Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:35
Behavioral task
behavioral1
Sample
d873afa1c12ff92eb38b063191b50d70_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d873afa1c12ff92eb38b063191b50d70_NeikiAnalytics.exe
-
Size
62KB
-
MD5
d873afa1c12ff92eb38b063191b50d70
-
SHA1
2aefede21ea7231cc95e2a58739f59451eacb135
-
SHA256
4d5ea2027e761d42bb29d5d49ee647dc9dce3141f1b32acacbc22fe7030e463f
-
SHA512
07babfc56c863b1a616eb2270a27ff556d737cc758ffe84f3539aa9398f0e3b3c9d9e53e4a20d2375ac50f159de18608bcece4b3397cd78dba944bed0c1ceb55
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+EMdH:zhOmTsF93UYfwC6GIoutiTWMdH
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
Processes:
resource yara_rule behavioral1/memory/1920-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-87-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2900-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1544-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1232-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1204-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1044-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/872-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1548-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1564-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1680-550-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-561-0x0000000076AC0000-0x0000000076BDF000-memory.dmp family_blackmoon behavioral1/memory/1936-589-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-700-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-716-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-895-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2392-972-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2772-1154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1980-1191-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2272-8735-0x0000000076AC0000-0x0000000076BDF000-memory.dmp family_blackmoon behavioral1/memory/2272-16749-0x0000000076AC0000-0x0000000076BDF000-memory.dmp family_blackmoon behavioral1/memory/2272-19618-0x0000000076AC0000-0x0000000076BDF000-memory.dmp family_blackmoon behavioral1/memory/2272-34330-0x0000000076AC0000-0x0000000076BDF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frrrxfl.exethnntt.exerlxfxlx.exe3hhhtt.exe5pdvd.exe1vdvj.exe9rrlxlx.exelffrxfl.exe5btthn.exeddvdp.exerlrxxxl.exefxllrrl.exebthtbb.exevpdpv.exe1rlrffl.exe3rlflfr.exebthbhh.exe5vpvd.exevpdvd.exexxlrlrr.exehbnhtt.exevjpvd.exejvjvv.exe1xflrxx.exerrflflx.exehnhnnn.exevjddv.exe7jpdv.exeffrxrrx.exe1nbhhh.exejdvvd.exejjdpd.exefxrfffl.exefrfrrff.exenhtnnh.exe1hbbtn.exevpdjp.exe3fxlllf.exe5rxxxxf.exebntbbt.exetntbhh.exedvvdd.exevppvj.exe3xllrlr.exeffrllff.exenbtnnn.exe5tbhbb.exenhttbh.exevjvpp.exexlflfxf.exe9rfrrlf.exelflrffl.exehbntbt.exenbnttb.exe7djjp.exepjpvd.exefxrxlrl.exefxlflxr.exebthhtt.exe5bbbnt.exevppvv.exepdjpj.exe7lfllxf.exefrfflfl.exepid process 2080 frrrxfl.exe 1636 thnntt.exe 3008 rlxfxlx.exe 1908 3hhhtt.exe 2712 5pdvd.exe 2368 1vdvj.exe 2524 9rrlxlx.exe 2680 lffrxfl.exe 2728 5btthn.exe 2540 ddvdp.exe 2900 rlrxxxl.exe 1692 fxllrrl.exe 1544 bthtbb.exe 980 vpdpv.exe 2016 1rlrffl.exe 1576 3rlflfr.exe 1844 bthbhh.exe 1536 5vpvd.exe 1232 vpdvd.exe 1204 xxlrlrr.exe 2676 hbnhtt.exe 2588 vjpvd.exe 2224 jvjvv.exe 2252 1xflrxx.exe 976 rrflflx.exe 3040 hnhnnn.exe 2312 vjddv.exe 2360 7jpdv.exe 1716 ffrxrrx.exe 1772 1nbhhh.exe 340 jdvvd.exe 1768 jjdpd.exe 2828 fxrfffl.exe 2860 frfrrff.exe 2844 nhtnnh.exe 1044 1hbbtn.exe 872 vpdjp.exe 2068 3fxlllf.exe 1256 5rxxxxf.exe 1964 bntbbt.exe 2064 tntbhh.exe 2764 dvvdd.exe 1776 vppvj.exe 3008 3xllrlr.exe 2704 ffrllff.exe 2648 nbtnnn.exe 2624 5tbhbb.exe 2748 nhttbh.exe 2512 vjvpp.exe 2532 xlflfxf.exe 2680 9rfrrlf.exe 2536 lflrffl.exe 1552 hbntbt.exe 1628 nbnttb.exe 2912 7djjp.exe 1548 pjpvd.exe 1016 fxrxlrl.exe 1760 fxlflxr.exe 1892 bthhtt.exe 2416 5bbbnt.exe 1568 vppvv.exe 2160 pdjpj.exe 1436 7lfllxf.exe 2408 frfflfl.exe -
Processes:
resource yara_rule behavioral1/memory/1920-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2080-14-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thnntt.exe upx behavioral1/memory/1636-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2080-9-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\frrrxfl.exe upx behavioral1/memory/1636-20-0x00000000002C0000-0x00000000002E7000-memory.dmp upx behavioral1/memory/1636-24-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlxfxlx.exe upx C:\3hhhtt.exe upx behavioral1/memory/3008-32-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5pdvd.exe upx behavioral1/memory/2712-42-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1vdvj.exe upx C:\9rrlxlx.exe upx behavioral1/memory/2368-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lffrxfl.exe upx behavioral1/memory/2524-63-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5btthn.exe upx behavioral1/memory/2680-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddvdp.exe upx behavioral1/memory/2728-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2540-87-0x00000000002C0000-0x00000000002E7000-memory.dmp upx C:\rlrxxxl.exe upx behavioral1/memory/2900-89-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxllrrl.exe upx behavioral1/memory/2900-97-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bthtbb.exe upx behavioral1/memory/1544-105-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpdpv.exe upx behavioral1/memory/1544-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/980-114-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1rlrffl.exe upx C:\3rlflfr.exe upx behavioral1/memory/2016-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1576-137-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bthbhh.exe upx C:\5vpvd.exe upx C:\vpdvd.exe upx behavioral1/memory/1536-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1232-159-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxlrlrr.exe upx behavioral1/memory/1204-168-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbnhtt.exe upx C:\vjpvd.exe upx C:\jvjvv.exe upx behavioral1/memory/2588-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2224-190-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1xflrxx.exe upx C:\rrflflx.exe upx C:\hnhnnn.exe upx behavioral1/memory/3040-206-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjddv.exe upx C:\7jpdv.exe upx behavioral1/memory/2312-220-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffrxrrx.exe upx behavioral1/memory/1716-229-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1nbhhh.exe upx behavioral1/memory/1772-237-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdvvd.exe upx C:\jjdpd.exe upx behavioral1/memory/1768-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2860-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2860-270-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d873afa1c12ff92eb38b063191b50d70_NeikiAnalytics.exefrrrxfl.exethnntt.exerlxfxlx.exe3hhhtt.exe5pdvd.exe1vdvj.exe9rrlxlx.exelffrxfl.exe5btthn.exeddvdp.exerlrxxxl.exefxllrrl.exebthtbb.exevpdpv.exe1rlrffl.exedescription pid process target process PID 1920 wrote to memory of 2080 1920 d873afa1c12ff92eb38b063191b50d70_NeikiAnalytics.exe frrrxfl.exe PID 1920 wrote to memory of 2080 1920 d873afa1c12ff92eb38b063191b50d70_NeikiAnalytics.exe frrrxfl.exe PID 1920 wrote to memory of 2080 1920 d873afa1c12ff92eb38b063191b50d70_NeikiAnalytics.exe frrrxfl.exe PID 1920 wrote to memory of 2080 1920 d873afa1c12ff92eb38b063191b50d70_NeikiAnalytics.exe frrrxfl.exe PID 2080 wrote to memory of 1636 2080 frrrxfl.exe thnntt.exe PID 2080 wrote to memory of 1636 2080 frrrxfl.exe thnntt.exe PID 2080 wrote to memory of 1636 2080 frrrxfl.exe thnntt.exe PID 2080 wrote to memory of 1636 2080 frrrxfl.exe thnntt.exe PID 1636 wrote to memory of 3008 1636 thnntt.exe rlxfxlx.exe PID 1636 wrote to memory of 3008 1636 thnntt.exe rlxfxlx.exe PID 1636 wrote to memory of 3008 1636 thnntt.exe rlxfxlx.exe PID 1636 wrote to memory of 3008 1636 thnntt.exe rlxfxlx.exe PID 3008 wrote to memory of 1908 3008 rlxfxlx.exe 3hhhtt.exe PID 3008 wrote to memory of 1908 3008 rlxfxlx.exe 3hhhtt.exe PID 3008 wrote to memory of 1908 3008 rlxfxlx.exe 3hhhtt.exe PID 3008 wrote to memory of 1908 3008 rlxfxlx.exe 3hhhtt.exe PID 1908 wrote to memory of 2712 1908 3hhhtt.exe 5pdvd.exe PID 1908 wrote to memory of 2712 1908 3hhhtt.exe 5pdvd.exe PID 1908 wrote to memory of 2712 1908 3hhhtt.exe 5pdvd.exe PID 1908 wrote to memory of 2712 1908 3hhhtt.exe 5pdvd.exe PID 2712 wrote to memory of 2368 2712 5pdvd.exe 1vdvj.exe PID 2712 wrote to memory of 2368 2712 5pdvd.exe 1vdvj.exe PID 2712 wrote to memory of 2368 2712 5pdvd.exe 1vdvj.exe PID 2712 wrote to memory of 2368 2712 5pdvd.exe 1vdvj.exe PID 2368 wrote to memory of 2524 2368 1vdvj.exe 9rrlxlx.exe PID 2368 wrote to memory of 2524 2368 1vdvj.exe 9rrlxlx.exe PID 2368 wrote to memory of 2524 2368 1vdvj.exe 9rrlxlx.exe PID 2368 wrote to memory of 2524 2368 1vdvj.exe 9rrlxlx.exe PID 2524 wrote to memory of 2680 2524 9rrlxlx.exe lffrxfl.exe PID 2524 wrote to memory of 2680 2524 9rrlxlx.exe lffrxfl.exe PID 2524 wrote to memory of 2680 2524 9rrlxlx.exe lffrxfl.exe PID 2524 wrote to memory of 2680 2524 9rrlxlx.exe lffrxfl.exe PID 2680 wrote to memory of 2728 2680 lffrxfl.exe 5btthn.exe PID 2680 wrote to memory of 2728 2680 lffrxfl.exe 5btthn.exe PID 2680 wrote to memory of 2728 2680 lffrxfl.exe 5btthn.exe PID 2680 wrote to memory of 2728 2680 lffrxfl.exe 5btthn.exe PID 2728 wrote to memory of 2540 2728 5btthn.exe ddvdp.exe PID 2728 wrote to memory of 2540 2728 5btthn.exe ddvdp.exe PID 2728 wrote to memory of 2540 2728 5btthn.exe ddvdp.exe PID 2728 wrote to memory of 2540 2728 5btthn.exe ddvdp.exe PID 2540 wrote to memory of 2900 2540 ddvdp.exe rlrxxxl.exe PID 2540 wrote to memory of 2900 2540 ddvdp.exe rlrxxxl.exe PID 2540 wrote to memory of 2900 2540 ddvdp.exe rlrxxxl.exe PID 2540 wrote to memory of 2900 2540 ddvdp.exe rlrxxxl.exe PID 2900 wrote to memory of 1692 2900 rlrxxxl.exe fxllrrl.exe PID 2900 wrote to memory of 1692 2900 rlrxxxl.exe fxllrrl.exe PID 2900 wrote to memory of 1692 2900 rlrxxxl.exe fxllrrl.exe PID 2900 wrote to memory of 1692 2900 rlrxxxl.exe fxllrrl.exe PID 1692 wrote to memory of 1544 1692 fxllrrl.exe bthtbb.exe PID 1692 wrote to memory of 1544 1692 fxllrrl.exe bthtbb.exe PID 1692 wrote to memory of 1544 1692 fxllrrl.exe bthtbb.exe PID 1692 wrote to memory of 1544 1692 fxllrrl.exe bthtbb.exe PID 1544 wrote to memory of 980 1544 bthtbb.exe vpdpv.exe PID 1544 wrote to memory of 980 1544 bthtbb.exe vpdpv.exe PID 1544 wrote to memory of 980 1544 bthtbb.exe vpdpv.exe PID 1544 wrote to memory of 980 1544 bthtbb.exe vpdpv.exe PID 980 wrote to memory of 2016 980 vpdpv.exe 1rlrffl.exe PID 980 wrote to memory of 2016 980 vpdpv.exe 1rlrffl.exe PID 980 wrote to memory of 2016 980 vpdpv.exe 1rlrffl.exe PID 980 wrote to memory of 2016 980 vpdpv.exe 1rlrffl.exe PID 2016 wrote to memory of 1576 2016 1rlrffl.exe 3rlflfr.exe PID 2016 wrote to memory of 1576 2016 1rlrffl.exe 3rlflfr.exe PID 2016 wrote to memory of 1576 2016 1rlrffl.exe 3rlflfr.exe PID 2016 wrote to memory of 1576 2016 1rlrffl.exe 3rlflfr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d873afa1c12ff92eb38b063191b50d70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d873afa1c12ff92eb38b063191b50d70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\frrrxfl.exec:\frrrxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\thnntt.exec:\thnntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\rlxfxlx.exec:\rlxfxlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\3hhhtt.exec:\3hhhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\5pdvd.exec:\5pdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\1vdvj.exec:\1vdvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\9rrlxlx.exec:\9rrlxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\lffrxfl.exec:\lffrxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\5btthn.exec:\5btthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\ddvdp.exec:\ddvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\rlrxxxl.exec:\rlrxxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\fxllrrl.exec:\fxllrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\bthtbb.exec:\bthtbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\vpdpv.exec:\vpdpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\1rlrffl.exec:\1rlrffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\3rlflfr.exec:\3rlflfr.exe17⤵
- Executes dropped EXE
PID:1576 -
\??\c:\bthbhh.exec:\bthbhh.exe18⤵
- Executes dropped EXE
PID:1844 -
\??\c:\5vpvd.exec:\5vpvd.exe19⤵
- Executes dropped EXE
PID:1536 -
\??\c:\vpdvd.exec:\vpdvd.exe20⤵
- Executes dropped EXE
PID:1232 -
\??\c:\xxlrlrr.exec:\xxlrlrr.exe21⤵
- Executes dropped EXE
PID:1204 -
\??\c:\hbnhtt.exec:\hbnhtt.exe22⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vjpvd.exec:\vjpvd.exe23⤵
- Executes dropped EXE
PID:2588 -
\??\c:\jvjvv.exec:\jvjvv.exe24⤵
- Executes dropped EXE
PID:2224 -
\??\c:\1xflrxx.exec:\1xflrxx.exe25⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rrflflx.exec:\rrflflx.exe26⤵
- Executes dropped EXE
PID:976 -
\??\c:\hnhnnn.exec:\hnhnnn.exe27⤵
- Executes dropped EXE
PID:3040 -
\??\c:\vjddv.exec:\vjddv.exe28⤵
- Executes dropped EXE
PID:2312 -
\??\c:\7jpdv.exec:\7jpdv.exe29⤵
- Executes dropped EXE
PID:2360 -
\??\c:\ffrxrrx.exec:\ffrxrrx.exe30⤵
- Executes dropped EXE
PID:1716 -
\??\c:\1nbhhh.exec:\1nbhhh.exe31⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jdvvd.exec:\jdvvd.exe32⤵
- Executes dropped EXE
PID:340 -
\??\c:\jjdpd.exec:\jjdpd.exe33⤵
- Executes dropped EXE
PID:1768 -
\??\c:\fxrfffl.exec:\fxrfffl.exe34⤵
- Executes dropped EXE
PID:2828 -
\??\c:\frfrrff.exec:\frfrrff.exe35⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nhtnnh.exec:\nhtnnh.exe36⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1hbbtn.exec:\1hbbtn.exe37⤵
- Executes dropped EXE
PID:1044 -
\??\c:\vpdjp.exec:\vpdjp.exe38⤵
- Executes dropped EXE
PID:872 -
\??\c:\3fxlllf.exec:\3fxlllf.exe39⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5rxxxxf.exec:\5rxxxxf.exe40⤵
- Executes dropped EXE
PID:1256 -
\??\c:\bntbbt.exec:\bntbbt.exe41⤵
- Executes dropped EXE
PID:1964 -
\??\c:\tntbhh.exec:\tntbhh.exe42⤵
- Executes dropped EXE
PID:2064 -
\??\c:\dvvdd.exec:\dvvdd.exe43⤵
- Executes dropped EXE
PID:2764 -
\??\c:\vppvj.exec:\vppvj.exe44⤵
- Executes dropped EXE
PID:1776 -
\??\c:\3xllrlr.exec:\3xllrlr.exe45⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ffrllff.exec:\ffrllff.exe46⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nbtnnn.exec:\nbtnnn.exe47⤵
- Executes dropped EXE
PID:2648 -
\??\c:\5tbhbb.exec:\5tbhbb.exe48⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nhttbh.exec:\nhttbh.exe49⤵
- Executes dropped EXE
PID:2748 -
\??\c:\vjvpp.exec:\vjvpp.exe50⤵
- Executes dropped EXE
PID:2512 -
\??\c:\xlflfxf.exec:\xlflfxf.exe51⤵
- Executes dropped EXE
PID:2532 -
\??\c:\9rfrrlf.exec:\9rfrrlf.exe52⤵
- Executes dropped EXE
PID:2680 -
\??\c:\lflrffl.exec:\lflrffl.exe53⤵
- Executes dropped EXE
PID:2536 -
\??\c:\hbntbt.exec:\hbntbt.exe54⤵
- Executes dropped EXE
PID:1552 -
\??\c:\nbnttb.exec:\nbnttb.exe55⤵
- Executes dropped EXE
PID:1628 -
\??\c:\7djjp.exec:\7djjp.exe56⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pjpvd.exec:\pjpvd.exe57⤵
- Executes dropped EXE
PID:1548 -
\??\c:\fxrxlrl.exec:\fxrxlrl.exe58⤵
- Executes dropped EXE
PID:1016 -
\??\c:\fxlflxr.exec:\fxlflxr.exe59⤵
- Executes dropped EXE
PID:1760 -
\??\c:\bthhtt.exec:\bthhtt.exe60⤵
- Executes dropped EXE
PID:1892 -
\??\c:\5bbbnt.exec:\5bbbnt.exe61⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vppvv.exec:\vppvv.exe62⤵
- Executes dropped EXE
PID:1568 -
\??\c:\pdjpj.exec:\pdjpj.exe63⤵
- Executes dropped EXE
PID:2160 -
\??\c:\7lfllxf.exec:\7lfllxf.exe64⤵
- Executes dropped EXE
PID:1436 -
\??\c:\frfflfl.exec:\frfflfl.exe65⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jdvjd.exec:\jdvjd.exe66⤵PID:1356
-
\??\c:\dpdvv.exec:\dpdvv.exe67⤵PID:1232
-
\??\c:\lxlrffx.exec:\lxlrffx.exe68⤵PID:2580
-
\??\c:\lfrxflr.exec:\lfrxflr.exe69⤵PID:3012
-
\??\c:\thtnnh.exec:\thtnnh.exe70⤵PID:2344
-
\??\c:\hbnttt.exec:\hbnttt.exe71⤵PID:1032
-
\??\c:\jvpjp.exec:\jvpjp.exe72⤵PID:2232
-
\??\c:\5ddpp.exec:\5ddpp.exe73⤵PID:772
-
\??\c:\5frxxxf.exec:\5frxxxf.exe74⤵PID:1668
-
\??\c:\rlrxxxl.exec:\rlrxxxl.exe75⤵PID:2120
-
\??\c:\5btbhb.exec:\5btbhb.exe76⤵PID:2788
-
\??\c:\bthhnn.exec:\bthhnn.exe77⤵PID:1028
-
\??\c:\pdjjp.exec:\pdjjp.exe78⤵PID:1564
-
\??\c:\pjddj.exec:\pjddj.exe79⤵PID:2360
-
\??\c:\1xfrfff.exec:\1xfrfff.exe80⤵PID:924
-
\??\c:\xrxlfrl.exec:\xrxlfrl.exe81⤵PID:1756
-
\??\c:\nhthnt.exec:\nhthnt.exe82⤵PID:744
-
\??\c:\1hnbtn.exec:\1hnbtn.exe83⤵PID:3016
-
\??\c:\jvvvd.exec:\jvvvd.exe84⤵PID:2276
-
\??\c:\vpvpv.exec:\vpvpv.exe85⤵PID:572
-
\??\c:\1lrrlff.exec:\1lrrlff.exe86⤵PID:1748
-
\??\c:\xrxlrxx.exec:\xrxlrxx.exe87⤵PID:568
-
\??\c:\thtbbb.exec:\thtbbb.exe88⤵PID:1680
-
\??\c:\1tbbhb.exec:\1tbbhb.exe89⤵PID:3068
-
\??\c:\dvjvv.exec:\dvjvv.exe90⤵PID:2272
-
\??\c:\dvppd.exec:\dvppd.exe91⤵PID:2864
-
\??\c:\tnhtnn.exec:\tnhtnn.exe92⤵PID:2080
-
\??\c:\bhtntn.exec:\bhtntn.exe93⤵PID:1804
-
\??\c:\pjdvj.exec:\pjdvj.exe94⤵PID:1496
-
\??\c:\dvpvv.exec:\dvpvv.exe95⤵PID:1936
-
\??\c:\xrfrllx.exec:\xrfrllx.exe96⤵PID:2596
-
\??\c:\lxfrrxx.exec:\lxfrrxx.exe97⤵PID:2708
-
\??\c:\5nthtt.exec:\5nthtt.exe98⤵PID:2716
-
\??\c:\btnnhh.exec:\btnnhh.exe99⤵PID:2616
-
\??\c:\jvjpp.exec:\jvjpp.exe100⤵PID:2624
-
\??\c:\1vdjd.exec:\1vdjd.exe101⤵PID:2784
-
\??\c:\lxffllr.exec:\lxffllr.exe102⤵PID:2936
-
\??\c:\xxrlrxf.exec:\xxrlrxf.exe103⤵PID:2484
-
\??\c:\bbthtb.exec:\bbthtb.exe104⤵PID:2564
-
\??\c:\bntbbn.exec:\bntbbn.exe105⤵PID:2896
-
\??\c:\vdddv.exec:\vdddv.exe106⤵PID:2904
-
\??\c:\pjvjj.exec:\pjvjj.exe107⤵PID:2548
-
\??\c:\5frxffl.exec:\5frxffl.exe108⤵PID:808
-
\??\c:\ttbtth.exec:\ttbtth.exe109⤵PID:876
-
\??\c:\5nbttb.exec:\5nbttb.exe110⤵PID:1544
-
\??\c:\7vpjj.exec:\7vpjj.exe111⤵PID:1904
-
\??\c:\9jjjd.exec:\9jjjd.exe112⤵PID:804
-
\??\c:\rflflrx.exec:\rflflrx.exe113⤵PID:1468
-
\??\c:\lfxffll.exec:\lfxffll.exe114⤵PID:1568
-
\??\c:\7tthht.exec:\7tthht.exe115⤵PID:2376
-
\??\c:\hthhhh.exec:\hthhhh.exe116⤵PID:1416
-
\??\c:\3nbttt.exec:\3nbttt.exe117⤵PID:1536
-
\??\c:\dvpdj.exec:\dvpdj.exe118⤵PID:1236
-
\??\c:\jvjjj.exec:\jvjjj.exe119⤵PID:2776
-
\??\c:\rlxxrfl.exec:\rlxxrfl.exe120⤵PID:1404
-
\??\c:\bnhnnt.exec:\bnhnnt.exe121⤵PID:2256
-
\??\c:\bnhtbb.exec:\bnhtbb.exe122⤵PID:2240
-
\??\c:\hbhntt.exec:\hbhntt.exe123⤵PID:2328
-
\??\c:\jdpvj.exec:\jdpvj.exe124⤵PID:484
-
\??\c:\jvddv.exec:\jvddv.exe125⤵PID:320
-
\??\c:\5rfffff.exec:\5rfffff.exe126⤵PID:832
-
\??\c:\1rxffll.exec:\1rxffll.exe127⤵PID:2428
-
\??\c:\bbhhtt.exec:\bbhhtt.exe128⤵PID:1684
-
\??\c:\9bthhn.exec:\9bthhn.exe129⤵PID:1304
-
\??\c:\1vvdp.exec:\1vvdp.exe130⤵PID:1708
-
\??\c:\jvpjp.exec:\jvpjp.exe131⤵PID:1312
-
\??\c:\3lflrrx.exec:\3lflrrx.exe132⤵PID:1216
-
\??\c:\lxlllxx.exec:\lxlllxx.exe133⤵PID:1208
-
\??\c:\tnntht.exec:\tnntht.exe134⤵PID:3036
-
\??\c:\7hhnth.exec:\7hhnth.exe135⤵PID:1796
-
\??\c:\7dvjv.exec:\7dvjv.exe136⤵PID:1768
-
\??\c:\vjppd.exec:\vjppd.exe137⤵PID:2304
-
\??\c:\lllrrxf.exec:\lllrrxf.exe138⤵PID:2860
-
\??\c:\rfrlllx.exec:\rfrlllx.exe139⤵PID:3056
-
\??\c:\thtbbt.exec:\thtbbt.exe140⤵PID:2448
-
\??\c:\bnntbt.exec:\bnntbt.exe141⤵PID:2184
-
\??\c:\jdppd.exec:\jdppd.exe142⤵PID:1920
-
\??\c:\vjvpd.exec:\vjvpd.exe143⤵PID:1968
-
\??\c:\7lffxxf.exec:\7lffxxf.exe144⤵PID:1604
-
\??\c:\xlrfxxf.exec:\xlrfxxf.exe145⤵PID:1492
-
\??\c:\ttthnn.exec:\ttthnn.exe146⤵PID:2064
-
\??\c:\hhnnbt.exec:\hhnnbt.exe147⤵PID:2108
-
\??\c:\pdpvd.exec:\pdpvd.exe148⤵PID:2696
-
\??\c:\vpvdd.exec:\vpvdd.exe149⤵PID:2620
-
\??\c:\7xxllxl.exec:\7xxllxl.exe150⤵PID:2816
-
\??\c:\9hhntb.exec:\9hhntb.exe151⤵PID:2752
-
\??\c:\ppdjj.exec:\ppdjj.exe152⤵PID:2624
-
\??\c:\7pjvv.exec:\7pjvv.exe153⤵PID:2604
-
\??\c:\vpjdj.exec:\vpjdj.exe154⤵PID:2512
-
\??\c:\lfxxxxl.exec:\lfxxxxl.exe155⤵PID:2732
-
\??\c:\lfxlrlr.exec:\lfxlrlr.exe156⤵PID:2564
-
\??\c:\tthtbh.exec:\tthtbh.exe157⤵PID:2896
-
\??\c:\bnbhhn.exec:\bnbhhn.exe158⤵PID:2904
-
\??\c:\7ppjv.exec:\7ppjv.exe159⤵PID:2316
-
\??\c:\3jvpd.exec:\3jvpd.exe160⤵PID:2912
-
\??\c:\xrflrrx.exec:\xrflrrx.exe161⤵PID:876
-
\??\c:\lxfxflr.exec:\lxfxflr.exe162⤵PID:1544
-
\??\c:\3fxrxrx.exec:\3fxrxrx.exe163⤵PID:908
-
\??\c:\ntnthb.exec:\ntnthb.exe164⤵PID:1584
-
\??\c:\3jddj.exec:\3jddj.exe165⤵PID:1412
-
\??\c:\9pppv.exec:\9pppv.exe166⤵PID:2160
-
\??\c:\9lffxfr.exec:\9lffxfr.exe167⤵PID:2392
-
\??\c:\lflxlrx.exec:\lflxlrx.exe168⤵PID:1320
-
\??\c:\nbtttb.exec:\nbtttb.exe169⤵PID:2800
-
\??\c:\pjvdv.exec:\pjvdv.exe170⤵PID:1232
-
\??\c:\vdjvj.exec:\vdjvj.exe171⤵PID:2552
-
\??\c:\jdpjv.exec:\jdpjv.exe172⤵PID:2052
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe173⤵PID:2344
-
\??\c:\rlfrrxx.exec:\rlfrrxx.exe174⤵PID:2024
-
\??\c:\9nhnnn.exec:\9nhnnn.exe175⤵PID:2232
-
\??\c:\hbhtbb.exec:\hbhtbb.exe176⤵PID:904
-
\??\c:\jdjpd.exec:\jdjpd.exe177⤵PID:2124
-
\??\c:\jdvdd.exec:\jdvdd.exe178⤵PID:1616
-
\??\c:\xxxrfrx.exec:\xxxrfrx.exe179⤵PID:2788
-
\??\c:\xrlxlrr.exec:\xrlxlrr.exe180⤵PID:1884
-
\??\c:\1nhttb.exec:\1nhttb.exe181⤵PID:1432
-
\??\c:\tnbntb.exec:\tnbntb.exe182⤵PID:1716
-
\??\c:\jvdvp.exec:\jvdvp.exe183⤵PID:2212
-
\??\c:\ddvdd.exec:\ddvdd.exe184⤵PID:764
-
\??\c:\lffrxfl.exec:\lffrxfl.exe185⤵PID:688
-
\??\c:\xxxlrrx.exec:\xxxlrrx.exe186⤵PID:3016
-
\??\c:\nhnntt.exec:\nhnntt.exe187⤵PID:2828
-
\??\c:\9hbbtb.exec:\9hbbtb.exe188⤵PID:572
-
\??\c:\dvjjj.exec:\dvjjj.exe189⤵PID:1676
-
\??\c:\5ddjv.exec:\5ddjv.exe190⤵PID:2988
-
\??\c:\jjpvv.exec:\jjpvv.exe191⤵PID:1044
-
\??\c:\fxrxxxl.exec:\fxrxxxl.exe192⤵PID:3068
-
\??\c:\1rxffrx.exec:\1rxffrx.exe193⤵PID:2288
-
\??\c:\thtbbb.exec:\thtbbb.exe194⤵PID:1460
-
\??\c:\3bttbh.exec:\3bttbh.exe195⤵PID:1968
-
\??\c:\vpvvv.exec:\vpvvv.exe196⤵PID:2584
-
\??\c:\jvdpp.exec:\jvdpp.exe197⤵PID:2632
-
\??\c:\9lfrxfl.exec:\9lfrxfl.exe198⤵PID:2064
-
\??\c:\lfflrxl.exec:\lfflrxl.exe199⤵PID:2108
-
\??\c:\3bthtt.exec:\3bthtt.exe200⤵PID:2496
-
\??\c:\hbhntt.exec:\hbhntt.exe201⤵PID:2768
-
\??\c:\pjjvj.exec:\pjjvj.exe202⤵PID:2772
-
\??\c:\vpjpp.exec:\vpjpp.exe203⤵PID:2656
-
\??\c:\rlrlxfl.exec:\rlrlxfl.exe204⤵PID:2544
-
\??\c:\nnthnn.exec:\nnthnn.exe205⤵PID:2504
-
\??\c:\7nhntt.exec:\7nhntt.exe206⤵PID:2492
-
\??\c:\dvpvd.exec:\dvpvd.exe207⤵PID:2540
-
\??\c:\pjddj.exec:\pjddj.exe208⤵PID:1980
-
\??\c:\rlfrllf.exec:\rlfrllf.exe209⤵PID:108
-
\??\c:\tthbhh.exec:\tthbhh.exe210⤵PID:1452
-
\??\c:\pjdpv.exec:\pjdpv.exe211⤵PID:752
-
\??\c:\vppjd.exec:\vppjd.exe212⤵PID:2912
-
\??\c:\rlrxxfl.exec:\rlrxxfl.exe213⤵PID:980
-
\??\c:\rfrrflr.exec:\rfrrflr.exe214⤵PID:1904
-
\??\c:\9nhntt.exec:\9nhntt.exe215⤵PID:1944
-
\??\c:\nhnnhh.exec:\nhnnhh.exe216⤵PID:2296
-
\??\c:\hbtntb.exec:\hbtntb.exe217⤵PID:1576
-
\??\c:\vvvdj.exec:\vvvdj.exe218⤵PID:1004
-
\??\c:\jdpvv.exec:\jdpvv.exe219⤵PID:2408
-
\??\c:\rrrfffr.exec:\rrrfffr.exe220⤵PID:2916
-
\??\c:\ffxxflr.exec:\ffxxflr.exe221⤵PID:1236
-
\??\c:\hhbnbb.exec:\hhbnbb.exe222⤵PID:2776
-
\??\c:\hbthhh.exec:\hbthhh.exe223⤵PID:3012
-
\??\c:\9dvdd.exec:\9dvdd.exe224⤵PID:2348
-
\??\c:\pdppv.exec:\pdppv.exe225⤵PID:536
-
\??\c:\xrflrxx.exec:\xrflrxx.exe226⤵PID:2224
-
\??\c:\xrxfrrx.exec:\xrxfrrx.exe227⤵PID:308
-
\??\c:\3hbhhh.exec:\3hbhhh.exe228⤵PID:2460
-
\??\c:\thbbhn.exec:\thbbhn.exe229⤵PID:300
-
\??\c:\vjvjj.exec:\vjvjj.exe230⤵PID:1240
-
\??\c:\1pjjj.exec:\1pjjj.exe231⤵PID:1028
-
\??\c:\9jjpv.exec:\9jjpv.exe232⤵PID:1304
-
\??\c:\rlxlxfl.exec:\rlxlxfl.exe233⤵PID:1836
-
\??\c:\1rxlllr.exec:\1rxlllr.exe234⤵PID:776
-
\??\c:\ththbb.exec:\ththbb.exe235⤵PID:896
-
\??\c:\nnnthn.exec:\nnnthn.exe236⤵PID:552
-
\??\c:\pjvdd.exec:\pjvdd.exe237⤵PID:3036
-
\??\c:\vvppd.exec:\vvppd.exe238⤵PID:688
-
\??\c:\rllxfll.exec:\rllxfll.exe239⤵PID:2956
-
\??\c:\lfllxfl.exec:\lfllxfl.exe240⤵PID:2828
-
\??\c:\1bbbhh.exec:\1bbbhh.exe241⤵PID:572
-
\??\c:\5bntbb.exec:\5bntbb.exe242⤵PID:2200