Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 04:30
Behavioral task
behavioral1
Sample
cff7c292fc3b7a9cb8517212d2583320_NEIKI.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
cff7c292fc3b7a9cb8517212d2583320_NEIKI.exe
-
Size
454KB
-
MD5
cff7c292fc3b7a9cb8517212d2583320
-
SHA1
b6cff1446b6612012f291bea2aeb3305d5b04c95
-
SHA256
33c92a867f9fa3d0be115854bbc30b78926376974e5950730c010ab0f38161ba
-
SHA512
29a31c27708cb276f7c6213c7aeded243ac1e5e1c0d0fa034bd1c747d1e59fae8ef6e0a8edfdb4f3e309c90005fcc244cc2294008abe7283d1daa584b5514f49
-
SSDEEP
12288:y4wFHoS3eFp3IDvSbh5nPYERAAUDCa4NYmu:HFp3lz1XUDCaGYmu
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5224-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5324-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2924-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2456-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1300-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3232-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2920-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1960-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5492-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5512-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1104-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1912-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5584-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/400-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/636-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2492-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5260-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5280-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1112-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1756-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1692-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/6092-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4532-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/460-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5564-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5728-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5668-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5332-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3476-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2256-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5648-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/6040-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1296-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-523-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2148-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-611-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2632-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-667-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-674-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4236-693-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/232-764-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-789-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5672-881-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2228 llxxrrx.exe 1604 tbbnth.exe 5324 dpdvp.exe 2924 nnbttt.exe 2456 rxxfxrl.exe 1300 htbtnh.exe 3232 btbbbt.exe 2920 bhhhhh.exe 1960 nhtbht.exe 3872 lrrllxr.exe 4804 llxrfxr.exe 6040 hnhnbn.exe 3464 djpjd.exe 3280 nnnhhh.exe 3776 fxlxlxr.exe 5492 tnhnbt.exe 2584 frxxrrl.exe 5044 nbhbnh.exe 4448 3bhbtt.exe 5512 5dpdv.exe 4928 xlxrrrr.exe 1104 nbttnt.exe 1912 1vddj.exe 2276 xrlfxlr.exe 4824 dpjvj.exe 400 lxrfrxr.exe 5584 hhhbtn.exe 5028 1ppjj.exe 636 vpdvj.exe 2992 xrfrlxr.exe 2640 ntthbb.exe 3632 fxxlffx.exe 4400 ddvdj.exe 2028 pppjd.exe 2492 rfffxxx.exe 1980 bntnhb.exe 2120 jjvpp.exe 1588 fxxxrrr.exe 5260 5btnhn.exe 1520 dddvp.exe 5280 llxrlfx.exe 1444 7hthbn.exe 3292 jvppv.exe 1112 5vjdv.exe 3036 1tbtth.exe 4932 jvdpd.exe 1756 xxlfxxx.exe 1768 5fxrxrl.exe 3996 hbbtnt.exe 4576 ddjjd.exe 1692 lrfxrxx.exe 6060 lflfxxx.exe 6092 tthhnh.exe 4988 vjdvv.exe 532 rxxxrrl.exe 4532 3tbbtt.exe 840 vpjjj.exe 4144 7rfxflr.exe 460 xrllflx.exe 216 btnnhn.exe 5564 djpjd.exe 5728 lrfxlrf.exe 5668 rxrlflf.exe 3584 btnnhh.exe -
resource yara_rule behavioral2/memory/5224-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b36-3.dat upx behavioral2/memory/5224-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2228-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b95-12.dat upx behavioral2/files/0x000b000000023b91-11.dat upx behavioral2/files/0x000a000000023b96-19.dat upx behavioral2/memory/5324-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2924-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b97-26.dat upx behavioral2/memory/2924-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2456-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b98-32.dat upx behavioral2/files/0x000a000000023b9a-38.dat upx behavioral2/memory/1300-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9b-45.dat upx behavioral2/memory/3232-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2920-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9c-49.dat upx behavioral2/memory/1960-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9d-57.dat upx behavioral2/files/0x000a000000023b9e-63.dat upx behavioral2/files/0x000a000000023b9f-67.dat upx behavioral2/files/0x000b000000023b92-72.dat upx behavioral2/memory/4804-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba0-77.dat upx behavioral2/memory/3464-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba1-83.dat upx behavioral2/memory/3280-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3776-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba2-90.dat upx behavioral2/files/0x000a000000023ba3-95.dat upx behavioral2/memory/5492-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba4-101.dat upx behavioral2/memory/5044-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2584-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5044-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba5-110.dat upx behavioral2/files/0x000a000000023ba7-120.dat upx behavioral2/memory/4928-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4448-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5512-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba6-115.dat upx behavioral2/files/0x000a000000023ba8-127.dat upx behavioral2/files/0x000a000000023ba9-133.dat upx behavioral2/memory/1104-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0002000000022e0c-139.dat upx behavioral2/memory/1912-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0002000000022e09-145.dat upx behavioral2/memory/4824-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023baa-158.dat upx behavioral2/memory/5584-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/400-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0012000000023a0c-150.dat upx behavioral2/files/0x000a000000023bab-163.dat upx behavioral2/memory/5028-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bac-168.dat upx behavioral2/files/0x000a000000023bad-176.dat upx behavioral2/files/0x000a000000023bae-179.dat upx behavioral2/memory/636-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0012000000023a08-185.dat upx behavioral2/memory/4400-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2028-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2492-201-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5224 wrote to memory of 2228 5224 cff7c292fc3b7a9cb8517212d2583320_NEIKI.exe 83 PID 5224 wrote to memory of 2228 5224 cff7c292fc3b7a9cb8517212d2583320_NEIKI.exe 83 PID 5224 wrote to memory of 2228 5224 cff7c292fc3b7a9cb8517212d2583320_NEIKI.exe 83 PID 2228 wrote to memory of 1604 2228 llxxrrx.exe 84 PID 2228 wrote to memory of 1604 2228 llxxrrx.exe 84 PID 2228 wrote to memory of 1604 2228 llxxrrx.exe 84 PID 1604 wrote to memory of 5324 1604 tbbnth.exe 85 PID 1604 wrote to memory of 5324 1604 tbbnth.exe 85 PID 1604 wrote to memory of 5324 1604 tbbnth.exe 85 PID 5324 wrote to memory of 2924 5324 dpdvp.exe 86 PID 5324 wrote to memory of 2924 5324 dpdvp.exe 86 PID 5324 wrote to memory of 2924 5324 dpdvp.exe 86 PID 2924 wrote to memory of 2456 2924 nnbttt.exe 87 PID 2924 wrote to memory of 2456 2924 nnbttt.exe 87 PID 2924 wrote to memory of 2456 2924 nnbttt.exe 87 PID 2456 wrote to memory of 1300 2456 rxxfxrl.exe 89 PID 2456 wrote to memory of 1300 2456 rxxfxrl.exe 89 PID 2456 wrote to memory of 1300 2456 rxxfxrl.exe 89 PID 1300 wrote to memory of 3232 1300 htbtnh.exe 91 PID 1300 wrote to memory of 3232 1300 htbtnh.exe 91 PID 1300 wrote to memory of 3232 1300 htbtnh.exe 91 PID 3232 wrote to memory of 2920 3232 btbbbt.exe 92 PID 3232 wrote to memory of 2920 3232 btbbbt.exe 92 PID 3232 wrote to memory of 2920 3232 btbbbt.exe 92 PID 2920 wrote to memory of 1960 2920 bhhhhh.exe 94 PID 2920 wrote to memory of 1960 2920 bhhhhh.exe 94 PID 2920 wrote to memory of 1960 2920 bhhhhh.exe 94 PID 1960 wrote to memory of 3872 1960 nhtbht.exe 95 PID 1960 wrote to memory of 3872 1960 nhtbht.exe 95 PID 1960 wrote to memory of 3872 1960 nhtbht.exe 95 PID 3872 wrote to memory of 4804 3872 lrrllxr.exe 96 PID 3872 wrote to memory of 4804 3872 lrrllxr.exe 96 PID 3872 wrote to memory of 4804 3872 lrrllxr.exe 96 PID 4804 wrote to memory of 6040 4804 llxrfxr.exe 97 PID 4804 wrote to memory of 6040 4804 llxrfxr.exe 97 PID 4804 wrote to memory of 6040 4804 llxrfxr.exe 97 PID 6040 wrote to memory of 3464 6040 hnhnbn.exe 98 PID 6040 wrote to memory of 3464 6040 hnhnbn.exe 98 PID 6040 wrote to memory of 3464 6040 hnhnbn.exe 98 PID 3464 wrote to memory of 3280 3464 djpjd.exe 99 PID 3464 wrote to memory of 3280 3464 djpjd.exe 99 PID 3464 wrote to memory of 3280 3464 djpjd.exe 99 PID 3280 wrote to memory of 3776 3280 nnnhhh.exe 100 PID 3280 wrote to memory of 3776 3280 nnnhhh.exe 100 PID 3280 wrote to memory of 3776 3280 nnnhhh.exe 100 PID 3776 wrote to memory of 5492 3776 fxlxlxr.exe 101 PID 3776 wrote to memory of 5492 3776 fxlxlxr.exe 101 PID 3776 wrote to memory of 5492 3776 fxlxlxr.exe 101 PID 5492 wrote to memory of 2584 5492 tnhnbt.exe 102 PID 5492 wrote to memory of 2584 5492 tnhnbt.exe 102 PID 5492 wrote to memory of 2584 5492 tnhnbt.exe 102 PID 2584 wrote to memory of 5044 2584 frxxrrl.exe 103 PID 2584 wrote to memory of 5044 2584 frxxrrl.exe 103 PID 2584 wrote to memory of 5044 2584 frxxrrl.exe 103 PID 5044 wrote to memory of 4448 5044 nbhbnh.exe 104 PID 5044 wrote to memory of 4448 5044 nbhbnh.exe 104 PID 5044 wrote to memory of 4448 5044 nbhbnh.exe 104 PID 4448 wrote to memory of 5512 4448 3bhbtt.exe 105 PID 4448 wrote to memory of 5512 4448 3bhbtt.exe 105 PID 4448 wrote to memory of 5512 4448 3bhbtt.exe 105 PID 5512 wrote to memory of 4928 5512 5dpdv.exe 106 PID 5512 wrote to memory of 4928 5512 5dpdv.exe 106 PID 5512 wrote to memory of 4928 5512 5dpdv.exe 106 PID 4928 wrote to memory of 1104 4928 xlxrrrr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\cff7c292fc3b7a9cb8517212d2583320_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\cff7c292fc3b7a9cb8517212d2583320_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5224 -
\??\c:\llxxrrx.exec:\llxxrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\tbbnth.exec:\tbbnth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\dpdvp.exec:\dpdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
\??\c:\nnbttt.exec:\nnbttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\rxxfxrl.exec:\rxxfxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\htbtnh.exec:\htbtnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\btbbbt.exec:\btbbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\bhhhhh.exec:\bhhhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\nhtbht.exec:\nhtbht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\lrrllxr.exec:\lrrllxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\llxrfxr.exec:\llxrfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\hnhnbn.exec:\hnhnbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
\??\c:\djpjd.exec:\djpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\nnnhhh.exec:\nnnhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\fxlxlxr.exec:\fxlxlxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\tnhnbt.exec:\tnhnbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
\??\c:\frxxrrl.exec:\frxxrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\nbhbnh.exec:\nbhbnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\3bhbtt.exec:\3bhbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\5dpdv.exec:\5dpdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
\??\c:\xlxrrrr.exec:\xlxrrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\nbttnt.exec:\nbttnt.exe23⤵
- Executes dropped EXE
PID:1104 -
\??\c:\1vddj.exec:\1vddj.exe24⤵
- Executes dropped EXE
PID:1912 -
\??\c:\xrlfxlr.exec:\xrlfxlr.exe25⤵
- Executes dropped EXE
PID:2276 -
\??\c:\dpjvj.exec:\dpjvj.exe26⤵
- Executes dropped EXE
PID:4824 -
\??\c:\lxrfrxr.exec:\lxrfrxr.exe27⤵
- Executes dropped EXE
PID:400 -
\??\c:\hhhbtn.exec:\hhhbtn.exe28⤵
- Executes dropped EXE
PID:5584 -
\??\c:\1ppjj.exec:\1ppjj.exe29⤵
- Executes dropped EXE
PID:5028 -
\??\c:\vpdvj.exec:\vpdvj.exe30⤵
- Executes dropped EXE
PID:636 -
\??\c:\xrfrlxr.exec:\xrfrlxr.exe31⤵
- Executes dropped EXE
PID:2992 -
\??\c:\ntthbb.exec:\ntthbb.exe32⤵
- Executes dropped EXE
PID:2640 -
\??\c:\fxxlffx.exec:\fxxlffx.exe33⤵
- Executes dropped EXE
PID:3632 -
\??\c:\ddvdj.exec:\ddvdj.exe34⤵
- Executes dropped EXE
PID:4400 -
\??\c:\pppjd.exec:\pppjd.exe35⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rfffxxx.exec:\rfffxxx.exe36⤵
- Executes dropped EXE
PID:2492 -
\??\c:\bntnhb.exec:\bntnhb.exe37⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jjvpp.exec:\jjvpp.exe38⤵
- Executes dropped EXE
PID:2120 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe39⤵
- Executes dropped EXE
PID:1588 -
\??\c:\5btnhn.exec:\5btnhn.exe40⤵
- Executes dropped EXE
PID:5260 -
\??\c:\dddvp.exec:\dddvp.exe41⤵
- Executes dropped EXE
PID:1520 -
\??\c:\llxrlfx.exec:\llxrlfx.exe42⤵
- Executes dropped EXE
PID:5280 -
\??\c:\7hthbn.exec:\7hthbn.exe43⤵
- Executes dropped EXE
PID:1444 -
\??\c:\jvppv.exec:\jvppv.exe44⤵
- Executes dropped EXE
PID:3292 -
\??\c:\5vjdv.exec:\5vjdv.exe45⤵
- Executes dropped EXE
PID:1112 -
\??\c:\1tbtth.exec:\1tbtth.exe46⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jvdpd.exec:\jvdpd.exe47⤵
- Executes dropped EXE
PID:4932 -
\??\c:\xxlfxxx.exec:\xxlfxxx.exe48⤵
- Executes dropped EXE
PID:1756 -
\??\c:\5fxrxrl.exec:\5fxrxrl.exe49⤵
- Executes dropped EXE
PID:1768 -
\??\c:\hbbtnt.exec:\hbbtnt.exe50⤵
- Executes dropped EXE
PID:3996 -
\??\c:\ddjjd.exec:\ddjjd.exe51⤵
- Executes dropped EXE
PID:4576 -
\??\c:\lrfxrxx.exec:\lrfxrxx.exe52⤵
- Executes dropped EXE
PID:1692 -
\??\c:\lflfxxx.exec:\lflfxxx.exe53⤵
- Executes dropped EXE
PID:6060 -
\??\c:\tthhnh.exec:\tthhnh.exe54⤵
- Executes dropped EXE
PID:6092 -
\??\c:\vjdvv.exec:\vjdvv.exe55⤵
- Executes dropped EXE
PID:4988 -
\??\c:\rxxxrrl.exec:\rxxxrrl.exe56⤵
- Executes dropped EXE
PID:532 -
\??\c:\3tbbtt.exec:\3tbbtt.exe57⤵
- Executes dropped EXE
PID:4532 -
\??\c:\vpjjj.exec:\vpjjj.exe58⤵
- Executes dropped EXE
PID:840 -
\??\c:\7rfxflr.exec:\7rfxflr.exe59⤵
- Executes dropped EXE
PID:4144 -
\??\c:\xrllflx.exec:\xrllflx.exe60⤵
- Executes dropped EXE
PID:460 -
\??\c:\btnnhn.exec:\btnnhn.exe61⤵
- Executes dropped EXE
PID:216 -
\??\c:\djpjd.exec:\djpjd.exe62⤵
- Executes dropped EXE
PID:5564 -
\??\c:\lrfxlrf.exec:\lrfxlrf.exe63⤵
- Executes dropped EXE
PID:5728 -
\??\c:\rxrlflf.exec:\rxrlflf.exe64⤵
- Executes dropped EXE
PID:5668 -
\??\c:\btnnhh.exec:\btnnhh.exe65⤵
- Executes dropped EXE
PID:3584 -
\??\c:\pjpjj.exec:\pjpjj.exe66⤵PID:3092
-
\??\c:\rrxrrrr.exec:\rrxrrrr.exe67⤵PID:3960
-
\??\c:\tntnhb.exec:\tntnhb.exe68⤵PID:1644
-
\??\c:\pvjdj.exec:\pvjdj.exe69⤵PID:548
-
\??\c:\pvdpd.exec:\pvdpd.exe70⤵PID:2988
-
\??\c:\rfxfrfl.exec:\rfxfrfl.exe71⤵PID:5332
-
\??\c:\hntnhh.exec:\hntnhh.exe72⤵PID:1484
-
\??\c:\pdjdv.exec:\pdjdv.exe73⤵PID:716
-
\??\c:\fxxxrlf.exec:\fxxxrlf.exe74⤵PID:5596
-
\??\c:\htttht.exec:\htttht.exe75⤵PID:3476
-
\??\c:\7tnbtt.exec:\7tnbtt.exe76⤵PID:5160
-
\??\c:\5jjdv.exec:\5jjdv.exe77⤵PID:5192
-
\??\c:\fxlflfx.exec:\fxlflfx.exe78⤵PID:3684
-
\??\c:\hbhhhh.exec:\hbhhhh.exe79⤵PID:1916
-
\??\c:\nbnhbb.exec:\nbnhbb.exe80⤵PID:3560
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe81⤵PID:2256
-
\??\c:\flxfxlx.exec:\flxfxlx.exe82⤵PID:3504
-
\??\c:\bnbbhh.exec:\bnbbhh.exe83⤵PID:5520
-
\??\c:\jpjdp.exec:\jpjdp.exe84⤵PID:1448
-
\??\c:\jdvvp.exec:\jdvvp.exe85⤵PID:3396
-
\??\c:\3rrrllf.exec:\3rrrllf.exe86⤵PID:4616
-
\??\c:\thbnhb.exec:\thbnhb.exe87⤵PID:5648
-
\??\c:\jjddv.exec:\jjddv.exe88⤵PID:2468
-
\??\c:\dpdvp.exec:\dpdvp.exe89⤵PID:6040
-
\??\c:\9ffxxrf.exec:\9ffxxrf.exe90⤵PID:3392
-
\??\c:\ttbbnn.exec:\ttbbnn.exe91⤵PID:1032
-
\??\c:\9pvpj.exec:\9pvpj.exe92⤵PID:3388
-
\??\c:\rllflrf.exec:\rllflrf.exe93⤵PID:5032
-
\??\c:\bhbbnb.exec:\bhbbnb.exe94⤵PID:5452
-
\??\c:\vpjjj.exec:\vpjjj.exe95⤵PID:3968
-
\??\c:\rxlfxrf.exec:\rxlfxrf.exe96⤵PID:4536
-
\??\c:\flxlllf.exec:\flxlllf.exe97⤵PID:5644
-
\??\c:\vjppv.exec:\vjppv.exe98⤵PID:1460
-
\??\c:\5xffxfx.exec:\5xffxfx.exe99⤵PID:4868
-
\??\c:\nbhhbt.exec:\nbhhbt.exe100⤵PID:4332
-
\??\c:\nbhhtb.exec:\nbhhtb.exe101⤵PID:5628
-
\??\c:\1pvpp.exec:\1pvpp.exe102⤵PID:5784
-
\??\c:\3rrllll.exec:\3rrllll.exe103⤵PID:5972
-
\??\c:\nttnhh.exec:\nttnhh.exe104⤵PID:5640
-
\??\c:\pvpvv.exec:\pvpvv.exe105⤵PID:1256
-
\??\c:\fxflxlf.exec:\fxflxlf.exe106⤵PID:1296
-
\??\c:\lfrlfff.exec:\lfrlfff.exe107⤵PID:6120
-
\??\c:\bbnntt.exec:\bbnntt.exe108⤵PID:768
-
\??\c:\5vddd.exec:\5vddd.exe109⤵PID:632
-
\??\c:\jdvdp.exec:\jdvdp.exe110⤵PID:5592
-
\??\c:\lrfxrfl.exec:\lrfxrfl.exe111⤵PID:3748
-
\??\c:\tthhhh.exec:\tthhhh.exe112⤵PID:1904
-
\??\c:\dpppd.exec:\dpppd.exe113⤵PID:228
-
\??\c:\vvjjv.exec:\vvjjv.exe114⤵PID:5980
-
\??\c:\xrffrrf.exec:\xrffrrf.exe115⤵PID:220
-
\??\c:\hhhhbb.exec:\hhhhbb.exe116⤵PID:2076
-
\??\c:\hhnhbb.exec:\hhnhbb.exe117⤵PID:4400
-
\??\c:\pppvp.exec:\pppvp.exe118⤵PID:2028
-
\??\c:\xxrrllf.exec:\xxrrllf.exe119⤵PID:5484
-
\??\c:\xrxfxxx.exec:\xrxfxxx.exe120⤵PID:2652
-
\??\c:\nnttnt.exec:\nnttnt.exe121⤵PID:1480
-
\??\c:\dddvv.exec:\dddvv.exe122⤵PID:2120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-