Analysis
-
max time kernel
147s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 02:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
301e3e399e78515e26ac1532360c116dca19bf2a61acbf14a90092339f290842_NeikiAnalytics.exe
Resource
win7-20240508-en
3 signatures
150 seconds
General
-
Target
301e3e399e78515e26ac1532360c116dca19bf2a61acbf14a90092339f290842_NeikiAnalytics.exe
-
Size
63KB
-
MD5
464f6a6fbd87ef91df99a9eaac30fb60
-
SHA1
5680d592eedd3288f2a554ec01d1b9b607f04f7d
-
SHA256
301e3e399e78515e26ac1532360c116dca19bf2a61acbf14a90092339f290842
-
SHA512
02a4cfea243261b99b43bac5ab65b5303e1fff710005b74e93457923a779d6858483995f28765c906a713846a492ed6b846db05bdb32ea792d2fbe8cfc9e8761
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDII9ZvHKEKiU:ymb3NkkiQ3mdBjFII9ZvHKEKX
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/2836-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2804-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1088-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3784-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/896-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rlxrxxf.exejpdpj.exellfxrrf.exehbhbnh.exepdppv.exerflxxfx.exebtbthh.exelfrrrfl.exebbnhhh.exe3pjjp.exefrflrxf.exebnnnhh.exepvppv.exexxrrxrx.exentntbn.exehbtbht.exelfrflff.exebbbbht.exepdppp.exefxlrxll.exeththth.exelrlrlrl.exenttbhb.exelxxfrll.exebthtbb.exevvdvv.exexlrxxlr.exethnttb.exevjpjd.exettbhtt.exerxxxfrf.exenbnhbh.exe1pdvd.exevpddv.exerfrlfxx.exenbntbh.exepjpdj.exepjpvd.exeflffrrf.exenthhnt.exejjvvj.exexlxffrr.exeffrxxfl.exehbttbh.exedvvjv.exefrxxxlr.exentbbnn.exevjvdd.exexrllrfr.exenbhtnb.exepjppv.exelfrlxll.exelxlxxxx.exethttht.exejjvpp.exentbbnn.exenbnnbh.exevvpdp.exeflxflxf.exetnhnbn.exejpdjp.exefrrfxrf.exethttbh.exelflllfx.exepid process 1672 rlxrxxf.exe 2636 jpdpj.exe 4616 llfxrrf.exe 392 hbhbnh.exe 4596 pdppv.exe 4628 rflxxfx.exe 3828 btbthh.exe 896 lfrrrfl.exe 644 bbnhhh.exe 3784 3pjjp.exe 2388 frflrxf.exe 4580 bnnnhh.exe 3924 pvppv.exe 3984 xxrrxrx.exe 3564 ntntbn.exe 3088 hbtbht.exe 2804 lfrflff.exe 4676 bbbbht.exe 1088 pdppp.exe 1292 fxlrxll.exe 2416 ththth.exe 4396 lrlrlrl.exe 4496 nttbhb.exe 2588 lxxfrll.exe 4724 bthtbb.exe 1288 vvdvv.exe 2188 xlrxxlr.exe 436 thnttb.exe 2900 vjpjd.exe 4852 ttbhtt.exe 2348 rxxxfrf.exe 3992 nbnhbh.exe 4420 1pdvd.exe 1804 vpddv.exe 3672 rfrlfxx.exe 4824 nbntbh.exe 4980 pjpdj.exe 112 pjpvd.exe 3236 flffrrf.exe 1412 nthhnt.exe 4648 jjvvj.exe 3056 xlxffrr.exe 3276 ffrxxfl.exe 1184 hbttbh.exe 4820 dvvjv.exe 3688 frxxxlr.exe 4452 ntbbnn.exe 5088 vjvdd.exe 3224 xrllrfr.exe 4580 nbhtnb.exe 3924 pjppv.exe 3984 lfrlxll.exe 1016 lxlxxxx.exe 2424 thttht.exe 3712 jjvpp.exe 4504 ntbbnn.exe 4676 nbnnbh.exe 408 vvpdp.exe 4296 flxflxf.exe 4228 tnhnbn.exe 4340 jpdjp.exe 4760 frrfxrf.exe 4572 thttbh.exe 3204 lflllfx.exe -
Processes:
resource yara_rule behavioral2/memory/2836-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2804-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1088-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3784-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/896-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-8-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
301e3e399e78515e26ac1532360c116dca19bf2a61acbf14a90092339f290842_NeikiAnalytics.exerlxrxxf.exejpdpj.exellfxrrf.exehbhbnh.exepdppv.exerflxxfx.exebtbthh.exelfrrrfl.exebbnhhh.exe3pjjp.exefrflrxf.exebnnnhh.exepvppv.exexxrrxrx.exentntbn.exehbtbht.exelfrflff.exebbbbht.exepdppp.exefxlrxll.exeththth.exedescription pid process target process PID 2836 wrote to memory of 1672 2836 301e3e399e78515e26ac1532360c116dca19bf2a61acbf14a90092339f290842_NeikiAnalytics.exe rlxrxxf.exe PID 2836 wrote to memory of 1672 2836 301e3e399e78515e26ac1532360c116dca19bf2a61acbf14a90092339f290842_NeikiAnalytics.exe rlxrxxf.exe PID 2836 wrote to memory of 1672 2836 301e3e399e78515e26ac1532360c116dca19bf2a61acbf14a90092339f290842_NeikiAnalytics.exe rlxrxxf.exe PID 1672 wrote to memory of 2636 1672 rlxrxxf.exe jpdpj.exe PID 1672 wrote to memory of 2636 1672 rlxrxxf.exe jpdpj.exe PID 1672 wrote to memory of 2636 1672 rlxrxxf.exe jpdpj.exe PID 2636 wrote to memory of 4616 2636 jpdpj.exe llfxrrf.exe PID 2636 wrote to memory of 4616 2636 jpdpj.exe llfxrrf.exe PID 2636 wrote to memory of 4616 2636 jpdpj.exe llfxrrf.exe PID 4616 wrote to memory of 392 4616 llfxrrf.exe vjjjv.exe PID 4616 wrote to memory of 392 4616 llfxrrf.exe vjjjv.exe PID 4616 wrote to memory of 392 4616 llfxrrf.exe vjjjv.exe PID 392 wrote to memory of 4596 392 hbhbnh.exe 7ppjp.exe PID 392 wrote to memory of 4596 392 hbhbnh.exe 7ppjp.exe PID 392 wrote to memory of 4596 392 hbhbnh.exe 7ppjp.exe PID 4596 wrote to memory of 4628 4596 pdppv.exe xrxlxrr.exe PID 4596 wrote to memory of 4628 4596 pdppv.exe xrxlxrr.exe PID 4596 wrote to memory of 4628 4596 pdppv.exe xrxlxrr.exe PID 4628 wrote to memory of 3828 4628 rflxxfx.exe xxrffxx.exe PID 4628 wrote to memory of 3828 4628 rflxxfx.exe xxrffxx.exe PID 4628 wrote to memory of 3828 4628 rflxxfx.exe xxrffxx.exe PID 3828 wrote to memory of 896 3828 btbthh.exe vvjjp.exe PID 3828 wrote to memory of 896 3828 btbthh.exe vvjjp.exe PID 3828 wrote to memory of 896 3828 btbthh.exe vvjjp.exe PID 896 wrote to memory of 644 896 lfrrrfl.exe xlxrxfl.exe PID 896 wrote to memory of 644 896 lfrrrfl.exe xlxrxfl.exe PID 896 wrote to memory of 644 896 lfrrrfl.exe xlxrxfl.exe PID 644 wrote to memory of 3784 644 bbnhhh.exe 3pjjp.exe PID 644 wrote to memory of 3784 644 bbnhhh.exe 3pjjp.exe PID 644 wrote to memory of 3784 644 bbnhhh.exe 3pjjp.exe PID 3784 wrote to memory of 2388 3784 3pjjp.exe frflrxf.exe PID 3784 wrote to memory of 2388 3784 3pjjp.exe frflrxf.exe PID 3784 wrote to memory of 2388 3784 3pjjp.exe frflrxf.exe PID 2388 wrote to memory of 4580 2388 frflrxf.exe lfrlxll.exe PID 2388 wrote to memory of 4580 2388 frflrxf.exe lfrlxll.exe PID 2388 wrote to memory of 4580 2388 frflrxf.exe lfrlxll.exe PID 4580 wrote to memory of 3924 4580 bnnnhh.exe dvdpd.exe PID 4580 wrote to memory of 3924 4580 bnnnhh.exe dvdpd.exe PID 4580 wrote to memory of 3924 4580 bnnnhh.exe dvdpd.exe PID 3924 wrote to memory of 3984 3924 pvppv.exe htbnnn.exe PID 3924 wrote to memory of 3984 3924 pvppv.exe htbnnn.exe PID 3924 wrote to memory of 3984 3924 pvppv.exe htbnnn.exe PID 3984 wrote to memory of 3564 3984 xxrrxrx.exe hhhhht.exe PID 3984 wrote to memory of 3564 3984 xxrrxrx.exe hhhhht.exe PID 3984 wrote to memory of 3564 3984 xxrrxrx.exe hhhhht.exe PID 3564 wrote to memory of 3088 3564 ntntbn.exe lrflrfx.exe PID 3564 wrote to memory of 3088 3564 ntntbn.exe lrflrfx.exe PID 3564 wrote to memory of 3088 3564 ntntbn.exe lrflrfx.exe PID 3088 wrote to memory of 2804 3088 hbtbht.exe dvpvj.exe PID 3088 wrote to memory of 2804 3088 hbtbht.exe dvpvj.exe PID 3088 wrote to memory of 2804 3088 hbtbht.exe dvpvj.exe PID 2804 wrote to memory of 4676 2804 lfrflff.exe bbbbht.exe PID 2804 wrote to memory of 4676 2804 lfrflff.exe bbbbht.exe PID 2804 wrote to memory of 4676 2804 lfrflff.exe bbbbht.exe PID 4676 wrote to memory of 1088 4676 bbbbht.exe 5ppjj.exe PID 4676 wrote to memory of 1088 4676 bbbbht.exe 5ppjj.exe PID 4676 wrote to memory of 1088 4676 bbbbht.exe 5ppjj.exe PID 1088 wrote to memory of 1292 1088 pdppp.exe 9xxrrxr.exe PID 1088 wrote to memory of 1292 1088 pdppp.exe 9xxrrxr.exe PID 1088 wrote to memory of 1292 1088 pdppp.exe 9xxrrxr.exe PID 1292 wrote to memory of 2416 1292 fxlrxll.exe nbnnnn.exe PID 1292 wrote to memory of 2416 1292 fxlrxll.exe nbnnnn.exe PID 1292 wrote to memory of 2416 1292 fxlrxll.exe nbnnnn.exe PID 2416 wrote to memory of 4396 2416 ththth.exe lrlrlrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\301e3e399e78515e26ac1532360c116dca19bf2a61acbf14a90092339f290842_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\301e3e399e78515e26ac1532360c116dca19bf2a61acbf14a90092339f290842_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpdpj.exec:\jpdpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llfxrrf.exec:\llfxrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhbnh.exec:\hbhbnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdppv.exec:\pdppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rflxxfx.exec:\rflxxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btbthh.exec:\btbthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfrrrfl.exec:\lfrrrfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbnhhh.exec:\bbnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3pjjp.exec:\3pjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frflrxf.exec:\frflrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnnnhh.exec:\bnnnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvppv.exec:\pvppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxrrxrx.exec:\xxrrxrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntntbn.exec:\ntntbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbtbht.exec:\hbtbht.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfrflff.exec:\lfrflff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbbbht.exec:\bbbbht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdppp.exec:\pdppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxlrxll.exec:\fxlrxll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ththth.exec:\ththth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrlrlrl.exec:\lrlrlrl.exe23⤵
- Executes dropped EXE
-
\??\c:\nttbhb.exec:\nttbhb.exe24⤵
- Executes dropped EXE
-
\??\c:\lxxfrll.exec:\lxxfrll.exe25⤵
- Executes dropped EXE
-
\??\c:\bthtbb.exec:\bthtbb.exe26⤵
- Executes dropped EXE
-
\??\c:\vvdvv.exec:\vvdvv.exe27⤵
- Executes dropped EXE
-
\??\c:\xlrxxlr.exec:\xlrxxlr.exe28⤵
- Executes dropped EXE
-
\??\c:\thnttb.exec:\thnttb.exe29⤵
- Executes dropped EXE
-
\??\c:\vjpjd.exec:\vjpjd.exe30⤵
- Executes dropped EXE
-
\??\c:\ttbhtt.exec:\ttbhtt.exe31⤵
- Executes dropped EXE
-
\??\c:\rxxxfrf.exec:\rxxxfrf.exe32⤵
- Executes dropped EXE
-
\??\c:\nbnhbh.exec:\nbnhbh.exe33⤵
- Executes dropped EXE
-
\??\c:\1pdvd.exec:\1pdvd.exe34⤵
- Executes dropped EXE
-
\??\c:\vpddv.exec:\vpddv.exe35⤵
- Executes dropped EXE
-
\??\c:\rfrlfxx.exec:\rfrlfxx.exe36⤵
- Executes dropped EXE
-
\??\c:\nbntbh.exec:\nbntbh.exe37⤵
- Executes dropped EXE
-
\??\c:\pjpdj.exec:\pjpdj.exe38⤵
- Executes dropped EXE
-
\??\c:\pjpvd.exec:\pjpvd.exe39⤵
- Executes dropped EXE
-
\??\c:\flffrrf.exec:\flffrrf.exe40⤵
- Executes dropped EXE
-
\??\c:\nthhnt.exec:\nthhnt.exe41⤵
- Executes dropped EXE
-
\??\c:\jjvvj.exec:\jjvvj.exe42⤵
- Executes dropped EXE
-
\??\c:\xlxffrr.exec:\xlxffrr.exe43⤵
- Executes dropped EXE
-
\??\c:\ffrxxfl.exec:\ffrxxfl.exe44⤵
- Executes dropped EXE
-
\??\c:\hbttbh.exec:\hbttbh.exe45⤵
- Executes dropped EXE
-
\??\c:\dvvjv.exec:\dvvjv.exe46⤵
- Executes dropped EXE
-
\??\c:\frxxxlr.exec:\frxxxlr.exe47⤵
- Executes dropped EXE
-
\??\c:\ntbbnn.exec:\ntbbnn.exe48⤵
- Executes dropped EXE
-
\??\c:\vjvdd.exec:\vjvdd.exe49⤵
- Executes dropped EXE
-
\??\c:\xrllrfr.exec:\xrllrfr.exe50⤵
- Executes dropped EXE
-
\??\c:\nbhtnb.exec:\nbhtnb.exe51⤵
- Executes dropped EXE
-
\??\c:\pjppv.exec:\pjppv.exe52⤵
- Executes dropped EXE
-
\??\c:\lfrlxll.exec:\lfrlxll.exe53⤵
- Executes dropped EXE
-
\??\c:\lxlxxxx.exec:\lxlxxxx.exe54⤵
- Executes dropped EXE
-
\??\c:\thttht.exec:\thttht.exe55⤵
- Executes dropped EXE
-
\??\c:\jjvpp.exec:\jjvpp.exe56⤵
- Executes dropped EXE
-
\??\c:\ntbbnn.exec:\ntbbnn.exe57⤵
- Executes dropped EXE
-
\??\c:\nbnnbh.exec:\nbnnbh.exe58⤵
- Executes dropped EXE
-
\??\c:\vvpdp.exec:\vvpdp.exe59⤵
- Executes dropped EXE
-
\??\c:\flxflxf.exec:\flxflxf.exe60⤵
- Executes dropped EXE
-
\??\c:\tnhnbn.exec:\tnhnbn.exe61⤵
- Executes dropped EXE
-
\??\c:\jpdjp.exec:\jpdjp.exe62⤵
- Executes dropped EXE
-
\??\c:\frrfxrf.exec:\frrfxrf.exe63⤵
- Executes dropped EXE
-
\??\c:\thttbh.exec:\thttbh.exe64⤵
- Executes dropped EXE
-
\??\c:\lflllfx.exec:\lflllfx.exe65⤵
- Executes dropped EXE
-
\??\c:\vvvdd.exec:\vvvdd.exe66⤵
-
\??\c:\lrxflrr.exec:\lrxflrr.exe67⤵
-
\??\c:\thtbnn.exec:\thtbnn.exe68⤵
-
\??\c:\xrfllxr.exec:\xrfllxr.exe69⤵
-
\??\c:\flfflxr.exec:\flfflxr.exe70⤵
-
\??\c:\hnbhht.exec:\hnbhht.exe71⤵
-
\??\c:\vpvdj.exec:\vpvdj.exe72⤵
-
\??\c:\fflrrxf.exec:\fflrrxf.exe73⤵
-
\??\c:\flrrxrl.exec:\flrrxrl.exe74⤵
-
\??\c:\hbtnbb.exec:\hbtnbb.exe75⤵
-
\??\c:\xxllrrx.exec:\xxllrrx.exe76⤵
-
\??\c:\nhtbhn.exec:\nhtbhn.exe77⤵
-
\??\c:\btnhtt.exec:\btnhtt.exe78⤵
-
\??\c:\jpvpv.exec:\jpvpv.exe79⤵
-
\??\c:\ttthnh.exec:\ttthnh.exe80⤵
-
\??\c:\vjdpp.exec:\vjdpp.exe81⤵
-
\??\c:\rxfrxll.exec:\rxfrxll.exe82⤵
-
\??\c:\ttbhnt.exec:\ttbhnt.exe83⤵
-
\??\c:\pdjjd.exec:\pdjjd.exe84⤵
-
\??\c:\jvpvd.exec:\jvpvd.exe85⤵
-
\??\c:\xrfflff.exec:\xrfflff.exe86⤵
-
\??\c:\bthtbh.exec:\bthtbh.exe87⤵
-
\??\c:\ffxfxff.exec:\ffxfxff.exe88⤵
-
\??\c:\xxffxlx.exec:\xxffxlx.exe89⤵
-
\??\c:\tntbht.exec:\tntbht.exe90⤵
-
\??\c:\djjdv.exec:\djjdv.exe91⤵
-
\??\c:\fxfrfrf.exec:\fxfrfrf.exe92⤵
-
\??\c:\hbtthb.exec:\hbtthb.exe93⤵
-
\??\c:\vvppv.exec:\vvppv.exe94⤵
-
\??\c:\xxrlxrr.exec:\xxrlxrr.exe95⤵
-
\??\c:\bbnthb.exec:\bbnthb.exe96⤵
-
\??\c:\bnnbbn.exec:\bnnbbn.exe97⤵
-
\??\c:\jdpdd.exec:\jdpdd.exe98⤵
-
\??\c:\xrrrlfr.exec:\xrrrlfr.exe99⤵
-
\??\c:\thnbbb.exec:\thnbbb.exe100⤵
-
\??\c:\tbbnnh.exec:\tbbnnh.exe101⤵
-
\??\c:\llllfrr.exec:\llllfrr.exe102⤵
-
\??\c:\3bhbhn.exec:\3bhbhn.exe103⤵
-
\??\c:\9hbbhh.exec:\9hbbhh.exe104⤵
-
\??\c:\vvjpd.exec:\vvjpd.exe105⤵
-
\??\c:\nnnhbb.exec:\nnnhbb.exe106⤵
-
\??\c:\pvvdd.exec:\pvvdd.exe107⤵
-
\??\c:\xrlfffx.exec:\xrlfffx.exe108⤵
-
\??\c:\tnnhth.exec:\tnnhth.exe109⤵
-
\??\c:\hbnntn.exec:\hbnntn.exe110⤵
-
\??\c:\vdddv.exec:\vdddv.exe111⤵
-
\??\c:\xrxxxfl.exec:\xrxxxfl.exe112⤵
-
\??\c:\tbhhtt.exec:\tbhhtt.exe113⤵
-
\??\c:\pjpjd.exec:\pjpjd.exe114⤵
-
\??\c:\jjdpj.exec:\jjdpj.exe115⤵
-
\??\c:\flxfxxl.exec:\flxfxxl.exe116⤵
-
\??\c:\ntnbhb.exec:\ntnbhb.exe117⤵
-
\??\c:\bnhhbt.exec:\bnhhbt.exe118⤵
-
\??\c:\flflxll.exec:\flflxll.exe119⤵
-
\??\c:\nbtbhh.exec:\nbtbhh.exe120⤵
-
\??\c:\hbbthh.exec:\hbbthh.exe121⤵
-
\??\c:\ppvvd.exec:\ppvvd.exe122⤵
-
\??\c:\lrrfxrf.exec:\lrrfxrf.exe123⤵
-
\??\c:\bbnbnb.exec:\bbnbnb.exe124⤵
-
\??\c:\9bhntb.exec:\9bhntb.exe125⤵
-
\??\c:\pvpdj.exec:\pvpdj.exe126⤵
-
\??\c:\rrxxfrx.exec:\rrxxfrx.exe127⤵
-
\??\c:\frxflfr.exec:\frxflfr.exe128⤵
-
\??\c:\bntbbt.exec:\bntbbt.exe129⤵
-
\??\c:\vdpjp.exec:\vdpjp.exe130⤵
-
\??\c:\hhnbht.exec:\hhnbht.exe131⤵
-
\??\c:\hbhnbt.exec:\hbhnbt.exe132⤵
-
\??\c:\dppjj.exec:\dppjj.exe133⤵
-
\??\c:\nbhntn.exec:\nbhntn.exe134⤵
-
\??\c:\ttbnth.exec:\ttbnth.exe135⤵
-
\??\c:\pdddd.exec:\pdddd.exe136⤵
-
\??\c:\lfrlxll.exec:\lfrlxll.exe137⤵
-
\??\c:\nnnbhb.exec:\nnnbhb.exe138⤵
-
\??\c:\djvdj.exec:\djvdj.exe139⤵
-
\??\c:\rflxrrr.exec:\rflxrrr.exe140⤵
-
\??\c:\tntnnh.exec:\tntnnh.exe141⤵
-
\??\c:\pdjdj.exec:\pdjdj.exe142⤵
-
\??\c:\lffffrf.exec:\lffffrf.exe143⤵
-
\??\c:\nntttb.exec:\nntttb.exe144⤵
-
\??\c:\9xxrrxr.exec:\9xxrrxr.exe145⤵
-
\??\c:\9btbhn.exec:\9btbhn.exe146⤵
-
\??\c:\dpdvj.exec:\dpdvj.exe147⤵
-
\??\c:\llxxrxl.exec:\llxxrxl.exe148⤵
-
\??\c:\hnhbtt.exec:\hnhbtt.exe149⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe150⤵
-
\??\c:\xfrrflx.exec:\xfrrflx.exe151⤵
-
\??\c:\xxlxlxl.exec:\xxlxlxl.exe152⤵
-
\??\c:\bthbtn.exec:\bthbtn.exe153⤵
-
\??\c:\jvjjp.exec:\jvjjp.exe154⤵
-
\??\c:\flxxflr.exec:\flxxflr.exe155⤵
-
\??\c:\rxlxrfl.exec:\rxlxrfl.exe156⤵
-
\??\c:\bhhbhh.exec:\bhhbhh.exe157⤵
-
\??\c:\dvvvv.exec:\dvvvv.exe158⤵
-
\??\c:\lrfllrf.exec:\lrfllrf.exe159⤵
-
\??\c:\bbbbnt.exec:\bbbbnt.exe160⤵
-
\??\c:\pppvd.exec:\pppvd.exe161⤵
-
\??\c:\hhtbnt.exec:\hhtbnt.exe162⤵
-
\??\c:\tnhntt.exec:\tnhntt.exe163⤵
-
\??\c:\pdvpv.exec:\pdvpv.exe164⤵
-
\??\c:\rfffxxr.exec:\rfffxxr.exe165⤵
-
\??\c:\nbbtnh.exec:\nbbtnh.exe166⤵
-
\??\c:\nbtbhb.exec:\nbtbhb.exe167⤵
-
\??\c:\jvpjv.exec:\jvpjv.exe168⤵
-
\??\c:\vvjdd.exec:\vvjdd.exe169⤵
-
\??\c:\vpvvj.exec:\vpvvj.exe170⤵
-
\??\c:\lxlxxfr.exec:\lxlxxfr.exe171⤵
-
\??\c:\bnhnht.exec:\bnhnht.exe172⤵
-
\??\c:\dppdj.exec:\dppdj.exe173⤵
-
\??\c:\xxrrflf.exec:\xxrrflf.exe174⤵
-
\??\c:\bhhtbt.exec:\bhhtbt.exe175⤵
-
\??\c:\pdpvd.exec:\pdpvd.exe176⤵
-
\??\c:\hbnthh.exec:\hbnthh.exe177⤵
-
\??\c:\ddpdv.exec:\ddpdv.exe178⤵
-
\??\c:\flrrxfl.exec:\flrrxfl.exe179⤵
-
\??\c:\bbtbhh.exec:\bbtbhh.exe180⤵
-
\??\c:\rfrrxff.exec:\rfrrxff.exe181⤵
-
\??\c:\bnhntb.exec:\bnhntb.exe182⤵
-
\??\c:\3nntnb.exec:\3nntnb.exe183⤵
-
\??\c:\vjvpd.exec:\vjvpd.exe184⤵
-
\??\c:\frxfrxf.exec:\frxfrxf.exe185⤵
-
\??\c:\nbnnnn.exec:\nbnnnn.exe186⤵
-
\??\c:\vvpdp.exec:\vvpdp.exe187⤵
-
\??\c:\jpjjp.exec:\jpjjp.exe188⤵
-
\??\c:\3bbnnn.exec:\3bbnnn.exe189⤵
-
\??\c:\dpdvp.exec:\dpdvp.exe190⤵
-
\??\c:\lfxflrf.exec:\lfxflrf.exe191⤵
-
\??\c:\tbhhht.exec:\tbhhht.exe192⤵
-
\??\c:\vpdpv.exec:\vpdpv.exe193⤵
-
\??\c:\ffrflrx.exec:\ffrflrx.exe194⤵
-
\??\c:\thbnnt.exec:\thbnnt.exe195⤵
-
\??\c:\hhhttt.exec:\hhhttt.exe196⤵
-
\??\c:\dpdjp.exec:\dpdjp.exe197⤵
-
\??\c:\rfxlrfr.exec:\rfxlrfr.exe198⤵
-
\??\c:\3tbbnb.exec:\3tbbnb.exe199⤵
-
\??\c:\vvjdj.exec:\vvjdj.exe200⤵
-
\??\c:\lrfflrx.exec:\lrfflrx.exe201⤵
-
\??\c:\5thntb.exec:\5thntb.exe202⤵
-
\??\c:\vpddj.exec:\vpddj.exe203⤵
-
\??\c:\frfxxxx.exec:\frfxxxx.exe204⤵
-
\??\c:\nttbtt.exec:\nttbtt.exe205⤵
-
\??\c:\vjjjv.exec:\vjjjv.exe206⤵
-
\??\c:\3lxxllx.exec:\3lxxllx.exe207⤵
-
\??\c:\fxrrfxl.exec:\fxrrfxl.exe208⤵
-
\??\c:\nbbthn.exec:\nbbthn.exe209⤵
-
\??\c:\llflrxl.exec:\llflrxl.exe210⤵
-
\??\c:\ntnhnn.exec:\ntnhnn.exe211⤵
-
\??\c:\dvdjj.exec:\dvdjj.exe212⤵
-
\??\c:\jjjpd.exec:\jjjpd.exe213⤵
-
\??\c:\xrflrxx.exec:\xrflrxx.exe214⤵
-
\??\c:\lrlfxfr.exec:\lrlfxfr.exe215⤵
-
\??\c:\9nntht.exec:\9nntht.exe216⤵
-
\??\c:\tthbhn.exec:\tthbhn.exe217⤵
-
\??\c:\vjvdj.exec:\vjvdj.exe218⤵
-
\??\c:\pvvjd.exec:\pvvjd.exe219⤵
-
\??\c:\rffllll.exec:\rffllll.exe220⤵
-
\??\c:\tntbbn.exec:\tntbbn.exe221⤵
-
\??\c:\djjjp.exec:\djjjp.exe222⤵
-
\??\c:\rxrfxrx.exec:\rxrfxrx.exe223⤵
-
\??\c:\llflflx.exec:\llflflx.exe224⤵
-
\??\c:\tbhntb.exec:\tbhntb.exe225⤵
-
\??\c:\vpdvj.exec:\vpdvj.exe226⤵
-
\??\c:\jjvvj.exec:\jjvvj.exe227⤵
-
\??\c:\xrlfrfl.exec:\xrlfrfl.exe228⤵
-
\??\c:\3lrxflr.exec:\3lrxflr.exe229⤵
-
\??\c:\5hhhnh.exec:\5hhhnh.exe230⤵
-
\??\c:\vdpdp.exec:\vdpdp.exe231⤵
-
\??\c:\xrlxfrr.exec:\xrlxfrr.exe232⤵
-
\??\c:\rrrlffx.exec:\rrrlffx.exe233⤵
-
\??\c:\hnhhnt.exec:\hnhhnt.exe234⤵
-
\??\c:\tbtbtb.exec:\tbtbtb.exe235⤵
-
\??\c:\pdjpv.exec:\pdjpv.exe236⤵
-
\??\c:\lxlrlxl.exec:\lxlrlxl.exe237⤵
-
\??\c:\frlrrff.exec:\frlrrff.exe238⤵
-
\??\c:\bhnhnb.exec:\bhnhnb.exe239⤵
-
\??\c:\pdvvj.exec:\pdvvj.exe240⤵
-
\??\c:\xfxxfrx.exec:\xfxxfrx.exe241⤵