Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2024 22:38
Behavioral task
behavioral1
Sample
809624faf15f44e1dd36c92f119c9f40_NEIKI.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
809624faf15f44e1dd36c92f119c9f40_NEIKI.exe
-
Size
52KB
-
MD5
809624faf15f44e1dd36c92f119c9f40
-
SHA1
144cef5fc819fcbf3e8a967b720d4b30d2d5f90a
-
SHA256
c116710e1d8bcfd21f6bb0f57d3de32638d6824fb3acf3546b7526388d3781e8
-
SHA512
f26d4202d487ac22ec8de0e46f8b27b3e37182f5e9f4f6528fad9d065ec8f3db1985986f470ee261b79362b72813d05ac214fe4a90ffcfa65f9e74625b307d44
-
SSDEEP
1536:RvQBeOGtrYS3srx93UBWfwC6Ggnouy8Cp:RhOmTsF93UYfwC6GIoutc
Malware Config
Signatures
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1704-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1364-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4100-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4164-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/544-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1364-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1856-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2380-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-680-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-758-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-777-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-773-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3200-759-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-666-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-659-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-635-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4228-593-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2964-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2624-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2056-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2588-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/384-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1760-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2784-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2640-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4636-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2516-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2268-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1648-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2976-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1592 xlrffxf.exe 4612 hthttn.exe 3720 dpjvp.exe 5104 7ppjj.exe 5100 xxfrffr.exe 1648 xllfxfx.exe 2268 3tbnbt.exe 5008 5dpdj.exe 4272 jvpjd.exe 4080 5rrrfxr.exe 4560 lflxfxx.exe 2008 rxxrfxr.exe 1704 bhhhnb.exe 848 1ntnhb.exe 2796 9vppd.exe 1160 lxfrxrl.exe 3784 5rlrfxr.exe 2516 5tnhbt.exe 4636 tnnhbt.exe 2192 vjpjj.exe 4164 vppvd.exe 3252 xfxflfx.exe 4072 thbthh.exe 4860 hbtnbt.exe 2640 pddvp.exe 3580 djvjj.exe 2876 flfrlfr.exe 2748 nbtthn.exe 4500 thnhbt.exe 4280 vjjvp.exe 3148 xlrffxr.exe 2360 rlfxrfx.exe 872 thhthb.exe 1364 7nnbnn.exe 2604 dppdj.exe 928 jvpdp.exe 2420 3xrfrrl.exe 2144 tbntnt.exe 3876 nnttbb.exe 2784 pjddp.exe 5104 vvjpd.exe 4424 pdddp.exe 1760 xxxlxxl.exe 2060 llllxxl.exe 4848 tbhbth.exe 4100 nbnhhb.exe 1216 dpjvj.exe 4824 vddpd.exe 3752 xlfflff.exe 384 lrfxrlf.exe 4960 fffrfxl.exe 3260 nbhbbb.exe 1704 pvdpd.exe 2476 dvvpd.exe 3684 pjdvp.exe 2588 frrrlfx.exe 3804 rrrxrfx.exe 2016 nhhbnn.exe 232 bnnnhb.exe 116 vppjd.exe 852 pdjvv.exe 2960 3rrllxx.exe 4164 xlllllf.exe 4928 tbtthn.exe -
resource yara_rule behavioral2/files/0x000700000002340c-13.dat upx behavioral2/files/0x000700000002340e-25.dat upx behavioral2/memory/2268-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-58.dat upx behavioral2/files/0x0007000000023416-69.dat upx behavioral2/memory/1704-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341c-106.dat upx behavioral2/files/0x000700000002341e-119.dat upx behavioral2/files/0x000700000002341f-124.dat upx behavioral2/memory/4072-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-147.dat upx behavioral2/files/0x0007000000023424-153.dat upx behavioral2/files/0x0007000000023425-158.dat upx behavioral2/files/0x0007000000023427-168.dat upx behavioral2/files/0x0007000000023428-176.dat upx behavioral2/memory/2360-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/872-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1364-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4100-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4100-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4164-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/544-321-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1364-357-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1856-365-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3304-385-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5116-404-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2380-495-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4884-680-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1668-698-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4648-743-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1656-747-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2016-730-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1704-714-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4436-758-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2412-780-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3744-819-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2700-806-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4604-790-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4904-777-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4900-773-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3200-759-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3716-751-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4560-694-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/348-690-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4884-676-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3576-666-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3516-659-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4972-635-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3632-615-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4228-593-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3884-571-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1684-531-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2724-527-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1000-508-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1580-482-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4860-463-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3436-453-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3436-449-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2964-446-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4672-438-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4440-419-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4600-416-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2624-412-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2056-398-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2976 wrote to memory of 1592 2976 809624faf15f44e1dd36c92f119c9f40_NEIKI.exe 83 PID 2976 wrote to memory of 1592 2976 809624faf15f44e1dd36c92f119c9f40_NEIKI.exe 83 PID 2976 wrote to memory of 1592 2976 809624faf15f44e1dd36c92f119c9f40_NEIKI.exe 83 PID 1592 wrote to memory of 4612 1592 xlrffxf.exe 86 PID 1592 wrote to memory of 4612 1592 xlrffxf.exe 86 PID 1592 wrote to memory of 4612 1592 xlrffxf.exe 86 PID 4612 wrote to memory of 3720 4612 hthttn.exe 87 PID 4612 wrote to memory of 3720 4612 hthttn.exe 87 PID 4612 wrote to memory of 3720 4612 hthttn.exe 87 PID 3720 wrote to memory of 5104 3720 dpjvp.exe 88 PID 3720 wrote to memory of 5104 3720 dpjvp.exe 88 PID 3720 wrote to memory of 5104 3720 dpjvp.exe 88 PID 5104 wrote to memory of 5100 5104 7ppjj.exe 89 PID 5104 wrote to memory of 5100 5104 7ppjj.exe 89 PID 5104 wrote to memory of 5100 5104 7ppjj.exe 89 PID 5100 wrote to memory of 1648 5100 xxfrffr.exe 229 PID 5100 wrote to memory of 1648 5100 xxfrffr.exe 229 PID 5100 wrote to memory of 1648 5100 xxfrffr.exe 229 PID 1648 wrote to memory of 2268 1648 xllfxfx.exe 91 PID 1648 wrote to memory of 2268 1648 xllfxfx.exe 91 PID 1648 wrote to memory of 2268 1648 xllfxfx.exe 91 PID 2268 wrote to memory of 5008 2268 3tbnbt.exe 92 PID 2268 wrote to memory of 5008 2268 3tbnbt.exe 92 PID 2268 wrote to memory of 5008 2268 3tbnbt.exe 92 PID 5008 wrote to memory of 4272 5008 5dpdj.exe 93 PID 5008 wrote to memory of 4272 5008 5dpdj.exe 93 PID 5008 wrote to memory of 4272 5008 5dpdj.exe 93 PID 4272 wrote to memory of 4080 4272 jvpjd.exe 94 PID 4272 wrote to memory of 4080 4272 jvpjd.exe 94 PID 4272 wrote to memory of 4080 4272 jvpjd.exe 94 PID 4080 wrote to memory of 4560 4080 5rrrfxr.exe 95 PID 4080 wrote to memory of 4560 4080 5rrrfxr.exe 95 PID 4080 wrote to memory of 4560 4080 5rrrfxr.exe 95 PID 4560 wrote to memory of 2008 4560 lflxfxx.exe 96 PID 4560 wrote to memory of 2008 4560 lflxfxx.exe 96 PID 4560 wrote to memory of 2008 4560 lflxfxx.exe 96 PID 2008 wrote to memory of 1704 2008 rxxrfxr.exe 230 PID 2008 wrote to memory of 1704 2008 rxxrfxr.exe 230 PID 2008 wrote to memory of 1704 2008 rxxrfxr.exe 230 PID 1704 wrote to memory of 848 1704 bhhhnb.exe 98 PID 1704 wrote to memory of 848 1704 bhhhnb.exe 98 PID 1704 wrote to memory of 848 1704 bhhhnb.exe 98 PID 848 wrote to memory of 2796 848 1ntnhb.exe 99 PID 848 wrote to memory of 2796 848 1ntnhb.exe 99 PID 848 wrote to memory of 2796 848 1ntnhb.exe 99 PID 2796 wrote to memory of 1160 2796 9vppd.exe 100 PID 2796 wrote to memory of 1160 2796 9vppd.exe 100 PID 2796 wrote to memory of 1160 2796 9vppd.exe 100 PID 1160 wrote to memory of 3784 1160 lxfrxrl.exe 101 PID 1160 wrote to memory of 3784 1160 lxfrxrl.exe 101 PID 1160 wrote to memory of 3784 1160 lxfrxrl.exe 101 PID 3784 wrote to memory of 2516 3784 5rlrfxr.exe 382 PID 3784 wrote to memory of 2516 3784 5rlrfxr.exe 382 PID 3784 wrote to memory of 2516 3784 5rlrfxr.exe 382 PID 2516 wrote to memory of 4636 2516 5tnhbt.exe 104 PID 2516 wrote to memory of 4636 2516 5tnhbt.exe 104 PID 2516 wrote to memory of 4636 2516 5tnhbt.exe 104 PID 4636 wrote to memory of 2192 4636 tnnhbt.exe 105 PID 4636 wrote to memory of 2192 4636 tnnhbt.exe 105 PID 4636 wrote to memory of 2192 4636 tnnhbt.exe 105 PID 2192 wrote to memory of 4164 2192 vjpjj.exe 106 PID 2192 wrote to memory of 4164 2192 vjpjj.exe 106 PID 2192 wrote to memory of 4164 2192 vjpjj.exe 106 PID 4164 wrote to memory of 3252 4164 vppvd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\809624faf15f44e1dd36c92f119c9f40_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\809624faf15f44e1dd36c92f119c9f40_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\xlrffxf.exec:\xlrffxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\hthttn.exec:\hthttn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\dpjvp.exec:\dpjvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\7ppjj.exec:\7ppjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\xxfrffr.exec:\xxfrffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\xllfxfx.exec:\xllfxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\3tbnbt.exec:\3tbnbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\5dpdj.exec:\5dpdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\jvpjd.exec:\jvpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\5rrrfxr.exec:\5rrrfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\lflxfxx.exec:\lflxfxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\rxxrfxr.exec:\rxxrfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\bhhhnb.exec:\bhhhnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\1ntnhb.exec:\1ntnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\9vppd.exec:\9vppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\lxfrxrl.exec:\lxfrxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\5rlrfxr.exec:\5rlrfxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\5tnhbt.exec:\5tnhbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\tnnhbt.exec:\tnnhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\vjpjj.exec:\vjpjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\vppvd.exec:\vppvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\xfxflfx.exec:\xfxflfx.exe23⤵
- Executes dropped EXE
PID:3252 -
\??\c:\thbthh.exec:\thbthh.exe24⤵
- Executes dropped EXE
PID:4072 -
\??\c:\hbtnbt.exec:\hbtnbt.exe25⤵
- Executes dropped EXE
PID:4860 -
\??\c:\pddvp.exec:\pddvp.exe26⤵
- Executes dropped EXE
PID:2640 -
\??\c:\djvjj.exec:\djvjj.exe27⤵
- Executes dropped EXE
PID:3580 -
\??\c:\flfrlfr.exec:\flfrlfr.exe28⤵
- Executes dropped EXE
PID:2876 -
\??\c:\nbtthn.exec:\nbtthn.exe29⤵
- Executes dropped EXE
PID:2748 -
\??\c:\thnhbt.exec:\thnhbt.exe30⤵
- Executes dropped EXE
PID:4500 -
\??\c:\vjjvp.exec:\vjjvp.exe31⤵
- Executes dropped EXE
PID:4280 -
\??\c:\xlrffxr.exec:\xlrffxr.exe32⤵
- Executes dropped EXE
PID:3148 -
\??\c:\rlfxrfx.exec:\rlfxrfx.exe33⤵
- Executes dropped EXE
PID:2360 -
\??\c:\thhthb.exec:\thhthb.exe34⤵
- Executes dropped EXE
PID:872 -
\??\c:\7nnbnn.exec:\7nnbnn.exe35⤵
- Executes dropped EXE
PID:1364 -
\??\c:\dppdj.exec:\dppdj.exe36⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jvpdp.exec:\jvpdp.exe37⤵
- Executes dropped EXE
PID:928 -
\??\c:\3xrfrrl.exec:\3xrfrrl.exe38⤵
- Executes dropped EXE
PID:2420 -
\??\c:\tbntnt.exec:\tbntnt.exe39⤵
- Executes dropped EXE
PID:2144 -
\??\c:\nnttbb.exec:\nnttbb.exe40⤵
- Executes dropped EXE
PID:3876 -
\??\c:\pjddp.exec:\pjddp.exe41⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vvjpd.exec:\vvjpd.exe42⤵
- Executes dropped EXE
PID:5104 -
\??\c:\pdddp.exec:\pdddp.exe43⤵
- Executes dropped EXE
PID:4424 -
\??\c:\xxxlxxl.exec:\xxxlxxl.exe44⤵
- Executes dropped EXE
PID:1760 -
\??\c:\llllxxl.exec:\llllxxl.exe45⤵
- Executes dropped EXE
PID:2060 -
\??\c:\tbhbth.exec:\tbhbth.exe46⤵
- Executes dropped EXE
PID:4848 -
\??\c:\nbnhhb.exec:\nbnhhb.exe47⤵
- Executes dropped EXE
PID:4100 -
\??\c:\dpjvj.exec:\dpjvj.exe48⤵
- Executes dropped EXE
PID:1216 -
\??\c:\vddpd.exec:\vddpd.exe49⤵
- Executes dropped EXE
PID:4824 -
\??\c:\xlfflff.exec:\xlfflff.exe50⤵
- Executes dropped EXE
PID:3752 -
\??\c:\lrfxrlf.exec:\lrfxrlf.exe51⤵
- Executes dropped EXE
PID:384 -
\??\c:\fffrfxl.exec:\fffrfxl.exe52⤵
- Executes dropped EXE
PID:4960 -
\??\c:\nbhbbb.exec:\nbhbbb.exe53⤵
- Executes dropped EXE
PID:3260 -
\??\c:\pvdpd.exec:\pvdpd.exe54⤵
- Executes dropped EXE
PID:1704 -
\??\c:\dvvpd.exec:\dvvpd.exe55⤵
- Executes dropped EXE
PID:2476 -
\??\c:\pjdvp.exec:\pjdvp.exe56⤵
- Executes dropped EXE
PID:3684 -
\??\c:\frrrlfx.exec:\frrrlfx.exe57⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rrrxrfx.exec:\rrrxrfx.exe58⤵
- Executes dropped EXE
PID:3804 -
\??\c:\nhhbnn.exec:\nhhbnn.exe59⤵
- Executes dropped EXE
PID:2016 -
\??\c:\bnnnhb.exec:\bnnnhb.exe60⤵
- Executes dropped EXE
PID:232 -
\??\c:\vppjd.exec:\vppjd.exe61⤵
- Executes dropped EXE
PID:116 -
\??\c:\pdjvv.exec:\pdjvv.exe62⤵
- Executes dropped EXE
PID:852 -
\??\c:\3rrllxx.exec:\3rrllxx.exe63⤵
- Executes dropped EXE
PID:2960 -
\??\c:\xlllllf.exec:\xlllllf.exe64⤵
- Executes dropped EXE
PID:4164 -
\??\c:\tbtthn.exec:\tbtthn.exe65⤵
- Executes dropped EXE
PID:4928 -
\??\c:\thnnhn.exec:\thnnhn.exe66⤵PID:4400
-
\??\c:\dpjdv.exec:\dpjdv.exe67⤵PID:3120
-
\??\c:\ppdvd.exec:\ppdvd.exe68⤵PID:1188
-
\??\c:\5jjvj.exec:\5jjvj.exe69⤵PID:2908
-
\??\c:\9xxrllf.exec:\9xxrllf.exe70⤵PID:3540
-
\??\c:\1lfxrrl.exec:\1lfxrrl.exe71⤵PID:544
-
\??\c:\1tttnn.exec:\1tttnn.exe72⤵PID:1044
-
\??\c:\bnhhtt.exec:\bnhhtt.exe73⤵PID:5056
-
\??\c:\pdjjv.exec:\pdjjv.exe74⤵PID:752
-
\??\c:\3pdvd.exec:\3pdvd.exe75⤵PID:4500
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe76⤵PID:3604
-
\??\c:\lffxxrl.exec:\lffxxrl.exe77⤵PID:1096
-
\??\c:\1hnnbt.exec:\1hnnbt.exe78⤵PID:3572
-
\??\c:\nhbnbt.exec:\nhbnbt.exe79⤵PID:4412
-
\??\c:\jpjvv.exec:\jpjvv.exe80⤵PID:2348
-
\??\c:\pdpjj.exec:\pdpjj.exe81⤵PID:1364
-
\??\c:\vddvd.exec:\vddvd.exe82⤵PID:2604
-
\??\c:\frrlxrf.exec:\frrlxrf.exe83⤵PID:2860
-
\??\c:\bhbnbt.exec:\bhbnbt.exe84⤵PID:1856
-
\??\c:\nhnhbt.exec:\nhnhbt.exe85⤵PID:3440
-
\??\c:\ddvvp.exec:\ddvvp.exe86⤵PID:2688
-
\??\c:\dvvpj.exec:\dvvpj.exe87⤵PID:5104
-
\??\c:\ppjpd.exec:\ppjpd.exe88⤵PID:4424
-
\??\c:\3fxfrlf.exec:\3fxfrlf.exe89⤵PID:3020
-
\??\c:\lxfxfll.exec:\lxfxfll.exe90⤵PID:3304
-
\??\c:\tbbbbt.exec:\tbbbbt.exe91⤵PID:4848
-
\??\c:\nhbhbb.exec:\nhbhbb.exe92⤵PID:3264
-
\??\c:\vjjvj.exec:\vjjvj.exe93⤵PID:2056
-
\??\c:\7ddpv.exec:\7ddpv.exe94⤵PID:244
-
\??\c:\flfxfxr.exec:\flfxfxr.exe95⤵PID:5116
-
\??\c:\rffxfxf.exec:\rffxfxf.exe96⤵PID:2260
-
\??\c:\7bbbnn.exec:\7bbbnn.exe97⤵PID:2624
-
\??\c:\thnhtn.exec:\thnhtn.exe98⤵PID:4600
-
\??\c:\httnnh.exec:\httnnh.exe99⤵PID:4440
-
\??\c:\vdjvp.exec:\vdjvp.exe100⤵PID:4376
-
\??\c:\djdjp.exec:\djdjp.exe101⤵PID:4148
-
\??\c:\lrxxxfr.exec:\lrxxxfr.exe102⤵PID:3204
-
\??\c:\5xrrllf.exec:\5xrrllf.exe103⤵PID:4564
-
\??\c:\xlllfxx.exec:\xlllfxx.exe104⤵PID:4776
-
\??\c:\bhbbbt.exec:\bhbbbt.exe105⤵PID:4672
-
\??\c:\ntbbnn.exec:\ntbbnn.exe106⤵PID:3972
-
\??\c:\jvvvp.exec:\jvvvp.exe107⤵PID:2964
-
\??\c:\1vpdv.exec:\1vpdv.exe108⤵PID:3436
-
\??\c:\xffxxrl.exec:\xffxxrl.exe109⤵PID:4648
-
\??\c:\lxxfxrl.exec:\lxxfxrl.exe110⤵PID:2088
-
\??\c:\3xxxrrf.exec:\3xxxrrf.exe111⤵PID:4916
-
\??\c:\tbbnhb.exec:\tbbnhb.exe112⤵PID:4860
-
\??\c:\thhtnh.exec:\thhtnh.exe113⤵PID:2396
-
\??\c:\hhhnnn.exec:\hhhnnn.exe114⤵PID:3532
-
\??\c:\pjddv.exec:\pjddv.exe115⤵PID:3396
-
\??\c:\vdvpd.exec:\vdvpd.exe116⤵PID:4660
-
\??\c:\xxlfrrl.exec:\xxlfrrl.exe117⤵PID:4992
-
\??\c:\xlxrfxr.exec:\xlxrfxr.exe118⤵PID:1580
-
\??\c:\ffxxllx.exec:\ffxxllx.exe119⤵PID:3640
-
\??\c:\btnbtn.exec:\btnbtn.exe120⤵PID:5088
-
\??\c:\nnnbnh.exec:\nnnbnh.exe121⤵PID:2380
-
\??\c:\pdvdp.exec:\pdvdp.exe122⤵PID:3156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-