Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 15:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e3854cbd0a2942f0d645d782e20a8bf0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e3854cbd0a2942f0d645d782e20a8bf0_NeikiAnalytics.exe
-
Size
361KB
-
MD5
e3854cbd0a2942f0d645d782e20a8bf0
-
SHA1
4e62f4d0f3cd8a9f233f7df263b41e1b4a58c483
-
SHA256
f502b9a78e0c45d890e2e5f58147636905be79720f2716e339453a767c835de4
-
SHA512
c380210a37daf41db08141547a748f35cc7980a76a649525bd12a92a8ddf5d54e4d01ee061be8a550934183514fa7931408e83aed545eeeb57074c65360a3348
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjD8296gnzeZhBuW:n3C9ytvngQj429nnzeZhBF
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/2828-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1592-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lllrflx.exejjpvv.exellxlxxr.exe1bnnhn.exeppvvv.exe9ffffrr.exelxxxrrl.exexlfxffx.exejpdvd.exelfxxrrx.exebbhnnt.exepppdd.exe3hbnnt.exennbhhh.exehnnntb.exehhnbhn.exe3djpj.exebnttnt.exexllllll.exefxxxxxx.exenhtttt.exentbhtb.exevvvvv.exexxxxxxf.exenhbbtb.exeflrxxrr.exenbtthh.exexlflrxf.exevpddd.exevdvvj.exe7ffllrx.exejpdvp.exejppvd.exetnbhhh.exedpjjd.exellxrxxx.exe1nnnhn.exe1vddj.exetbbttb.exepjppp.exerxrxrxl.exejvvjj.exerxxxxff.exehntttb.exeppdvj.exexxllfll.exebbbbhn.exehnbbbh.exepjjdv.exerlfffll.exebntnnt.exevjjdd.exelfrlllf.exetttnhh.exevdvvv.exexrrlfxx.exeffrrxfr.exe9djjj.exefrxxrrr.exebbbttt.exedppdp.exerrfxrrx.exebbnhbb.exevjpjd.exepid process 2620 lllrflx.exe 4748 jjpvv.exe 2044 llxlxxr.exe 3524 1bnnhn.exe 4752 ppvvv.exe 936 9ffffrr.exe 3680 lxxxrrl.exe 776 xlfxffx.exe 3328 jpdvd.exe 4180 lfxxrrx.exe 2356 bbhnnt.exe 3304 pppdd.exe 2376 3hbnnt.exe 1076 nnbhhh.exe 1592 hnnntb.exe 4728 hhnbhn.exe 592 3djpj.exe 64 bnttnt.exe 1544 xllllll.exe 3600 fxxxxxx.exe 2968 nhtttt.exe 4720 ntbhtb.exe 4040 vvvvv.exe 5100 xxxxxxf.exe 4992 nhbbtb.exe 4188 flrxxrr.exe 912 nbtthh.exe 2244 xlflrxf.exe 2204 vpddd.exe 3408 vdvvj.exe 4532 7ffllrx.exe 3052 jpdvp.exe 1552 jppvd.exe 1736 tnbhhh.exe 4428 dpjjd.exe 2096 llxrxxx.exe 1620 1nnnhn.exe 4220 1vddj.exe 3552 tbbttb.exe 5036 pjppp.exe 3196 rxrxrxl.exe 3296 jvvjj.exe 3324 rxxxxff.exe 3416 hntttb.exe 2732 ppdvj.exe 4124 xxllfll.exe 3824 bbbbhn.exe 3056 hnbbbh.exe 3668 pjjdv.exe 4036 rlfffll.exe 2580 bntnnt.exe 5012 vjjdd.exe 2080 lfrlllf.exe 4072 tttnhh.exe 1500 vdvvv.exe 3752 xrrlfxx.exe 1012 ffrrxfr.exe 1172 9djjj.exe 1228 frxxrrr.exe 2068 bbbttt.exe 3924 dppdp.exe 4620 rrfxrrx.exe 2164 bbnhbb.exe 3060 vjpjd.exe -
Processes:
resource yara_rule behavioral2/memory/2828-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e3854cbd0a2942f0d645d782e20a8bf0_NeikiAnalytics.exelllrflx.exejjpvv.exellxlxxr.exe1bnnhn.exeppvvv.exe9ffffrr.exelxxxrrl.exexlfxffx.exejpdvd.exelfxxrrx.exebbhnnt.exepppdd.exe3hbnnt.exennbhhh.exehnnntb.exehhnbhn.exe3djpj.exebnttnt.exexllllll.exefxxxxxx.exenhtttt.exedescription pid process target process PID 2828 wrote to memory of 2620 2828 e3854cbd0a2942f0d645d782e20a8bf0_NeikiAnalytics.exe lllrflx.exe PID 2828 wrote to memory of 2620 2828 e3854cbd0a2942f0d645d782e20a8bf0_NeikiAnalytics.exe lllrflx.exe PID 2828 wrote to memory of 2620 2828 e3854cbd0a2942f0d645d782e20a8bf0_NeikiAnalytics.exe lllrflx.exe PID 2620 wrote to memory of 4748 2620 lllrflx.exe jjpvv.exe PID 2620 wrote to memory of 4748 2620 lllrflx.exe jjpvv.exe PID 2620 wrote to memory of 4748 2620 lllrflx.exe jjpvv.exe PID 4748 wrote to memory of 2044 4748 jjpvv.exe llxlxxr.exe PID 4748 wrote to memory of 2044 4748 jjpvv.exe llxlxxr.exe PID 4748 wrote to memory of 2044 4748 jjpvv.exe llxlxxr.exe PID 2044 wrote to memory of 3524 2044 llxlxxr.exe 1bnnhn.exe PID 2044 wrote to memory of 3524 2044 llxlxxr.exe 1bnnhn.exe PID 2044 wrote to memory of 3524 2044 llxlxxr.exe 1bnnhn.exe PID 3524 wrote to memory of 4752 3524 1bnnhn.exe ppvvv.exe PID 3524 wrote to memory of 4752 3524 1bnnhn.exe ppvvv.exe PID 3524 wrote to memory of 4752 3524 1bnnhn.exe ppvvv.exe PID 4752 wrote to memory of 936 4752 ppvvv.exe 9ffffrr.exe PID 4752 wrote to memory of 936 4752 ppvvv.exe 9ffffrr.exe PID 4752 wrote to memory of 936 4752 ppvvv.exe 9ffffrr.exe PID 936 wrote to memory of 3680 936 9ffffrr.exe lxxxrrl.exe PID 936 wrote to memory of 3680 936 9ffffrr.exe lxxxrrl.exe PID 936 wrote to memory of 3680 936 9ffffrr.exe lxxxrrl.exe PID 3680 wrote to memory of 776 3680 lxxxrrl.exe xlfxffx.exe PID 3680 wrote to memory of 776 3680 lxxxrrl.exe xlfxffx.exe PID 3680 wrote to memory of 776 3680 lxxxrrl.exe xlfxffx.exe PID 776 wrote to memory of 3328 776 xlfxffx.exe jpdvd.exe PID 776 wrote to memory of 3328 776 xlfxffx.exe jpdvd.exe PID 776 wrote to memory of 3328 776 xlfxffx.exe jpdvd.exe PID 3328 wrote to memory of 4180 3328 jpdvd.exe lfxxrrx.exe PID 3328 wrote to memory of 4180 3328 jpdvd.exe lfxxrrx.exe PID 3328 wrote to memory of 4180 3328 jpdvd.exe lfxxrrx.exe PID 4180 wrote to memory of 2356 4180 lfxxrrx.exe bbhnnt.exe PID 4180 wrote to memory of 2356 4180 lfxxrrx.exe bbhnnt.exe PID 4180 wrote to memory of 2356 4180 lfxxrrx.exe bbhnnt.exe PID 2356 wrote to memory of 3304 2356 bbhnnt.exe pppdd.exe PID 2356 wrote to memory of 3304 2356 bbhnnt.exe pppdd.exe PID 2356 wrote to memory of 3304 2356 bbhnnt.exe pppdd.exe PID 3304 wrote to memory of 2376 3304 pppdd.exe 3hbnnt.exe PID 3304 wrote to memory of 2376 3304 pppdd.exe 3hbnnt.exe PID 3304 wrote to memory of 2376 3304 pppdd.exe 3hbnnt.exe PID 2376 wrote to memory of 1076 2376 3hbnnt.exe nnbhhh.exe PID 2376 wrote to memory of 1076 2376 3hbnnt.exe nnbhhh.exe PID 2376 wrote to memory of 1076 2376 3hbnnt.exe nnbhhh.exe PID 1076 wrote to memory of 1592 1076 nnbhhh.exe hnnntb.exe PID 1076 wrote to memory of 1592 1076 nnbhhh.exe hnnntb.exe PID 1076 wrote to memory of 1592 1076 nnbhhh.exe hnnntb.exe PID 1592 wrote to memory of 4728 1592 hnnntb.exe hhnbhn.exe PID 1592 wrote to memory of 4728 1592 hnnntb.exe hhnbhn.exe PID 1592 wrote to memory of 4728 1592 hnnntb.exe hhnbhn.exe PID 4728 wrote to memory of 592 4728 hhnbhn.exe 3djpj.exe PID 4728 wrote to memory of 592 4728 hhnbhn.exe 3djpj.exe PID 4728 wrote to memory of 592 4728 hhnbhn.exe 3djpj.exe PID 592 wrote to memory of 64 592 3djpj.exe bnttnt.exe PID 592 wrote to memory of 64 592 3djpj.exe bnttnt.exe PID 592 wrote to memory of 64 592 3djpj.exe bnttnt.exe PID 64 wrote to memory of 1544 64 bnttnt.exe xllllll.exe PID 64 wrote to memory of 1544 64 bnttnt.exe xllllll.exe PID 64 wrote to memory of 1544 64 bnttnt.exe xllllll.exe PID 1544 wrote to memory of 3600 1544 xllllll.exe fxxxxxx.exe PID 1544 wrote to memory of 3600 1544 xllllll.exe fxxxxxx.exe PID 1544 wrote to memory of 3600 1544 xllllll.exe fxxxxxx.exe PID 3600 wrote to memory of 2968 3600 fxxxxxx.exe nhtttt.exe PID 3600 wrote to memory of 2968 3600 fxxxxxx.exe nhtttt.exe PID 3600 wrote to memory of 2968 3600 fxxxxxx.exe nhtttt.exe PID 2968 wrote to memory of 4720 2968 nhtttt.exe ntbhtb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3854cbd0a2942f0d645d782e20a8bf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e3854cbd0a2942f0d645d782e20a8bf0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\lllrflx.exec:\lllrflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\jjpvv.exec:\jjpvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\llxlxxr.exec:\llxlxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\1bnnhn.exec:\1bnnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\ppvvv.exec:\ppvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\9ffffrr.exec:\9ffffrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\xlfxffx.exec:\xlfxffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\jpdvd.exec:\jpdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\lfxxrrx.exec:\lfxxrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\bbhnnt.exec:\bbhnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\pppdd.exec:\pppdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\3hbnnt.exec:\3hbnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\nnbhhh.exec:\nnbhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\hnnntb.exec:\hnnntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\hhnbhn.exec:\hhnbhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\3djpj.exec:\3djpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\bnttnt.exec:\bnttnt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\xllllll.exec:\xllllll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\nhtttt.exec:\nhtttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\ntbhtb.exec:\ntbhtb.exe23⤵
- Executes dropped EXE
PID:4720 -
\??\c:\vvvvv.exec:\vvvvv.exe24⤵
- Executes dropped EXE
PID:4040 -
\??\c:\xxxxxxf.exec:\xxxxxxf.exe25⤵
- Executes dropped EXE
PID:5100 -
\??\c:\nhbbtb.exec:\nhbbtb.exe26⤵
- Executes dropped EXE
PID:4992 -
\??\c:\flrxxrr.exec:\flrxxrr.exe27⤵
- Executes dropped EXE
PID:4188 -
\??\c:\nbtthh.exec:\nbtthh.exe28⤵
- Executes dropped EXE
PID:912 -
\??\c:\xlflrxf.exec:\xlflrxf.exe29⤵
- Executes dropped EXE
PID:2244 -
\??\c:\vpddd.exec:\vpddd.exe30⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vdvvj.exec:\vdvvj.exe31⤵
- Executes dropped EXE
PID:3408 -
\??\c:\7ffllrx.exec:\7ffllrx.exe32⤵
- Executes dropped EXE
PID:4532 -
\??\c:\jpdvp.exec:\jpdvp.exe33⤵
- Executes dropped EXE
PID:3052 -
\??\c:\jppvd.exec:\jppvd.exe34⤵
- Executes dropped EXE
PID:1552 -
\??\c:\tnbhhh.exec:\tnbhhh.exe35⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dpjjd.exec:\dpjjd.exe36⤵
- Executes dropped EXE
PID:4428 -
\??\c:\llxrxxx.exec:\llxrxxx.exe37⤵
- Executes dropped EXE
PID:2096 -
\??\c:\1nnnhn.exec:\1nnnhn.exe38⤵
- Executes dropped EXE
PID:1620 -
\??\c:\1vddj.exec:\1vddj.exe39⤵
- Executes dropped EXE
PID:4220 -
\??\c:\tbbttb.exec:\tbbttb.exe40⤵
- Executes dropped EXE
PID:3552 -
\??\c:\pjppp.exec:\pjppp.exe41⤵
- Executes dropped EXE
PID:5036 -
\??\c:\rxrxrxl.exec:\rxrxrxl.exe42⤵
- Executes dropped EXE
PID:3196 -
\??\c:\jvvjj.exec:\jvvjj.exe43⤵
- Executes dropped EXE
PID:3296 -
\??\c:\rxxxxff.exec:\rxxxxff.exe44⤵
- Executes dropped EXE
PID:3324 -
\??\c:\hntttb.exec:\hntttb.exe45⤵
- Executes dropped EXE
PID:3416 -
\??\c:\ppdvj.exec:\ppdvj.exe46⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xxllfll.exec:\xxllfll.exe47⤵
- Executes dropped EXE
PID:4124 -
\??\c:\bbbbhn.exec:\bbbbhn.exe48⤵
- Executes dropped EXE
PID:3824 -
\??\c:\hnbbbh.exec:\hnbbbh.exe49⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pjjdv.exec:\pjjdv.exe50⤵
- Executes dropped EXE
PID:3668 -
\??\c:\rlfffll.exec:\rlfffll.exe51⤵
- Executes dropped EXE
PID:4036 -
\??\c:\bntnnt.exec:\bntnnt.exe52⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vjjdd.exec:\vjjdd.exe53⤵
- Executes dropped EXE
PID:5012 -
\??\c:\lfrlllf.exec:\lfrlllf.exe54⤵
- Executes dropped EXE
PID:2080 -
\??\c:\tttnhh.exec:\tttnhh.exe55⤵
- Executes dropped EXE
PID:4072 -
\??\c:\vdvvv.exec:\vdvvv.exe56⤵
- Executes dropped EXE
PID:1500 -
\??\c:\xrrlfxx.exec:\xrrlfxx.exe57⤵
- Executes dropped EXE
PID:3752 -
\??\c:\ffrrxfr.exec:\ffrrxfr.exe58⤵
- Executes dropped EXE
PID:1012 -
\??\c:\9djjj.exec:\9djjj.exe59⤵
- Executes dropped EXE
PID:1172 -
\??\c:\frxxrrr.exec:\frxxrrr.exe60⤵
- Executes dropped EXE
PID:1228 -
\??\c:\bbbttt.exec:\bbbttt.exe61⤵
- Executes dropped EXE
PID:2068 -
\??\c:\dppdp.exec:\dppdp.exe62⤵
- Executes dropped EXE
PID:3924 -
\??\c:\rrfxrrx.exec:\rrfxrrx.exe63⤵
- Executes dropped EXE
PID:4620 -
\??\c:\bbnhbb.exec:\bbnhbb.exe64⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vjpjd.exec:\vjpjd.exe65⤵
- Executes dropped EXE
PID:3060 -
\??\c:\bthbnn.exec:\bthbnn.exe66⤵PID:4580
-
\??\c:\vpvvv.exec:\vpvvv.exe67⤵PID:2024
-
\??\c:\fxrlffx.exec:\fxrlffx.exe68⤵PID:4884
-
\??\c:\hbtnht.exec:\hbtnht.exe69⤵PID:1176
-
\??\c:\dpdvv.exec:\dpdvv.exe70⤵PID:3568
-
\??\c:\xlffxff.exec:\xlffxff.exe71⤵PID:880
-
\??\c:\ttbbbt.exec:\ttbbbt.exe72⤵PID:4004
-
\??\c:\vjdvp.exec:\vjdvp.exe73⤵PID:1504
-
\??\c:\lxrrlxr.exec:\lxrrlxr.exe74⤵PID:4596
-
\??\c:\9hnntb.exec:\9hnntb.exe75⤵PID:4192
-
\??\c:\htbhbb.exec:\htbhbb.exe76⤵PID:2392
-
\??\c:\dppjv.exec:\dppjv.exe77⤵PID:3392
-
\??\c:\rxrxrfr.exec:\rxrxrfr.exe78⤵PID:4508
-
\??\c:\hbhhbh.exec:\hbhhbh.exe79⤵PID:1380
-
\??\c:\htbtnn.exec:\htbtnn.exe80⤵PID:1460
-
\??\c:\vpdvd.exec:\vpdvd.exe81⤵PID:1532
-
\??\c:\xffxrll.exec:\xffxrll.exe82⤵PID:4604
-
\??\c:\5bbnnt.exec:\5bbnnt.exe83⤵PID:2252
-
\??\c:\ddvvv.exec:\ddvvv.exe84⤵PID:2828
-
\??\c:\pjpdd.exec:\pjpdd.exe85⤵PID:2572
-
\??\c:\ffxxxrl.exec:\ffxxxrl.exe86⤵PID:4736
-
\??\c:\1tnnhn.exec:\1tnnhn.exe87⤵PID:3524
-
\??\c:\tnhtth.exec:\tnhtth.exe88⤵PID:3200
-
\??\c:\djpdv.exec:\djpdv.exe89⤵PID:1864
-
\??\c:\vppjd.exec:\vppjd.exe90⤵PID:1048
-
\??\c:\llxxfll.exec:\llxxfll.exe91⤵PID:8
-
\??\c:\nbbtnn.exec:\nbbtnn.exe92⤵PID:4140
-
\??\c:\nhtnnh.exec:\nhtnnh.exe93⤵PID:2772
-
\??\c:\vjpjd.exec:\vjpjd.exe94⤵PID:3328
-
\??\c:\jjppp.exec:\jjppp.exe95⤵PID:4976
-
\??\c:\1lrlflf.exec:\1lrlflf.exe96⤵PID:3532
-
\??\c:\ntthbb.exec:\ntthbb.exe97⤵PID:5064
-
\??\c:\tnttbb.exec:\tnttbb.exe98⤵PID:5012
-
\??\c:\1dpjj.exec:\1dpjj.exe99⤵PID:2788
-
\??\c:\lllrffr.exec:\lllrffr.exe100⤵PID:3320
-
\??\c:\9bnhhn.exec:\9bnhhn.exe101⤵PID:2712
-
\??\c:\nbbbbt.exec:\nbbbbt.exe102⤵PID:4380
-
\??\c:\5pjjd.exec:\5pjjd.exe103⤵PID:3876
-
\??\c:\ffrllfr.exec:\ffrllfr.exe104⤵PID:208
-
\??\c:\hthbth.exec:\hthbth.exe105⤵PID:592
-
\??\c:\5tbtbb.exec:\5tbtbb.exe106⤵PID:4620
-
\??\c:\ddpjd.exec:\ddpjd.exe107⤵PID:2996
-
\??\c:\3xxlffx.exec:\3xxlffx.exe108⤵PID:3060
-
\??\c:\rlfrllf.exec:\rlfrllf.exe109⤵PID:4580
-
\??\c:\hnbbhh.exec:\hnbbhh.exe110⤵PID:2180
-
\??\c:\jjdvd.exec:\jjdvd.exe111⤵PID:2612
-
\??\c:\vdvvp.exec:\vdvvp.exe112⤵PID:3568
-
\??\c:\lllffxr.exec:\lllffxr.exe113⤵PID:3104
-
\??\c:\rllllll.exec:\rllllll.exe114⤵PID:1472
-
\??\c:\bhhhhb.exec:\bhhhhb.exe115⤵PID:4804
-
\??\c:\jdvpj.exec:\jdvpj.exe116⤵PID:3484
-
\??\c:\vdpjv.exec:\vdpjv.exe117⤵PID:3728
-
\??\c:\xrxxrxx.exec:\xrxxrxx.exe118⤵PID:3784
-
\??\c:\tnnnhb.exec:\tnnnhb.exe119⤵PID:3556
-
\??\c:\vvdpd.exec:\vvdpd.exe120⤵PID:4532
-
\??\c:\jjvpp.exec:\jjvpp.exe121⤵PID:4776
-
\??\c:\rrrfxrl.exec:\rrrfxrl.exe122⤵PID:4652
-
\??\c:\nbhbhh.exec:\nbhbhh.exe123⤵PID:2672
-
\??\c:\pvdjj.exec:\pvdjj.exe124⤵PID:4744
-
\??\c:\rrxxffr.exec:\rrxxffr.exe125⤵PID:2396
-
\??\c:\7hnhnn.exec:\7hnhnn.exe126⤵PID:1404
-
\??\c:\btbtbb.exec:\btbtbb.exe127⤵PID:4220
-
\??\c:\pddvd.exec:\pddvd.exe128⤵PID:2044
-
\??\c:\rlxlfxr.exec:\rlxlfxr.exe129⤵PID:3412
-
\??\c:\5xrrrrx.exec:\5xrrrrx.exe130⤵PID:2708
-
\??\c:\bnbttt.exec:\bnbttt.exe131⤵PID:3200
-
\??\c:\bhtnhh.exec:\bhtnhh.exe132⤵PID:552
-
\??\c:\dddpj.exec:\dddpj.exe133⤵PID:4688
-
\??\c:\flxfrrl.exec:\flxfrrl.exe134⤵PID:776
-
\??\c:\9fflflx.exec:\9fflflx.exe135⤵PID:1548
-
\??\c:\hntbbb.exec:\hntbbb.exe136⤵PID:3668
-
\??\c:\vpjjj.exec:\vpjjj.exe137⤵PID:1860
-
\??\c:\dpppj.exec:\dpppj.exe138⤵PID:2208
-
\??\c:\3fxlffx.exec:\3fxlffx.exe139⤵PID:4760
-
\??\c:\1lrllff.exec:\1lrllff.exe140⤵PID:4704
-
\??\c:\bbnnhb.exec:\bbnnhb.exe141⤵PID:1384
-
\??\c:\9bbhht.exec:\9bbhht.exe142⤵PID:4136
-
\??\c:\vjjjj.exec:\vjjjj.exe143⤵PID:3028
-
\??\c:\rlxrrxx.exec:\rlxrrxx.exe144⤵PID:2172
-
\??\c:\lffxxrr.exec:\lffxxrr.exe145⤵PID:3112
-
\??\c:\bthnnt.exec:\bthnnt.exe146⤵PID:3708
-
\??\c:\jvdvp.exec:\jvdvp.exe147⤵PID:3060
-
\??\c:\3jjdv.exec:\3jjdv.exe148⤵PID:3704
-
\??\c:\xrrllll.exec:\xrrllll.exe149⤵PID:4996
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe150⤵PID:3568
-
\??\c:\1htnhh.exec:\1htnhh.exe151⤵PID:4004
-
\??\c:\nnnhbb.exec:\nnnhbb.exe152⤵PID:1472
-
\??\c:\vpvjj.exec:\vpvjj.exe153⤵PID:2824
-
\??\c:\9xxrlfl.exec:\9xxrlfl.exe154⤵PID:4780
-
\??\c:\xxfrlfx.exec:\xxfrlfx.exe155⤵PID:2392
-
\??\c:\nhhtnn.exec:\nhhtnn.exe156⤵PID:1300
-
\??\c:\vvdvd.exec:\vvdvd.exe157⤵PID:1964
-
\??\c:\dvjjp.exec:\dvjjp.exe158⤵PID:796
-
\??\c:\llrlrll.exec:\llrlrll.exe159⤵PID:3560
-
\??\c:\nttthh.exec:\nttthh.exe160⤵PID:4652
-
\??\c:\pjdvp.exec:\pjdvp.exe161⤵PID:2564
-
\??\c:\rffxrrl.exec:\rffxrrl.exe162⤵PID:1620
-
\??\c:\1xrlffr.exec:\1xrlffr.exe163⤵PID:4984
-
\??\c:\hbhbhh.exec:\hbhbhh.exe164⤵PID:1852
-
\??\c:\jdvpd.exec:\jdvpd.exe165⤵PID:3400
-
\??\c:\xlxxrrl.exec:\xlxxrrl.exe166⤵PID:4820
-
\??\c:\1rxrrrr.exec:\1rxrrrr.exe167⤵PID:5112
-
\??\c:\thhbbb.exec:\thhbbb.exe168⤵PID:3324
-
\??\c:\9djvv.exec:\9djvv.exe169⤵PID:1048
-
\??\c:\rlrrlfx.exec:\rlrrlfx.exe170⤵PID:540
-
\??\c:\ttthbt.exec:\ttthbt.exe171⤵PID:3776
-
\??\c:\bnhbbh.exec:\bnhbbh.exe172⤵PID:2772
-
\??\c:\5vvjv.exec:\5vvjv.exe173⤵PID:2088
-
\??\c:\ttbhhh.exec:\ttbhhh.exe174⤵PID:1880
-
\??\c:\jdvpj.exec:\jdvpj.exe175⤵PID:3668
-
\??\c:\rxrrlll.exec:\rxrrlll.exe176⤵PID:3456
-
\??\c:\thnhbt.exec:\thnhbt.exe177⤵PID:3300
-
\??\c:\ttbbbn.exec:\ttbbbn.exe178⤵PID:3636
-
\??\c:\dvjjd.exec:\dvjjd.exe179⤵PID:2176
-
\??\c:\fxlfxrl.exec:\fxlfxrl.exe180⤵PID:3788
-
\??\c:\nhnntt.exec:\nhnntt.exe181⤵PID:4516
-
\??\c:\pjjvd.exec:\pjjvd.exe182⤵PID:1544
-
\??\c:\ppjdv.exec:\ppjdv.exe183⤵PID:2596
-
\??\c:\xfrffxr.exec:\xfrffxr.exe184⤵PID:772
-
\??\c:\3rxrffx.exec:\3rxrffx.exe185⤵PID:4040
-
\??\c:\bbhnnt.exec:\bbhnnt.exe186⤵PID:1528
-
\??\c:\dvvpd.exec:\dvvpd.exe187⤵PID:4176
-
\??\c:\ppddv.exec:\ppddv.exe188⤵PID:3496
-
\??\c:\rxlxxfl.exec:\rxlxxfl.exe189⤵PID:2256
-
\??\c:\fxrllff.exec:\fxrllff.exe190⤵PID:3148
-
\??\c:\hhtnnn.exec:\hhtnnn.exe191⤵PID:4700
-
\??\c:\ppjjp.exec:\ppjjp.exe192⤵PID:3484
-
\??\c:\vdjdv.exec:\vdjdv.exe193⤵PID:916
-
\??\c:\flrxxrx.exec:\flrxxrx.exe194⤵PID:1672
-
\??\c:\lxxxxfr.exec:\lxxxxfr.exe195⤵PID:1520
-
\??\c:\btbbbh.exec:\btbbbh.exe196⤵PID:2024
-
\??\c:\1pvpp.exec:\1pvpp.exe197⤵PID:4776
-
\??\c:\7nhnhh.exec:\7nhnhh.exe198⤵PID:1460
-
\??\c:\dppvp.exec:\dppvp.exe199⤵PID:2672
-
\??\c:\rrrflxx.exec:\rrrflxx.exe200⤵PID:2252
-
\??\c:\7hnhhh.exec:\7hnhhh.exe201⤵PID:2396
-
\??\c:\pjvvv.exec:\pjvvv.exe202⤵PID:3156
-
\??\c:\llffxff.exec:\llffxff.exe203⤵PID:4220
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe204⤵PID:4752
-
\??\c:\bntbnn.exec:\bntbnn.exe205⤵PID:3260
-
\??\c:\5jdpj.exec:\5jdpj.exe206⤵PID:2348
-
\??\c:\flrrlrr.exec:\flrrlrr.exe207⤵PID:436
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe208⤵PID:3680
-
\??\c:\ddddv.exec:\ddddv.exe209⤵PID:2040
-
\??\c:\jdjjp.exec:\jdjjp.exe210⤵PID:4628
-
\??\c:\nbhbtn.exec:\nbhbtn.exe211⤵PID:4296
-
\??\c:\ttbbtb.exec:\ttbbtb.exe212⤵PID:4180
-
\??\c:\fxllffx.exec:\fxllffx.exe213⤵PID:4976
-
\??\c:\hhhbtt.exec:\hhhbtt.exe214⤵PID:5012
-
\??\c:\hbntbh.exec:\hbntbh.exe215⤵PID:3604
-
\??\c:\jjppj.exec:\jjppj.exe216⤵PID:1164
-
\??\c:\1rrlxrl.exec:\1rrlxrl.exe217⤵PID:4728
-
\??\c:\nnnhbb.exec:\nnnhbb.exe218⤵PID:4524
-
\??\c:\bbbbhh.exec:\bbbbhh.exe219⤵PID:5104
-
\??\c:\5jjpp.exec:\5jjpp.exe220⤵PID:2220
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe221⤵PID:2968
-
\??\c:\thnhbb.exec:\thnhbb.exe222⤵PID:2984
-
\??\c:\jpvjj.exec:\jpvjj.exe223⤵PID:5044
-
\??\c:\ffllllr.exec:\ffllllr.exe224⤵PID:1396
-
\??\c:\xrfffrr.exec:\xrfffrr.exe225⤵PID:2516
-
\??\c:\hbhbtt.exec:\hbhbtt.exe226⤵PID:5068
-
\??\c:\vpvpv.exec:\vpvpv.exe227⤵PID:912
-
\??\c:\lrxlfrl.exec:\lrxlfrl.exe228⤵PID:4504
-
\??\c:\hbhhbh.exec:\hbhhbh.exe229⤵PID:2820
-
\??\c:\hnhhhh.exec:\hnhhhh.exe230⤵PID:1724
-
\??\c:\pppjd.exec:\pppjd.exe231⤵PID:1808
-
\??\c:\lxrrrll.exec:\lxrrrll.exe232⤵PID:1160
-
\??\c:\bthhhh.exec:\bthhhh.exe233⤵PID:2836
-
\??\c:\nbhnnt.exec:\nbhnnt.exe234⤵PID:4952
-
\??\c:\vdpdv.exec:\vdpdv.exe235⤵PID:1156
-
\??\c:\xrrllff.exec:\xrrllff.exe236⤵PID:3240
-
\??\c:\hbhhhh.exec:\hbhhhh.exe237⤵PID:3348
-
\??\c:\thtttb.exec:\thtttb.exe238⤵PID:4436
-
\??\c:\vvvvv.exec:\vvvvv.exe239⤵PID:4624
-
\??\c:\3vvjd.exec:\3vvjd.exe240⤵PID:4744
-
\??\c:\1frrllf.exec:\1frrllf.exe241⤵PID:3984
-
\??\c:\bthbbb.exec:\bthbbb.exe242⤵PID:3908