Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 22:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4c7b9aec4547d7e858ebde38c1491130_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4c7b9aec4547d7e858ebde38c1491130_NeikiAnalytics.exe
-
Size
64KB
-
MD5
4c7b9aec4547d7e858ebde38c1491130
-
SHA1
9cd01457ffd108ed7a1ba5c5f1319b8a595a04f8
-
SHA256
7af6da8924a2e27bbef8ee624acbbe5d44eae03af5c390e7ff76c07b2ef7915a
-
SHA512
6f8b1a078e4de0a0e9b49db27754e7e29ba2368069b1805ee05b303a27a4da7ede6e168499fc8bfbb58d6e3cdef441d23d7a9f1f20309d3bd74730b851ab06ad
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJULh12u:ymb3NkkiQ3mdBjFIFdJmp
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/3468-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3048-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/620-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3624-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/724-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-13-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rfrfxxr.exenhhhtt.exetbhhbb.exevjdjp.exejdvvp.exerxffxrl.exeffffxff.exennnnhh.exentbhtn.exevvvjp.exedvddj.exelxffxxx.exenbhhbb.exettbttb.exevpvvv.exellffllx.exe3flfffx.exenbhbtn.exenhhbtb.exevjppd.exepdvdj.exerxfffll.exe9hnhhb.exehbtbht.exevjdvp.exe7djdv.exexrfxxxf.exe5flfxxl.exenbttbn.exehthbnh.exevjvdj.exefflrllf.exeflxlfxf.exenbbnhb.exepvdjj.exedddpd.exe9flffrr.exefrrrlff.exebthhbt.exehnnbtn.exevjpdj.exedvdvp.exerflfxrr.exe3rlfxfx.exetnbtnn.exe3hhhhn.exe3vjdp.exevpvpv.exelflflfr.exexlxxfff.exetbbnht.exenhnbtn.exepjjdv.exefxrlrlx.exerfxrllx.exebhhhtt.exentnhbt.exedvvdp.exerxxrllf.exe5rfxfll.exehtbnhb.exejdvvp.exeddjvv.exexfrrffr.exepid process 3852 rfrfxxr.exe 724 nhhhtt.exe 3468 tbhhbb.exe 3624 vjdjp.exe 3048 jdvvp.exe 2392 rxffxrl.exe 4596 ffffxff.exe 3880 nnnnhh.exe 1088 ntbhtn.exe 5004 vvvjp.exe 2328 dvddj.exe 620 lxffxxx.exe 4268 nbhhbb.exe 4100 ttbttb.exe 4352 vpvvv.exe 4880 llffllx.exe 1776 3flfffx.exe 752 nbhbtn.exe 2476 nhhbtb.exe 2920 vjppd.exe 4992 pdvdj.exe 728 rxfffll.exe 4672 9hnhhb.exe 4860 hbtbht.exe 3420 vjdvp.exe 3084 7djdv.exe 3628 xrfxxxf.exe 4852 5flfxxl.exe 3696 nbttbn.exe 3920 hthbnh.exe 1628 vjvdj.exe 4196 fflrllf.exe 4524 flxlfxf.exe 4584 nbbnhb.exe 2804 pvdjj.exe 1956 dddpd.exe 4480 9flffrr.exe 1660 frrrlff.exe 3684 bthhbt.exe 3940 hnnbtn.exe 1332 vjpdj.exe 1436 dvdvp.exe 4604 rflfxrr.exe 1012 3rlfxfx.exe 3880 tnbtnn.exe 4428 3hhhhn.exe 1408 3vjdp.exe 1476 vpvpv.exe 4484 lflflfr.exe 4708 xlxxfff.exe 4920 tbbnht.exe 1940 nhnbtn.exe 1392 pjjdv.exe 744 fxrlrlx.exe 3776 rfxrllx.exe 1156 bhhhtt.exe 1100 ntnhbt.exe 3620 dvvdp.exe 1412 rxxrllf.exe 5100 5rfxfll.exe 1900 htbnhb.exe 852 jdvvp.exe 4908 ddjvv.exe 3496 xfrrffr.exe -
Processes:
resource yara_rule behavioral2/memory/3468-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/620-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3624-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3624-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3624-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3624-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/724-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4c7b9aec4547d7e858ebde38c1491130_NeikiAnalytics.exerfrfxxr.exenhhhtt.exetbhhbb.exevjdjp.exejdvvp.exerxffxrl.exeffffxff.exennnnhh.exentbhtn.exevvvjp.exedvddj.exelxffxxx.exenbhhbb.exettbttb.exevpvvv.exellffllx.exe3flfffx.exenbhbtn.exenhhbtb.exevjppd.exepdvdj.exedescription pid process target process PID 3328 wrote to memory of 3852 3328 4c7b9aec4547d7e858ebde38c1491130_NeikiAnalytics.exe rfrfxxr.exe PID 3328 wrote to memory of 3852 3328 4c7b9aec4547d7e858ebde38c1491130_NeikiAnalytics.exe rfrfxxr.exe PID 3328 wrote to memory of 3852 3328 4c7b9aec4547d7e858ebde38c1491130_NeikiAnalytics.exe rfrfxxr.exe PID 3852 wrote to memory of 724 3852 rfrfxxr.exe nhhhtt.exe PID 3852 wrote to memory of 724 3852 rfrfxxr.exe nhhhtt.exe PID 3852 wrote to memory of 724 3852 rfrfxxr.exe nhhhtt.exe PID 724 wrote to memory of 3468 724 nhhhtt.exe tbhhbb.exe PID 724 wrote to memory of 3468 724 nhhhtt.exe tbhhbb.exe PID 724 wrote to memory of 3468 724 nhhhtt.exe tbhhbb.exe PID 3468 wrote to memory of 3624 3468 tbhhbb.exe vjdjp.exe PID 3468 wrote to memory of 3624 3468 tbhhbb.exe vjdjp.exe PID 3468 wrote to memory of 3624 3468 tbhhbb.exe vjdjp.exe PID 3624 wrote to memory of 3048 3624 vjdjp.exe jdvvp.exe PID 3624 wrote to memory of 3048 3624 vjdjp.exe jdvvp.exe PID 3624 wrote to memory of 3048 3624 vjdjp.exe jdvvp.exe PID 3048 wrote to memory of 2392 3048 jdvvp.exe rxffxrl.exe PID 3048 wrote to memory of 2392 3048 jdvvp.exe rxffxrl.exe PID 3048 wrote to memory of 2392 3048 jdvvp.exe rxffxrl.exe PID 2392 wrote to memory of 4596 2392 rxffxrl.exe ffffxff.exe PID 2392 wrote to memory of 4596 2392 rxffxrl.exe ffffxff.exe PID 2392 wrote to memory of 4596 2392 rxffxrl.exe ffffxff.exe PID 4596 wrote to memory of 3880 4596 ffffxff.exe nnnnhh.exe PID 4596 wrote to memory of 3880 4596 ffffxff.exe nnnnhh.exe PID 4596 wrote to memory of 3880 4596 ffffxff.exe nnnnhh.exe PID 3880 wrote to memory of 1088 3880 nnnnhh.exe ntbhtn.exe PID 3880 wrote to memory of 1088 3880 nnnnhh.exe ntbhtn.exe PID 3880 wrote to memory of 1088 3880 nnnnhh.exe ntbhtn.exe PID 1088 wrote to memory of 5004 1088 ntbhtn.exe vvvjp.exe PID 1088 wrote to memory of 5004 1088 ntbhtn.exe vvvjp.exe PID 1088 wrote to memory of 5004 1088 ntbhtn.exe vvvjp.exe PID 5004 wrote to memory of 2328 5004 vvvjp.exe dvddj.exe PID 5004 wrote to memory of 2328 5004 vvvjp.exe dvddj.exe PID 5004 wrote to memory of 2328 5004 vvvjp.exe dvddj.exe PID 2328 wrote to memory of 620 2328 dvddj.exe lxffxxx.exe PID 2328 wrote to memory of 620 2328 dvddj.exe lxffxxx.exe PID 2328 wrote to memory of 620 2328 dvddj.exe lxffxxx.exe PID 620 wrote to memory of 4268 620 lxffxxx.exe nbhhbb.exe PID 620 wrote to memory of 4268 620 lxffxxx.exe nbhhbb.exe PID 620 wrote to memory of 4268 620 lxffxxx.exe nbhhbb.exe PID 4268 wrote to memory of 4100 4268 nbhhbb.exe ttbttb.exe PID 4268 wrote to memory of 4100 4268 nbhhbb.exe ttbttb.exe PID 4268 wrote to memory of 4100 4268 nbhhbb.exe ttbttb.exe PID 4100 wrote to memory of 4352 4100 ttbttb.exe vpvvv.exe PID 4100 wrote to memory of 4352 4100 ttbttb.exe vpvvv.exe PID 4100 wrote to memory of 4352 4100 ttbttb.exe vpvvv.exe PID 4352 wrote to memory of 4880 4352 vpvvv.exe llffllx.exe PID 4352 wrote to memory of 4880 4352 vpvvv.exe llffllx.exe PID 4352 wrote to memory of 4880 4352 vpvvv.exe llffllx.exe PID 4880 wrote to memory of 1776 4880 llffllx.exe 3flfffx.exe PID 4880 wrote to memory of 1776 4880 llffllx.exe 3flfffx.exe PID 4880 wrote to memory of 1776 4880 llffllx.exe 3flfffx.exe PID 1776 wrote to memory of 752 1776 3flfffx.exe nbhbtn.exe PID 1776 wrote to memory of 752 1776 3flfffx.exe nbhbtn.exe PID 1776 wrote to memory of 752 1776 3flfffx.exe nbhbtn.exe PID 752 wrote to memory of 2476 752 nbhbtn.exe nhhbtb.exe PID 752 wrote to memory of 2476 752 nbhbtn.exe nhhbtb.exe PID 752 wrote to memory of 2476 752 nbhbtn.exe nhhbtb.exe PID 2476 wrote to memory of 2920 2476 nhhbtb.exe vjppd.exe PID 2476 wrote to memory of 2920 2476 nhhbtb.exe vjppd.exe PID 2476 wrote to memory of 2920 2476 nhhbtb.exe vjppd.exe PID 2920 wrote to memory of 4992 2920 vjppd.exe pdvdj.exe PID 2920 wrote to memory of 4992 2920 vjppd.exe pdvdj.exe PID 2920 wrote to memory of 4992 2920 vjppd.exe pdvdj.exe PID 4992 wrote to memory of 728 4992 pdvdj.exe rxfffll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\437850118\zmstage.exeC:\Users\Admin\AppData\Local\Temp\437850118\zmstage.exe1⤵PID:612
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\4c7b9aec4547d7e858ebde38c1491130_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4c7b9aec4547d7e858ebde38c1491130_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\rfrfxxr.exec:\rfrfxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\nhhhtt.exec:\nhhhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
\??\c:\tbhhbb.exec:\tbhhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\vjdjp.exec:\vjdjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\jdvvp.exec:\jdvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\rxffxrl.exec:\rxffxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\ffffxff.exec:\ffffxff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\nnnnhh.exec:\nnnnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\ntbhtn.exec:\ntbhtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\vvvjp.exec:\vvvjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\dvddj.exec:\dvddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\lxffxxx.exec:\lxffxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\nbhhbb.exec:\nbhhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\ttbttb.exec:\ttbttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\vpvvv.exec:\vpvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\llffllx.exec:\llffllx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\3flfffx.exec:\3flfffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\nbhbtn.exec:\nbhbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\nhhbtb.exec:\nhhbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\vjppd.exec:\vjppd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\pdvdj.exec:\pdvdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\rxfffll.exec:\rxfffll.exe23⤵
- Executes dropped EXE
PID:728 -
\??\c:\9hnhhb.exec:\9hnhhb.exe24⤵
- Executes dropped EXE
PID:4672 -
\??\c:\hbtbht.exec:\hbtbht.exe25⤵
- Executes dropped EXE
PID:4860 -
\??\c:\vjdvp.exec:\vjdvp.exe26⤵
- Executes dropped EXE
PID:3420 -
\??\c:\7djdv.exec:\7djdv.exe27⤵
- Executes dropped EXE
PID:3084 -
\??\c:\xrfxxxf.exec:\xrfxxxf.exe28⤵
- Executes dropped EXE
PID:3628 -
\??\c:\5flfxxl.exec:\5flfxxl.exe29⤵
- Executes dropped EXE
PID:4852 -
\??\c:\nbttbn.exec:\nbttbn.exe30⤵
- Executes dropped EXE
PID:3696 -
\??\c:\hthbnh.exec:\hthbnh.exe31⤵
- Executes dropped EXE
PID:3920 -
\??\c:\vjvdj.exec:\vjvdj.exe32⤵
- Executes dropped EXE
PID:1628 -
\??\c:\fflrllf.exec:\fflrllf.exe33⤵
- Executes dropped EXE
PID:4196 -
\??\c:\flxlfxf.exec:\flxlfxf.exe34⤵
- Executes dropped EXE
PID:4524 -
\??\c:\nbbnhb.exec:\nbbnhb.exe35⤵
- Executes dropped EXE
PID:4584 -
\??\c:\pvdjj.exec:\pvdjj.exe36⤵
- Executes dropped EXE
PID:2804 -
\??\c:\dddpd.exec:\dddpd.exe37⤵
- Executes dropped EXE
PID:1956 -
\??\c:\9flffrr.exec:\9flffrr.exe38⤵
- Executes dropped EXE
PID:4480 -
\??\c:\frrrlff.exec:\frrrlff.exe39⤵
- Executes dropped EXE
PID:1660 -
\??\c:\bthhbt.exec:\bthhbt.exe40⤵
- Executes dropped EXE
PID:3684 -
\??\c:\hnnbtn.exec:\hnnbtn.exe41⤵
- Executes dropped EXE
PID:3940 -
\??\c:\vjpdj.exec:\vjpdj.exe42⤵
- Executes dropped EXE
PID:1332 -
\??\c:\dvdvp.exec:\dvdvp.exe43⤵
- Executes dropped EXE
PID:1436 -
\??\c:\rflfxrr.exec:\rflfxrr.exe44⤵
- Executes dropped EXE
PID:4604 -
\??\c:\3rlfxfx.exec:\3rlfxfx.exe45⤵
- Executes dropped EXE
PID:1012 -
\??\c:\tnbtnn.exec:\tnbtnn.exe46⤵
- Executes dropped EXE
PID:3880 -
\??\c:\3hhhhn.exec:\3hhhhn.exe47⤵
- Executes dropped EXE
PID:4428 -
\??\c:\3vjdp.exec:\3vjdp.exe48⤵
- Executes dropped EXE
PID:1408 -
\??\c:\vpvpv.exec:\vpvpv.exe49⤵
- Executes dropped EXE
PID:1476 -
\??\c:\lflflfr.exec:\lflflfr.exe50⤵
- Executes dropped EXE
PID:4484 -
\??\c:\xlxxfff.exec:\xlxxfff.exe51⤵
- Executes dropped EXE
PID:4708 -
\??\c:\tbbnht.exec:\tbbnht.exe52⤵
- Executes dropped EXE
PID:4920 -
\??\c:\nhnbtn.exec:\nhnbtn.exe53⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pjjdv.exec:\pjjdv.exe54⤵
- Executes dropped EXE
PID:1392 -
\??\c:\fxrlrlx.exec:\fxrlrlx.exe55⤵
- Executes dropped EXE
PID:744 -
\??\c:\rfxrllx.exec:\rfxrllx.exe56⤵
- Executes dropped EXE
PID:3776 -
\??\c:\bhhhtt.exec:\bhhhtt.exe57⤵
- Executes dropped EXE
PID:1156 -
\??\c:\ntnhbt.exec:\ntnhbt.exe58⤵
- Executes dropped EXE
PID:1100 -
\??\c:\dvvdp.exec:\dvvdp.exe59⤵
- Executes dropped EXE
PID:3620 -
\??\c:\rxxrllf.exec:\rxxrllf.exe60⤵
- Executes dropped EXE
PID:1412 -
\??\c:\5rfxfll.exec:\5rfxfll.exe61⤵
- Executes dropped EXE
PID:5100 -
\??\c:\htbnhb.exec:\htbnhb.exe62⤵
- Executes dropped EXE
PID:1900 -
\??\c:\jdvvp.exec:\jdvvp.exe63⤵
- Executes dropped EXE
PID:852 -
\??\c:\ddjvv.exec:\ddjvv.exe64⤵
- Executes dropped EXE
PID:4908 -
\??\c:\xfrrffr.exec:\xfrrffr.exe65⤵
- Executes dropped EXE
PID:3496 -
\??\c:\rflxxrr.exec:\rflxxrr.exe66⤵PID:3848
-
\??\c:\thnnhh.exec:\thnnhh.exe67⤵PID:2584
-
\??\c:\hbbtnn.exec:\hbbtnn.exe68⤵PID:4232
-
\??\c:\5pdpj.exec:\5pdpj.exe69⤵PID:1736
-
\??\c:\jjjjd.exec:\jjjjd.exe70⤵PID:1388
-
\??\c:\fxxrxxl.exec:\fxxrxxl.exe71⤵PID:2824
-
\??\c:\xlxrrll.exec:\xlxrrll.exe72⤵PID:1656
-
\??\c:\nhnhnn.exec:\nhnhnn.exe73⤵PID:4452
-
\??\c:\hhbnth.exec:\hhbnth.exe74⤵PID:5024
-
\??\c:\jjvvp.exec:\jjvvp.exe75⤵PID:2992
-
\??\c:\fllxllf.exec:\fllxllf.exe76⤵PID:216
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe77⤵PID:2144
-
\??\c:\nhbtnn.exec:\nhbtnn.exe78⤵PID:4528
-
\??\c:\nbhbtn.exec:\nbhbtn.exe79⤵PID:2072
-
\??\c:\ppppj.exec:\ppppj.exe80⤵PID:4536
-
\??\c:\ppvpd.exec:\ppvpd.exe81⤵PID:4284
-
\??\c:\fxfxfxf.exec:\fxfxfxf.exe82⤵PID:1668
-
\??\c:\rfrlxrl.exec:\rfrlxrl.exe83⤵PID:1168
-
\??\c:\7nthnn.exec:\7nthnn.exe84⤵PID:1664
-
\??\c:\3btnbn.exec:\3btnbn.exe85⤵PID:3916
-
\??\c:\3ddvp.exec:\3ddvp.exe86⤵PID:4472
-
\??\c:\ffxxffr.exec:\ffxxffr.exe87⤵PID:3940
-
\??\c:\lfflxfl.exec:\lfflxfl.exe88⤵PID:1396
-
\??\c:\tttbnb.exec:\tttbnb.exe89⤵PID:548
-
\??\c:\thhbbb.exec:\thhbbb.exe90⤵PID:4612
-
\??\c:\pdjdj.exec:\pdjdj.exe91⤵PID:2268
-
\??\c:\3jdpj.exec:\3jdpj.exe92⤵PID:4996
-
\??\c:\llrxrrx.exec:\llrxrrx.exe93⤵PID:4192
-
\??\c:\3xfxrrl.exec:\3xfxrrl.exe94⤵PID:2472
-
\??\c:\bnhnhb.exec:\bnhnhb.exe95⤵PID:996
-
\??\c:\jdppv.exec:\jdppv.exe96⤵PID:4484
-
\??\c:\jdpjd.exec:\jdpjd.exe97⤵PID:3840
-
\??\c:\vjppd.exec:\vjppd.exe98⤵PID:512
-
\??\c:\jpvjv.exec:\jpvjv.exe99⤵PID:2148
-
\??\c:\flxlxlr.exec:\flxlxlr.exe100⤵PID:1700
-
\??\c:\frrlfxr.exec:\frrlfxr.exe101⤵PID:4352
-
\??\c:\5bbhhh.exec:\5bbhhh.exe102⤵PID:1256
-
\??\c:\nttbbh.exec:\nttbbh.exe103⤵PID:1648
-
\??\c:\vpddv.exec:\vpddv.exe104⤵PID:4940
-
\??\c:\pjpjv.exec:\pjpjv.exe105⤵PID:1384
-
\??\c:\rllrrfr.exec:\rllrrfr.exe106⤵PID:3444
-
\??\c:\9bhbbb.exec:\9bhbbb.exe107⤵PID:3788
-
\??\c:\btbnhh.exec:\btbnhh.exe108⤵PID:5112
-
\??\c:\djjjd.exec:\djjjd.exe109⤵PID:4908
-
\??\c:\pjppv.exec:\pjppv.exe110⤵PID:2948
-
\??\c:\rllfxxx.exec:\rllfxxx.exe111⤵PID:1948
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe112⤵PID:1920
-
\??\c:\bthbtt.exec:\bthbtt.exe113⤵PID:4224
-
\??\c:\bbtttt.exec:\bbtttt.exe114⤵PID:4016
-
\??\c:\jpdjj.exec:\jpdjj.exe115⤵PID:4696
-
\??\c:\7jjdd.exec:\7jjdd.exe116⤵PID:2824
-
\??\c:\lffxrlx.exec:\lffxrlx.exe117⤵PID:2836
-
\??\c:\lrllfrr.exec:\lrllfrr.exe118⤵PID:3696
-
\??\c:\btnhhb.exec:\btnhhb.exe119⤵PID:4052
-
\??\c:\9tnnnt.exec:\9tnnnt.exe120⤵PID:2992
-
\??\c:\jpvvj.exec:\jpvvj.exe121⤵PID:4832
-
\??\c:\ppppd.exec:\ppppd.exe122⤵PID:856
-
\??\c:\1rfxrrl.exec:\1rfxrrl.exe123⤵PID:1676
-
\??\c:\3rxrlll.exec:\3rxrlll.exe124⤵PID:1508
-
\??\c:\nbhbnh.exec:\nbhbnh.exe125⤵PID:4032
-
\??\c:\bhnhbb.exec:\bhnhbb.exe126⤵PID:2080
-
\??\c:\pjdvj.exec:\pjdvj.exe127⤵PID:4508
-
\??\c:\pjjdp.exec:\pjjdp.exe128⤵PID:2560
-
\??\c:\rrrlxxr.exec:\rrrlxxr.exe129⤵PID:724
-
\??\c:\9hnttb.exec:\9hnttb.exe130⤵PID:4328
-
\??\c:\1vpjp.exec:\1vpjp.exe131⤵PID:3812
-
\??\c:\fxxrffr.exec:\fxxrffr.exe132⤵PID:1332
-
\??\c:\btttnh.exec:\btttnh.exe133⤵PID:2760
-
\??\c:\hnnnhb.exec:\hnnnhb.exe134⤵PID:5000
-
\??\c:\pvvpj.exec:\pvvpj.exe135⤵PID:5016
-
\??\c:\pjpjj.exec:\pjpjj.exe136⤵PID:4240
-
\??\c:\9jjjd.exec:\9jjjd.exe137⤵PID:4192
-
\??\c:\fllfxxr.exec:\fllfxxr.exe138⤵PID:4464
-
\??\c:\lxxfxrl.exec:\lxxfxrl.exe139⤵PID:4708
-
\??\c:\9hnnbt.exec:\9hnnbt.exe140⤵PID:3472
-
\??\c:\hbhhhb.exec:\hbhhhb.exe141⤵PID:512
-
\??\c:\bnttnh.exec:\bnttnh.exe142⤵PID:2616
-
\??\c:\ppddd.exec:\ppddd.exe143⤵PID:720
-
\??\c:\3fxrxrl.exec:\3fxrxrl.exe144⤵PID:1944
-
\??\c:\fxxrllf.exec:\fxxrllf.exe145⤵PID:1256
-
\??\c:\tnbtnh.exec:\tnbtnh.exe146⤵PID:5048
-
\??\c:\jjjvd.exec:\jjjvd.exe147⤵PID:4992
-
\??\c:\vpdvj.exec:\vpdvj.exe148⤵PID:1552
-
\??\c:\rrxxlff.exec:\rrxxlff.exe149⤵PID:1900
-
\??\c:\5ffxxlf.exec:\5ffxxlf.exe150⤵PID:4316
-
\??\c:\nbbtnn.exec:\nbbtnn.exe151⤵PID:4004
-
\??\c:\hbtnbb.exec:\hbtnbb.exe152⤵PID:2948
-
\??\c:\jddvp.exec:\jddvp.exe153⤵PID:1760
-
\??\c:\pvvjv.exec:\pvvjv.exe154⤵PID:4944
-
\??\c:\jdddp.exec:\jdddp.exe155⤵PID:2264
-
\??\c:\rlfxllx.exec:\rlfxllx.exe156⤵PID:3628
-
\??\c:\rrxrlrf.exec:\rrxrlrf.exe157⤵PID:1656
-
\??\c:\bntnnn.exec:\bntnnn.exe158⤵PID:2260
-
\??\c:\hbbtbb.exec:\hbbtbb.exe159⤵PID:3568
-
\??\c:\vjppp.exec:\vjppp.exe160⤵PID:2668
-
\??\c:\dvpjj.exec:\dvpjj.exe161⤵PID:3504
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe162⤵PID:612
-
\??\c:\xrrrlll.exec:\xrrrlll.exe163⤵PID:4584
-
\??\c:\bhbtnh.exec:\bhbtnh.exe164⤵PID:4632
-
\??\c:\tbthbt.exec:\tbthbt.exe165⤵PID:4372
-
\??\c:\dpppj.exec:\dpppj.exe166⤵PID:3328
-
\??\c:\pvdpd.exec:\pvdpd.exe167⤵PID:3852
-
\??\c:\7xlxrlf.exec:\7xlxrlf.exe168⤵PID:1644
-
\??\c:\lffxxff.exec:\lffxxff.exe169⤵PID:1664
-
\??\c:\bttnnt.exec:\bttnnt.exe170⤵PID:3916
-
\??\c:\3bhbtt.exec:\3bhbtt.exe171⤵PID:4472
-
\??\c:\jvvdv.exec:\jvvdv.exe172⤵PID:1436
-
\??\c:\jjjvp.exec:\jjjvp.exe173⤵PID:4604
-
\??\c:\xfrrlff.exec:\xfrrlff.exe174⤵PID:548
-
\??\c:\xffflfl.exec:\xffflfl.exe175⤵PID:3248
-
\??\c:\3bbbtn.exec:\3bbbtn.exe176⤵PID:4652
-
\??\c:\hbhhbh.exec:\hbhhbh.exe177⤵PID:5016
-
\??\c:\vpppj.exec:\vpppj.exe178⤵PID:4488
-
\??\c:\9vdpj.exec:\9vdpj.exe179⤵PID:2016
-
\??\c:\fxxlxxr.exec:\fxxlxxr.exe180⤵PID:4396
-
\??\c:\rrxrlrl.exec:\rrxrlrl.exe181⤵PID:3840
-
\??\c:\bnnhbb.exec:\bnnhbb.exe182⤵PID:3372
-
\??\c:\9btbbh.exec:\9btbbh.exe183⤵PID:2148
-
\??\c:\vppvp.exec:\vppvp.exe184⤵PID:3776
-
\??\c:\9jvvp.exec:\9jvvp.exe185⤵PID:1156
-
\??\c:\9djdv.exec:\9djdv.exe186⤵PID:4936
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe187⤵PID:1016
-
\??\c:\1xxxrlf.exec:\1xxxrlf.exe188⤵PID:5100
-
\??\c:\hntttt.exec:\hntttt.exe189⤵PID:852
-
\??\c:\5jvvp.exec:\5jvvp.exe190⤵PID:3984
-
\??\c:\7dvjd.exec:\7dvjd.exe191⤵PID:2720
-
\??\c:\xxrxxfr.exec:\xxrxxfr.exe192⤵PID:3496
-
\??\c:\rflfxxx.exec:\rflfxxx.exe193⤵PID:4436
-
\??\c:\httthh.exec:\httthh.exe194⤵PID:3084
-
\??\c:\bbnnnn.exec:\bbnnnn.exe195⤵PID:3704
-
\??\c:\jjvjj.exec:\jjvjj.exe196⤵PID:4948
-
\??\c:\pvvjd.exec:\pvvjd.exe197⤵PID:1496
-
\??\c:\pjdvd.exec:\pjdvd.exe198⤵PID:1908
-
\??\c:\lxlfffx.exec:\lxlfffx.exe199⤵PID:3696
-
\??\c:\fffxrrl.exec:\fffxrrl.exe200⤵PID:1652
-
\??\c:\nbbnbn.exec:\nbbnbn.exe201⤵PID:4832
-
\??\c:\ttnhhh.exec:\ttnhhh.exe202⤵PID:2636
-
\??\c:\vpppj.exec:\vpppj.exe203⤵PID:4544
-
\??\c:\vvddv.exec:\vvddv.exe204⤵PID:1676
-
\??\c:\lfllrxf.exec:\lfllrxf.exe205⤵PID:2072
-
\??\c:\lrxlllx.exec:\lrxlllx.exe206⤵PID:1660
-
\??\c:\xfxfxff.exec:\xfxfxff.exe207⤵PID:1668
-
\??\c:\btnnhh.exec:\btnnhh.exe208⤵PID:1616
-
\??\c:\httnnn.exec:\httnnn.exe209⤵PID:3876
-
\??\c:\bbnnbb.exec:\bbnnbb.exe210⤵PID:2384
-
\??\c:\vppjd.exec:\vppjd.exe211⤵PID:1012
-
\??\c:\5ppjd.exec:\5ppjd.exe212⤵PID:2240
-
\??\c:\xxfxxrl.exec:\xxfxxrl.exe213⤵PID:3880
-
\??\c:\3xxlflf.exec:\3xxlflf.exe214⤵PID:3412
-
\??\c:\7bbnhh.exec:\7bbnhh.exe215⤵PID:4652
-
\??\c:\bbbbnn.exec:\bbbbnn.exe216⤵PID:5016
-
\??\c:\thtnbb.exec:\thtnbb.exe217⤵PID:4488
-
\??\c:\pvjdv.exec:\pvjdv.exe218⤵PID:3600
-
\??\c:\jpdvp.exec:\jpdvp.exe219⤵PID:8
-
\??\c:\vvddd.exec:\vvddd.exe220⤵PID:3840
-
\??\c:\ffxrfff.exec:\ffxrfff.exe221⤵PID:3372
-
\??\c:\llfflrl.exec:\llfflrl.exe222⤵PID:2148
-
\??\c:\thnbbt.exec:\thnbbt.exe223⤵PID:1648
-
\??\c:\hbtttt.exec:\hbtttt.exe224⤵PID:1344
-
\??\c:\hntntt.exec:\hntntt.exe225⤵PID:1156
-
\??\c:\ddpjp.exec:\ddpjp.exe226⤵PID:544
-
\??\c:\pjdjj.exec:\pjdjj.exe227⤵PID:2300
-
\??\c:\ddjpd.exec:\ddjpd.exe228⤵PID:3620
-
\??\c:\1rfrxlx.exec:\1rfrxlx.exe229⤵PID:1848
-
\??\c:\rrfflrx.exec:\rrfflrx.exe230⤵PID:3748
-
\??\c:\xxllxlx.exec:\xxllxlx.exe231⤵PID:3364
-
\??\c:\hthhht.exec:\hthhht.exe232⤵PID:4672
-
\??\c:\nbhhhh.exec:\nbhhhh.exe233⤵PID:4316
-
\??\c:\tnnhbb.exec:\tnnhbb.exe234⤵PID:3420
-
\??\c:\vjjjd.exec:\vjjjd.exe235⤵PID:3932
-
\??\c:\pjpdp.exec:\pjpdp.exe236⤵PID:3084
-
\??\c:\jjpjj.exec:\jjpjj.exe237⤵PID:4076
-
\??\c:\5xrrfll.exec:\5xrrfll.exe238⤵PID:4592
-
\??\c:\llrlxrr.exec:\llrlxrr.exe239⤵PID:1656
-
\??\c:\nhbbtb.exec:\nhbbtb.exe240⤵PID:2448
-
\??\c:\9bbthh.exec:\9bbthh.exe241⤵PID:1904
-
\??\c:\nbbttn.exec:\nbbttn.exe242⤵PID:2668