Analysis
-
max time kernel
149s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 18:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c1e916c080d8caacb08e752d6fb20b0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2c1e916c080d8caacb08e752d6fb20b0_NeikiAnalytics.exe
-
Size
97KB
-
MD5
2c1e916c080d8caacb08e752d6fb20b0
-
SHA1
14d627bdba10797a2821c7e55eb5c09a824e8eb3
-
SHA256
7401ae07db0884b9cd826a426630f669bcb83f3d20ea0010d27ddf6625a083e2
-
SHA512
5d4ddf56ca0e8de62b668e92ee1d563f834799bfca8662588a2e1bccc1f0a3ffeef1b672c946ec6ae850a3b1e451cb0eccf007213ca2f8f04ac0f79236e75f1c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JxJAg8dtZ:ymb3NkkiQ3mdBjFIWeFGyAsJAg2Z
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral2/memory/3080-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2784-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1836-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
9rxxlrf.exebbhbtn.exe3vddd.exepvpvv.exehnhhtt.exedpvjd.exexflfxxr.exexlllfff.exenhhhbt.exedjppj.exepjdpj.exexrrxrxr.exetnhttt.exe3pdvp.exelrxxrxl.exefrllllr.exe5tnhbb.exebhhbnn.exepdjjd.exe5lxrrrx.exe3xxrlxx.exebttttt.exepdjjj.exexlfrrrl.exehnnnhh.exe5bbbtn.exepvjjv.exerlfxffl.exenbbbtn.exenbbtnh.exe9xxrlrl.exe1rrlfxx.exehntnnh.exe5pvpv.exe3xxrfxr.exelxlxffl.exebbtnhh.exetnhbnh.exejjjvj.exexrrfrlf.exe5btnht.exeddpjd.exepvdvv.exelxrlrxr.exe9bhbnn.exebtbhhh.exejddvd.exevjjdv.exexrxxfff.exe7lllffx.exe7bbbtt.exedvjvj.exe1jpjv.exelrlxrll.exenbhtnn.exebhbtnn.exevpvpj.exejvdjj.exerlrxrrf.exehbbbbb.exenbbbbt.exejddvd.exe5vjvv.exe5lfxrrl.exepid process 3240 9rxxlrf.exe 448 bbhbtn.exe 4164 3vddd.exe 3428 pvpvv.exe 4656 hnhhtt.exe 3052 dpvjd.exe 3424 xflfxxr.exe 1216 xlllfff.exe 3740 nhhhbt.exe 1864 djppj.exe 4372 pjdpj.exe 2820 xrrxrxr.exe 3172 tnhttt.exe 4860 3pdvp.exe 4560 lrxxrxl.exe 1836 frllllr.exe 2784 5tnhbb.exe 4984 bhhbnn.exe 1548 pdjjd.exe 3948 5lxrrrx.exe 2384 3xxrlxx.exe 1860 bttttt.exe 3588 pdjjj.exe 4432 xlfrrrl.exe 3300 hnnnhh.exe 1328 5bbbtn.exe 4652 pvjjv.exe 4160 rlfxffl.exe 3304 nbbbtn.exe 1660 nbbtnh.exe 4520 9xxrlrl.exe 4480 1rrlfxx.exe 3896 hntnnh.exe 1984 5pvpv.exe 3704 3xxrfxr.exe 3424 lxlxffl.exe 2376 bbtnhh.exe 1692 tnhbnh.exe 1604 jjjvj.exe 1776 xrrfrlf.exe 2120 5btnht.exe 1492 ddpjd.exe 3852 pvdvv.exe 2228 lxrlrxr.exe 2128 9bhbnn.exe 3616 btbhhh.exe 2428 jddvd.exe 5012 vjjdv.exe 1888 xrxxfff.exe 1088 7lllffx.exe 2808 7bbbtt.exe 2036 dvjvj.exe 2572 1jpjv.exe 4308 lrlxrll.exe 1200 nbhtnn.exe 4432 bhbtnn.exe 680 vpvpj.exe 4468 jvdjj.exe 1328 rlrxrrf.exe 5032 hbbbbb.exe 1608 nbbbbt.exe 4840 jddvd.exe 3032 5vjvv.exe 3248 5lfxrrl.exe -
Processes:
resource yara_rule behavioral2/memory/3080-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-190-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2c1e916c080d8caacb08e752d6fb20b0_NeikiAnalytics.exe9rxxlrf.exebbhbtn.exe3vddd.exepvpvv.exehnhhtt.exedpvjd.exexflfxxr.exexlllfff.exenhhhbt.exedjppj.exepjdpj.exexrrxrxr.exetnhttt.exe3pdvp.exelrxxrxl.exefrllllr.exe5tnhbb.exebhhbnn.exepdjjd.exe5lxrrrx.exe3xxrlxx.exedescription pid process target process PID 3080 wrote to memory of 3240 3080 2c1e916c080d8caacb08e752d6fb20b0_NeikiAnalytics.exe 9rxxlrf.exe PID 3080 wrote to memory of 3240 3080 2c1e916c080d8caacb08e752d6fb20b0_NeikiAnalytics.exe 9rxxlrf.exe PID 3080 wrote to memory of 3240 3080 2c1e916c080d8caacb08e752d6fb20b0_NeikiAnalytics.exe 9rxxlrf.exe PID 3240 wrote to memory of 448 3240 9rxxlrf.exe bbhbtn.exe PID 3240 wrote to memory of 448 3240 9rxxlrf.exe bbhbtn.exe PID 3240 wrote to memory of 448 3240 9rxxlrf.exe bbhbtn.exe PID 448 wrote to memory of 4164 448 bbhbtn.exe 3vddd.exe PID 448 wrote to memory of 4164 448 bbhbtn.exe 3vddd.exe PID 448 wrote to memory of 4164 448 bbhbtn.exe 3vddd.exe PID 4164 wrote to memory of 3428 4164 3vddd.exe pvpvv.exe PID 4164 wrote to memory of 3428 4164 3vddd.exe pvpvv.exe PID 4164 wrote to memory of 3428 4164 3vddd.exe pvpvv.exe PID 3428 wrote to memory of 4656 3428 pvpvv.exe hnhhtt.exe PID 3428 wrote to memory of 4656 3428 pvpvv.exe hnhhtt.exe PID 3428 wrote to memory of 4656 3428 pvpvv.exe hnhhtt.exe PID 4656 wrote to memory of 3052 4656 hnhhtt.exe dpvjd.exe PID 4656 wrote to memory of 3052 4656 hnhhtt.exe dpvjd.exe PID 4656 wrote to memory of 3052 4656 hnhhtt.exe dpvjd.exe PID 3052 wrote to memory of 3424 3052 dpvjd.exe xflfxxr.exe PID 3052 wrote to memory of 3424 3052 dpvjd.exe xflfxxr.exe PID 3052 wrote to memory of 3424 3052 dpvjd.exe xflfxxr.exe PID 3424 wrote to memory of 1216 3424 xflfxxr.exe xlllfff.exe PID 3424 wrote to memory of 1216 3424 xflfxxr.exe xlllfff.exe PID 3424 wrote to memory of 1216 3424 xflfxxr.exe xlllfff.exe PID 1216 wrote to memory of 3740 1216 xlllfff.exe nhhhbt.exe PID 1216 wrote to memory of 3740 1216 xlllfff.exe nhhhbt.exe PID 1216 wrote to memory of 3740 1216 xlllfff.exe nhhhbt.exe PID 3740 wrote to memory of 1864 3740 nhhhbt.exe djppj.exe PID 3740 wrote to memory of 1864 3740 nhhhbt.exe djppj.exe PID 3740 wrote to memory of 1864 3740 nhhhbt.exe djppj.exe PID 1864 wrote to memory of 4372 1864 djppj.exe pjdpj.exe PID 1864 wrote to memory of 4372 1864 djppj.exe pjdpj.exe PID 1864 wrote to memory of 4372 1864 djppj.exe pjdpj.exe PID 4372 wrote to memory of 2820 4372 pjdpj.exe xrrxrxr.exe PID 4372 wrote to memory of 2820 4372 pjdpj.exe xrrxrxr.exe PID 4372 wrote to memory of 2820 4372 pjdpj.exe xrrxrxr.exe PID 2820 wrote to memory of 3172 2820 xrrxrxr.exe tnhttt.exe PID 2820 wrote to memory of 3172 2820 xrrxrxr.exe tnhttt.exe PID 2820 wrote to memory of 3172 2820 xrrxrxr.exe tnhttt.exe PID 3172 wrote to memory of 4860 3172 tnhttt.exe 3pdvp.exe PID 3172 wrote to memory of 4860 3172 tnhttt.exe 3pdvp.exe PID 3172 wrote to memory of 4860 3172 tnhttt.exe 3pdvp.exe PID 4860 wrote to memory of 4560 4860 3pdvp.exe lrxxrxl.exe PID 4860 wrote to memory of 4560 4860 3pdvp.exe lrxxrxl.exe PID 4860 wrote to memory of 4560 4860 3pdvp.exe lrxxrxl.exe PID 4560 wrote to memory of 1836 4560 lrxxrxl.exe frllllr.exe PID 4560 wrote to memory of 1836 4560 lrxxrxl.exe frllllr.exe PID 4560 wrote to memory of 1836 4560 lrxxrxl.exe frllllr.exe PID 1836 wrote to memory of 2784 1836 frllllr.exe 5tnhbb.exe PID 1836 wrote to memory of 2784 1836 frllllr.exe 5tnhbb.exe PID 1836 wrote to memory of 2784 1836 frllllr.exe 5tnhbb.exe PID 2784 wrote to memory of 4984 2784 5tnhbb.exe bhhbnn.exe PID 2784 wrote to memory of 4984 2784 5tnhbb.exe bhhbnn.exe PID 2784 wrote to memory of 4984 2784 5tnhbb.exe bhhbnn.exe PID 4984 wrote to memory of 1548 4984 bhhbnn.exe pdjjd.exe PID 4984 wrote to memory of 1548 4984 bhhbnn.exe pdjjd.exe PID 4984 wrote to memory of 1548 4984 bhhbnn.exe pdjjd.exe PID 1548 wrote to memory of 3948 1548 pdjjd.exe 5lxrrrx.exe PID 1548 wrote to memory of 3948 1548 pdjjd.exe 5lxrrrx.exe PID 1548 wrote to memory of 3948 1548 pdjjd.exe 5lxrrrx.exe PID 3948 wrote to memory of 2384 3948 5lxrrrx.exe 3xxrlxx.exe PID 3948 wrote to memory of 2384 3948 5lxrrrx.exe 3xxrlxx.exe PID 3948 wrote to memory of 2384 3948 5lxrrrx.exe 3xxrlxx.exe PID 2384 wrote to memory of 1860 2384 3xxrlxx.exe bttttt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c1e916c080d8caacb08e752d6fb20b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2c1e916c080d8caacb08e752d6fb20b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\9rxxlrf.exec:\9rxxlrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\bbhbtn.exec:\bbhbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\3vddd.exec:\3vddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\pvpvv.exec:\pvpvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\hnhhtt.exec:\hnhhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\dpvjd.exec:\dpvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\xflfxxr.exec:\xflfxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\xlllfff.exec:\xlllfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\nhhhbt.exec:\nhhhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\djppj.exec:\djppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\pjdpj.exec:\pjdpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\xrrxrxr.exec:\xrrxrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\tnhttt.exec:\tnhttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\3pdvp.exec:\3pdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\lrxxrxl.exec:\lrxxrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\frllllr.exec:\frllllr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\5tnhbb.exec:\5tnhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\bhhbnn.exec:\bhhbnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\pdjjd.exec:\pdjjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\5lxrrrx.exec:\5lxrrrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\3xxrlxx.exec:\3xxrlxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\bttttt.exec:\bttttt.exe23⤵
- Executes dropped EXE
PID:1860 -
\??\c:\pdjjj.exec:\pdjjj.exe24⤵
- Executes dropped EXE
PID:3588 -
\??\c:\xlfrrrl.exec:\xlfrrrl.exe25⤵
- Executes dropped EXE
PID:4432 -
\??\c:\hnnnhh.exec:\hnnnhh.exe26⤵
- Executes dropped EXE
PID:3300 -
\??\c:\5bbbtn.exec:\5bbbtn.exe27⤵
- Executes dropped EXE
PID:1328 -
\??\c:\pvjjv.exec:\pvjjv.exe28⤵
- Executes dropped EXE
PID:4652 -
\??\c:\rlfxffl.exec:\rlfxffl.exe29⤵
- Executes dropped EXE
PID:4160 -
\??\c:\nbbbtn.exec:\nbbbtn.exe30⤵
- Executes dropped EXE
PID:3304 -
\??\c:\nbbtnh.exec:\nbbtnh.exe31⤵
- Executes dropped EXE
PID:1660 -
\??\c:\9xxrlrl.exec:\9xxrlrl.exe32⤵
- Executes dropped EXE
PID:4520 -
\??\c:\1rrlfxx.exec:\1rrlfxx.exe33⤵
- Executes dropped EXE
PID:4480 -
\??\c:\hntnnh.exec:\hntnnh.exe34⤵
- Executes dropped EXE
PID:3896 -
\??\c:\5pvpv.exec:\5pvpv.exe35⤵
- Executes dropped EXE
PID:1984 -
\??\c:\3xxrfxr.exec:\3xxrfxr.exe36⤵
- Executes dropped EXE
PID:3704 -
\??\c:\lxlxffl.exec:\lxlxffl.exe37⤵
- Executes dropped EXE
PID:3424 -
\??\c:\bbtnhh.exec:\bbtnhh.exe38⤵
- Executes dropped EXE
PID:2376 -
\??\c:\tnhbnh.exec:\tnhbnh.exe39⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jjjvj.exec:\jjjvj.exe40⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xrrfrlf.exec:\xrrfrlf.exe41⤵
- Executes dropped EXE
PID:1776 -
\??\c:\5btnht.exec:\5btnht.exe42⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ddpjd.exec:\ddpjd.exe43⤵
- Executes dropped EXE
PID:1492 -
\??\c:\pvdvv.exec:\pvdvv.exe44⤵
- Executes dropped EXE
PID:3852 -
\??\c:\lxrlrxr.exec:\lxrlrxr.exe45⤵
- Executes dropped EXE
PID:2228 -
\??\c:\9bhbnn.exec:\9bhbnn.exe46⤵
- Executes dropped EXE
PID:2128 -
\??\c:\btbhhh.exec:\btbhhh.exe47⤵
- Executes dropped EXE
PID:3616 -
\??\c:\jddvd.exec:\jddvd.exe48⤵
- Executes dropped EXE
PID:2428 -
\??\c:\vjjdv.exec:\vjjdv.exe49⤵
- Executes dropped EXE
PID:5012 -
\??\c:\xrxxfff.exec:\xrxxfff.exe50⤵
- Executes dropped EXE
PID:1888 -
\??\c:\7lllffx.exec:\7lllffx.exe51⤵
- Executes dropped EXE
PID:1088 -
\??\c:\7bbbtt.exec:\7bbbtt.exe52⤵
- Executes dropped EXE
PID:2808 -
\??\c:\dvjvj.exec:\dvjvj.exe53⤵
- Executes dropped EXE
PID:2036 -
\??\c:\1jpjv.exec:\1jpjv.exe54⤵
- Executes dropped EXE
PID:2572 -
\??\c:\lrlxrll.exec:\lrlxrll.exe55⤵
- Executes dropped EXE
PID:4308 -
\??\c:\nbhtnn.exec:\nbhtnn.exe56⤵
- Executes dropped EXE
PID:1200 -
\??\c:\bhbtnn.exec:\bhbtnn.exe57⤵
- Executes dropped EXE
PID:4432 -
\??\c:\vpvpj.exec:\vpvpj.exe58⤵
- Executes dropped EXE
PID:680 -
\??\c:\jvdjj.exec:\jvdjj.exe59⤵
- Executes dropped EXE
PID:4468 -
\??\c:\rlrxrrf.exec:\rlrxrrf.exe60⤵
- Executes dropped EXE
PID:1328 -
\??\c:\hbbbbb.exec:\hbbbbb.exe61⤵
- Executes dropped EXE
PID:5032 -
\??\c:\nbbbbt.exec:\nbbbbt.exe62⤵
- Executes dropped EXE
PID:1608 -
\??\c:\jddvd.exec:\jddvd.exe63⤵
- Executes dropped EXE
PID:4840 -
\??\c:\5vjvv.exec:\5vjvv.exe64⤵
- Executes dropped EXE
PID:3032 -
\??\c:\5lfxrrl.exec:\5lfxrrl.exe65⤵
- Executes dropped EXE
PID:3248 -
\??\c:\btnnhn.exec:\btnnhn.exe66⤵PID:4348
-
\??\c:\htnhhh.exec:\htnhhh.exe67⤵PID:5036
-
\??\c:\vdjpv.exec:\vdjpv.exe68⤵PID:4656
-
\??\c:\ntbnbn.exec:\ntbnbn.exe69⤵PID:1984
-
\??\c:\3tbtnh.exec:\3tbtnh.exe70⤵PID:2340
-
\??\c:\pjjdp.exec:\pjjdp.exe71⤵PID:2028
-
\??\c:\lffxrrx.exec:\lffxrrx.exe72⤵PID:1864
-
\??\c:\llrrrrr.exec:\llrrrrr.exe73⤵PID:4356
-
\??\c:\btttbn.exec:\btttbn.exe74⤵PID:412
-
\??\c:\tbnhbb.exec:\tbnhbb.exe75⤵PID:3172
-
\??\c:\vvvpd.exec:\vvvpd.exe76⤵PID:3852
-
\??\c:\xrlfrff.exec:\xrlfrff.exe77⤵PID:1616
-
\??\c:\rrllffx.exec:\rrllffx.exe78⤵PID:2128
-
\??\c:\hbhbbb.exec:\hbhbbb.exe79⤵PID:1336
-
\??\c:\ppdpj.exec:\ppdpj.exe80⤵PID:1968
-
\??\c:\pddvv.exec:\pddvv.exe81⤵PID:4984
-
\??\c:\llllrrr.exec:\llllrrr.exe82⤵PID:3116
-
\??\c:\bnnhhh.exec:\bnnhhh.exe83⤵PID:3264
-
\??\c:\7bbtnn.exec:\7bbtnn.exe84⤵PID:2384
-
\??\c:\pvdvv.exec:\pvdvv.exe85⤵PID:3292
-
\??\c:\xfxxlfl.exec:\xfxxlfl.exe86⤵PID:4952
-
\??\c:\nnhhhh.exec:\nnhhhh.exe87⤵PID:2232
-
\??\c:\pdddd.exec:\pdddd.exe88⤵PID:2304
-
\??\c:\dpppj.exec:\dpppj.exe89⤵PID:4312
-
\??\c:\1xxrrfx.exec:\1xxrrfx.exe90⤵PID:4404
-
\??\c:\hntnhh.exec:\hntnhh.exe91⤵PID:5032
-
\??\c:\hbhbnn.exec:\hbhbnn.exe92⤵PID:4408
-
\??\c:\1pjdv.exec:\1pjdv.exe93⤵PID:3944
-
\??\c:\9ppdd.exec:\9ppdd.exe94⤵PID:596
-
\??\c:\3rrlllf.exec:\3rrlllf.exe95⤵PID:1660
-
\??\c:\tbnnhh.exec:\tbnnhh.exe96⤵PID:4028
-
\??\c:\bttnnb.exec:\bttnnb.exe97⤵PID:4712
-
\??\c:\pjdjd.exec:\pjdjd.exe98⤵PID:4480
-
\??\c:\llrlxlf.exec:\llrlxlf.exe99⤵PID:1416
-
\??\c:\btnhbb.exec:\btnhbb.exe100⤵PID:1708
-
\??\c:\7djjj.exec:\7djjj.exe101⤵PID:1216
-
\??\c:\vvddd.exec:\vvddd.exe102⤵PID:3732
-
\??\c:\lfxrlff.exec:\lfxrlff.exe103⤵PID:1972
-
\??\c:\lfxrllf.exec:\lfxrllf.exe104⤵PID:4356
-
\??\c:\9tbbtt.exec:\9tbbtt.exe105⤵PID:3148
-
\??\c:\jjpjj.exec:\jjpjj.exe106⤵PID:3236
-
\??\c:\pjpdp.exec:\pjpdp.exe107⤵PID:4964
-
\??\c:\lxlfrrx.exec:\lxlfrrx.exe108⤵PID:2428
-
\??\c:\bhbnnn.exec:\bhbnnn.exe109⤵PID:1968
-
\??\c:\ddpdj.exec:\ddpdj.exe110⤵PID:1268
-
\??\c:\pvddj.exec:\pvddj.exe111⤵PID:904
-
\??\c:\lfxrxxr.exec:\lfxrxxr.exe112⤵PID:1048
-
\??\c:\bthtnb.exec:\bthtnb.exe113⤵PID:1072
-
\??\c:\nbnhnn.exec:\nbnhnn.exe114⤵PID:2844
-
\??\c:\9ddvp.exec:\9ddvp.exe115⤵PID:3532
-
\??\c:\lflfffl.exec:\lflfffl.exe116⤵PID:4468
-
\??\c:\rlrrxxx.exec:\rlrrxxx.exe117⤵PID:2364
-
\??\c:\nnbbbb.exec:\nnbbbb.exe118⤵PID:3240
-
\??\c:\vpjpj.exec:\vpjpj.exe119⤵PID:1608
-
\??\c:\fxfxffx.exec:\fxfxffx.exe120⤵PID:2408
-
\??\c:\hbhhbb.exec:\hbhhbb.exe121⤵PID:3224
-
\??\c:\vdppp.exec:\vdppp.exe122⤵PID:1660
-
\??\c:\1rxrllf.exec:\1rxrllf.exe123⤵PID:4028
-
\??\c:\hbhtth.exec:\hbhtth.exe124⤵PID:1740
-
\??\c:\9ppvv.exec:\9ppvv.exe125⤵PID:4480
-
\??\c:\1tbhbn.exec:\1tbhbn.exe126⤵PID:1416
-
\??\c:\frffflx.exec:\frffflx.exe127⤵PID:1644
-
\??\c:\bbnnbb.exec:\bbnnbb.exe128⤵PID:1216
-
\??\c:\1jvpj.exec:\1jvpj.exe129⤵PID:3732
-
\??\c:\flxllrr.exec:\flxllrr.exe130⤵PID:4036
-
\??\c:\xffrllf.exec:\xffrllf.exe131⤵PID:3280
-
\??\c:\dvdvp.exec:\dvdvp.exe132⤵PID:3920
-
\??\c:\jvvpp.exec:\jvvpp.exe133⤵PID:3616
-
\??\c:\7lfxlxr.exec:\7lfxlxr.exe134⤵PID:520
-
\??\c:\rxffrrr.exec:\rxffrrr.exe135⤵PID:4032
-
\??\c:\tbtbbt.exec:\tbtbbt.exe136⤵PID:4984
-
\??\c:\vvpjv.exec:\vvpjv.exe137⤵PID:1704
-
\??\c:\vjdvd.exec:\vjdvd.exe138⤵PID:1032
-
\??\c:\7llxlxl.exec:\7llxlxl.exe139⤵PID:1572
-
\??\c:\bhnnhh.exec:\bhnnhh.exe140⤵PID:4168
-
\??\c:\djjvp.exec:\djjvp.exe141⤵PID:1780
-
\??\c:\vpdvp.exec:\vpdvp.exe142⤵PID:2304
-
\??\c:\frrrflf.exec:\frrrflf.exe143⤵PID:4312
-
\??\c:\5fxrlfx.exec:\5fxrlfx.exe144⤵PID:404
-
\??\c:\bnnntt.exec:\bnnntt.exe145⤵PID:4388
-
\??\c:\hthttt.exec:\hthttt.exe146⤵PID:4776
-
\??\c:\3jvvd.exec:\3jvvd.exe147⤵PID:4012
-
\??\c:\9dpjd.exec:\9dpjd.exe148⤵PID:4700
-
\??\c:\5rrrfrl.exec:\5rrrfrl.exe149⤵PID:5036
-
\??\c:\tnttnn.exec:\tnttnn.exe150⤵PID:1928
-
\??\c:\hbhnhb.exec:\hbhnhb.exe151⤵PID:1416
-
\??\c:\ppdpj.exec:\ppdpj.exe152⤵PID:2708
-
\??\c:\rrxfffl.exec:\rrxfffl.exe153⤵PID:3732
-
\??\c:\frfffff.exec:\frfffff.exe154⤵PID:1288
-
\??\c:\1nhbtt.exec:\1nhbtt.exe155⤵PID:1688
-
\??\c:\nhtbtb.exec:\nhtbtb.exe156⤵PID:1336
-
\??\c:\tnnhbt.exec:\tnnhbt.exe157⤵PID:1444
-
\??\c:\5vddd.exec:\5vddd.exe158⤵PID:2156
-
\??\c:\vvvpj.exec:\vvvpj.exe159⤵PID:3264
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe160⤵PID:3292
-
\??\c:\7lrrlxx.exec:\7lrrlxx.exe161⤵PID:840
-
\??\c:\7nhhbh.exec:\7nhhbh.exe162⤵PID:4952
-
\??\c:\nttthh.exec:\nttthh.exe163⤵PID:2844
-
\??\c:\9vdjj.exec:\9vdjj.exe164⤵PID:5076
-
\??\c:\jjdjj.exec:\jjdjj.exe165⤵PID:4404
-
\??\c:\fxffllx.exec:\fxffllx.exe166⤵PID:3544
-
\??\c:\rllllll.exec:\rllllll.exe167⤵PID:3304
-
\??\c:\nhbbtb.exec:\nhbbtb.exe168⤵PID:2468
-
\??\c:\hhtttb.exec:\hhtttb.exe169⤵PID:4348
-
\??\c:\pjjdd.exec:\pjjdd.exe170⤵PID:3696
-
\??\c:\dpvpp.exec:\dpvpp.exe171⤵PID:4480
-
\??\c:\xxlllxx.exec:\xxlllxx.exe172⤵PID:3488
-
\??\c:\3lffxfx.exec:\3lffxfx.exe173⤵PID:752
-
\??\c:\bhhhhh.exec:\bhhhhh.exe174⤵PID:1416
-
\??\c:\hntbnt.exec:\hntbnt.exe175⤵PID:3692
-
\??\c:\1jjpj.exec:\1jjpj.exe176⤵PID:3732
-
\??\c:\pdvpp.exec:\pdvpp.exe177⤵PID:3576
-
\??\c:\lrxlxxl.exec:\lrxlxxl.exe178⤵PID:1688
-
\??\c:\lxlrrrr.exec:\lxlrrrr.exe179⤵PID:3764
-
\??\c:\thnhbn.exec:\thnhbn.exe180⤵PID:5108
-
\??\c:\vpjvv.exec:\vpjvv.exe181⤵PID:2872
-
\??\c:\1dddp.exec:\1dddp.exe182⤵PID:4716
-
\??\c:\fxffllr.exec:\fxffllr.exe183⤵PID:3324
-
\??\c:\xfxrxxf.exec:\xfxrxxf.exe184⤵PID:1572
-
\??\c:\nnnntt.exec:\nnnntt.exe185⤵PID:1580
-
\??\c:\1ppjd.exec:\1ppjd.exe186⤵PID:4412
-
\??\c:\xfxrllf.exec:\xfxrllf.exe187⤵PID:4164
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe188⤵PID:1892
-
\??\c:\5hhhhh.exec:\5hhhhh.exe189⤵PID:3024
-
\??\c:\dddvv.exec:\dddvv.exe190⤵PID:4388
-
\??\c:\3pjjp.exec:\3pjjp.exe191⤵PID:2084
-
\??\c:\xllxfrf.exec:\xllxfrf.exe192⤵PID:704
-
\??\c:\frrrrff.exec:\frrrrff.exe193⤵PID:1496
-
\??\c:\tnttnt.exec:\tnttnt.exe194⤵PID:2864
-
\??\c:\nttbbh.exec:\nttbbh.exe195⤵PID:2996
-
\??\c:\vdjpj.exec:\vdjpj.exe196⤵PID:4068
-
\??\c:\rxxxrll.exec:\rxxxrll.exe197⤵PID:2120
-
\??\c:\xlrlrxf.exec:\xlrlrxf.exe198⤵PID:1664
-
\??\c:\1nhbbh.exec:\1nhbbh.exe199⤵PID:3836
-
\??\c:\nbnnbh.exec:\nbnnbh.exe200⤵PID:2296
-
\??\c:\vdjjj.exec:\vdjjj.exe201⤵PID:1336
-
\??\c:\vjddp.exec:\vjddp.exe202⤵PID:1268
-
\??\c:\frxrffx.exec:\frxrffx.exe203⤵PID:2168
-
\??\c:\rrffxxx.exec:\rrffxxx.exe204⤵PID:872
-
\??\c:\thhbtt.exec:\thhbtt.exe205⤵PID:840
-
\??\c:\3thhhh.exec:\3thhhh.exe206⤵PID:1572
-
\??\c:\htnhbh.exec:\htnhbh.exe207⤵PID:924
-
\??\c:\vdvjj.exec:\vdvjj.exe208⤵PID:1436
-
\??\c:\jpvdj.exec:\jpvdj.exe209⤵PID:2408
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe210⤵PID:2512
-
\??\c:\fllffxr.exec:\fllffxr.exe211⤵PID:4028
-
\??\c:\ntbbtb.exec:\ntbbtb.exe212⤵PID:1708
-
\??\c:\ttbbbb.exec:\ttbbbb.exe213⤵PID:3180
-
\??\c:\dvvvv.exec:\dvvvv.exe214⤵PID:1692
-
\??\c:\dvpjv.exec:\dvpjv.exe215⤵PID:4172
-
\??\c:\lrrxxff.exec:\lrrxxff.exe216⤵PID:1972
-
\??\c:\frrlfrr.exec:\frrlfrr.exe217⤵PID:2820
-
\??\c:\nnbhbh.exec:\nnbhbh.exe218⤵PID:3852
-
\??\c:\ntttnt.exec:\ntttnt.exe219⤵PID:1460
-
\??\c:\dpvvv.exec:\dpvvv.exe220⤵PID:596
-
\??\c:\vvvdp.exec:\vvvdp.exe221⤵PID:4776
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe222⤵PID:3632
-
\??\c:\lxfrxfx.exec:\lxfrxfx.exe223⤵PID:3764
-
\??\c:\tntnhh.exec:\tntnhh.exe224⤵PID:1320
-
\??\c:\hhtbhh.exec:\hhtbhh.exe225⤵PID:2872
-
\??\c:\jdjjd.exec:\jdjjd.exe226⤵PID:4744
-
\??\c:\vpjdj.exec:\vpjdj.exe227⤵PID:4484
-
\??\c:\rxffxxx.exec:\rxffxxx.exe228⤵PID:4888
-
\??\c:\xlrrllf.exec:\xlrrllf.exe229⤵PID:2112
-
\??\c:\btnnnn.exec:\btnnnn.exe230⤵PID:4404
-
\??\c:\hhbbbh.exec:\hhbbbh.exe231⤵PID:3052
-
\??\c:\3dpjp.exec:\3dpjp.exe232⤵PID:2364
-
\??\c:\dpppd.exec:\dpppd.exe233⤵PID:1028
-
\??\c:\rrrrllf.exec:\rrrrllf.exe234⤵PID:3248
-
\??\c:\lrrlfll.exec:\lrrlfll.exe235⤵PID:4056
-
\??\c:\fxfxxfx.exec:\fxfxxfx.exe236⤵PID:1496
-
\??\c:\3tbbbb.exec:\3tbbbb.exe237⤵PID:4904
-
\??\c:\hhttnb.exec:\hhttnb.exe238⤵PID:1492
-
\??\c:\dvpjp.exec:\dvpjp.exe239⤵PID:3280
-
\??\c:\7dvjd.exec:\7dvjd.exe240⤵PID:3184
-
\??\c:\xrfxrrr.exec:\xrfxrrr.exe241⤵PID:1888
-
\??\c:\rrllffx.exec:\rrllffx.exe242⤵PID:3576