Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 10:49
Behavioral task
behavioral1
Sample
47a611a6179a1a1cf8a30bc02b20cad0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
47a611a6179a1a1cf8a30bc02b20cad0_NeikiAnalytics.exe
-
Size
328KB
-
MD5
47a611a6179a1a1cf8a30bc02b20cad0
-
SHA1
e53be27e43cf6d5632a9633ae87583fb524fc173
-
SHA256
0ac2d2b89bff167b4323ecd3ae7b7cd48e9372187c92d66bd32100c1a365708e
-
SHA512
8adf55dd97589c3c49afa57b088ad06153ede82c3c7505f3867a725a1ae8d0d60438e36424e1e3dc98ab58d1884e879dbe61f70d838bf527d05111c2c4d8dd78
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR:R4wFHoSHYHUrAwfMp3CDR
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/2964-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2092-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/828-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2144-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/588-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1476-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/292-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1752-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-305-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2580-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/800-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-649-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-726-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-808-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2972-871-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1760-1150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-1166-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2352-13889-0x0000000077820000-0x000000007793F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dpjdd.exenhnhnn.exepjppd.exefxfflll.exenhtntn.exexlfflxr.exepdjdp.exexxffrrf.exedjjvd.exefllfrlx.exebtntht.exedpjvj.exexllflfr.exeddvdp.exerxlflrf.exebnttth.exejdvdv.exehnnhth.exefxrrxxx.exe3nthnn.exeppvjj.exentnnnn.exedjjjp.exe5lxfrfl.exehbbnht.exehhhnbt.exefxlxfll.exellflrrl.exehtnbtb.exedvvjd.exelfrrlfl.exebnnbtt.exefrrrllr.exebbtntb.exe5nhhbb.exedvpdv.exefffxlxl.exebntbht.exejjvvd.exedjjpd.exeffrxllf.exehbntbn.exebtbnbb.exevddpd.exelrxllxr.exebbthtb.exejjvpv.exedjjpd.exelxllxrf.exenntbht.exedvpvv.exejpdvv.exelrfllll.exennhntn.exedvjpd.exerrrxfrf.exehhnthh.exetbtttn.exedvpjd.exeffrrfxr.exenhbntn.exe9tbthb.exe1ppvd.exelxfxxxx.exepid process 2552 dpjdd.exe 2092 nhnhnn.exe 2560 pjppd.exe 2676 fxfflll.exe 2620 nhtntn.exe 2788 xlfflxr.exe 2876 pdjdp.exe 2640 xxffrrf.exe 2480 djjvd.exe 2856 fllfrlx.exe 2128 btntht.exe 2764 dpjvj.exe 2732 xllflfr.exe 1148 ddvdp.exe 2720 rxlflrf.exe 2896 bnttth.exe 828 jdvdv.exe 1800 hnnhth.exe 2144 fxrrxxx.exe 1616 3nthnn.exe 1976 ppvjj.exe 588 ntnnnn.exe 1128 djjjp.exe 1476 5lxfrfl.exe 1916 hbbnht.exe 1928 hhhnbt.exe 2432 fxlxfll.exe 2168 llflrrl.exe 1612 htnbtb.exe 856 dvvjd.exe 292 lfrrlfl.exe 1980 bnnbtt.exe 1752 frrrllr.exe 2088 bbtntb.exe 2076 5nhhbb.exe 1684 dvpdv.exe 1664 fffxlxl.exe 1952 bntbht.exe 2244 jjvvd.exe 2924 djjpd.exe 2148 ffrxllf.exe 2976 hbntbn.exe 2576 btbnbb.exe 2072 vddpd.exe 2680 lrxllxr.exe 2596 bbthtb.exe 1764 jjvpv.exe 1184 djjpd.exe 2804 lxllxrf.exe 2684 nntbht.exe 1940 dvpvv.exe 2580 jpdvv.exe 2032 lrfllll.exe 1112 nnhntn.exe 2064 dvjpd.exe 2484 rrrxfrf.exe 2528 hhnthh.exe 1956 tbtttn.exe 2340 dvpjd.exe 1148 ffrrfxr.exe 2864 nhbntn.exe 3052 9tbthb.exe 1376 1ppvd.exe 2104 lxfxxxx.exe -
Processes:
resource yara_rule behavioral1/memory/2964-1-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dpjdd.exe upx behavioral1/memory/2552-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhnhnn.exe upx behavioral1/memory/2552-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2560-26-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjppd.exe upx behavioral1/memory/2092-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-34-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxfflll.exe upx C:\nhtntn.exe upx behavioral1/memory/2620-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2620-47-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlfflxr.exe upx C:\pdjdp.exe upx C:\xxffrrf.exe upx behavioral1/memory/2876-63-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djjvd.exe upx behavioral1/memory/2640-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2480-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fllfrlx.exe upx behavioral1/memory/2480-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2856-89-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btntht.exe upx C:\dpjvj.exe upx C:\xllflfr.exe upx behavioral1/memory/2764-104-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddvdp.exe upx behavioral1/memory/2732-112-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxlflrf.exe upx C:\bnttth.exe upx behavioral1/memory/2720-127-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdvdv.exe upx behavioral1/memory/828-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1800-144-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnnhth.exe upx behavioral1/memory/1800-151-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxrrxxx.exe upx behavioral1/memory/2144-159-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3nthnn.exe upx C:\ppvjj.exe upx behavioral1/memory/1976-169-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ntnnnn.exe upx C:\djjjp.exe upx behavioral1/memory/588-183-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5lxfrfl.exe upx behavioral1/memory/1476-198-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbbnht.exe upx C:\hhhnbt.exe upx C:\fxlxfll.exe upx behavioral1/memory/2432-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2432-221-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llflrrl.exe upx behavioral1/memory/2168-229-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htnbtb.exe upx behavioral1/memory/1612-232-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dvvjd.exe upx \??\c:\lfrrlfl.exe upx behavioral1/memory/292-247-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnnbtt.exe upx behavioral1/memory/1752-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1952-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2924-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2072-319-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
47a611a6179a1a1cf8a30bc02b20cad0_NeikiAnalytics.exedpjdd.exenhnhnn.exepjppd.exefxfflll.exenhtntn.exexlfflxr.exepdjdp.exexxffrrf.exedjjvd.exefllfrlx.exebtntht.exedpjvj.exexllflfr.exeddvdp.exerxlflrf.exedescription pid process target process PID 2964 wrote to memory of 2552 2964 47a611a6179a1a1cf8a30bc02b20cad0_NeikiAnalytics.exe dpjdd.exe PID 2964 wrote to memory of 2552 2964 47a611a6179a1a1cf8a30bc02b20cad0_NeikiAnalytics.exe dpjdd.exe PID 2964 wrote to memory of 2552 2964 47a611a6179a1a1cf8a30bc02b20cad0_NeikiAnalytics.exe dpjdd.exe PID 2964 wrote to memory of 2552 2964 47a611a6179a1a1cf8a30bc02b20cad0_NeikiAnalytics.exe dpjdd.exe PID 2552 wrote to memory of 2092 2552 dpjdd.exe nhnhnn.exe PID 2552 wrote to memory of 2092 2552 dpjdd.exe nhnhnn.exe PID 2552 wrote to memory of 2092 2552 dpjdd.exe nhnhnn.exe PID 2552 wrote to memory of 2092 2552 dpjdd.exe nhnhnn.exe PID 2092 wrote to memory of 2560 2092 nhnhnn.exe pjppd.exe PID 2092 wrote to memory of 2560 2092 nhnhnn.exe pjppd.exe PID 2092 wrote to memory of 2560 2092 nhnhnn.exe pjppd.exe PID 2092 wrote to memory of 2560 2092 nhnhnn.exe pjppd.exe PID 2560 wrote to memory of 2676 2560 pjppd.exe fxfflll.exe PID 2560 wrote to memory of 2676 2560 pjppd.exe fxfflll.exe PID 2560 wrote to memory of 2676 2560 pjppd.exe fxfflll.exe PID 2560 wrote to memory of 2676 2560 pjppd.exe fxfflll.exe PID 2676 wrote to memory of 2620 2676 fxfflll.exe nhtntn.exe PID 2676 wrote to memory of 2620 2676 fxfflll.exe nhtntn.exe PID 2676 wrote to memory of 2620 2676 fxfflll.exe nhtntn.exe PID 2676 wrote to memory of 2620 2676 fxfflll.exe nhtntn.exe PID 2620 wrote to memory of 2788 2620 nhtntn.exe xlfflxr.exe PID 2620 wrote to memory of 2788 2620 nhtntn.exe xlfflxr.exe PID 2620 wrote to memory of 2788 2620 nhtntn.exe xlfflxr.exe PID 2620 wrote to memory of 2788 2620 nhtntn.exe xlfflxr.exe PID 2788 wrote to memory of 2876 2788 xlfflxr.exe pdjdp.exe PID 2788 wrote to memory of 2876 2788 xlfflxr.exe pdjdp.exe PID 2788 wrote to memory of 2876 2788 xlfflxr.exe pdjdp.exe PID 2788 wrote to memory of 2876 2788 xlfflxr.exe pdjdp.exe PID 2876 wrote to memory of 2640 2876 pdjdp.exe xxffrrf.exe PID 2876 wrote to memory of 2640 2876 pdjdp.exe xxffrrf.exe PID 2876 wrote to memory of 2640 2876 pdjdp.exe xxffrrf.exe PID 2876 wrote to memory of 2640 2876 pdjdp.exe xxffrrf.exe PID 2640 wrote to memory of 2480 2640 xxffrrf.exe djjvd.exe PID 2640 wrote to memory of 2480 2640 xxffrrf.exe djjvd.exe PID 2640 wrote to memory of 2480 2640 xxffrrf.exe djjvd.exe PID 2640 wrote to memory of 2480 2640 xxffrrf.exe djjvd.exe PID 2480 wrote to memory of 2856 2480 djjvd.exe fllfrlx.exe PID 2480 wrote to memory of 2856 2480 djjvd.exe fllfrlx.exe PID 2480 wrote to memory of 2856 2480 djjvd.exe fllfrlx.exe PID 2480 wrote to memory of 2856 2480 djjvd.exe fllfrlx.exe PID 2856 wrote to memory of 2128 2856 fllfrlx.exe btntht.exe PID 2856 wrote to memory of 2128 2856 fllfrlx.exe btntht.exe PID 2856 wrote to memory of 2128 2856 fllfrlx.exe btntht.exe PID 2856 wrote to memory of 2128 2856 fllfrlx.exe btntht.exe PID 2128 wrote to memory of 2764 2128 btntht.exe dpjvj.exe PID 2128 wrote to memory of 2764 2128 btntht.exe dpjvj.exe PID 2128 wrote to memory of 2764 2128 btntht.exe dpjvj.exe PID 2128 wrote to memory of 2764 2128 btntht.exe dpjvj.exe PID 2764 wrote to memory of 2732 2764 dpjvj.exe xllflfr.exe PID 2764 wrote to memory of 2732 2764 dpjvj.exe xllflfr.exe PID 2764 wrote to memory of 2732 2764 dpjvj.exe xllflfr.exe PID 2764 wrote to memory of 2732 2764 dpjvj.exe xllflfr.exe PID 2732 wrote to memory of 1148 2732 xllflfr.exe ddvdp.exe PID 2732 wrote to memory of 1148 2732 xllflfr.exe ddvdp.exe PID 2732 wrote to memory of 1148 2732 xllflfr.exe ddvdp.exe PID 2732 wrote to memory of 1148 2732 xllflfr.exe ddvdp.exe PID 1148 wrote to memory of 2720 1148 ddvdp.exe rxlflrf.exe PID 1148 wrote to memory of 2720 1148 ddvdp.exe rxlflrf.exe PID 1148 wrote to memory of 2720 1148 ddvdp.exe rxlflrf.exe PID 1148 wrote to memory of 2720 1148 ddvdp.exe rxlflrf.exe PID 2720 wrote to memory of 2896 2720 rxlflrf.exe bnttth.exe PID 2720 wrote to memory of 2896 2720 rxlflrf.exe bnttth.exe PID 2720 wrote to memory of 2896 2720 rxlflrf.exe bnttth.exe PID 2720 wrote to memory of 2896 2720 rxlflrf.exe bnttth.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\47a611a6179a1a1cf8a30bc02b20cad0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\47a611a6179a1a1cf8a30bc02b20cad0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\dpjdd.exec:\dpjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\nhnhnn.exec:\nhnhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\pjppd.exec:\pjppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\fxfflll.exec:\fxfflll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\nhtntn.exec:\nhtntn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xlfflxr.exec:\xlfflxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\pdjdp.exec:\pdjdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\xxffrrf.exec:\xxffrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\djjvd.exec:\djjvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\fllfrlx.exec:\fllfrlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\btntht.exec:\btntht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\dpjvj.exec:\dpjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\xllflfr.exec:\xllflfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\ddvdp.exec:\ddvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\rxlflrf.exec:\rxlflrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\bnttth.exec:\bnttth.exe17⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jdvdv.exec:\jdvdv.exe18⤵
- Executes dropped EXE
PID:828 -
\??\c:\hnnhth.exec:\hnnhth.exe19⤵
- Executes dropped EXE
PID:1800 -
\??\c:\fxrrxxx.exec:\fxrrxxx.exe20⤵
- Executes dropped EXE
PID:2144 -
\??\c:\3nthnn.exec:\3nthnn.exe21⤵
- Executes dropped EXE
PID:1616 -
\??\c:\ppvjj.exec:\ppvjj.exe22⤵
- Executes dropped EXE
PID:1976 -
\??\c:\ntnnnn.exec:\ntnnnn.exe23⤵
- Executes dropped EXE
PID:588 -
\??\c:\djjjp.exec:\djjjp.exe24⤵
- Executes dropped EXE
PID:1128 -
\??\c:\5lxfrfl.exec:\5lxfrfl.exe25⤵
- Executes dropped EXE
PID:1476 -
\??\c:\hbbnht.exec:\hbbnht.exe26⤵
- Executes dropped EXE
PID:1916 -
\??\c:\hhhnbt.exec:\hhhnbt.exe27⤵
- Executes dropped EXE
PID:1928 -
\??\c:\fxlxfll.exec:\fxlxfll.exe28⤵
- Executes dropped EXE
PID:2432 -
\??\c:\llflrrl.exec:\llflrrl.exe29⤵
- Executes dropped EXE
PID:2168 -
\??\c:\htnbtb.exec:\htnbtb.exe30⤵
- Executes dropped EXE
PID:1612 -
\??\c:\dvvjd.exec:\dvvjd.exe31⤵
- Executes dropped EXE
PID:856 -
\??\c:\lfrrlfl.exec:\lfrrlfl.exe32⤵
- Executes dropped EXE
PID:292 -
\??\c:\bnnbtt.exec:\bnnbtt.exe33⤵
- Executes dropped EXE
PID:1980 -
\??\c:\frrrllr.exec:\frrrllr.exe34⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bbtntb.exec:\bbtntb.exe35⤵
- Executes dropped EXE
PID:2088 -
\??\c:\5nhhbb.exec:\5nhhbb.exe36⤵
- Executes dropped EXE
PID:2076 -
\??\c:\dvpdv.exec:\dvpdv.exe37⤵
- Executes dropped EXE
PID:1684 -
\??\c:\fffxlxl.exec:\fffxlxl.exe38⤵
- Executes dropped EXE
PID:1664 -
\??\c:\bntbht.exec:\bntbht.exe39⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jjvvd.exec:\jjvvd.exe40⤵
- Executes dropped EXE
PID:2244 -
\??\c:\djjpd.exec:\djjpd.exe41⤵
- Executes dropped EXE
PID:2924 -
\??\c:\ffrxllf.exec:\ffrxllf.exe42⤵
- Executes dropped EXE
PID:2148 -
\??\c:\hbntbn.exec:\hbntbn.exe43⤵
- Executes dropped EXE
PID:2976 -
\??\c:\btbnbb.exec:\btbnbb.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vddpd.exec:\vddpd.exe45⤵
- Executes dropped EXE
PID:2072 -
\??\c:\lrxllxr.exec:\lrxllxr.exe46⤵
- Executes dropped EXE
PID:2680 -
\??\c:\bbthtb.exec:\bbthtb.exe47⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jjvpv.exec:\jjvpv.exe48⤵
- Executes dropped EXE
PID:1764 -
\??\c:\djjpd.exec:\djjpd.exe49⤵
- Executes dropped EXE
PID:1184 -
\??\c:\lxllxrf.exec:\lxllxrf.exe50⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nntbht.exec:\nntbht.exe51⤵
- Executes dropped EXE
PID:2684 -
\??\c:\dvpvv.exec:\dvpvv.exe52⤵
- Executes dropped EXE
PID:1940 -
\??\c:\jpdvv.exec:\jpdvv.exe53⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lrfllll.exec:\lrfllll.exe54⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nnhntn.exec:\nnhntn.exe55⤵
- Executes dropped EXE
PID:1112 -
\??\c:\dvjpd.exec:\dvjpd.exe56⤵
- Executes dropped EXE
PID:2064 -
\??\c:\rrrxfrf.exec:\rrrxfrf.exe57⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hhnthh.exec:\hhnthh.exe58⤵
- Executes dropped EXE
PID:2528 -
\??\c:\tbtttn.exec:\tbtttn.exe59⤵
- Executes dropped EXE
PID:1956 -
\??\c:\dvpjd.exec:\dvpjd.exe60⤵
- Executes dropped EXE
PID:2340 -
\??\c:\ffrrfxr.exec:\ffrrfxr.exe61⤵
- Executes dropped EXE
PID:1148 -
\??\c:\nhbntn.exec:\nhbntn.exe62⤵
- Executes dropped EXE
PID:2864 -
\??\c:\9tbthb.exec:\9tbthb.exe63⤵
- Executes dropped EXE
PID:3052 -
\??\c:\1ppvd.exec:\1ppvd.exe64⤵
- Executes dropped EXE
PID:1376 -
\??\c:\lxfxxxx.exec:\lxfxxxx.exe65⤵
- Executes dropped EXE
PID:2104 -
\??\c:\llxlllr.exec:\llxlllr.exe66⤵PID:1768
-
\??\c:\pjdpd.exec:\pjdpd.exe67⤵PID:1800
-
\??\c:\dvpdp.exec:\dvpdp.exe68⤵PID:1276
-
\??\c:\lxrlrxx.exec:\lxrlrxx.exe69⤵PID:2388
-
\??\c:\tthtnh.exec:\tthtnh.exe70⤵PID:2252
-
\??\c:\ddppv.exec:\ddppv.exe71⤵PID:1976
-
\??\c:\ddpvj.exec:\ddpvj.exe72⤵PID:716
-
\??\c:\5rrlfrr.exec:\5rrlfrr.exe73⤵PID:1192
-
\??\c:\ntbbhn.exec:\ntbbhn.exe74⤵PID:1480
-
\??\c:\htbhbt.exec:\htbhbt.exe75⤵PID:800
-
\??\c:\dvjvv.exec:\dvjvv.exe76⤵PID:1140
-
\??\c:\rlllfrl.exec:\rlllfrl.exe77⤵PID:1284
-
\??\c:\nbnnnn.exec:\nbnnnn.exe78⤵PID:2308
-
\??\c:\pvpjp.exec:\pvpjp.exe79⤵PID:2448
-
\??\c:\vvdjp.exec:\vvdjp.exe80⤵PID:1560
-
\??\c:\xffrlrf.exec:\xffrlrf.exe81⤵PID:1512
-
\??\c:\thhhbt.exec:\thhhbt.exe82⤵PID:376
-
\??\c:\pdpdd.exec:\pdpdd.exe83⤵PID:856
-
\??\c:\frffrxl.exec:\frffrxl.exe84⤵PID:292
-
\??\c:\xfffxrr.exec:\xfffxrr.exe85⤵PID:2012
-
\??\c:\btnhhh.exec:\btnhhh.exe86⤵PID:948
-
\??\c:\dpvjv.exec:\dpvjv.exe87⤵PID:2040
-
\??\c:\xlxrflr.exec:\xlxrflr.exe88⤵PID:2288
-
\??\c:\tnnnbt.exec:\tnnnbt.exe89⤵PID:1468
-
\??\c:\vjvvv.exec:\vjvvv.exe90⤵PID:2240
-
\??\c:\9vdjp.exec:\9vdjp.exe91⤵PID:1440
-
\??\c:\xrrrffl.exec:\xrrrffl.exe92⤵PID:1156
-
\??\c:\nhtbhn.exec:\nhtbhn.exe93⤵PID:2656
-
\??\c:\ttntht.exec:\ttntht.exe94⤵PID:2972
-
\??\c:\3pddj.exec:\3pddj.exe95⤵PID:2296
-
\??\c:\xxflfrf.exec:\xxflfrf.exe96⤵PID:2920
-
\??\c:\lxfxlrf.exec:\lxfxlrf.exe97⤵PID:1624
-
\??\c:\hbtthh.exec:\hbtthh.exe98⤵PID:2072
-
\??\c:\ddvjp.exec:\ddvjp.exe99⤵PID:2680
-
\??\c:\5rxrrxr.exec:\5rxrrxr.exe100⤵PID:2596
-
\??\c:\hhhhhb.exec:\hhhhhb.exe101⤵PID:2772
-
\??\c:\jjdjd.exec:\jjdjd.exe102⤵PID:2784
-
\??\c:\jjvdj.exec:\jjvdj.exe103⤵PID:2804
-
\??\c:\flffrxr.exec:\flffrxr.exe104⤵PID:2292
-
\??\c:\ttbbnb.exec:\ttbbnb.exe105⤵PID:2532
-
\??\c:\vpjpd.exec:\vpjpd.exe106⤵PID:2640
-
\??\c:\lrrrrfx.exec:\lrrrrfx.exe107⤵PID:3024
-
\??\c:\htthhh.exec:\htthhh.exe108⤵PID:2636
-
\??\c:\vdjdj.exec:\vdjdj.exe109⤵PID:1740
-
\??\c:\jpjpv.exec:\jpjpv.exe110⤵PID:2888
-
\??\c:\lxfxlxl.exec:\lxfxlxl.exe111⤵PID:3064
-
\??\c:\ttbtnn.exec:\ttbtnn.exe112⤵PID:1100
-
\??\c:\ppvdp.exec:\ppvdp.exe113⤵PID:2736
-
\??\c:\9jvjj.exec:\9jvjj.exe114⤵PID:2556
-
\??\c:\lfxrflr.exec:\lfxrflr.exe115⤵PID:1548
-
\??\c:\bbhhbn.exec:\bbhhbn.exe116⤵PID:964
-
\??\c:\7pdpv.exec:\7pdpv.exe117⤵PID:1376
-
\??\c:\jvvdp.exec:\jvvdp.exe118⤵PID:1660
-
\??\c:\xlflllr.exec:\xlflllr.exe119⤵PID:1564
-
\??\c:\bttnbb.exec:\bttnbb.exe120⤵PID:1908
-
\??\c:\1ddjv.exec:\1ddjv.exe121⤵PID:1276
-
\??\c:\ttnthh.exec:\ttnthh.exe122⤵PID:2204
-
\??\c:\thbbbb.exec:\thbbbb.exe123⤵PID:608
-
\??\c:\vpjdp.exec:\vpjdp.exe124⤵PID:1452
-
\??\c:\rlrxxxx.exec:\rlrxxxx.exe125⤵PID:1128
-
\??\c:\xrrrxrf.exec:\xrrrxrf.exe126⤵PID:2952
-
\??\c:\hbhhtn.exec:\hbhhtn.exe127⤵PID:668
-
\??\c:\bntntt.exec:\bntntt.exe128⤵PID:572
-
\??\c:\pvjpp.exec:\pvjpp.exe129⤵PID:1820
-
\??\c:\lfxxrxf.exec:\lfxxrxf.exe130⤵PID:2164
-
\??\c:\3fxlrlr.exec:\3fxlrlr.exe131⤵PID:1504
-
\??\c:\pjddj.exec:\pjddj.exe132⤵PID:1704
-
\??\c:\jjpjd.exec:\jjpjd.exe133⤵PID:1200
-
\??\c:\7rlrrrr.exec:\7rlrrrr.exe134⤵PID:1512
-
\??\c:\bbtnth.exec:\bbtnth.exe135⤵PID:1852
-
\??\c:\1tnntt.exec:\1tnntt.exe136⤵PID:2320
-
\??\c:\pdpjj.exec:\pdpjj.exe137⤵PID:292
-
\??\c:\pdvvv.exec:\pdvvv.exe138⤵PID:2012
-
\??\c:\llxlxlf.exec:\llxlxlf.exe139⤵PID:1680
-
\??\c:\tthntn.exec:\tthntn.exe140⤵PID:1912
-
\??\c:\ttnnbn.exec:\ttnnbn.exe141⤵PID:2288
-
\??\c:\lfrxflf.exec:\lfrxflf.exe142⤵PID:1936
-
\??\c:\9lflxlx.exec:\9lflxlx.exe143⤵PID:2240
-
\??\c:\9btbbt.exec:\9btbbt.exe144⤵PID:2792
-
\??\c:\3jjdv.exec:\3jjdv.exe145⤵PID:1156
-
\??\c:\1djpj.exec:\1djpj.exe146⤵PID:2656
-
\??\c:\rfrrxrf.exec:\rfrrxrf.exe147⤵PID:2972
-
\??\c:\xfrlffx.exec:\xfrlffx.exe148⤵PID:2028
-
\??\c:\1tbttn.exec:\1tbttn.exe149⤵PID:1628
-
\??\c:\vdjdv.exec:\vdjdv.exe150⤵PID:2688
-
\??\c:\xxffxxf.exec:\xxffxxf.exe151⤵PID:2932
-
\??\c:\xlxfrrf.exec:\xlxfrrf.exe152⤵PID:2476
-
\??\c:\5nbnnn.exec:\5nbnnn.exe153⤵PID:2840
-
\??\c:\dvvdd.exec:\dvvdd.exe154⤵PID:1184
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe155⤵PID:2780
-
\??\c:\bnbbtb.exec:\bnbbtb.exe156⤵PID:2684
-
\??\c:\jpjjp.exec:\jpjjp.exe157⤵PID:2532
-
\??\c:\fxlflll.exec:\fxlflll.exe158⤵PID:2640
-
\??\c:\9bntbh.exec:\9bntbh.exe159⤵PID:3032
-
\??\c:\nbhbhn.exec:\nbhbhn.exe160⤵PID:1112
-
\??\c:\jddvv.exec:\jddvv.exe161⤵PID:2764
-
\??\c:\fxrfxfl.exec:\fxrfxfl.exe162⤵PID:1096
-
\??\c:\lffxllr.exec:\lffxllr.exe163⤵PID:2528
-
\??\c:\bttbhn.exec:\bttbhn.exe164⤵PID:2900
-
\??\c:\djjdj.exec:\djjdj.exe165⤵PID:2860
-
\??\c:\xfxxffr.exec:\xfxxffr.exe166⤵PID:2276
-
\??\c:\5hbttn.exec:\5hbttn.exe167⤵PID:844
-
\??\c:\ppdvv.exec:\ppdvv.exe168⤵PID:2896
-
\??\c:\xrrrfxl.exec:\xrrrfxl.exe169⤵PID:2200
-
\??\c:\nnnntn.exec:\nnnntn.exe170⤵PID:888
-
\??\c:\bthntb.exec:\bthntb.exe171⤵PID:2144
-
\??\c:\dpppp.exec:\dpppp.exe172⤵PID:1708
-
\??\c:\xxlfrfl.exec:\xxlfrfl.exe173⤵PID:1656
-
\??\c:\5lxflfl.exec:\5lxflfl.exe174⤵PID:1896
-
\??\c:\nhbtbb.exec:\nhbtbb.exe175⤵PID:384
-
\??\c:\jdvdv.exec:\jdvdv.exe176⤵PID:608
-
\??\c:\jdpdp.exec:\jdpdp.exe177⤵PID:1716
-
\??\c:\llrrrrx.exec:\llrrrrx.exe178⤵PID:1452
-
\??\c:\nttbbb.exec:\nttbbb.exe179⤵PID:1924
-
\??\c:\vpjdp.exec:\vpjdp.exe180⤵PID:2952
-
\??\c:\dpvjp.exec:\dpvjp.exe181⤵PID:668
-
\??\c:\rxfxfll.exec:\rxfxfll.exe182⤵PID:2440
-
\??\c:\5tbtnb.exec:\5tbtnb.exe183⤵PID:1820
-
\??\c:\jjjpd.exec:\jjjpd.exe184⤵PID:2448
-
\??\c:\7fflrxf.exec:\7fflrxf.exe185⤵PID:1504
-
\??\c:\ntbhhh.exec:\ntbhhh.exe186⤵PID:1168
-
\??\c:\bbbthn.exec:\bbbthn.exe187⤵PID:1648
-
\??\c:\ppdpv.exec:\ppdpv.exe188⤵PID:1068
-
\??\c:\frffxff.exec:\frffxff.exe189⤵PID:2016
-
\??\c:\hhhtbn.exec:\hhhtbn.exe190⤵PID:1508
-
\??\c:\ttntht.exec:\ttntht.exe191⤵PID:1340
-
\??\c:\jdpvp.exec:\jdpvp.exe192⤵PID:604
-
\??\c:\llfxfrr.exec:\llfxfrr.exe193⤵PID:1680
-
\??\c:\nnbnnb.exec:\nnbnnb.exe194⤵PID:1536
-
\??\c:\nttntn.exec:\nttntn.exe195⤵PID:2280
-
\??\c:\vpjvp.exec:\vpjvp.exe196⤵PID:904
-
\??\c:\lxfrxll.exec:\lxfrxll.exe197⤵PID:2372
-
\??\c:\1lxlrlr.exec:\1lxlrlr.exe198⤵PID:2792
-
\??\c:\ntbtht.exec:\ntbtht.exe199⤵PID:2068
-
\??\c:\nbnbbt.exec:\nbnbbt.exe200⤵PID:2036
-
\??\c:\pjjvj.exec:\pjjvj.exe201⤵PID:1760
-
\??\c:\frxrrll.exec:\frxrrll.exe202⤵PID:2668
-
\??\c:\fxrxfrl.exec:\fxrxfrl.exe203⤵PID:2560
-
\??\c:\hntnbh.exec:\hntnbh.exe204⤵PID:2676
-
\??\c:\3tnbnb.exec:\3tnbnb.exe205⤵PID:1764
-
\??\c:\jppdj.exec:\jppdj.exe206⤵PID:2496
-
\??\c:\jjvjj.exec:\jjvjj.exe207⤵PID:2516
-
\??\c:\frrfrlx.exec:\frrfrlx.exe208⤵PID:2664
-
\??\c:\lrxxfxl.exec:\lrxxfxl.exe209⤵PID:2464
-
\??\c:\bbbbnb.exec:\bbbbnb.exe210⤵PID:2472
-
\??\c:\htttbb.exec:\htttbb.exe211⤵PID:2488
-
\??\c:\jdvdp.exec:\jdvdp.exe212⤵PID:3028
-
\??\c:\rxrlflx.exec:\rxrlflx.exe213⤵PID:2744
-
\??\c:\1llxfll.exec:\1llxfll.exe214⤵PID:2652
-
\??\c:\hhnbbh.exec:\hhnbbh.exe215⤵PID:2872
-
\??\c:\thbhht.exec:\thbhht.exe216⤵PID:1332
-
\??\c:\vpvpj.exec:\vpvpj.exe217⤵PID:2908
-
\??\c:\3ddpp.exec:\3ddpp.exe218⤵PID:2728
-
\??\c:\xxlrrxf.exec:\xxlrrxf.exe219⤵PID:2832
-
\??\c:\llrxrrx.exec:\llrxrrx.exe220⤵PID:3000
-
\??\c:\ntthnn.exec:\ntthnn.exe221⤵PID:3052
-
\??\c:\pvdvp.exec:\pvdvp.exe222⤵PID:1792
-
\??\c:\jpjvd.exec:\jpjvd.exe223⤵PID:2272
-
\??\c:\lffxrfr.exec:\lffxrfr.exe224⤵PID:1660
-
\??\c:\3hbhnn.exec:\3hbhnn.exe225⤵PID:2892
-
\??\c:\1tnbtb.exec:\1tnbtb.exe226⤵PID:1796
-
\??\c:\jpjpj.exec:\jpjpj.exe227⤵PID:2388
-
\??\c:\llllxll.exec:\llllxll.exe228⤵PID:1652
-
\??\c:\9hbnth.exec:\9hbnth.exe229⤵PID:580
-
\??\c:\1hbhbn.exec:\1hbhbn.exe230⤵PID:384
-
\??\c:\ppjdp.exec:\ppjdp.exe231⤵PID:608
-
\??\c:\7rlflrr.exec:\7rlflrr.exe232⤵PID:1716
-
\??\c:\9ttbtb.exec:\9ttbtb.exe233⤵PID:2960
-
\??\c:\jddpd.exec:\jddpd.exe234⤵PID:1216
-
\??\c:\vvjjp.exec:\vvjjp.exe235⤵PID:412
-
\??\c:\xrxflrx.exec:\xrxflrx.exe236⤵PID:2192
-
\??\c:\nttnbt.exec:\nttnbt.exe237⤵PID:1528
-
\??\c:\fxfxrll.exec:\fxfxrll.exe238⤵PID:2164
-
\??\c:\9hbnnt.exec:\9hbnnt.exe239⤵PID:2300
-
\??\c:\9hhhhh.exec:\9hhhhh.exe240⤵PID:1704
-
\??\c:\3pvpv.exec:\3pvpv.exe241⤵PID:1180
-