe224⤵
-
\??\c:\hnthtt.exec:\hnthtt.exe225⤵
-
\??\c:\vpdvp.exec:\vpdvp.exe226⤵
-
\??\c:\3rrfrll.exec:\3rrfrll.exe227⤵
-
\??\c:\rlflfll.exec:\rlflfll.exe228⤵
-
\??\c:\bnhbtt.exec:\bnhbtt.exe229⤵
-
\??\c:\hhhbtn.exec:\hhhbtn.exe230⤵
-
\??\c:\9tthbt.exec:\9tthbt.exe231⤵
-
\??\c:\3dvpd.exec:\3dvpd.exe232⤵
-
\??\c:\vjdvj.exec:\vjdvj.exe233⤵
-
\??\c:\rllrxlr.exec:\rllrxlr.exe234⤵
-
\??\c:\rllfxrl.exec:\rllfxrl.exe235⤵
-
\??\c:\bhnhbb.exec:\bhnhbb.exe236⤵
-
\??\c:\hbthtt.exec:\hbthtt.exe237⤵
-
\??\c:\dpjvj.exec:\dpjvj.exe238⤵
-
\??\c:\pjdvj.exec:\pjdvj.exe239⤵
-
\??\c:\dvpdv.exec:\dvpdv.exe240⤵
-
\??\c:\frfrlfx.exec:\frfrlfx.exe241⤵