Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 18:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe
-
Size
244KB
-
MD5
2963ed62e8506848012aeca7bbb9b4b0
-
SHA1
336f5346d76edbae51577b72b11386348335328d
-
SHA256
bc671f9b02fc13da178dda77874e283d4804c0380a733d4ed984c8c6a970a98c
-
SHA512
a405ff885a9ed5a27c299a787713c9156f043af57381a78eadff29f8c088ec9d78d5aca4e433eea631b9204bb256835132dad76be4e9b0eb71f3de2082a8ca62
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFRX:n3C9uD6AUDCa4NYmRX
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/3576-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2660-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/908-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2596-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1324-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5rfrlfx.exetnbtnn.exe3dvpj.exerxfxrlf.exexllfflf.exe1tbbhh.exethbthb.exeffrlflf.exenhnnhb.exevppjj.exetnnhnb.exe7vvvj.exelfrlffx.exe5hnhbh.exellxrlrr.exebnnhth.exehhtnnn.exevvddp.exennbbbt.exe5nttnn.exexlllfff.exe3lfrlfx.exevdjvd.exefrxrffx.exe1vjdd.exerlffffx.exe9tbthh.exehhtthh.exeddvvp.exexrfxllf.exebntnhb.exejpvpj.exerlfxrfx.exennnnbb.exejvvpp.exe3vdjd.exeflxrfrf.exenhhbbb.exethnhbt.exeppdjp.exexxxxxxf.exebbhhbb.exe3tttnt.exe5jvpp.exellxxrfx.exehbbnhn.exejdvvp.exeddjdv.exe7xflfll.exe1xrxrxr.exe7hhnnn.exejdpjd.exepppjd.exerfrlrrl.exenhbbtt.exebhhbhn.exejvddp.exelxxrxfr.exetthhnn.exe5bbtnn.exevvdvp.exelxxxxff.exehhhttt.exetbbbtt.exepid process 2524 5rfrlfx.exe 4360 tnbtnn.exe 2192 3dvpj.exe 2848 rxfxrlf.exe 2148 xllfflf.exe 2980 1tbbhh.exe 964 thbthb.exe 2572 ffrlflf.exe 3240 nhnnhb.exe 2660 vppjj.exe 540 tnnhnb.exe 4940 7vvvj.exe 1764 lfrlffx.exe 3872 5hnhbh.exe 1384 llxrlrr.exe 1596 bnnhth.exe 832 hhtnnn.exe 3660 vvddp.exe 1104 nnbbbt.exe 3112 5nttnn.exe 4984 xlllfff.exe 3160 3lfrlfx.exe 4196 vdjvd.exe 3884 frxrffx.exe 908 1vjdd.exe 2596 rlffffx.exe 1632 9tbthh.exe 1324 hhtthh.exe 2888 ddvvp.exe 4472 xrfxllf.exe 1676 bntnhb.exe 3008 jpvpj.exe 4380 rlfxrfx.exe 4812 nnnnbb.exe 2940 jvvpp.exe 3780 3vdjd.exe 1496 flxrfrf.exe 4616 nhhbbb.exe 4020 thnhbt.exe 4760 ppdjp.exe 5084 xxxxxxf.exe 4360 bbhhbb.exe 2500 3tttnt.exe 620 5jvpp.exe 3920 llxxrfx.exe 3748 hbbnhn.exe 2448 jdvvp.exe 1404 ddjdv.exe 4992 7xflfll.exe 3256 1xrxrxr.exe 4968 7hhnnn.exe 2176 jdpjd.exe 1952 pppjd.exe 4716 rfrlrrl.exe 2372 nhbbtt.exe 3584 bhhbhn.exe 2964 jvddp.exe 3792 lxxrxfr.exe 3536 tthhnn.exe 344 5bbtnn.exe 4804 vvdvp.exe 2652 lxxxxff.exe 1088 hhhttt.exe 5044 tbbbtt.exe -
Processes:
resource yara_rule behavioral2/memory/3576-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2660-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3884-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/908-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2596-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe5rfrlfx.exetnbtnn.exe3dvpj.exerxfxrlf.exexllfflf.exe1tbbhh.exethbthb.exeffrlflf.exenhnnhb.exevppjj.exetnnhnb.exe7vvvj.exelfrlffx.exe5hnhbh.exellxrlrr.exebnnhth.exehhtnnn.exevvddp.exennbbbt.exe5nttnn.exexlllfff.exedescription pid process target process PID 3576 wrote to memory of 2524 3576 2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe 5rfrlfx.exe PID 3576 wrote to memory of 2524 3576 2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe 5rfrlfx.exe PID 3576 wrote to memory of 2524 3576 2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe 5rfrlfx.exe PID 2524 wrote to memory of 4360 2524 5rfrlfx.exe tnbtnn.exe PID 2524 wrote to memory of 4360 2524 5rfrlfx.exe tnbtnn.exe PID 2524 wrote to memory of 4360 2524 5rfrlfx.exe tnbtnn.exe PID 4360 wrote to memory of 2192 4360 tnbtnn.exe 3dvpj.exe PID 4360 wrote to memory of 2192 4360 tnbtnn.exe 3dvpj.exe PID 4360 wrote to memory of 2192 4360 tnbtnn.exe 3dvpj.exe PID 2192 wrote to memory of 2848 2192 3dvpj.exe rxfxrlf.exe PID 2192 wrote to memory of 2848 2192 3dvpj.exe rxfxrlf.exe PID 2192 wrote to memory of 2848 2192 3dvpj.exe rxfxrlf.exe PID 2848 wrote to memory of 2148 2848 rxfxrlf.exe xllfflf.exe PID 2848 wrote to memory of 2148 2848 rxfxrlf.exe xllfflf.exe PID 2848 wrote to memory of 2148 2848 rxfxrlf.exe xllfflf.exe PID 2148 wrote to memory of 2980 2148 xllfflf.exe 1tbbhh.exe PID 2148 wrote to memory of 2980 2148 xllfflf.exe 1tbbhh.exe PID 2148 wrote to memory of 2980 2148 xllfflf.exe 1tbbhh.exe PID 2980 wrote to memory of 964 2980 1tbbhh.exe thbthb.exe PID 2980 wrote to memory of 964 2980 1tbbhh.exe thbthb.exe PID 2980 wrote to memory of 964 2980 1tbbhh.exe thbthb.exe PID 964 wrote to memory of 2572 964 thbthb.exe ffrlflf.exe PID 964 wrote to memory of 2572 964 thbthb.exe ffrlflf.exe PID 964 wrote to memory of 2572 964 thbthb.exe ffrlflf.exe PID 2572 wrote to memory of 3240 2572 ffrlflf.exe nhnnhb.exe PID 2572 wrote to memory of 3240 2572 ffrlflf.exe nhnnhb.exe PID 2572 wrote to memory of 3240 2572 ffrlflf.exe nhnnhb.exe PID 3240 wrote to memory of 2660 3240 nhnnhb.exe vppjj.exe PID 3240 wrote to memory of 2660 3240 nhnnhb.exe vppjj.exe PID 3240 wrote to memory of 2660 3240 nhnnhb.exe vppjj.exe PID 2660 wrote to memory of 540 2660 vppjj.exe tnnhnb.exe PID 2660 wrote to memory of 540 2660 vppjj.exe tnnhnb.exe PID 2660 wrote to memory of 540 2660 vppjj.exe tnnhnb.exe PID 540 wrote to memory of 4940 540 tnnhnb.exe 7vvvj.exe PID 540 wrote to memory of 4940 540 tnnhnb.exe 7vvvj.exe PID 540 wrote to memory of 4940 540 tnnhnb.exe 7vvvj.exe PID 4940 wrote to memory of 1764 4940 7vvvj.exe lfrlffx.exe PID 4940 wrote to memory of 1764 4940 7vvvj.exe lfrlffx.exe PID 4940 wrote to memory of 1764 4940 7vvvj.exe lfrlffx.exe PID 1764 wrote to memory of 3872 1764 lfrlffx.exe 5hnhbh.exe PID 1764 wrote to memory of 3872 1764 lfrlffx.exe 5hnhbh.exe PID 1764 wrote to memory of 3872 1764 lfrlffx.exe 5hnhbh.exe PID 3872 wrote to memory of 1384 3872 5hnhbh.exe llxrlrr.exe PID 3872 wrote to memory of 1384 3872 5hnhbh.exe llxrlrr.exe PID 3872 wrote to memory of 1384 3872 5hnhbh.exe llxrlrr.exe PID 1384 wrote to memory of 1596 1384 llxrlrr.exe bnnhth.exe PID 1384 wrote to memory of 1596 1384 llxrlrr.exe bnnhth.exe PID 1384 wrote to memory of 1596 1384 llxrlrr.exe bnnhth.exe PID 1596 wrote to memory of 832 1596 bnnhth.exe hhtnnn.exe PID 1596 wrote to memory of 832 1596 bnnhth.exe hhtnnn.exe PID 1596 wrote to memory of 832 1596 bnnhth.exe hhtnnn.exe PID 832 wrote to memory of 3660 832 hhtnnn.exe vvddp.exe PID 832 wrote to memory of 3660 832 hhtnnn.exe vvddp.exe PID 832 wrote to memory of 3660 832 hhtnnn.exe vvddp.exe PID 3660 wrote to memory of 1104 3660 vvddp.exe nnbbbt.exe PID 3660 wrote to memory of 1104 3660 vvddp.exe nnbbbt.exe PID 3660 wrote to memory of 1104 3660 vvddp.exe nnbbbt.exe PID 1104 wrote to memory of 3112 1104 nnbbbt.exe 5nttnn.exe PID 1104 wrote to memory of 3112 1104 nnbbbt.exe 5nttnn.exe PID 1104 wrote to memory of 3112 1104 nnbbbt.exe 5nttnn.exe PID 3112 wrote to memory of 4984 3112 5nttnn.exe xlllfff.exe PID 3112 wrote to memory of 4984 3112 5nttnn.exe xlllfff.exe PID 3112 wrote to memory of 4984 3112 5nttnn.exe xlllfff.exe PID 4984 wrote to memory of 3160 4984 xlllfff.exe 3lfrlfx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2963ed62e8506848012aeca7bbb9b4b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\5rfrlfx.exec:\5rfrlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\tnbtnn.exec:\tnbtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\3dvpj.exec:\3dvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\rxfxrlf.exec:\rxfxrlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\xllfflf.exec:\xllfflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\1tbbhh.exec:\1tbbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\thbthb.exec:\thbthb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\ffrlflf.exec:\ffrlflf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\nhnnhb.exec:\nhnnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\vppjj.exec:\vppjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\tnnhnb.exec:\tnnhnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\7vvvj.exec:\7vvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\lfrlffx.exec:\lfrlffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\5hnhbh.exec:\5hnhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\llxrlrr.exec:\llxrlrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\bnnhth.exec:\bnnhth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\hhtnnn.exec:\hhtnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\vvddp.exec:\vvddp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\nnbbbt.exec:\nnbbbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\5nttnn.exec:\5nttnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\xlllfff.exec:\xlllfff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\3lfrlfx.exec:\3lfrlfx.exe23⤵
- Executes dropped EXE
PID:3160 -
\??\c:\vdjvd.exec:\vdjvd.exe24⤵
- Executes dropped EXE
PID:4196 -
\??\c:\frxrffx.exec:\frxrffx.exe25⤵
- Executes dropped EXE
PID:3884 -
\??\c:\1vjdd.exec:\1vjdd.exe26⤵
- Executes dropped EXE
PID:908 -
\??\c:\rlffffx.exec:\rlffffx.exe27⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9tbthh.exec:\9tbthh.exe28⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hhtthh.exec:\hhtthh.exe29⤵
- Executes dropped EXE
PID:1324 -
\??\c:\ddvvp.exec:\ddvvp.exe30⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xrfxllf.exec:\xrfxllf.exe31⤵
- Executes dropped EXE
PID:4472 -
\??\c:\bntnhb.exec:\bntnhb.exe32⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jpvpj.exec:\jpvpj.exe33⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rlfxrfx.exec:\rlfxrfx.exe34⤵
- Executes dropped EXE
PID:4380 -
\??\c:\nnnnbb.exec:\nnnnbb.exe35⤵
- Executes dropped EXE
PID:4812 -
\??\c:\jvvpp.exec:\jvvpp.exe36⤵
- Executes dropped EXE
PID:2940 -
\??\c:\3vdjd.exec:\3vdjd.exe37⤵
- Executes dropped EXE
PID:3780 -
\??\c:\flxrfrf.exec:\flxrfrf.exe38⤵
- Executes dropped EXE
PID:1496 -
\??\c:\nhhbbb.exec:\nhhbbb.exe39⤵
- Executes dropped EXE
PID:4616 -
\??\c:\thnhbt.exec:\thnhbt.exe40⤵
- Executes dropped EXE
PID:4020 -
\??\c:\ppdjp.exec:\ppdjp.exe41⤵
- Executes dropped EXE
PID:4760 -
\??\c:\xxxxxxf.exec:\xxxxxxf.exe42⤵
- Executes dropped EXE
PID:5084 -
\??\c:\bbhhbb.exec:\bbhhbb.exe43⤵
- Executes dropped EXE
PID:4360 -
\??\c:\3tttnt.exec:\3tttnt.exe44⤵
- Executes dropped EXE
PID:2500 -
\??\c:\5jvpp.exec:\5jvpp.exe45⤵
- Executes dropped EXE
PID:620 -
\??\c:\llxxrfx.exec:\llxxrfx.exe46⤵
- Executes dropped EXE
PID:3920 -
\??\c:\hbbnhn.exec:\hbbnhn.exe47⤵
- Executes dropped EXE
PID:3748 -
\??\c:\jdvvp.exec:\jdvvp.exe48⤵
- Executes dropped EXE
PID:2448 -
\??\c:\ddjdv.exec:\ddjdv.exe49⤵
- Executes dropped EXE
PID:1404 -
\??\c:\7xflfll.exec:\7xflfll.exe50⤵
- Executes dropped EXE
PID:4992 -
\??\c:\1xrxrxr.exec:\1xrxrxr.exe51⤵
- Executes dropped EXE
PID:3256 -
\??\c:\7hhnnn.exec:\7hhnnn.exe52⤵
- Executes dropped EXE
PID:4968 -
\??\c:\jdpjd.exec:\jdpjd.exe53⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pppjd.exec:\pppjd.exe54⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rfrlrrl.exec:\rfrlrrl.exe55⤵
- Executes dropped EXE
PID:4716 -
\??\c:\nhbbtt.exec:\nhbbtt.exe56⤵
- Executes dropped EXE
PID:2372 -
\??\c:\bhhbhn.exec:\bhhbhn.exe57⤵
- Executes dropped EXE
PID:3584 -
\??\c:\jvddp.exec:\jvddp.exe58⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lxxrxfr.exec:\lxxrxfr.exe59⤵
- Executes dropped EXE
PID:3792 -
\??\c:\tthhnn.exec:\tthhnn.exe60⤵
- Executes dropped EXE
PID:3536 -
\??\c:\5bbtnn.exec:\5bbtnn.exe61⤵
- Executes dropped EXE
PID:344 -
\??\c:\vvdvp.exec:\vvdvp.exe62⤵
- Executes dropped EXE
PID:4804 -
\??\c:\lxxxxff.exec:\lxxxxff.exe63⤵
- Executes dropped EXE
PID:2652 -
\??\c:\hhhttt.exec:\hhhttt.exe64⤵
- Executes dropped EXE
PID:1088 -
\??\c:\tbbbtt.exec:\tbbbtt.exe65⤵
- Executes dropped EXE
PID:5044 -
\??\c:\jdpjj.exec:\jdpjj.exe66⤵PID:3112
-
\??\c:\pjjdd.exec:\pjjdd.exe67⤵PID:2724
-
\??\c:\rxlfxrl.exec:\rxlfxrl.exe68⤵PID:2972
-
\??\c:\nhnnnt.exec:\nhnnnt.exe69⤵PID:1052
-
\??\c:\hntnhh.exec:\hntnhh.exe70⤵PID:3888
-
\??\c:\dppjd.exec:\dppjd.exe71⤵PID:4820
-
\??\c:\lxfxrxx.exec:\lxfxrxx.exe72⤵PID:756
-
\??\c:\hnthbb.exec:\hnthbb.exe73⤵PID:4956
-
\??\c:\7jpjj.exec:\7jpjj.exe74⤵PID:400
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe75⤵PID:1324
-
\??\c:\3xxfxxr.exec:\3xxfxxr.exe76⤵PID:3492
-
\??\c:\jddvv.exec:\jddvv.exe77⤵PID:4472
-
\??\c:\ddddd.exec:\ddddd.exe78⤵PID:1676
-
\??\c:\9fllfff.exec:\9fllfff.exe79⤵PID:4364
-
\??\c:\hthbbb.exec:\hthbbb.exe80⤵PID:4416
-
\??\c:\tthhtt.exec:\tthhtt.exe81⤵PID:2496
-
\??\c:\fxfxxfx.exec:\fxfxxfx.exe82⤵PID:2892
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe83⤵PID:2276
-
\??\c:\nnbbtt.exec:\nnbbtt.exe84⤵PID:2544
-
\??\c:\tttbbh.exec:\tttbbh.exe85⤵PID:3780
-
\??\c:\vvdvp.exec:\vvdvp.exe86⤵PID:1496
-
\??\c:\9vdvv.exec:\9vdvv.exe87⤵PID:3576
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe88⤵PID:184
-
\??\c:\9fllffx.exec:\9fllffx.exe89⤵PID:1468
-
\??\c:\1ntttb.exec:\1ntttb.exe90⤵PID:5084
-
\??\c:\ddpdv.exec:\ddpdv.exe91⤵PID:1208
-
\??\c:\1vddv.exec:\1vddv.exe92⤵PID:2500
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe93⤵PID:4068
-
\??\c:\ntbbtb.exec:\ntbbtb.exe94⤵PID:4512
-
\??\c:\hbtnnh.exec:\hbtnnh.exe95⤵PID:2184
-
\??\c:\pdppp.exec:\pdppp.exe96⤵PID:868
-
\??\c:\xxfflff.exec:\xxfflff.exe97⤵PID:3372
-
\??\c:\xlrrrrl.exec:\xlrrrrl.exe98⤵PID:2880
-
\??\c:\thttnn.exec:\thttnn.exe99⤵PID:2176
-
\??\c:\9nttbb.exec:\9nttbb.exe100⤵PID:1952
-
\??\c:\pjdvp.exec:\pjdvp.exe101⤵PID:4716
-
\??\c:\dpjvd.exec:\dpjvd.exe102⤵PID:1244
-
\??\c:\frrrlll.exec:\frrrlll.exe103⤵PID:3584
-
\??\c:\tntnhh.exec:\tntnhh.exe104⤵PID:3956
-
\??\c:\xxrllll.exec:\xxrllll.exe105⤵PID:1384
-
\??\c:\bhnnhh.exec:\bhnnhh.exe106⤵PID:4832
-
\??\c:\jpvpj.exec:\jpvpj.exe107⤵PID:3660
-
\??\c:\vppjd.exec:\vppjd.exe108⤵PID:1888
-
\??\c:\fxrllfx.exec:\fxrllfx.exe109⤵PID:1104
-
\??\c:\llrrrxf.exec:\llrrrxf.exe110⤵PID:4912
-
\??\c:\nhhtnh.exec:\nhhtnh.exe111⤵PID:4456
-
\??\c:\jjpjj.exec:\jjpjj.exe112⤵PID:3788
-
\??\c:\3xlffff.exec:\3xlffff.exe113⤵PID:3988
-
\??\c:\bbbbtt.exec:\bbbbtt.exe114⤵PID:2060
-
\??\c:\nhhhbt.exec:\nhhhbt.exe115⤵PID:2856
-
\??\c:\dddvj.exec:\dddvj.exe116⤵PID:4732
-
\??\c:\flrfxxx.exec:\flrfxxx.exe117⤵PID:3524
-
\??\c:\lfxrlfr.exec:\lfxrlfr.exe118⤵PID:1676
-
\??\c:\bbntnn.exec:\bbntnn.exe119⤵PID:4008
-
\??\c:\vvjdv.exec:\vvjdv.exe120⤵PID:3992
-
\??\c:\vpppj.exec:\vpppj.exe121⤵PID:2496
-
\??\c:\flrxrxr.exec:\flrxrxr.exe122⤵PID:2892
-
\??\c:\nnbbhb.exec:\nnbbhb.exe123⤵PID:4440
-
\??\c:\vdjdv.exec:\vdjdv.exe124⤵PID:4424
-
\??\c:\vvvvp.exec:\vvvvp.exe125⤵PID:3668
-
\??\c:\lfffrxr.exec:\lfffrxr.exe126⤵PID:1364
-
\??\c:\bnttnt.exec:\bnttnt.exe127⤵PID:2524
-
\??\c:\jpddd.exec:\jpddd.exe128⤵PID:2632
-
\??\c:\lllxrff.exec:\lllxrff.exe129⤵PID:732
-
\??\c:\bnhbbh.exec:\bnhbbh.exe130⤵PID:4092
-
\??\c:\nnbbbb.exec:\nnbbbb.exe131⤵PID:620
-
\??\c:\9jppp.exec:\9jppp.exe132⤵PID:2500
-
\??\c:\xxxxxff.exec:\xxxxxff.exe133⤵PID:4068
-
\??\c:\nhhhhh.exec:\nhhhhh.exe134⤵PID:3464
-
\??\c:\vpvpp.exec:\vpvpp.exe135⤵PID:4600
-
\??\c:\rlrlffr.exec:\rlrlffr.exe136⤵PID:1480
-
\??\c:\hbnthn.exec:\hbnthn.exe137⤵PID:4664
-
\??\c:\nnbbhn.exec:\nnbbhn.exe138⤵PID:2880
-
\??\c:\ddjjd.exec:\ddjjd.exe139⤵PID:2176
-
\??\c:\lrrlffx.exec:\lrrlffx.exe140⤵PID:2372
-
\??\c:\htnhbn.exec:\htnhbn.exe141⤵PID:4612
-
\??\c:\vjpjj.exec:\vjpjj.exe142⤵PID:1244
-
\??\c:\pjjpp.exec:\pjjpp.exe143⤵PID:3516
-
\??\c:\rflflfl.exec:\rflflfl.exe144⤵PID:1728
-
\??\c:\7nntnn.exec:\7nntnn.exe145⤵PID:3792
-
\??\c:\3ppjd.exec:\3ppjd.exe146⤵PID:832
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe147⤵PID:3224
-
\??\c:\9rxxlll.exec:\9rxxlll.exe148⤵PID:3892
-
\??\c:\ppdjd.exec:\ppdjd.exe149⤵PID:660
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe150⤵PID:2540
-
\??\c:\nbnbtt.exec:\nbnbtt.exe151⤵PID:1880
-
\??\c:\vdjdv.exec:\vdjdv.exe152⤵PID:2452
-
\??\c:\pjppj.exec:\pjppj.exe153⤵PID:1968
-
\??\c:\rflllll.exec:\rflllll.exe154⤵PID:3236
-
\??\c:\xffffxx.exec:\xffffxx.exe155⤵PID:2656
-
\??\c:\bthbtn.exec:\bthbtn.exe156⤵PID:1416
-
\??\c:\pdjjd.exec:\pdjjd.exe157⤵PID:3652
-
\??\c:\jjdjj.exec:\jjdjj.exe158⤵PID:4964
-
\??\c:\xllxxff.exec:\xllxxff.exe159⤵PID:2612
-
\??\c:\nhnnhh.exec:\nhnnhh.exe160⤵PID:4416
-
\??\c:\jpjpp.exec:\jpjpp.exe161⤵PID:3676
-
\??\c:\ddvpp.exec:\ddvpp.exe162⤵PID:4980
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe163⤵PID:4436
-
\??\c:\9xxrfff.exec:\9xxrfff.exe164⤵PID:4352
-
\??\c:\nthnnb.exec:\nthnnb.exe165⤵PID:3668
-
\??\c:\dpddv.exec:\dpddv.exe166⤵PID:184
-
\??\c:\vddvv.exec:\vddvv.exe167⤵PID:4532
-
\??\c:\lxxffxl.exec:\lxxffxl.exe168⤵PID:5084
-
\??\c:\lxrxrrl.exec:\lxrxrrl.exe169⤵PID:3048
-
\??\c:\bbhbbb.exec:\bbhbbb.exe170⤵PID:1488
-
\??\c:\bbhbbt.exec:\bbhbbt.exe171⤵PID:2936
-
\??\c:\vvvpj.exec:\vvvpj.exe172⤵PID:5012
-
\??\c:\3lrrrlf.exec:\3lrrrlf.exe173⤵PID:4444
-
\??\c:\lflfxxf.exec:\lflfxxf.exe174⤵PID:3240
-
\??\c:\hhnbnb.exec:\hhnbnb.exe175⤵PID:948
-
\??\c:\vdddv.exec:\vdddv.exe176⤵PID:2620
-
\??\c:\9vdvv.exec:\9vdvv.exe177⤵PID:4460
-
\??\c:\flrrrff.exec:\flrrrff.exe178⤵PID:508
-
\??\c:\xxfxrxx.exec:\xxfxrxx.exe179⤵PID:2512
-
\??\c:\tbbttt.exec:\tbbttt.exe180⤵PID:1240
-
\??\c:\hhnhbb.exec:\hhnhbb.exe181⤵PID:2968
-
\??\c:\dpdvj.exec:\dpdvj.exe182⤵PID:3488
-
\??\c:\rflflff.exec:\rflflff.exe183⤵PID:2328
-
\??\c:\rxxxxrr.exec:\rxxxxrr.exe184⤵PID:4332
-
\??\c:\ttbtnt.exec:\ttbtnt.exe185⤵PID:4168
-
\??\c:\1tbttt.exec:\1tbttt.exe186⤵PID:4040
-
\??\c:\1jppp.exec:\1jppp.exe187⤵PID:3416
-
\??\c:\jdjjj.exec:\jdjjj.exe188⤵PID:4324
-
\??\c:\frrflfr.exec:\frrflfr.exe189⤵PID:1192
-
\??\c:\lrxrrll.exec:\lrxrrll.exe190⤵PID:1976
-
\??\c:\btnhnn.exec:\btnhnn.exe191⤵PID:1844
-
\??\c:\pdvjv.exec:\pdvjv.exe192⤵PID:3768
-
\??\c:\5vjdp.exec:\5vjdp.exe193⤵PID:4556
-
\??\c:\rrxrfxx.exec:\rrxrfxx.exe194⤵PID:2856
-
\??\c:\rlfrllf.exec:\rlfrllf.exe195⤵PID:4736
-
\??\c:\nhbtnn.exec:\nhbtnn.exe196⤵PID:4776
-
\??\c:\1tbbtt.exec:\1tbbtt.exe197⤵PID:2172
-
\??\c:\pvjdd.exec:\pvjdd.exe198⤵PID:1248
-
\??\c:\djpjd.exec:\djpjd.exe199⤵PID:4080
-
\??\c:\5rlxxxl.exec:\5rlxxxl.exe200⤵PID:4648
-
\??\c:\tnbbtt.exec:\tnbbtt.exe201⤵PID:4416
-
\??\c:\bntnnh.exec:\bntnnh.exe202⤵PID:3676
-
\??\c:\jjpjv.exec:\jjpjv.exe203⤵PID:4980
-
\??\c:\vpjjd.exec:\vpjjd.exe204⤵PID:4436
-
\??\c:\rxxrrrl.exec:\rxxrrrl.exe205⤵PID:3576
-
\??\c:\hhbbnn.exec:\hhbbnn.exe206⤵PID:3668
-
\??\c:\3tttnt.exec:\3tttnt.exe207⤵PID:184
-
\??\c:\vvjdp.exec:\vvjdp.exe208⤵PID:2260
-
\??\c:\pjjjj.exec:\pjjjj.exe209⤵PID:736
-
\??\c:\flxrlrr.exec:\flxrlrr.exe210⤵PID:3048
-
\??\c:\jvjjd.exec:\jvjjd.exe211⤵PID:512
-
\??\c:\xfrxlll.exec:\xfrxlll.exe212⤵PID:4288
-
\??\c:\fllfxxr.exec:\fllfxxr.exe213⤵PID:1216
-
\??\c:\rxrlxff.exec:\rxrlxff.exe214⤵PID:4084
-
\??\c:\xllffxx.exec:\xllffxx.exe215⤵PID:2528
-
\??\c:\htnttt.exec:\htnttt.exe216⤵PID:1508
-
\??\c:\9pdvv.exec:\9pdvv.exe217⤵PID:4564
-
\??\c:\xlrlffx.exec:\xlrlffx.exe218⤵PID:4928
-
\??\c:\ppvdd.exec:\ppvdd.exe219⤵PID:3872
-
\??\c:\rfllfxr.exec:\rfllfxr.exe220⤵PID:1484
-
\??\c:\ffxrlll.exec:\ffxrlll.exe221⤵PID:1520
-
\??\c:\tttnhh.exec:\tttnhh.exe222⤵PID:2968
-
\??\c:\pjvpd.exec:\pjvpd.exe223⤵PID:2244
-
\??\c:\pvvdj.exec:\pvvdj.exe224⤵PID:1692
-
\??\c:\rflfxxr.exec:\rflfxxr.exe225⤵PID:2652
-
\??\c:\hbbbhh.exec:\hbbbhh.exe226⤵PID:5044
-
\??\c:\hbbthh.exec:\hbbthh.exe227⤵PID:1888
-
\??\c:\vjvvv.exec:\vjvvv.exe228⤵PID:2724
-
\??\c:\frrxrrx.exec:\frrxrrx.exe229⤵PID:1052
-
\??\c:\3htnnt.exec:\3htnnt.exe230⤵PID:3888
-
\??\c:\djvvj.exec:\djvvj.exe231⤵PID:2804
-
\??\c:\vvvpv.exec:\vvvpv.exe232⤵PID:4892
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe233⤵PID:3252
-
\??\c:\bntnnn.exec:\bntnnn.exe234⤵PID:3212
-
\??\c:\tttttn.exec:\tttttn.exe235⤵PID:2856
-
\??\c:\pjppp.exec:\pjppp.exe236⤵PID:3652
-
\??\c:\fxfrllx.exec:\fxfrllx.exe237⤵PID:3040
-
\??\c:\nbnhbt.exec:\nbnhbt.exe238⤵PID:5068
-
\??\c:\pjjdd.exec:\pjjdd.exe239⤵PID:2248
-
\??\c:\ppddv.exec:\ppddv.exe240⤵PID:632
-
\??\c:\ffrrflr.exec:\ffrrflr.exe241⤵PID:1408
-
\??\c:\hnbbhb.exec:\hnbbhb.exe242⤵PID:2592