Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 23:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5ed5faa5e06c443cb04922533aa97e30_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5ed5faa5e06c443cb04922533aa97e30_NeikiAnalytics.exe
-
Size
62KB
-
MD5
5ed5faa5e06c443cb04922533aa97e30
-
SHA1
9b08027795dceafaa9c0c8ee0445fc12c96008af
-
SHA256
61a73a14f47b2be2d62dd1bba92293e9d18e525ee971b9ea45fa9226559c1bbb
-
SHA512
f278b8ea3fd55ca30d35dbf7482fe711d9aacab94872d037487a50bb94e823ed20425418a13f6cb31690b3845982f5e1d56add0d7f397b5df2fbaa060e914aa8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDISoFGDw27:ymb3NkkiQ3mdBjFIk17
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/1712-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1836-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1324-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
9djjj.exellfxxxr.exebhtbnt.exe1dppp.exerlrrlrf.exenntttb.exetnttnh.exepjdvp.exexfrrlll.exepdddd.exepppvj.exellxxxfx.exetbbbhh.exejdjvv.exelxfllll.exe7tnbbt.exevvvvv.exe7lrxlrr.exehnhhth.exe1vvjj.exelfffffx.exefffflrx.exe3tnhbh.exepjvpv.exefxfxrxr.exelllxrrr.exehbhntt.exehttnnn.exepvvpp.exerxlxxff.exerfrfxxx.exettbhtb.exethtttt.exe7pdjj.exellrrxff.exetthnnt.exetthnth.exejjjjp.exevpdjp.exerrfflrr.exefxrllfx.exenhnnnh.exeddddj.exepjppj.exe7xxrrxx.exejppdj.exevpvpp.exellxffrx.exeffffxll.exebbhnbh.exeppvvd.exejjppp.exellrxrxf.exetnhhhn.exethnnhn.exevdjjd.exeflrlfrf.exexrxxfxx.exebtbhnt.exehhttnn.exejdpjj.exexlrxxfl.exe3thhhn.exeppjpj.exepid process 3372 9djjj.exe 1584 llfxxxr.exe 2488 bhtbnt.exe 3304 1dppp.exe 1148 rlrrlrf.exe 2004 nntttb.exe 4372 tnttnh.exe 1836 pjdvp.exe 2212 xfrrlll.exe 3560 pdddd.exe 2080 pppvj.exe 4920 llxxxfx.exe 1108 tbbbhh.exe 2400 jdjvv.exe 2588 lxfllll.exe 4060 7tnbbt.exe 4700 vvvvv.exe 2904 7lrxlrr.exe 4908 hnhhth.exe 3408 1vvjj.exe 4048 lfffffx.exe 3176 fffflrx.exe 4604 3tnhbh.exe 2384 pjvpv.exe 2008 fxfxrxr.exe 3452 lllxrrr.exe 1680 hbhntt.exe 2052 httnnn.exe 1324 pvvpp.exe 2852 rxlxxff.exe 3696 rfrfxxx.exe 3420 ttbhtb.exe 4912 thtttt.exe 2392 7pdjj.exe 4168 llrrxff.exe 820 tthnnt.exe 4940 tthnth.exe 2780 jjjjp.exe 4564 vpdjp.exe 2348 rrfflrr.exe 4428 fxrllfx.exe 5064 nhnnnh.exe 3272 ddddj.exe 3372 pjppj.exe 2464 7xxrrxx.exe 1844 jppdj.exe 3872 vpvpp.exe 1112 llxffrx.exe 1816 ffffxll.exe 3248 bbhnbh.exe 4584 ppvvd.exe 4580 jjppp.exe 2476 llrxrxf.exe 4648 tnhhhn.exe 3560 thnnhn.exe 1356 vdjjd.exe 4932 flrlfrf.exe 4996 xrxxfxx.exe 1000 btbhnt.exe 2280 hhttnn.exe 1896 jdpjj.exe 5040 xlrxxfl.exe 2352 3thhhn.exe 4080 ppjpj.exe -
Processes:
resource yara_rule behavioral2/memory/1712-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5ed5faa5e06c443cb04922533aa97e30_NeikiAnalytics.exe9djjj.exellfxxxr.exebhtbnt.exe1dppp.exerlrrlrf.exenntttb.exetnttnh.exepjdvp.exexfrrlll.exepdddd.exepppvj.exellxxxfx.exetbbbhh.exejdjvv.exelxfllll.exe7tnbbt.exevvvvv.exe7lrxlrr.exehnhhth.exe1vvjj.exelfffffx.exedescription pid process target process PID 1712 wrote to memory of 3372 1712 5ed5faa5e06c443cb04922533aa97e30_NeikiAnalytics.exe 9djjj.exe PID 1712 wrote to memory of 3372 1712 5ed5faa5e06c443cb04922533aa97e30_NeikiAnalytics.exe 9djjj.exe PID 1712 wrote to memory of 3372 1712 5ed5faa5e06c443cb04922533aa97e30_NeikiAnalytics.exe 9djjj.exe PID 3372 wrote to memory of 1584 3372 9djjj.exe llfxxxr.exe PID 3372 wrote to memory of 1584 3372 9djjj.exe llfxxxr.exe PID 3372 wrote to memory of 1584 3372 9djjj.exe llfxxxr.exe PID 1584 wrote to memory of 2488 1584 llfxxxr.exe bhtbnt.exe PID 1584 wrote to memory of 2488 1584 llfxxxr.exe bhtbnt.exe PID 1584 wrote to memory of 2488 1584 llfxxxr.exe bhtbnt.exe PID 2488 wrote to memory of 3304 2488 bhtbnt.exe 1dppp.exe PID 2488 wrote to memory of 3304 2488 bhtbnt.exe 1dppp.exe PID 2488 wrote to memory of 3304 2488 bhtbnt.exe 1dppp.exe PID 3304 wrote to memory of 1148 3304 1dppp.exe rlrrlrf.exe PID 3304 wrote to memory of 1148 3304 1dppp.exe rlrrlrf.exe PID 3304 wrote to memory of 1148 3304 1dppp.exe rlrrlrf.exe PID 1148 wrote to memory of 2004 1148 rlrrlrf.exe nntttb.exe PID 1148 wrote to memory of 2004 1148 rlrrlrf.exe nntttb.exe PID 1148 wrote to memory of 2004 1148 rlrrlrf.exe nntttb.exe PID 2004 wrote to memory of 4372 2004 nntttb.exe tnttnh.exe PID 2004 wrote to memory of 4372 2004 nntttb.exe tnttnh.exe PID 2004 wrote to memory of 4372 2004 nntttb.exe tnttnh.exe PID 4372 wrote to memory of 1836 4372 tnttnh.exe pjdvp.exe PID 4372 wrote to memory of 1836 4372 tnttnh.exe pjdvp.exe PID 4372 wrote to memory of 1836 4372 tnttnh.exe pjdvp.exe PID 1836 wrote to memory of 2212 1836 pjdvp.exe xfrrlll.exe PID 1836 wrote to memory of 2212 1836 pjdvp.exe xfrrlll.exe PID 1836 wrote to memory of 2212 1836 pjdvp.exe xfrrlll.exe PID 2212 wrote to memory of 3560 2212 xfrrlll.exe pdddd.exe PID 2212 wrote to memory of 3560 2212 xfrrlll.exe pdddd.exe PID 2212 wrote to memory of 3560 2212 xfrrlll.exe pdddd.exe PID 3560 wrote to memory of 2080 3560 pdddd.exe pppvj.exe PID 3560 wrote to memory of 2080 3560 pdddd.exe pppvj.exe PID 3560 wrote to memory of 2080 3560 pdddd.exe pppvj.exe PID 2080 wrote to memory of 4920 2080 pppvj.exe llxxxfx.exe PID 2080 wrote to memory of 4920 2080 pppvj.exe llxxxfx.exe PID 2080 wrote to memory of 4920 2080 pppvj.exe llxxxfx.exe PID 4920 wrote to memory of 1108 4920 llxxxfx.exe tbbbhh.exe PID 4920 wrote to memory of 1108 4920 llxxxfx.exe tbbbhh.exe PID 4920 wrote to memory of 1108 4920 llxxxfx.exe tbbbhh.exe PID 1108 wrote to memory of 2400 1108 tbbbhh.exe jdjvv.exe PID 1108 wrote to memory of 2400 1108 tbbbhh.exe jdjvv.exe PID 1108 wrote to memory of 2400 1108 tbbbhh.exe jdjvv.exe PID 2400 wrote to memory of 2588 2400 jdjvv.exe lxfllll.exe PID 2400 wrote to memory of 2588 2400 jdjvv.exe lxfllll.exe PID 2400 wrote to memory of 2588 2400 jdjvv.exe lxfllll.exe PID 2588 wrote to memory of 4060 2588 lxfllll.exe 7tnbbt.exe PID 2588 wrote to memory of 4060 2588 lxfllll.exe 7tnbbt.exe PID 2588 wrote to memory of 4060 2588 lxfllll.exe 7tnbbt.exe PID 4060 wrote to memory of 4700 4060 7tnbbt.exe vvvvv.exe PID 4060 wrote to memory of 4700 4060 7tnbbt.exe vvvvv.exe PID 4060 wrote to memory of 4700 4060 7tnbbt.exe vvvvv.exe PID 4700 wrote to memory of 2904 4700 vvvvv.exe 7lrxlrr.exe PID 4700 wrote to memory of 2904 4700 vvvvv.exe 7lrxlrr.exe PID 4700 wrote to memory of 2904 4700 vvvvv.exe 7lrxlrr.exe PID 2904 wrote to memory of 4908 2904 7lrxlrr.exe hnhhth.exe PID 2904 wrote to memory of 4908 2904 7lrxlrr.exe hnhhth.exe PID 2904 wrote to memory of 4908 2904 7lrxlrr.exe hnhhth.exe PID 4908 wrote to memory of 3408 4908 hnhhth.exe 1vvjj.exe PID 4908 wrote to memory of 3408 4908 hnhhth.exe 1vvjj.exe PID 4908 wrote to memory of 3408 4908 hnhhth.exe 1vvjj.exe PID 3408 wrote to memory of 4048 3408 1vvjj.exe lfffffx.exe PID 3408 wrote to memory of 4048 3408 1vvjj.exe lfffffx.exe PID 3408 wrote to memory of 4048 3408 1vvjj.exe lfffffx.exe PID 4048 wrote to memory of 3176 4048 lfffffx.exe fffflrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ed5faa5e06c443cb04922533aa97e30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5ed5faa5e06c443cb04922533aa97e30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\9djjj.exec:\9djjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\llfxxxr.exec:\llfxxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\bhtbnt.exec:\bhtbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\1dppp.exec:\1dppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\rlrrlrf.exec:\rlrrlrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\nntttb.exec:\nntttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\tnttnh.exec:\tnttnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\pjdvp.exec:\pjdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\xfrrlll.exec:\xfrrlll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\pdddd.exec:\pdddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\pppvj.exec:\pppvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\llxxxfx.exec:\llxxxfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\tbbbhh.exec:\tbbbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\jdjvv.exec:\jdjvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\lxfllll.exec:\lxfllll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\7tnbbt.exec:\7tnbbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\vvvvv.exec:\vvvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\7lrxlrr.exec:\7lrxlrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\hnhhth.exec:\hnhhth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\1vvjj.exec:\1vvjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\lfffffx.exec:\lfffffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\fffflrx.exec:\fffflrx.exe23⤵
- Executes dropped EXE
PID:3176 -
\??\c:\3tnhbh.exec:\3tnhbh.exe24⤵
- Executes dropped EXE
PID:4604 -
\??\c:\pjvpv.exec:\pjvpv.exe25⤵
- Executes dropped EXE
PID:2384 -
\??\c:\fxfxrxr.exec:\fxfxrxr.exe26⤵
- Executes dropped EXE
PID:2008 -
\??\c:\lllxrrr.exec:\lllxrrr.exe27⤵
- Executes dropped EXE
PID:3452 -
\??\c:\hbhntt.exec:\hbhntt.exe28⤵
- Executes dropped EXE
PID:1680 -
\??\c:\httnnn.exec:\httnnn.exe29⤵
- Executes dropped EXE
PID:2052 -
\??\c:\pvvpp.exec:\pvvpp.exe30⤵
- Executes dropped EXE
PID:1324 -
\??\c:\rxlxxff.exec:\rxlxxff.exe31⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rfrfxxx.exec:\rfrfxxx.exe32⤵
- Executes dropped EXE
PID:3696 -
\??\c:\ttbhtb.exec:\ttbhtb.exe33⤵
- Executes dropped EXE
PID:3420 -
\??\c:\thtttt.exec:\thtttt.exe34⤵
- Executes dropped EXE
PID:4912 -
\??\c:\7pdjj.exec:\7pdjj.exe35⤵
- Executes dropped EXE
PID:2392 -
\??\c:\llrrxff.exec:\llrrxff.exe36⤵
- Executes dropped EXE
PID:4168 -
\??\c:\tthnnt.exec:\tthnnt.exe37⤵
- Executes dropped EXE
PID:820 -
\??\c:\tthnth.exec:\tthnth.exe38⤵
- Executes dropped EXE
PID:4940 -
\??\c:\jjjjp.exec:\jjjjp.exe39⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vpdjp.exec:\vpdjp.exe40⤵
- Executes dropped EXE
PID:4564 -
\??\c:\rrfflrr.exec:\rrfflrr.exe41⤵
- Executes dropped EXE
PID:2348 -
\??\c:\fxrllfx.exec:\fxrllfx.exe42⤵
- Executes dropped EXE
PID:4428 -
\??\c:\nhnnnh.exec:\nhnnnh.exe43⤵
- Executes dropped EXE
PID:5064 -
\??\c:\ddddj.exec:\ddddj.exe44⤵
- Executes dropped EXE
PID:3272 -
\??\c:\pjppj.exec:\pjppj.exe45⤵
- Executes dropped EXE
PID:3372 -
\??\c:\7xxrrxx.exec:\7xxrrxx.exe46⤵
- Executes dropped EXE
PID:2464 -
\??\c:\jppdj.exec:\jppdj.exe47⤵
- Executes dropped EXE
PID:1844 -
\??\c:\vpvpp.exec:\vpvpp.exe48⤵
- Executes dropped EXE
PID:3872 -
\??\c:\llxffrx.exec:\llxffrx.exe49⤵
- Executes dropped EXE
PID:1112 -
\??\c:\ffffxll.exec:\ffffxll.exe50⤵
- Executes dropped EXE
PID:1816 -
\??\c:\bbhnbh.exec:\bbhnbh.exe51⤵
- Executes dropped EXE
PID:3248 -
\??\c:\ppvvd.exec:\ppvvd.exe52⤵
- Executes dropped EXE
PID:4584 -
\??\c:\jjppp.exec:\jjppp.exe53⤵
- Executes dropped EXE
PID:4580 -
\??\c:\llrxrxf.exec:\llrxrxf.exe54⤵
- Executes dropped EXE
PID:2476 -
\??\c:\tnhhhn.exec:\tnhhhn.exe55⤵
- Executes dropped EXE
PID:4648 -
\??\c:\thnnhn.exec:\thnnhn.exe56⤵
- Executes dropped EXE
PID:3560 -
\??\c:\vdjjd.exec:\vdjjd.exe57⤵
- Executes dropped EXE
PID:1356 -
\??\c:\flrlfrf.exec:\flrlfrf.exe58⤵
- Executes dropped EXE
PID:4932 -
\??\c:\xrxxfxx.exec:\xrxxfxx.exe59⤵
- Executes dropped EXE
PID:4996 -
\??\c:\btbhnt.exec:\btbhnt.exe60⤵
- Executes dropped EXE
PID:1000 -
\??\c:\hhttnn.exec:\hhttnn.exe61⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jdpjj.exec:\jdpjj.exe62⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xlrxxfl.exec:\xlrxxfl.exe63⤵
- Executes dropped EXE
PID:5040 -
\??\c:\3thhhn.exec:\3thhhn.exe64⤵
- Executes dropped EXE
PID:2352 -
\??\c:\ppjpj.exec:\ppjpj.exe65⤵
- Executes dropped EXE
PID:4080 -
\??\c:\djdpj.exec:\djdpj.exe66⤵PID:3764
-
\??\c:\llrxrxr.exec:\llrxrxr.exe67⤵PID:3204
-
\??\c:\hthntb.exec:\hthntb.exe68⤵PID:4016
-
\??\c:\bntbbh.exec:\bntbbh.exe69⤵PID:4856
-
\??\c:\3jjjv.exec:\3jjjv.exe70⤵PID:4256
-
\??\c:\9djpp.exec:\9djpp.exe71⤵PID:4904
-
\??\c:\rxlflrx.exec:\rxlflrx.exe72⤵PID:2784
-
\??\c:\tbthtn.exec:\tbthtn.exe73⤵PID:1796
-
\??\c:\tnnnhn.exec:\tnnnhn.exe74⤵PID:3992
-
\??\c:\djjpv.exec:\djjpv.exe75⤵PID:1180
-
\??\c:\vdddv.exec:\vdddv.exe76⤵PID:3452
-
\??\c:\frfllrr.exec:\frfllrr.exe77⤵PID:2148
-
\??\c:\5fffxxr.exec:\5fffxxr.exe78⤵PID:2244
-
\??\c:\nnhthn.exec:\nnhthn.exe79⤵PID:2040
-
\??\c:\bthnnt.exec:\bthnnt.exe80⤵PID:2852
-
\??\c:\3jddd.exec:\3jddd.exe81⤵PID:2616
-
\??\c:\lfxrlll.exec:\lfxrlll.exe82⤵PID:1644
-
\??\c:\xrxlfxx.exec:\xrxlfxx.exe83⤵PID:4600
-
\??\c:\hnnttt.exec:\hnnttt.exe84⤵PID:5032
-
\??\c:\9ppjd.exec:\9ppjd.exe85⤵PID:4612
-
\??\c:\pdvjd.exec:\pdvjd.exe86⤵PID:628
-
\??\c:\xlfxfxf.exec:\xlfxfxf.exe87⤵PID:4280
-
\??\c:\ffxxxfx.exec:\ffxxxfx.exe88⤵PID:3668
-
\??\c:\7nhbtt.exec:\7nhbtt.exe89⤵PID:2704
-
\??\c:\nttnhb.exec:\nttnhb.exe90⤵PID:3460
-
\??\c:\pddpj.exec:\pddpj.exe91⤵PID:4172
-
\??\c:\jpvvp.exec:\jpvvp.exe92⤵PID:4772
-
\??\c:\lflrxxx.exec:\lflrxxx.exe93⤵PID:3272
-
\??\c:\rxlxrfr.exec:\rxlxrfr.exe94⤵PID:3096
-
\??\c:\nbbbbb.exec:\nbbbbb.exe95⤵PID:3200
-
\??\c:\ddjjp.exec:\ddjjp.exe96⤵PID:3512
-
\??\c:\jjjvj.exec:\jjjvj.exe97⤵PID:3044
-
\??\c:\flrxlrx.exec:\flrxlrx.exe98⤵PID:3528
-
\??\c:\3bbbnn.exec:\3bbbnn.exe99⤵PID:4476
-
\??\c:\tntnhb.exec:\tntnhb.exe100⤵PID:464
-
\??\c:\jdpjp.exec:\jdpjp.exe101⤵PID:1516
-
\??\c:\nthnhb.exec:\nthnhb.exe102⤵PID:848
-
\??\c:\vpjdj.exec:\vpjdj.exe103⤵PID:816
-
\??\c:\3vvvj.exec:\3vvvj.exe104⤵PID:828
-
\??\c:\frfxrlf.exec:\frfxrlf.exe105⤵PID:4648
-
\??\c:\bnnnhh.exec:\bnnnhh.exe106⤵PID:3560
-
\??\c:\vvddp.exec:\vvddp.exe107⤵PID:4920
-
\??\c:\fxffffl.exec:\fxffffl.exe108⤵PID:2932
-
\??\c:\1ffllll.exec:\1ffllll.exe109⤵PID:4356
-
\??\c:\1hbbtb.exec:\1hbbtb.exe110⤵PID:1908
-
\??\c:\hnnnnn.exec:\hnnnnn.exe111⤵PID:4060
-
\??\c:\dvddp.exec:\dvddp.exe112⤵PID:4828
-
\??\c:\vjdpj.exec:\vjdpj.exe113⤵PID:4120
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe114⤵PID:3868
-
\??\c:\3lfxrrf.exec:\3lfxrrf.exe115⤵PID:988
-
\??\c:\hbbttt.exec:\hbbttt.exe116⤵PID:4256
-
\??\c:\vdjjj.exec:\vdjjj.exe117⤵PID:2784
-
\??\c:\jvdjj.exec:\jvdjj.exe118⤵PID:2008
-
\??\c:\9xlfxxr.exec:\9xlfxxr.exe119⤵PID:4788
-
\??\c:\llrxrrl.exec:\llrxrrl.exe120⤵PID:2896
-
\??\c:\tnbtbb.exec:\tnbtbb.exe121⤵PID:1396
-
\??\c:\thbtnh.exec:\thbtnh.exe122⤵PID:1324
-
\??\c:\pjppd.exec:\pjppd.exe123⤵PID:3388
-
\??\c:\ffllflf.exec:\ffllflf.exe124⤵PID:1928
-
\??\c:\hhbbtt.exec:\hhbbtt.exe125⤵PID:952
-
\??\c:\vvvpp.exec:\vvvpp.exe126⤵PID:2692
-
\??\c:\vvvpp.exec:\vvvpp.exe127⤵PID:4460
-
\??\c:\xflfflf.exec:\xflfflf.exe128⤵PID:4704
-
\??\c:\nttnhh.exec:\nttnhh.exe129⤵PID:2508
-
\??\c:\hhbttt.exec:\hhbttt.exe130⤵PID:1548
-
\??\c:\pvppd.exec:\pvppd.exe131⤵PID:1368
-
\??\c:\lrffflr.exec:\lrffflr.exe132⤵PID:5068
-
\??\c:\pjdvp.exec:\pjdvp.exe133⤵PID:4564
-
\??\c:\vdjdv.exec:\vdjdv.exe134⤵PID:4400
-
\??\c:\xflfffr.exec:\xflfffr.exe135⤵PID:1192
-
\??\c:\jdpjp.exec:\jdpjp.exe136⤵PID:3100
-
\??\c:\jdpdv.exec:\jdpdv.exe137⤵PID:4140
-
\??\c:\ntbnhn.exec:\ntbnhn.exe138⤵PID:3352
-
\??\c:\pdjdd.exec:\pdjdd.exe139⤵PID:1712
-
\??\c:\rfffrrl.exec:\rfffrrl.exe140⤵PID:1540
-
\??\c:\lrlfrrl.exec:\lrlfrrl.exe141⤵PID:2448
-
\??\c:\bbnnhh.exec:\bbnnhh.exe142⤵PID:2004
-
\??\c:\htnhnh.exec:\htnhnh.exe143⤵PID:1168
-
\??\c:\xlrrrxf.exec:\xlrrrxf.exe144⤵PID:1816
-
\??\c:\tttttn.exec:\tttttn.exe145⤵PID:3864
-
\??\c:\nbhbbn.exec:\nbhbbn.exe146⤵PID:4580
-
\??\c:\pdjdj.exec:\pdjdj.exe147⤵PID:3000
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe148⤵PID:2476
-
\??\c:\7bhhbb.exec:\7bhhbb.exe149⤵PID:2472
-
\??\c:\tnnttt.exec:\tnnttt.exe150⤵PID:8
-
\??\c:\pvvjj.exec:\pvvjj.exe151⤵PID:1916
-
\??\c:\jdpjv.exec:\jdpjv.exe152⤵PID:876
-
\??\c:\rrlfrrr.exec:\rrlfrrr.exe153⤵PID:748
-
\??\c:\fxxxfxf.exec:\fxxxfxf.exe154⤵PID:888
-
\??\c:\tthbnt.exec:\tthbnt.exe155⤵PID:1376
-
\??\c:\nhtttb.exec:\nhtttb.exe156⤵PID:4552
-
\??\c:\vvvdd.exec:\vvvdd.exe157⤵PID:4544
-
\??\c:\dvddv.exec:\dvddv.exe158⤵PID:3176
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe159⤵PID:1796
-
\??\c:\lffxrxr.exec:\lffxrxr.exe160⤵PID:516
-
\??\c:\htbhbb.exec:\htbhbb.exe161⤵PID:1648
-
\??\c:\tthbhh.exec:\tthbhh.exe162⤵PID:2576
-
\??\c:\5djjp.exec:\5djjp.exe163⤵PID:4900
-
\??\c:\vdjjj.exec:\vdjjj.exe164⤵PID:2284
-
\??\c:\xxxrffx.exec:\xxxrffx.exe165⤵PID:3688
-
\??\c:\llrxrrl.exec:\llrxrrl.exe166⤵PID:1928
-
\??\c:\nnhbtt.exec:\nnhbtt.exe167⤵PID:2880
-
\??\c:\vpjpj.exec:\vpjpj.exe168⤵PID:4780
-
\??\c:\vdjdd.exec:\vdjdd.exe169⤵PID:2592
-
\??\c:\xlxfrrf.exec:\xlxfrrf.exe170⤵PID:820
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe171⤵PID:2336
-
\??\c:\hbbbbb.exec:\hbbbbb.exe172⤵PID:1864
-
\??\c:\ppjdj.exec:\ppjdj.exe173⤵PID:2044
-
\??\c:\ppppj.exec:\ppppj.exe174⤵PID:4428
-
\??\c:\rffrrxl.exec:\rffrrxl.exe175⤵PID:3464
-
\??\c:\xxfffll.exec:\xxfffll.exe176⤵PID:1132
-
\??\c:\bbbtnt.exec:\bbbtnt.exe177⤵PID:1716
-
\??\c:\9nnntb.exec:\9nnntb.exe178⤵PID:4672
-
\??\c:\dpvvp.exec:\dpvvp.exe179⤵PID:2708
-
\??\c:\3djjp.exec:\3djjp.exe180⤵PID:3512
-
\??\c:\rlffrxl.exec:\rlffrxl.exe181⤵PID:3196
-
\??\c:\bnntnb.exec:\bnntnb.exe182⤵PID:3528
-
\??\c:\tbhhhh.exec:\tbhhhh.exe183⤵PID:2152
-
\??\c:\pvvvv.exec:\pvvvv.exe184⤵PID:1836
-
\??\c:\frxxxxx.exec:\frxxxxx.exe185⤵PID:2212
-
\??\c:\xllrrrl.exec:\xllrrrl.exe186⤵PID:4344
-
\??\c:\bttttb.exec:\bttttb.exe187⤵PID:2668
-
\??\c:\vpvvp.exec:\vpvvp.exe188⤵PID:760
-
\??\c:\7ddvj.exec:\7ddvj.exe189⤵PID:1920
-
\??\c:\lflffff.exec:\lflffff.exe190⤵PID:1196
-
\??\c:\htbnhh.exec:\htbnhh.exe191⤵PID:2400
-
\??\c:\dpvpj.exec:\dpvpj.exe192⤵PID:2396
-
\??\c:\frxffxr.exec:\frxffxr.exe193⤵PID:748
-
\??\c:\ttthbt.exec:\ttthbt.exe194⤵PID:3764
-
\??\c:\bttnhh.exec:\bttnhh.exe195⤵PID:4336
-
\??\c:\vvvpj.exec:\vvvpj.exe196⤵PID:3408
-
\??\c:\jdppj.exec:\jdppj.exe197⤵PID:3292
-
\??\c:\rrlfrxx.exec:\rrlfrxx.exe198⤵PID:3588
-
\??\c:\rlfrllf.exec:\rlfrllf.exe199⤵PID:3176
-
\??\c:\btnnhh.exec:\btnnhh.exe200⤵PID:1152
-
\??\c:\nbhhtt.exec:\nbhhtt.exe201⤵PID:5056
-
\??\c:\pjdvj.exec:\pjdvj.exe202⤵PID:1648
-
\??\c:\jvdpj.exec:\jvdpj.exe203⤵PID:4160
-
\??\c:\rxxfrlf.exec:\rxxfrlf.exe204⤵PID:4900
-
\??\c:\3flrlll.exec:\3flrlll.exe205⤵PID:3696
-
\??\c:\3ttnht.exec:\3ttnht.exe206⤵PID:3688
-
\??\c:\bbbhth.exec:\bbbhth.exe207⤵PID:3956
-
\??\c:\jjjjd.exec:\jjjjd.exe208⤵PID:1896
-
\??\c:\vpvjj.exec:\vpvjj.exe209⤵PID:4168
-
\??\c:\xrfxrrx.exec:\xrfxrrx.exe210⤵PID:4780
-
\??\c:\bbnhtt.exec:\bbnhtt.exe211⤵PID:1724
-
\??\c:\hnnbbb.exec:\hnnbbb.exe212⤵PID:3608
-
\??\c:\thtnnn.exec:\thtnnn.exe213⤵PID:1064
-
\??\c:\jpjpv.exec:\jpjpv.exe214⤵PID:4400
-
\??\c:\rrrrflf.exec:\rrrrflf.exe215⤵PID:2788
-
\??\c:\frrfflr.exec:\frrfflr.exe216⤵PID:3272
-
\??\c:\hhhhhn.exec:\hhhhhn.exe217⤵PID:1572
-
\??\c:\ttttnn.exec:\ttttnn.exe218⤵PID:1056
-
\??\c:\9dddv.exec:\9dddv.exe219⤵PID:3872
-
\??\c:\5jjvp.exec:\5jjvp.exe220⤵PID:1436
-
\??\c:\rxfxllr.exec:\rxfxllr.exe221⤵PID:1488
-
\??\c:\fllxxrr.exec:\fllxxrr.exe222⤵PID:4532
-
\??\c:\tntnbt.exec:\tntnbt.exe223⤵PID:3816
-
\??\c:\pjppj.exec:\pjppj.exe224⤵PID:4188
-
\??\c:\vppjd.exec:\vppjd.exe225⤵PID:4580
-
\??\c:\llfxrrf.exec:\llfxrrf.exe226⤵PID:2476
-
\??\c:\rrfxxxf.exec:\rrfxxxf.exe227⤵PID:2080
-
\??\c:\ntttnn.exec:\ntttnn.exe228⤵PID:1028
-
\??\c:\7hhhtt.exec:\7hhhtt.exe229⤵PID:4652
-
\??\c:\7pjdv.exec:\7pjdv.exe230⤵PID:3500
-
\??\c:\vdjdv.exec:\vdjdv.exe231⤵PID:4060
-
\??\c:\5xxrlxr.exec:\5xxrlxr.exe232⤵PID:4692
-
\??\c:\fllxxrf.exec:\fllxxrf.exe233⤵PID:5116
-
\??\c:\5httht.exec:\5httht.exe234⤵PID:4416
-
\??\c:\nnnhhn.exec:\nnnhhn.exe235⤵PID:4892
-
\??\c:\3dppd.exec:\3dppd.exe236⤵PID:4544
-
\??\c:\jpdpd.exec:\jpdpd.exe237⤵PID:4256
-
\??\c:\3rxrllf.exec:\3rxrllf.exe238⤵PID:1544
-
\??\c:\lfxrlxx.exec:\lfxrlxx.exe239⤵PID:1180
-
\??\c:\bttnhh.exec:\bttnhh.exe240⤵PID:2300
-
\??\c:\bnthtt.exec:\bnthtt.exe241⤵PID:2576
-
\??\c:\1jjjv.exec:\1jjjv.exe242⤵PID:4800