Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 15:23
Behavioral task
behavioral1
Sample
55f3f1b7c2710e650627e100a28572c0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
55f3f1b7c2710e650627e100a28572c0_NeikiAnalytics.exe
-
Size
80KB
-
MD5
55f3f1b7c2710e650627e100a28572c0
-
SHA1
9b2db659a9ebd87d2f0021151fc32328e971ca0b
-
SHA256
bc38d2b192301f1fc183e11454f9ed7d751f37b5341ae69822452f82ae181eec
-
SHA512
9bc5930b5aff24d83cc1f8711b50cfef99eef47545a15e094eebe829ec38fdaf2695cfb3775b97a39ae3370a32ed53bad15d52fb9aa625451452f0385abd647e
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6TVqMJ89J:zhOmTsF93UYfwC6GIoutiTU2HVS6cMJw
Malware Config
Signatures
-
Detect Blackmoon payload 46 IoCs
Processes:
resource yara_rule behavioral1/memory/1656-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1444-12-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1444-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1368-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-80-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2568-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2308-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/372-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/372-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/888-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/624-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1372-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1484-491-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2460-502-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-751-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1544-766-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3008-775-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/348-967-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2052-9459-0x00000000771E0000-0x00000000772FF000-memory.dmp family_blackmoon behavioral1/memory/2052-10588-0x0000000077300000-0x00000000773FA000-memory.dmp family_blackmoon behavioral1/memory/2052-11915-0x0000000077300000-0x00000000773FA000-memory.dmp family_blackmoon behavioral1/memory/2052-13250-0x00000000771E0000-0x00000000772FF000-memory.dmp family_blackmoon behavioral1/memory/2052-13784-0x00000000771E0000-0x00000000772FF000-memory.dmp family_blackmoon behavioral1/memory/2052-32014-0x00000000771E0000-0x00000000772FF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rllxllr.exethntbh.exebnbbhb.exe3pvpv.exelxlrrrr.exebnbhtb.exebbhhhh.exejdppv.exelxflfll.exetnbntt.exethtbbt.exevpddp.exe1fflllr.exenbnbnn.exenhhhnh.exejdppv.exe7pddv.exe7lfrxxf.exetthbhb.exenbntnn.exevjvpp.exevjjpd.exe9rlrllr.exe1xfrrll.exe3thhnt.exe3tnbbh.exe5jvdv.exerfrxlrl.exe3nhntb.exehtnnnt.exepdpjp.exerrflrxx.exelxxrrrr.exe9nbhtb.exenbhhnn.exehtbnbb.exevjpjp.exe9pddd.exe3frrlfl.exelrxxxrx.exethbhtt.exebthhnn.exevdvpd.exedvdjj.exexrlrxfl.exexrxflxx.exetnbbbh.exe7tbtbb.exedvvvd.exedvppd.exe9fxfllr.exe3fxrrff.exehtbhnh.exebtbhth.exejvjvj.exejjvdd.exexlxflff.exe3rxffxf.exenbbnnt.exehthnnt.exevjpvd.exe1vpvd.exe5pdvv.exe3xrxllr.exepid process 1444 rllxllr.exe 1632 thntbh.exe 1368 bnbbhb.exe 2592 3pvpv.exe 2776 lxlrrrr.exe 2500 bnbhtb.exe 2736 bbhhhh.exe 2660 jdppv.exe 2396 lxflfll.exe 2568 tnbntt.exe 2308 thtbbt.exe 2560 vpddp.exe 2812 1fflllr.exe 2944 nbnbnn.exe 2948 nhhhnh.exe 372 jdppv.exe 1652 7pddv.exe 544 7lfrxxf.exe 888 tthbhb.exe 756 nbntnn.exe 2408 vjvpp.exe 624 vjjpd.exe 2432 9rlrllr.exe 3020 1xfrrll.exe 1920 3thhnt.exe 1100 3tnbbh.exe 3008 5jvdv.exe 876 rfrxlrl.exe 2108 3nhntb.exe 2440 htnnnt.exe 1960 pdpjp.exe 300 rrflrxx.exe 292 lxxrrrr.exe 744 9nbhtb.exe 2340 nbhhnn.exe 2904 htbnbb.exe 1980 vjpjp.exe 1956 9pddd.exe 2176 3frrlfl.exe 2028 lrxxxrx.exe 1984 thbhtt.exe 1220 bthhnn.exe 2260 vdvpd.exe 2032 dvdjj.exe 2632 xrlrxfl.exe 1368 xrxflxx.exe 2724 tnbbbh.exe 2884 7tbtbb.exe 2776 dvvvd.exe 2868 dvppd.exe 2248 9fxfllr.exe 2696 3fxrrff.exe 2548 htbhnh.exe 2536 btbhth.exe 2564 jvjvj.exe 2976 jjvdd.exe 2256 xlxflff.exe 2808 3rxffxf.exe 2848 nbbnnt.exe 1504 hthnnt.exe 760 vjpvd.exe 2948 1vpvd.exe 2380 5pdvv.exe 1820 3xrxllr.exe -
Processes:
resource yara_rule behavioral1/memory/1656-1-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rllxllr.exe upx behavioral1/memory/1444-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thntbh.exe upx behavioral1/memory/1444-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1632-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnbbhb.exe upx C:\3pvpv.exe upx behavioral1/memory/1368-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1632-24-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxlrrrr.exe upx behavioral1/memory/2592-40-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnbhtb.exe upx behavioral1/memory/2776-48-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbhhhh.exe upx behavioral1/memory/2500-56-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdppv.exe upx behavioral1/memory/2736-65-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxflfll.exe upx behavioral1/memory/2660-72-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tnbntt.exe upx behavioral1/memory/2396-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2396-80-0x00000000001B0000-0x00000000001D7000-memory.dmp upx C:\thtbbt.exe upx behavioral1/memory/2568-89-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpddp.exe upx behavioral1/memory/2308-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2560-100-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1fflllr.exe upx C:\nbnbnn.exe upx C:\nhhhnh.exe upx behavioral1/memory/2948-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2948-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/372-125-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7pddv.exe upx behavioral1/memory/372-131-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7lfrxxf.exe upx C:\tthbhb.exe upx behavioral1/memory/888-154-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbntnn.exe upx behavioral1/memory/756-155-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjvpp.exe upx C:\vjjpd.exe upx behavioral1/memory/624-172-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9rlrllr.exe upx C:\1xfrrll.exe upx behavioral1/memory/3020-186-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3thhnt.exe upx \??\c:\3tnbbh.exe upx C:\5jvdv.exe upx behavioral1/memory/1100-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3008-214-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfrxlrl.exe upx C:\3nhntb.exe upx C:\htnnnt.exe upx behavioral1/memory/2108-229-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdpjp.exe upx C:\rrflrxx.exe upx C:\lxxrrrr.exe upx behavioral1/memory/2904-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2028-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1984-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2260-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-316-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
55f3f1b7c2710e650627e100a28572c0_NeikiAnalytics.exerllxllr.exethntbh.exebnbbhb.exe3pvpv.exelxlrrrr.exebnbhtb.exebbhhhh.exejdppv.exelxflfll.exetnbntt.exethtbbt.exevpddp.exe1fflllr.exenbnbnn.exenhhhnh.exedescription pid process target process PID 1656 wrote to memory of 1444 1656 55f3f1b7c2710e650627e100a28572c0_NeikiAnalytics.exe rllxllr.exe PID 1656 wrote to memory of 1444 1656 55f3f1b7c2710e650627e100a28572c0_NeikiAnalytics.exe rllxllr.exe PID 1656 wrote to memory of 1444 1656 55f3f1b7c2710e650627e100a28572c0_NeikiAnalytics.exe rllxllr.exe PID 1656 wrote to memory of 1444 1656 55f3f1b7c2710e650627e100a28572c0_NeikiAnalytics.exe rllxllr.exe PID 1444 wrote to memory of 1632 1444 rllxllr.exe thntbh.exe PID 1444 wrote to memory of 1632 1444 rllxllr.exe thntbh.exe PID 1444 wrote to memory of 1632 1444 rllxllr.exe thntbh.exe PID 1444 wrote to memory of 1632 1444 rllxllr.exe thntbh.exe PID 1632 wrote to memory of 1368 1632 thntbh.exe bnbbhb.exe PID 1632 wrote to memory of 1368 1632 thntbh.exe bnbbhb.exe PID 1632 wrote to memory of 1368 1632 thntbh.exe bnbbhb.exe PID 1632 wrote to memory of 1368 1632 thntbh.exe bnbbhb.exe PID 1368 wrote to memory of 2592 1368 bnbbhb.exe 3pvpv.exe PID 1368 wrote to memory of 2592 1368 bnbbhb.exe 3pvpv.exe PID 1368 wrote to memory of 2592 1368 bnbbhb.exe 3pvpv.exe PID 1368 wrote to memory of 2592 1368 bnbbhb.exe 3pvpv.exe PID 2592 wrote to memory of 2776 2592 3pvpv.exe lxlrrrr.exe PID 2592 wrote to memory of 2776 2592 3pvpv.exe lxlrrrr.exe PID 2592 wrote to memory of 2776 2592 3pvpv.exe lxlrrrr.exe PID 2592 wrote to memory of 2776 2592 3pvpv.exe lxlrrrr.exe PID 2776 wrote to memory of 2500 2776 lxlrrrr.exe bnbhtb.exe PID 2776 wrote to memory of 2500 2776 lxlrrrr.exe bnbhtb.exe PID 2776 wrote to memory of 2500 2776 lxlrrrr.exe bnbhtb.exe PID 2776 wrote to memory of 2500 2776 lxlrrrr.exe bnbhtb.exe PID 2500 wrote to memory of 2736 2500 bnbhtb.exe bbhhhh.exe PID 2500 wrote to memory of 2736 2500 bnbhtb.exe bbhhhh.exe PID 2500 wrote to memory of 2736 2500 bnbhtb.exe bbhhhh.exe PID 2500 wrote to memory of 2736 2500 bnbhtb.exe bbhhhh.exe PID 2736 wrote to memory of 2660 2736 bbhhhh.exe jdppv.exe PID 2736 wrote to memory of 2660 2736 bbhhhh.exe jdppv.exe PID 2736 wrote to memory of 2660 2736 bbhhhh.exe jdppv.exe PID 2736 wrote to memory of 2660 2736 bbhhhh.exe jdppv.exe PID 2660 wrote to memory of 2396 2660 jdppv.exe lxflfll.exe PID 2660 wrote to memory of 2396 2660 jdppv.exe lxflfll.exe PID 2660 wrote to memory of 2396 2660 jdppv.exe lxflfll.exe PID 2660 wrote to memory of 2396 2660 jdppv.exe lxflfll.exe PID 2396 wrote to memory of 2568 2396 lxflfll.exe tnbntt.exe PID 2396 wrote to memory of 2568 2396 lxflfll.exe tnbntt.exe PID 2396 wrote to memory of 2568 2396 lxflfll.exe tnbntt.exe PID 2396 wrote to memory of 2568 2396 lxflfll.exe tnbntt.exe PID 2568 wrote to memory of 2308 2568 tnbntt.exe thtbbt.exe PID 2568 wrote to memory of 2308 2568 tnbntt.exe thtbbt.exe PID 2568 wrote to memory of 2308 2568 tnbntt.exe thtbbt.exe PID 2568 wrote to memory of 2308 2568 tnbntt.exe thtbbt.exe PID 2308 wrote to memory of 2560 2308 thtbbt.exe vpddp.exe PID 2308 wrote to memory of 2560 2308 thtbbt.exe vpddp.exe PID 2308 wrote to memory of 2560 2308 thtbbt.exe vpddp.exe PID 2308 wrote to memory of 2560 2308 thtbbt.exe vpddp.exe PID 2560 wrote to memory of 2812 2560 vpddp.exe 1fflllr.exe PID 2560 wrote to memory of 2812 2560 vpddp.exe 1fflllr.exe PID 2560 wrote to memory of 2812 2560 vpddp.exe 1fflllr.exe PID 2560 wrote to memory of 2812 2560 vpddp.exe 1fflllr.exe PID 2812 wrote to memory of 2944 2812 1fflllr.exe nbnbnn.exe PID 2812 wrote to memory of 2944 2812 1fflllr.exe nbnbnn.exe PID 2812 wrote to memory of 2944 2812 1fflllr.exe nbnbnn.exe PID 2812 wrote to memory of 2944 2812 1fflllr.exe nbnbnn.exe PID 2944 wrote to memory of 2948 2944 nbnbnn.exe nhhhnh.exe PID 2944 wrote to memory of 2948 2944 nbnbnn.exe nhhhnh.exe PID 2944 wrote to memory of 2948 2944 nbnbnn.exe nhhhnh.exe PID 2944 wrote to memory of 2948 2944 nbnbnn.exe nhhhnh.exe PID 2948 wrote to memory of 372 2948 nhhhnh.exe jdppv.exe PID 2948 wrote to memory of 372 2948 nhhhnh.exe jdppv.exe PID 2948 wrote to memory of 372 2948 nhhhnh.exe jdppv.exe PID 2948 wrote to memory of 372 2948 nhhhnh.exe jdppv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\55f3f1b7c2710e650627e100a28572c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\55f3f1b7c2710e650627e100a28572c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\rllxllr.exec:\rllxllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thntbh.exec:\thntbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnbbhb.exec:\bnbbhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3pvpv.exec:\3pvpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxlrrrr.exec:\lxlrrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnbhtb.exec:\bnbhtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbhhhh.exec:\bbhhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdppv.exec:\jdppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxflfll.exec:\lxflfll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbntt.exec:\tnbntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thtbbt.exec:\thtbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpddp.exec:\vpddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1fflllr.exec:\1fflllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbnbnn.exec:\nbnbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhhnh.exec:\nhhhnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdppv.exec:\jdppv.exe17⤵
- Executes dropped EXE
-
\??\c:\7pddv.exec:\7pddv.exe18⤵
- Executes dropped EXE
-
\??\c:\7lfrxxf.exec:\7lfrxxf.exe19⤵
- Executes dropped EXE
-
\??\c:\tthbhb.exec:\tthbhb.exe20⤵
- Executes dropped EXE
-
\??\c:\nbntnn.exec:\nbntnn.exe21⤵
- Executes dropped EXE
-
\??\c:\vjvpp.exec:\vjvpp.exe22⤵
- Executes dropped EXE
-
\??\c:\vjjpd.exec:\vjjpd.exe23⤵
- Executes dropped EXE
-
\??\c:\9rlrllr.exec:\9rlrllr.exe24⤵
- Executes dropped EXE
-
\??\c:\1xfrrll.exec:\1xfrrll.exe25⤵
- Executes dropped EXE
-
\??\c:\3thhnt.exec:\3thhnt.exe26⤵
- Executes dropped EXE
-
\??\c:\3tnbbh.exec:\3tnbbh.exe27⤵
- Executes dropped EXE
-
\??\c:\5jvdv.exec:\5jvdv.exe28⤵
- Executes dropped EXE
-
\??\c:\rfrxlrl.exec:\rfrxlrl.exe29⤵
- Executes dropped EXE
-
\??\c:\3nhntb.exec:\3nhntb.exe30⤵
- Executes dropped EXE
-
\??\c:\htnnnt.exec:\htnnnt.exe31⤵
- Executes dropped EXE
-
\??\c:\pdpjp.exec:\pdpjp.exe32⤵
- Executes dropped EXE
-
\??\c:\rrflrxx.exec:\rrflrxx.exe33⤵
- Executes dropped EXE
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe34⤵
- Executes dropped EXE
-
\??\c:\9nbhtb.exec:\9nbhtb.exe35⤵
- Executes dropped EXE
-
\??\c:\nbhhnn.exec:\nbhhnn.exe36⤵
- Executes dropped EXE
-
\??\c:\htbnbb.exec:\htbnbb.exe37⤵
- Executes dropped EXE
-
\??\c:\vjpjp.exec:\vjpjp.exe38⤵
- Executes dropped EXE
-
\??\c:\9pddd.exec:\9pddd.exe39⤵
- Executes dropped EXE
-
\??\c:\3frrlfl.exec:\3frrlfl.exe40⤵
- Executes dropped EXE
-
\??\c:\lrxxxrx.exec:\lrxxxrx.exe41⤵
- Executes dropped EXE
-
\??\c:\thbhtt.exec:\thbhtt.exe42⤵
- Executes dropped EXE
-
\??\c:\bthhnn.exec:\bthhnn.exe43⤵
- Executes dropped EXE
-
\??\c:\vdvpd.exec:\vdvpd.exe44⤵
- Executes dropped EXE
-
\??\c:\dvdjj.exec:\dvdjj.exe45⤵
- Executes dropped EXE
-
\??\c:\xrlrxfl.exec:\xrlrxfl.exe46⤵
- Executes dropped EXE
-
\??\c:\xrxflxx.exec:\xrxflxx.exe47⤵
- Executes dropped EXE
-
\??\c:\tnbbbh.exec:\tnbbbh.exe48⤵
- Executes dropped EXE
-
\??\c:\7tbtbb.exec:\7tbtbb.exe49⤵
- Executes dropped EXE
-
\??\c:\dvvvd.exec:\dvvvd.exe50⤵
- Executes dropped EXE
-
\??\c:\dvppd.exec:\dvppd.exe51⤵
- Executes dropped EXE
-
\??\c:\9fxfllr.exec:\9fxfllr.exe52⤵
- Executes dropped EXE
-
\??\c:\3fxrrff.exec:\3fxrrff.exe53⤵
- Executes dropped EXE
-
\??\c:\htbhnh.exec:\htbhnh.exe54⤵
- Executes dropped EXE
-
\??\c:\btbhth.exec:\btbhth.exe55⤵
- Executes dropped EXE
-
\??\c:\jvjvj.exec:\jvjvj.exe56⤵
- Executes dropped EXE
-
\??\c:\jjvdd.exec:\jjvdd.exe57⤵
- Executes dropped EXE
-
\??\c:\xlxflff.exec:\xlxflff.exe58⤵
- Executes dropped EXE
-
\??\c:\3rxffxf.exec:\3rxffxf.exe59⤵
- Executes dropped EXE
-
\??\c:\nbbnnt.exec:\nbbnnt.exe60⤵
- Executes dropped EXE
-
\??\c:\hthnnt.exec:\hthnnt.exe61⤵
- Executes dropped EXE
-
\??\c:\vjpvd.exec:\vjpvd.exe62⤵
- Executes dropped EXE
-
\??\c:\1vpvd.exec:\1vpvd.exe63⤵
- Executes dropped EXE
-
\??\c:\5pdvv.exec:\5pdvv.exe64⤵
- Executes dropped EXE
-
\??\c:\3xrxllr.exec:\3xrxllr.exe65⤵
- Executes dropped EXE
-
\??\c:\lrflllr.exec:\lrflllr.exe66⤵
-
\??\c:\tnbttt.exec:\tnbttt.exe67⤵
-
\??\c:\7pjdd.exec:\7pjdd.exe68⤵
-
\??\c:\ppjdp.exec:\ppjdp.exe69⤵
-
\??\c:\rlfxlxr.exec:\rlfxlxr.exe70⤵
-
\??\c:\nbhnnh.exec:\nbhnnh.exe71⤵
-
\??\c:\bnnntt.exec:\bnnntt.exe72⤵
-
\??\c:\1dpvv.exec:\1dpvv.exe73⤵
-
\??\c:\1jvpv.exec:\1jvpv.exe74⤵
-
\??\c:\llfrxlx.exec:\llfrxlx.exe75⤵
-
\??\c:\rllrrxf.exec:\rllrrxf.exe76⤵
-
\??\c:\9btnnn.exec:\9btnnn.exe77⤵
-
\??\c:\nbhtnt.exec:\nbhtnt.exe78⤵
-
\??\c:\dvdpv.exec:\dvdpv.exe79⤵
-
\??\c:\1dvvd.exec:\1dvvd.exe80⤵
-
\??\c:\rfrrrxl.exec:\rfrrrxl.exe81⤵
-
\??\c:\lrrfxll.exec:\lrrfxll.exe82⤵
-
\??\c:\5bntbt.exec:\5bntbt.exe83⤵
-
\??\c:\bbnttn.exec:\bbnttn.exe84⤵
-
\??\c:\hbhntt.exec:\hbhntt.exe85⤵
-
\??\c:\1dvvv.exec:\1dvvv.exe86⤵
-
\??\c:\3dpdp.exec:\3dpdp.exe87⤵
-
\??\c:\1rlrrxx.exec:\1rlrrxx.exe88⤵
-
\??\c:\frrrrlr.exec:\frrrrlr.exe89⤵
-
\??\c:\bhtbhb.exec:\bhtbhb.exe90⤵
-
\??\c:\tnbttt.exec:\tnbttt.exe91⤵
-
\??\c:\5jjpv.exec:\5jjpv.exe92⤵
-
\??\c:\dpvdj.exec:\dpvdj.exe93⤵
-
\??\c:\1flrrrx.exec:\1flrrrx.exe94⤵
-
\??\c:\frrrxrr.exec:\frrrxrr.exe95⤵
-
\??\c:\3nhnbt.exec:\3nhnbt.exe96⤵
-
\??\c:\nhhbbb.exec:\nhhbbb.exe97⤵
-
\??\c:\hbnhhn.exec:\hbnhhn.exe98⤵
-
\??\c:\djvdd.exec:\djvdd.exe99⤵
-
\??\c:\pjjjp.exec:\pjjjp.exe100⤵
-
\??\c:\xlrlffl.exec:\xlrlffl.exe101⤵
-
\??\c:\rfrllll.exec:\rfrllll.exe102⤵
-
\??\c:\1thhhh.exec:\1thhhh.exe103⤵
-
\??\c:\nbnhhh.exec:\nbnhhh.exe104⤵
-
\??\c:\jpppv.exec:\jpppv.exe105⤵
-
\??\c:\jvpjp.exec:\jvpjp.exe106⤵
-
\??\c:\pdjjd.exec:\pdjjd.exe107⤵
-
\??\c:\rfffxfr.exec:\rfffxfr.exe108⤵
-
\??\c:\rrlxlrx.exec:\rrlxlrx.exe109⤵
-
\??\c:\nhtbtb.exec:\nhtbtb.exe110⤵
-
\??\c:\7hbhhb.exec:\7hbhhb.exe111⤵
-
\??\c:\1jddj.exec:\1jddj.exe112⤵
-
\??\c:\7ppvv.exec:\7ppvv.exe113⤵
-
\??\c:\vjpjj.exec:\vjpjj.exe114⤵
-
\??\c:\lfflxfl.exec:\lfflxfl.exe115⤵
-
\??\c:\lfrrffl.exec:\lfrrffl.exe116⤵
-
\??\c:\htttbb.exec:\htttbb.exe117⤵
-
\??\c:\bthtbb.exec:\bthtbb.exe118⤵
-
\??\c:\jvddd.exec:\jvddd.exe119⤵
-
\??\c:\jdpvd.exec:\jdpvd.exe120⤵
-
\??\c:\xrflfrf.exec:\xrflfrf.exe121⤵
-
\??\c:\lfllrrf.exec:\lfllrrf.exe122⤵
-
\??\c:\ttbhht.exec:\ttbhht.exe123⤵
-
\??\c:\bthnhh.exec:\bthnhh.exe124⤵
-
\??\c:\vpddd.exec:\vpddd.exe125⤵
-
\??\c:\dvddj.exec:\dvddj.exe126⤵
-
\??\c:\9frffll.exec:\9frffll.exe127⤵
-
\??\c:\3frrffl.exec:\3frrffl.exe128⤵
-
\??\c:\hbnnbh.exec:\hbnnbh.exe129⤵
-
\??\c:\hbbhhh.exec:\hbbhhh.exe130⤵
-
\??\c:\vpvdj.exec:\vpvdj.exe131⤵
-
\??\c:\5jjjp.exec:\5jjjp.exe132⤵
-
\??\c:\5xffxrf.exec:\5xffxrf.exe133⤵
-
\??\c:\lfxfllr.exec:\lfxfllr.exe134⤵
-
\??\c:\nhhtbh.exec:\nhhtbh.exe135⤵
-
\??\c:\tnhntt.exec:\tnhntt.exe136⤵
-
\??\c:\1ddvp.exec:\1ddvp.exe137⤵
-
\??\c:\dpvjj.exec:\dpvjj.exe138⤵
-
\??\c:\vvpvj.exec:\vvpvj.exe139⤵
-
\??\c:\lffxllx.exec:\lffxllx.exe140⤵
-
\??\c:\rrfrffx.exec:\rrfrffx.exe141⤵
-
\??\c:\tnbhnn.exec:\tnbhnn.exe142⤵
-
\??\c:\7nbnnb.exec:\7nbnnb.exe143⤵
-
\??\c:\jdpvj.exec:\jdpvj.exe144⤵
-
\??\c:\vpdjj.exec:\vpdjj.exe145⤵
-
\??\c:\5djdd.exec:\5djdd.exe146⤵
-
\??\c:\xlrxlll.exec:\xlrxlll.exe147⤵
-
\??\c:\lxrxfxx.exec:\lxrxfxx.exe148⤵
-
\??\c:\tntbtt.exec:\tntbtt.exe149⤵
-
\??\c:\bhntnt.exec:\bhntnt.exe150⤵
-
\??\c:\jdjpj.exec:\jdjpj.exe151⤵
-
\??\c:\vpdjj.exec:\vpdjj.exe152⤵
-
\??\c:\pdjjd.exec:\pdjjd.exe153⤵
-
\??\c:\xlrrxxf.exec:\xlrrxxf.exe154⤵
-
\??\c:\rfxxffr.exec:\rfxxffr.exe155⤵
-
\??\c:\3btttn.exec:\3btttn.exe156⤵
-
\??\c:\nhbbbt.exec:\nhbbbt.exe157⤵
-
\??\c:\9jppv.exec:\9jppv.exe158⤵
-
\??\c:\vpjpv.exec:\vpjpv.exe159⤵
-
\??\c:\7jvjd.exec:\7jvjd.exe160⤵
-
\??\c:\1xrxfxx.exec:\1xrxfxx.exe161⤵
-
\??\c:\xlrlfxf.exec:\xlrlfxf.exe162⤵
-
\??\c:\httbbb.exec:\httbbb.exe163⤵
-
\??\c:\htnhnh.exec:\htnhnh.exe164⤵
-
\??\c:\jdpdd.exec:\jdpdd.exe165⤵
-
\??\c:\rlxlllr.exec:\rlxlllr.exe166⤵
-
\??\c:\lxffxrx.exec:\lxffxrx.exe167⤵
-
\??\c:\lxxxxxf.exec:\lxxxxxf.exe168⤵
-
\??\c:\hbtntt.exec:\hbtntt.exe169⤵
-
\??\c:\3pjdv.exec:\3pjdv.exe170⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe171⤵
-
\??\c:\jvddd.exec:\jvddd.exe172⤵
-
\??\c:\lxfflrr.exec:\lxfflrr.exe173⤵
-
\??\c:\rlxfxxx.exec:\rlxfxxx.exe174⤵
-
\??\c:\btnntt.exec:\btnntt.exe175⤵
-
\??\c:\7hnnnn.exec:\7hnnnn.exe176⤵
-
\??\c:\dvddv.exec:\dvddv.exe177⤵
-
\??\c:\vjppp.exec:\vjppp.exe178⤵
-
\??\c:\xrxfflx.exec:\xrxfflx.exe179⤵
-
\??\c:\fxlrrxx.exec:\fxlrrxx.exe180⤵
-
\??\c:\tnhbtt.exec:\tnhbtt.exe181⤵
-
\??\c:\bntbnn.exec:\bntbnn.exe182⤵
-
\??\c:\jdpvd.exec:\jdpvd.exe183⤵
-
\??\c:\jddjd.exec:\jddjd.exe184⤵
-
\??\c:\fxrxxxf.exec:\fxrxxxf.exe185⤵
-
\??\c:\rfxfxlr.exec:\rfxfxlr.exe186⤵
-
\??\c:\5bbntb.exec:\5bbntb.exe187⤵
-
\??\c:\nbbhbb.exec:\nbbhbb.exe188⤵
-
\??\c:\jdvpj.exec:\jdvpj.exe189⤵
-
\??\c:\5pjvv.exec:\5pjvv.exe190⤵
-
\??\c:\rfxrllr.exec:\rfxrllr.exe191⤵
-
\??\c:\lxxxxfx.exec:\lxxxxfx.exe192⤵
-
\??\c:\3btnth.exec:\3btnth.exe193⤵
-
\??\c:\5thbtb.exec:\5thbtb.exe194⤵
-
\??\c:\nhbhtb.exec:\nhbhtb.exe195⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe196⤵
-
\??\c:\jddjd.exec:\jddjd.exe197⤵
-
\??\c:\xlrrxxx.exec:\xlrrxxx.exe198⤵
-
\??\c:\7frrxlx.exec:\7frrxlx.exe199⤵
-
\??\c:\1nhtbh.exec:\1nhtbh.exe200⤵
-
\??\c:\nhhnnt.exec:\nhhnnt.exe201⤵
-
\??\c:\ddjvv.exec:\ddjvv.exe202⤵
-
\??\c:\5dpvd.exec:\5dpvd.exe203⤵
-
\??\c:\lxflrxx.exec:\lxflrxx.exe204⤵
-
\??\c:\fxlrfff.exec:\fxlrfff.exe205⤵
-
\??\c:\nhthtt.exec:\nhthtt.exe206⤵
-
\??\c:\5htbhn.exec:\5htbhn.exe207⤵
-
\??\c:\ddvdd.exec:\ddvdd.exe208⤵
-
\??\c:\7jppj.exec:\7jppj.exe209⤵
-
\??\c:\lfffxfl.exec:\lfffxfl.exe210⤵
-
\??\c:\rlrrxfl.exec:\rlrrxfl.exe211⤵
-
\??\c:\xrfflxx.exec:\xrfflxx.exe212⤵
-
\??\c:\hhbhtb.exec:\hhbhtb.exe213⤵
-
\??\c:\7ppjd.exec:\7ppjd.exe214⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe215⤵
-
\??\c:\pvddj.exec:\pvddj.exe216⤵
-
\??\c:\lxlfxrf.exec:\lxlfxrf.exe217⤵
-
\??\c:\htbtbt.exec:\htbtbt.exe218⤵
-
\??\c:\1jjpp.exec:\1jjpp.exe219⤵
-
\??\c:\vjppj.exec:\vjppj.exe220⤵
-
\??\c:\5rlrrrr.exec:\5rlrrrr.exe221⤵
-
\??\c:\nbhnhb.exec:\nbhnhb.exe222⤵
-
\??\c:\1thbbt.exec:\1thbbt.exe223⤵
-
\??\c:\3djjp.exec:\3djjp.exe224⤵
-
\??\c:\rrflrrf.exec:\rrflrrf.exe225⤵
-
\??\c:\frxffrf.exec:\frxffrf.exe226⤵
-
\??\c:\thtnnn.exec:\thtnnn.exe227⤵
-
\??\c:\3tnnnn.exec:\3tnnnn.exe228⤵
-
\??\c:\vpdpp.exec:\vpdpp.exe229⤵
-
\??\c:\dvjpv.exec:\dvjpv.exe230⤵
-
\??\c:\frfllrf.exec:\frfllrf.exe231⤵
-
\??\c:\lflrrrr.exec:\lflrrrr.exe232⤵
-
\??\c:\rlflxrr.exec:\rlflxrr.exe233⤵
-
\??\c:\1bthnt.exec:\1bthnt.exe234⤵
-
\??\c:\nnbhnn.exec:\nnbhnn.exe235⤵
-
\??\c:\pjdvd.exec:\pjdvd.exe236⤵
-
\??\c:\djvpd.exec:\djvpd.exe237⤵
-
\??\c:\lfllrlf.exec:\lfllrlf.exe238⤵
-
\??\c:\xlrxxff.exec:\xlrxxff.exe239⤵
-
\??\c:\nhtbhh.exec:\nhtbhh.exe240⤵
-
\??\c:\nhtbhh.exec:\nhtbhh.exe241⤵