Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2024 22:59
Behavioral task
behavioral1
Sample
8b0a1db9fd3c33f10eb4b43412f1bff0_NEIKI.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
8b0a1db9fd3c33f10eb4b43412f1bff0_NEIKI.exe
-
Size
82KB
-
MD5
8b0a1db9fd3c33f10eb4b43412f1bff0
-
SHA1
289bc2ba444dbecf7538925503cebd0a86524ddc
-
SHA256
c12fa0fa2ed9c343136cd53306f3139278663cf7b622bdaa8bae31095ed7dd9e
-
SHA512
fc525cadbb9ac99734dbc68996c9dc83a504b2d16c302c068c0f28c677f55001cb948f1f82ef68ea26fc9aa29a58c294e2d23bc93c7420df2a2298779c21c4de
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8yaVskCzYBbKd+XsWgADUOjS0Nytw2SH:9hOmTsF93UYfwC6GIoutyaVszyKd+XYu
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3808-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2168-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4676-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2980-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1536-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1536-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3112-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2540-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/316-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2444-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3904-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3092-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3096-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/508-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3792-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2804-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1676-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/736-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-511-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3792-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-552-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-571-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-657-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1856-661-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-831-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-844-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-1053-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-1066-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-1493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-1580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2168 rxxrxlr.exe 4536 hhnbhn.exe 4676 ddvvd.exe 2996 fxxrrrl.exe 4360 tbhhhn.exe 1320 pjvvv.exe 2848 fxxfrlf.exe 2412 flfxxrf.exe 4624 hntttt.exe 2980 vjvpd.exe 2388 rxrxxfx.exe 4512 1frllrr.exe 3448 htnnnn.exe 3532 jjvpp.exe 5024 xxxxxfl.exe 4112 nnttnb.exe 4716 rlxxxxx.exe 1536 flfllxf.exe 2264 hbhnhb.exe 2964 pdpjj.exe 5004 vpddj.exe 4508 ntnnbb.exe 4356 dpvpj.exe 3112 xxlfxrl.exe 4100 hhtbtn.exe 1656 ppvpv.exe 2540 fxffllx.exe 316 hbnhhn.exe 4416 vvppj.exe 1192 llrllrl.exe 4712 ddvjd.exe 1616 thtntt.exe 2444 djvpj.exe 4876 lrxrrrr.exe 3252 fffffxf.exe 2664 nhtbtt.exe 4076 frflrfl.exe 1696 5rlllll.exe 3580 lxrlfxl.exe 4808 3bnbbb.exe 1724 tnnhhh.exe 5096 vdpjv.exe 3688 jjdvv.exe 1108 llxxlxx.exe 4448 nnttbh.exe 4432 3nbbnh.exe 3808 pdvvd.exe 3944 rlxrrrl.exe 4896 tntttb.exe 3904 7hnhnn.exe 4900 7dpjv.exe 3092 frrlfxr.exe 4532 hhbhnh.exe 3096 tbbbbh.exe 1852 7djdd.exe 1756 xlllllf.exe 604 bbhnnb.exe 676 7vjdj.exe 2044 9xxffxx.exe 4288 hbnhbb.exe 2936 tthhtt.exe 1520 1vddd.exe 1648 tbbbtt.exe 5088 rfffl.exe -
resource yara_rule behavioral2/memory/3808-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000500000002328f-3.dat upx behavioral2/memory/3808-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2168-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a0000000233e5-11.dat upx behavioral2/files/0x00080000000233ec-16.dat upx behavioral2/memory/4536-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4676-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ed-23.dat upx behavioral2/memory/2996-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ee-28.dat upx behavioral2/memory/4360-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ef-36.dat upx behavioral2/memory/1320-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f0-40.dat upx behavioral2/memory/2848-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f1-47.dat upx behavioral2/files/0x00070000000233f2-51.dat upx behavioral2/files/0x00070000000233f3-56.dat upx behavioral2/files/0x00070000000233f4-61.dat upx behavioral2/memory/2980-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f5-66.dat upx behavioral2/files/0x00070000000233f6-71.dat upx behavioral2/memory/4512-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f7-78.dat upx behavioral2/memory/3448-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f8-83.dat upx behavioral2/memory/3532-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5024-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f9-90.dat upx behavioral2/files/0x00070000000233fa-96.dat upx behavioral2/memory/4112-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4716-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fb-104.dat upx behavioral2/memory/1536-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fc-111.dat upx behavioral2/memory/2264-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fd-116.dat upx behavioral2/memory/1536-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fe-120.dat upx behavioral2/files/0x00070000000233ff-125.dat upx behavioral2/memory/5004-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4508-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4508-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023400-135.dat upx behavioral2/memory/4356-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023401-140.dat upx behavioral2/memory/3112-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233ea-145.dat upx behavioral2/memory/3112-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023402-151.dat upx behavioral2/files/0x0007000000023403-156.dat upx behavioral2/memory/2540-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023404-163.dat upx behavioral2/files/0x0007000000023405-167.dat upx behavioral2/memory/316-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-173.dat upx behavioral2/files/0x0007000000023407-179.dat upx behavioral2/memory/1192-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023408-186.dat upx behavioral2/memory/4712-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2444-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4876-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3252-199-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3808 wrote to memory of 2168 3808 8b0a1db9fd3c33f10eb4b43412f1bff0_NEIKI.exe 80 PID 3808 wrote to memory of 2168 3808 8b0a1db9fd3c33f10eb4b43412f1bff0_NEIKI.exe 80 PID 3808 wrote to memory of 2168 3808 8b0a1db9fd3c33f10eb4b43412f1bff0_NEIKI.exe 80 PID 2168 wrote to memory of 4536 2168 rxxrxlr.exe 81 PID 2168 wrote to memory of 4536 2168 rxxrxlr.exe 81 PID 2168 wrote to memory of 4536 2168 rxxrxlr.exe 81 PID 4536 wrote to memory of 4676 4536 hhnbhn.exe 82 PID 4536 wrote to memory of 4676 4536 hhnbhn.exe 82 PID 4536 wrote to memory of 4676 4536 hhnbhn.exe 82 PID 4676 wrote to memory of 2996 4676 ddvvd.exe 83 PID 4676 wrote to memory of 2996 4676 ddvvd.exe 83 PID 4676 wrote to memory of 2996 4676 ddvvd.exe 83 PID 2996 wrote to memory of 4360 2996 fxxrrrl.exe 85 PID 2996 wrote to memory of 4360 2996 fxxrrrl.exe 85 PID 2996 wrote to memory of 4360 2996 fxxrrrl.exe 85 PID 4360 wrote to memory of 1320 4360 tbhhhn.exe 86 PID 4360 wrote to memory of 1320 4360 tbhhhn.exe 86 PID 4360 wrote to memory of 1320 4360 tbhhhn.exe 86 PID 1320 wrote to memory of 2848 1320 pjvvv.exe 87 PID 1320 wrote to memory of 2848 1320 pjvvv.exe 87 PID 1320 wrote to memory of 2848 1320 pjvvv.exe 87 PID 2848 wrote to memory of 2412 2848 fxxfrlf.exe 88 PID 2848 wrote to memory of 2412 2848 fxxfrlf.exe 88 PID 2848 wrote to memory of 2412 2848 fxxfrlf.exe 88 PID 2412 wrote to memory of 4624 2412 flfxxrf.exe 89 PID 2412 wrote to memory of 4624 2412 flfxxrf.exe 89 PID 2412 wrote to memory of 4624 2412 flfxxrf.exe 89 PID 4624 wrote to memory of 2980 4624 hntttt.exe 91 PID 4624 wrote to memory of 2980 4624 hntttt.exe 91 PID 4624 wrote to memory of 2980 4624 hntttt.exe 91 PID 2980 wrote to memory of 2388 2980 vjvpd.exe 92 PID 2980 wrote to memory of 2388 2980 vjvpd.exe 92 PID 2980 wrote to memory of 2388 2980 vjvpd.exe 92 PID 2388 wrote to memory of 4512 2388 rxrxxfx.exe 93 PID 2388 wrote to memory of 4512 2388 rxrxxfx.exe 93 PID 2388 wrote to memory of 4512 2388 rxrxxfx.exe 93 PID 4512 wrote to memory of 3448 4512 1frllrr.exe 94 PID 4512 wrote to memory of 3448 4512 1frllrr.exe 94 PID 4512 wrote to memory of 3448 4512 1frllrr.exe 94 PID 3448 wrote to memory of 3532 3448 htnnnn.exe 95 PID 3448 wrote to memory of 3532 3448 htnnnn.exe 95 PID 3448 wrote to memory of 3532 3448 htnnnn.exe 95 PID 3532 wrote to memory of 5024 3532 jjvpp.exe 96 PID 3532 wrote to memory of 5024 3532 jjvpp.exe 96 PID 3532 wrote to memory of 5024 3532 jjvpp.exe 96 PID 5024 wrote to memory of 4112 5024 xxxxxfl.exe 97 PID 5024 wrote to memory of 4112 5024 xxxxxfl.exe 97 PID 5024 wrote to memory of 4112 5024 xxxxxfl.exe 97 PID 4112 wrote to memory of 4716 4112 nnttnb.exe 98 PID 4112 wrote to memory of 4716 4112 nnttnb.exe 98 PID 4112 wrote to memory of 4716 4112 nnttnb.exe 98 PID 4716 wrote to memory of 1536 4716 rlxxxxx.exe 100 PID 4716 wrote to memory of 1536 4716 rlxxxxx.exe 100 PID 4716 wrote to memory of 1536 4716 rlxxxxx.exe 100 PID 1536 wrote to memory of 2264 1536 flfllxf.exe 101 PID 1536 wrote to memory of 2264 1536 flfllxf.exe 101 PID 1536 wrote to memory of 2264 1536 flfllxf.exe 101 PID 2264 wrote to memory of 2964 2264 hbhnhb.exe 102 PID 2264 wrote to memory of 2964 2264 hbhnhb.exe 102 PID 2264 wrote to memory of 2964 2264 hbhnhb.exe 102 PID 2964 wrote to memory of 5004 2964 pdpjj.exe 103 PID 2964 wrote to memory of 5004 2964 pdpjj.exe 103 PID 2964 wrote to memory of 5004 2964 pdpjj.exe 103 PID 5004 wrote to memory of 4508 5004 vpddj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b0a1db9fd3c33f10eb4b43412f1bff0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\8b0a1db9fd3c33f10eb4b43412f1bff0_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\rxxrxlr.exec:\rxxrxlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\hhnbhn.exec:\hhnbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\ddvvd.exec:\ddvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\tbhhhn.exec:\tbhhhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\pjvvv.exec:\pjvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\fxxfrlf.exec:\fxxfrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\flfxxrf.exec:\flfxxrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\hntttt.exec:\hntttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\vjvpd.exec:\vjvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\rxrxxfx.exec:\rxrxxfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\1frllrr.exec:\1frllrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\htnnnn.exec:\htnnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\jjvpp.exec:\jjvpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\xxxxxfl.exec:\xxxxxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\nnttnb.exec:\nnttnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\flfllxf.exec:\flfllxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\hbhnhb.exec:\hbhnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\pdpjj.exec:\pdpjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\vpddj.exec:\vpddj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\ntnnbb.exec:\ntnnbb.exe23⤵
- Executes dropped EXE
PID:4508 -
\??\c:\dpvpj.exec:\dpvpj.exe24⤵
- Executes dropped EXE
PID:4356 -
\??\c:\xxlfxrl.exec:\xxlfxrl.exe25⤵
- Executes dropped EXE
PID:3112 -
\??\c:\hhtbtn.exec:\hhtbtn.exe26⤵
- Executes dropped EXE
PID:4100 -
\??\c:\ppvpv.exec:\ppvpv.exe27⤵
- Executes dropped EXE
PID:1656 -
\??\c:\fxffllx.exec:\fxffllx.exe28⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hbnhhn.exec:\hbnhhn.exe29⤵
- Executes dropped EXE
PID:316 -
\??\c:\vvppj.exec:\vvppj.exe30⤵
- Executes dropped EXE
PID:4416 -
\??\c:\llrllrl.exec:\llrllrl.exe31⤵
- Executes dropped EXE
PID:1192 -
\??\c:\ddvjd.exec:\ddvjd.exe32⤵
- Executes dropped EXE
PID:4712 -
\??\c:\thtntt.exec:\thtntt.exe33⤵
- Executes dropped EXE
PID:1616 -
\??\c:\djvpj.exec:\djvpj.exe34⤵
- Executes dropped EXE
PID:2444 -
\??\c:\lrxrrrr.exec:\lrxrrrr.exe35⤵
- Executes dropped EXE
PID:4876 -
\??\c:\fffffxf.exec:\fffffxf.exe36⤵
- Executes dropped EXE
PID:3252 -
\??\c:\nhtbtt.exec:\nhtbtt.exe37⤵
- Executes dropped EXE
PID:2664 -
\??\c:\frflrfl.exec:\frflrfl.exe38⤵
- Executes dropped EXE
PID:4076 -
\??\c:\5rlllll.exec:\5rlllll.exe39⤵
- Executes dropped EXE
PID:1696 -
\??\c:\lxrlfxl.exec:\lxrlfxl.exe40⤵
- Executes dropped EXE
PID:3580 -
\??\c:\3bnbbb.exec:\3bnbbb.exe41⤵
- Executes dropped EXE
PID:4808 -
\??\c:\tnnhhh.exec:\tnnhhh.exe42⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vdpjv.exec:\vdpjv.exe43⤵
- Executes dropped EXE
PID:5096 -
\??\c:\jjdvv.exec:\jjdvv.exe44⤵
- Executes dropped EXE
PID:3688 -
\??\c:\llxxlxx.exec:\llxxlxx.exe45⤵
- Executes dropped EXE
PID:1108 -
\??\c:\nnttbh.exec:\nnttbh.exe46⤵
- Executes dropped EXE
PID:4448 -
\??\c:\3nbbnh.exec:\3nbbnh.exe47⤵
- Executes dropped EXE
PID:4432 -
\??\c:\pdvvd.exec:\pdvvd.exe48⤵
- Executes dropped EXE
PID:3808 -
\??\c:\rlxrrrl.exec:\rlxrrrl.exe49⤵
- Executes dropped EXE
PID:3944 -
\??\c:\tntttb.exec:\tntttb.exe50⤵
- Executes dropped EXE
PID:4896 -
\??\c:\7hnhnn.exec:\7hnhnn.exe51⤵
- Executes dropped EXE
PID:3904 -
\??\c:\7dpjv.exec:\7dpjv.exe52⤵
- Executes dropped EXE
PID:4900 -
\??\c:\frrlfxr.exec:\frrlfxr.exe53⤵
- Executes dropped EXE
PID:3092 -
\??\c:\hhbhnh.exec:\hhbhnh.exe54⤵
- Executes dropped EXE
PID:4532 -
\??\c:\tbbbbh.exec:\tbbbbh.exe55⤵
- Executes dropped EXE
PID:3096 -
\??\c:\7djdd.exec:\7djdd.exe56⤵
- Executes dropped EXE
PID:1852 -
\??\c:\xlllllf.exec:\xlllllf.exe57⤵
- Executes dropped EXE
PID:1756 -
\??\c:\bbhnnb.exec:\bbhnnb.exe58⤵
- Executes dropped EXE
PID:604 -
\??\c:\7vjdj.exec:\7vjdj.exe59⤵
- Executes dropped EXE
PID:676 -
\??\c:\9xxffxx.exec:\9xxffxx.exe60⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hbnhbb.exec:\hbnhbb.exe61⤵
- Executes dropped EXE
PID:4288 -
\??\c:\tthhtt.exec:\tthhtt.exe62⤵
- Executes dropped EXE
PID:2936 -
\??\c:\1vddd.exec:\1vddd.exe63⤵
- Executes dropped EXE
PID:1520 -
\??\c:\tbbbtt.exec:\tbbbtt.exe64⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rfffl.exec:\rfffl.exe65⤵
- Executes dropped EXE
PID:5088 -
\??\c:\7lxflll.exec:\7lxflll.exe66⤵PID:4352
-
\??\c:\dvvvj.exec:\dvvvj.exe67⤵PID:3372
-
\??\c:\jdjpj.exec:\jdjpj.exe68⤵PID:2176
-
\??\c:\xrlxrll.exec:\xrlxrll.exe69⤵PID:2364
-
\??\c:\hnnhhh.exec:\hnnhhh.exe70⤵PID:4112
-
\??\c:\3ppjv.exec:\3ppjv.exe71⤵PID:3116
-
\??\c:\fffffll.exec:\fffffll.exe72⤵PID:508
-
\??\c:\nbhhbb.exec:\nbhhbb.exe73⤵PID:3332
-
\??\c:\vdvvp.exec:\vdvvp.exe74⤵PID:4928
-
\??\c:\flllflf.exec:\flllflf.exe75⤵PID:3792
-
\??\c:\thtbnt.exec:\thtbnt.exe76⤵PID:4804
-
\??\c:\vppjd.exec:\vppjd.exe77⤵PID:2652
-
\??\c:\lllxxrr.exec:\lllxxrr.exe78⤵PID:1088
-
\??\c:\nhtbbb.exec:\nhtbbb.exe79⤵PID:3336
-
\??\c:\9tbbtt.exec:\9tbbtt.exe80⤵PID:2220
-
\??\c:\pdjjj.exec:\pdjjj.exe81⤵PID:4028
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe82⤵PID:1248
-
\??\c:\btbbbb.exec:\btbbbb.exe83⤵PID:660
-
\??\c:\9btthh.exec:\9btthh.exe84⤵PID:3432
-
\??\c:\pjppp.exec:\pjppp.exe85⤵PID:2080
-
\??\c:\7rrrxlr.exec:\7rrrxlr.exe86⤵PID:4200
-
\??\c:\rffxrxl.exec:\rffxrxl.exe87⤵PID:4948
-
\??\c:\pvjvv.exec:\pvjvv.exe88⤵PID:440
-
\??\c:\ppvvv.exec:\ppvvv.exe89⤵PID:1548
-
\??\c:\xlxfrxl.exec:\xlxfrxl.exe90⤵PID:2804
-
\??\c:\bhbnbt.exec:\bhbnbt.exe91⤵PID:1968
-
\??\c:\jdpjd.exec:\jdpjd.exe92⤵PID:1844
-
\??\c:\ppdpj.exec:\ppdpj.exe93⤵PID:5000
-
\??\c:\tthbbt.exec:\tthbbt.exe94⤵PID:4472
-
\??\c:\3vddv.exec:\3vddv.exe95⤵PID:3560
-
\??\c:\xrllfff.exec:\xrllfff.exe96⤵PID:1676
-
\??\c:\btnnht.exec:\btnnht.exe97⤵PID:4736
-
\??\c:\1tbbnt.exec:\1tbbnt.exe98⤵PID:3652
-
\??\c:\7vpvv.exec:\7vpvv.exe99⤵PID:4380
-
\??\c:\rffxrxr.exec:\rffxrxr.exe100⤵PID:3916
-
\??\c:\1htntt.exec:\1htntt.exe101⤵PID:3940
-
\??\c:\hnhnht.exec:\hnhnht.exe102⤵PID:1096
-
\??\c:\1jpjv.exec:\1jpjv.exe103⤵PID:1224
-
\??\c:\xfxffxf.exec:\xfxffxf.exe104⤵PID:4424
-
\??\c:\hhntbb.exec:\hhntbb.exe105⤵PID:1408
-
\??\c:\btnthh.exec:\btnthh.exe106⤵PID:1860
-
\??\c:\vvvpp.exec:\vvvpp.exe107⤵PID:1264
-
\??\c:\7xxfrxx.exec:\7xxfrxx.exe108⤵PID:4344
-
\??\c:\1hhbbt.exec:\1hhbbt.exe109⤵PID:3944
-
\??\c:\vjjjd.exec:\vjjjd.exe110⤵PID:4896
-
\??\c:\dvjvp.exec:\dvjvp.exe111⤵PID:4724
-
\??\c:\xllfxfx.exec:\xllfxfx.exe112⤵PID:184
-
\??\c:\nnhtbn.exec:\nnhtbn.exe113⤵PID:212
-
\??\c:\3nnnhh.exec:\3nnnhh.exe114⤵PID:1468
-
\??\c:\9pdvv.exec:\9pdvv.exe115⤵PID:732
-
\??\c:\fxrxrfx.exec:\fxrxrfx.exe116⤵PID:736
-
\??\c:\rlrfxrf.exec:\rlrfxrf.exe117⤵PID:3008
-
\??\c:\nbnnnn.exec:\nbnnnn.exe118⤵PID:4456
-
\??\c:\jpddd.exec:\jpddd.exe119⤵PID:3188
-
\??\c:\3xlfxxf.exec:\3xlfxxf.exe120⤵PID:3248
-
\??\c:\hhbthh.exec:\hhbthh.exe121⤵PID:3804
-
\??\c:\ttthhb.exec:\ttthhb.exe122⤵PID:1404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-