Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 03:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5e0aa7a8f8fab8977e653ae7651a3ab0_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5e0aa7a8f8fab8977e653ae7651a3ab0_NeikiAnalytics.exe
-
Size
75KB
-
MD5
5e0aa7a8f8fab8977e653ae7651a3ab0
-
SHA1
5d47e2df66490c4708dadc65dbc8216c815051e4
-
SHA256
48a6cd4c621c0893732381aff1a2ff3cce9a8d04e0733413b41c2e6938aa38aa
-
SHA512
97dbc7a507dadf71e0d6a5c5cef0424157b00149100fa4c95ab0f5200881947ac63be5fdab234f98e28c5e3d893ca67166db9ffe52de4b88c4c7ede539cb17c1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5+:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCE
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/2020-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/620-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frxrlrl.exebhbttn.exevjjdd.exepdvjv.exerlxllfl.exenbtnhb.exepdjvj.exeffflfxf.exevjpdv.exevpjdd.exehhbtbb.exepjdpd.exedvjvv.exeflrrlff.exehbttth.exeppdjv.exevdvdv.exexrlfxxf.exebnhthn.exe7hnbnn.exejjjvj.exelfrfrlf.exefxfxxrr.exenbtnbt.exedpjdv.exepjvjd.exexlxlxrf.exe3tbthh.exedvvjd.exe3jvpv.exerlxxlfx.exehbttnn.exevddvd.exejjvdp.exevvpjp.exerffxlfr.exetttnnn.exetthbtt.exe3jvpj.exe1vjdv.exellrrrrr.exehbnhbt.exejddvv.exejddvp.exefflfxxx.exerrrrllf.exeppvpp.exefrllxff.exerxlllrl.exenbhhhn.exevdjvd.exevjpvd.exe1frlfff.exeflllllf.exe3bbbtb.exehnhthb.exeddjvj.exe9vdpv.exe9llfxfx.exexrxxxxr.exebtnnbb.exenhbtbb.exedjvdd.exejdvjj.exepid process 2340 frxrlrl.exe 2608 bhbttn.exe 3432 vjjdd.exe 2444 pdvjv.exe 1980 rlxllfl.exe 408 nbtnhb.exe 5060 pdjvj.exe 4300 ffflfxf.exe 3236 vjpdv.exe 4664 vpjdd.exe 2856 hhbtbb.exe 3920 pjdpd.exe 1632 dvjvv.exe 4900 flrrlff.exe 1936 hbttth.exe 4780 ppdjv.exe 4764 vdvdv.exe 3664 xrlfxxf.exe 4320 bnhthn.exe 1384 7hnbnn.exe 4476 jjjvj.exe 1292 lfrfrlf.exe 620 fxfxxrr.exe 3180 nbtnbt.exe 4720 dpjdv.exe 4760 pjvjd.exe 4076 xlxlxrf.exe 4888 3tbthh.exe 2084 dvvjd.exe 3380 3jvpv.exe 3252 rlxxlfx.exe 3852 hbttnn.exe 3500 vddvd.exe 2464 jjvdp.exe 3888 vvpjp.exe 1352 rffxlfr.exe 4264 tttnnn.exe 5076 tthbtt.exe 4460 3jvpj.exe 2516 1vjdv.exe 2380 llrrrrr.exe 1468 hbnhbt.exe 952 jddvv.exe 1576 jddvp.exe 1900 fflfxxx.exe 4536 rrrrllf.exe 2252 ppvpp.exe 2420 frllxff.exe 1596 rxlllrl.exe 4828 nbhhhn.exe 1480 vdjvd.exe 3920 vjpvd.exe 3268 1frlfff.exe 4792 flllllf.exe 792 3bbbtb.exe 1212 hnhthb.exe 2492 ddjvj.exe 2520 9vdpv.exe 1204 9llfxfx.exe 4444 xrxxxxr.exe 1716 btnnbb.exe 3208 nhbtbb.exe 4832 djvdd.exe 3992 jdvjj.exe -
Processes:
resource yara_rule behavioral2/memory/2020-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2608-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/620-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3180-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5e0aa7a8f8fab8977e653ae7651a3ab0_NeikiAnalytics.exefrxrlrl.exebhbttn.exevjjdd.exepdvjv.exerlxllfl.exenbtnhb.exepdjvj.exeffflfxf.exevjpdv.exevpjdd.exehhbtbb.exepjdpd.exedvjvv.exeflrrlff.exehbttth.exeppdjv.exevdvdv.exexrlfxxf.exebnhthn.exe7hnbnn.exejjjvj.exedescription pid process target process PID 2020 wrote to memory of 2340 2020 5e0aa7a8f8fab8977e653ae7651a3ab0_NeikiAnalytics.exe frxrlrl.exe PID 2020 wrote to memory of 2340 2020 5e0aa7a8f8fab8977e653ae7651a3ab0_NeikiAnalytics.exe frxrlrl.exe PID 2020 wrote to memory of 2340 2020 5e0aa7a8f8fab8977e653ae7651a3ab0_NeikiAnalytics.exe frxrlrl.exe PID 2340 wrote to memory of 2608 2340 frxrlrl.exe bhbttn.exe PID 2340 wrote to memory of 2608 2340 frxrlrl.exe bhbttn.exe PID 2340 wrote to memory of 2608 2340 frxrlrl.exe bhbttn.exe PID 2608 wrote to memory of 3432 2608 bhbttn.exe vjjdd.exe PID 2608 wrote to memory of 3432 2608 bhbttn.exe vjjdd.exe PID 2608 wrote to memory of 3432 2608 bhbttn.exe vjjdd.exe PID 3432 wrote to memory of 2444 3432 vjjdd.exe pdvjv.exe PID 3432 wrote to memory of 2444 3432 vjjdd.exe pdvjv.exe PID 3432 wrote to memory of 2444 3432 vjjdd.exe pdvjv.exe PID 2444 wrote to memory of 1980 2444 pdvjv.exe rlxllfl.exe PID 2444 wrote to memory of 1980 2444 pdvjv.exe rlxllfl.exe PID 2444 wrote to memory of 1980 2444 pdvjv.exe rlxllfl.exe PID 1980 wrote to memory of 408 1980 rlxllfl.exe nbtnhb.exe PID 1980 wrote to memory of 408 1980 rlxllfl.exe nbtnhb.exe PID 1980 wrote to memory of 408 1980 rlxllfl.exe nbtnhb.exe PID 408 wrote to memory of 5060 408 nbtnhb.exe pdjvj.exe PID 408 wrote to memory of 5060 408 nbtnhb.exe pdjvj.exe PID 408 wrote to memory of 5060 408 nbtnhb.exe pdjvj.exe PID 5060 wrote to memory of 4300 5060 pdjvj.exe ffflfxf.exe PID 5060 wrote to memory of 4300 5060 pdjvj.exe ffflfxf.exe PID 5060 wrote to memory of 4300 5060 pdjvj.exe ffflfxf.exe PID 4300 wrote to memory of 3236 4300 ffflfxf.exe vjpdv.exe PID 4300 wrote to memory of 3236 4300 ffflfxf.exe vjpdv.exe PID 4300 wrote to memory of 3236 4300 ffflfxf.exe vjpdv.exe PID 3236 wrote to memory of 4664 3236 vjpdv.exe vpjdd.exe PID 3236 wrote to memory of 4664 3236 vjpdv.exe vpjdd.exe PID 3236 wrote to memory of 4664 3236 vjpdv.exe vpjdd.exe PID 4664 wrote to memory of 2856 4664 vpjdd.exe hhbtbb.exe PID 4664 wrote to memory of 2856 4664 vpjdd.exe hhbtbb.exe PID 4664 wrote to memory of 2856 4664 vpjdd.exe hhbtbb.exe PID 2856 wrote to memory of 3920 2856 hhbtbb.exe pjdpd.exe PID 2856 wrote to memory of 3920 2856 hhbtbb.exe pjdpd.exe PID 2856 wrote to memory of 3920 2856 hhbtbb.exe pjdpd.exe PID 3920 wrote to memory of 1632 3920 pjdpd.exe dvjvv.exe PID 3920 wrote to memory of 1632 3920 pjdpd.exe dvjvv.exe PID 3920 wrote to memory of 1632 3920 pjdpd.exe dvjvv.exe PID 1632 wrote to memory of 4900 1632 dvjvv.exe flrrlff.exe PID 1632 wrote to memory of 4900 1632 dvjvv.exe flrrlff.exe PID 1632 wrote to memory of 4900 1632 dvjvv.exe flrrlff.exe PID 4900 wrote to memory of 1936 4900 flrrlff.exe hbttth.exe PID 4900 wrote to memory of 1936 4900 flrrlff.exe hbttth.exe PID 4900 wrote to memory of 1936 4900 flrrlff.exe hbttth.exe PID 1936 wrote to memory of 4780 1936 hbttth.exe ppdjv.exe PID 1936 wrote to memory of 4780 1936 hbttth.exe ppdjv.exe PID 1936 wrote to memory of 4780 1936 hbttth.exe ppdjv.exe PID 4780 wrote to memory of 4764 4780 ppdjv.exe vdvdv.exe PID 4780 wrote to memory of 4764 4780 ppdjv.exe vdvdv.exe PID 4780 wrote to memory of 4764 4780 ppdjv.exe vdvdv.exe PID 4764 wrote to memory of 3664 4764 vdvdv.exe xrlfxxf.exe PID 4764 wrote to memory of 3664 4764 vdvdv.exe xrlfxxf.exe PID 4764 wrote to memory of 3664 4764 vdvdv.exe xrlfxxf.exe PID 3664 wrote to memory of 4320 3664 xrlfxxf.exe bnhthn.exe PID 3664 wrote to memory of 4320 3664 xrlfxxf.exe bnhthn.exe PID 3664 wrote to memory of 4320 3664 xrlfxxf.exe bnhthn.exe PID 4320 wrote to memory of 1384 4320 bnhthn.exe 7hnbnn.exe PID 4320 wrote to memory of 1384 4320 bnhthn.exe 7hnbnn.exe PID 4320 wrote to memory of 1384 4320 bnhthn.exe 7hnbnn.exe PID 1384 wrote to memory of 4476 1384 7hnbnn.exe jjjvj.exe PID 1384 wrote to memory of 4476 1384 7hnbnn.exe jjjvj.exe PID 1384 wrote to memory of 4476 1384 7hnbnn.exe jjjvj.exe PID 4476 wrote to memory of 1292 4476 jjjvj.exe lfrfrlf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e0aa7a8f8fab8977e653ae7651a3ab0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5e0aa7a8f8fab8977e653ae7651a3ab0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\frxrlrl.exec:\frxrlrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\bhbttn.exec:\bhbttn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\vjjdd.exec:\vjjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\pdvjv.exec:\pdvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\rlxllfl.exec:\rlxllfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\nbtnhb.exec:\nbtnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\pdjvj.exec:\pdjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\ffflfxf.exec:\ffflfxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\vjpdv.exec:\vjpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\vpjdd.exec:\vpjdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\hhbtbb.exec:\hhbtbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\pjdpd.exec:\pjdpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\dvjvv.exec:\dvjvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\flrrlff.exec:\flrrlff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\hbttth.exec:\hbttth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\ppdjv.exec:\ppdjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\vdvdv.exec:\vdvdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\xrlfxxf.exec:\xrlfxxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\bnhthn.exec:\bnhthn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\7hnbnn.exec:\7hnbnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\jjjvj.exec:\jjjvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\lfrfrlf.exec:\lfrfrlf.exe23⤵
- Executes dropped EXE
PID:1292 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe24⤵
- Executes dropped EXE
PID:620 -
\??\c:\nbtnbt.exec:\nbtnbt.exe25⤵
- Executes dropped EXE
PID:3180 -
\??\c:\dpjdv.exec:\dpjdv.exe26⤵
- Executes dropped EXE
PID:4720 -
\??\c:\pjvjd.exec:\pjvjd.exe27⤵
- Executes dropped EXE
PID:4760 -
\??\c:\xlxlxrf.exec:\xlxlxrf.exe28⤵
- Executes dropped EXE
PID:4076 -
\??\c:\3tbthh.exec:\3tbthh.exe29⤵
- Executes dropped EXE
PID:4888 -
\??\c:\dvvjd.exec:\dvvjd.exe30⤵
- Executes dropped EXE
PID:2084 -
\??\c:\3jvpv.exec:\3jvpv.exe31⤵
- Executes dropped EXE
PID:3380 -
\??\c:\rlxxlfx.exec:\rlxxlfx.exe32⤵
- Executes dropped EXE
PID:3252 -
\??\c:\hbttnn.exec:\hbttnn.exe33⤵
- Executes dropped EXE
PID:3852 -
\??\c:\vddvd.exec:\vddvd.exe34⤵
- Executes dropped EXE
PID:3500 -
\??\c:\jjvdp.exec:\jjvdp.exe35⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vvpjp.exec:\vvpjp.exe36⤵
- Executes dropped EXE
PID:3888 -
\??\c:\rffxlfr.exec:\rffxlfr.exe37⤵
- Executes dropped EXE
PID:1352 -
\??\c:\tttnnn.exec:\tttnnn.exe38⤵
- Executes dropped EXE
PID:4264 -
\??\c:\tthbtt.exec:\tthbtt.exe39⤵
- Executes dropped EXE
PID:5076 -
\??\c:\3jvpj.exec:\3jvpj.exe40⤵
- Executes dropped EXE
PID:4460 -
\??\c:\1vjdv.exec:\1vjdv.exe41⤵
- Executes dropped EXE
PID:2516 -
\??\c:\llrrrrr.exec:\llrrrrr.exe42⤵
- Executes dropped EXE
PID:2380 -
\??\c:\hbnhbt.exec:\hbnhbt.exe43⤵
- Executes dropped EXE
PID:1468 -
\??\c:\jddvv.exec:\jddvv.exe44⤵
- Executes dropped EXE
PID:952 -
\??\c:\jddvp.exec:\jddvp.exe45⤵
- Executes dropped EXE
PID:1576 -
\??\c:\fflfxxx.exec:\fflfxxx.exe46⤵
- Executes dropped EXE
PID:1900 -
\??\c:\rrrrllf.exec:\rrrrllf.exe47⤵
- Executes dropped EXE
PID:4536 -
\??\c:\ppvpp.exec:\ppvpp.exe48⤵
- Executes dropped EXE
PID:2252 -
\??\c:\frllxff.exec:\frllxff.exe49⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rxlllrl.exec:\rxlllrl.exe50⤵
- Executes dropped EXE
PID:1596 -
\??\c:\nbhhhn.exec:\nbhhhn.exe51⤵
- Executes dropped EXE
PID:4828 -
\??\c:\vdjvd.exec:\vdjvd.exe52⤵
- Executes dropped EXE
PID:1480 -
\??\c:\vjpvd.exec:\vjpvd.exe53⤵
- Executes dropped EXE
PID:3920 -
\??\c:\1frlfff.exec:\1frlfff.exe54⤵
- Executes dropped EXE
PID:3268 -
\??\c:\flllllf.exec:\flllllf.exe55⤵
- Executes dropped EXE
PID:4792 -
\??\c:\3bbbtb.exec:\3bbbtb.exe56⤵
- Executes dropped EXE
PID:792 -
\??\c:\hnhthb.exec:\hnhthb.exe57⤵
- Executes dropped EXE
PID:1212 -
\??\c:\ddjvj.exec:\ddjvj.exe58⤵
- Executes dropped EXE
PID:2492 -
\??\c:\9vdpv.exec:\9vdpv.exe59⤵
- Executes dropped EXE
PID:2520 -
\??\c:\9llfxfx.exec:\9llfxfx.exe60⤵
- Executes dropped EXE
PID:1204 -
\??\c:\xrxxxxr.exec:\xrxxxxr.exe61⤵
- Executes dropped EXE
PID:4444 -
\??\c:\btnnbb.exec:\btnnbb.exe62⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nhbtbb.exec:\nhbtbb.exe63⤵
- Executes dropped EXE
PID:3208 -
\??\c:\djvdd.exec:\djvdd.exe64⤵
- Executes dropped EXE
PID:4832 -
\??\c:\jdvjj.exec:\jdvjj.exe65⤵
- Executes dropped EXE
PID:3992 -
\??\c:\jdpvp.exec:\jdpvp.exe66⤵PID:4160
-
\??\c:\7xffflr.exec:\7xffflr.exe67⤵PID:4372
-
\??\c:\xrlflll.exec:\xrlflll.exe68⤵PID:1400
-
\??\c:\thnnnn.exec:\thnnnn.exe69⤵PID:4356
-
\??\c:\bhtnhh.exec:\bhtnhh.exe70⤵PID:3600
-
\??\c:\9pppd.exec:\9pppd.exe71⤵PID:4060
-
\??\c:\vvddd.exec:\vvddd.exe72⤵PID:4076
-
\??\c:\vppjd.exec:\vppjd.exe73⤵PID:3672
-
\??\c:\xfxfxlr.exec:\xfxfxlr.exe74⤵PID:2572
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe75⤵PID:1020
-
\??\c:\tnttth.exec:\tnttth.exe76⤵PID:2996
-
\??\c:\btbbht.exec:\btbbht.exe77⤵PID:3252
-
\??\c:\vpvpd.exec:\vpvpd.exe78⤵PID:3852
-
\??\c:\7jpdd.exec:\7jpdd.exe79⤵PID:1032
-
\??\c:\pvpdv.exec:\pvpdv.exe80⤵PID:3416
-
\??\c:\9rxrfff.exec:\9rxrfff.exe81⤵PID:460
-
\??\c:\bbtttt.exec:\bbtttt.exe82⤵PID:2352
-
\??\c:\7bhbtt.exec:\7bhbtt.exe83⤵PID:2400
-
\??\c:\vjpjv.exec:\vjpjv.exe84⤵PID:5000
-
\??\c:\9jvpj.exec:\9jvpj.exe85⤵PID:2340
-
\??\c:\3llfrrr.exec:\3llfrrr.exe86⤵PID:2516
-
\??\c:\btnbbb.exec:\btnbbb.exe87⤵PID:1752
-
\??\c:\bttnhn.exec:\bttnhn.exe88⤵PID:1468
-
\??\c:\1vjpj.exec:\1vjpj.exe89⤵PID:692
-
\??\c:\3llfxxr.exec:\3llfxxr.exe90⤵PID:4588
-
\??\c:\lrllflf.exec:\lrllflf.exe91⤵PID:3996
-
\??\c:\9htbtn.exec:\9htbtn.exe92⤵PID:5016
-
\??\c:\bntttb.exec:\bntttb.exe93⤵PID:3928
-
\??\c:\bbtntt.exec:\bbtntt.exe94⤵PID:864
-
\??\c:\jvdjv.exec:\jvdjv.exe95⤵PID:3176
-
\??\c:\dvdvv.exec:\dvdvv.exe96⤵PID:2420
-
\??\c:\9rfxrll.exec:\9rfxrll.exe97⤵PID:1596
-
\??\c:\rrxxxfx.exec:\rrxxxfx.exe98⤵PID:3836
-
\??\c:\ntbbbb.exec:\ntbbbb.exe99⤵PID:1480
-
\??\c:\httnnn.exec:\httnnn.exe100⤵PID:5108
-
\??\c:\vvvdp.exec:\vvvdp.exe101⤵PID:3268
-
\??\c:\xlrxlll.exec:\xlrxlll.exe102⤵PID:4792
-
\??\c:\llrlfff.exec:\llrlfff.exe103⤵PID:2500
-
\??\c:\ttbttt.exec:\ttbttt.exe104⤵PID:1964
-
\??\c:\hbbnbt.exec:\hbbnbt.exe105⤵PID:2852
-
\??\c:\pjpvv.exec:\pjpvv.exe106⤵PID:1252
-
\??\c:\vvppj.exec:\vvppj.exe107⤵PID:3276
-
\??\c:\fffxxxx.exec:\fffxxxx.exe108⤵PID:3544
-
\??\c:\rflfxxl.exec:\rflfxxl.exe109⤵PID:2280
-
\??\c:\xxfxxrr.exec:\xxfxxrr.exe110⤵PID:1612
-
\??\c:\bbtntt.exec:\bbtntt.exe111⤵PID:3264
-
\??\c:\hhhhbb.exec:\hhhhbb.exe112⤵PID:988
-
\??\c:\jddvp.exec:\jddvp.exe113⤵PID:3180
-
\??\c:\vvdpj.exec:\vvdpj.exe114⤵PID:2652
-
\??\c:\3jvpp.exec:\3jvpp.exe115⤵PID:4988
-
\??\c:\1rffllr.exec:\1rffllr.exe116⤵PID:3892
-
\??\c:\rflffll.exec:\rflffll.exe117⤵PID:2388
-
\??\c:\bbnnnt.exec:\bbnnnt.exe118⤵PID:4528
-
\??\c:\dvdpd.exec:\dvdpd.exe119⤵PID:4040
-
\??\c:\pdvjd.exec:\pdvjd.exe120⤵PID:3200
-
\??\c:\hbntbb.exec:\hbntbb.exe121⤵PID:3068
-
\??\c:\jdjjj.exec:\jdjjj.exe122⤵PID:512
-
\??\c:\vjpjd.exec:\vjpjd.exe123⤵PID:4520
-
\??\c:\xfffxxx.exec:\xfffxxx.exe124⤵PID:3044
-
\??\c:\lxxlrlf.exec:\lxxlrlf.exe125⤵PID:2668
-
\??\c:\rfxxxfx.exec:\rfxxxfx.exe126⤵PID:1032
-
\??\c:\3ntnhh.exec:\3ntnhh.exe127⤵PID:4264
-
\??\c:\7hbbnn.exec:\7hbbnn.exe128⤵PID:2020
-
\??\c:\7jjjv.exec:\7jjjv.exe129⤵PID:4564
-
\??\c:\jjvpj.exec:\jjvpj.exe130⤵PID:2620
-
\??\c:\fxxrlrr.exec:\fxxrlrr.exe131⤵PID:3680
-
\??\c:\fxrrrxx.exec:\fxrrrxx.exe132⤵PID:4492
-
\??\c:\rxlxlfr.exec:\rxlxlfr.exe133⤵PID:1004
-
\??\c:\3nnnhh.exec:\3nnnhh.exe134⤵PID:952
-
\??\c:\bbbbnn.exec:\bbbbnn.exe135⤵PID:1576
-
\??\c:\7jddj.exec:\7jddj.exe136⤵PID:3996
-
\??\c:\vjjdv.exec:\vjjdv.exe137⤵PID:4560
-
\??\c:\xlrlfff.exec:\xlrlfff.exe138⤵PID:4536
-
\??\c:\xfxxxxr.exec:\xfxxxxr.exe139⤵PID:2732
-
\??\c:\jjvpv.exec:\jjvpv.exe140⤵PID:4984
-
\??\c:\jpvvv.exec:\jpvvv.exe141⤵PID:4700
-
\??\c:\3flfxxr.exec:\3flfxxr.exe142⤵PID:4344
-
\??\c:\rrrfllx.exec:\rrrfllx.exe143⤵PID:2524
-
\??\c:\7bbbtb.exec:\7bbbtb.exe144⤵PID:4960
-
\??\c:\hnbtnn.exec:\hnbtnn.exe145⤵PID:5108
-
\??\c:\jpvpp.exec:\jpvpp.exe146⤵PID:4712
-
\??\c:\ppdvp.exec:\ppdvp.exe147⤵PID:2492
-
\??\c:\jdvpj.exec:\jdvpj.exe148⤵PID:4324
-
\??\c:\flfffll.exec:\flfffll.exe149⤵PID:5116
-
\??\c:\lfllflf.exec:\lfllflf.exe150⤵PID:1332
-
\??\c:\bbttbh.exec:\bbttbh.exe151⤵PID:4992
-
\??\c:\hhtnnn.exec:\hhtnnn.exe152⤵PID:2280
-
\??\c:\vvvvj.exec:\vvvvj.exe153⤵PID:1512
-
\??\c:\vjjjj.exec:\vjjjj.exe154⤵PID:1796
-
\??\c:\jdjpp.exec:\jdjpp.exe155⤵PID:1568
-
\??\c:\xrrlfff.exec:\xrrlfff.exe156⤵PID:4760
-
\??\c:\btbnnn.exec:\btbnnn.exe157⤵PID:5104
-
\??\c:\3hhbnn.exec:\3hhbnn.exe158⤵PID:2084
-
\??\c:\bnnnhh.exec:\bnnnhh.exe159⤵PID:4016
-
\??\c:\7ppvp.exec:\7ppvp.exe160⤵PID:3060
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe161⤵PID:4168
-
\??\c:\fxfxfff.exec:\fxfxfff.exe162⤵PID:4844
-
\??\c:\btthbn.exec:\btthbn.exe163⤵PID:1508
-
\??\c:\vddpj.exec:\vddpj.exe164⤵PID:3280
-
\??\c:\pjdvp.exec:\pjdvp.exe165⤵PID:1932
-
\??\c:\llrrxxf.exec:\llrrxxf.exe166⤵PID:2472
-
\??\c:\lfxxffr.exec:\lfxxffr.exe167⤵PID:4228
-
\??\c:\btbttn.exec:\btbttn.exe168⤵PID:2020
-
\??\c:\tntnbb.exec:\tntnbb.exe169⤵PID:4564
-
\??\c:\pjppp.exec:\pjppp.exe170⤵PID:2564
-
\??\c:\pdpjd.exec:\pdpjd.exe171⤵PID:1756
-
\??\c:\rlffffl.exec:\rlffffl.exe172⤵PID:4824
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe173⤵PID:1004
-
\??\c:\nhhhhh.exec:\nhhhhh.exe174⤵PID:1404
-
\??\c:\hbtttt.exec:\hbtttt.exe175⤵PID:1576
-
\??\c:\vpjdp.exec:\vpjdp.exe176⤵PID:392
-
\??\c:\rllrlll.exec:\rllrlll.exe177⤵PID:2252
-
\??\c:\frrrrxx.exec:\frrrrxx.exe178⤵PID:3476
-
\??\c:\nhnntt.exec:\nhnntt.exe179⤵PID:4448
-
\??\c:\hhttbb.exec:\hhttbb.exe180⤵PID:3312
-
\??\c:\ppppp.exec:\ppppp.exe181⤵PID:3056
-
\??\c:\1vjdp.exec:\1vjdp.exe182⤵PID:1624
-
\??\c:\frxxrrl.exec:\frxxrrl.exe183⤵PID:1632
-
\??\c:\ffffffx.exec:\ffffffx.exe184⤵PID:3204
-
\??\c:\9ntttt.exec:\9ntttt.exe185⤵PID:3556
-
\??\c:\hntnnn.exec:\hntnnn.exe186⤵PID:4712
-
\??\c:\1vppd.exec:\1vppd.exe187⤵PID:4980
-
\??\c:\vdvvp.exec:\vdvvp.exe188⤵PID:4324
-
\??\c:\9llrfrr.exec:\9llrfrr.exe189⤵PID:3208
-
\??\c:\1xllrrf.exec:\1xllrrf.exe190⤵PID:1056
-
\??\c:\1dddj.exec:\1dddj.exe191⤵PID:620
-
\??\c:\xfxrrll.exec:\xfxrrll.exe192⤵PID:4848
-
\??\c:\xxrxrff.exec:\xxrxrff.exe193⤵PID:4008
-
\??\c:\thnhbb.exec:\thnhbb.exe194⤵PID:4768
-
\??\c:\dvjjp.exec:\dvjjp.exe195⤵PID:4812
-
\??\c:\dvpjp.exec:\dvpjp.exe196⤵PID:3988
-
\??\c:\xrxxlll.exec:\xrxxlll.exe197⤵PID:2572
-
\??\c:\ffffxff.exec:\ffffxff.exe198⤵PID:3736
-
\??\c:\bbnnnn.exec:\bbnnnn.exe199⤵PID:60
-
\??\c:\3bhbbh.exec:\3bhbbh.exe200⤵PID:3500
-
\??\c:\ppvpp.exec:\ppvpp.exe201⤵PID:232
-
\??\c:\jjpjj.exec:\jjpjj.exe202⤵PID:3044
-
\??\c:\lfffffx.exec:\lfffffx.exe203⤵PID:4284
-
\??\c:\5lxxxfx.exec:\5lxxxfx.exe204⤵PID:1140
-
\??\c:\nnntbt.exec:\nnntbt.exe205⤵PID:3188
-
\??\c:\tthbhh.exec:\tthbhh.exe206⤵PID:4264
-
\??\c:\pvjdv.exec:\pvjdv.exe207⤵PID:1300
-
\??\c:\ppjjj.exec:\ppjjj.exe208⤵PID:2020
-
\??\c:\xrrrfff.exec:\xrrrfff.exe209⤵PID:2620
-
\??\c:\xxxxflr.exec:\xxxxflr.exe210⤵PID:1680
-
\??\c:\nbhhhh.exec:\nbhhhh.exe211⤵PID:3116
-
\??\c:\nhhtnn.exec:\nhhtnn.exe212⤵PID:1348
-
\??\c:\3vvvp.exec:\3vvvp.exe213⤵PID:408
-
\??\c:\vdjdv.exec:\vdjdv.exe214⤵PID:1708
-
\??\c:\ddddd.exec:\ddddd.exe215⤵PID:4660
-
\??\c:\xrffxff.exec:\xrffxff.exe216⤵PID:4664
-
\??\c:\fxxxrrx.exec:\fxxxrrx.exe217⤵PID:4448
-
\??\c:\bttnnn.exec:\bttnnn.exe218⤵PID:3312
-
\??\c:\9ntnnn.exec:\9ntnnn.exe219⤵PID:3056
-
\??\c:\1nnnhn.exec:\1nnnhn.exe220⤵PID:1624
-
\??\c:\djvpp.exec:\djvpp.exe221⤵PID:1952
-
\??\c:\jvjjd.exec:\jvjjd.exe222⤵PID:2532
-
\??\c:\5rfxrrl.exec:\5rfxrrl.exe223⤵PID:4764
-
\??\c:\nthbhn.exec:\nthbhn.exe224⤵PID:2852
-
\??\c:\tbnhhh.exec:\tbnhhh.exe225⤵PID:3372
-
\??\c:\9jjjd.exec:\9jjjd.exe226⤵PID:1696
-
\??\c:\pjdvd.exec:\pjdvd.exe227⤵PID:4372
-
\??\c:\rlrlffx.exec:\rlrlffx.exe228⤵PID:3644
-
\??\c:\3ffxffx.exec:\3ffxffx.exe229⤵PID:1960
-
\??\c:\3xxxxrr.exec:\3xxxxrr.exe230⤵PID:3088
-
\??\c:\nbbbtt.exec:\nbbbtt.exe231⤵PID:1568
-
\??\c:\nnhbtb.exec:\nnhbtb.exe232⤵PID:3316
-
\??\c:\vvddd.exec:\vvddd.exe233⤵PID:3844
-
\??\c:\pjpjj.exec:\pjpjj.exe234⤵PID:1020
-
\??\c:\xllffff.exec:\xllffff.exe235⤵PID:3712
-
\??\c:\lfllfff.exec:\lfllfff.exe236⤵PID:2024
-
\??\c:\5bbbbt.exec:\5bbbbt.exe237⤵PID:4520
-
\??\c:\nhbbhh.exec:\nhbbhh.exe238⤵PID:4844
-
\??\c:\3jvvv.exec:\3jvvv.exe239⤵PID:3044
-
\??\c:\vdvvp.exec:\vdvvp.exe240⤵PID:2668
-
\??\c:\5rrlflf.exec:\5rrlflf.exe241⤵PID:2472
-
\??\c:\7lxxffl.exec:\7lxxffl.exe242⤵PID:1432