Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 06:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
93cf62c1ae7f3060b75b0638c8c9f810_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
93cf62c1ae7f3060b75b0638c8c9f810_NeikiAnalytics.exe
-
Size
54KB
-
MD5
93cf62c1ae7f3060b75b0638c8c9f810
-
SHA1
fea26c173bfd9f0d6b40b0bd3bb80fceca8e9216
-
SHA256
2d7dc3bbea6200b0f18dda11e8a39dc090c7efdd785d3261cd55147917c8e9ca
-
SHA512
9bf1080eab50230e0aebd6e728f75f01ad919dbf70008622ff55453d8ff3564ec5b54efed008da4c131065e3164b6a300e4bf92f2e7f52e757e8a0c382dcd656
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFE:ymb3NkkiQ3mdBjFIFE
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/32-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-34-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3492-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/840-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2972-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3784-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1596-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3800-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pjvpj.exefxfrlll.exehbttnn.exetntthb.exeppppp.exe7xxlffx.exebthbbt.exepdjjv.exejvvpd.exexrfxrlf.exe7nhbtt.exebttthb.exevvvpj.exexrrrfxx.exehtbtnn.exennbbnh.exepjddv.exepdpdd.exexrrlffx.exetnnhhh.exehbnnnh.exeppdvj.exelffrxrr.exexrlfrrx.exehhnnnn.exebbnntt.exeppppd.exejjdpv.exelrxrlff.exehbbnhb.exebttnbt.exedvjpj.exerxfffff.exedvjdd.exexrrrrxf.exe9xffxxx.exennhbtn.exetnttnh.exe3jdpj.exerffxrrl.exelfxxrlf.exenhbbtt.exepdjjd.exefxrrllf.exeffrxlfr.exehhnbth.exe9tbttn.exevddvp.exerxfxllf.exenhnnhh.exenhtnnn.exepjpjv.exevpppj.exerffxlfx.exethnnbt.exebtnnbb.exenbhhhh.exe5dvpd.exeppvpp.exefrrrrrl.exebthhbt.exe9bbbtt.exedvddv.exedvpjj.exepid process 216 pjvpj.exe 4160 fxfrlll.exe 764 hbttnn.exe 3492 tntthb.exe 1496 ppppp.exe 2044 7xxlffx.exe 452 bthbbt.exe 5064 pdjjv.exe 888 jvvpd.exe 4144 xrfxrlf.exe 2964 7nhbtt.exe 1708 bttthb.exe 840 vvvpj.exe 2360 xrrrfxx.exe 1968 htbtnn.exe 408 nnbbnh.exe 2972 pjddv.exe 4792 pdpdd.exe 1748 xrrlffx.exe 3784 tnnhhh.exe 1540 hbnnnh.exe 1596 ppdvj.exe 3800 lffrxrr.exe 3588 xrlfrrx.exe 3720 hhnnnn.exe 3500 bbnntt.exe 3928 ppppd.exe 3856 jjdpv.exe 4960 lrxrlff.exe 2996 hbbnhb.exe 3232 bttnbt.exe 2568 dvjpj.exe 4876 rxfffff.exe 2200 dvjdd.exe 3484 xrrrrxf.exe 4220 9xffxxx.exe 448 nnhbtn.exe 1812 tnttnh.exe 3616 3jdpj.exe 4644 rffxrrl.exe 4364 lfxxrlf.exe 4688 nhbbtt.exe 4908 pdjjd.exe 1004 fxrrllf.exe 1360 ffrxlfr.exe 3492 hhnbth.exe 2884 9tbttn.exe 464 vddvp.exe 1872 rxfxllf.exe 5020 nhnnhh.exe 4248 nhtnnn.exe 3416 pjpjv.exe 4544 vpppj.exe 3056 rffxlfx.exe 3980 thnnbt.exe 3600 btnnbb.exe 3620 nbhhhh.exe 1824 5dvpd.exe 4440 ppvpp.exe 5112 frrrrrl.exe 4684 bthhbt.exe 2480 9bbbtt.exe 4704 dvddv.exe 4624 dvpjj.exe -
Processes:
resource yara_rule behavioral2/memory/32-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/840-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2360-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2972-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3784-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1596-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3800-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
93cf62c1ae7f3060b75b0638c8c9f810_NeikiAnalytics.exepjvpj.exefxfrlll.exehbttnn.exetntthb.exeppppp.exe7xxlffx.exebthbbt.exepdjjv.exejvvpd.exexrfxrlf.exe7nhbtt.exebttthb.exevvvpj.exexrrrfxx.exehtbtnn.exennbbnh.exepjddv.exepdpdd.exexrrlffx.exetnnhhh.exehbnnnh.exedescription pid process target process PID 32 wrote to memory of 216 32 93cf62c1ae7f3060b75b0638c8c9f810_NeikiAnalytics.exe pjvpj.exe PID 32 wrote to memory of 216 32 93cf62c1ae7f3060b75b0638c8c9f810_NeikiAnalytics.exe pjvpj.exe PID 32 wrote to memory of 216 32 93cf62c1ae7f3060b75b0638c8c9f810_NeikiAnalytics.exe pjvpj.exe PID 216 wrote to memory of 4160 216 pjvpj.exe fxfrlll.exe PID 216 wrote to memory of 4160 216 pjvpj.exe fxfrlll.exe PID 216 wrote to memory of 4160 216 pjvpj.exe fxfrlll.exe PID 4160 wrote to memory of 764 4160 fxfrlll.exe hbttnn.exe PID 4160 wrote to memory of 764 4160 fxfrlll.exe hbttnn.exe PID 4160 wrote to memory of 764 4160 fxfrlll.exe hbttnn.exe PID 764 wrote to memory of 3492 764 hbttnn.exe tntthb.exe PID 764 wrote to memory of 3492 764 hbttnn.exe tntthb.exe PID 764 wrote to memory of 3492 764 hbttnn.exe tntthb.exe PID 3492 wrote to memory of 1496 3492 tntthb.exe ppppp.exe PID 3492 wrote to memory of 1496 3492 tntthb.exe ppppp.exe PID 3492 wrote to memory of 1496 3492 tntthb.exe ppppp.exe PID 1496 wrote to memory of 2044 1496 ppppp.exe 7xxlffx.exe PID 1496 wrote to memory of 2044 1496 ppppp.exe 7xxlffx.exe PID 1496 wrote to memory of 2044 1496 ppppp.exe 7xxlffx.exe PID 2044 wrote to memory of 452 2044 7xxlffx.exe bthbbt.exe PID 2044 wrote to memory of 452 2044 7xxlffx.exe bthbbt.exe PID 2044 wrote to memory of 452 2044 7xxlffx.exe bthbbt.exe PID 452 wrote to memory of 5064 452 bthbbt.exe pdjjv.exe PID 452 wrote to memory of 5064 452 bthbbt.exe pdjjv.exe PID 452 wrote to memory of 5064 452 bthbbt.exe pdjjv.exe PID 5064 wrote to memory of 888 5064 pdjjv.exe jvvpd.exe PID 5064 wrote to memory of 888 5064 pdjjv.exe jvvpd.exe PID 5064 wrote to memory of 888 5064 pdjjv.exe jvvpd.exe PID 888 wrote to memory of 4144 888 jvvpd.exe xrfxrlf.exe PID 888 wrote to memory of 4144 888 jvvpd.exe xrfxrlf.exe PID 888 wrote to memory of 4144 888 jvvpd.exe xrfxrlf.exe PID 4144 wrote to memory of 2964 4144 xrfxrlf.exe 7nhbtt.exe PID 4144 wrote to memory of 2964 4144 xrfxrlf.exe 7nhbtt.exe PID 4144 wrote to memory of 2964 4144 xrfxrlf.exe 7nhbtt.exe PID 2964 wrote to memory of 1708 2964 7nhbtt.exe bttthb.exe PID 2964 wrote to memory of 1708 2964 7nhbtt.exe bttthb.exe PID 2964 wrote to memory of 1708 2964 7nhbtt.exe bttthb.exe PID 1708 wrote to memory of 840 1708 bttthb.exe vvvpj.exe PID 1708 wrote to memory of 840 1708 bttthb.exe vvvpj.exe PID 1708 wrote to memory of 840 1708 bttthb.exe vvvpj.exe PID 840 wrote to memory of 2360 840 vvvpj.exe xrrrfxx.exe PID 840 wrote to memory of 2360 840 vvvpj.exe xrrrfxx.exe PID 840 wrote to memory of 2360 840 vvvpj.exe xrrrfxx.exe PID 2360 wrote to memory of 1968 2360 xrrrfxx.exe htbtnn.exe PID 2360 wrote to memory of 1968 2360 xrrrfxx.exe htbtnn.exe PID 2360 wrote to memory of 1968 2360 xrrrfxx.exe htbtnn.exe PID 1968 wrote to memory of 408 1968 htbtnn.exe nnbbnh.exe PID 1968 wrote to memory of 408 1968 htbtnn.exe nnbbnh.exe PID 1968 wrote to memory of 408 1968 htbtnn.exe nnbbnh.exe PID 408 wrote to memory of 2972 408 nnbbnh.exe pjddv.exe PID 408 wrote to memory of 2972 408 nnbbnh.exe pjddv.exe PID 408 wrote to memory of 2972 408 nnbbnh.exe pjddv.exe PID 2972 wrote to memory of 4792 2972 pjddv.exe pdpdd.exe PID 2972 wrote to memory of 4792 2972 pjddv.exe pdpdd.exe PID 2972 wrote to memory of 4792 2972 pjddv.exe pdpdd.exe PID 4792 wrote to memory of 1748 4792 pdpdd.exe xrrlffx.exe PID 4792 wrote to memory of 1748 4792 pdpdd.exe xrrlffx.exe PID 4792 wrote to memory of 1748 4792 pdpdd.exe xrrlffx.exe PID 1748 wrote to memory of 3784 1748 xrrlffx.exe tnnhhh.exe PID 1748 wrote to memory of 3784 1748 xrrlffx.exe tnnhhh.exe PID 1748 wrote to memory of 3784 1748 xrrlffx.exe tnnhhh.exe PID 3784 wrote to memory of 1540 3784 tnnhhh.exe hbnnnh.exe PID 3784 wrote to memory of 1540 3784 tnnhhh.exe hbnnnh.exe PID 3784 wrote to memory of 1540 3784 tnnhhh.exe hbnnnh.exe PID 1540 wrote to memory of 1596 1540 hbnnnh.exe ppdvj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\93cf62c1ae7f3060b75b0638c8c9f810_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\93cf62c1ae7f3060b75b0638c8c9f810_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\pjvpj.exec:\pjvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\fxfrlll.exec:\fxfrlll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\hbttnn.exec:\hbttnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\tntthb.exec:\tntthb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\ppppp.exec:\ppppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\7xxlffx.exec:\7xxlffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\bthbbt.exec:\bthbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\pdjjv.exec:\pdjjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\jvvpd.exec:\jvvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\xrfxrlf.exec:\xrfxrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\7nhbtt.exec:\7nhbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\bttthb.exec:\bttthb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\vvvpj.exec:\vvvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\xrrrfxx.exec:\xrrrfxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\htbtnn.exec:\htbtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\nnbbnh.exec:\nnbbnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\pjddv.exec:\pjddv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\pdpdd.exec:\pdpdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\xrrlffx.exec:\xrrlffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\tnnhhh.exec:\tnnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\hbnnnh.exec:\hbnnnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\ppdvj.exec:\ppdvj.exe23⤵
- Executes dropped EXE
PID:1596 -
\??\c:\lffrxrr.exec:\lffrxrr.exe24⤵
- Executes dropped EXE
PID:3800 -
\??\c:\xrlfrrx.exec:\xrlfrrx.exe25⤵
- Executes dropped EXE
PID:3588 -
\??\c:\hhnnnn.exec:\hhnnnn.exe26⤵
- Executes dropped EXE
PID:3720 -
\??\c:\bbnntt.exec:\bbnntt.exe27⤵
- Executes dropped EXE
PID:3500 -
\??\c:\ppppd.exec:\ppppd.exe28⤵
- Executes dropped EXE
PID:3928 -
\??\c:\jjdpv.exec:\jjdpv.exe29⤵
- Executes dropped EXE
PID:3856 -
\??\c:\lrxrlff.exec:\lrxrlff.exe30⤵
- Executes dropped EXE
PID:4960 -
\??\c:\hbbnhb.exec:\hbbnhb.exe31⤵
- Executes dropped EXE
PID:2996 -
\??\c:\bttnbt.exec:\bttnbt.exe32⤵
- Executes dropped EXE
PID:3232 -
\??\c:\dvjpj.exec:\dvjpj.exe33⤵
- Executes dropped EXE
PID:2568 -
\??\c:\rxfffff.exec:\rxfffff.exe34⤵
- Executes dropped EXE
PID:4876 -
\??\c:\dvjdd.exec:\dvjdd.exe35⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xrrrrxf.exec:\xrrrrxf.exe36⤵
- Executes dropped EXE
PID:3484 -
\??\c:\9xffxxx.exec:\9xffxxx.exe37⤵
- Executes dropped EXE
PID:4220 -
\??\c:\nnhbtn.exec:\nnhbtn.exe38⤵
- Executes dropped EXE
PID:448 -
\??\c:\tnttnh.exec:\tnttnh.exe39⤵
- Executes dropped EXE
PID:1812 -
\??\c:\3jdpj.exec:\3jdpj.exe40⤵
- Executes dropped EXE
PID:3616 -
\??\c:\rffxrrl.exec:\rffxrrl.exe41⤵
- Executes dropped EXE
PID:4644 -
\??\c:\lfxxrlf.exec:\lfxxrlf.exe42⤵
- Executes dropped EXE
PID:4364 -
\??\c:\nhbbtt.exec:\nhbbtt.exe43⤵
- Executes dropped EXE
PID:4688 -
\??\c:\pdjjd.exec:\pdjjd.exe44⤵
- Executes dropped EXE
PID:4908 -
\??\c:\fxrrllf.exec:\fxrrllf.exe45⤵
- Executes dropped EXE
PID:1004 -
\??\c:\ffrxlfr.exec:\ffrxlfr.exe46⤵
- Executes dropped EXE
PID:1360 -
\??\c:\hhnbth.exec:\hhnbth.exe47⤵
- Executes dropped EXE
PID:3492 -
\??\c:\9tbttn.exec:\9tbttn.exe48⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vddvp.exec:\vddvp.exe49⤵
- Executes dropped EXE
PID:464 -
\??\c:\rxfxllf.exec:\rxfxllf.exe50⤵
- Executes dropped EXE
PID:1872 -
\??\c:\nhnnhh.exec:\nhnnhh.exe51⤵
- Executes dropped EXE
PID:5020 -
\??\c:\nhtnnn.exec:\nhtnnn.exe52⤵
- Executes dropped EXE
PID:4248 -
\??\c:\pjpjv.exec:\pjpjv.exe53⤵
- Executes dropped EXE
PID:3416 -
\??\c:\vpppj.exec:\vpppj.exe54⤵
- Executes dropped EXE
PID:4544 -
\??\c:\rffxlfx.exec:\rffxlfx.exe55⤵
- Executes dropped EXE
PID:3056 -
\??\c:\thnnbt.exec:\thnnbt.exe56⤵
- Executes dropped EXE
PID:3980 -
\??\c:\btnnbb.exec:\btnnbb.exe57⤵
- Executes dropped EXE
PID:3600 -
\??\c:\nbhhhh.exec:\nbhhhh.exe58⤵
- Executes dropped EXE
PID:3620 -
\??\c:\5dvpd.exec:\5dvpd.exe59⤵
- Executes dropped EXE
PID:1824 -
\??\c:\ppvpp.exec:\ppvpp.exe60⤵
- Executes dropped EXE
PID:4440 -
\??\c:\frrrrrl.exec:\frrrrrl.exe61⤵
- Executes dropped EXE
PID:5112 -
\??\c:\bthhbt.exec:\bthhbt.exe62⤵
- Executes dropped EXE
PID:4684 -
\??\c:\9bbbtt.exec:\9bbbtt.exe63⤵
- Executes dropped EXE
PID:2480 -
\??\c:\dvddv.exec:\dvddv.exe64⤵
- Executes dropped EXE
PID:4704 -
\??\c:\dvpjj.exec:\dvpjj.exe65⤵
- Executes dropped EXE
PID:4624 -
\??\c:\xlrllxr.exec:\xlrllxr.exe66⤵PID:1068
-
\??\c:\xffxlll.exec:\xffxlll.exe67⤵PID:3784
-
\??\c:\9tthbt.exec:\9tthbt.exe68⤵PID:1540
-
\??\c:\nbbhnh.exec:\nbbhnh.exe69⤵PID:4088
-
\??\c:\bnhthh.exec:\bnhthh.exe70⤵PID:4696
-
\??\c:\dpjpd.exec:\dpjpd.exe71⤵PID:3348
-
\??\c:\pvppj.exec:\pvppj.exe72⤵PID:1604
-
\??\c:\xflffxr.exec:\xflffxr.exe73⤵PID:3720
-
\??\c:\rxxxlrx.exec:\rxxxlrx.exe74⤵PID:3248
-
\??\c:\3nhtnn.exec:\3nhtnn.exe75⤵PID:4740
-
\??\c:\hnhnht.exec:\hnhnht.exe76⤵PID:4720
-
\??\c:\pjpdp.exec:\pjpdp.exe77⤵PID:2432
-
\??\c:\jdjdv.exec:\jdjdv.exe78⤵PID:3808
-
\??\c:\vdvpj.exec:\vdvpj.exe79⤵PID:3464
-
\??\c:\frfxllf.exec:\frfxllf.exe80⤵PID:2268
-
\??\c:\rlfxlff.exec:\rlfxlff.exe81⤵PID:3772
-
\??\c:\9tthhn.exec:\9tthhn.exe82⤵PID:2104
-
\??\c:\9hbbtt.exec:\9hbbtt.exe83⤵PID:1792
-
\??\c:\jdvpd.exec:\jdvpd.exe84⤵PID:628
-
\??\c:\ppdvp.exec:\ppdvp.exe85⤵PID:116
-
\??\c:\xffxxrl.exec:\xffxxrl.exe86⤵PID:4220
-
\??\c:\btnnhh.exec:\btnnhh.exe87⤵PID:448
-
\??\c:\pjjdv.exec:\pjjdv.exe88⤵PID:1812
-
\??\c:\xxfrlxr.exec:\xxfrlxr.exe89⤵PID:1000
-
\??\c:\1llfxxr.exec:\1llfxxr.exe90⤵PID:4352
-
\??\c:\hbhbhh.exec:\hbhbhh.exe91⤵PID:3264
-
\??\c:\dvjdv.exec:\dvjdv.exe92⤵PID:2464
-
\??\c:\pjvpv.exec:\pjvpv.exe93⤵PID:3092
-
\??\c:\fxxrfxx.exec:\fxxrfxx.exe94⤵PID:1360
-
\??\c:\hhhhnn.exec:\hhhhnn.exe95⤵PID:2624
-
\??\c:\thhbnn.exec:\thhbnn.exe96⤵PID:4020
-
\??\c:\dppjd.exec:\dppjd.exe97⤵PID:2780
-
\??\c:\flrfffx.exec:\flrfffx.exe98⤵PID:2604
-
\??\c:\fxxlllf.exec:\fxxlllf.exe99⤵PID:2892
-
\??\c:\ttthth.exec:\ttthth.exe100⤵PID:4248
-
\??\c:\5jpjv.exec:\5jpjv.exe101⤵PID:1728
-
\??\c:\rfrfrrx.exec:\rfrfrrx.exe102⤵PID:2188
-
\??\c:\btnnhh.exec:\btnnhh.exe103⤵PID:3056
-
\??\c:\bnhbnb.exec:\bnhbnb.exe104⤵PID:3948
-
\??\c:\3pvpj.exec:\3pvpj.exe105⤵PID:3600
-
\??\c:\fxfxllr.exec:\fxfxllr.exe106⤵PID:3620
-
\??\c:\lxrrrrl.exec:\lxrrrrl.exe107⤵PID:1824
-
\??\c:\btbbtn.exec:\btbbtn.exe108⤵PID:4440
-
\??\c:\nbbbtt.exec:\nbbbtt.exe109⤵PID:5112
-
\??\c:\vppjj.exec:\vppjj.exe110⤵PID:4684
-
\??\c:\rfrlfxl.exec:\rfrlfxl.exe111⤵PID:2920
-
\??\c:\rlrrffx.exec:\rlrrffx.exe112⤵PID:1220
-
\??\c:\btbbbb.exec:\btbbbb.exe113⤵PID:4708
-
\??\c:\ntthnb.exec:\ntthnb.exe114⤵PID:1068
-
\??\c:\dpdvp.exec:\dpdvp.exe115⤵PID:752
-
\??\c:\rlffrrr.exec:\rlffrrr.exe116⤵PID:528
-
\??\c:\fffxrrl.exec:\fffxrrl.exe117⤵PID:3444
-
\??\c:\tbtthh.exec:\tbtthh.exe118⤵PID:3588
-
\??\c:\htbnhh.exec:\htbnhh.exe119⤵PID:4116
-
\??\c:\ddvjv.exec:\ddvjv.exe120⤵PID:4940
-
\??\c:\3fxrllf.exec:\3fxrllf.exe121⤵PID:3624
-
\??\c:\xfllffl.exec:\xfllffl.exe122⤵PID:5016
-
\??\c:\7lllfxx.exec:\7lllfxx.exe123⤵PID:4024
-
\??\c:\btbttt.exec:\btbttt.exe124⤵PID:2560
-
\??\c:\tntnbt.exec:\tntnbt.exe125⤵PID:3076
-
\??\c:\ppjdd.exec:\ppjdd.exe126⤵PID:2160
-
\??\c:\vjvpp.exec:\vjvpp.exe127⤵PID:3564
-
\??\c:\jjppv.exec:\jjppv.exe128⤵PID:2868
-
\??\c:\xrxflrx.exec:\xrxflrx.exe129⤵PID:1404
-
\??\c:\fxfflfx.exec:\fxfflfx.exe130⤵PID:388
-
\??\c:\xlrllfx.exec:\xlrllfx.exe131⤵PID:1216
-
\??\c:\hbtnhn.exec:\hbtnhn.exe132⤵PID:2968
-
\??\c:\5hbtnh.exec:\5hbtnh.exe133⤵PID:2832
-
\??\c:\dpjdv.exec:\dpjdv.exe134⤵PID:1356
-
\??\c:\jpppj.exec:\jpppj.exe135⤵PID:400
-
\??\c:\rlrlrlx.exec:\rlrlrlx.exe136⤵PID:376
-
\??\c:\xlrrxll.exec:\xlrrxll.exe137⤵PID:4476
-
\??\c:\1hhhbb.exec:\1hhhbb.exe138⤵PID:3956
-
\??\c:\tbhhbh.exec:\tbhhbh.exe139⤵PID:1496
-
\??\c:\thbbnh.exec:\thbbnh.exe140⤵PID:3392
-
\??\c:\7vvpj.exec:\7vvpj.exe141⤵PID:2932
-
\??\c:\vvvpj.exec:\vvvpj.exe142⤵PID:4020
-
\??\c:\xrxxlfx.exec:\xrxxlfx.exe143⤵PID:2680
-
\??\c:\7rxxrrl.exec:\7rxxrrl.exe144⤵PID:5076
-
\??\c:\rrllrrx.exec:\rrllrrx.exe145⤵PID:4928
-
\??\c:\9tnhhb.exec:\9tnhhb.exe146⤵PID:3568
-
\??\c:\1hhnth.exec:\1hhnth.exe147⤵PID:4692
-
\??\c:\jpvpj.exec:\jpvpj.exe148⤵PID:5028
-
\??\c:\jjpjp.exec:\jjpjp.exe149⤵PID:4656
-
\??\c:\rffrllf.exec:\rffrllf.exe150⤵PID:3096
-
\??\c:\djdvp.exec:\djdvp.exe151⤵PID:392
-
\??\c:\dpjdp.exec:\dpjdp.exe152⤵PID:1176
-
\??\c:\xxxlrxl.exec:\xxxlrxl.exe153⤵PID:2232
-
\??\c:\frrlfxr.exec:\frrlfxr.exe154⤵PID:2384
-
\??\c:\1ntnnn.exec:\1ntnnn.exe155⤵PID:5072
-
\??\c:\httnhh.exec:\httnhh.exe156⤵PID:552
-
\??\c:\vvppp.exec:\vvppp.exe157⤵PID:1056
-
\??\c:\pjpjv.exec:\pjpjv.exe158⤵PID:3444
-
\??\c:\fxxlfxr.exec:\fxxlfxr.exe159⤵PID:1604
-
\??\c:\3tnhbb.exec:\3tnhbb.exe160⤵PID:2084
-
\??\c:\nhhbbb.exec:\nhhbbb.exe161⤵PID:3660
-
\??\c:\vjppj.exec:\vjppj.exe162⤵PID:880
-
\??\c:\vdvjv.exec:\vdvjv.exe163⤵PID:3236
-
\??\c:\lxfrrrl.exec:\lxfrrrl.exe164⤵PID:4212
-
\??\c:\rxfxxrl.exec:\rxfxxrl.exe165⤵PID:2636
-
\??\c:\1nthhn.exec:\1nthhn.exe166⤵PID:4208
-
\??\c:\7djdv.exec:\7djdv.exe167⤵PID:2568
-
\??\c:\flrllfx.exec:\flrllfx.exe168⤵PID:1740
-
\??\c:\9ffxxxx.exec:\9ffxxxx.exe169⤵PID:2104
-
\??\c:\3hbttb.exec:\3hbttb.exe170⤵PID:2324
-
\??\c:\nnbthh.exec:\nnbthh.exe171⤵PID:116
-
\??\c:\jjjdd.exec:\jjjdd.exe172⤵PID:952
-
\??\c:\vjdvj.exec:\vjdvj.exe173⤵PID:2968
-
\??\c:\lffxfxx.exec:\lffxfxx.exe174⤵PID:2400
-
\??\c:\rfrrxxx.exec:\rfrrxxx.exe175⤵PID:3916
-
\??\c:\1nnhbb.exec:\1nnhbb.exe176⤵PID:4908
-
\??\c:\5nhhbh.exec:\5nhhbh.exe177⤵PID:2464
-
\??\c:\pjjdv.exec:\pjjdv.exe178⤵PID:4148
-
\??\c:\vvpjj.exec:\vvpjj.exe179⤵PID:3492
-
\??\c:\xrllrrr.exec:\xrllrrr.exe180⤵PID:4360
-
\??\c:\5hnhnn.exec:\5hnhnn.exe181⤵PID:2208
-
\??\c:\dvppp.exec:\dvppp.exe182⤵PID:464
-
\??\c:\3rxrrlx.exec:\3rxrrlx.exe183⤵PID:2892
-
\??\c:\bhthbb.exec:\bhthbb.exe184⤵PID:2680
-
\??\c:\5flffrx.exec:\5flffrx.exe185⤵PID:4384
-
\??\c:\xlllfxx.exec:\xlllfxx.exe186⤵PID:2964
-
\??\c:\3tnnhh.exec:\3tnnhh.exe187⤵PID:3728
-
\??\c:\lffxrrl.exec:\lffxrrl.exe188⤵PID:5012
-
\??\c:\bnnbnt.exec:\bnnbnt.exe189⤵PID:2948
-
\??\c:\nhbttn.exec:\nhbttn.exe190⤵PID:3904
-
\??\c:\vjjpp.exec:\vjjpp.exe191⤵PID:1088
-
\??\c:\jvdvp.exec:\jvdvp.exe192⤵PID:1176
-
\??\c:\9xrlffx.exec:\9xrlffx.exe193⤵PID:1220
-
\??\c:\rfrlrll.exec:\rfrlrll.exe194⤵PID:2384
-
\??\c:\hnnnhh.exec:\hnnnhh.exe195⤵PID:4088
-
\??\c:\hnnnnh.exec:\hnnnnh.exe196⤵PID:4488
-
\??\c:\9pvpj.exec:\9pvpj.exe197⤵PID:3140
-
\??\c:\vjpjj.exec:\vjpjj.exe198⤵PID:4312
-
\??\c:\vjpvv.exec:\vjpvv.exe199⤵PID:3760
-
\??\c:\frxrlll.exec:\frxrlll.exe200⤵PID:872
-
\??\c:\frxxrrl.exec:\frxxrrl.exe201⤵PID:3660
-
\??\c:\htbhbn.exec:\htbhbn.exe202⤵PID:880
-
\??\c:\tnnnhh.exec:\tnnnhh.exe203⤵PID:2432
-
\??\c:\dpvpv.exec:\dpvpv.exe204⤵PID:3260
-
\??\c:\dpvpp.exec:\dpvpp.exe205⤵PID:2636
-
\??\c:\pvdvp.exec:\pvdvp.exe206⤵PID:3528
-
\??\c:\3xxxlrr.exec:\3xxxlrr.exe207⤵PID:1404
-
\??\c:\lfxrrlf.exec:\lfxrrlf.exe208⤵PID:704
-
\??\c:\hbhbhh.exec:\hbhbhh.exe209⤵PID:1216
-
\??\c:\nhbtnh.exec:\nhbtnh.exe210⤵PID:116
-
\??\c:\htbnnn.exec:\htbnnn.exe211⤵PID:3616
-
\??\c:\7pppj.exec:\7pppj.exe212⤵PID:1356
-
\??\c:\vjjjv.exec:\vjjjv.exe213⤵PID:3396
-
\??\c:\1frlllr.exec:\1frlllr.exe214⤵PID:3188
-
\??\c:\flffrrl.exec:\flffrrl.exe215⤵PID:376
-
\??\c:\9tnhbt.exec:\9tnhbt.exe216⤵PID:5084
-
\??\c:\tnhhbh.exec:\tnhhbh.exe217⤵PID:5052
-
\??\c:\3jjdd.exec:\3jjdd.exe218⤵PID:3392
-
\??\c:\vjjpj.exec:\vjjpj.exe219⤵PID:452
-
\??\c:\pdjjd.exec:\pdjjd.exe220⤵PID:4020
-
\??\c:\9lllfll.exec:\9lllfll.exe221⤵PID:4864
-
\??\c:\thnnhh.exec:\thnnhh.exe222⤵PID:4248
-
\??\c:\hbnnhh.exec:\hbnnhh.exe223⤵PID:1064
-
\??\c:\3pvpd.exec:\3pvpd.exe224⤵PID:4492
-
\??\c:\vvvdp.exec:\vvvdp.exe225⤵PID:4692
-
\??\c:\lllfxfx.exec:\lllfxfx.exe226⤵PID:4632
-
\??\c:\1fxfllr.exec:\1fxfllr.exe227⤵PID:5012
-
\??\c:\7xxrffx.exec:\7xxrffx.exe228⤵PID:1052
-
\??\c:\nbhhnn.exec:\nbhhnn.exe229⤵PID:3300
-
\??\c:\thnnhh.exec:\thnnhh.exe230⤵PID:1748
-
\??\c:\ddvpj.exec:\ddvpj.exe231⤵PID:3124
-
\??\c:\pdpdv.exec:\pdpdv.exe232⤵PID:1596
-
\??\c:\xxrrfxx.exec:\xxrrfxx.exe233⤵PID:3784
-
\??\c:\rfrlfxl.exec:\rfrlfxl.exe234⤵PID:1824
-
\??\c:\lfxrffr.exec:\lfxrffr.exe235⤵PID:628
-
\??\c:\tbnhtn.exec:\tbnhtn.exe236⤵PID:4088
-
\??\c:\tbhbhh.exec:\tbhbhh.exe237⤵PID:4936
-
\??\c:\vjvpj.exec:\vjvpj.exe238⤵PID:3140
-
\??\c:\vdppv.exec:\vdppv.exe239⤵PID:3724
-
\??\c:\djdvd.exec:\djdvd.exe240⤵PID:4388
-
\??\c:\rflfrxr.exec:\rflfrxr.exe241⤵PID:872
-
\??\c:\xxffffx.exec:\xxffffx.exe242⤵PID:2860