Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 22:41
Behavioral task
behavioral1
Sample
1fc39e4152dcca498d553770e4d1bf98f9fdd7fab29be464a76287517c55dc71_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
1fc39e4152dcca498d553770e4d1bf98f9fdd7fab29be464a76287517c55dc71_NeikiAnalytics.exe
-
Size
68KB
-
MD5
509330c2a8244a3f2abb2ee081766480
-
SHA1
4733ff946056622cb26f74e0b4d1612f482bbe88
-
SHA256
1fc39e4152dcca498d553770e4d1bf98f9fdd7fab29be464a76287517c55dc71
-
SHA512
401abfcda4c56288de8a85286ba783bab780e43b81f48c201307eface09da9411e0bb8b0001c7bc8710693089e27d938e7ab2085a4c2666217c1e919e9ec2afa
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNYLIALUmYgDt:khOmTsF93UYfwC6GIoutpY4ALUmj
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
Processes:
resource yara_rule behavioral1/memory/1964-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1192-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/792-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1552-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1012-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1848-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1436-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1436-187-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/828-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2280-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1208-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1208-241-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1208-240-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1284-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/300-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/884-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1528-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1388-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-520-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2916-547-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1948-554-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-609-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-800-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1296-1047-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2184-1054-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-1061-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1564-1348-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2804-1394-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1720-1453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rllxflr.exebthhtn.exe7pvjd.exefxfrlff.exebbtnhb.exeddvdp.exe5lrfxll.exe1nnbnn.exetnbbbb.exevvvvv.exeddpdp.exe3lxfllx.exexlfflfx.exenhhtnt.exehbntth.exevpjpp.exerfrxxfl.exetnhthh.exebththh.exepdpdj.exevpvjv.exenhhbnn.exe3btnhb.exe9ppvd.exe1fxrrrx.exe3lxfxrx.exe5hhntt.exeddddj.exejddjj.exellrfrff.exebthhnn.exetnnhtn.exe7dpdj.exepjpjj.exerxlrrlf.exexflfflf.exethbbbb.exetntbnt.exeddvpd.exevppvd.exerrrfrxl.exerrlxffx.exebbhbnn.exetttnht.exe9pjjp.exejdvvv.exelxflrrx.exexlxrxxr.exexrxxrrf.exe3nhhbt.exe5hhtbh.exehttbhb.exevjjvp.exedvjpd.exerfrrrxf.exe7xrffrl.exenhbnbn.exebthtbh.exe1nntbb.exe5vjjd.exe3pjvv.exevjpvd.exerrlrxfl.exexrrfrff.exepid process 2796 rllxflr.exe 2524 bthhtn.exe 2672 7pvjd.exe 1192 fxfrlff.exe 2808 bbtnhb.exe 2648 ddvdp.exe 2484 5lrfxll.exe 2472 1nnbnn.exe 2932 tnbbbb.exe 792 vvvvv.exe 1552 ddpdp.exe 2416 3lxfllx.exe 1848 xlfflfx.exe 1012 nhhtnt.exe 316 hbntth.exe 1700 vpjpp.exe 1928 rfrxxfl.exe 564 tnhthh.exe 2396 bththh.exe 1436 pdpdj.exe 2868 vpvjv.exe 2392 nhhbnn.exe 828 3btnhb.exe 2280 9ppvd.exe 2692 1fxrrrx.exe 1208 3lxfxrx.exe 1284 5hhntt.exe 300 ddddj.exe 2300 jddjj.exe 2864 llrfrff.exe 560 bthhnn.exe 884 tnnhtn.exe 1952 7dpdj.exe 1264 pjpjj.exe 3052 rxlrrlf.exe 2524 xflfflf.exe 1528 thbbbb.exe 2556 tntbnt.exe 2560 ddvpd.exe 2588 vppvd.exe 2640 rrrfrxl.exe 2596 rrlxffx.exe 2432 bbhbnn.exe 2484 tttnht.exe 2472 9pjjp.exe 348 jdvvv.exe 2328 lxflrrx.exe 1832 xlxrxxr.exe 1552 xrxxrrf.exe 1544 3nhhbt.exe 1504 5hhtbh.exe 2644 httbhb.exe 1592 vjjvp.exe 316 dvjpd.exe 1572 rfrrrxf.exe 264 7xrffrl.exe 1392 nhbnbn.exe 1196 bthtbh.exe 1852 1nntbb.exe 1068 5vjjd.exe 2792 3pjvv.exe 1564 vjpvd.exe 2760 rrlrxfl.exe 2392 xrrfrff.exe -
Processes:
resource yara_rule behavioral1/memory/1964-1-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rllxflr.exe upx behavioral1/memory/2796-8-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bthhtn.exe upx behavioral1/memory/2524-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2796-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2672-28-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7pvjd.exe upx C:\fxfrlff.exe upx C:\bbtnhb.exe upx behavioral1/memory/1192-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2808-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2672-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2808-55-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddvdp.exe upx behavioral1/memory/2648-63-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5lrfxll.exe upx C:\1nnbnn.exe upx behavioral1/memory/2484-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnbbbb.exe upx \??\c:\vvvvv.exe upx behavioral1/memory/792-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddpdp.exe upx C:\3lxfllx.exe upx behavioral1/memory/1552-107-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlfflfx.exe upx C:\nhhtnt.exe upx behavioral1/memory/1012-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1848-124-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbntth.exe upx \??\c:\vpjpp.exe upx behavioral1/memory/1700-143-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfrxxfl.exe upx C:\tnhthh.exe upx behavioral1/memory/564-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1928-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/564-164-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\bththh.exe upx \??\c:\pdpdj.exe upx behavioral1/memory/1436-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2396-178-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpvjv.exe upx behavioral1/memory/1436-189-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhhbnn.exe upx C:\3btnhb.exe upx C:\9ppvd.exe upx behavioral1/memory/828-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2280-223-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1fxrrrx.exe upx C:\3lxfxrx.exe upx C:\5hhntt.exe upx behavioral1/memory/1208-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1208-240-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\ddddj.exe upx behavioral1/memory/1284-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/300-260-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jddjj.exe upx behavioral1/memory/2300-262-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llrfrff.exe upx \??\c:\bthhnn.exe upx behavioral1/memory/560-280-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnhtn.exe upx behavioral1/memory/884-288-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/884-296-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1fc39e4152dcca498d553770e4d1bf98f9fdd7fab29be464a76287517c55dc71_NeikiAnalytics.exerllxflr.exebthhtn.exe7pvjd.exefxfrlff.exebbtnhb.exeddvdp.exe5lrfxll.exe1nnbnn.exetnbbbb.exevvvvv.exeddpdp.exe3lxfllx.exexlfflfx.exenhhtnt.exehbntth.exedescription pid process target process PID 1964 wrote to memory of 2796 1964 1fc39e4152dcca498d553770e4d1bf98f9fdd7fab29be464a76287517c55dc71_NeikiAnalytics.exe rllxflr.exe PID 1964 wrote to memory of 2796 1964 1fc39e4152dcca498d553770e4d1bf98f9fdd7fab29be464a76287517c55dc71_NeikiAnalytics.exe rllxflr.exe PID 1964 wrote to memory of 2796 1964 1fc39e4152dcca498d553770e4d1bf98f9fdd7fab29be464a76287517c55dc71_NeikiAnalytics.exe rllxflr.exe PID 1964 wrote to memory of 2796 1964 1fc39e4152dcca498d553770e4d1bf98f9fdd7fab29be464a76287517c55dc71_NeikiAnalytics.exe rllxflr.exe PID 2796 wrote to memory of 2524 2796 rllxflr.exe bthhtn.exe PID 2796 wrote to memory of 2524 2796 rllxflr.exe bthhtn.exe PID 2796 wrote to memory of 2524 2796 rllxflr.exe bthhtn.exe PID 2796 wrote to memory of 2524 2796 rllxflr.exe bthhtn.exe PID 2524 wrote to memory of 2672 2524 bthhtn.exe 7pvjd.exe PID 2524 wrote to memory of 2672 2524 bthhtn.exe 7pvjd.exe PID 2524 wrote to memory of 2672 2524 bthhtn.exe 7pvjd.exe PID 2524 wrote to memory of 2672 2524 bthhtn.exe 7pvjd.exe PID 2672 wrote to memory of 1192 2672 7pvjd.exe fxfrlff.exe PID 2672 wrote to memory of 1192 2672 7pvjd.exe fxfrlff.exe PID 2672 wrote to memory of 1192 2672 7pvjd.exe fxfrlff.exe PID 2672 wrote to memory of 1192 2672 7pvjd.exe fxfrlff.exe PID 1192 wrote to memory of 2808 1192 fxfrlff.exe bbtnhb.exe PID 1192 wrote to memory of 2808 1192 fxfrlff.exe bbtnhb.exe PID 1192 wrote to memory of 2808 1192 fxfrlff.exe bbtnhb.exe PID 1192 wrote to memory of 2808 1192 fxfrlff.exe bbtnhb.exe PID 2808 wrote to memory of 2648 2808 bbtnhb.exe ddvdp.exe PID 2808 wrote to memory of 2648 2808 bbtnhb.exe ddvdp.exe PID 2808 wrote to memory of 2648 2808 bbtnhb.exe ddvdp.exe PID 2808 wrote to memory of 2648 2808 bbtnhb.exe ddvdp.exe PID 2648 wrote to memory of 2484 2648 ddvdp.exe 5lrfxll.exe PID 2648 wrote to memory of 2484 2648 ddvdp.exe 5lrfxll.exe PID 2648 wrote to memory of 2484 2648 ddvdp.exe 5lrfxll.exe PID 2648 wrote to memory of 2484 2648 ddvdp.exe 5lrfxll.exe PID 2484 wrote to memory of 2472 2484 5lrfxll.exe 1nnbnn.exe PID 2484 wrote to memory of 2472 2484 5lrfxll.exe 1nnbnn.exe PID 2484 wrote to memory of 2472 2484 5lrfxll.exe 1nnbnn.exe PID 2484 wrote to memory of 2472 2484 5lrfxll.exe 1nnbnn.exe PID 2472 wrote to memory of 2932 2472 1nnbnn.exe tnbbbb.exe PID 2472 wrote to memory of 2932 2472 1nnbnn.exe tnbbbb.exe PID 2472 wrote to memory of 2932 2472 1nnbnn.exe tnbbbb.exe PID 2472 wrote to memory of 2932 2472 1nnbnn.exe tnbbbb.exe PID 2932 wrote to memory of 792 2932 tnbbbb.exe vvvvv.exe PID 2932 wrote to memory of 792 2932 tnbbbb.exe vvvvv.exe PID 2932 wrote to memory of 792 2932 tnbbbb.exe vvvvv.exe PID 2932 wrote to memory of 792 2932 tnbbbb.exe vvvvv.exe PID 792 wrote to memory of 1552 792 vvvvv.exe ddpdp.exe PID 792 wrote to memory of 1552 792 vvvvv.exe ddpdp.exe PID 792 wrote to memory of 1552 792 vvvvv.exe ddpdp.exe PID 792 wrote to memory of 1552 792 vvvvv.exe ddpdp.exe PID 1552 wrote to memory of 2416 1552 ddpdp.exe 3lxfllx.exe PID 1552 wrote to memory of 2416 1552 ddpdp.exe 3lxfllx.exe PID 1552 wrote to memory of 2416 1552 ddpdp.exe 3lxfllx.exe PID 1552 wrote to memory of 2416 1552 ddpdp.exe 3lxfllx.exe PID 2416 wrote to memory of 1848 2416 3lxfllx.exe xlfflfx.exe PID 2416 wrote to memory of 1848 2416 3lxfllx.exe xlfflfx.exe PID 2416 wrote to memory of 1848 2416 3lxfllx.exe xlfflfx.exe PID 2416 wrote to memory of 1848 2416 3lxfllx.exe xlfflfx.exe PID 1848 wrote to memory of 1012 1848 xlfflfx.exe nhhtnt.exe PID 1848 wrote to memory of 1012 1848 xlfflfx.exe nhhtnt.exe PID 1848 wrote to memory of 1012 1848 xlfflfx.exe nhhtnt.exe PID 1848 wrote to memory of 1012 1848 xlfflfx.exe nhhtnt.exe PID 1012 wrote to memory of 316 1012 nhhtnt.exe hbntth.exe PID 1012 wrote to memory of 316 1012 nhhtnt.exe hbntth.exe PID 1012 wrote to memory of 316 1012 nhhtnt.exe hbntth.exe PID 1012 wrote to memory of 316 1012 nhhtnt.exe hbntth.exe PID 316 wrote to memory of 1700 316 hbntth.exe vpjpp.exe PID 316 wrote to memory of 1700 316 hbntth.exe vpjpp.exe PID 316 wrote to memory of 1700 316 hbntth.exe vpjpp.exe PID 316 wrote to memory of 1700 316 hbntth.exe vpjpp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fc39e4152dcca498d553770e4d1bf98f9fdd7fab29be464a76287517c55dc71_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1fc39e4152dcca498d553770e4d1bf98f9fdd7fab29be464a76287517c55dc71_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\rllxflr.exec:\rllxflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bthhtn.exec:\bthhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7pvjd.exec:\7pvjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxfrlff.exec:\fxfrlff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbtnhb.exec:\bbtnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddvdp.exec:\ddvdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5lrfxll.exec:\5lrfxll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1nnbnn.exec:\1nnbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbbbb.exec:\tnbbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvvvv.exec:\vvvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddpdp.exec:\ddpdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3lxfllx.exec:\3lxfllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlfflfx.exec:\xlfflfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhtnt.exec:\nhhtnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbntth.exec:\hbntth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjpp.exec:\vpjpp.exe17⤵
- Executes dropped EXE
-
\??\c:\rfrxxfl.exec:\rfrxxfl.exe18⤵
- Executes dropped EXE
-
\??\c:\tnhthh.exec:\tnhthh.exe19⤵
- Executes dropped EXE
-
\??\c:\bththh.exec:\bththh.exe20⤵
- Executes dropped EXE
-
\??\c:\pdpdj.exec:\pdpdj.exe21⤵
- Executes dropped EXE
-
\??\c:\vpvjv.exec:\vpvjv.exe22⤵
- Executes dropped EXE
-
\??\c:\nhhbnn.exec:\nhhbnn.exe23⤵
- Executes dropped EXE
-
\??\c:\3btnhb.exec:\3btnhb.exe24⤵
- Executes dropped EXE
-
\??\c:\9ppvd.exec:\9ppvd.exe25⤵
- Executes dropped EXE
-
\??\c:\1fxrrrx.exec:\1fxrrrx.exe26⤵
- Executes dropped EXE
-
\??\c:\3lxfxrx.exec:\3lxfxrx.exe27⤵
- Executes dropped EXE
-
\??\c:\5hhntt.exec:\5hhntt.exe28⤵
- Executes dropped EXE
-
\??\c:\ddddj.exec:\ddddj.exe29⤵
- Executes dropped EXE
-
\??\c:\jddjj.exec:\jddjj.exe30⤵
- Executes dropped EXE
-
\??\c:\llrfrff.exec:\llrfrff.exe31⤵
- Executes dropped EXE
-
\??\c:\bthhnn.exec:\bthhnn.exe32⤵
- Executes dropped EXE
-
\??\c:\tnnhtn.exec:\tnnhtn.exe33⤵
- Executes dropped EXE
-
\??\c:\7dpdj.exec:\7dpdj.exe34⤵
- Executes dropped EXE
-
\??\c:\pjpjj.exec:\pjpjj.exe35⤵
- Executes dropped EXE
-
\??\c:\rxlrrlf.exec:\rxlrrlf.exe36⤵
- Executes dropped EXE
-
\??\c:\xflfflf.exec:\xflfflf.exe37⤵
- Executes dropped EXE
-
\??\c:\thbbbb.exec:\thbbbb.exe38⤵
- Executes dropped EXE
-
\??\c:\tntbnt.exec:\tntbnt.exe39⤵
- Executes dropped EXE
-
\??\c:\ddvpd.exec:\ddvpd.exe40⤵
- Executes dropped EXE
-
\??\c:\vppvd.exec:\vppvd.exe41⤵
- Executes dropped EXE
-
\??\c:\rrrfrxl.exec:\rrrfrxl.exe42⤵
- Executes dropped EXE
-
\??\c:\rrlxffx.exec:\rrlxffx.exe43⤵
- Executes dropped EXE
-
\??\c:\bbhbnn.exec:\bbhbnn.exe44⤵
- Executes dropped EXE
-
\??\c:\tttnht.exec:\tttnht.exe45⤵
- Executes dropped EXE
-
\??\c:\9pjjp.exec:\9pjjp.exe46⤵
- Executes dropped EXE
-
\??\c:\jdvvv.exec:\jdvvv.exe47⤵
- Executes dropped EXE
-
\??\c:\lxflrrx.exec:\lxflrrx.exe48⤵
- Executes dropped EXE
-
\??\c:\xlxrxxr.exec:\xlxrxxr.exe49⤵
- Executes dropped EXE
-
\??\c:\xrxxrrf.exec:\xrxxrrf.exe50⤵
- Executes dropped EXE
-
\??\c:\3nhhbt.exec:\3nhhbt.exe51⤵
- Executes dropped EXE
-
\??\c:\5hhtbh.exec:\5hhtbh.exe52⤵
- Executes dropped EXE
-
\??\c:\httbhb.exec:\httbhb.exe53⤵
- Executes dropped EXE
-
\??\c:\vjjvp.exec:\vjjvp.exe54⤵
- Executes dropped EXE
-
\??\c:\dvjpd.exec:\dvjpd.exe55⤵
- Executes dropped EXE
-
\??\c:\rfrrrxf.exec:\rfrrrxf.exe56⤵
- Executes dropped EXE
-
\??\c:\7xrffrl.exec:\7xrffrl.exe57⤵
- Executes dropped EXE
-
\??\c:\nhbnbn.exec:\nhbnbn.exe58⤵
- Executes dropped EXE
-
\??\c:\bthtbh.exec:\bthtbh.exe59⤵
- Executes dropped EXE
-
\??\c:\1nntbb.exec:\1nntbb.exe60⤵
- Executes dropped EXE
-
\??\c:\5vjjd.exec:\5vjjd.exe61⤵
- Executes dropped EXE
-
\??\c:\3pjvv.exec:\3pjvv.exe62⤵
- Executes dropped EXE
-
\??\c:\vjpvd.exec:\vjpvd.exe63⤵
- Executes dropped EXE
-
\??\c:\rrlrxfl.exec:\rrlrxfl.exe64⤵
- Executes dropped EXE
-
\??\c:\xrrfrff.exec:\xrrfrff.exe65⤵
- Executes dropped EXE
-
\??\c:\nhbhtb.exec:\nhbhtb.exe66⤵
-
\??\c:\3vjpd.exec:\3vjpd.exe67⤵
-
\??\c:\jdpjv.exec:\jdpjv.exe68⤵
-
\??\c:\7lfrxlf.exec:\7lfrxlf.exe69⤵
-
\??\c:\lllfflf.exec:\lllfflf.exe70⤵
-
\??\c:\9frfrlr.exec:\9frfrlr.exe71⤵
-
\??\c:\5tbnnb.exec:\5tbnnb.exe72⤵
-
\??\c:\nhbbnn.exec:\nhbbnn.exe73⤵
-
\??\c:\jjvjp.exec:\jjvjp.exe74⤵
-
\??\c:\vppjj.exec:\vppjj.exe75⤵
-
\??\c:\pjvpv.exec:\pjvpv.exe76⤵
-
\??\c:\rlxfxrf.exec:\rlxfxrf.exe77⤵
-
\??\c:\1frxxxx.exec:\1frxxxx.exe78⤵
-
\??\c:\9rxrrfl.exec:\9rxrrfl.exe79⤵
-
\??\c:\ttnbbn.exec:\ttnbbn.exe80⤵
-
\??\c:\tbbhht.exec:\tbbhht.exe81⤵
-
\??\c:\tnbttn.exec:\tnbttn.exe82⤵
-
\??\c:\pjjpj.exec:\pjjpj.exe83⤵
-
\??\c:\5dvdd.exec:\5dvdd.exe84⤵
-
\??\c:\rrxlxrr.exec:\rrxlxrr.exe85⤵
-
\??\c:\rxlxrfx.exec:\rxlxrfx.exe86⤵
-
\??\c:\rlllrrf.exec:\rlllrrf.exe87⤵
-
\??\c:\lllrflx.exec:\lllrflx.exe88⤵
-
\??\c:\tnthnb.exec:\tnthnb.exe89⤵
-
\??\c:\bhnbnn.exec:\bhnbnn.exe90⤵
-
\??\c:\dvjvv.exec:\dvjvv.exe91⤵
-
\??\c:\pdvvd.exec:\pdvvd.exe92⤵
-
\??\c:\5vpvp.exec:\5vpvp.exe93⤵
-
\??\c:\rxrxxll.exec:\rxrxxll.exe94⤵
-
\??\c:\xrlxfll.exec:\xrlxfll.exe95⤵
-
\??\c:\1xlxlrl.exec:\1xlxlrl.exe96⤵
-
\??\c:\btbnbb.exec:\btbnbb.exe97⤵
-
\??\c:\bnnhht.exec:\bnnhht.exe98⤵
-
\??\c:\1nbhnb.exec:\1nbhnb.exe99⤵
-
\??\c:\djvpj.exec:\djvpj.exe100⤵
-
\??\c:\dvjpj.exec:\dvjpj.exe101⤵
-
\??\c:\fxrxxrf.exec:\fxrxxrf.exe102⤵
-
\??\c:\7frflrx.exec:\7frflrx.exe103⤵
-
\??\c:\flrflxl.exec:\flrflxl.exe104⤵
-
\??\c:\tbbthn.exec:\tbbthn.exe105⤵
-
\??\c:\hbnnnt.exec:\hbnnnt.exe106⤵
-
\??\c:\nbnnbb.exec:\nbnnbb.exe107⤵
-
\??\c:\pppvd.exec:\pppvd.exe108⤵
-
\??\c:\pdvjj.exec:\pdvjj.exe109⤵
-
\??\c:\vvdjj.exec:\vvdjj.exe110⤵
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe111⤵
-
\??\c:\llxxlrx.exec:\llxxlrx.exe112⤵
-
\??\c:\lfrxfll.exec:\lfrxfll.exe113⤵
-
\??\c:\htbbhh.exec:\htbbhh.exe114⤵
-
\??\c:\9ttnnt.exec:\9ttnnt.exe115⤵
-
\??\c:\hbhhnt.exec:\hbhhnt.exe116⤵
-
\??\c:\jvpjj.exec:\jvpjj.exe117⤵
-
\??\c:\vvjjv.exec:\vvjjv.exe118⤵
-
\??\c:\vpdjd.exec:\vpdjd.exe119⤵
-
\??\c:\7xfffff.exec:\7xfffff.exe120⤵
-
\??\c:\fxflrrf.exec:\fxflrrf.exe121⤵
-
\??\c:\9lflxxl.exec:\9lflxxl.exe122⤵
-
\??\c:\htntbb.exec:\htntbb.exe123⤵
-
\??\c:\btbnnt.exec:\btbnnt.exe124⤵
-
\??\c:\dvppp.exec:\dvppp.exe125⤵
-
\??\c:\jvjvv.exec:\jvjvv.exe126⤵
-
\??\c:\pjddv.exec:\pjddv.exe127⤵
-
\??\c:\xrrrffl.exec:\xrrrffl.exe128⤵
-
\??\c:\frfxflr.exec:\frfxflr.exe129⤵
-
\??\c:\fxrxllx.exec:\fxrxllx.exe130⤵
-
\??\c:\hthtbn.exec:\hthtbn.exe131⤵
-
\??\c:\hhbhbt.exec:\hhbhbt.exe132⤵
-
\??\c:\bthhtt.exec:\bthhtt.exe133⤵
-
\??\c:\7vvvj.exec:\7vvvj.exe134⤵
-
\??\c:\dvppd.exec:\dvppd.exe135⤵
-
\??\c:\rllxffx.exec:\rllxffx.exe136⤵
-
\??\c:\5rfrrrx.exec:\5rfrrrx.exe137⤵
-
\??\c:\xrflllx.exec:\xrflllx.exe138⤵
-
\??\c:\9nbttb.exec:\9nbttb.exe139⤵
-
\??\c:\tbbtbt.exec:\tbbtbt.exe140⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe141⤵
-
\??\c:\jjjvv.exec:\jjjvv.exe142⤵
-
\??\c:\frlxlrf.exec:\frlxlrf.exe143⤵
-
\??\c:\ffflfxl.exec:\ffflfxl.exe144⤵
-
\??\c:\fxxxflf.exec:\fxxxflf.exe145⤵
-
\??\c:\9nhntb.exec:\9nhntb.exe146⤵
-
\??\c:\hbbhbh.exec:\hbbhbh.exe147⤵
-
\??\c:\djjdd.exec:\djjdd.exe148⤵
-
\??\c:\jjdjd.exec:\jjdjd.exe149⤵
-
\??\c:\fflfxrr.exec:\fflfxrr.exe150⤵
-
\??\c:\5fxxllx.exec:\5fxxllx.exe151⤵
-
\??\c:\1lxxfrl.exec:\1lxxfrl.exe152⤵
-
\??\c:\bbnbhh.exec:\bbnbhh.exe153⤵
-
\??\c:\pvvjj.exec:\pvvjj.exe154⤵
-
\??\c:\7xlrrrf.exec:\7xlrrrf.exe155⤵
-
\??\c:\bnntnh.exec:\bnntnh.exe156⤵
-
\??\c:\ddjpj.exec:\ddjpj.exe157⤵
-
\??\c:\3vvjj.exec:\3vvjj.exe158⤵
-
\??\c:\xrfrxxx.exec:\xrfrxxx.exe159⤵
-
\??\c:\3tnhhh.exec:\3tnhhh.exe160⤵
-
\??\c:\5btbhn.exec:\5btbhn.exe161⤵
-
\??\c:\xflffff.exec:\xflffff.exe162⤵
-
\??\c:\ntbttt.exec:\ntbttt.exe163⤵
-
\??\c:\jpdjj.exec:\jpdjj.exe164⤵
-
\??\c:\jpvvv.exec:\jpvvv.exe165⤵
-
\??\c:\rlllxrx.exec:\rlllxrx.exe166⤵
-
\??\c:\bhnhbt.exec:\bhnhbt.exe167⤵
-
\??\c:\thttnh.exec:\thttnh.exe168⤵
-
\??\c:\jjjpd.exec:\jjjpd.exe169⤵
-
\??\c:\llxlrxx.exec:\llxlrxx.exe170⤵
-
\??\c:\xxffrfx.exec:\xxffrfx.exe171⤵
-
\??\c:\nnhhnb.exec:\nnhhnb.exe172⤵
-
\??\c:\pdvdp.exec:\pdvdp.exe173⤵
-
\??\c:\xrflxfl.exec:\xrflxfl.exe174⤵
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe175⤵
-
\??\c:\nbnttn.exec:\nbnttn.exe176⤵
-
\??\c:\hbnhhb.exec:\hbnhhb.exe177⤵
-
\??\c:\ppdjv.exec:\ppdjv.exe178⤵
-
\??\c:\frflxxf.exec:\frflxxf.exe179⤵
-
\??\c:\bttnnb.exec:\bttnnb.exe180⤵
-
\??\c:\bbnbth.exec:\bbnbth.exe181⤵
-
\??\c:\7pvvj.exec:\7pvvj.exe182⤵
-
\??\c:\1lffflr.exec:\1lffflr.exe183⤵
-
\??\c:\lfffrxr.exec:\lfffrxr.exe184⤵
-
\??\c:\7hhbhh.exec:\7hhbhh.exe185⤵
-
\??\c:\1pdjj.exec:\1pdjj.exe186⤵
-
\??\c:\ffxlfrf.exec:\ffxlfrf.exe187⤵
-
\??\c:\7flxllr.exec:\7flxllr.exe188⤵
-
\??\c:\frffllr.exec:\frffllr.exe189⤵
-
\??\c:\tbbnhb.exec:\tbbnhb.exe190⤵
-
\??\c:\3djvd.exec:\3djvd.exe191⤵
-
\??\c:\lfrrffx.exec:\lfrrffx.exe192⤵
-
\??\c:\rrlxlrx.exec:\rrlxlrx.exe193⤵
-
\??\c:\ntbnbn.exec:\ntbnbn.exe194⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe195⤵
-
\??\c:\xrllrrl.exec:\xrllrrl.exe196⤵
-
\??\c:\1lflllx.exec:\1lflllx.exe197⤵
-
\??\c:\htttnt.exec:\htttnt.exe198⤵
-
\??\c:\ppvjv.exec:\ppvjv.exe199⤵
-
\??\c:\3lfrlrx.exec:\3lfrlrx.exe200⤵
-
\??\c:\tnttth.exec:\tnttth.exe201⤵
-
\??\c:\jvdpj.exec:\jvdpj.exe202⤵
-
\??\c:\lfrffll.exec:\lfrffll.exe203⤵
-
\??\c:\ffxlrxr.exec:\ffxlrxr.exe204⤵
-
\??\c:\tttnth.exec:\tttnth.exe205⤵
-
\??\c:\vpjdj.exec:\vpjdj.exe206⤵
-
\??\c:\llrlxll.exec:\llrlxll.exe207⤵
-
\??\c:\ntbbbn.exec:\ntbbbn.exe208⤵
-
\??\c:\nhttbb.exec:\nhttbb.exe209⤵
-
\??\c:\ddpjj.exec:\ddpjj.exe210⤵
-
\??\c:\9flrrff.exec:\9flrrff.exe211⤵
-
\??\c:\ffrxffl.exec:\ffrxffl.exe212⤵
-
\??\c:\jppvj.exec:\jppvj.exe213⤵
-
\??\c:\jpdvv.exec:\jpdvv.exe214⤵
-
\??\c:\xrllffr.exec:\xrllffr.exe215⤵
-
\??\c:\nbnhnb.exec:\nbnhnb.exe216⤵
-
\??\c:\3hnbbh.exec:\3hnbbh.exe217⤵
-
\??\c:\jdjdp.exec:\jdjdp.exe218⤵
-
\??\c:\5ttthh.exec:\5ttthh.exe219⤵
-
\??\c:\hbhbhn.exec:\hbhbhn.exe220⤵
-
\??\c:\vvddd.exec:\vvddd.exe221⤵
-
\??\c:\jdpvd.exec:\jdpvd.exe222⤵
-
\??\c:\9nbtnn.exec:\9nbtnn.exe223⤵
-
\??\c:\hbnnnh.exec:\hbnnnh.exe224⤵
-
\??\c:\ppvjd.exec:\ppvjd.exe225⤵
-
\??\c:\lrflrff.exec:\lrflrff.exe226⤵
-
\??\c:\bbnbnn.exec:\bbnbnn.exe227⤵
-
\??\c:\3btbhh.exec:\3btbhh.exe228⤵
-
\??\c:\3jjjv.exec:\3jjjv.exe229⤵
-
\??\c:\jjdpj.exec:\jjdpj.exe230⤵
-
\??\c:\bbhnbb.exec:\bbhnbb.exe231⤵
-
\??\c:\hbttbb.exec:\hbttbb.exe232⤵
-
\??\c:\pjvpv.exec:\pjvpv.exe233⤵
-
\??\c:\rfxxxrf.exec:\rfxxxrf.exe234⤵
-
\??\c:\9ntbnt.exec:\9ntbnt.exe235⤵
-
\??\c:\9vpvp.exec:\9vpvp.exe236⤵
-
\??\c:\rrflxxf.exec:\rrflxxf.exe237⤵
-
\??\c:\tnbhhh.exec:\tnbhhh.exe238⤵
-
\??\c:\dpvjd.exec:\dpvjd.exe239⤵
-
\??\c:\5lrrffl.exec:\5lrrffl.exe240⤵
-
\??\c:\httnbb.exec:\httnbb.exe241⤵