Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 20:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe
-
Size
64KB
-
MD5
4d80bf26a8ae547018e5c490af88de90
-
SHA1
f422ccb67549a6b09c231a9dd1976b155f769b29
-
SHA256
9434a81b9e30ac69a3a97272fb7951c58e1a327b833945a7711fccbf523fba7f
-
SHA512
a8b56f797ecb7885d21422dafbc184a7b3cde0841d25bb387e19163631d0a01585aa3f9919a64146b89cd96a36f9944c244644ce514827757ce8ed37c2443982
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvdK:ymb3NkkiQ3mdBjF0yMlv
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/2624-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/524-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-35-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3932-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3352-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
flxlxfr.exejdvpj.exepjdjj.exefxfxrll.exenbhbtn.exenbbbtn.exe9jpdd.exelrlxrxf.exerlllllf.exenhttnt.exe9jjdv.exehbhhtb.exe7bhbtt.exedpdvv.exexlfrfrx.exedpddv.exe9pjjd.exebhbtnh.exehthnhh.exepjvvp.exefflfxxl.exerrllxxr.exetnhnbb.exe5djjd.exefxlxrxr.exebbhtnn.exe1vddv.exelfrfxlr.exehnbtnb.exethhnhn.exedpvjp.exelllfxxx.exepdpjp.exevvpjv.exexrlflrl.exe7hnnbt.exe3dpjd.exedvppj.exerlrlffx.exentttnn.exenhnhnh.exedpdvv.exeffxrfxx.exefxxlxrf.exebhbtbt.exepvpvj.exepjvpp.exexflfrrr.exetthbnn.exevpjjd.exellrrlll.exehhntnt.exedddpp.exejpjjd.exexfxxffr.exe3hbbhn.exedvdvv.exe1jddp.exefxfxxxf.exebttttt.exenhbtnn.exejpvdd.exepvjpj.exepjpjj.exepid process 3460 flxlxfr.exe 524 jdvpj.exe 448 pjdjj.exe 3376 fxfxrll.exe 3848 nbhbtn.exe 3320 nbbbtn.exe 3364 9jpdd.exe 4136 lrlxrxf.exe 3592 rlllllf.exe 4980 nhttnt.exe 4424 9jjdv.exe 4688 hbhhtb.exe 3932 7bhbtt.exe 1488 dpdvv.exe 4208 xlfrfrx.exe 3272 dpddv.exe 1248 9pjjd.exe 1668 bhbtnh.exe 4024 hthnhh.exe 1716 pjvvp.exe 2468 fflfxxl.exe 3352 rrllxxr.exe 4412 tnhnbb.exe 2904 5djjd.exe 2184 fxlxrxr.exe 4372 bbhtnn.exe 2004 1vddv.exe 2772 lfrfxlr.exe 5072 hnbtnb.exe 1124 thhnhn.exe 1772 dpvjp.exe 996 lllfxxx.exe 1612 pdpjp.exe 2020 vvpjv.exe 4836 xrlflrl.exe 2316 7hnnbt.exe 2156 3dpjd.exe 648 dvppj.exe 2528 rlrlffx.exe 1740 ntttnn.exe 1172 nhnhnh.exe 3536 dpdvv.exe 3892 ffxrfxx.exe 3204 fxxlxrf.exe 2224 bhbtbt.exe 1488 pvpvj.exe 2856 pjvpp.exe 636 xflfrrr.exe 2452 tthbnn.exe 4932 vpjjd.exe 1736 llrrlll.exe 992 hhntnt.exe 4012 dddpp.exe 4244 jpjjd.exe 4016 xfxxffr.exe 4576 3hbbhn.exe 3568 dvdvv.exe 2616 1jddp.exe 5028 fxfxxxf.exe 1444 bttttt.exe 4916 nhbtnn.exe 4532 jpvdd.exe 816 pvjpj.exe 4144 pjpjj.exe -
Processes:
resource yara_rule behavioral2/memory/3460-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/524-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3352-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exeflxlxfr.exejdvpj.exepjdjj.exefxfxrll.exenbhbtn.exenbbbtn.exe9jpdd.exelrlxrxf.exerlllllf.exenhttnt.exe9jjdv.exehbhhtb.exe7bhbtt.exedpdvv.exexlfrfrx.exedpddv.exe9pjjd.exebhbtnh.exehthnhh.exepjvvp.exefflfxxl.exedescription pid process target process PID 2624 wrote to memory of 3460 2624 4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe flxlxfr.exe PID 2624 wrote to memory of 3460 2624 4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe flxlxfr.exe PID 2624 wrote to memory of 3460 2624 4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe flxlxfr.exe PID 3460 wrote to memory of 524 3460 flxlxfr.exe jdvpj.exe PID 3460 wrote to memory of 524 3460 flxlxfr.exe jdvpj.exe PID 3460 wrote to memory of 524 3460 flxlxfr.exe jdvpj.exe PID 524 wrote to memory of 448 524 jdvpj.exe pjdjj.exe PID 524 wrote to memory of 448 524 jdvpj.exe pjdjj.exe PID 524 wrote to memory of 448 524 jdvpj.exe pjdjj.exe PID 448 wrote to memory of 3376 448 pjdjj.exe fxfxrll.exe PID 448 wrote to memory of 3376 448 pjdjj.exe fxfxrll.exe PID 448 wrote to memory of 3376 448 pjdjj.exe fxfxrll.exe PID 3376 wrote to memory of 3848 3376 fxfxrll.exe nbhbtn.exe PID 3376 wrote to memory of 3848 3376 fxfxrll.exe nbhbtn.exe PID 3376 wrote to memory of 3848 3376 fxfxrll.exe nbhbtn.exe PID 3848 wrote to memory of 3320 3848 nbhbtn.exe nbbbtn.exe PID 3848 wrote to memory of 3320 3848 nbhbtn.exe nbbbtn.exe PID 3848 wrote to memory of 3320 3848 nbhbtn.exe nbbbtn.exe PID 3320 wrote to memory of 3364 3320 nbbbtn.exe 9jpdd.exe PID 3320 wrote to memory of 3364 3320 nbbbtn.exe 9jpdd.exe PID 3320 wrote to memory of 3364 3320 nbbbtn.exe 9jpdd.exe PID 3364 wrote to memory of 4136 3364 9jpdd.exe lrlxrxf.exe PID 3364 wrote to memory of 4136 3364 9jpdd.exe lrlxrxf.exe PID 3364 wrote to memory of 4136 3364 9jpdd.exe lrlxrxf.exe PID 4136 wrote to memory of 3592 4136 lrlxrxf.exe rlllllf.exe PID 4136 wrote to memory of 3592 4136 lrlxrxf.exe rlllllf.exe PID 4136 wrote to memory of 3592 4136 lrlxrxf.exe rlllllf.exe PID 3592 wrote to memory of 4980 3592 rlllllf.exe nhttnt.exe PID 3592 wrote to memory of 4980 3592 rlllllf.exe nhttnt.exe PID 3592 wrote to memory of 4980 3592 rlllllf.exe nhttnt.exe PID 4980 wrote to memory of 4424 4980 nhttnt.exe 9jjdv.exe PID 4980 wrote to memory of 4424 4980 nhttnt.exe 9jjdv.exe PID 4980 wrote to memory of 4424 4980 nhttnt.exe 9jjdv.exe PID 4424 wrote to memory of 4688 4424 9jjdv.exe hbhhtb.exe PID 4424 wrote to memory of 4688 4424 9jjdv.exe hbhhtb.exe PID 4424 wrote to memory of 4688 4424 9jjdv.exe hbhhtb.exe PID 4688 wrote to memory of 3932 4688 hbhhtb.exe 7bhbtt.exe PID 4688 wrote to memory of 3932 4688 hbhhtb.exe 7bhbtt.exe PID 4688 wrote to memory of 3932 4688 hbhhtb.exe 7bhbtt.exe PID 3932 wrote to memory of 1488 3932 7bhbtt.exe dpdvv.exe PID 3932 wrote to memory of 1488 3932 7bhbtt.exe dpdvv.exe PID 3932 wrote to memory of 1488 3932 7bhbtt.exe dpdvv.exe PID 1488 wrote to memory of 4208 1488 dpdvv.exe xlfrfrx.exe PID 1488 wrote to memory of 4208 1488 dpdvv.exe xlfrfrx.exe PID 1488 wrote to memory of 4208 1488 dpdvv.exe xlfrfrx.exe PID 4208 wrote to memory of 3272 4208 xlfrfrx.exe dpddv.exe PID 4208 wrote to memory of 3272 4208 xlfrfrx.exe dpddv.exe PID 4208 wrote to memory of 3272 4208 xlfrfrx.exe dpddv.exe PID 3272 wrote to memory of 1248 3272 dpddv.exe 9pjjd.exe PID 3272 wrote to memory of 1248 3272 dpddv.exe 9pjjd.exe PID 3272 wrote to memory of 1248 3272 dpddv.exe 9pjjd.exe PID 1248 wrote to memory of 1668 1248 9pjjd.exe bhbtnh.exe PID 1248 wrote to memory of 1668 1248 9pjjd.exe bhbtnh.exe PID 1248 wrote to memory of 1668 1248 9pjjd.exe bhbtnh.exe PID 1668 wrote to memory of 4024 1668 bhbtnh.exe hthnhh.exe PID 1668 wrote to memory of 4024 1668 bhbtnh.exe hthnhh.exe PID 1668 wrote to memory of 4024 1668 bhbtnh.exe hthnhh.exe PID 4024 wrote to memory of 1716 4024 hthnhh.exe pjvvp.exe PID 4024 wrote to memory of 1716 4024 hthnhh.exe pjvvp.exe PID 4024 wrote to memory of 1716 4024 hthnhh.exe pjvvp.exe PID 1716 wrote to memory of 2468 1716 pjvvp.exe fflfxxl.exe PID 1716 wrote to memory of 2468 1716 pjvvp.exe fflfxxl.exe PID 1716 wrote to memory of 2468 1716 pjvvp.exe fflfxxl.exe PID 2468 wrote to memory of 3352 2468 fflfxxl.exe rrllxxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4d80bf26a8ae547018e5c490af88de90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\flxlxfr.exec:\flxlxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\jdvpj.exec:\jdvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
\??\c:\pjdjj.exec:\pjdjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\fxfxrll.exec:\fxfxrll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\nbhbtn.exec:\nbhbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\nbbbtn.exec:\nbbbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\9jpdd.exec:\9jpdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\lrlxrxf.exec:\lrlxrxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\rlllllf.exec:\rlllllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\nhttnt.exec:\nhttnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\9jjdv.exec:\9jjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\hbhhtb.exec:\hbhhtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\7bhbtt.exec:\7bhbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\dpdvv.exec:\dpdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\xlfrfrx.exec:\xlfrfrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\dpddv.exec:\dpddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\9pjjd.exec:\9pjjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\bhbtnh.exec:\bhbtnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\hthnhh.exec:\hthnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\pjvvp.exec:\pjvvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\fflfxxl.exec:\fflfxxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\rrllxxr.exec:\rrllxxr.exe23⤵
- Executes dropped EXE
PID:3352 -
\??\c:\tnhnbb.exec:\tnhnbb.exe24⤵
- Executes dropped EXE
PID:4412 -
\??\c:\5djjd.exec:\5djjd.exe25⤵
- Executes dropped EXE
PID:2904 -
\??\c:\fxlxrxr.exec:\fxlxrxr.exe26⤵
- Executes dropped EXE
PID:2184 -
\??\c:\bbhtnn.exec:\bbhtnn.exe27⤵
- Executes dropped EXE
PID:4372 -
\??\c:\1vddv.exec:\1vddv.exe28⤵
- Executes dropped EXE
PID:2004 -
\??\c:\lfrfxlr.exec:\lfrfxlr.exe29⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hnbtnb.exec:\hnbtnb.exe30⤵
- Executes dropped EXE
PID:5072 -
\??\c:\thhnhn.exec:\thhnhn.exe31⤵
- Executes dropped EXE
PID:1124 -
\??\c:\dpvjp.exec:\dpvjp.exe32⤵
- Executes dropped EXE
PID:1772 -
\??\c:\lllfxxx.exec:\lllfxxx.exe33⤵
- Executes dropped EXE
PID:996 -
\??\c:\pdpjp.exec:\pdpjp.exe34⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vvpjv.exec:\vvpjv.exe35⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xrlflrl.exec:\xrlflrl.exe36⤵
- Executes dropped EXE
PID:4836 -
\??\c:\7hnnbt.exec:\7hnnbt.exe37⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3dpjd.exec:\3dpjd.exe38⤵
- Executes dropped EXE
PID:2156 -
\??\c:\dvppj.exec:\dvppj.exe39⤵
- Executes dropped EXE
PID:648 -
\??\c:\rlrlffx.exec:\rlrlffx.exe40⤵
- Executes dropped EXE
PID:2528 -
\??\c:\ntttnn.exec:\ntttnn.exe41⤵
- Executes dropped EXE
PID:1740 -
\??\c:\nhnhnh.exec:\nhnhnh.exe42⤵
- Executes dropped EXE
PID:1172 -
\??\c:\dpdvv.exec:\dpdvv.exe43⤵
- Executes dropped EXE
PID:3536 -
\??\c:\ffxrfxx.exec:\ffxrfxx.exe44⤵
- Executes dropped EXE
PID:3892 -
\??\c:\fxxlxrf.exec:\fxxlxrf.exe45⤵
- Executes dropped EXE
PID:3204 -
\??\c:\bhbtbt.exec:\bhbtbt.exe46⤵
- Executes dropped EXE
PID:2224 -
\??\c:\pvpvj.exec:\pvpvj.exe47⤵
- Executes dropped EXE
PID:1488 -
\??\c:\pjvpp.exec:\pjvpp.exe48⤵
- Executes dropped EXE
PID:2856 -
\??\c:\xflfrrr.exec:\xflfrrr.exe49⤵
- Executes dropped EXE
PID:636 -
\??\c:\tthbnn.exec:\tthbnn.exe50⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vpjjd.exec:\vpjjd.exe51⤵
- Executes dropped EXE
PID:4932 -
\??\c:\llrrlll.exec:\llrrlll.exe52⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hhntnt.exec:\hhntnt.exe53⤵
- Executes dropped EXE
PID:992 -
\??\c:\dddpp.exec:\dddpp.exe54⤵
- Executes dropped EXE
PID:4012 -
\??\c:\jpjjd.exec:\jpjjd.exe55⤵
- Executes dropped EXE
PID:4244 -
\??\c:\xfxxffr.exec:\xfxxffr.exe56⤵
- Executes dropped EXE
PID:4016 -
\??\c:\3hbbhn.exec:\3hbbhn.exe57⤵
- Executes dropped EXE
PID:4576 -
\??\c:\dvdvv.exec:\dvdvv.exe58⤵
- Executes dropped EXE
PID:3568 -
\??\c:\1jddp.exec:\1jddp.exe59⤵
- Executes dropped EXE
PID:2616 -
\??\c:\fxfxxxf.exec:\fxfxxxf.exe60⤵
- Executes dropped EXE
PID:5028 -
\??\c:\bttttt.exec:\bttttt.exe61⤵
- Executes dropped EXE
PID:1444 -
\??\c:\nhbtnn.exec:\nhbtnn.exe62⤵
- Executes dropped EXE
PID:4916 -
\??\c:\jpvdd.exec:\jpvdd.exe63⤵
- Executes dropped EXE
PID:4532 -
\??\c:\pvjpj.exec:\pvjpj.exe64⤵
- Executes dropped EXE
PID:816 -
\??\c:\pjpjj.exec:\pjpjj.exe65⤵
- Executes dropped EXE
PID:4144 -
\??\c:\fflrfrf.exec:\fflrfrf.exe66⤵PID:5004
-
\??\c:\1hhhbb.exec:\1hhhbb.exe67⤵PID:4808
-
\??\c:\hhttbh.exec:\hhttbh.exe68⤵PID:4068
-
\??\c:\jjpvv.exec:\jjpvv.exe69⤵PID:2188
-
\??\c:\vjjpp.exec:\vjjpp.exe70⤵PID:5084
-
\??\c:\rflxfrl.exec:\rflxfrl.exe71⤵PID:2732
-
\??\c:\lflllll.exec:\lflllll.exe72⤵PID:924
-
\??\c:\hbhbtt.exec:\hbhbtt.exe73⤵PID:2980
-
\??\c:\vpdpv.exec:\vpdpv.exe74⤵PID:4436
-
\??\c:\ppdjj.exec:\ppdjj.exe75⤵PID:3592
-
\??\c:\9thnbh.exec:\9thnbh.exe76⤵PID:3668
-
\??\c:\hbnbbn.exec:\hbnbbn.exe77⤵PID:1172
-
\??\c:\vjdvv.exec:\vjdvv.exe78⤵PID:3536
-
\??\c:\rrrlfff.exec:\rrrlfff.exe79⤵PID:3892
-
\??\c:\fflfxrf.exec:\fflfxrf.exe80⤵PID:1648
-
\??\c:\nththt.exec:\nththt.exe81⤵PID:2844
-
\??\c:\nnntht.exec:\nnntht.exe82⤵PID:1488
-
\??\c:\jdjdd.exec:\jdjdd.exe83⤵PID:2856
-
\??\c:\3ffxrxr.exec:\3ffxrxr.exe84⤵PID:3712
-
\??\c:\lrxrlrr.exec:\lrxrlrr.exe85⤵PID:4380
-
\??\c:\9hbhnb.exec:\9hbhnb.exe86⤵PID:4848
-
\??\c:\bnthbh.exec:\bnthbh.exe87⤵PID:904
-
\??\c:\jdjjj.exec:\jdjjj.exe88⤵PID:1736
-
\??\c:\9vvvv.exec:\9vvvv.exe89⤵PID:4652
-
\??\c:\xrlffff.exec:\xrlffff.exe90⤵PID:1996
-
\??\c:\hnbtnn.exec:\hnbtnn.exe91⤵PID:2016
-
\??\c:\ttnnnn.exec:\ttnnnn.exe92⤵PID:3224
-
\??\c:\3pppv.exec:\3pppv.exe93⤵PID:1524
-
\??\c:\vvdvd.exec:\vvdvd.exe94⤵PID:1064
-
\??\c:\rrflffr.exec:\rrflffr.exe95⤵PID:3540
-
\??\c:\btbnnt.exec:\btbnnt.exe96⤵PID:4492
-
\??\c:\jvpvp.exec:\jvpvp.exe97⤵PID:2232
-
\??\c:\dpvpp.exec:\dpvpp.exe98⤵PID:376
-
\??\c:\xlxrlrl.exec:\xlxrlrl.exe99⤵PID:2132
-
\??\c:\btnbht.exec:\btnbht.exe100⤵PID:4904
-
\??\c:\btbhbb.exec:\btbhbb.exe101⤵PID:1772
-
\??\c:\7jjjv.exec:\7jjjv.exe102⤵PID:2152
-
\??\c:\dvdvp.exec:\dvdvp.exe103⤵PID:4988
-
\??\c:\fxxllff.exec:\fxxllff.exe104⤵PID:3612
-
\??\c:\xlfxxxl.exec:\xlfxxxl.exe105⤵PID:3340
-
\??\c:\7tttnb.exec:\7tttnb.exe106⤵PID:3936
-
\??\c:\vvddp.exec:\vvddp.exe107⤵PID:4312
-
\??\c:\9jppp.exec:\9jppp.exe108⤵PID:4912
-
\??\c:\frrfflf.exec:\frrfflf.exe109⤵PID:4260
-
\??\c:\nthhbh.exec:\nthhbh.exe110⤵PID:3776
-
\??\c:\7nnnbb.exec:\7nnnbb.exe111⤵PID:2008
-
\??\c:\vdjjp.exec:\vdjjp.exe112⤵PID:3932
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe113⤵PID:3604
-
\??\c:\9lfrxlf.exec:\9lfrxlf.exe114⤵PID:1648
-
\??\c:\vdvjv.exec:\vdvjv.exe115⤵PID:2844
-
\??\c:\lfxflxl.exec:\lfxflxl.exe116⤵PID:4520
-
\??\c:\btttnn.exec:\btttnn.exe117⤵PID:2260
-
\??\c:\dvppp.exec:\dvppp.exe118⤵PID:3232
-
\??\c:\rxrllll.exec:\rxrllll.exe119⤵PID:3248
-
\??\c:\lxrlllf.exec:\lxrlllf.exe120⤵PID:3412
-
\??\c:\nnbbtt.exec:\nnbbtt.exe121⤵PID:3804
-
\??\c:\vpjdd.exec:\vpjdd.exe122⤵PID:1716
-
\??\c:\pdjdj.exec:\pdjdj.exe123⤵PID:1112
-
\??\c:\rllxrxf.exec:\rllxrxf.exe124⤵PID:1996
-
\??\c:\nbbbbb.exec:\nbbbbb.exe125⤵PID:2016
-
\??\c:\dvdvv.exec:\dvdvv.exe126⤵PID:2904
-
\??\c:\jjpvv.exec:\jjpvv.exe127⤵PID:1524
-
\??\c:\lffxrrr.exec:\lffxrrr.exe128⤵PID:3304
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe129⤵PID:1604
-
\??\c:\5hntnn.exec:\5hntnn.exe130⤵PID:4532
-
\??\c:\9ttnnh.exec:\9ttnnh.exe131⤵PID:5072
-
\??\c:\dvvvv.exec:\dvvvv.exe132⤵PID:2132
-
\??\c:\3llfffx.exec:\3llfffx.exe133⤵PID:3672
-
\??\c:\rrxfxrx.exec:\rrxfxrx.exe134⤵PID:3684
-
\??\c:\9thhbb.exec:\9thhbb.exe135⤵PID:3320
-
\??\c:\thtbtb.exec:\thtbtb.exe136⤵PID:924
-
\??\c:\vdppp.exec:\vdppp.exe137⤵PID:760
-
\??\c:\dpvvp.exec:\dpvvp.exe138⤵PID:3680
-
\??\c:\ffrxlll.exec:\ffrxlll.exe139⤵PID:2160
-
\??\c:\xrlfllr.exec:\xrlfllr.exe140⤵PID:2308
-
\??\c:\hhhnnb.exec:\hhhnnb.exe141⤵PID:3204
-
\??\c:\bthbhh.exec:\bthbhh.exe142⤵PID:2860
-
\??\c:\9ddvv.exec:\9ddvv.exe143⤵PID:5116
-
\??\c:\dvvpj.exec:\dvvpj.exe144⤵PID:2844
-
\??\c:\rlrrlll.exec:\rlrrlll.exe145⤵PID:1248
-
\??\c:\hhhhhh.exec:\hhhhhh.exe146⤵PID:2452
-
\??\c:\bttttt.exec:\bttttt.exe147⤵PID:3096
-
\??\c:\jdpjv.exec:\jdpjv.exe148⤵PID:4888
-
\??\c:\flfxlxf.exec:\flfxlxf.exe149⤵PID:2500
-
\??\c:\htbhbh.exec:\htbhbh.exe150⤵PID:3148
-
\??\c:\3pvpj.exec:\3pvpj.exe151⤵PID:1716
-
\??\c:\frxrllf.exec:\frxrllf.exe152⤵PID:1112
-
\??\c:\jvppp.exec:\jvppp.exe153⤵PID:1352
-
\??\c:\xfxxxlx.exec:\xfxxxlx.exe154⤵PID:3568
-
\??\c:\lflxrrl.exec:\lflxrrl.exe155⤵PID:1064
-
\??\c:\pddvj.exec:\pddvj.exe156⤵PID:3304
-
\??\c:\djpjv.exec:\djpjv.exe157⤵PID:5040
-
\??\c:\fxrlxfr.exec:\fxrlxfr.exe158⤵PID:4144
-
\??\c:\nbnnhn.exec:\nbnnhn.exe159⤵PID:4072
-
\??\c:\vjpdd.exec:\vjpdd.exe160⤵PID:4044
-
\??\c:\pjjvp.exec:\pjjvp.exe161⤵PID:3364
-
\??\c:\5lxrxfl.exec:\5lxrxfl.exe162⤵PID:2268
-
\??\c:\htnhtt.exec:\htnhtt.exe163⤵PID:4136
-
\??\c:\dppjd.exec:\dppjd.exe164⤵PID:2596
-
\??\c:\lxfflrx.exec:\lxfflrx.exe165⤵PID:760
-
\??\c:\lxlffxf.exec:\lxlffxf.exe166⤵PID:3776
-
\??\c:\5bhbhb.exec:\5bhbhb.exe167⤵PID:1672
-
\??\c:\ntnntt.exec:\ntnntt.exe168⤵PID:3988
-
\??\c:\bbbbnt.exec:\bbbbnt.exe169⤵PID:1260
-
\??\c:\ttbbth.exec:\ttbbth.exe170⤵PID:1488
-
\??\c:\lxlrfxr.exec:\lxlrfxr.exe171⤵PID:2856
-
\??\c:\hnbhbh.exec:\hnbhbh.exe172⤵PID:2428
-
\??\c:\djpjj.exec:\djpjj.exe173⤵PID:2260
-
\??\c:\ffrrlxf.exec:\ffrrlxf.exe174⤵PID:4848
-
\??\c:\bnbtnn.exec:\bnbtnn.exe175⤵PID:3096
-
\??\c:\pvdvv.exec:\pvdvv.exe176⤵PID:992
-
\??\c:\lfxlllf.exec:\lfxlllf.exe177⤵PID:2500
-
\??\c:\nhbbbb.exec:\nhbbbb.exe178⤵PID:2472
-
\??\c:\ppjpv.exec:\ppjpv.exe179⤵PID:4596
-
\??\c:\flrrxxx.exec:\flrrxxx.exe180⤵PID:3224
-
\??\c:\bnbttb.exec:\bnbttb.exe181⤵PID:1352
-
\??\c:\tnhhhh.exec:\tnhhhh.exe182⤵PID:4352
-
\??\c:\llflxlx.exec:\llflxlx.exe183⤵PID:2456
-
\??\c:\hnthnb.exec:\hnthnb.exe184⤵PID:4852
-
\??\c:\pjppv.exec:\pjppv.exe185⤵PID:5072
-
\??\c:\xlrxrrr.exec:\xlrxrrr.exe186⤵PID:1168
-
\??\c:\1hnnnn.exec:\1hnnnn.exe187⤵PID:3672
-
\??\c:\1jjjj.exec:\1jjjj.exe188⤵PID:5108
-
\??\c:\xrxrrxx.exec:\xrxrrxx.exe189⤵PID:2156
-
\??\c:\hhntnt.exec:\hhntnt.exe190⤵PID:2268
-
\??\c:\1tbnth.exec:\1tbnth.exe191⤵PID:4136
-
\??\c:\vvppp.exec:\vvppp.exe192⤵PID:4980
-
\??\c:\pppdp.exec:\pppdp.exe193⤵PID:2160
-
\??\c:\lrxxflr.exec:\lrxxflr.exe194⤵PID:2008
-
\??\c:\9nnnhh.exec:\9nnnhh.exe195⤵PID:1672
-
\??\c:\pdvvp.exec:\pdvvp.exe196⤵PID:4928
-
\??\c:\pdjdv.exec:\pdjdv.exe197⤵PID:1260
-
\??\c:\htthth.exec:\htthth.exe198⤵PID:4520
-
\??\c:\3jppp.exec:\3jppp.exe199⤵PID:2856
-
\??\c:\xxxrfrf.exec:\xxxrfrf.exe200⤵PID:2080
-
\??\c:\htbhhn.exec:\htbhhn.exe201⤵PID:3500
-
\??\c:\tbnnhn.exec:\tbnnhn.exe202⤵PID:4848
-
\??\c:\pvjdp.exec:\pvjdp.exe203⤵PID:2468
-
\??\c:\7fffxff.exec:\7fffxff.exe204⤵PID:3148
-
\??\c:\nntnhh.exec:\nntnhh.exe205⤵PID:4812
-
\??\c:\vdvpd.exec:\vdvpd.exe206⤵PID:4952
-
\??\c:\fffxrxx.exec:\fffxrxx.exe207⤵PID:4596
-
\??\c:\thntth.exec:\thntth.exe208⤵PID:3568
-
\??\c:\ppppv.exec:\ppppv.exe209⤵PID:4188
-
\??\c:\1rrlfxr.exec:\1rrlfxr.exe210⤵PID:4352
-
\??\c:\tnnnhb.exec:\tnnnhb.exe211⤵PID:1124
-
\??\c:\ppjdd.exec:\ppjdd.exe212⤵PID:4144
-
\??\c:\vddpd.exec:\vddpd.exe213⤵PID:1168
-
\??\c:\lllfxxr.exec:\lllfxxr.exe214⤵PID:4044
-
\??\c:\ttnnnn.exec:\ttnnnn.exe215⤵PID:3320
-
\??\c:\pjdvd.exec:\pjdvd.exe216⤵PID:924
-
\??\c:\xrxrlll.exec:\xrxrlll.exe217⤵PID:1836
-
\??\c:\rrfflrf.exec:\rrfflrf.exe218⤵PID:1172
-
\??\c:\5hnhtb.exec:\5hnhtb.exe219⤵PID:4692
-
\??\c:\rfrlxff.exec:\rfrlxff.exe220⤵PID:2308
-
\??\c:\xxrlxxl.exec:\xxrlxxl.exe221⤵PID:4528
-
\??\c:\ttthtn.exec:\ttthtn.exe222⤵PID:2896
-
\??\c:\pvjdv.exec:\pvjdv.exe223⤵PID:396
-
\??\c:\tttnnh.exec:\tttnnh.exe224⤵PID:3976
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe225⤵PID:3600
-
\??\c:\bbhhhh.exec:\bbhhhh.exe226⤵PID:2404
-
\??\c:\rfrxfrr.exec:\rfrxfrr.exe227⤵PID:2260
-
\??\c:\tbtbtn.exec:\tbtbtn.exe228⤵PID:3508
-
\??\c:\pjjjd.exec:\pjjjd.exe229⤵PID:4652
-
\??\c:\hnbbbt.exec:\hnbbbt.exe230⤵PID:992
-
\??\c:\vvvpj.exec:\vvvpj.exe231⤵PID:1296
-
\??\c:\hbbnht.exec:\hbbnht.exe232⤵PID:4412
-
\??\c:\5dpjp.exec:\5dpjp.exe233⤵PID:64
-
\??\c:\lrxrrrf.exec:\lrxrrrf.exe234⤵PID:4492
-
\??\c:\5bbnnn.exec:\5bbnnn.exe235⤵PID:816
-
\??\c:\jpddd.exec:\jpddd.exe236⤵PID:5040
-
\??\c:\7lffflx.exec:\7lffflx.exe237⤵PID:448
-
\??\c:\flrrlll.exec:\flrrlll.exe238⤵PID:1652
-
\??\c:\btbtnn.exec:\btbtnn.exe239⤵PID:4040
-
\??\c:\djjdv.exec:\djjdv.exe240⤵PID:3288
-
\??\c:\9pppp.exec:\9pppp.exe241⤵PID:2316
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe242⤵PID:3592