Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 23:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
23bb9eaf9592cce27c54a02255f6f48b3b3b60c6483d7258d4970ce6100438d3_NeikiAnalytics.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
-
Target
23bb9eaf9592cce27c54a02255f6f48b3b3b60c6483d7258d4970ce6100438d3_NeikiAnalytics.exe
-
Size
74KB
-
MD5
a274255d4c1a1a119182d457c1220330
-
SHA1
b5b3143592fcc5e10a9cc839897882659f12dfbb
-
SHA256
23bb9eaf9592cce27c54a02255f6f48b3b3b60c6483d7258d4970ce6100438d3
-
SHA512
d99a91c8fe97af1c76386759f9747f3c730281b85f5cf2a78512dfcba8d31914937b33e16c63c2b3e6e610cb9418e8fde806c48d6aad62ff919f4be8310dece2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUwcsbYsoam:ymb3NkkiQ3mdBjF0yjcsMsoam
Malware Config
Signatures
-
Detect Blackmoon payload 32 IoCs
Processes:
resource yara_rule behavioral2/memory/452-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1128-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1128-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2020-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-76-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpvvv.exe9xlllrr.exerrfxrrf.exebtnntb.exe3dddv.exevvddj.exeffxxxfl.exerrrlrxr.exetntbbh.exenbbbtt.exe9jvvv.exepdpvv.exe1xflrrx.exexxlllrr.exefxffflr.exebhnttt.exe5pvvj.exedvdvv.exefrrlllx.exerrxxxxx.exe1flllxl.exehbhhhh.exettbttb.exejdppv.exevdppj.exerxxxxxf.exerfrrfll.exefflrrxf.exenntbhh.exebttbtb.exeppdvp.exeppddj.exe3frrlrx.exexfrrrxx.exe3bhhhn.exebhhhhh.exennttht.exe3dvvj.exevddvv.exefflllrl.exefrflfxf.exelrrxrrr.exebhnnnn.exetbbbbh.exepdvvp.exedjddd.exe1pvvv.exe1lrrrrx.exexfffffl.exerrrrlrr.exehbntbb.exe1bnttb.exebtbbhh.exepvvvd.exedppdd.exe3fxxrxr.exe3xxxxfl.exelrrxxxf.exettbbnn.exettbbbb.exettnnhh.exejdpjp.exe7vvpp.exelfrrrxf.exepid process 1464 vpvvv.exe 4520 9xlllrr.exe 1128 rrfxrrf.exe 3576 btnntb.exe 3668 3dddv.exe 3436 vvddj.exe 1052 ffxxxfl.exe 1048 rrrlrxr.exe 3976 tntbbh.exe 3364 nbbbtt.exe 4948 9jvvv.exe 3620 pdpvv.exe 2236 1xflrrx.exe 2696 xxlllrr.exe 2456 fxffflr.exe 4004 bhnttt.exe 3660 5pvvj.exe 1548 dvdvv.exe 3324 frrlllx.exe 3648 rrxxxxx.exe 2020 1flllxl.exe 4620 hbhhhh.exe 4240 ttbttb.exe 5112 jdppv.exe 1420 vdppj.exe 1928 rxxxxxf.exe 4188 rfrrfll.exe 4984 fflrrxf.exe 2832 nntbhh.exe 2952 bttbtb.exe 4588 ppdvp.exe 3616 ppddj.exe 3968 3frrlrx.exe 3640 xfrrrxx.exe 5076 3bhhhn.exe 4936 bhhhhh.exe 5108 nnttht.exe 4688 3dvvj.exe 3156 vddvv.exe 3508 fflllrl.exe 2040 frflfxf.exe 4752 lrrxrrr.exe 3532 bhnnnn.exe 4252 tbbbbh.exe 4464 pdvvp.exe 3704 djddd.exe 4932 1pvvv.exe 3944 1lrrrrx.exe 3344 xfffffl.exe 4540 rrrrlrr.exe 5036 hbntbb.exe 2324 1bnttb.exe 4532 btbbhh.exe 4684 pvvvd.exe 3948 dppdd.exe 2972 3fxxrxr.exe 916 3xxxxfl.exe 4196 lrrxxxf.exe 1172 ttbbnn.exe 1632 ttbbbb.exe 1048 ttnnhh.exe 3176 jdpjp.exe 2712 7vvpp.exe 1884 lfrrrxf.exe -
Processes:
resource yara_rule behavioral2/memory/452-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1128-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1128-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2020-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-40-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
23bb9eaf9592cce27c54a02255f6f48b3b3b60c6483d7258d4970ce6100438d3_NeikiAnalytics.exevpvvv.exe9xlllrr.exerrfxrrf.exebtnntb.exe3dddv.exevvddj.exeffxxxfl.exerrrlrxr.exetntbbh.exenbbbtt.exe9jvvv.exepdpvv.exe1xflrrx.exexxlllrr.exefxffflr.exebhnttt.exe5pvvj.exedvdvv.exefrrlllx.exerrxxxxx.exe1flllxl.exedescription pid process target process PID 452 wrote to memory of 1464 452 23bb9eaf9592cce27c54a02255f6f48b3b3b60c6483d7258d4970ce6100438d3_NeikiAnalytics.exe vpvvv.exe PID 452 wrote to memory of 1464 452 23bb9eaf9592cce27c54a02255f6f48b3b3b60c6483d7258d4970ce6100438d3_NeikiAnalytics.exe vpvvv.exe PID 452 wrote to memory of 1464 452 23bb9eaf9592cce27c54a02255f6f48b3b3b60c6483d7258d4970ce6100438d3_NeikiAnalytics.exe vpvvv.exe PID 1464 wrote to memory of 4520 1464 vpvvv.exe 9xlllrr.exe PID 1464 wrote to memory of 4520 1464 vpvvv.exe 9xlllrr.exe PID 1464 wrote to memory of 4520 1464 vpvvv.exe 9xlllrr.exe PID 4520 wrote to memory of 1128 4520 9xlllrr.exe rrfxrrf.exe PID 4520 wrote to memory of 1128 4520 9xlllrr.exe rrfxrrf.exe PID 4520 wrote to memory of 1128 4520 9xlllrr.exe rrfxrrf.exe PID 1128 wrote to memory of 3576 1128 rrfxrrf.exe btnntb.exe PID 1128 wrote to memory of 3576 1128 rrfxrrf.exe btnntb.exe PID 1128 wrote to memory of 3576 1128 rrfxrrf.exe btnntb.exe PID 3576 wrote to memory of 3668 3576 btnntb.exe 3dddv.exe PID 3576 wrote to memory of 3668 3576 btnntb.exe 3dddv.exe PID 3576 wrote to memory of 3668 3576 btnntb.exe 3dddv.exe PID 3668 wrote to memory of 3436 3668 3dddv.exe vvddj.exe PID 3668 wrote to memory of 3436 3668 3dddv.exe vvddj.exe PID 3668 wrote to memory of 3436 3668 3dddv.exe vvddj.exe PID 3436 wrote to memory of 1052 3436 vvddj.exe ffxxxfl.exe PID 3436 wrote to memory of 1052 3436 vvddj.exe ffxxxfl.exe PID 3436 wrote to memory of 1052 3436 vvddj.exe ffxxxfl.exe PID 1052 wrote to memory of 1048 1052 ffxxxfl.exe rrrlrxr.exe PID 1052 wrote to memory of 1048 1052 ffxxxfl.exe rrrlrxr.exe PID 1052 wrote to memory of 1048 1052 ffxxxfl.exe rrrlrxr.exe PID 1048 wrote to memory of 3976 1048 rrrlrxr.exe tntbbh.exe PID 1048 wrote to memory of 3976 1048 rrrlrxr.exe tntbbh.exe PID 1048 wrote to memory of 3976 1048 rrrlrxr.exe tntbbh.exe PID 3976 wrote to memory of 3364 3976 tntbbh.exe nbbbtt.exe PID 3976 wrote to memory of 3364 3976 tntbbh.exe nbbbtt.exe PID 3976 wrote to memory of 3364 3976 tntbbh.exe nbbbtt.exe PID 3364 wrote to memory of 4948 3364 nbbbtt.exe 9jvvv.exe PID 3364 wrote to memory of 4948 3364 nbbbtt.exe 9jvvv.exe PID 3364 wrote to memory of 4948 3364 nbbbtt.exe 9jvvv.exe PID 4948 wrote to memory of 3620 4948 9jvvv.exe pdpvv.exe PID 4948 wrote to memory of 3620 4948 9jvvv.exe pdpvv.exe PID 4948 wrote to memory of 3620 4948 9jvvv.exe pdpvv.exe PID 3620 wrote to memory of 2236 3620 pdpvv.exe 1xflrrx.exe PID 3620 wrote to memory of 2236 3620 pdpvv.exe 1xflrrx.exe PID 3620 wrote to memory of 2236 3620 pdpvv.exe 1xflrrx.exe PID 2236 wrote to memory of 2696 2236 1xflrrx.exe xxlllrr.exe PID 2236 wrote to memory of 2696 2236 1xflrrx.exe xxlllrr.exe PID 2236 wrote to memory of 2696 2236 1xflrrx.exe xxlllrr.exe PID 2696 wrote to memory of 2456 2696 xxlllrr.exe fxffflr.exe PID 2696 wrote to memory of 2456 2696 xxlllrr.exe fxffflr.exe PID 2696 wrote to memory of 2456 2696 xxlllrr.exe fxffflr.exe PID 2456 wrote to memory of 4004 2456 fxffflr.exe 7ddjd.exe PID 2456 wrote to memory of 4004 2456 fxffflr.exe 7ddjd.exe PID 2456 wrote to memory of 4004 2456 fxffflr.exe 7ddjd.exe PID 4004 wrote to memory of 3660 4004 bhnttt.exe 5pvvj.exe PID 4004 wrote to memory of 3660 4004 bhnttt.exe 5pvvj.exe PID 4004 wrote to memory of 3660 4004 bhnttt.exe 5pvvj.exe PID 3660 wrote to memory of 1548 3660 5pvvj.exe dvdvv.exe PID 3660 wrote to memory of 1548 3660 5pvvj.exe dvdvv.exe PID 3660 wrote to memory of 1548 3660 5pvvj.exe dvdvv.exe PID 1548 wrote to memory of 3324 1548 dvdvv.exe frrlllx.exe PID 1548 wrote to memory of 3324 1548 dvdvv.exe frrlllx.exe PID 1548 wrote to memory of 3324 1548 dvdvv.exe frrlllx.exe PID 3324 wrote to memory of 3648 3324 frrlllx.exe rrxxxxx.exe PID 3324 wrote to memory of 3648 3324 frrlllx.exe rrxxxxx.exe PID 3324 wrote to memory of 3648 3324 frrlllx.exe rrxxxxx.exe PID 3648 wrote to memory of 2020 3648 rrxxxxx.exe 1flllxl.exe PID 3648 wrote to memory of 2020 3648 rrxxxxx.exe 1flllxl.exe PID 3648 wrote to memory of 2020 3648 rrxxxxx.exe 1flllxl.exe PID 2020 wrote to memory of 4620 2020 1flllxl.exe hbhhhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23bb9eaf9592cce27c54a02255f6f48b3b3b60c6483d7258d4970ce6100438d3_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\23bb9eaf9592cce27c54a02255f6f48b3b3b60c6483d7258d4970ce6100438d3_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvvv.exec:\vpvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9xlllrr.exec:\9xlllrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrfxrrf.exec:\rrfxrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btnntb.exec:\btnntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3dddv.exec:\3dddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvddj.exec:\vvddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxxxfl.exec:\ffxxxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrrlrxr.exec:\rrrlrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tntbbh.exec:\tntbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbbbtt.exec:\nbbbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9jvvv.exec:\9jvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdpvv.exec:\pdpvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1xflrrx.exec:\1xflrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxlllrr.exec:\xxlllrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxffflr.exec:\fxffflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhnttt.exec:\bhnttt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5pvvj.exec:\5pvvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdvv.exec:\dvdvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frrlllx.exec:\frrlllx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1flllxl.exec:\1flllxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhhhh.exec:\hbhhhh.exe23⤵
- Executes dropped EXE
-
\??\c:\ttbttb.exec:\ttbttb.exe24⤵
- Executes dropped EXE
-
\??\c:\jdppv.exec:\jdppv.exe25⤵
- Executes dropped EXE
-
\??\c:\vdppj.exec:\vdppj.exe26⤵
- Executes dropped EXE
-
\??\c:\rxxxxxf.exec:\rxxxxxf.exe27⤵
- Executes dropped EXE
-
\??\c:\rfrrfll.exec:\rfrrfll.exe28⤵
- Executes dropped EXE
-
\??\c:\fflrrxf.exec:\fflrrxf.exe29⤵
- Executes dropped EXE
-
\??\c:\nntbhh.exec:\nntbhh.exe30⤵
- Executes dropped EXE
-
\??\c:\bttbtb.exec:\bttbtb.exe31⤵
- Executes dropped EXE
-
\??\c:\ppdvp.exec:\ppdvp.exe32⤵
- Executes dropped EXE
-
\??\c:\ppddj.exec:\ppddj.exe33⤵
- Executes dropped EXE
-
\??\c:\3frrlrx.exec:\3frrlrx.exe34⤵
- Executes dropped EXE
-
\??\c:\xfrrrxx.exec:\xfrrrxx.exe35⤵
- Executes dropped EXE
-
\??\c:\3bhhhn.exec:\3bhhhn.exe36⤵
- Executes dropped EXE
-
\??\c:\bhhhhh.exec:\bhhhhh.exe37⤵
- Executes dropped EXE
-
\??\c:\nnttht.exec:\nnttht.exe38⤵
- Executes dropped EXE
-
\??\c:\3dvvj.exec:\3dvvj.exe39⤵
- Executes dropped EXE
-
\??\c:\vddvv.exec:\vddvv.exe40⤵
- Executes dropped EXE
-
\??\c:\fflllrl.exec:\fflllrl.exe41⤵
- Executes dropped EXE
-
\??\c:\frflfxf.exec:\frflfxf.exe42⤵
- Executes dropped EXE
-
\??\c:\lrrxrrr.exec:\lrrxrrr.exe43⤵
- Executes dropped EXE
-
\??\c:\bhnnnn.exec:\bhnnnn.exe44⤵
- Executes dropped EXE
-
\??\c:\tbbbbh.exec:\tbbbbh.exe45⤵
- Executes dropped EXE
-
\??\c:\pdvvp.exec:\pdvvp.exe46⤵
- Executes dropped EXE
-
\??\c:\djddd.exec:\djddd.exe47⤵
- Executes dropped EXE
-
\??\c:\1pvvv.exec:\1pvvv.exe48⤵
- Executes dropped EXE
-
\??\c:\1lrrrrx.exec:\1lrrrrx.exe49⤵
- Executes dropped EXE
-
\??\c:\xfffffl.exec:\xfffffl.exe50⤵
- Executes dropped EXE
-
\??\c:\rrrrlrr.exec:\rrrrlrr.exe51⤵
- Executes dropped EXE
-
\??\c:\hbntbb.exec:\hbntbb.exe52⤵
- Executes dropped EXE
-
\??\c:\1bnttb.exec:\1bnttb.exe53⤵
- Executes dropped EXE
-
\??\c:\btbbhh.exec:\btbbhh.exe54⤵
- Executes dropped EXE
-
\??\c:\pvvvd.exec:\pvvvd.exe55⤵
- Executes dropped EXE
-
\??\c:\dppdd.exec:\dppdd.exe56⤵
- Executes dropped EXE
-
\??\c:\3fxxrxr.exec:\3fxxrxr.exe57⤵
- Executes dropped EXE
-
\??\c:\3xxxxfl.exec:\3xxxxfl.exe58⤵
- Executes dropped EXE
-
\??\c:\lrrxxxf.exec:\lrrxxxf.exe59⤵
- Executes dropped EXE
-
\??\c:\ttbbnn.exec:\ttbbnn.exe60⤵
- Executes dropped EXE
-
\??\c:\ttbbbb.exec:\ttbbbb.exe61⤵
- Executes dropped EXE
-
\??\c:\ttnnhh.exec:\ttnnhh.exe62⤵
- Executes dropped EXE
-
\??\c:\jdpjp.exec:\jdpjp.exe63⤵
- Executes dropped EXE
-
\??\c:\7vvpp.exec:\7vvpp.exe64⤵
- Executes dropped EXE
-
\??\c:\lfrrrxf.exec:\lfrrrxf.exe65⤵
- Executes dropped EXE
-
\??\c:\fxrxflx.exec:\fxrxflx.exe66⤵
-
\??\c:\xxfffff.exec:\xxfffff.exe67⤵
-
\??\c:\bbnttt.exec:\bbnttt.exe68⤵
-
\??\c:\ttnhhb.exec:\ttnhhb.exe69⤵
-
\??\c:\vpvvv.exec:\vpvvv.exe70⤵
-
\??\c:\jpvdv.exec:\jpvdv.exe71⤵
-
\??\c:\vjjjj.exec:\vjjjj.exe72⤵
-
\??\c:\fflffff.exec:\fflffff.exe73⤵
-
\??\c:\rlrxrxf.exec:\rlrxrxf.exe74⤵
-
\??\c:\lxlrlll.exec:\lxlrlll.exe75⤵
-
\??\c:\3bbnbh.exec:\3bbnbh.exe76⤵
-
\??\c:\hhhbbb.exec:\hhhbbb.exe77⤵
-
\??\c:\jjpvp.exec:\jjpvp.exe78⤵
-
\??\c:\jjddv.exec:\jjddv.exe79⤵
-
\??\c:\pdjjj.exec:\pdjjj.exe80⤵
-
\??\c:\ffxfflr.exec:\ffxfflr.exe81⤵
-
\??\c:\rflrrrr.exec:\rflrrrr.exe82⤵
-
\??\c:\hbnnhh.exec:\hbnnhh.exe83⤵
-
\??\c:\5hhhnt.exec:\5hhhnt.exe84⤵
-
\??\c:\hhbhbn.exec:\hhbhbn.exe85⤵
-
\??\c:\vvjjj.exec:\vvjjj.exe86⤵
-
\??\c:\vpddv.exec:\vpddv.exe87⤵
-
\??\c:\pppdj.exec:\pppdj.exe88⤵
-
\??\c:\xlllfll.exec:\xlllfll.exe89⤵
-
\??\c:\rrllfll.exec:\rrllfll.exe90⤵
-
\??\c:\tnnnnh.exec:\tnnnnh.exe91⤵
-
\??\c:\tbtttb.exec:\tbtttb.exe92⤵
-
\??\c:\3nbhhn.exec:\3nbhhn.exe93⤵
-
\??\c:\ddpvd.exec:\ddpvd.exe94⤵
-
\??\c:\vdjjd.exec:\vdjjd.exe95⤵
-
\??\c:\dvdjp.exec:\dvdjp.exe96⤵
-
\??\c:\xfrxflx.exec:\xfrxflx.exe97⤵
-
\??\c:\lrfrxrf.exec:\lrfrxrf.exe98⤵
-
\??\c:\xfrrxff.exec:\xfrrxff.exe99⤵
-
\??\c:\3bnnnb.exec:\3bnnnb.exe100⤵
-
\??\c:\nththb.exec:\nththb.exe101⤵
-
\??\c:\3vpdp.exec:\3vpdp.exe102⤵
-
\??\c:\dvjpp.exec:\dvjpp.exe103⤵
-
\??\c:\dpppj.exec:\dpppj.exe104⤵
-
\??\c:\1lrrlrl.exec:\1lrrlrl.exe105⤵
-
\??\c:\rxrrlrr.exec:\rxrrlrr.exe106⤵
-
\??\c:\ffxxlrf.exec:\ffxxlrf.exe107⤵
-
\??\c:\nhnnnt.exec:\nhnnnt.exe108⤵
-
\??\c:\nnhhhh.exec:\nnhhhh.exe109⤵
-
\??\c:\1vddj.exec:\1vddj.exe110⤵
-
\??\c:\ddddv.exec:\ddddv.exe111⤵
-
\??\c:\ddddv.exec:\ddddv.exe112⤵
-
\??\c:\7lrrrxx.exec:\7lrrrxx.exe113⤵
-
\??\c:\3rxffll.exec:\3rxffll.exe114⤵
-
\??\c:\rrxllxx.exec:\rrxllxx.exe115⤵
-
\??\c:\ttnhhh.exec:\ttnhhh.exe116⤵
-
\??\c:\ttbbbh.exec:\ttbbbh.exe117⤵
-
\??\c:\bhhhhn.exec:\bhhhhn.exe118⤵
-
\??\c:\jppvp.exec:\jppvp.exe119⤵
-
\??\c:\dvppj.exec:\dvppj.exe120⤵
-
\??\c:\vdjpj.exec:\vdjpj.exe121⤵
-
\??\c:\xxlllrx.exec:\xxlllrx.exe122⤵
-
\??\c:\rrxfxfx.exec:\rrxfxfx.exe123⤵
-
\??\c:\5btttb.exec:\5btttb.exe124⤵
-
\??\c:\bbtbhn.exec:\bbtbhn.exe125⤵
-
\??\c:\ttbntn.exec:\ttbntn.exe126⤵
-
\??\c:\vdjpj.exec:\vdjpj.exe127⤵
-
\??\c:\9pdjd.exec:\9pdjd.exe128⤵
-
\??\c:\9vpvp.exec:\9vpvp.exe129⤵
-
\??\c:\rxxxxfl.exec:\rxxxxfl.exe130⤵
-
\??\c:\5rllflx.exec:\5rllflx.exe131⤵
-
\??\c:\xfllxxx.exec:\xfllxxx.exe132⤵
-
\??\c:\thntbn.exec:\thntbn.exe133⤵
-
\??\c:\bbntbn.exec:\bbntbn.exe134⤵
-
\??\c:\jppvj.exec:\jppvj.exe135⤵
-
\??\c:\thnnhh.exec:\thnnhh.exe136⤵
-
\??\c:\ppdjp.exec:\ppdjp.exe137⤵
-
\??\c:\7pppp.exec:\7pppp.exe138⤵
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe139⤵
-
\??\c:\xfxxrll.exec:\xfxxrll.exe140⤵
-
\??\c:\xrflxff.exec:\xrflxff.exe141⤵
-
\??\c:\ntnhnt.exec:\ntnhnt.exe142⤵
-
\??\c:\nthhhh.exec:\nthhhh.exe143⤵
-
\??\c:\vvjjp.exec:\vvjjp.exe144⤵
-
\??\c:\lflflfx.exec:\lflflfx.exe145⤵
-
\??\c:\lxxrffx.exec:\lxxrffx.exe146⤵
-
\??\c:\ttbthb.exec:\ttbthb.exe147⤵
-
\??\c:\ntnthb.exec:\ntnthb.exe148⤵
-
\??\c:\vddvp.exec:\vddvp.exe149⤵
-
\??\c:\pdvvj.exec:\pdvvj.exe150⤵
-
\??\c:\9ppvp.exec:\9ppvp.exe151⤵
-
\??\c:\7rrxrff.exec:\7rrxrff.exe152⤵
-
\??\c:\9rlllrr.exec:\9rlllrr.exe153⤵
-
\??\c:\ttthhh.exec:\ttthhh.exe154⤵
-
\??\c:\bhhnnt.exec:\bhhnnt.exe155⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe156⤵
-
\??\c:\ppppj.exec:\ppppj.exe157⤵
-
\??\c:\lfrrxxx.exec:\lfrrxxx.exe158⤵
-
\??\c:\llxxxxl.exec:\llxxxxl.exe159⤵
-
\??\c:\thhtbt.exec:\thhtbt.exe160⤵
-
\??\c:\jppvv.exec:\jppvv.exe161⤵
-
\??\c:\jpjjj.exec:\jpjjj.exe162⤵
-
\??\c:\7ffrfff.exec:\7ffrfff.exe163⤵
-
\??\c:\llxllrr.exec:\llxllrr.exe164⤵
-
\??\c:\bbnhtn.exec:\bbnhtn.exe165⤵
-
\??\c:\jddvj.exec:\jddvj.exe166⤵
-
\??\c:\ppvjj.exec:\ppvjj.exe167⤵
-
\??\c:\fxllfxr.exec:\fxllfxr.exe168⤵
-
\??\c:\5frfrrl.exec:\5frfrrl.exe169⤵
-
\??\c:\xfffflx.exec:\xfffflx.exe170⤵
-
\??\c:\nnnnnb.exec:\nnnnnb.exe171⤵
-
\??\c:\tthhnn.exec:\tthhnn.exe172⤵
-
\??\c:\7vvpp.exec:\7vvpp.exe173⤵
-
\??\c:\9jvvj.exec:\9jvvj.exe174⤵
-
\??\c:\lfrllrl.exec:\lfrllrl.exe175⤵
-
\??\c:\fffxffx.exec:\fffxffx.exe176⤵
-
\??\c:\hbhnbn.exec:\hbhnbn.exe177⤵
-
\??\c:\hbbbnn.exec:\hbbbnn.exe178⤵
-
\??\c:\pjdpj.exec:\pjdpj.exe179⤵
-
\??\c:\ddpjd.exec:\ddpjd.exe180⤵
-
\??\c:\flflrll.exec:\flflrll.exe181⤵
-
\??\c:\fxfllll.exec:\fxfllll.exe182⤵
-
\??\c:\9bbhbt.exec:\9bbhbt.exe183⤵
-
\??\c:\hhnnnn.exec:\hhnnnn.exe184⤵
-
\??\c:\jvjvj.exec:\jvjvj.exe185⤵
-
\??\c:\vpppd.exec:\vpppd.exe186⤵
-
\??\c:\rrxxflr.exec:\rrxxflr.exe187⤵
-
\??\c:\lfffxlf.exec:\lfffxlf.exe188⤵
-
\??\c:\tnbhbb.exec:\tnbhbb.exe189⤵
-
\??\c:\djvpp.exec:\djvpp.exe190⤵
-
\??\c:\dvdpj.exec:\dvdpj.exe191⤵
-
\??\c:\xrrlffx.exec:\xrrlffx.exe192⤵
-
\??\c:\xlrrlll.exec:\xlrrlll.exe193⤵
-
\??\c:\hbnhhh.exec:\hbnhhh.exe194⤵
-
\??\c:\dvjvd.exec:\dvjvd.exe195⤵
-
\??\c:\7ddjd.exec:\7ddjd.exe196⤵
-
\??\c:\3ffxrrf.exec:\3ffxrrf.exe197⤵
-
\??\c:\rlllfxx.exec:\rlllfxx.exe198⤵
-
\??\c:\ntbnhb.exec:\ntbnhb.exe199⤵
-
\??\c:\dpjjp.exec:\dpjjp.exe200⤵
-
\??\c:\ddjjj.exec:\ddjjj.exe201⤵
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe202⤵
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe203⤵
-
\??\c:\tbbbbh.exec:\tbbbbh.exe204⤵
-
\??\c:\7hhnnt.exec:\7hhnnt.exe205⤵
-
\??\c:\pjjpd.exec:\pjjpd.exe206⤵
-
\??\c:\rxxfllr.exec:\rxxfllr.exe207⤵
-
\??\c:\xrfrxxf.exec:\xrfrxxf.exe208⤵
-
\??\c:\5nbbbb.exec:\5nbbbb.exe209⤵
-
\??\c:\pdddv.exec:\pdddv.exe210⤵
-
\??\c:\jvjjd.exec:\jvjjd.exe211⤵
-
\??\c:\rxffffl.exec:\rxffffl.exe212⤵
-
\??\c:\xlxxxfx.exec:\xlxxxfx.exe213⤵
-
\??\c:\nthhnt.exec:\nthhnt.exe214⤵
-
\??\c:\ppddv.exec:\ppddv.exe215⤵
-
\??\c:\djdvp.exec:\djdvp.exe216⤵
-
\??\c:\lllrrxf.exec:\lllrrxf.exe217⤵
-
\??\c:\nbbbbb.exec:\nbbbbb.exe218⤵
-
\??\c:\dpppj.exec:\dpppj.exe219⤵
-
\??\c:\xfxrlxr.exec:\xfxrlxr.exe220⤵
-
\??\c:\xxxffff.exec:\xxxffff.exe221⤵
-
\??\c:\tnnnhh.exec:\tnnnhh.exe222⤵
-
\??\c:\jjddj.exec:\jjddj.exe223⤵
-
\??\c:\bnhhhb.exec:\bnhhhb.exe224⤵
-
\??\c:\jppjd.exec:\jppjd.exe225⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe226⤵
-
\??\c:\rlxfxxf.exec:\rlxfxxf.exe227⤵
-
\??\c:\llfrfrx.exec:\llfrfrx.exe228⤵
-
\??\c:\dvjpp.exec:\dvjpp.exe229⤵
-
\??\c:\7thhhn.exec:\7thhhn.exe230⤵
-
\??\c:\3tbbhn.exec:\3tbbhn.exe231⤵
-
\??\c:\vdvjj.exec:\vdvjj.exe232⤵
-
\??\c:\3vvvd.exec:\3vvvd.exe233⤵
-
\??\c:\lxrrxrf.exec:\lxrrxrf.exe234⤵
-
\??\c:\1jddv.exec:\1jddv.exe235⤵
-
\??\c:\dpjpd.exec:\dpjpd.exe236⤵
-
\??\c:\xxllrff.exec:\xxllrff.exe237⤵
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe238⤵
-
\??\c:\hnnbbt.exec:\hnnbbt.exe239⤵
-
\??\c:\pvvpd.exec:\pvvpd.exe240⤵
-
\??\c:\5frrrrr.exec:\5frrrrr.exe241⤵