Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 05:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b50aeca915993f27cd725896006ef060_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b50aeca915993f27cd725896006ef060_NeikiAnalytics.exe
-
Size
116KB
-
MD5
b50aeca915993f27cd725896006ef060
-
SHA1
a65a9a91e3a059165b3587b2a7a788e499c0ecb4
-
SHA256
bf55fcae6f921d5c384ad6483e308369bfbba4ee16d5ea8c70346116e8c60727
-
SHA512
46810ccbaa28443fba7d03d734b9c7876fdeb5a8307f886c830f0c433c6f165ea38df9d00b144d56fa094ced12afe0352a7167383932a525890227511f58092b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFosxXGPXbXQMFHLgDWSmjlkF0:n3C9BRosxW8MFHLMWvl3
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/2736-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1896-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpjpj.exe3dddp.exe3ffxxxx.exelxrlllf.exethnnhh.exepjjpj.exexflfxfx.exenhbttt.exejvpjd.exefrrlxrl.exedvdvj.exeffxlfrl.exerflfrll.exebbbttb.exejdpjd.exe5fxrlfx.exetthbtb.exedjvpj.exerrfxxrl.exefrxrfff.exehhhbtn.exeppjvj.exerxrlffx.exelrrrllf.exehbntnn.exepjdjj.exerlfxllf.exefrffxrl.exe7hhtnh.exevppjv.exevdpdj.exefrrrrll.exehtnhbt.exejvdpp.exepdppp.exe7rxrrrr.exehnnhbt.exepjdpj.exelfxxrlr.exexxxfxxf.exebnhtnh.exeppvpv.exedvddp.exelxffffr.exehbnhhn.exejjdpd.exevpvpv.exerlfxllf.exellrlfff.exetnhthb.exejdvpv.exevvdpd.exefrfxlfl.exefxlxxlf.exehbtbhb.exedpjdv.exexlrllff.exerxrllll.exenhnnnn.exevpjdp.exepvjvp.exexlffxrr.exenhhbbt.exehhnbtn.exepid process 4796 vpjpj.exe 744 3dddp.exe 2000 3ffxxxx.exe 1108 lxrlllf.exe 2100 thnnhh.exe 1292 pjjpj.exe 4676 xflfxfx.exe 3888 nhbttt.exe 1896 jvpjd.exe 5004 frrlxrl.exe 2392 dvdvj.exe 1592 ffxlfrl.exe 3956 rflfrll.exe 4176 bbbttb.exe 2288 jdpjd.exe 4760 5fxrlfx.exe 1984 tthbtb.exe 2452 djvpj.exe 1272 rrfxxrl.exe 2052 frxrfff.exe 5064 hhhbtn.exe 1796 ppjvj.exe 436 rxrlffx.exe 5008 lrrrllf.exe 412 hbntnn.exe 4260 pjdjj.exe 4216 rlfxllf.exe 432 frffxrl.exe 3508 7hhtnh.exe 3768 vppjv.exe 4004 vdpdj.exe 4424 frrrrll.exe 1888 htnhbt.exe 1380 jvdpp.exe 4376 pdppp.exe 1576 7rxrrrr.exe 2148 hnnhbt.exe 988 pjdpj.exe 1744 lfxxrlr.exe 1004 xxxfxxf.exe 4496 bnhtnh.exe 4364 ppvpv.exe 1292 dvddp.exe 1184 lxffffr.exe 4584 hbnhhn.exe 1588 jjdpd.exe 2576 vpvpv.exe 1772 rlfxllf.exe 3384 llrlfff.exe 2188 tnhthb.exe 4164 jdvpv.exe 4996 vvdpd.exe 4636 frfxlfl.exe 4660 fxlxxlf.exe 2112 hbtbhb.exe 4732 dpjdv.exe 528 xlrllff.exe 1152 rxrllll.exe 3088 nhnnnn.exe 892 vpjdp.exe 3672 pvjvp.exe 548 xlffxrr.exe 3876 nhhbbt.exe 1680 hhnbtn.exe -
Processes:
resource yara_rule behavioral2/memory/2736-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1896-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/412-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b50aeca915993f27cd725896006ef060_NeikiAnalytics.exevpjpj.exe3dddp.exe3ffxxxx.exelxrlllf.exethnnhh.exepjjpj.exexflfxfx.exenhbttt.exejvpjd.exefrrlxrl.exedvdvj.exeffxlfrl.exerflfrll.exebbbttb.exejdpjd.exe5fxrlfx.exetthbtb.exedjvpj.exerrfxxrl.exefrxrfff.exehhhbtn.exedescription pid process target process PID 2736 wrote to memory of 4796 2736 b50aeca915993f27cd725896006ef060_NeikiAnalytics.exe vpjpj.exe PID 2736 wrote to memory of 4796 2736 b50aeca915993f27cd725896006ef060_NeikiAnalytics.exe vpjpj.exe PID 2736 wrote to memory of 4796 2736 b50aeca915993f27cd725896006ef060_NeikiAnalytics.exe vpjpj.exe PID 4796 wrote to memory of 744 4796 vpjpj.exe 3dddp.exe PID 4796 wrote to memory of 744 4796 vpjpj.exe 3dddp.exe PID 4796 wrote to memory of 744 4796 vpjpj.exe 3dddp.exe PID 744 wrote to memory of 2000 744 3dddp.exe 3ffxxxx.exe PID 744 wrote to memory of 2000 744 3dddp.exe 3ffxxxx.exe PID 744 wrote to memory of 2000 744 3dddp.exe 3ffxxxx.exe PID 2000 wrote to memory of 1108 2000 3ffxxxx.exe lxrlllf.exe PID 2000 wrote to memory of 1108 2000 3ffxxxx.exe lxrlllf.exe PID 2000 wrote to memory of 1108 2000 3ffxxxx.exe lxrlllf.exe PID 1108 wrote to memory of 2100 1108 lxrlllf.exe thnnhh.exe PID 1108 wrote to memory of 2100 1108 lxrlllf.exe thnnhh.exe PID 1108 wrote to memory of 2100 1108 lxrlllf.exe thnnhh.exe PID 2100 wrote to memory of 1292 2100 thnnhh.exe pjjpj.exe PID 2100 wrote to memory of 1292 2100 thnnhh.exe pjjpj.exe PID 2100 wrote to memory of 1292 2100 thnnhh.exe pjjpj.exe PID 1292 wrote to memory of 4676 1292 pjjpj.exe xflfxfx.exe PID 1292 wrote to memory of 4676 1292 pjjpj.exe xflfxfx.exe PID 1292 wrote to memory of 4676 1292 pjjpj.exe xflfxfx.exe PID 4676 wrote to memory of 3888 4676 xflfxfx.exe nhbttt.exe PID 4676 wrote to memory of 3888 4676 xflfxfx.exe nhbttt.exe PID 4676 wrote to memory of 3888 4676 xflfxfx.exe nhbttt.exe PID 3888 wrote to memory of 1896 3888 nhbttt.exe jvpjd.exe PID 3888 wrote to memory of 1896 3888 nhbttt.exe jvpjd.exe PID 3888 wrote to memory of 1896 3888 nhbttt.exe jvpjd.exe PID 1896 wrote to memory of 5004 1896 jvpjd.exe frrlxrl.exe PID 1896 wrote to memory of 5004 1896 jvpjd.exe frrlxrl.exe PID 1896 wrote to memory of 5004 1896 jvpjd.exe frrlxrl.exe PID 5004 wrote to memory of 2392 5004 frrlxrl.exe dvdvj.exe PID 5004 wrote to memory of 2392 5004 frrlxrl.exe dvdvj.exe PID 5004 wrote to memory of 2392 5004 frrlxrl.exe dvdvj.exe PID 2392 wrote to memory of 1592 2392 dvdvj.exe ffxlfrl.exe PID 2392 wrote to memory of 1592 2392 dvdvj.exe ffxlfrl.exe PID 2392 wrote to memory of 1592 2392 dvdvj.exe ffxlfrl.exe PID 1592 wrote to memory of 3956 1592 ffxlfrl.exe rflfrll.exe PID 1592 wrote to memory of 3956 1592 ffxlfrl.exe rflfrll.exe PID 1592 wrote to memory of 3956 1592 ffxlfrl.exe rflfrll.exe PID 3956 wrote to memory of 4176 3956 rflfrll.exe bbbttb.exe PID 3956 wrote to memory of 4176 3956 rflfrll.exe bbbttb.exe PID 3956 wrote to memory of 4176 3956 rflfrll.exe bbbttb.exe PID 4176 wrote to memory of 2288 4176 bbbttb.exe jdpjd.exe PID 4176 wrote to memory of 2288 4176 bbbttb.exe jdpjd.exe PID 4176 wrote to memory of 2288 4176 bbbttb.exe jdpjd.exe PID 2288 wrote to memory of 4760 2288 jdpjd.exe 5fxrlfx.exe PID 2288 wrote to memory of 4760 2288 jdpjd.exe 5fxrlfx.exe PID 2288 wrote to memory of 4760 2288 jdpjd.exe 5fxrlfx.exe PID 4760 wrote to memory of 1984 4760 5fxrlfx.exe tthbtb.exe PID 4760 wrote to memory of 1984 4760 5fxrlfx.exe tthbtb.exe PID 4760 wrote to memory of 1984 4760 5fxrlfx.exe tthbtb.exe PID 1984 wrote to memory of 2452 1984 tthbtb.exe djvpj.exe PID 1984 wrote to memory of 2452 1984 tthbtb.exe djvpj.exe PID 1984 wrote to memory of 2452 1984 tthbtb.exe djvpj.exe PID 2452 wrote to memory of 1272 2452 djvpj.exe rrfxxrl.exe PID 2452 wrote to memory of 1272 2452 djvpj.exe rrfxxrl.exe PID 2452 wrote to memory of 1272 2452 djvpj.exe rrfxxrl.exe PID 1272 wrote to memory of 2052 1272 rrfxxrl.exe frxrfff.exe PID 1272 wrote to memory of 2052 1272 rrfxxrl.exe frxrfff.exe PID 1272 wrote to memory of 2052 1272 rrfxxrl.exe frxrfff.exe PID 2052 wrote to memory of 5064 2052 frxrfff.exe hhhbtn.exe PID 2052 wrote to memory of 5064 2052 frxrfff.exe hhhbtn.exe PID 2052 wrote to memory of 5064 2052 frxrfff.exe hhhbtn.exe PID 5064 wrote to memory of 1796 5064 hhhbtn.exe ppjvj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b50aeca915993f27cd725896006ef060_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b50aeca915993f27cd725896006ef060_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\vpjpj.exec:\vpjpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\3dddp.exec:\3dddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\3ffxxxx.exec:\3ffxxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\lxrlllf.exec:\lxrlllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\thnnhh.exec:\thnnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\pjjpj.exec:\pjjpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\xflfxfx.exec:\xflfxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\nhbttt.exec:\nhbttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\jvpjd.exec:\jvpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\frrlxrl.exec:\frrlxrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\dvdvj.exec:\dvdvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\ffxlfrl.exec:\ffxlfrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\rflfrll.exec:\rflfrll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\bbbttb.exec:\bbbttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\jdpjd.exec:\jdpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\5fxrlfx.exec:\5fxrlfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\tthbtb.exec:\tthbtb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\djvpj.exec:\djvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\rrfxxrl.exec:\rrfxxrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\frxrfff.exec:\frxrfff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\hhhbtn.exec:\hhhbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\ppjvj.exec:\ppjvj.exe23⤵
- Executes dropped EXE
PID:1796 -
\??\c:\rxrlffx.exec:\rxrlffx.exe24⤵
- Executes dropped EXE
PID:436 -
\??\c:\lrrrllf.exec:\lrrrllf.exe25⤵
- Executes dropped EXE
PID:5008 -
\??\c:\hbntnn.exec:\hbntnn.exe26⤵
- Executes dropped EXE
PID:412 -
\??\c:\pjdjj.exec:\pjdjj.exe27⤵
- Executes dropped EXE
PID:4260 -
\??\c:\rlfxllf.exec:\rlfxllf.exe28⤵
- Executes dropped EXE
PID:4216 -
\??\c:\frffxrl.exec:\frffxrl.exe29⤵
- Executes dropped EXE
PID:432 -
\??\c:\7hhtnh.exec:\7hhtnh.exe30⤵
- Executes dropped EXE
PID:3508 -
\??\c:\vppjv.exec:\vppjv.exe31⤵
- Executes dropped EXE
PID:3768 -
\??\c:\vdpdj.exec:\vdpdj.exe32⤵
- Executes dropped EXE
PID:4004 -
\??\c:\frrrrll.exec:\frrrrll.exe33⤵
- Executes dropped EXE
PID:4424 -
\??\c:\htnhbt.exec:\htnhbt.exe34⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jvdpp.exec:\jvdpp.exe35⤵
- Executes dropped EXE
PID:1380 -
\??\c:\pdppp.exec:\pdppp.exe36⤵
- Executes dropped EXE
PID:4376 -
\??\c:\7rxrrrr.exec:\7rxrrrr.exe37⤵
- Executes dropped EXE
PID:1576 -
\??\c:\hnnhbt.exec:\hnnhbt.exe38⤵
- Executes dropped EXE
PID:2148 -
\??\c:\pjdpj.exec:\pjdpj.exe39⤵
- Executes dropped EXE
PID:988 -
\??\c:\lfxxrlr.exec:\lfxxrlr.exe40⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xxxfxxf.exec:\xxxfxxf.exe41⤵
- Executes dropped EXE
PID:1004 -
\??\c:\bnhtnh.exec:\bnhtnh.exe42⤵
- Executes dropped EXE
PID:4496 -
\??\c:\ppvpv.exec:\ppvpv.exe43⤵
- Executes dropped EXE
PID:4364 -
\??\c:\dvddp.exec:\dvddp.exe44⤵
- Executes dropped EXE
PID:1292 -
\??\c:\lxffffr.exec:\lxffffr.exe45⤵
- Executes dropped EXE
PID:1184 -
\??\c:\hbnhhn.exec:\hbnhhn.exe46⤵
- Executes dropped EXE
PID:4584 -
\??\c:\jjdpd.exec:\jjdpd.exe47⤵
- Executes dropped EXE
PID:1588 -
\??\c:\vpvpv.exec:\vpvpv.exe48⤵
- Executes dropped EXE
PID:2576 -
\??\c:\rlfxllf.exec:\rlfxllf.exe49⤵
- Executes dropped EXE
PID:1772 -
\??\c:\llrlfff.exec:\llrlfff.exe50⤵
- Executes dropped EXE
PID:3384 -
\??\c:\tnhthb.exec:\tnhthb.exe51⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jdvpv.exec:\jdvpv.exe52⤵
- Executes dropped EXE
PID:4164 -
\??\c:\vvdpd.exec:\vvdpd.exe53⤵
- Executes dropped EXE
PID:4996 -
\??\c:\frfxlfl.exec:\frfxlfl.exe54⤵
- Executes dropped EXE
PID:4636 -
\??\c:\fxlxxlf.exec:\fxlxxlf.exe55⤵
- Executes dropped EXE
PID:4660 -
\??\c:\hbtbhb.exec:\hbtbhb.exe56⤵
- Executes dropped EXE
PID:2112 -
\??\c:\dpjdv.exec:\dpjdv.exe57⤵
- Executes dropped EXE
PID:4732 -
\??\c:\xlrllff.exec:\xlrllff.exe58⤵
- Executes dropped EXE
PID:528 -
\??\c:\rxrllll.exec:\rxrllll.exe59⤵
- Executes dropped EXE
PID:1152 -
\??\c:\nhnnnn.exec:\nhnnnn.exe60⤵
- Executes dropped EXE
PID:3088 -
\??\c:\vpjdp.exec:\vpjdp.exe61⤵
- Executes dropped EXE
PID:892 -
\??\c:\pvjvp.exec:\pvjvp.exe62⤵
- Executes dropped EXE
PID:3672 -
\??\c:\xlffxrr.exec:\xlffxrr.exe63⤵
- Executes dropped EXE
PID:548 -
\??\c:\nhhbbt.exec:\nhhbbt.exe64⤵
- Executes dropped EXE
PID:3876 -
\??\c:\hhnbtn.exec:\hhnbtn.exe65⤵
- Executes dropped EXE
PID:1680 -
\??\c:\ddpdv.exec:\ddpdv.exe66⤵PID:2844
-
\??\c:\vvjdp.exec:\vvjdp.exe67⤵PID:4940
-
\??\c:\xrrlxff.exec:\xrrlxff.exe68⤵PID:4756
-
\??\c:\5lfxrlf.exec:\5lfxrlf.exe69⤵PID:412
-
\??\c:\nnhbbt.exec:\nnhbbt.exe70⤵PID:3824
-
\??\c:\httthb.exec:\httthb.exe71⤵PID:912
-
\??\c:\jdvpp.exec:\jdvpp.exe72⤵PID:3848
-
\??\c:\xrxrlrl.exec:\xrxrlrl.exe73⤵PID:2184
-
\??\c:\xrrlflf.exec:\xrrlflf.exe74⤵PID:3484
-
\??\c:\nthtnn.exec:\nthtnn.exe75⤵PID:2864
-
\??\c:\pjdvv.exec:\pjdvv.exe76⤵PID:4768
-
\??\c:\fxflxfr.exec:\fxflxfr.exe77⤵PID:4456
-
\??\c:\rflfllr.exec:\rflfllr.exe78⤵PID:4424
-
\??\c:\ttthnn.exec:\ttthnn.exe79⤵PID:4372
-
\??\c:\nhhbnn.exec:\nhhbnn.exe80⤵PID:4956
-
\??\c:\5pvpp.exec:\5pvpp.exe81⤵PID:4860
-
\??\c:\xffxrlf.exec:\xffxrlf.exe82⤵PID:2388
-
\??\c:\llxlxxx.exec:\llxlxxx.exe83⤵PID:4088
-
\??\c:\bhthtt.exec:\bhthtt.exe84⤵PID:4180
-
\??\c:\hbhtbt.exec:\hbhtbt.exe85⤵PID:1852
-
\??\c:\jdvpd.exec:\jdvpd.exe86⤵PID:1492
-
\??\c:\9vjdv.exec:\9vjdv.exe87⤵PID:2192
-
\??\c:\rfxflll.exec:\rfxflll.exe88⤵PID:216
-
\??\c:\nbttnb.exec:\nbttnb.exe89⤵PID:1004
-
\??\c:\hhnbnn.exec:\hhnbnn.exe90⤵PID:680
-
\??\c:\dvdpv.exec:\dvdpv.exe91⤵PID:4664
-
\??\c:\fflfxxf.exec:\fflfxxf.exe92⤵PID:2724
-
\??\c:\llrxxfl.exec:\llrxxfl.exe93⤵PID:64
-
\??\c:\bthbhb.exec:\bthbhb.exe94⤵PID:5052
-
\??\c:\7vpdv.exec:\7vpdv.exe95⤵PID:1588
-
\??\c:\pvpjv.exec:\pvpjv.exe96⤵PID:4116
-
\??\c:\lxfxlff.exec:\lxfxlff.exe97⤵PID:2852
-
\??\c:\lxxrrrl.exec:\lxxrrrl.exe98⤵PID:5044
-
\??\c:\bbnbth.exec:\bbnbth.exe99⤵PID:3480
-
\??\c:\dppjv.exec:\dppjv.exe100⤵PID:2316
-
\??\c:\jddjv.exec:\jddjv.exe101⤵PID:2776
-
\??\c:\rffxlfx.exec:\rffxlfx.exe102⤵PID:5076
-
\??\c:\tttnhb.exec:\tttnhb.exe103⤵PID:2288
-
\??\c:\7nthhb.exec:\7nthhb.exe104⤵PID:2868
-
\??\c:\jdpjv.exec:\jdpjv.exe105⤵PID:4760
-
\??\c:\1vjdv.exec:\1vjdv.exe106⤵PID:3692
-
\??\c:\fxrffff.exec:\fxrffff.exe107⤵PID:3464
-
\??\c:\xxxrllf.exec:\xxxrllf.exe108⤵PID:4652
-
\??\c:\hnnnhb.exec:\hnnnhb.exe109⤵PID:4284
-
\??\c:\bttntt.exec:\bttntt.exe110⤵PID:3980
-
\??\c:\5vjjd.exec:\5vjjd.exe111⤵PID:1760
-
\??\c:\rlxrxrf.exec:\rlxrxrf.exe112⤵PID:3644
-
\??\c:\7fxlfrl.exec:\7fxlfrl.exe113⤵PID:732
-
\??\c:\hhnhtn.exec:\hhnhtn.exe114⤵PID:4928
-
\??\c:\bbthhh.exec:\bbthhh.exe115⤵PID:1824
-
\??\c:\vjvjd.exec:\vjvjd.exe116⤵PID:4260
-
\??\c:\vdvvj.exec:\vdvvj.exe117⤵PID:3404
-
\??\c:\lrlxrlf.exec:\lrlxrlf.exe118⤵PID:4012
-
\??\c:\ffrrrrr.exec:\ffrrrrr.exe119⤵PID:4784
-
\??\c:\hhtbbn.exec:\hhtbbn.exe120⤵PID:2680
-
\??\c:\pvdvp.exec:\pvdvp.exe121⤵PID:3664
-
\??\c:\7vjvv.exec:\7vjvv.exe122⤵PID:1440
-
\??\c:\rrrrrrl.exec:\rrrrrrl.exe123⤵PID:1512
-
\??\c:\rxffxrr.exec:\rxffxrr.exe124⤵PID:1632
-
\??\c:\bnnbtn.exec:\bnnbtn.exe125⤵PID:1216
-
\??\c:\pdpdj.exec:\pdpdj.exe126⤵PID:1904
-
\??\c:\flfxrll.exec:\flfxrll.exe127⤵PID:2344
-
\??\c:\bnnhhb.exec:\bnnhhb.exe128⤵PID:1892
-
\??\c:\pvdvv.exec:\pvdvv.exe129⤵PID:1912
-
\??\c:\3vvpj.exec:\3vvpj.exe130⤵PID:1860
-
\??\c:\rlffrrx.exec:\rlffrrx.exe131⤵PID:4796
-
\??\c:\rlfxrxr.exec:\rlfxrxr.exe132⤵PID:3312
-
\??\c:\thnhbb.exec:\thnhbb.exe133⤵PID:4472
-
\??\c:\bhnhbn.exec:\bhnhbn.exe134⤵PID:4980
-
\??\c:\1vjvp.exec:\1vjvp.exe135⤵PID:4420
-
\??\c:\djdvp.exec:\djdvp.exe136⤵PID:3136
-
\??\c:\rlllfff.exec:\rlllfff.exe137⤵PID:1292
-
\??\c:\xxfrxrr.exec:\xxfrxrr.exe138⤵PID:2276
-
\??\c:\5nhnht.exec:\5nhnht.exe139⤵PID:4584
-
\??\c:\hbtnbt.exec:\hbtnbt.exe140⤵PID:400
-
\??\c:\jvjdv.exec:\jvjdv.exe141⤵PID:2576
-
\??\c:\vdjdv.exec:\vdjdv.exe142⤵PID:3420
-
\??\c:\rxrrlfx.exec:\rxrrlfx.exe143⤵PID:1396
-
\??\c:\thtbnh.exec:\thtbnh.exe144⤵PID:2152
-
\??\c:\tnhthh.exec:\tnhthh.exe145⤵PID:2424
-
\??\c:\1jjvj.exec:\1jjvj.exe146⤵PID:4436
-
\??\c:\jdjvj.exec:\jdjvj.exe147⤵PID:956
-
\??\c:\flffxrr.exec:\flffxrr.exe148⤵PID:1056
-
\??\c:\1fxrllf.exec:\1fxrllf.exe149⤵PID:3400
-
\??\c:\9hnhbt.exec:\9hnhbt.exe150⤵PID:1516
-
\??\c:\3btthh.exec:\3btthh.exe151⤵PID:4304
-
\??\c:\hbhthb.exec:\hbhthb.exe152⤵PID:208
-
\??\c:\dppjj.exec:\dppjj.exe153⤵PID:1828
-
\??\c:\3fllxfr.exec:\3fllxfr.exe154⤵PID:2096
-
\??\c:\lxrxfrf.exec:\lxrxfrf.exe155⤵PID:736
-
\??\c:\hbbtbt.exec:\hbbtbt.exe156⤵PID:3804
-
\??\c:\jddpj.exec:\jddpj.exe157⤵PID:5064
-
\??\c:\ppjdp.exec:\ppjdp.exe158⤵PID:1600
-
\??\c:\lrlfrrl.exec:\lrlfrrl.exe159⤵PID:436
-
\??\c:\lxxrllf.exec:\lxxrllf.exe160⤵PID:692
-
\??\c:\bbtnhn.exec:\bbtnhn.exe161⤵PID:4928
-
\??\c:\pppdv.exec:\pppdv.exe162⤵PID:2940
-
\??\c:\dvpdp.exec:\dvpdp.exe163⤵PID:2104
-
\??\c:\rlxlffx.exec:\rlxlffx.exe164⤵PID:3108
-
\??\c:\3rxlfrf.exec:\3rxlfrf.exe165⤵PID:4012
-
\??\c:\nhhnbb.exec:\nhhnbb.exe166⤵PID:676
-
\??\c:\bnnhbt.exec:\bnnhbt.exe167⤵PID:4520
-
\??\c:\5vppj.exec:\5vppj.exe168⤵PID:5072
-
\??\c:\1rffrlf.exec:\1rffrlf.exe169⤵PID:4368
-
\??\c:\rlffxrf.exec:\rlffxrf.exe170⤵PID:1512
-
\??\c:\tnbnnb.exec:\tnbnnb.exe171⤵PID:2616
-
\??\c:\ppjjd.exec:\ppjjd.exe172⤵PID:4956
-
\??\c:\rrrxlfl.exec:\rrrxlfl.exe173⤵PID:2884
-
\??\c:\bhhthb.exec:\bhhthb.exe174⤵PID:1576
-
\??\c:\nbnbnh.exec:\nbnbnh.exe175⤵PID:1524
-
\??\c:\dvvvd.exec:\dvvvd.exe176⤵PID:988
-
\??\c:\5rxrllf.exec:\5rxrllf.exe177⤵PID:4572
-
\??\c:\rlxfxrl.exec:\rlxfxrl.exe178⤵PID:2448
-
\??\c:\tnbhbn.exec:\tnbhbn.exe179⤵PID:1040
-
\??\c:\3ntnnn.exec:\3ntnnn.exe180⤵PID:1188
-
\??\c:\pjvpd.exec:\pjvpd.exe181⤵PID:4364
-
\??\c:\jjddp.exec:\jjddp.exe182⤵PID:2984
-
\??\c:\rlrllfx.exec:\rlrllfx.exe183⤵PID:3984
-
\??\c:\xrfxrll.exec:\xrfxrll.exe184⤵PID:4776
-
\??\c:\hnbhth.exec:\hnbhth.exe185⤵PID:5036
-
\??\c:\7bthbn.exec:\7bthbn.exe186⤵PID:1220
-
\??\c:\pdjvp.exec:\pdjvp.exe187⤵PID:2392
-
\??\c:\dppjd.exec:\dppjd.exe188⤵PID:4164
-
\??\c:\3xxrlfx.exec:\3xxrlfx.exe189⤵PID:3956
-
\??\c:\xlffxxr.exec:\xlffxxr.exe190⤵PID:4968
-
\??\c:\btbtbt.exec:\btbtbt.exe191⤵PID:4660
-
\??\c:\tthbtt.exec:\tthbtt.exe192⤵PID:4872
-
\??\c:\7ppjd.exec:\7ppjd.exe193⤵PID:4464
-
\??\c:\jvpjj.exec:\jvpjj.exe194⤵PID:528
-
\??\c:\frlfrrf.exec:\frlfrrf.exe195⤵PID:708
-
\??\c:\frlflfr.exec:\frlflfr.exe196⤵PID:3476
-
\??\c:\bnhnnt.exec:\bnhnnt.exe197⤵PID:936
-
\??\c:\nhbthh.exec:\nhbthh.exe198⤵PID:3464
-
\??\c:\3jvdj.exec:\3jvdj.exe199⤵PID:396
-
\??\c:\7ppvp.exec:\7ppvp.exe200⤵PID:5084
-
\??\c:\ffxlffx.exec:\ffxlffx.exe201⤵PID:724
-
\??\c:\frxxfrr.exec:\frxxfrr.exe202⤵PID:5040
-
\??\c:\hbhttt.exec:\hbhttt.exe203⤵PID:1680
-
\??\c:\dvjvv.exec:\dvjvv.exe204⤵PID:436
-
\??\c:\ddvjd.exec:\ddvjd.exe205⤵PID:4936
-
\??\c:\lxrlxxf.exec:\lxrlxxf.exe206⤵PID:3824
-
\??\c:\thnhhh.exec:\thnhhh.exe207⤵PID:4212
-
\??\c:\btbhth.exec:\btbhth.exe208⤵PID:4216
-
\??\c:\jdvdd.exec:\jdvdd.exe209⤵PID:4784
-
\??\c:\jpjpd.exec:\jpjpd.exe210⤵PID:2024
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe211⤵PID:4072
-
\??\c:\btbntn.exec:\btbntn.exe212⤵PID:4552
-
\??\c:\hbtthn.exec:\hbtthn.exe213⤵PID:4456
-
\??\c:\nnhthh.exec:\nnhthh.exe214⤵PID:4356
-
\??\c:\vpvpv.exec:\vpvpv.exe215⤵PID:2616
-
\??\c:\7ppjd.exec:\7ppjd.exe216⤵PID:1908
-
\??\c:\rflfrrl.exec:\rflfrrl.exe217⤵PID:2148
-
\??\c:\bhtbht.exec:\bhtbht.exe218⤵PID:5088
-
\??\c:\tbbtnn.exec:\tbbtnn.exe219⤵PID:4472
-
\??\c:\pvvpd.exec:\pvvpd.exe220⤵PID:2568
-
\??\c:\dvvvv.exec:\dvvvv.exe221⤵PID:680
-
\??\c:\dvdvj.exec:\dvdvj.exe222⤵PID:4664
-
\??\c:\lxfxrlf.exec:\lxfxrlf.exe223⤵PID:2276
-
\??\c:\xrlfffx.exec:\xrlfffx.exe224⤵PID:3940
-
\??\c:\nthbtn.exec:\nthbtn.exe225⤵PID:1444
-
\??\c:\httnhh.exec:\httnhh.exe226⤵PID:1592
-
\??\c:\pdvvp.exec:\pdvvp.exe227⤵PID:2392
-
\??\c:\jvjdd.exec:\jvjdd.exe228⤵PID:3996
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe229⤵PID:4636
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe230⤵PID:380
-
\??\c:\hntnhb.exec:\hntnhb.exe231⤵PID:4932
-
\??\c:\vppjd.exec:\vppjd.exe232⤵PID:2288
-
\??\c:\xxrlrff.exec:\xxrlrff.exe233⤵PID:4532
-
\??\c:\rflxlrx.exec:\rflxlrx.exe234⤵PID:1968
-
\??\c:\hnbtnn.exec:\hnbtnn.exe235⤵PID:4304
-
\??\c:\tnhbhh.exec:\tnhbhh.exe236⤵PID:3808
-
\??\c:\xxlfffx.exec:\xxlfffx.exe237⤵PID:816
-
\??\c:\xrrfxfx.exec:\xrrfxfx.exe238⤵PID:368
-
\??\c:\nhttbt.exec:\nhttbt.exe239⤵PID:2720
-
\??\c:\7tthbh.exec:\7tthbh.exe240⤵PID:1464
-
\??\c:\jdppv.exec:\jdppv.exe241⤵PID:3428
-
\??\c:\jdvpj.exec:\jdvpj.exe242⤵PID:3104