Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 23:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
224c84fab0c4fbd47bd791c84260e4ce35ed7c9574f9c0a6c19c835915cf3f43_NeikiAnalytics.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
-
Target
224c84fab0c4fbd47bd791c84260e4ce35ed7c9574f9c0a6c19c835915cf3f43_NeikiAnalytics.exe
-
Size
369KB
-
MD5
abfaec01284ea027d5067505a9097e80
-
SHA1
da3e44bc26d18d8d3185ec3f14961bfafaf9dd5e
-
SHA256
224c84fab0c4fbd47bd791c84260e4ce35ed7c9574f9c0a6c19c835915cf3f43
-
SHA512
f4dcb65b140ca70e2355ba4b4ea3a89c23615b502c4027dcaa5b40aa9f41c6c7dc1f0f32b5fd6a507d7e4e30a250aeeb0935e1d214c112ff169e7409409b91af
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9FrHSwh/c/hdTWGIaxJ8TN005pWmjVwdSsy0V:n3C9BRo7tvnJ9Fywhk/T7xyTpShZVV
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/1584-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1124-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1516-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/840-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/508-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
flrflrf.exenbbhtb.exejjjjj.exevvpvv.exellfxxfr.exetnhttb.exevdvdj.exellfllxr.exehbtthh.exennttnn.exedddvv.exerrrrxxf.exenthnbn.exejjjpd.exe9fxxrlf.exerflrrrx.exe1bnnnt.exedpvpp.exeflrlfxx.exebhhbhh.exejjddp.exe9lrrxfx.exettnnnt.exehnbbtb.exebntnnh.exepjvjj.exelfxflrx.exetbtbbh.exe7jppp.exe9flrxrx.exehnhhtb.exevjppv.exexlxxxlx.exentbbbh.exentbnhb.exepvddd.exerlffrrx.exethhhhh.exejjjjd.exedjvdp.exefllxfxx.exebhhhnn.exethhbhh.exedppvp.exexrfrlrr.exexxrllll.exehbhbbb.exe9vvvp.exepdvdv.exelxxxfxf.exehhbtnn.exenbnbtt.exeflxrrlf.exerxlllll.exehbbbbb.exedjpjd.exerxllxxl.exerllxxlx.exehbtnbb.exe5pvvd.exepdjdd.exexffxrff.exehthntt.exe9jvjd.exepid process 3380 flrflrf.exe 1580 nbbhtb.exe 548 jjjjj.exe 1064 vvpvv.exe 4636 llfxxfr.exe 2160 tnhttb.exe 1216 vdvdj.exe 2580 llfllxr.exe 508 hbtthh.exe 4068 nnttnn.exe 4740 dddvv.exe 840 rrrrxxf.exe 1516 nthnbn.exe 5088 jjjpd.exe 3648 9fxxrlf.exe 1408 rflrrrx.exe 4436 1bnnnt.exe 4836 dpvpp.exe 4632 flrlfxx.exe 4372 bhhbhh.exe 1340 jjddp.exe 4792 9lrrxfx.exe 4264 ttnnnt.exe 1124 hnbbtb.exe 1728 bntnnh.exe 1940 pjvjj.exe 5016 lfxflrx.exe 4784 tbtbbh.exe 3144 7jppp.exe 3696 9flrxrx.exe 4572 hnhhtb.exe 4964 vjppv.exe 2032 xlxxxlx.exe 3884 ntbbbh.exe 3512 ntbnhb.exe 3692 pvddd.exe 3988 rlffrrx.exe 3772 thhhhh.exe 748 jjjjd.exe 1224 djvdp.exe 2980 fllxfxx.exe 1804 bhhhnn.exe 2600 thhbhh.exe 3496 dppvp.exe 4624 xrfrlrr.exe 4420 xxrllll.exe 464 hbhbbb.exe 4044 9vvvp.exe 4024 pdvdv.exe 3604 lxxxfxf.exe 2860 hhbtnn.exe 1064 nbnbtt.exe 556 flxrrlf.exe 2588 rxlllll.exe 1660 hbbbbb.exe 5012 djpjd.exe 4308 rxllxxl.exe 3676 rllxxlx.exe 2580 hbtnbb.exe 800 5pvvd.exe 1652 pdjdd.exe 756 xffxrff.exe 3260 hthntt.exe 916 9jvjd.exe -
Processes:
resource yara_rule behavioral2/memory/1584-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1124-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/840-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/508-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-17-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
224c84fab0c4fbd47bd791c84260e4ce35ed7c9574f9c0a6c19c835915cf3f43_NeikiAnalytics.exeflrflrf.exenbbhtb.exejjjjj.exevvpvv.exellfxxfr.exetnhttb.exevdvdj.exellfllxr.exehbtthh.exennttnn.exedddvv.exerrrrxxf.exenthnbn.exejjjpd.exe9fxxrlf.exerflrrrx.exe1bnnnt.exedpvpp.exeflrlfxx.exebhhbhh.exejjddp.exedescription pid process target process PID 1584 wrote to memory of 3380 1584 224c84fab0c4fbd47bd791c84260e4ce35ed7c9574f9c0a6c19c835915cf3f43_NeikiAnalytics.exe flrflrf.exe PID 1584 wrote to memory of 3380 1584 224c84fab0c4fbd47bd791c84260e4ce35ed7c9574f9c0a6c19c835915cf3f43_NeikiAnalytics.exe flrflrf.exe PID 1584 wrote to memory of 3380 1584 224c84fab0c4fbd47bd791c84260e4ce35ed7c9574f9c0a6c19c835915cf3f43_NeikiAnalytics.exe flrflrf.exe PID 3380 wrote to memory of 1580 3380 flrflrf.exe nbbhtb.exe PID 3380 wrote to memory of 1580 3380 flrflrf.exe nbbhtb.exe PID 3380 wrote to memory of 1580 3380 flrflrf.exe nbbhtb.exe PID 1580 wrote to memory of 548 1580 nbbhtb.exe djjjp.exe PID 1580 wrote to memory of 548 1580 nbbhtb.exe djjjp.exe PID 1580 wrote to memory of 548 1580 nbbhtb.exe djjjp.exe PID 548 wrote to memory of 1064 548 jjjjj.exe vvpvv.exe PID 548 wrote to memory of 1064 548 jjjjj.exe vvpvv.exe PID 548 wrote to memory of 1064 548 jjjjj.exe vvpvv.exe PID 1064 wrote to memory of 4636 1064 vvpvv.exe llfxxfr.exe PID 1064 wrote to memory of 4636 1064 vvpvv.exe llfxxfr.exe PID 1064 wrote to memory of 4636 1064 vvpvv.exe llfxxfr.exe PID 4636 wrote to memory of 2160 4636 llfxxfr.exe tnhttb.exe PID 4636 wrote to memory of 2160 4636 llfxxfr.exe tnhttb.exe PID 4636 wrote to memory of 2160 4636 llfxxfr.exe tnhttb.exe PID 2160 wrote to memory of 1216 2160 tnhttb.exe vdvdj.exe PID 2160 wrote to memory of 1216 2160 tnhttb.exe vdvdj.exe PID 2160 wrote to memory of 1216 2160 tnhttb.exe vdvdj.exe PID 1216 wrote to memory of 2580 1216 vdvdj.exe bhnttb.exe PID 1216 wrote to memory of 2580 1216 vdvdj.exe bhnttb.exe PID 1216 wrote to memory of 2580 1216 vdvdj.exe bhnttb.exe PID 2580 wrote to memory of 508 2580 llfllxr.exe hbbbhn.exe PID 2580 wrote to memory of 508 2580 llfllxr.exe hbbbhn.exe PID 2580 wrote to memory of 508 2580 llfllxr.exe hbbbhn.exe PID 508 wrote to memory of 4068 508 hbtthh.exe nnttnn.exe PID 508 wrote to memory of 4068 508 hbtthh.exe nnttnn.exe PID 508 wrote to memory of 4068 508 hbtthh.exe nnttnn.exe PID 4068 wrote to memory of 4740 4068 nnttnn.exe dddvv.exe PID 4068 wrote to memory of 4740 4068 nnttnn.exe dddvv.exe PID 4068 wrote to memory of 4740 4068 nnttnn.exe dddvv.exe PID 4740 wrote to memory of 840 4740 dddvv.exe rrrrxxf.exe PID 4740 wrote to memory of 840 4740 dddvv.exe rrrrxxf.exe PID 4740 wrote to memory of 840 4740 dddvv.exe rrrrxxf.exe PID 840 wrote to memory of 1516 840 rrrrxxf.exe nthnbn.exe PID 840 wrote to memory of 1516 840 rrrrxxf.exe nthnbn.exe PID 840 wrote to memory of 1516 840 rrrrxxf.exe nthnbn.exe PID 1516 wrote to memory of 5088 1516 nthnbn.exe 3nnhhb.exe PID 1516 wrote to memory of 5088 1516 nthnbn.exe 3nnhhb.exe PID 1516 wrote to memory of 5088 1516 nthnbn.exe 3nnhhb.exe PID 5088 wrote to memory of 3648 5088 jjjpd.exe 9fxxrlf.exe PID 5088 wrote to memory of 3648 5088 jjjpd.exe 9fxxrlf.exe PID 5088 wrote to memory of 3648 5088 jjjpd.exe 9fxxrlf.exe PID 3648 wrote to memory of 1408 3648 9fxxrlf.exe rflrrrx.exe PID 3648 wrote to memory of 1408 3648 9fxxrlf.exe rflrrrx.exe PID 3648 wrote to memory of 1408 3648 9fxxrlf.exe rflrrrx.exe PID 1408 wrote to memory of 4436 1408 rflrrrx.exe ddjjp.exe PID 1408 wrote to memory of 4436 1408 rflrrrx.exe ddjjp.exe PID 1408 wrote to memory of 4436 1408 rflrrrx.exe ddjjp.exe PID 4436 wrote to memory of 4836 4436 1bnnnt.exe dpvpp.exe PID 4436 wrote to memory of 4836 4436 1bnnnt.exe dpvpp.exe PID 4436 wrote to memory of 4836 4436 1bnnnt.exe dpvpp.exe PID 4836 wrote to memory of 4632 4836 dpvpp.exe flrlfxx.exe PID 4836 wrote to memory of 4632 4836 dpvpp.exe flrlfxx.exe PID 4836 wrote to memory of 4632 4836 dpvpp.exe flrlfxx.exe PID 4632 wrote to memory of 4372 4632 flrlfxx.exe bhhbhh.exe PID 4632 wrote to memory of 4372 4632 flrlfxx.exe bhhbhh.exe PID 4632 wrote to memory of 4372 4632 flrlfxx.exe bhhbhh.exe PID 4372 wrote to memory of 1340 4372 bhhbhh.exe xlxxflr.exe PID 4372 wrote to memory of 1340 4372 bhhbhh.exe xlxxflr.exe PID 4372 wrote to memory of 1340 4372 bhhbhh.exe xlxxflr.exe PID 1340 wrote to memory of 4792 1340 jjddp.exe 9lrrxfx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\224c84fab0c4fbd47bd791c84260e4ce35ed7c9574f9c0a6c19c835915cf3f43_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\224c84fab0c4fbd47bd791c84260e4ce35ed7c9574f9c0a6c19c835915cf3f43_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\flrflrf.exec:\flrflrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbbhtb.exec:\nbbhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjjjj.exec:\jjjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvpvv.exec:\vvpvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llfxxfr.exec:\llfxxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnhttb.exec:\tnhttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdvdj.exec:\vdvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llfllxr.exec:\llfllxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbtthh.exec:\hbtthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnttnn.exec:\nnttnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dddvv.exec:\dddvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrrrxxf.exec:\rrrrxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nthnbn.exec:\nthnbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjjpd.exec:\jjjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9fxxrlf.exec:\9fxxrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rflrrrx.exec:\rflrrrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1bnnnt.exec:\1bnnnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpvpp.exec:\dpvpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flrlfxx.exec:\flrlfxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhhbhh.exec:\bhhbhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjddp.exec:\jjddp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9lrrxfx.exec:\9lrrxfx.exe23⤵
- Executes dropped EXE
-
\??\c:\ttnnnt.exec:\ttnnnt.exe24⤵
- Executes dropped EXE
-
\??\c:\hnbbtb.exec:\hnbbtb.exe25⤵
- Executes dropped EXE
-
\??\c:\bntnnh.exec:\bntnnh.exe26⤵
- Executes dropped EXE
-
\??\c:\pjvjj.exec:\pjvjj.exe27⤵
- Executes dropped EXE
-
\??\c:\lfxflrx.exec:\lfxflrx.exe28⤵
- Executes dropped EXE
-
\??\c:\tbtbbh.exec:\tbtbbh.exe29⤵
- Executes dropped EXE
-
\??\c:\7jppp.exec:\7jppp.exe30⤵
- Executes dropped EXE
-
\??\c:\9flrxrx.exec:\9flrxrx.exe31⤵
- Executes dropped EXE
-
\??\c:\hnhhtb.exec:\hnhhtb.exe32⤵
- Executes dropped EXE
-
\??\c:\vjppv.exec:\vjppv.exe33⤵
- Executes dropped EXE
-
\??\c:\xlxxxlx.exec:\xlxxxlx.exe34⤵
- Executes dropped EXE
-
\??\c:\ntbbbh.exec:\ntbbbh.exe35⤵
- Executes dropped EXE
-
\??\c:\ntbnhb.exec:\ntbnhb.exe36⤵
- Executes dropped EXE
-
\??\c:\pvddd.exec:\pvddd.exe37⤵
- Executes dropped EXE
-
\??\c:\rlffrrx.exec:\rlffrrx.exe38⤵
- Executes dropped EXE
-
\??\c:\thhhhh.exec:\thhhhh.exe39⤵
- Executes dropped EXE
-
\??\c:\jjjjd.exec:\jjjjd.exe40⤵
- Executes dropped EXE
-
\??\c:\djvdp.exec:\djvdp.exe41⤵
- Executes dropped EXE
-
\??\c:\fllxfxx.exec:\fllxfxx.exe42⤵
- Executes dropped EXE
-
\??\c:\bhhhnn.exec:\bhhhnn.exe43⤵
- Executes dropped EXE
-
\??\c:\thhbhh.exec:\thhbhh.exe44⤵
- Executes dropped EXE
-
\??\c:\dppvp.exec:\dppvp.exe45⤵
- Executes dropped EXE
-
\??\c:\xrfrlrr.exec:\xrfrlrr.exe46⤵
- Executes dropped EXE
-
\??\c:\xxrllll.exec:\xxrllll.exe47⤵
- Executes dropped EXE
-
\??\c:\hbhbbb.exec:\hbhbbb.exe48⤵
- Executes dropped EXE
-
\??\c:\9vvvp.exec:\9vvvp.exe49⤵
- Executes dropped EXE
-
\??\c:\pdvdv.exec:\pdvdv.exe50⤵
- Executes dropped EXE
-
\??\c:\lxxxfxf.exec:\lxxxfxf.exe51⤵
- Executes dropped EXE
-
\??\c:\hhbtnn.exec:\hhbtnn.exe52⤵
- Executes dropped EXE
-
\??\c:\nbnbtt.exec:\nbnbtt.exe53⤵
- Executes dropped EXE
-
\??\c:\flxrrlf.exec:\flxrrlf.exe54⤵
- Executes dropped EXE
-
\??\c:\rxlllll.exec:\rxlllll.exe55⤵
- Executes dropped EXE
-
\??\c:\hbbbbb.exec:\hbbbbb.exe56⤵
- Executes dropped EXE
-
\??\c:\djpjd.exec:\djpjd.exe57⤵
- Executes dropped EXE
-
\??\c:\rxllxxl.exec:\rxllxxl.exe58⤵
- Executes dropped EXE
-
\??\c:\rllxxlx.exec:\rllxxlx.exe59⤵
- Executes dropped EXE
-
\??\c:\hbtnbb.exec:\hbtnbb.exe60⤵
- Executes dropped EXE
-
\??\c:\5pvvd.exec:\5pvvd.exe61⤵
- Executes dropped EXE
-
\??\c:\pdjdd.exec:\pdjdd.exe62⤵
- Executes dropped EXE
-
\??\c:\xffxrff.exec:\xffxrff.exe63⤵
- Executes dropped EXE
-
\??\c:\hthntt.exec:\hthntt.exe64⤵
- Executes dropped EXE
-
\??\c:\9jvjd.exec:\9jvjd.exe65⤵
- Executes dropped EXE
-
\??\c:\9pppj.exec:\9pppj.exe66⤵
-
\??\c:\xllffrr.exec:\xllffrr.exe67⤵
-
\??\c:\nbhbbb.exec:\nbhbbb.exe68⤵
-
\??\c:\nnbbtb.exec:\nnbbtb.exe69⤵
-
\??\c:\vppdj.exec:\vppdj.exe70⤵
-
\??\c:\3rxxlrx.exec:\3rxxlrx.exe71⤵
-
\??\c:\xrrrllf.exec:\xrrrllf.exe72⤵
-
\??\c:\tnbbtn.exec:\tnbbtn.exe73⤵
-
\??\c:\dvvvv.exec:\dvvvv.exe74⤵
-
\??\c:\jpvpp.exec:\jpvpp.exe75⤵
-
\??\c:\5lllfff.exec:\5lllfff.exe76⤵
-
\??\c:\bntttn.exec:\bntttn.exe77⤵
-
\??\c:\bttnhh.exec:\bttnhh.exe78⤵
-
\??\c:\jvddj.exec:\jvddj.exe79⤵
-
\??\c:\3lxrxfl.exec:\3lxrxfl.exe80⤵
-
\??\c:\lllfffr.exec:\lllfffr.exe81⤵
-
\??\c:\tbnhbt.exec:\tbnhbt.exe82⤵
-
\??\c:\hnbbtt.exec:\hnbbtt.exe83⤵
-
\??\c:\1vdvp.exec:\1vdvp.exe84⤵
-
\??\c:\xrrlfff.exec:\xrrlfff.exe85⤵
-
\??\c:\fxllrrx.exec:\fxllrrx.exe86⤵
-
\??\c:\bhtthn.exec:\bhtthn.exe87⤵
-
\??\c:\vpppj.exec:\vpppj.exe88⤵
-
\??\c:\jvjdv.exec:\jvjdv.exe89⤵
-
\??\c:\1rxxrrr.exec:\1rxxrrr.exe90⤵
-
\??\c:\btbttt.exec:\btbttt.exe91⤵
-
\??\c:\bnttbb.exec:\bnttbb.exe92⤵
-
\??\c:\pdpjd.exec:\pdpjd.exe93⤵
-
\??\c:\lxxfxxf.exec:\lxxfxxf.exe94⤵
-
\??\c:\flrllff.exec:\flrllff.exe95⤵
-
\??\c:\3thbbb.exec:\3thbbb.exe96⤵
-
\??\c:\dpvpv.exec:\dpvpv.exe97⤵
-
\??\c:\jjvjj.exec:\jjvjj.exe98⤵
-
\??\c:\llrrxxr.exec:\llrrxxr.exe99⤵
-
\??\c:\rxlflxx.exec:\rxlflxx.exe100⤵
-
\??\c:\bhhhbb.exec:\bhhhbb.exe101⤵
-
\??\c:\pjpjp.exec:\pjpjp.exe102⤵
-
\??\c:\jdppd.exec:\jdppd.exe103⤵
-
\??\c:\rfflxfr.exec:\rfflxfr.exe104⤵
-
\??\c:\bttttt.exec:\bttttt.exe105⤵
-
\??\c:\vvvdd.exec:\vvvdd.exe106⤵
-
\??\c:\rrrrlrl.exec:\rrrrlrl.exe107⤵
-
\??\c:\btbtth.exec:\btbtth.exe108⤵
-
\??\c:\jvvvj.exec:\jvvvj.exe109⤵
-
\??\c:\dddpp.exec:\dddpp.exe110⤵
-
\??\c:\flrlxxx.exec:\flrlxxx.exe111⤵
-
\??\c:\hnnhbt.exec:\hnnhbt.exe112⤵
-
\??\c:\htthtt.exec:\htthtt.exe113⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe114⤵
-
\??\c:\llxrfff.exec:\llxrfff.exe115⤵
-
\??\c:\rffxlll.exec:\rffxlll.exe116⤵
-
\??\c:\hnhtnh.exec:\hnhtnh.exe117⤵
-
\??\c:\dvvdv.exec:\dvvdv.exe118⤵
-
\??\c:\vdjjd.exec:\vdjjd.exe119⤵
-
\??\c:\rxlllll.exec:\rxlllll.exe120⤵
-
\??\c:\7lffrrf.exec:\7lffrrf.exe121⤵
-
\??\c:\nbnhnt.exec:\nbnhnt.exe122⤵
-
\??\c:\pdpjj.exec:\pdpjj.exe123⤵
-
\??\c:\dvppj.exec:\dvppj.exe124⤵
-
\??\c:\ffxrrrl.exec:\ffxrrrl.exe125⤵
-
\??\c:\hbnnhn.exec:\hbnnhn.exe126⤵
-
\??\c:\btnhhb.exec:\btnhhb.exe127⤵
-
\??\c:\jpjpv.exec:\jpjpv.exe128⤵
-
\??\c:\7vddv.exec:\7vddv.exe129⤵
-
\??\c:\lrrrlff.exec:\lrrrlff.exe130⤵
-
\??\c:\bbhbtt.exec:\bbhbtt.exe131⤵
-
\??\c:\3ppjd.exec:\3ppjd.exe132⤵
-
\??\c:\jjvvv.exec:\jjvvv.exe133⤵
-
\??\c:\xrlfxrf.exec:\xrlfxrf.exe134⤵
-
\??\c:\fxffllf.exec:\fxffllf.exe135⤵
-
\??\c:\hhnntt.exec:\hhnntt.exe136⤵
-
\??\c:\bnhbbb.exec:\bnhbbb.exe137⤵
-
\??\c:\jjjdd.exec:\jjjdd.exe138⤵
-
\??\c:\frfllxf.exec:\frfllxf.exe139⤵
-
\??\c:\lrffxxf.exec:\lrffxxf.exe140⤵
-
\??\c:\hnttnn.exec:\hnttnn.exe141⤵
-
\??\c:\nbbbtt.exec:\nbbbtt.exe142⤵
-
\??\c:\3vdvp.exec:\3vdvp.exe143⤵
-
\??\c:\vvvdv.exec:\vvvdv.exe144⤵
-
\??\c:\ffxllxx.exec:\ffxllxx.exe145⤵
-
\??\c:\nhhnnt.exec:\nhhnnt.exe146⤵
-
\??\c:\bbhhhh.exec:\bbhhhh.exe147⤵
-
\??\c:\dpddd.exec:\dpddd.exe148⤵
-
\??\c:\xxrrrff.exec:\xxrrrff.exe149⤵
-
\??\c:\nhnbbt.exec:\nhnbbt.exe150⤵
-
\??\c:\7hnhhn.exec:\7hnhhn.exe151⤵
-
\??\c:\pppdd.exec:\pppdd.exe152⤵
-
\??\c:\jdvdj.exec:\jdvdj.exe153⤵
-
\??\c:\rrffrll.exec:\rrffrll.exe154⤵
-
\??\c:\tnbtbn.exec:\tnbtbn.exe155⤵
-
\??\c:\btbbnt.exec:\btbbnt.exe156⤵
-
\??\c:\pdppp.exec:\pdppp.exe157⤵
-
\??\c:\fxffxxx.exec:\fxffxxx.exe158⤵
-
\??\c:\lflffxx.exec:\lflffxx.exe159⤵
-
\??\c:\tbhhbh.exec:\tbhhbh.exe160⤵
-
\??\c:\vpvpp.exec:\vpvpp.exe161⤵
-
\??\c:\vpjjd.exec:\vpjjd.exe162⤵
-
\??\c:\lrxrllf.exec:\lrxrllf.exe163⤵
-
\??\c:\xrffrrx.exec:\xrffrrx.exe164⤵
-
\??\c:\bhnnnt.exec:\bhnnnt.exe165⤵
-
\??\c:\jdpjd.exec:\jdpjd.exe166⤵
-
\??\c:\5jppp.exec:\5jppp.exe167⤵
-
\??\c:\rfxrxrl.exec:\rfxrxrl.exe168⤵
-
\??\c:\hhhbtt.exec:\hhhbtt.exe169⤵
-
\??\c:\thnntt.exec:\thnntt.exe170⤵
-
\??\c:\pjjjj.exec:\pjjjj.exe171⤵
-
\??\c:\ddvdv.exec:\ddvdv.exe172⤵
-
\??\c:\rffffrx.exec:\rffffrx.exe173⤵
-
\??\c:\hbhhhn.exec:\hbhhhn.exe174⤵
-
\??\c:\tnnbtt.exec:\tnnbtt.exe175⤵
-
\??\c:\dpppv.exec:\dpppv.exe176⤵
-
\??\c:\rxlllrx.exec:\rxlllrx.exe177⤵
-
\??\c:\lffxrrl.exec:\lffxrrl.exe178⤵
-
\??\c:\hhtthn.exec:\hhtthn.exe179⤵
-
\??\c:\5nhbbb.exec:\5nhbbb.exe180⤵
-
\??\c:\pddvp.exec:\pddvp.exe181⤵
-
\??\c:\vdpdp.exec:\vdpdp.exe182⤵
-
\??\c:\xxfrlxf.exec:\xxfrlxf.exe183⤵
-
\??\c:\tnbntb.exec:\tnbntb.exe184⤵
-
\??\c:\bbthnh.exec:\bbthnh.exe185⤵
-
\??\c:\pddpd.exec:\pddpd.exe186⤵
-
\??\c:\3pvpj.exec:\3pvpj.exe187⤵
-
\??\c:\7rfxxfr.exec:\7rfxxfr.exe188⤵
-
\??\c:\ntttnh.exec:\ntttnh.exe189⤵
-
\??\c:\nnhnnt.exec:\nnhnnt.exe190⤵
-
\??\c:\dvdvd.exec:\dvdvd.exe191⤵
-
\??\c:\dppjd.exec:\dppjd.exe192⤵
-
\??\c:\xxllrfl.exec:\xxllrfl.exe193⤵
-
\??\c:\hbbtnn.exec:\hbbtnn.exe194⤵
-
\??\c:\1nbtnh.exec:\1nbtnh.exe195⤵
-
\??\c:\vppvj.exec:\vppvj.exe196⤵
-
\??\c:\dpjdj.exec:\dpjdj.exe197⤵
-
\??\c:\xxlfxrr.exec:\xxlfxrr.exe198⤵
-
\??\c:\rxrxxfl.exec:\rxrxxfl.exe199⤵
-
\??\c:\9bbtnn.exec:\9bbtnn.exe200⤵
-
\??\c:\5tbttt.exec:\5tbttt.exe201⤵
-
\??\c:\jdddv.exec:\jdddv.exe202⤵
-
\??\c:\jpdvp.exec:\jpdvp.exe203⤵
-
\??\c:\5flfxxr.exec:\5flfxxr.exe204⤵
-
\??\c:\rrrrlff.exec:\rrrrlff.exe205⤵
-
\??\c:\5nnhbh.exec:\5nnhbh.exe206⤵
-
\??\c:\ddpvj.exec:\ddpvj.exe207⤵
-
\??\c:\1pvpj.exec:\1pvpj.exe208⤵
-
\??\c:\7ffffll.exec:\7ffffll.exe209⤵
-
\??\c:\xrlrlfl.exec:\xrlrlfl.exe210⤵
-
\??\c:\thbnth.exec:\thbnth.exe211⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe212⤵
-
\??\c:\9dpjp.exec:\9dpjp.exe213⤵
-
\??\c:\rffllxx.exec:\rffllxx.exe214⤵
-
\??\c:\tbnbht.exec:\tbnbht.exe215⤵
-
\??\c:\5btnhn.exec:\5btnhn.exe216⤵
-
\??\c:\jppjd.exec:\jppjd.exe217⤵
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe218⤵
-
\??\c:\rlxxllx.exec:\rlxxllx.exe219⤵
-
\??\c:\tbhhtb.exec:\tbhhtb.exe220⤵
-
\??\c:\dpdpj.exec:\dpdpj.exe221⤵
-
\??\c:\jdpjp.exec:\jdpjp.exe222⤵
-
\??\c:\ffrxxff.exec:\ffrxxff.exe223⤵
-
\??\c:\rfxfllx.exec:\rfxfllx.exe224⤵
-
\??\c:\1tntbh.exec:\1tntbh.exe225⤵
-
\??\c:\vjpvv.exec:\vjpvv.exe226⤵
-
\??\c:\pvddj.exec:\pvddj.exe227⤵
-
\??\c:\rflllrr.exec:\rflllrr.exe228⤵
-
\??\c:\tnbbbh.exec:\tnbbbh.exe229⤵
-
\??\c:\jjjjj.exec:\jjjjj.exe230⤵
-
\??\c:\djddd.exec:\djddd.exe231⤵
-
\??\c:\lxrxxxf.exec:\lxrxxxf.exe232⤵
-
\??\c:\ntnbbn.exec:\ntnbbn.exe233⤵
-
\??\c:\ppvvv.exec:\ppvvv.exe234⤵
-
\??\c:\1vjjp.exec:\1vjjp.exe235⤵
-
\??\c:\lrrxxff.exec:\lrrxxff.exe236⤵
-
\??\c:\9htntb.exec:\9htntb.exe237⤵
-
\??\c:\nhtbhh.exec:\nhtbhh.exe238⤵
-
\??\c:\dpdjp.exec:\dpdjp.exe239⤵
-
\??\c:\xfffxrl.exec:\xfffxrl.exe240⤵
-
\??\c:\btnthh.exec:\btnthh.exe241⤵