Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 03:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a334b6c11b40069df84f62bd0586d700_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a334b6c11b40069df84f62bd0586d700_NeikiAnalytics.exe
-
Size
247KB
-
MD5
a334b6c11b40069df84f62bd0586d700
-
SHA1
65b328694de18521249d38d0c730637d575623a4
-
SHA256
6f5ebee944ceaa4f17651f22bc916c592f59f53eea3c46eac3a9331f3c2fadae
-
SHA512
e9cdb0382e6ac0181a7625829ffffef1ab9fa21f146430816daf1d466bcd0c0139c8c09e889aa4dbe0b33788d3109f268cac4e661e844e38b1f3f60cba9038f9
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFRV68:n3C9uD6AUDCa4NYmR/
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/4012-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2508-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
flffrrx.exe7nnnhn.exevvdvd.exexlrrlfx.exe3hhtth.exenbtnhh.exepvdvv.exejdppd.exefxfflrr.exe1bnhnn.exeddjdd.exe3xxrrrl.exerrlfxxr.exennnbtt.exepddvp.exeddpvv.exexxllxxx.exetbthtt.exedpddv.exejpdvp.exexxrflxl.exeddddd.exefllfxxx.exefflxlxf.exebtnbnh.exepvvvj.exefffxxxx.exe5tbbtt.exepjpjd.exefxrrlll.exehtbbtb.exenhnhhh.exerrxrffr.exefxfrxxx.exetnbbtb.exedpdpd.exe9dppj.exefxrlrrf.exefrrrllf.exe9thbhh.exepvdvp.exerlxrfxx.exenhhhhb.exentttnn.exepdddv.exedjjpp.exefxlffff.exebnhbbh.exentbtnb.exedvpjv.exexlrxxxx.exerlxxxfx.exe5thhbn.exe3nhbtt.exevjpjj.exe5lrrrrl.exe3xrxxrr.exe5btthh.exedvdvd.exejpvpj.exerrfffxx.exelrfxffr.exetnbhnn.exedjppv.exepid process 1932 flffrrx.exe 3972 7nnnhn.exe 1572 vvdvd.exe 1080 xlrrlfx.exe 2072 3hhtth.exe 2064 nbtnhh.exe 1020 pvdvv.exe 3228 jdppd.exe 1940 fxfflrr.exe 4292 1bnhnn.exe 224 ddjdd.exe 3404 3xxrrrl.exe 520 rrlfxxr.exe 4628 nnnbtt.exe 2324 pddvp.exe 2508 ddpvv.exe 3140 xxllxxx.exe 3540 tbthtt.exe 2396 dpddv.exe 5076 jpdvp.exe 2752 xxrflxl.exe 1544 ddddd.exe 4720 fllfxxx.exe 2624 fflxlxf.exe 1392 btnbnh.exe 4608 pvvvj.exe 4132 fffxxxx.exe 4204 5tbbtt.exe 1464 pjpjd.exe 1352 fxrrlll.exe 808 htbbtb.exe 604 nhnhhh.exe 740 rrxrffr.exe 5116 fxfrxxx.exe 4552 tnbbtb.exe 1244 dpdpd.exe 3132 9dppj.exe 3428 fxrlrrf.exe 2524 frrrllf.exe 4928 9thbhh.exe 2584 pvdvp.exe 2824 rlxrfxx.exe 4808 nhhhhb.exe 812 ntttnn.exe 4880 pdddv.exe 720 djjpp.exe 1764 fxlffff.exe 700 bnhbbh.exe 2276 ntbtnb.exe 1800 dvpjv.exe 4224 xlrxxxx.exe 1804 rlxxxfx.exe 4564 5thhbn.exe 2168 3nhbtt.exe 4624 vjpjj.exe 4848 5lrrrrl.exe 2508 3xrxxrr.exe 3140 5btthh.exe 1356 dvdvd.exe 4352 jpvpj.exe 2372 rrfffxx.exe 1820 lrfxffr.exe 4228 tnbhnn.exe 1888 djppv.exe -
Processes:
resource yara_rule behavioral2/memory/4012-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2508-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-194-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a334b6c11b40069df84f62bd0586d700_NeikiAnalytics.exeflffrrx.exe7nnnhn.exevvdvd.exexlrrlfx.exe3hhtth.exenbtnhh.exepvdvv.exejdppd.exefxfflrr.exe1bnhnn.exeddjdd.exe3xxrrrl.exerrlfxxr.exennnbtt.exepddvp.exeddpvv.exexxllxxx.exetbthtt.exedpddv.exejpdvp.exexxrflxl.exedescription pid process target process PID 4012 wrote to memory of 1932 4012 a334b6c11b40069df84f62bd0586d700_NeikiAnalytics.exe flffrrx.exe PID 4012 wrote to memory of 1932 4012 a334b6c11b40069df84f62bd0586d700_NeikiAnalytics.exe flffrrx.exe PID 4012 wrote to memory of 1932 4012 a334b6c11b40069df84f62bd0586d700_NeikiAnalytics.exe flffrrx.exe PID 1932 wrote to memory of 3972 1932 flffrrx.exe 7nnnhn.exe PID 1932 wrote to memory of 3972 1932 flffrrx.exe 7nnnhn.exe PID 1932 wrote to memory of 3972 1932 flffrrx.exe 7nnnhn.exe PID 3972 wrote to memory of 1572 3972 7nnnhn.exe vvdvd.exe PID 3972 wrote to memory of 1572 3972 7nnnhn.exe vvdvd.exe PID 3972 wrote to memory of 1572 3972 7nnnhn.exe vvdvd.exe PID 1572 wrote to memory of 1080 1572 vvdvd.exe xlrrlfx.exe PID 1572 wrote to memory of 1080 1572 vvdvd.exe xlrrlfx.exe PID 1572 wrote to memory of 1080 1572 vvdvd.exe xlrrlfx.exe PID 1080 wrote to memory of 2072 1080 xlrrlfx.exe 3hhtth.exe PID 1080 wrote to memory of 2072 1080 xlrrlfx.exe 3hhtth.exe PID 1080 wrote to memory of 2072 1080 xlrrlfx.exe 3hhtth.exe PID 2072 wrote to memory of 2064 2072 3hhtth.exe nbtnhh.exe PID 2072 wrote to memory of 2064 2072 3hhtth.exe nbtnhh.exe PID 2072 wrote to memory of 2064 2072 3hhtth.exe nbtnhh.exe PID 2064 wrote to memory of 1020 2064 nbtnhh.exe pvdvv.exe PID 2064 wrote to memory of 1020 2064 nbtnhh.exe pvdvv.exe PID 2064 wrote to memory of 1020 2064 nbtnhh.exe pvdvv.exe PID 1020 wrote to memory of 3228 1020 pvdvv.exe jdppd.exe PID 1020 wrote to memory of 3228 1020 pvdvv.exe jdppd.exe PID 1020 wrote to memory of 3228 1020 pvdvv.exe jdppd.exe PID 3228 wrote to memory of 1940 3228 jdppd.exe fxfflrr.exe PID 3228 wrote to memory of 1940 3228 jdppd.exe fxfflrr.exe PID 3228 wrote to memory of 1940 3228 jdppd.exe fxfflrr.exe PID 1940 wrote to memory of 4292 1940 fxfflrr.exe 1bnhnn.exe PID 1940 wrote to memory of 4292 1940 fxfflrr.exe 1bnhnn.exe PID 1940 wrote to memory of 4292 1940 fxfflrr.exe 1bnhnn.exe PID 4292 wrote to memory of 224 4292 1bnhnn.exe ddjdd.exe PID 4292 wrote to memory of 224 4292 1bnhnn.exe ddjdd.exe PID 4292 wrote to memory of 224 4292 1bnhnn.exe ddjdd.exe PID 224 wrote to memory of 3404 224 ddjdd.exe 3xxrrrl.exe PID 224 wrote to memory of 3404 224 ddjdd.exe 3xxrrrl.exe PID 224 wrote to memory of 3404 224 ddjdd.exe 3xxrrrl.exe PID 3404 wrote to memory of 520 3404 3xxrrrl.exe rrlfxxr.exe PID 3404 wrote to memory of 520 3404 3xxrrrl.exe rrlfxxr.exe PID 3404 wrote to memory of 520 3404 3xxrrrl.exe rrlfxxr.exe PID 520 wrote to memory of 4628 520 rrlfxxr.exe nnnbtt.exe PID 520 wrote to memory of 4628 520 rrlfxxr.exe nnnbtt.exe PID 520 wrote to memory of 4628 520 rrlfxxr.exe nnnbtt.exe PID 4628 wrote to memory of 2324 4628 nnnbtt.exe pddvp.exe PID 4628 wrote to memory of 2324 4628 nnnbtt.exe pddvp.exe PID 4628 wrote to memory of 2324 4628 nnnbtt.exe pddvp.exe PID 2324 wrote to memory of 2508 2324 pddvp.exe ddpvv.exe PID 2324 wrote to memory of 2508 2324 pddvp.exe ddpvv.exe PID 2324 wrote to memory of 2508 2324 pddvp.exe ddpvv.exe PID 2508 wrote to memory of 3140 2508 ddpvv.exe xxllxxx.exe PID 2508 wrote to memory of 3140 2508 ddpvv.exe xxllxxx.exe PID 2508 wrote to memory of 3140 2508 ddpvv.exe xxllxxx.exe PID 3140 wrote to memory of 3540 3140 xxllxxx.exe tbthtt.exe PID 3140 wrote to memory of 3540 3140 xxllxxx.exe tbthtt.exe PID 3140 wrote to memory of 3540 3140 xxllxxx.exe tbthtt.exe PID 3540 wrote to memory of 2396 3540 tbthtt.exe dpddv.exe PID 3540 wrote to memory of 2396 3540 tbthtt.exe dpddv.exe PID 3540 wrote to memory of 2396 3540 tbthtt.exe dpddv.exe PID 2396 wrote to memory of 5076 2396 dpddv.exe jpdvp.exe PID 2396 wrote to memory of 5076 2396 dpddv.exe jpdvp.exe PID 2396 wrote to memory of 5076 2396 dpddv.exe jpdvp.exe PID 5076 wrote to memory of 2752 5076 jpdvp.exe xxrflxl.exe PID 5076 wrote to memory of 2752 5076 jpdvp.exe xxrflxl.exe PID 5076 wrote to memory of 2752 5076 jpdvp.exe xxrflxl.exe PID 2752 wrote to memory of 1544 2752 xxrflxl.exe ddddd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a334b6c11b40069df84f62bd0586d700_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a334b6c11b40069df84f62bd0586d700_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\flffrrx.exec:\flffrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\7nnnhn.exec:\7nnnhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\vvdvd.exec:\vvdvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\xlrrlfx.exec:\xlrrlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\3hhtth.exec:\3hhtth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\nbtnhh.exec:\nbtnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\pvdvv.exec:\pvdvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\jdppd.exec:\jdppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\fxfflrr.exec:\fxfflrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\1bnhnn.exec:\1bnhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\ddjdd.exec:\ddjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\3xxrrrl.exec:\3xxrrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\rrlfxxr.exec:\rrlfxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
\??\c:\nnnbtt.exec:\nnnbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\pddvp.exec:\pddvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\ddpvv.exec:\ddpvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\xxllxxx.exec:\xxllxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\tbthtt.exec:\tbthtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\dpddv.exec:\dpddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\jpdvp.exec:\jpdvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\xxrflxl.exec:\xxrflxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\ddddd.exec:\ddddd.exe23⤵
- Executes dropped EXE
PID:1544 -
\??\c:\fllfxxx.exec:\fllfxxx.exe24⤵
- Executes dropped EXE
PID:4720 -
\??\c:\fflxlxf.exec:\fflxlxf.exe25⤵
- Executes dropped EXE
PID:2624 -
\??\c:\btnbnh.exec:\btnbnh.exe26⤵
- Executes dropped EXE
PID:1392 -
\??\c:\pvvvj.exec:\pvvvj.exe27⤵
- Executes dropped EXE
PID:4608 -
\??\c:\fffxxxx.exec:\fffxxxx.exe28⤵
- Executes dropped EXE
PID:4132 -
\??\c:\5tbbtt.exec:\5tbbtt.exe29⤵
- Executes dropped EXE
PID:4204 -
\??\c:\pjpjd.exec:\pjpjd.exe30⤵
- Executes dropped EXE
PID:1464 -
\??\c:\fxrrlll.exec:\fxrrlll.exe31⤵
- Executes dropped EXE
PID:1352 -
\??\c:\htbbtb.exec:\htbbtb.exe32⤵
- Executes dropped EXE
PID:808 -
\??\c:\nhnhhh.exec:\nhnhhh.exe33⤵
- Executes dropped EXE
PID:604 -
\??\c:\rrxrffr.exec:\rrxrffr.exe34⤵
- Executes dropped EXE
PID:740 -
\??\c:\fxfrxxx.exec:\fxfrxxx.exe35⤵
- Executes dropped EXE
PID:5116 -
\??\c:\tnbbtb.exec:\tnbbtb.exe36⤵
- Executes dropped EXE
PID:4552 -
\??\c:\tntbnh.exec:\tntbnh.exe37⤵PID:2504
-
\??\c:\dpdpd.exec:\dpdpd.exe38⤵
- Executes dropped EXE
PID:1244 -
\??\c:\9dppj.exec:\9dppj.exe39⤵
- Executes dropped EXE
PID:3132 -
\??\c:\fxrlrrf.exec:\fxrlrrf.exe40⤵
- Executes dropped EXE
PID:3428 -
\??\c:\frrrllf.exec:\frrrllf.exe41⤵
- Executes dropped EXE
PID:2524 -
\??\c:\9thbhh.exec:\9thbhh.exe42⤵
- Executes dropped EXE
PID:4928 -
\??\c:\pvdvp.exec:\pvdvp.exe43⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rlxrfxx.exec:\rlxrfxx.exe44⤵
- Executes dropped EXE
PID:2824 -
\??\c:\nhhhhb.exec:\nhhhhb.exe45⤵
- Executes dropped EXE
PID:4808 -
\??\c:\ntttnn.exec:\ntttnn.exe46⤵
- Executes dropped EXE
PID:812 -
\??\c:\pdddv.exec:\pdddv.exe47⤵
- Executes dropped EXE
PID:4880 -
\??\c:\djjpp.exec:\djjpp.exe48⤵
- Executes dropped EXE
PID:720 -
\??\c:\fxlffff.exec:\fxlffff.exe49⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bnhbbh.exec:\bnhbbh.exe50⤵
- Executes dropped EXE
PID:700 -
\??\c:\ntbtnb.exec:\ntbtnb.exe51⤵
- Executes dropped EXE
PID:2276 -
\??\c:\dvpjv.exec:\dvpjv.exe52⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xlrxxxx.exec:\xlrxxxx.exe53⤵
- Executes dropped EXE
PID:4224 -
\??\c:\rlxxxfx.exec:\rlxxxfx.exe54⤵
- Executes dropped EXE
PID:1804 -
\??\c:\5thhbn.exec:\5thhbn.exe55⤵
- Executes dropped EXE
PID:4564 -
\??\c:\3nhbtt.exec:\3nhbtt.exe56⤵
- Executes dropped EXE
PID:2168 -
\??\c:\vjpjj.exec:\vjpjj.exe57⤵
- Executes dropped EXE
PID:4624 -
\??\c:\5lrrrrl.exec:\5lrrrrl.exe58⤵
- Executes dropped EXE
PID:4848 -
\??\c:\3xrxxrr.exec:\3xrxxrr.exe59⤵
- Executes dropped EXE
PID:2508 -
\??\c:\5btthh.exec:\5btthh.exe60⤵
- Executes dropped EXE
PID:3140 -
\??\c:\dvdvd.exec:\dvdvd.exe61⤵
- Executes dropped EXE
PID:1356 -
\??\c:\jpvpj.exec:\jpvpj.exe62⤵
- Executes dropped EXE
PID:4352 -
\??\c:\rrfffxx.exec:\rrfffxx.exe63⤵
- Executes dropped EXE
PID:2372 -
\??\c:\lrfxffr.exec:\lrfxffr.exe64⤵
- Executes dropped EXE
PID:1820 -
\??\c:\tnbhnn.exec:\tnbhnn.exe65⤵
- Executes dropped EXE
PID:4228 -
\??\c:\djppv.exec:\djppv.exe66⤵
- Executes dropped EXE
PID:1888 -
\??\c:\dvjjj.exec:\dvjjj.exe67⤵PID:2464
-
\??\c:\rrrlxrr.exec:\rrrlxrr.exe68⤵PID:2804
-
\??\c:\9nnttb.exec:\9nnttb.exe69⤵PID:2692
-
\??\c:\bthbbb.exec:\bthbbb.exe70⤵PID:4856
-
\??\c:\vdddd.exec:\vdddd.exe71⤵PID:1660
-
\??\c:\3frlrrx.exec:\3frlrrx.exe72⤵PID:4696
-
\??\c:\llffxxr.exec:\llffxxr.exe73⤵PID:1480
-
\??\c:\bnbhhh.exec:\bnbhhh.exe74⤵PID:2556
-
\??\c:\vdppp.exec:\vdppp.exe75⤵PID:4304
-
\??\c:\vpvpj.exec:\vpvpj.exe76⤵PID:3012
-
\??\c:\xlrlllf.exec:\xlrlllf.exe77⤵PID:3580
-
\??\c:\nbtnhh.exec:\nbtnhh.exe78⤵PID:1776
-
\??\c:\dpvvp.exec:\dpvvp.exe79⤵PID:1824
-
\??\c:\lfxffll.exec:\lfxffll.exe80⤵PID:2312
-
\??\c:\lxflllr.exec:\lxflllr.exe81⤵PID:4476
-
\??\c:\htbbbh.exec:\htbbbh.exe82⤵PID:1492
-
\??\c:\jdpdd.exec:\jdpdd.exe83⤵PID:4420
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe84⤵PID:512
-
\??\c:\xlrfxff.exec:\xlrfxff.exe85⤵PID:1244
-
\??\c:\tnnhhb.exec:\tnnhhb.exe86⤵PID:3132
-
\??\c:\jvppj.exec:\jvppj.exe87⤵PID:3428
-
\??\c:\pppjd.exec:\pppjd.exe88⤵PID:1572
-
\??\c:\rrfflll.exec:\rrfflll.exe89⤵PID:2092
-
\??\c:\7lllfff.exec:\7lllfff.exe90⤵PID:2072
-
\??\c:\1bnhhh.exec:\1bnhhh.exe91⤵PID:2224
-
\??\c:\jpddd.exec:\jpddd.exe92⤵PID:4808
-
\??\c:\rxlfxxl.exec:\rxlfxxl.exe93⤵PID:1020
-
\??\c:\rrfxrrl.exec:\rrfxrrl.exe94⤵PID:412
-
\??\c:\nhttbb.exec:\nhttbb.exe95⤵PID:2616
-
\??\c:\5jppp.exec:\5jppp.exe96⤵PID:4260
-
\??\c:\9fxrrrx.exec:\9fxrrrx.exe97⤵PID:5104
-
\??\c:\frxlrll.exec:\frxlrll.exe98⤵PID:2816
-
\??\c:\ntbbtn.exec:\ntbbtn.exe99⤵PID:3588
-
\??\c:\hhbtnn.exec:\hhbtnn.exe100⤵PID:1540
-
\??\c:\dvpjj.exec:\dvpjj.exe101⤵PID:3996
-
\??\c:\jpdpv.exec:\jpdpv.exe102⤵PID:5032
-
\??\c:\fxlffrr.exec:\fxlffrr.exe103⤵PID:2728
-
\??\c:\nhnhbb.exec:\nhnhbb.exe104⤵PID:3320
-
\??\c:\dvdvp.exec:\dvdvp.exe105⤵PID:2324
-
\??\c:\xflffxx.exec:\xflffxx.exe106⤵PID:4480
-
\??\c:\xxfxxrr.exec:\xxfxxrr.exe107⤵PID:2396
-
\??\c:\btbttb.exec:\btbttb.exe108⤵PID:2296
-
\??\c:\ddjdd.exec:\ddjdd.exe109⤵PID:2120
-
\??\c:\ppvpp.exec:\ppvpp.exe110⤵PID:1248
-
\??\c:\5vjdv.exec:\5vjdv.exe111⤵PID:3360
-
\??\c:\rrxxxff.exec:\rrxxxff.exe112⤵PID:2572
-
\??\c:\btbbtb.exec:\btbbtb.exe113⤵PID:1164
-
\??\c:\hhhbbh.exec:\hhhbbh.exe114⤵PID:3524
-
\??\c:\9jvdd.exec:\9jvdd.exe115⤵PID:2692
-
\??\c:\xxrllrr.exec:\xxrllrr.exe116⤵PID:4040
-
\??\c:\thbtnb.exec:\thbtnb.exe117⤵PID:2628
-
\??\c:\pdjjd.exec:\pdjjd.exe118⤵PID:4568
-
\??\c:\9frfrlx.exec:\9frfrlx.exe119⤵PID:3676
-
\??\c:\tnnnnb.exec:\tnnnnb.exe120⤵PID:4204
-
\??\c:\9djjp.exec:\9djjp.exe121⤵PID:2564
-
\??\c:\dvjdv.exec:\dvjdv.exe122⤵PID:5092
-
\??\c:\llfffff.exec:\llfffff.exe123⤵PID:220
-
\??\c:\nbbttn.exec:\nbbttn.exe124⤵PID:3204
-
\??\c:\hbnntt.exec:\hbnntt.exe125⤵PID:1824
-
\??\c:\jjpjp.exec:\jjpjp.exe126⤵PID:740
-
\??\c:\lrrlfff.exec:\lrrlfff.exe127⤵PID:4436
-
\??\c:\xrrrllf.exec:\xrrrllf.exe128⤵PID:4656
-
\??\c:\tnbbhh.exec:\tnbbhh.exe129⤵PID:3612
-
\??\c:\5djjd.exec:\5djjd.exe130⤵PID:1932
-
\??\c:\djvvj.exec:\djvvj.exe131⤵PID:1400
-
\??\c:\lrrxxfl.exec:\lrrxxfl.exe132⤵PID:1924
-
\??\c:\hhbnhn.exec:\hhbnhn.exe133⤵PID:888
-
\??\c:\nhnbtn.exec:\nhnbtn.exe134⤵PID:3640
-
\??\c:\vjjjv.exec:\vjjjv.exe135⤵PID:1520
-
\??\c:\llxfxxl.exec:\llxfxxl.exe136⤵PID:1152
-
\??\c:\xrfrxlx.exec:\xrfrxlx.exe137⤵PID:1184
-
\??\c:\1ntbnb.exec:\1ntbnb.exe138⤵PID:1100
-
\??\c:\1htbhb.exec:\1htbhb.exe139⤵PID:4532
-
\??\c:\dppjv.exec:\dppjv.exe140⤵PID:1764
-
\??\c:\lxlxxlx.exec:\lxlxxlx.exe141⤵PID:2988
-
\??\c:\3llfrrf.exec:\3llfrrf.exe142⤵PID:2028
-
\??\c:\5bnbtn.exec:\5bnbtn.exe143⤵PID:1668
-
\??\c:\1nnhtn.exec:\1nnhtn.exe144⤵PID:4628
-
\??\c:\djvvj.exec:\djvvj.exe145⤵PID:3248
-
\??\c:\vjjvj.exec:\vjjvj.exe146⤵PID:4168
-
\??\c:\rllxrll.exec:\rllxrll.exe147⤵PID:2336
-
\??\c:\tnbhbt.exec:\tnbhbt.exe148⤵PID:5076
-
\??\c:\bbnnhb.exec:\bbnnhb.exe149⤵PID:4664
-
\??\c:\dvpdv.exec:\dvpdv.exe150⤵PID:1320
-
\??\c:\vpvpj.exec:\vpvpj.exe151⤵PID:1544
-
\??\c:\fxrlfrf.exec:\fxrlfrf.exe152⤵PID:2236
-
\??\c:\5htbnt.exec:\5htbnt.exe153⤵PID:1164
-
\??\c:\7bbtnn.exec:\7bbtnn.exe154⤵PID:3560
-
\??\c:\jvvjv.exec:\jvvjv.exe155⤵PID:1660
-
\??\c:\frxrrrr.exec:\frxrrrr.exe156⤵PID:3820
-
\??\c:\hbnbhh.exec:\hbnbhh.exe157⤵PID:2996
-
\??\c:\pddpd.exec:\pddpd.exe158⤵PID:3584
-
\??\c:\1xrlxxr.exec:\1xrlxxr.exe159⤵PID:4204
-
\??\c:\bhhttn.exec:\bhhttn.exe160⤵PID:2564
-
\??\c:\pjpjd.exec:\pjpjd.exe161⤵PID:4844
-
\??\c:\pjppj.exec:\pjppj.exe162⤵PID:4960
-
\??\c:\rxffffr.exec:\rxffffr.exe163⤵PID:4676
-
\??\c:\flrfxrf.exec:\flrfxrf.exe164⤵PID:1824
-
\??\c:\nnbhht.exec:\nnbhht.exe165⤵PID:4012
-
\??\c:\vjvjd.exec:\vjvjd.exe166⤵PID:4436
-
\??\c:\9jjdv.exec:\9jjdv.exe167⤵PID:3704
-
\??\c:\rfflrff.exec:\rfflrff.exe168⤵PID:2040
-
\??\c:\nthhtb.exec:\nthhtb.exe169⤵PID:4688
-
\??\c:\nhbttn.exec:\nhbttn.exe170⤵PID:4920
-
\??\c:\jppdv.exec:\jppdv.exe171⤵PID:1980
-
\??\c:\rllfxrl.exec:\rllfxrl.exe172⤵PID:3384
-
\??\c:\tnhttt.exec:\tnhttt.exe173⤵PID:2824
-
\??\c:\htbntt.exec:\htbntt.exe174⤵PID:4328
-
\??\c:\jvvjv.exec:\jvvjv.exe175⤵PID:1184
-
\??\c:\9llfrxl.exec:\9llfrxl.exe176⤵PID:3548
-
\??\c:\hbbbth.exec:\hbbbth.exe177⤵PID:4532
-
\??\c:\ntnhbt.exec:\ntnhbt.exe178⤵PID:4500
-
\??\c:\djpvd.exec:\djpvd.exe179⤵PID:2988
-
\??\c:\pjjdp.exec:\pjjdp.exe180⤵PID:2028
-
\??\c:\ffrrflf.exec:\ffrrflf.exe181⤵PID:520
-
\??\c:\9lllffx.exec:\9lllffx.exe182⤵PID:3532
-
\??\c:\3bbtht.exec:\3bbtht.exe183⤵PID:3248
-
\??\c:\dvjvp.exec:\dvjvp.exe184⤵PID:4168
-
\??\c:\jddpd.exec:\jddpd.exe185⤵PID:2336
-
\??\c:\3rrfxrl.exec:\3rrfxrl.exe186⤵PID:2120
-
\??\c:\1ffxrrl.exec:\1ffxrrl.exe187⤵PID:4876
-
\??\c:\bbtnbb.exec:\bbtnbb.exe188⤵PID:3360
-
\??\c:\dppjd.exec:\dppjd.exe189⤵PID:2368
-
\??\c:\ffffxfl.exec:\ffffxfl.exe190⤵PID:4024
-
\??\c:\flxfffr.exec:\flxfffr.exe191⤵PID:4208
-
\??\c:\hbnttt.exec:\hbnttt.exe192⤵PID:5004
-
\??\c:\bbnhnn.exec:\bbnhnn.exe193⤵PID:2856
-
\??\c:\vpppj.exec:\vpppj.exe194⤵PID:1708
-
\??\c:\lxxlrrr.exec:\lxxlrrr.exe195⤵PID:2996
-
\??\c:\rlxflrr.exec:\rlxflrr.exe196⤵PID:3656
-
\??\c:\hthbbh.exec:\hthbbh.exe197⤵PID:1524
-
\??\c:\9pvdv.exec:\9pvdv.exe198⤵PID:2564
-
\??\c:\jjvpd.exec:\jjvpd.exe199⤵PID:3636
-
\??\c:\9ffxrlf.exec:\9ffxrlf.exe200⤵PID:4648
-
\??\c:\tnthbn.exec:\tnthbn.exe201⤵PID:4264
-
\??\c:\htbbbt.exec:\htbbbt.exe202⤵PID:3572
-
\??\c:\jjpjd.exec:\jjpjd.exe203⤵PID:4580
-
\??\c:\7jpjv.exec:\7jpjv.exe204⤵PID:4220
-
\??\c:\lxrfrrf.exec:\lxrfrrf.exe205⤵PID:1244
-
\??\c:\hnbntt.exec:\hnbntt.exe206⤵PID:1080
-
\??\c:\vpvdd.exec:\vpvdd.exe207⤵PID:1572
-
\??\c:\3ddpd.exec:\3ddpd.exe208⤵PID:1060
-
\??\c:\xxxlrrf.exec:\xxxlrrf.exe209⤵PID:1788
-
\??\c:\frxlrfl.exec:\frxlrfl.exe210⤵PID:3384
-
\??\c:\bbbtnn.exec:\bbbtnn.exe211⤵PID:1152
-
\??\c:\dppdp.exec:\dppdp.exe212⤵PID:4880
-
\??\c:\vpjdp.exec:\vpjdp.exe213⤵PID:1940
-
\??\c:\rrrxllf.exec:\rrrxllf.exe214⤵PID:3548
-
\??\c:\xrrlrfl.exec:\xrrlrfl.exe215⤵PID:4224
-
\??\c:\nbhbtt.exec:\nbhbtt.exe216⤵PID:3588
-
\??\c:\hnnnhb.exec:\hnnnhb.exe217⤵PID:3556
-
\??\c:\djpdv.exec:\djpdv.exe218⤵PID:2028
-
\??\c:\xllffrl.exec:\xllffrl.exe219⤵PID:1536
-
\??\c:\ffrlxrl.exec:\ffrlxrl.exe220⤵PID:4052
-
\??\c:\btbtbt.exec:\btbtbt.exe221⤵PID:2812
-
\??\c:\ddvdd.exec:\ddvdd.exe222⤵PID:4168
-
\??\c:\jjjjd.exec:\jjjjd.exe223⤵PID:4228
-
\??\c:\fllfrxl.exec:\fllfrxl.exe224⤵PID:1888
-
\??\c:\hhhttn.exec:\hhhttn.exe225⤵PID:2216
-
\??\c:\tnhbnn.exec:\tnhbnn.exe226⤵PID:2236
-
\??\c:\dvvpj.exec:\dvvpj.exe227⤵PID:1164
-
\??\c:\pjjdv.exec:\pjjdv.exe228⤵PID:4696
-
\??\c:\frrllff.exec:\frrllff.exe229⤵PID:4524
-
\??\c:\thnhnh.exec:\thnhnh.exe230⤵PID:5004
-
\??\c:\djddd.exec:\djddd.exe231⤵PID:64
-
\??\c:\pjddj.exec:\pjddj.exe232⤵PID:1708
-
\??\c:\lxfrrlf.exec:\lxfrrlf.exe233⤵PID:2996
-
\??\c:\thnhbt.exec:\thnhbt.exe234⤵PID:4368
-
\??\c:\nbnnbn.exec:\nbnnbn.exe235⤵PID:2476
-
\??\c:\1jdvp.exec:\1jdvp.exe236⤵PID:1260
-
\??\c:\pjdvp.exec:\pjdvp.exe237⤵PID:3636
-
\??\c:\ffrflrx.exec:\ffrflrx.exe238⤵PID:4424
-
\??\c:\9hbbtn.exec:\9hbbtn.exe239⤵PID:4428
-
\??\c:\bnnhbt.exec:\bnnhbt.exe240⤵PID:3572
-
\??\c:\pvdpj.exec:\pvdpj.exe241⤵PID:1976
-
\??\c:\dvpjp.exec:\dvpjp.exe242⤵PID:1400