Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 13:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
54f39aebde61f67e7bdbe44c82ca08393c61e4048f097749d1bd37a332a7acc0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
54f39aebde61f67e7bdbe44c82ca08393c61e4048f097749d1bd37a332a7acc0_NeikiAnalytics.exe
-
Size
81KB
-
MD5
025a00289948face7bdf2057c2603820
-
SHA1
979a61b1bea376f8bae9c6c7beeecd9e622176d3
-
SHA256
54f39aebde61f67e7bdbe44c82ca08393c61e4048f097749d1bd37a332a7acc0
-
SHA512
4b6bcffb1a70fa9a88ea9775f0a5586ae109898eda5da9fdf5eee8224f27487cc193adeb522684a63a35875a7603c900998a634f363a493b46d0950bc6fe44e6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7xCkTsIwtOa2dYS8njh:ymb3NkkiQ3mdBjFo7LAIbT6jh
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2948-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/816-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1892-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1316-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/356-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-93-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-41-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-22-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1dpvj.exelxlrrrr.exe7flffxf.exe1lxlrfl.exenthnhb.exehnhhnb.exepdpjv.exe1pjvv.exe3lxllfl.exexlffxrx.exexlrlrlx.exebhnntt.exehthntt.exetnttbb.exepdjdv.exevjvvv.exe5fllrll.exexlxrfff.exerxlffxl.exe7lfffrr.exenbhbbt.exebnbbbb.exe9dppp.exedpjvp.exejpvvd.exe3frlrll.exe9bhhhh.exethtntn.exevjppv.exepdpvd.exefxlxxxf.exexflfxrx.exexrlllrx.exebnnhnh.exehtbthb.exe9jvpd.exepdjdj.exe3lxxxrr.exelfxffll.exellxrxrf.exethhbtt.exe3tnttn.exe9thbhh.exe5jppj.exejjvjd.exefrllrrf.exe7xrxxxf.exehbthtt.exebthbtt.exe7btnbb.exe3pddd.exe9lrxrlx.exetnbbbt.exehtnntt.exerlxffxf.exebhntbn.exepdjjj.exefrxlllr.exe1nbhbh.exebnbbbb.exelllxxlx.exe7rrrrlr.exettnnhh.exejdvdp.exepid process 3044 1dpvj.exe 2556 lxlrrrr.exe 2664 7flffxf.exe 2616 1lxlrfl.exe 2580 nthnhb.exe 2232 hnhhnb.exe 2464 pdpjv.exe 2864 1pjvv.exe 1672 3lxllfl.exe 356 xlffxrx.exe 2440 xlrlrlx.exe 1316 bhnntt.exe 1892 hthntt.exe 2564 tnttbb.exe 1772 pdjdv.exe 1824 vjvvv.exe 1532 5fllrll.exe 840 xlxrfff.exe 2560 rxlffxl.exe 2448 7lfffrr.exe 2656 nbhbbt.exe 596 bnbbbb.exe 1512 9dppp.exe 1836 dpjvp.exe 2432 jpvvd.exe 1064 3frlrll.exe 564 9bhhhh.exe 1284 thtntn.exe 816 vjppv.exe 2056 pdpvd.exe 1332 fxlxxxf.exe 3048 xflfxrx.exe 1592 xrlllrx.exe 2972 bnnhnh.exe 2792 htbthb.exe 2572 9jvpd.exe 2500 pdjdj.exe 2780 3lxxxrr.exe 2400 lfxffll.exe 2488 llxrxrf.exe 1736 thhbtt.exe 2428 3tnttn.exe 2700 9thbhh.exe 1468 5jppj.exe 2520 jjvjd.exe 1856 frllrrf.exe 1988 7xrxxxf.exe 2384 hbthtt.exe 2392 bthbtt.exe 360 7btnbb.exe 1824 3pddd.exe 1344 9lrxrlx.exe 884 tnbbbt.exe 1676 htnntt.exe 1348 rlxffxf.exe 2276 bhntbn.exe 2656 pdjjj.exe 1504 frxlllr.exe 552 1nbhbh.exe 1036 bnbbbb.exe 1720 lllxxlx.exe 968 7rrrrlr.exe 324 ttnnhh.exe 1048 jdvdp.exe -
Processes:
resource yara_rule behavioral1/memory/2948-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1316-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/356-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-40-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
54f39aebde61f67e7bdbe44c82ca08393c61e4048f097749d1bd37a332a7acc0_NeikiAnalytics.exe1dpvj.exelxlrrrr.exe7flffxf.exe1lxlrfl.exenthnhb.exehnhhnb.exepdpjv.exe1pjvv.exe3lxllfl.exexlffxrx.exexlrlrlx.exebhnntt.exehthntt.exetnttbb.exepdjdv.exedescription pid process target process PID 2948 wrote to memory of 3044 2948 54f39aebde61f67e7bdbe44c82ca08393c61e4048f097749d1bd37a332a7acc0_NeikiAnalytics.exe 1dpvj.exe PID 2948 wrote to memory of 3044 2948 54f39aebde61f67e7bdbe44c82ca08393c61e4048f097749d1bd37a332a7acc0_NeikiAnalytics.exe 1dpvj.exe PID 2948 wrote to memory of 3044 2948 54f39aebde61f67e7bdbe44c82ca08393c61e4048f097749d1bd37a332a7acc0_NeikiAnalytics.exe 1dpvj.exe PID 2948 wrote to memory of 3044 2948 54f39aebde61f67e7bdbe44c82ca08393c61e4048f097749d1bd37a332a7acc0_NeikiAnalytics.exe 1dpvj.exe PID 3044 wrote to memory of 2556 3044 1dpvj.exe lxlrrrr.exe PID 3044 wrote to memory of 2556 3044 1dpvj.exe lxlrrrr.exe PID 3044 wrote to memory of 2556 3044 1dpvj.exe lxlrrrr.exe PID 3044 wrote to memory of 2556 3044 1dpvj.exe lxlrrrr.exe PID 2556 wrote to memory of 2664 2556 lxlrrrr.exe 7flffxf.exe PID 2556 wrote to memory of 2664 2556 lxlrrrr.exe 7flffxf.exe PID 2556 wrote to memory of 2664 2556 lxlrrrr.exe 7flffxf.exe PID 2556 wrote to memory of 2664 2556 lxlrrrr.exe 7flffxf.exe PID 2664 wrote to memory of 2616 2664 7flffxf.exe 1lxlrfl.exe PID 2664 wrote to memory of 2616 2664 7flffxf.exe 1lxlrfl.exe PID 2664 wrote to memory of 2616 2664 7flffxf.exe 1lxlrfl.exe PID 2664 wrote to memory of 2616 2664 7flffxf.exe 1lxlrfl.exe PID 2616 wrote to memory of 2580 2616 1lxlrfl.exe nthnhb.exe PID 2616 wrote to memory of 2580 2616 1lxlrfl.exe nthnhb.exe PID 2616 wrote to memory of 2580 2616 1lxlrfl.exe nthnhb.exe PID 2616 wrote to memory of 2580 2616 1lxlrfl.exe nthnhb.exe PID 2580 wrote to memory of 2232 2580 nthnhb.exe hnhhnb.exe PID 2580 wrote to memory of 2232 2580 nthnhb.exe hnhhnb.exe PID 2580 wrote to memory of 2232 2580 nthnhb.exe hnhhnb.exe PID 2580 wrote to memory of 2232 2580 nthnhb.exe hnhhnb.exe PID 2232 wrote to memory of 2464 2232 hnhhnb.exe pdpjv.exe PID 2232 wrote to memory of 2464 2232 hnhhnb.exe pdpjv.exe PID 2232 wrote to memory of 2464 2232 hnhhnb.exe pdpjv.exe PID 2232 wrote to memory of 2464 2232 hnhhnb.exe pdpjv.exe PID 2464 wrote to memory of 2864 2464 pdpjv.exe 1pjvv.exe PID 2464 wrote to memory of 2864 2464 pdpjv.exe 1pjvv.exe PID 2464 wrote to memory of 2864 2464 pdpjv.exe 1pjvv.exe PID 2464 wrote to memory of 2864 2464 pdpjv.exe 1pjvv.exe PID 2864 wrote to memory of 1672 2864 1pjvv.exe 3lxllfl.exe PID 2864 wrote to memory of 1672 2864 1pjvv.exe 3lxllfl.exe PID 2864 wrote to memory of 1672 2864 1pjvv.exe 3lxllfl.exe PID 2864 wrote to memory of 1672 2864 1pjvv.exe 3lxllfl.exe PID 1672 wrote to memory of 356 1672 3lxllfl.exe xlffxrx.exe PID 1672 wrote to memory of 356 1672 3lxllfl.exe xlffxrx.exe PID 1672 wrote to memory of 356 1672 3lxllfl.exe xlffxrx.exe PID 1672 wrote to memory of 356 1672 3lxllfl.exe xlffxrx.exe PID 356 wrote to memory of 2440 356 xlffxrx.exe xlrlrlx.exe PID 356 wrote to memory of 2440 356 xlffxrx.exe xlrlrlx.exe PID 356 wrote to memory of 2440 356 xlffxrx.exe xlrlrlx.exe PID 356 wrote to memory of 2440 356 xlffxrx.exe xlrlrlx.exe PID 2440 wrote to memory of 1316 2440 xlrlrlx.exe bhnntt.exe PID 2440 wrote to memory of 1316 2440 xlrlrlx.exe bhnntt.exe PID 2440 wrote to memory of 1316 2440 xlrlrlx.exe bhnntt.exe PID 2440 wrote to memory of 1316 2440 xlrlrlx.exe bhnntt.exe PID 1316 wrote to memory of 1892 1316 bhnntt.exe hthntt.exe PID 1316 wrote to memory of 1892 1316 bhnntt.exe hthntt.exe PID 1316 wrote to memory of 1892 1316 bhnntt.exe hthntt.exe PID 1316 wrote to memory of 1892 1316 bhnntt.exe hthntt.exe PID 1892 wrote to memory of 2564 1892 hthntt.exe tnttbb.exe PID 1892 wrote to memory of 2564 1892 hthntt.exe tnttbb.exe PID 1892 wrote to memory of 2564 1892 hthntt.exe tnttbb.exe PID 1892 wrote to memory of 2564 1892 hthntt.exe tnttbb.exe PID 2564 wrote to memory of 1772 2564 tnttbb.exe pdjdv.exe PID 2564 wrote to memory of 1772 2564 tnttbb.exe pdjdv.exe PID 2564 wrote to memory of 1772 2564 tnttbb.exe pdjdv.exe PID 2564 wrote to memory of 1772 2564 tnttbb.exe pdjdv.exe PID 1772 wrote to memory of 1824 1772 pdjdv.exe 3pddd.exe PID 1772 wrote to memory of 1824 1772 pdjdv.exe 3pddd.exe PID 1772 wrote to memory of 1824 1772 pdjdv.exe 3pddd.exe PID 1772 wrote to memory of 1824 1772 pdjdv.exe 3pddd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54f39aebde61f67e7bdbe44c82ca08393c61e4048f097749d1bd37a332a7acc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\54f39aebde61f67e7bdbe44c82ca08393c61e4048f097749d1bd37a332a7acc0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\1dpvj.exec:\1dpvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\lxlrrrr.exec:\lxlrrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\7flffxf.exec:\7flffxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\1lxlrfl.exec:\1lxlrfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\nthnhb.exec:\nthnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\hnhhnb.exec:\hnhhnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\pdpjv.exec:\pdpjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\1pjvv.exec:\1pjvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\3lxllfl.exec:\3lxllfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\xlffxrx.exec:\xlffxrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:356 -
\??\c:\xlrlrlx.exec:\xlrlrlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\bhnntt.exec:\bhnntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\hthntt.exec:\hthntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\tnttbb.exec:\tnttbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\pdjdv.exec:\pdjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\vjvvv.exec:\vjvvv.exe17⤵
- Executes dropped EXE
PID:1824 -
\??\c:\5fllrll.exec:\5fllrll.exe18⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xlxrfff.exec:\xlxrfff.exe19⤵
- Executes dropped EXE
PID:840 -
\??\c:\rxlffxl.exec:\rxlffxl.exe20⤵
- Executes dropped EXE
PID:2560 -
\??\c:\7lfffrr.exec:\7lfffrr.exe21⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nbhbbt.exec:\nbhbbt.exe22⤵
- Executes dropped EXE
PID:2656 -
\??\c:\bnbbbb.exec:\bnbbbb.exe23⤵
- Executes dropped EXE
PID:596 -
\??\c:\9dppp.exec:\9dppp.exe24⤵
- Executes dropped EXE
PID:1512 -
\??\c:\dpjvp.exec:\dpjvp.exe25⤵
- Executes dropped EXE
PID:1836 -
\??\c:\jpvvd.exec:\jpvvd.exe26⤵
- Executes dropped EXE
PID:2432 -
\??\c:\3frlrll.exec:\3frlrll.exe27⤵
- Executes dropped EXE
PID:1064 -
\??\c:\9bhhhh.exec:\9bhhhh.exe28⤵
- Executes dropped EXE
PID:564 -
\??\c:\thtntn.exec:\thtntn.exe29⤵
- Executes dropped EXE
PID:1284 -
\??\c:\vjppv.exec:\vjppv.exe30⤵
- Executes dropped EXE
PID:816 -
\??\c:\pdpvd.exec:\pdpvd.exe31⤵
- Executes dropped EXE
PID:2056 -
\??\c:\fxlxxxf.exec:\fxlxxxf.exe32⤵
- Executes dropped EXE
PID:1332 -
\??\c:\xflfxrx.exec:\xflfxrx.exe33⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xrlllrx.exec:\xrlllrx.exe34⤵
- Executes dropped EXE
PID:1592 -
\??\c:\bnnhnh.exec:\bnnhnh.exe35⤵
- Executes dropped EXE
PID:2972 -
\??\c:\htbthb.exec:\htbthb.exe36⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9jvpd.exec:\9jvpd.exe37⤵
- Executes dropped EXE
PID:2572 -
\??\c:\pdjdj.exec:\pdjdj.exe38⤵
- Executes dropped EXE
PID:2500 -
\??\c:\3lxxxrr.exec:\3lxxxrr.exe39⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lfxffll.exec:\lfxffll.exe40⤵
- Executes dropped EXE
PID:2400 -
\??\c:\llxrxrf.exec:\llxrxrf.exe41⤵
- Executes dropped EXE
PID:2488 -
\??\c:\thhbtt.exec:\thhbtt.exe42⤵
- Executes dropped EXE
PID:1736 -
\??\c:\3tnttn.exec:\3tnttn.exe43⤵
- Executes dropped EXE
PID:2428 -
\??\c:\9thbhh.exec:\9thbhh.exe44⤵
- Executes dropped EXE
PID:2700 -
\??\c:\5jppj.exec:\5jppj.exe45⤵
- Executes dropped EXE
PID:1468 -
\??\c:\jjvjd.exec:\jjvjd.exe46⤵
- Executes dropped EXE
PID:2520 -
\??\c:\frllrrf.exec:\frllrrf.exe47⤵
- Executes dropped EXE
PID:1856 -
\??\c:\7xrxxxf.exec:\7xrxxxf.exe48⤵
- Executes dropped EXE
PID:1988 -
\??\c:\hbthtt.exec:\hbthtt.exe49⤵
- Executes dropped EXE
PID:2384 -
\??\c:\bthbtt.exec:\bthbtt.exe50⤵
- Executes dropped EXE
PID:2392 -
\??\c:\7btnbb.exec:\7btnbb.exe51⤵
- Executes dropped EXE
PID:360 -
\??\c:\3pddd.exec:\3pddd.exe52⤵
- Executes dropped EXE
PID:1824 -
\??\c:\9lrxrlx.exec:\9lrxrlx.exe53⤵
- Executes dropped EXE
PID:1344 -
\??\c:\tnbbbt.exec:\tnbbbt.exe54⤵
- Executes dropped EXE
PID:884 -
\??\c:\htnntt.exec:\htnntt.exe55⤵
- Executes dropped EXE
PID:1676 -
\??\c:\rlxffxf.exec:\rlxffxf.exe56⤵
- Executes dropped EXE
PID:1348 -
\??\c:\bhntbn.exec:\bhntbn.exe57⤵
- Executes dropped EXE
PID:2276 -
\??\c:\pdjjj.exec:\pdjjj.exe58⤵
- Executes dropped EXE
PID:2656 -
\??\c:\frxlllr.exec:\frxlllr.exe59⤵
- Executes dropped EXE
PID:1504 -
\??\c:\1nbhbh.exec:\1nbhbh.exe60⤵
- Executes dropped EXE
PID:552 -
\??\c:\bnbbbb.exec:\bnbbbb.exe61⤵
- Executes dropped EXE
PID:1036 -
\??\c:\lllxxlx.exec:\lllxxlx.exe62⤵
- Executes dropped EXE
PID:1720 -
\??\c:\7rrrrlr.exec:\7rrrrlr.exe63⤵
- Executes dropped EXE
PID:968 -
\??\c:\ttnnhh.exec:\ttnnhh.exe64⤵
- Executes dropped EXE
PID:324 -
\??\c:\jdvdp.exec:\jdvdp.exe65⤵
- Executes dropped EXE
PID:1048 -
\??\c:\pjvvj.exec:\pjvvj.exe66⤵PID:2060
-
\??\c:\xrffrrx.exec:\xrffrrx.exe67⤵PID:1956
-
\??\c:\7btbnn.exec:\7btbnn.exe68⤵PID:1004
-
\??\c:\pjdjj.exec:\pjdjj.exe69⤵PID:1524
-
\??\c:\jjvpp.exec:\jjvpp.exe70⤵PID:2056
-
\??\c:\llffflr.exec:\llffflr.exe71⤵PID:2148
-
\??\c:\lffffxf.exec:\lffffxf.exe72⤵PID:1620
-
\??\c:\thnnnh.exec:\thnnnh.exe73⤵PID:2976
-
\??\c:\7hnbtn.exec:\7hnbtn.exe74⤵PID:2588
-
\??\c:\vpvvd.exec:\vpvvd.exe75⤵PID:2716
-
\??\c:\3dppp.exec:\3dppp.exe76⤵PID:2712
-
\??\c:\rrrfrlf.exec:\rrrfrlf.exe77⤵PID:1764
-
\??\c:\ffxrlrx.exec:\ffxrlrx.exe78⤵PID:2980
-
\??\c:\nnhtbh.exec:\nnhtbh.exe79⤵PID:2600
-
\??\c:\7tnttb.exec:\7tnttb.exe80⤵PID:2952
-
\??\c:\jvvpp.exec:\jvvpp.exe81⤵PID:2400
-
\??\c:\9vdpp.exec:\9vdpp.exe82⤵PID:2488
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe83⤵PID:2612
-
\??\c:\lfrxffl.exec:\lfrxffl.exe84⤵PID:2340
-
\??\c:\hhnttt.exec:\hhnttt.exe85⤵PID:1464
-
\??\c:\vvjpp.exec:\vvjpp.exe86⤵PID:1640
-
\??\c:\dvdpj.exec:\dvdpj.exe87⤵PID:1032
-
\??\c:\xrffllr.exec:\xrffllr.exe88⤵PID:1868
-
\??\c:\xxrflxl.exec:\xxrflxl.exe89⤵PID:2376
-
\??\c:\9bnthn.exec:\9bnthn.exe90⤵PID:2396
-
\??\c:\3htthn.exec:\3htthn.exe91⤵PID:800
-
\??\c:\pjvjv.exec:\pjvjv.exe92⤵PID:1520
-
\??\c:\dpddj.exec:\dpddj.exe93⤵PID:1756
-
\??\c:\dvvvv.exec:\dvvvv.exe94⤵PID:2100
-
\??\c:\7rxfxfr.exec:\7rxfxfr.exe95⤵PID:2088
-
\??\c:\bbbhbb.exec:\bbbhbb.exe96⤵PID:2172
-
\??\c:\nbhhbb.exec:\nbhhbb.exe97⤵PID:2444
-
\??\c:\dpdvj.exec:\dpdvj.exe98⤵PID:2064
-
\??\c:\ppdvj.exec:\ppdvj.exe99⤵PID:776
-
\??\c:\3frlrrf.exec:\3frlrrf.exe100⤵PID:588
-
\??\c:\5tntht.exec:\5tntht.exe101⤵PID:2536
-
\??\c:\ttnbhh.exec:\ttnbhh.exe102⤵PID:1840
-
\??\c:\9vvdd.exec:\9vvdd.exe103⤵PID:1104
-
\??\c:\7ddjj.exec:\7ddjj.exe104⤵PID:1828
-
\??\c:\7lrxffr.exec:\7lrxffr.exe105⤵PID:112
-
\??\c:\xxrxfrf.exec:\xxrxfrf.exe106⤵PID:576
-
\??\c:\nhttbb.exec:\nhttbb.exe107⤵PID:2256
-
\??\c:\thbhtt.exec:\thbhtt.exe108⤵PID:2288
-
\??\c:\1vdjp.exec:\1vdjp.exe109⤵PID:1744
-
\??\c:\pjvvv.exec:\pjvvv.exe110⤵PID:964
-
\??\c:\xrflxxf.exec:\xrflxxf.exe111⤵PID:2024
-
\??\c:\frffflx.exec:\frffflx.exe112⤵PID:1740
-
\??\c:\5nhbbb.exec:\5nhbbb.exe113⤵PID:1728
-
\??\c:\3hhtbb.exec:\3hhtbb.exe114⤵PID:2608
-
\??\c:\bthnhn.exec:\bthnhn.exe115⤵PID:2604
-
\??\c:\1pdvv.exec:\1pdvv.exe116⤵PID:2960
-
\??\c:\dvpdp.exec:\dvpdp.exe117⤵PID:2792
-
\??\c:\7lrrffx.exec:\7lrrffx.exe118⤵PID:2644
-
\??\c:\5lfflrx.exec:\5lfflrx.exe119⤵PID:2492
-
\??\c:\hbtttt.exec:\hbtttt.exe120⤵PID:2592
-
\??\c:\nbnhhn.exec:\nbnhhn.exe121⤵PID:2484
-
\??\c:\ddpvv.exec:\ddpvv.exe122⤵PID:2464
-
\??\c:\7dpvv.exec:\7dpvv.exe123⤵PID:1876
-
\??\c:\3ffflrf.exec:\3ffflrf.exe124⤵PID:2728
-
\??\c:\xlxxfxx.exec:\xlxxfxx.exe125⤵PID:1672
-
\??\c:\tntthb.exec:\tntthb.exe126⤵PID:2532
-
\??\c:\pjvvj.exec:\pjvvj.exe127⤵PID:1604
-
\??\c:\vpjjv.exec:\vpjjv.exe128⤵PID:2724
-
\??\c:\vvdvd.exec:\vvdvd.exe129⤵PID:312
-
\??\c:\ffrxflr.exec:\ffrxflr.exe130⤵PID:1980
-
\??\c:\3nbbbt.exec:\3nbbbt.exe131⤵PID:1816
-
\??\c:\7nnthb.exec:\7nnthb.exe132⤵PID:2372
-
\??\c:\5dvjp.exec:\5dvjp.exe133⤵PID:1580
-
\??\c:\vpdjp.exec:\vpdjp.exe134⤵PID:1532
-
\??\c:\frffxfl.exec:\frffxfl.exe135⤵PID:1780
-
\??\c:\lflrxfl.exec:\lflrxfl.exe136⤵PID:2812
-
\??\c:\lxffffl.exec:\lxffffl.exe137⤵PID:1760
-
\??\c:\nhbbtt.exec:\nhbbtt.exe138⤵PID:1852
-
\??\c:\jjvvv.exec:\jjvvv.exe139⤵PID:2276
-
\??\c:\9pdjp.exec:\9pdjp.exe140⤵PID:1664
-
\??\c:\vppvp.exec:\vppvp.exe141⤵PID:1504
-
\??\c:\rrfxffr.exec:\rrfxffr.exe142⤵PID:1804
-
\??\c:\1lxfllf.exec:\1lxfllf.exe143⤵PID:2884
-
\??\c:\bnbbnn.exec:\bnbbnn.exe144⤵PID:1796
-
\??\c:\1hhnbb.exec:\1hhnbb.exe145⤵PID:324
-
\??\c:\pjdpv.exec:\pjdpv.exe146⤵PID:2008
-
\??\c:\9jdjp.exec:\9jdjp.exe147⤵PID:564
-
\??\c:\xxlrrrr.exec:\xxlrrrr.exe148⤵PID:2060
-
\??\c:\thnnbb.exec:\thnnbb.exe149⤵PID:880
-
\??\c:\ppdjp.exec:\ppdjp.exe150⤵PID:2292
-
\??\c:\vvdjv.exec:\vvdjv.exe151⤵PID:1528
-
\??\c:\vpdjj.exec:\vpdjj.exe152⤵PID:3044
-
\??\c:\lfllrlr.exec:\lfllrlr.exe153⤵PID:3048
-
\??\c:\7llrxlr.exec:\7llrxlr.exe154⤵PID:2672
-
\??\c:\ntbhhn.exec:\ntbhhn.exe155⤵PID:2976
-
\??\c:\tthhtn.exec:\tthhtn.exe156⤵PID:2344
-
\??\c:\dvjjj.exec:\dvjjj.exe157⤵PID:2752
-
\??\c:\ppjjv.exec:\ppjjv.exe158⤵PID:2668
-
\??\c:\llxfffl.exec:\llxfffl.exe159⤵PID:2920
-
\??\c:\rfrxxfl.exec:\rfrxxfl.exe160⤵PID:2576
-
\??\c:\1bnnnt.exec:\1bnnnt.exe161⤵PID:2600
-
\??\c:\bbtbht.exec:\bbtbht.exe162⤵PID:2952
-
\??\c:\7vppp.exec:\7vppp.exe163⤵PID:2400
-
\??\c:\vpvvp.exec:\vpvvp.exe164⤵PID:2864
-
\??\c:\lfrxxlr.exec:\lfrxxlr.exe165⤵PID:2428
-
\??\c:\lfrxllr.exec:\lfrxllr.exe166⤵PID:2420
-
\??\c:\fxrrxrf.exec:\fxrrxrf.exe167⤵PID:1468
-
\??\c:\1btbhh.exec:\1btbhh.exe168⤵PID:1360
-
\??\c:\nhhnnn.exec:\nhhnnn.exe169⤵PID:1856
-
\??\c:\vpvjv.exec:\vpvjv.exe170⤵PID:2584
-
\??\c:\vpvpv.exec:\vpvpv.exe171⤵PID:924
-
\??\c:\llflxxr.exec:\llflxxr.exe172⤵PID:1704
-
\??\c:\xrfllrf.exec:\xrfllrf.exe173⤵PID:360
-
\??\c:\9rflrrf.exec:\9rflrrf.exe174⤵PID:1448
-
\??\c:\btbnbb.exec:\btbnbb.exe175⤵PID:1208
-
\??\c:\ppddp.exec:\ppddp.exe176⤵PID:884
-
\??\c:\vvjjj.exec:\vvjjj.exe177⤵PID:1452
-
\??\c:\pdppj.exec:\pdppj.exe178⤵PID:1172
-
\??\c:\xlxxfxl.exec:\xlxxfxl.exe179⤵PID:704
-
\??\c:\rlflxfl.exec:\rlflxfl.exe180⤵PID:2064
-
\??\c:\hbbbhh.exec:\hbbbhh.exe181⤵PID:676
-
\??\c:\hbhhtb.exec:\hbhhtb.exe182⤵PID:588
-
\??\c:\1pdjp.exec:\1pdjp.exe183⤵PID:2080
-
\??\c:\jvdjv.exec:\jvdjv.exe184⤵PID:1720
-
\??\c:\fxlrrxf.exec:\fxlrrxf.exe185⤵PID:2788
-
\??\c:\5xxxlff.exec:\5xxxlff.exe186⤵PID:2296
-
\??\c:\nbhhnt.exec:\nbhhnt.exe187⤵PID:2836
-
\??\c:\ttbhth.exec:\ttbhth.exe188⤵PID:1388
-
\??\c:\jjppv.exec:\jjppv.exe189⤵PID:1144
-
\??\c:\jjvpv.exec:\jjvpv.exe190⤵PID:2848
-
\??\c:\ffxfflx.exec:\ffxfflx.exe191⤵PID:1744
-
\??\c:\9xfflfr.exec:\9xfflfr.exe192⤵PID:2192
-
\??\c:\btbhhn.exec:\btbhhn.exe193⤵PID:2024
-
\??\c:\5bnnnh.exec:\5bnnnh.exe194⤵PID:2264
-
\??\c:\dppvj.exec:\dppvj.exe195⤵PID:2200
-
\??\c:\9pjjj.exec:\9pjjj.exe196⤵PID:2684
-
\??\c:\1rrlllr.exec:\1rrlllr.exe197⤵PID:2796
-
\??\c:\xlfxfxf.exec:\xlfxfxf.exe198⤵PID:2712
-
\??\c:\tnhbbh.exec:\tnhbbh.exe199⤵PID:2616
-
\??\c:\tnbhtn.exec:\tnbhtn.exe200⤵PID:2568
-
\??\c:\1pddd.exec:\1pddd.exe201⤵PID:2460
-
\??\c:\9jdvv.exec:\9jdvv.exe202⤵PID:2636
-
\??\c:\rfrrrxx.exec:\rfrrrxx.exe203⤵PID:2756
-
\??\c:\xrllrrr.exec:\xrllrrr.exe204⤵PID:3028
-
\??\c:\hbthnn.exec:\hbthnn.exe205⤵PID:1736
-
\??\c:\thntbb.exec:\thntbb.exe206⤵PID:1700
-
\??\c:\7jdjj.exec:\7jdjj.exe207⤵PID:1672
-
\??\c:\vpjpj.exec:\vpjpj.exe208⤵PID:2720
-
\??\c:\9xxxffr.exec:\9xxxffr.exe209⤵PID:2332
-
\??\c:\nhnhtb.exec:\nhnhtb.exe210⤵PID:2496
-
\??\c:\thnthn.exec:\thnthn.exe211⤵PID:2564
-
\??\c:\tnhhtn.exec:\tnhhtn.exe212⤵PID:1808
-
\??\c:\vvjvd.exec:\vvjvd.exe213⤵PID:2348
-
\??\c:\bthntt.exec:\bthntt.exe214⤵PID:3032
-
\??\c:\dddpp.exec:\dddpp.exe215⤵PID:1660
-
\??\c:\pjppj.exec:\pjppj.exe216⤵PID:2112
-
\??\c:\1rfxxrx.exec:\1rfxxrx.exe217⤵PID:1344
-
\??\c:\xrlrflx.exec:\xrlrflx.exe218⤵PID:2812
-
\??\c:\bnttbt.exec:\bnttbt.exe219⤵PID:536
-
\??\c:\3djvd.exec:\3djvd.exe220⤵PID:1852
-
\??\c:\pjppp.exec:\pjppp.exe221⤵PID:596
-
\??\c:\fxfxfxx.exec:\fxfxfxx.exe222⤵PID:2064
-
\??\c:\3lrlfrr.exec:\3lrlfrr.exe223⤵PID:1500
-
\??\c:\ntnnnh.exec:\ntnnnh.exe224⤵PID:1804
-
\??\c:\ntbhbb.exec:\ntbhbb.exe225⤵PID:2224
-
\??\c:\dpvvj.exec:\dpvvj.exe226⤵PID:2436
-
\??\c:\jvvvd.exec:\jvvvd.exe227⤵PID:812
-
\??\c:\pvvpv.exec:\pvvpv.exe228⤵PID:1952
-
\??\c:\xrrffxx.exec:\xrrffxx.exe229⤵PID:2912
-
\??\c:\xlrflff.exec:\xlrflff.exe230⤵PID:1388
-
\??\c:\htbhbt.exec:\htbhbt.exe231⤵PID:640
-
\??\c:\nbhntn.exec:\nbhntn.exe232⤵PID:2292
-
\??\c:\jvdvd.exec:\jvdvd.exe233⤵PID:1528
-
\??\c:\pjvvd.exec:\pjvvd.exe234⤵PID:3044
-
\??\c:\rrxrrrx.exec:\rrxrrrx.exe235⤵PID:3040
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe236⤵PID:2972
-
\??\c:\5httbt.exec:\5httbt.exe237⤵PID:2204
-
\??\c:\tnnntb.exec:\tnnntb.exe238⤵PID:2684
-
\??\c:\tnhbtn.exec:\tnhbtn.exe239⤵PID:2752
-
\??\c:\9jpjj.exec:\9jpjj.exe240⤵PID:2572
-
\??\c:\xrxrxrx.exec:\xrxrxrx.exe241⤵PID:2500
-