Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 12:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4facae0c37d1bb27e16d9de308e664e4f6d153ae7b1acc61be27f8c2628085c0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4facae0c37d1bb27e16d9de308e664e4f6d153ae7b1acc61be27f8c2628085c0_NeikiAnalytics.exe
-
Size
335KB
-
MD5
17d2433252f8fa89e2ad3c50505279f0
-
SHA1
ae769f27d9fd24f181b6d838be69c18ce90735de
-
SHA256
4facae0c37d1bb27e16d9de308e664e4f6d153ae7b1acc61be27f8c2628085c0
-
SHA512
84df47ef7dce3134e3e5be5d5fc97f556203b149ada4a58f5291a37d52e2ced8bad7b05910f33e3c1f6cfeb89454ee254e2e4eb32537bc6fa85f7be9598a5c46
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LCgnilBxBqwZK2q6sYTsmZDSFdBE0rXE4efx:n3C9BRo/CEilXBG2qZSlSFdBXExx
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/1920-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1124-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jjdvp.exe3rrrlrr.exepjdvj.exedvvdp.exetnbtnn.exejddpd.exehbbnbt.exepdpdv.exexfrfrrx.exeppjdv.exe5ffrfxl.exe1bbtnn.exellfrfxl.exebhbtnh.exe5rflxrf.exethhbtn.exe3rrrxxr.exetthbnn.exe9pjpj.exetnhbbb.exejpddd.exe9rlfrrl.exe3tttnn.exetbthtn.exe1jjdv.exejjpdv.exe9nnnhh.exevpddv.exevjjdv.exelfxrlfx.exefffxxlf.exelffrfxr.exebntnhh.exejdpjj.exe1rxxflf.exenhbbnh.exedppjv.exe7vvjv.exe1xxlxxl.exe9ntnbb.exebthbtb.exevpvpp.exelxfxrrl.exepjppv.exexrfrlfx.exebtbtnn.exe1hhtbt.exe9jpjv.exerlfxrlf.exehhbbtt.exepdvpd.exedvpdj.exelxlxxrr.exebbtntn.exe7ppdp.exejdjvj.exexlrlrlf.exe9ttnhb.exebtnhnh.exedvdpj.exelflxlfx.exelffxlfx.exebbhbnn.exepjpjj.exepid process 4004 jjdvp.exe 228 3rrrlrr.exe 4528 pjdvj.exe 4520 dvvdp.exe 1856 tnbtnn.exe 2640 jddpd.exe 4888 hbbnbt.exe 4652 pdpdv.exe 1912 xfrfrrx.exe 3800 ppjdv.exe 4588 5ffrfxl.exe 4912 1bbtnn.exe 3648 llfrfxl.exe 3080 bhbtnh.exe 1384 5rflxrf.exe 2752 thhbtn.exe 1188 3rrrxxr.exe 3892 tthbnn.exe 888 9pjpj.exe 4472 tnhbbb.exe 636 jpddd.exe 2516 9rlfrrl.exe 2356 3tttnn.exe 4800 tbthtn.exe 3912 1jjdv.exe 1124 jjpdv.exe 3596 9nnnhh.exe 3232 vpddv.exe 4992 vjjdv.exe 2428 lfxrlfx.exe 3600 fffxxlf.exe 4028 lffrfxr.exe 2076 bntnhh.exe 2360 jdpjj.exe 5084 1rxxflf.exe 2864 nhbbnh.exe 3560 dppjv.exe 4260 7vvjv.exe 4396 1xxlxxl.exe 4880 9ntnbb.exe 244 bthbtb.exe 4720 vpvpp.exe 3580 lxfxrrl.exe 3328 pjppv.exe 4084 xrfrlfx.exe 2932 btbtnn.exe 4380 1hhtbt.exe 4004 9jpjv.exe 756 rlfxrlf.exe 3268 hhbbtt.exe 2684 pdvpd.exe 3572 dvpdj.exe 4404 lxlxxrr.exe 3740 bbtntn.exe 1404 7ppdp.exe 460 jdjvj.exe 2840 xlrlrlf.exe 1472 9ttnhb.exe 4264 btnhnh.exe 3016 dvdpj.exe 4296 lflxlfx.exe 528 lffxlfx.exe 5008 bbhbnn.exe 4336 pjpjj.exe -
Processes:
resource yara_rule behavioral2/memory/1920-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1124-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4facae0c37d1bb27e16d9de308e664e4f6d153ae7b1acc61be27f8c2628085c0_NeikiAnalytics.exejjdvp.exe3rrrlrr.exepjdvj.exedvvdp.exetnbtnn.exejddpd.exehbbnbt.exepdpdv.exexfrfrrx.exeppjdv.exe5ffrfxl.exe1bbtnn.exellfrfxl.exebhbtnh.exe5rflxrf.exethhbtn.exe3rrrxxr.exetthbnn.exe9pjpj.exetnhbbb.exejpddd.exedescription pid process target process PID 1920 wrote to memory of 4004 1920 4facae0c37d1bb27e16d9de308e664e4f6d153ae7b1acc61be27f8c2628085c0_NeikiAnalytics.exe jjdvp.exe PID 1920 wrote to memory of 4004 1920 4facae0c37d1bb27e16d9de308e664e4f6d153ae7b1acc61be27f8c2628085c0_NeikiAnalytics.exe jjdvp.exe PID 1920 wrote to memory of 4004 1920 4facae0c37d1bb27e16d9de308e664e4f6d153ae7b1acc61be27f8c2628085c0_NeikiAnalytics.exe jjdvp.exe PID 4004 wrote to memory of 228 4004 jjdvp.exe 3rrrlrr.exe PID 4004 wrote to memory of 228 4004 jjdvp.exe 3rrrlrr.exe PID 4004 wrote to memory of 228 4004 jjdvp.exe 3rrrlrr.exe PID 228 wrote to memory of 4528 228 3rrrlrr.exe pjdvj.exe PID 228 wrote to memory of 4528 228 3rrrlrr.exe pjdvj.exe PID 228 wrote to memory of 4528 228 3rrrlrr.exe pjdvj.exe PID 4528 wrote to memory of 4520 4528 pjdvj.exe dvvdp.exe PID 4528 wrote to memory of 4520 4528 pjdvj.exe dvvdp.exe PID 4528 wrote to memory of 4520 4528 pjdvj.exe dvvdp.exe PID 4520 wrote to memory of 1856 4520 dvvdp.exe tnbtnn.exe PID 4520 wrote to memory of 1856 4520 dvvdp.exe tnbtnn.exe PID 4520 wrote to memory of 1856 4520 dvvdp.exe tnbtnn.exe PID 1856 wrote to memory of 2640 1856 tnbtnn.exe jddpd.exe PID 1856 wrote to memory of 2640 1856 tnbtnn.exe jddpd.exe PID 1856 wrote to memory of 2640 1856 tnbtnn.exe jddpd.exe PID 2640 wrote to memory of 4888 2640 jddpd.exe hbbnbt.exe PID 2640 wrote to memory of 4888 2640 jddpd.exe hbbnbt.exe PID 2640 wrote to memory of 4888 2640 jddpd.exe hbbnbt.exe PID 4888 wrote to memory of 4652 4888 hbbnbt.exe pdpdv.exe PID 4888 wrote to memory of 4652 4888 hbbnbt.exe pdpdv.exe PID 4888 wrote to memory of 4652 4888 hbbnbt.exe pdpdv.exe PID 4652 wrote to memory of 1912 4652 pdpdv.exe xfrfrrx.exe PID 4652 wrote to memory of 1912 4652 pdpdv.exe xfrfrrx.exe PID 4652 wrote to memory of 1912 4652 pdpdv.exe xfrfrrx.exe PID 1912 wrote to memory of 3800 1912 xfrfrrx.exe ppjdv.exe PID 1912 wrote to memory of 3800 1912 xfrfrrx.exe ppjdv.exe PID 1912 wrote to memory of 3800 1912 xfrfrrx.exe ppjdv.exe PID 3800 wrote to memory of 4588 3800 ppjdv.exe 5ffrfxl.exe PID 3800 wrote to memory of 4588 3800 ppjdv.exe 5ffrfxl.exe PID 3800 wrote to memory of 4588 3800 ppjdv.exe 5ffrfxl.exe PID 4588 wrote to memory of 4912 4588 5ffrfxl.exe 1bbtnn.exe PID 4588 wrote to memory of 4912 4588 5ffrfxl.exe 1bbtnn.exe PID 4588 wrote to memory of 4912 4588 5ffrfxl.exe 1bbtnn.exe PID 4912 wrote to memory of 3648 4912 1bbtnn.exe llfrfxl.exe PID 4912 wrote to memory of 3648 4912 1bbtnn.exe llfrfxl.exe PID 4912 wrote to memory of 3648 4912 1bbtnn.exe llfrfxl.exe PID 3648 wrote to memory of 3080 3648 llfrfxl.exe bhbtnh.exe PID 3648 wrote to memory of 3080 3648 llfrfxl.exe bhbtnh.exe PID 3648 wrote to memory of 3080 3648 llfrfxl.exe bhbtnh.exe PID 3080 wrote to memory of 1384 3080 bhbtnh.exe 5rflxrf.exe PID 3080 wrote to memory of 1384 3080 bhbtnh.exe 5rflxrf.exe PID 3080 wrote to memory of 1384 3080 bhbtnh.exe 5rflxrf.exe PID 1384 wrote to memory of 2752 1384 5rflxrf.exe thhbtn.exe PID 1384 wrote to memory of 2752 1384 5rflxrf.exe thhbtn.exe PID 1384 wrote to memory of 2752 1384 5rflxrf.exe thhbtn.exe PID 2752 wrote to memory of 1188 2752 thhbtn.exe 3rrrxxr.exe PID 2752 wrote to memory of 1188 2752 thhbtn.exe 3rrrxxr.exe PID 2752 wrote to memory of 1188 2752 thhbtn.exe 3rrrxxr.exe PID 1188 wrote to memory of 3892 1188 3rrrxxr.exe tthbnn.exe PID 1188 wrote to memory of 3892 1188 3rrrxxr.exe tthbnn.exe PID 1188 wrote to memory of 3892 1188 3rrrxxr.exe tthbnn.exe PID 3892 wrote to memory of 888 3892 tthbnn.exe 9pjpj.exe PID 3892 wrote to memory of 888 3892 tthbnn.exe 9pjpj.exe PID 3892 wrote to memory of 888 3892 tthbnn.exe 9pjpj.exe PID 888 wrote to memory of 4472 888 9pjpj.exe tnhbbb.exe PID 888 wrote to memory of 4472 888 9pjpj.exe tnhbbb.exe PID 888 wrote to memory of 4472 888 9pjpj.exe tnhbbb.exe PID 4472 wrote to memory of 636 4472 tnhbbb.exe jpddd.exe PID 4472 wrote to memory of 636 4472 tnhbbb.exe jpddd.exe PID 4472 wrote to memory of 636 4472 tnhbbb.exe jpddd.exe PID 636 wrote to memory of 2516 636 jpddd.exe 9rlfrrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4facae0c37d1bb27e16d9de308e664e4f6d153ae7b1acc61be27f8c2628085c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4facae0c37d1bb27e16d9de308e664e4f6d153ae7b1acc61be27f8c2628085c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\jjdvp.exec:\jjdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\3rrrlrr.exec:\3rrrlrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\pjdvj.exec:\pjdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\dvvdp.exec:\dvvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\tnbtnn.exec:\tnbtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\jddpd.exec:\jddpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\hbbnbt.exec:\hbbnbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\pdpdv.exec:\pdpdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\xfrfrrx.exec:\xfrfrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\ppjdv.exec:\ppjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\5ffrfxl.exec:\5ffrfxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\1bbtnn.exec:\1bbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\llfrfxl.exec:\llfrfxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\bhbtnh.exec:\bhbtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\5rflxrf.exec:\5rflxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\thhbtn.exec:\thhbtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\3rrrxxr.exec:\3rrrxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\tthbnn.exec:\tthbnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\9pjpj.exec:\9pjpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\tnhbbb.exec:\tnhbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\jpddd.exec:\jpddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\9rlfrrl.exec:\9rlfrrl.exe23⤵
- Executes dropped EXE
PID:2516 -
\??\c:\3tttnn.exec:\3tttnn.exe24⤵
- Executes dropped EXE
PID:2356 -
\??\c:\tbthtn.exec:\tbthtn.exe25⤵
- Executes dropped EXE
PID:4800 -
\??\c:\1jjdv.exec:\1jjdv.exe26⤵
- Executes dropped EXE
PID:3912 -
\??\c:\jjpdv.exec:\jjpdv.exe27⤵
- Executes dropped EXE
PID:1124 -
\??\c:\9nnnhh.exec:\9nnnhh.exe28⤵
- Executes dropped EXE
PID:3596 -
\??\c:\vpddv.exec:\vpddv.exe29⤵
- Executes dropped EXE
PID:3232 -
\??\c:\vjjdv.exec:\vjjdv.exe30⤵
- Executes dropped EXE
PID:4992 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe31⤵
- Executes dropped EXE
PID:2428 -
\??\c:\fffxxlf.exec:\fffxxlf.exe32⤵
- Executes dropped EXE
PID:3600 -
\??\c:\lffrfxr.exec:\lffrfxr.exe33⤵
- Executes dropped EXE
PID:4028 -
\??\c:\bntnhh.exec:\bntnhh.exe34⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jdpjj.exec:\jdpjj.exe35⤵
- Executes dropped EXE
PID:2360 -
\??\c:\1rxxflf.exec:\1rxxflf.exe36⤵
- Executes dropped EXE
PID:5084 -
\??\c:\nhbbnh.exec:\nhbbnh.exe37⤵
- Executes dropped EXE
PID:2864 -
\??\c:\dppjv.exec:\dppjv.exe38⤵
- Executes dropped EXE
PID:3560 -
\??\c:\7vvjv.exec:\7vvjv.exe39⤵
- Executes dropped EXE
PID:4260 -
\??\c:\1xxlxxl.exec:\1xxlxxl.exe40⤵
- Executes dropped EXE
PID:4396 -
\??\c:\9ntnbb.exec:\9ntnbb.exe41⤵
- Executes dropped EXE
PID:4880 -
\??\c:\bthbtb.exec:\bthbtb.exe42⤵
- Executes dropped EXE
PID:244 -
\??\c:\vpvpp.exec:\vpvpp.exe43⤵
- Executes dropped EXE
PID:4720 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe44⤵
- Executes dropped EXE
PID:3580 -
\??\c:\pjppv.exec:\pjppv.exe45⤵
- Executes dropped EXE
PID:3328 -
\??\c:\xrfrlfx.exec:\xrfrlfx.exe46⤵
- Executes dropped EXE
PID:4084 -
\??\c:\btbtnn.exec:\btbtnn.exe47⤵
- Executes dropped EXE
PID:2932 -
\??\c:\1hhtbt.exec:\1hhtbt.exe48⤵
- Executes dropped EXE
PID:4380 -
\??\c:\9jpjv.exec:\9jpjv.exe49⤵
- Executes dropped EXE
PID:4004 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe50⤵
- Executes dropped EXE
PID:756 -
\??\c:\hhbbtt.exec:\hhbbtt.exe51⤵
- Executes dropped EXE
PID:3268 -
\??\c:\pdvpd.exec:\pdvpd.exe52⤵
- Executes dropped EXE
PID:2684 -
\??\c:\dvpdj.exec:\dvpdj.exe53⤵
- Executes dropped EXE
PID:3572 -
\??\c:\lxlxxrr.exec:\lxlxxrr.exe54⤵
- Executes dropped EXE
PID:4404 -
\??\c:\bbtntn.exec:\bbtntn.exe55⤵
- Executes dropped EXE
PID:3740 -
\??\c:\7ppdp.exec:\7ppdp.exe56⤵
- Executes dropped EXE
PID:1404 -
\??\c:\jdjvj.exec:\jdjvj.exe57⤵
- Executes dropped EXE
PID:460 -
\??\c:\xlrlrlf.exec:\xlrlrlf.exe58⤵
- Executes dropped EXE
PID:2840 -
\??\c:\9ttnhb.exec:\9ttnhb.exe59⤵
- Executes dropped EXE
PID:1472 -
\??\c:\btnhnh.exec:\btnhnh.exe60⤵
- Executes dropped EXE
PID:4264 -
\??\c:\dvdpj.exec:\dvdpj.exe61⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lflxlfx.exec:\lflxlfx.exe62⤵
- Executes dropped EXE
PID:4296 -
\??\c:\lffxlfx.exec:\lffxlfx.exe63⤵
- Executes dropped EXE
PID:528 -
\??\c:\bbhbnn.exec:\bbhbnn.exe64⤵
- Executes dropped EXE
PID:5008 -
\??\c:\pjpjj.exec:\pjpjj.exe65⤵
- Executes dropped EXE
PID:4336 -
\??\c:\5vjvd.exec:\5vjvd.exe66⤵PID:4228
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe67⤵PID:3248
-
\??\c:\hntnnh.exec:\hntnnh.exe68⤵PID:1980
-
\??\c:\vvjdp.exec:\vvjdp.exe69⤵PID:2272
-
\??\c:\pdjdv.exec:\pdjdv.exe70⤵PID:4988
-
\??\c:\1xrrfff.exec:\1xrrfff.exe71⤵PID:4364
-
\??\c:\hbbtbt.exec:\hbbtbt.exe72⤵PID:532
-
\??\c:\vdddp.exec:\vdddp.exe73⤵PID:4832
-
\??\c:\5rrfrfx.exec:\5rrfrfx.exe74⤵PID:4568
-
\??\c:\rflffxx.exec:\rflffxx.exe75⤵PID:2996
-
\??\c:\5tbthb.exec:\5tbthb.exe76⤵PID:5104
-
\??\c:\vvjdp.exec:\vvjdp.exe77⤵PID:2516
-
\??\c:\pjjdp.exec:\pjjdp.exe78⤵PID:4232
-
\??\c:\3lxrrrx.exec:\3lxrrrx.exe79⤵PID:3924
-
\??\c:\5hhbtn.exec:\5hhbtn.exe80⤵PID:3888
-
\??\c:\tnnhtn.exec:\tnnhtn.exe81⤵PID:3508
-
\??\c:\jdpdv.exec:\jdpdv.exe82⤵PID:3396
-
\??\c:\frrfrfx.exec:\frrfrfx.exe83⤵PID:1780
-
\??\c:\3hhbnh.exec:\3hhbnh.exe84⤵PID:3140
-
\??\c:\3vdpp.exec:\3vdpp.exe85⤵PID:1512
-
\??\c:\rflxlfx.exec:\rflxlfx.exe86⤵PID:1620
-
\??\c:\llxxrrf.exec:\llxxrrf.exe87⤵PID:5036
-
\??\c:\hntnhb.exec:\hntnhb.exe88⤵PID:2076
-
\??\c:\vddvp.exec:\vddvp.exe89⤵PID:1580
-
\??\c:\djjdv.exec:\djjdv.exe90⤵PID:4776
-
\??\c:\9rlxrrl.exec:\9rlxrrl.exe91⤵PID:2088
-
\??\c:\hbnntt.exec:\hbnntt.exe92⤵PID:4396
-
\??\c:\djpjd.exec:\djpjd.exe93⤵PID:3088
-
\??\c:\xflfrll.exec:\xflfrll.exe94⤵PID:2576
-
\??\c:\hhbttt.exec:\hhbttt.exe95⤵PID:4968
-
\??\c:\dvdvp.exec:\dvdvp.exe96⤵PID:4020
-
\??\c:\rxrfrrf.exec:\rxrfrrf.exe97⤵PID:4384
-
\??\c:\ffllffx.exec:\ffllffx.exe98⤵PID:4316
-
\??\c:\htbtnh.exec:\htbtnh.exe99⤵PID:2932
-
\??\c:\5jdvj.exec:\5jdvj.exe100⤵PID:4344
-
\??\c:\pdjpj.exec:\pdjpj.exe101⤵PID:2956
-
\??\c:\rlfxxrr.exec:\rlfxxrr.exe102⤵PID:2120
-
\??\c:\bnnhbt.exec:\bnnhbt.exe103⤵PID:4528
-
\??\c:\7hhbtt.exec:\7hhbtt.exe104⤵PID:2444
-
\??\c:\jvvpd.exec:\jvvpd.exe105⤵PID:4836
-
\??\c:\1xrxffr.exec:\1xrxffr.exe106⤵PID:1724
-
\??\c:\rlrlllf.exec:\rlrlllf.exe107⤵PID:1864
-
\??\c:\7hbbtt.exec:\7hbbtt.exe108⤵PID:2572
-
\??\c:\vppjd.exec:\vppjd.exe109⤵PID:4644
-
\??\c:\xfxxffx.exec:\xfxxffx.exe110⤵PID:2536
-
\??\c:\rfxrrrx.exec:\rfxrrrx.exe111⤵PID:1320
-
\??\c:\nhbbbb.exec:\nhbbbb.exe112⤵PID:2336
-
\??\c:\jdddp.exec:\jdddp.exe113⤵PID:3800
-
\??\c:\dvddd.exec:\dvddd.exe114⤵PID:4632
-
\??\c:\xlfflff.exec:\xlfflff.exe115⤵PID:3548
-
\??\c:\bnnnhh.exec:\bnnnhh.exe116⤵PID:3996
-
\??\c:\pvjdp.exec:\pvjdp.exe117⤵PID:1608
-
\??\c:\7ppjv.exec:\7ppjv.exe118⤵PID:1884
-
\??\c:\5ffxrlf.exec:\5ffxrlf.exe119⤵PID:1384
-
\??\c:\htnhhh.exec:\htnhhh.exe120⤵PID:2748
-
\??\c:\djpjp.exec:\djpjp.exe121⤵PID:1036
-
\??\c:\xlffllf.exec:\xlffllf.exe122⤵PID:3616
-
\??\c:\xlxrffr.exec:\xlxrffr.exe123⤵PID:3132
-
\??\c:\tnbbhh.exec:\tnbbhh.exe124⤵PID:1468
-
\??\c:\jdvjv.exec:\jdvjv.exe125⤵PID:3808
-
\??\c:\vvvpp.exec:\vvvpp.exe126⤵PID:2836
-
\??\c:\rrrlffx.exec:\rrrlffx.exe127⤵PID:820
-
\??\c:\9thttn.exec:\9thttn.exe128⤵PID:4452
-
\??\c:\1nbthb.exec:\1nbthb.exe129⤵PID:4420
-
\??\c:\pddvv.exec:\pddvv.exe130⤵PID:3668
-
\??\c:\lxxlxrl.exec:\lxxlxrl.exe131⤵PID:1444
-
\??\c:\htbtnh.exec:\htbtnh.exe132⤵PID:3888
-
\??\c:\9ttnhn.exec:\9ttnhn.exe133⤵PID:3508
-
\??\c:\dpdvv.exec:\dpdvv.exe134⤵PID:3496
-
\??\c:\llxrfff.exec:\llxrfff.exe135⤵PID:4992
-
\??\c:\nthhbt.exec:\nthhbt.exe136⤵PID:2948
-
\??\c:\hbthtn.exec:\hbthtn.exe137⤵PID:1512
-
\??\c:\jpdjd.exec:\jpdjd.exe138⤵PID:3628
-
\??\c:\jpvpj.exec:\jpvpj.exe139⤵PID:4252
-
\??\c:\xxrlxrl.exec:\xxrlxrl.exe140⤵PID:3716
-
\??\c:\nhhbtt.exec:\nhhbtt.exe141⤵PID:1580
-
\??\c:\vjpjv.exec:\vjpjv.exe142⤵PID:2456
-
\??\c:\jdvpd.exec:\jdvpd.exe143⤵PID:2304
-
\??\c:\xrxlxrl.exec:\xrxlxrl.exe144⤵PID:4396
-
\??\c:\7bbnbb.exec:\7bbnbb.exe145⤵PID:244
-
\??\c:\ttbbnh.exec:\ttbbnh.exe146⤵PID:1676
-
\??\c:\jjjdp.exec:\jjjdp.exe147⤵PID:1988
-
\??\c:\xllrrlx.exec:\xllrrlx.exe148⤵PID:4020
-
\??\c:\hhtnhh.exec:\hhtnhh.exe149⤵PID:4348
-
\??\c:\bnbthb.exec:\bnbthb.exe150⤵PID:2188
-
\??\c:\pddpj.exec:\pddpj.exe151⤵PID:3052
-
\??\c:\vppdp.exec:\vppdp.exe152⤵PID:4508
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe153⤵PID:3612
-
\??\c:\htbthh.exec:\htbthh.exe154⤵PID:4520
-
\??\c:\1jjvd.exec:\1jjvd.exe155⤵PID:1936
-
\??\c:\pjpjv.exec:\pjpjv.exe156⤵PID:5004
-
\??\c:\rffxlff.exec:\rffxlff.exe157⤵PID:116
-
\??\c:\btttnh.exec:\btttnh.exe158⤵PID:4224
-
\??\c:\tnnbnh.exec:\tnnbnh.exe159⤵PID:1864
-
\??\c:\9jjdp.exec:\9jjdp.exe160⤵PID:2964
-
\??\c:\xrrfrrr.exec:\xrrfrrr.exe161⤵PID:3296
-
\??\c:\fxxxrrf.exec:\fxxxrrf.exe162⤵PID:4640
-
\??\c:\bbhhnn.exec:\bbhhnn.exe163⤵PID:1320
-
\??\c:\5vdpd.exec:\5vdpd.exe164⤵PID:2336
-
\??\c:\5vvpp.exec:\5vvpp.exe165⤵PID:4588
-
\??\c:\lllfxrr.exec:\lllfxrr.exe166⤵PID:5020
-
\??\c:\lffxllf.exec:\lffxllf.exe167⤵PID:1916
-
\??\c:\tbhbhb.exec:\tbhbhb.exe168⤵PID:3996
-
\??\c:\djpjv.exec:\djpjv.exe169⤵PID:1608
-
\??\c:\lrrrllf.exec:\lrrrllf.exe170⤵PID:4496
-
\??\c:\7llxrlf.exec:\7llxrlf.exe171⤵PID:1716
-
\??\c:\tnnnhh.exec:\tnnnhh.exe172⤵PID:2260
-
\??\c:\1jdjp.exec:\1jdjp.exe173⤵PID:4132
-
\??\c:\jjpjv.exec:\jjpjv.exe174⤵PID:3280
-
\??\c:\9llfxlf.exec:\9llfxlf.exe175⤵PID:1652
-
\??\c:\bnbnhb.exec:\bnbnhb.exe176⤵PID:2448
-
\??\c:\dpvpd.exec:\dpvpd.exe177⤵PID:636
-
\??\c:\jpvjv.exec:\jpvjv.exe178⤵PID:4024
-
\??\c:\lflfxfx.exec:\lflfxfx.exe179⤵PID:4452
-
\??\c:\bhhbtn.exec:\bhhbtn.exe180⤵PID:4420
-
\??\c:\hbtnbt.exec:\hbtnbt.exe181⤵PID:3668
-
\??\c:\jvvjv.exec:\jvvjv.exe182⤵PID:2024
-
\??\c:\9ffxxrr.exec:\9ffxxrr.exe183⤵PID:3888
-
\??\c:\flxrrrl.exec:\flxrrrl.exe184⤵PID:3508
-
\??\c:\ttnhbt.exec:\ttnhbt.exe185⤵PID:3496
-
\??\c:\vpjvp.exec:\vpjvp.exe186⤵PID:4276
-
\??\c:\ppvvj.exec:\ppvvj.exe187⤵PID:2948
-
\??\c:\xxfxffx.exec:\xxfxffx.exe188⤵PID:1620
-
\??\c:\xrxlfxx.exec:\xrxlfxx.exe189⤵PID:2220
-
\??\c:\hbbttn.exec:\hbbttn.exe190⤵PID:3000
-
\??\c:\ppjdp.exec:\ppjdp.exe191⤵PID:3624
-
\??\c:\dpdjv.exec:\dpdjv.exe192⤵PID:3560
-
\??\c:\9flxrrx.exec:\9flxrrx.exe193⤵PID:2088
-
\??\c:\httnhh.exec:\httnhh.exe194⤵PID:2208
-
\??\c:\jjjpp.exec:\jjjpp.exe195⤵PID:3088
-
\??\c:\dpvvj.exec:\dpvvj.exe196⤵PID:4824
-
\??\c:\xllfrlf.exec:\xllfrlf.exe197⤵PID:4968
-
\??\c:\xllfrlf.exec:\xllfrlf.exe198⤵PID:4340
-
\??\c:\ttnnbt.exec:\ttnnbt.exe199⤵PID:4256
-
\??\c:\ppdvv.exec:\ppdvv.exe200⤵PID:4524
-
\??\c:\lxlxlxr.exec:\lxlxlxr.exe201⤵PID:1080
-
\??\c:\rfllfxr.exec:\rfllfxr.exe202⤵PID:3052
-
\??\c:\bbhttt.exec:\bbhttt.exe203⤵PID:2412
-
\??\c:\9ntthh.exec:\9ntthh.exe204⤵PID:4528
-
\??\c:\3jdjd.exec:\3jdjd.exe205⤵PID:2444
-
\??\c:\rffxrrl.exec:\rffxrrl.exe206⤵PID:1936
-
\??\c:\ttbhbt.exec:\ttbhbt.exe207⤵PID:1724
-
\??\c:\tbtnbt.exec:\tbtnbt.exe208⤵PID:1388
-
\??\c:\jvdvp.exec:\jvdvp.exe209⤵PID:5060
-
\??\c:\xlrrffx.exec:\xlrrffx.exe210⤵PID:4652
-
\??\c:\hbbhtn.exec:\hbbhtn.exe211⤵PID:4144
-
\??\c:\nbnnbh.exec:\nbnnbh.exe212⤵PID:2092
-
\??\c:\vppjv.exec:\vppjv.exe213⤵PID:3800
-
\??\c:\rfxlfrf.exec:\rfxlfrf.exe214⤵PID:5000
-
\??\c:\rxlllll.exec:\rxlllll.exe215⤵PID:764
-
\??\c:\btbtnh.exec:\btbtnh.exe216⤵PID:3548
-
\??\c:\dpvpp.exec:\dpvpp.exe217⤵PID:5008
-
\??\c:\fxxrrrx.exec:\fxxrrrx.exe218⤵PID:4336
-
\??\c:\7bbbtn.exec:\7bbbtn.exe219⤵PID:3248
-
\??\c:\tnnhhb.exec:\tnnhhb.exe220⤵PID:4492
-
\??\c:\jvjvj.exec:\jvjvj.exe221⤵PID:2272
-
\??\c:\lrfxffl.exec:\lrfxffl.exe222⤵PID:1036
-
\??\c:\xflfxrl.exec:\xflfxrl.exe223⤵PID:3616
-
\??\c:\5hbnbt.exec:\5hbnbt.exe224⤵PID:5052
-
\??\c:\jvvjv.exec:\jvvjv.exe225⤵PID:5092
-
\??\c:\pdpdj.exec:\pdpdj.exe226⤵PID:4040
-
\??\c:\fxxlxfx.exec:\fxxlxfx.exe227⤵PID:3632
-
\??\c:\lxxrffx.exec:\lxxrffx.exe228⤵PID:3148
-
\??\c:\7bhbhb.exec:\7bhbhb.exe229⤵PID:3320
-
\??\c:\pvjdj.exec:\pvjdj.exe230⤵PID:1412
-
\??\c:\lrxlfxx.exec:\lrxlfxx.exe231⤵PID:3312
-
\??\c:\rflfxlf.exec:\rflfxlf.exe232⤵PID:3596
-
\??\c:\tnnhbt.exec:\tnnhbt.exe233⤵PID:4288
-
\??\c:\nhhbnh.exec:\nhhbnh.exe234⤵PID:4124
-
\??\c:\pjjdv.exec:\pjjdv.exe235⤵PID:2452
-
\??\c:\5rxrffx.exec:\5rxrffx.exe236⤵PID:4400
-
\??\c:\xxllfxr.exec:\xxllfxr.exe237⤵PID:1756
-
\??\c:\htbttn.exec:\htbttn.exe238⤵PID:3692
-
\??\c:\jdjvp.exec:\jdjvp.exe239⤵PID:3428
-
\??\c:\jdpdv.exec:\jdpdv.exe240⤵PID:4260
-
\??\c:\rrlffxf.exec:\rrlffxf.exe241⤵PID:1580
-