Analysis
-
max time kernel
150s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 17:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fd1570ca48910dc8833850b1b617d5a0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
fd1570ca48910dc8833850b1b617d5a0_NeikiAnalytics.exe
-
Size
95KB
-
MD5
fd1570ca48910dc8833850b1b617d5a0
-
SHA1
10a9eef5d46c855e9348679645f5eb6663d0539d
-
SHA256
f2d9834cb6e3b5311e079456544b09591e87b78ca95def714dd63989feebac6d
-
SHA512
79c975cce8c88a96d528afd6068ee759855cb0299a85488f490d6fbd6808cba3c156ea50cb24c6af2b57e7f30f5f126827ae6142ab24d9da6de3b99ba65f9d36
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTQz:ymb3NkkiQ3mdBjFIj+qNhvZuHQY0z
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/4108-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1264-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1088-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1284-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/616-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1jdvv.exe3rxfrlx.exe5nbtnn.exethtthb.exevppjd.exe5xxxllx.exenhtnhh.exebbhbnh.exevvvpd.exefxfxrxr.exebhtbht.exelrlrffx.exetttttt.exethhbnn.exepvddv.exe1xrlxfx.exe9hhbtt.exe3pvjj.exe9pppd.exefrfrxrl.exe9bbtnh.exe5pddv.exejddvp.exefrrxrll.exehbntnt.exevppjv.exe7jdpd.exe3lfxxrl.exetnbnnb.exejjdvp.exe3jpvj.exexrxflrx.exenntnhh.exepdvpd.exe7llxrlr.exenhhbbt.exetnnhhh.exejdvvp.exe3vvjv.exerfflfll.exelxxrlxl.exehnbtbh.exevjvjd.exedpdpj.exe7xflxxr.exebttnbb.exevjvvj.exe1ppjd.exerlflrlr.exenhhbtt.exe7nthnb.exeddvpj.exepjvpj.exe5flxlxr.exebtnhhh.exe7hhbnn.exe5vdpj.exexlxfrfl.exelfxfrfx.exe9tnnhh.exe1vpjd.exeppppj.exexfffxll.exenhhbnh.exepid process 4416 1jdvv.exe 1264 3rxfrlx.exe 2028 5nbtnn.exe 1396 thtthb.exe 1088 vppjd.exe 1612 5xxxllx.exe 1560 nhtnhh.exe 1284 bbhbnh.exe 4880 vvvpd.exe 2000 fxfxrxr.exe 2940 bhtbht.exe 2184 lrlrffx.exe 452 tttttt.exe 4420 thhbnn.exe 4352 pvddv.exe 2520 1xrlxfx.exe 4808 9hhbtt.exe 4584 3pvjj.exe 3260 9pppd.exe 4700 frfrxrl.exe 4052 9bbtnh.exe 540 5pddv.exe 4740 jddvp.exe 1508 frrxrll.exe 468 hbntnt.exe 616 vppjv.exe 2488 7jdpd.exe 1552 3lfxxrl.exe 2240 tnbnnb.exe 1520 jjdvp.exe 4840 3jpvj.exe 4928 xrxflrx.exe 1208 nntnhh.exe 2348 pdvpd.exe 2588 7llxrlr.exe 3416 nhhbbt.exe 3080 tnnhhh.exe 3180 jdvvp.exe 4108 3vvjv.exe 2960 rfflfll.exe 2788 lxxrlxl.exe 2640 hnbtbh.exe 1236 vjvjd.exe 396 dpdpj.exe 4960 7xflxxr.exe 1612 bttnbb.exe 776 vjvvj.exe 2744 1ppjd.exe 436 rlflrlr.exe 672 nhhbtt.exe 3876 7nthnb.exe 2852 ddvpj.exe 4684 pjvpj.exe 1824 5flxlxr.exe 1924 btnhhh.exe 4756 7hhbnn.exe 4392 5vdpj.exe 2404 xlxfrfl.exe 1148 lfxfrfx.exe 3564 9tnnhh.exe 4940 1vpjd.exe 4020 ppppj.exe 4700 xfffxll.exe 2136 nhhbnh.exe -
Processes:
resource yara_rule behavioral2/memory/4108-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1264-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1088-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/616-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fd1570ca48910dc8833850b1b617d5a0_NeikiAnalytics.exe1jdvv.exe3rxfrlx.exe5nbtnn.exethtthb.exevppjd.exe5xxxllx.exenhtnhh.exebbhbnh.exevvvpd.exefxfxrxr.exebhtbht.exelrlrffx.exetttttt.exethhbnn.exepvddv.exe1xrlxfx.exe9hhbtt.exe3pvjj.exe9pppd.exefrfrxrl.exe9bbtnh.exedescription pid process target process PID 4108 wrote to memory of 4416 4108 fd1570ca48910dc8833850b1b617d5a0_NeikiAnalytics.exe 1jdvv.exe PID 4108 wrote to memory of 4416 4108 fd1570ca48910dc8833850b1b617d5a0_NeikiAnalytics.exe 1jdvv.exe PID 4108 wrote to memory of 4416 4108 fd1570ca48910dc8833850b1b617d5a0_NeikiAnalytics.exe 1jdvv.exe PID 4416 wrote to memory of 1264 4416 1jdvv.exe 3rxfrlx.exe PID 4416 wrote to memory of 1264 4416 1jdvv.exe 3rxfrlx.exe PID 4416 wrote to memory of 1264 4416 1jdvv.exe 3rxfrlx.exe PID 1264 wrote to memory of 2028 1264 3rxfrlx.exe 5nbtnn.exe PID 1264 wrote to memory of 2028 1264 3rxfrlx.exe 5nbtnn.exe PID 1264 wrote to memory of 2028 1264 3rxfrlx.exe 5nbtnn.exe PID 2028 wrote to memory of 1396 2028 5nbtnn.exe thtthb.exe PID 2028 wrote to memory of 1396 2028 5nbtnn.exe thtthb.exe PID 2028 wrote to memory of 1396 2028 5nbtnn.exe thtthb.exe PID 1396 wrote to memory of 1088 1396 thtthb.exe vppjd.exe PID 1396 wrote to memory of 1088 1396 thtthb.exe vppjd.exe PID 1396 wrote to memory of 1088 1396 thtthb.exe vppjd.exe PID 1088 wrote to memory of 1612 1088 vppjd.exe 5xxxllx.exe PID 1088 wrote to memory of 1612 1088 vppjd.exe 5xxxllx.exe PID 1088 wrote to memory of 1612 1088 vppjd.exe 5xxxllx.exe PID 1612 wrote to memory of 1560 1612 5xxxllx.exe nhtnhh.exe PID 1612 wrote to memory of 1560 1612 5xxxllx.exe nhtnhh.exe PID 1612 wrote to memory of 1560 1612 5xxxllx.exe nhtnhh.exe PID 1560 wrote to memory of 1284 1560 nhtnhh.exe bbhbnh.exe PID 1560 wrote to memory of 1284 1560 nhtnhh.exe bbhbnh.exe PID 1560 wrote to memory of 1284 1560 nhtnhh.exe bbhbnh.exe PID 1284 wrote to memory of 4880 1284 bbhbnh.exe vvvpd.exe PID 1284 wrote to memory of 4880 1284 bbhbnh.exe vvvpd.exe PID 1284 wrote to memory of 4880 1284 bbhbnh.exe vvvpd.exe PID 4880 wrote to memory of 2000 4880 vvvpd.exe fxfxrxr.exe PID 4880 wrote to memory of 2000 4880 vvvpd.exe fxfxrxr.exe PID 4880 wrote to memory of 2000 4880 vvvpd.exe fxfxrxr.exe PID 2000 wrote to memory of 2940 2000 fxfxrxr.exe bhtbht.exe PID 2000 wrote to memory of 2940 2000 fxfxrxr.exe bhtbht.exe PID 2000 wrote to memory of 2940 2000 fxfxrxr.exe bhtbht.exe PID 2940 wrote to memory of 2184 2940 bhtbht.exe lrlrffx.exe PID 2940 wrote to memory of 2184 2940 bhtbht.exe lrlrffx.exe PID 2940 wrote to memory of 2184 2940 bhtbht.exe lrlrffx.exe PID 2184 wrote to memory of 452 2184 lrlrffx.exe tttttt.exe PID 2184 wrote to memory of 452 2184 lrlrffx.exe tttttt.exe PID 2184 wrote to memory of 452 2184 lrlrffx.exe tttttt.exe PID 452 wrote to memory of 4420 452 tttttt.exe thhbnn.exe PID 452 wrote to memory of 4420 452 tttttt.exe thhbnn.exe PID 452 wrote to memory of 4420 452 tttttt.exe thhbnn.exe PID 4420 wrote to memory of 4352 4420 thhbnn.exe pvddv.exe PID 4420 wrote to memory of 4352 4420 thhbnn.exe pvddv.exe PID 4420 wrote to memory of 4352 4420 thhbnn.exe pvddv.exe PID 4352 wrote to memory of 2520 4352 pvddv.exe 1xrlxfx.exe PID 4352 wrote to memory of 2520 4352 pvddv.exe 1xrlxfx.exe PID 4352 wrote to memory of 2520 4352 pvddv.exe 1xrlxfx.exe PID 2520 wrote to memory of 4808 2520 1xrlxfx.exe 9hhbtt.exe PID 2520 wrote to memory of 4808 2520 1xrlxfx.exe 9hhbtt.exe PID 2520 wrote to memory of 4808 2520 1xrlxfx.exe 9hhbtt.exe PID 4808 wrote to memory of 4584 4808 9hhbtt.exe 3pvjj.exe PID 4808 wrote to memory of 4584 4808 9hhbtt.exe 3pvjj.exe PID 4808 wrote to memory of 4584 4808 9hhbtt.exe 3pvjj.exe PID 4584 wrote to memory of 3260 4584 3pvjj.exe 9pppd.exe PID 4584 wrote to memory of 3260 4584 3pvjj.exe 9pppd.exe PID 4584 wrote to memory of 3260 4584 3pvjj.exe 9pppd.exe PID 3260 wrote to memory of 4700 3260 9pppd.exe frfrxrl.exe PID 3260 wrote to memory of 4700 3260 9pppd.exe frfrxrl.exe PID 3260 wrote to memory of 4700 3260 9pppd.exe frfrxrl.exe PID 4700 wrote to memory of 4052 4700 frfrxrl.exe 9bbtnh.exe PID 4700 wrote to memory of 4052 4700 frfrxrl.exe 9bbtnh.exe PID 4700 wrote to memory of 4052 4700 frfrxrl.exe 9bbtnh.exe PID 4052 wrote to memory of 540 4052 9bbtnh.exe 5pddv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd1570ca48910dc8833850b1b617d5a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\fd1570ca48910dc8833850b1b617d5a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\1jdvv.exec:\1jdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\3rxfrlx.exec:\3rxfrlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\5nbtnn.exec:\5nbtnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\thtthb.exec:\thtthb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\vppjd.exec:\vppjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\5xxxllx.exec:\5xxxllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\nhtnhh.exec:\nhtnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\bbhbnh.exec:\bbhbnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\vvvpd.exec:\vvvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\fxfxrxr.exec:\fxfxrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\bhtbht.exec:\bhtbht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\lrlrffx.exec:\lrlrffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\tttttt.exec:\tttttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\thhbnn.exec:\thhbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\pvddv.exec:\pvddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\1xrlxfx.exec:\1xrlxfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\9hhbtt.exec:\9hhbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\3pvjj.exec:\3pvjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\9pppd.exec:\9pppd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\frfrxrl.exec:\frfrxrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\9bbtnh.exec:\9bbtnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\5pddv.exec:\5pddv.exe23⤵
- Executes dropped EXE
PID:540 -
\??\c:\jddvp.exec:\jddvp.exe24⤵
- Executes dropped EXE
PID:4740 -
\??\c:\frrxrll.exec:\frrxrll.exe25⤵
- Executes dropped EXE
PID:1508 -
\??\c:\hbntnt.exec:\hbntnt.exe26⤵
- Executes dropped EXE
PID:468 -
\??\c:\vppjv.exec:\vppjv.exe27⤵
- Executes dropped EXE
PID:616 -
\??\c:\7jdpd.exec:\7jdpd.exe28⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3lfxxrl.exec:\3lfxxrl.exe29⤵
- Executes dropped EXE
PID:1552 -
\??\c:\tnbnnb.exec:\tnbnnb.exe30⤵
- Executes dropped EXE
PID:2240 -
\??\c:\jjdvp.exec:\jjdvp.exe31⤵
- Executes dropped EXE
PID:1520 -
\??\c:\3jpvj.exec:\3jpvj.exe32⤵
- Executes dropped EXE
PID:4840 -
\??\c:\xrxflrx.exec:\xrxflrx.exe33⤵
- Executes dropped EXE
PID:4928 -
\??\c:\nntnhh.exec:\nntnhh.exe34⤵
- Executes dropped EXE
PID:1208 -
\??\c:\pdvpd.exec:\pdvpd.exe35⤵
- Executes dropped EXE
PID:2348 -
\??\c:\7llxrlr.exec:\7llxrlr.exe36⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nhhbbt.exec:\nhhbbt.exe37⤵
- Executes dropped EXE
PID:3416 -
\??\c:\tnnhhh.exec:\tnnhhh.exe38⤵
- Executes dropped EXE
PID:3080 -
\??\c:\jdvvp.exec:\jdvvp.exe39⤵
- Executes dropped EXE
PID:3180 -
\??\c:\3vvjv.exec:\3vvjv.exe40⤵
- Executes dropped EXE
PID:4108 -
\??\c:\rfflfll.exec:\rfflfll.exe41⤵
- Executes dropped EXE
PID:2960 -
\??\c:\lxxrlxl.exec:\lxxrlxl.exe42⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hnbtbh.exec:\hnbtbh.exe43⤵
- Executes dropped EXE
PID:2640 -
\??\c:\vjvjd.exec:\vjvjd.exe44⤵
- Executes dropped EXE
PID:1236 -
\??\c:\dpdpj.exec:\dpdpj.exe45⤵
- Executes dropped EXE
PID:396 -
\??\c:\7xflxxr.exec:\7xflxxr.exe46⤵
- Executes dropped EXE
PID:4960 -
\??\c:\bttnbb.exec:\bttnbb.exe47⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vjvvj.exec:\vjvvj.exe48⤵
- Executes dropped EXE
PID:776 -
\??\c:\1ppjd.exec:\1ppjd.exe49⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rlflrlr.exec:\rlflrlr.exe50⤵
- Executes dropped EXE
PID:436 -
\??\c:\nhhbtt.exec:\nhhbtt.exe51⤵
- Executes dropped EXE
PID:672 -
\??\c:\7nthnb.exec:\7nthnb.exe52⤵
- Executes dropped EXE
PID:3876 -
\??\c:\ddvpj.exec:\ddvpj.exe53⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pjvpj.exec:\pjvpj.exe54⤵
- Executes dropped EXE
PID:4684 -
\??\c:\5flxlxr.exec:\5flxlxr.exe55⤵
- Executes dropped EXE
PID:1824 -
\??\c:\btnhhh.exec:\btnhhh.exe56⤵
- Executes dropped EXE
PID:1924 -
\??\c:\7hhbnn.exec:\7hhbnn.exe57⤵
- Executes dropped EXE
PID:4756 -
\??\c:\5vdpj.exec:\5vdpj.exe58⤵
- Executes dropped EXE
PID:4392 -
\??\c:\xlxfrfl.exec:\xlxfrfl.exe59⤵
- Executes dropped EXE
PID:2404 -
\??\c:\lfxfrfx.exec:\lfxfrfx.exe60⤵
- Executes dropped EXE
PID:1148 -
\??\c:\9tnnhh.exec:\9tnnhh.exe61⤵
- Executes dropped EXE
PID:3564 -
\??\c:\1vpjd.exec:\1vpjd.exe62⤵
- Executes dropped EXE
PID:4940 -
\??\c:\ppppj.exec:\ppppj.exe63⤵
- Executes dropped EXE
PID:4020 -
\??\c:\xfffxll.exec:\xfffxll.exe64⤵
- Executes dropped EXE
PID:4700 -
\??\c:\nhhbnh.exec:\nhhbnh.exe65⤵
- Executes dropped EXE
PID:2136 -
\??\c:\vpppd.exec:\vpppd.exe66⤵PID:4900
-
\??\c:\jpvpd.exec:\jpvpd.exe67⤵PID:2004
-
\??\c:\tbbthh.exec:\tbbthh.exe68⤵PID:3300
-
\??\c:\hnnhtt.exec:\hnnhtt.exe69⤵PID:1556
-
\??\c:\5djdv.exec:\5djdv.exe70⤵PID:3436
-
\??\c:\1xfffxf.exec:\1xfffxf.exe71⤵PID:1144
-
\??\c:\xxrlffx.exec:\xxrlffx.exe72⤵PID:4184
-
\??\c:\tbbthb.exec:\tbbthb.exe73⤵PID:2872
-
\??\c:\vpdvp.exec:\vpdvp.exe74⤵PID:1552
-
\??\c:\vvdpp.exec:\vvdpp.exe75⤵PID:5068
-
\??\c:\nbtnbb.exec:\nbtnbb.exe76⤵PID:4292
-
\??\c:\nnhhbt.exec:\nnhhbt.exe77⤵PID:5012
-
\??\c:\9dpjd.exec:\9dpjd.exe78⤵PID:760
-
\??\c:\flrfrxr.exec:\flrfrxr.exe79⤵PID:1312
-
\??\c:\xxfxllf.exec:\xxfxllf.exe80⤵PID:868
-
\??\c:\tnbtnh.exec:\tnbtnh.exe81⤵PID:4364
-
\??\c:\vdvpp.exec:\vdvpp.exe82⤵PID:4332
-
\??\c:\ddddp.exec:\ddddp.exe83⤵PID:4724
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe84⤵PID:3212
-
\??\c:\ntbtnn.exec:\ntbtnn.exe85⤵PID:4416
-
\??\c:\hnhbtn.exec:\hnhbtn.exe86⤵PID:2924
-
\??\c:\jdjjd.exec:\jdjjd.exe87⤵PID:1744
-
\??\c:\vvdvd.exec:\vvdvd.exe88⤵PID:648
-
\??\c:\llxfrrr.exec:\llxfrrr.exe89⤵PID:2764
-
\??\c:\hnnhhb.exec:\hnnhhb.exe90⤵PID:3800
-
\??\c:\5ttnbb.exec:\5ttnbb.exe91⤵PID:2464
-
\??\c:\dvvpp.exec:\dvvpp.exe92⤵PID:5076
-
\??\c:\llrrxxl.exec:\llrrxxl.exe93⤵PID:3624
-
\??\c:\lffxrxr.exec:\lffxrxr.exe94⤵PID:2780
-
\??\c:\3ntttt.exec:\3ntttt.exe95⤵PID:400
-
\??\c:\nhnhbh.exec:\nhnhbh.exe96⤵PID:2364
-
\??\c:\dvpdd.exec:\dvpdd.exe97⤵PID:2852
-
\??\c:\dvvvj.exec:\dvvvj.exe98⤵PID:4684
-
\??\c:\lllfxff.exec:\lllfxff.exe99⤵PID:1824
-
\??\c:\lfrlfxr.exec:\lfrlfxr.exe100⤵PID:1924
-
\??\c:\hhnttt.exec:\hhnttt.exe101⤵PID:4736
-
\??\c:\thbtnt.exec:\thbtnt.exe102⤵PID:2448
-
\??\c:\3jvpj.exec:\3jvpj.exe103⤵PID:4728
-
\??\c:\5pdvp.exec:\5pdvp.exe104⤵PID:1068
-
\??\c:\3lrrflx.exec:\3lrrflx.exe105⤵PID:3440
-
\??\c:\bbnntb.exec:\bbnntb.exe106⤵PID:2164
-
\??\c:\thnnhh.exec:\thnnhh.exe107⤵PID:3260
-
\??\c:\pjppp.exec:\pjppp.exe108⤵PID:2220
-
\??\c:\jjppd.exec:\jjppd.exe109⤵PID:1128
-
\??\c:\xrrxrll.exec:\xrrxrll.exe110⤵PID:4720
-
\??\c:\xxlllfl.exec:\xxlllfl.exe111⤵PID:4088
-
\??\c:\hhnnnt.exec:\hhnnnt.exe112⤵PID:2648
-
\??\c:\thhbth.exec:\thhbth.exe113⤵PID:3300
-
\??\c:\jdddv.exec:\jdddv.exe114⤵PID:1556
-
\??\c:\pvdvp.exec:\pvdvp.exe115⤵PID:5096
-
\??\c:\xflfxxx.exec:\xflfxxx.exe116⤵PID:1204
-
\??\c:\7flxrxx.exec:\7flxrxx.exe117⤵PID:3584
-
\??\c:\thhhbb.exec:\thhhbb.exe118⤵PID:4328
-
\??\c:\9htnhn.exec:\9htnhn.exe119⤵PID:3808
-
\??\c:\jddjd.exec:\jddjd.exe120⤵PID:1996
-
\??\c:\1dddp.exec:\1dddp.exe121⤵PID:5012
-
\??\c:\llffxxr.exec:\llffxxr.exe122⤵PID:3836
-
\??\c:\llxxrrl.exec:\llxxrrl.exe123⤵PID:4396
-
\??\c:\vvjdj.exec:\vvjdj.exe124⤵PID:2188
-
\??\c:\7xxrlrr.exec:\7xxrlrr.exe125⤵PID:3064
-
\??\c:\fxxfflf.exec:\fxxfflf.exe126⤵PID:2880
-
\??\c:\httttt.exec:\httttt.exe127⤵PID:4416
-
\??\c:\btbbth.exec:\btbbth.exe128⤵PID:1020
-
\??\c:\pjpjd.exec:\pjpjd.exe129⤵PID:2892
-
\??\c:\ppvvd.exec:\ppvvd.exe130⤵PID:3740
-
\??\c:\fllllxr.exec:\fllllxr.exe131⤵PID:548
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe132⤵PID:1896
-
\??\c:\nhnntt.exec:\nhnntt.exe133⤵PID:4992
-
\??\c:\htbttb.exec:\htbttb.exe134⤵PID:2780
-
\??\c:\jpvvp.exec:\jpvvp.exe135⤵PID:2356
-
\??\c:\xlffrll.exec:\xlffrll.exe136⤵PID:764
-
\??\c:\tnnnhh.exec:\tnnnhh.exe137⤵PID:5008
-
\??\c:\nhhbtb.exec:\nhhbtb.exe138⤵PID:1548
-
\??\c:\vvvvv.exec:\vvvvv.exe139⤵PID:4956
-
\??\c:\fxrlfxl.exec:\fxrlfxl.exe140⤵PID:4756
-
\??\c:\hbhhbh.exec:\hbhhbh.exe141⤵PID:3028
-
\??\c:\nhbbtb.exec:\nhbbtb.exe142⤵PID:2232
-
\??\c:\dpjjj.exec:\dpjjj.exe143⤵PID:3012
-
\??\c:\djjdp.exec:\djjdp.exe144⤵PID:4824
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe145⤵PID:1892
-
\??\c:\xrlrrxx.exec:\xrlrrxx.exe146⤵PID:2608
-
\??\c:\9hntnb.exec:\9hntnb.exe147⤵PID:3372
-
\??\c:\vjjpj.exec:\vjjpj.exe148⤵PID:3032
-
\??\c:\rffxrff.exec:\rffxrff.exe149⤵PID:3344
-
\??\c:\fffffff.exec:\fffffff.exe150⤵PID:4740
-
\??\c:\1bbttt.exec:\1bbttt.exe151⤵PID:3628
-
\??\c:\btnnhb.exec:\btnnhb.exe152⤵PID:2304
-
\??\c:\pdddp.exec:\pdddp.exe153⤵PID:3684
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe154⤵PID:4588
-
\??\c:\bbbbnt.exec:\bbbbnt.exe155⤵PID:1144
-
\??\c:\hbnbtt.exec:\hbnbtt.exe156⤵PID:2872
-
\??\c:\jpppd.exec:\jpppd.exe157⤵PID:4268
-
\??\c:\lxxfrfl.exec:\lxxfrfl.exe158⤵PID:1656
-
\??\c:\tnhtbt.exec:\tnhtbt.exe159⤵PID:1728
-
\??\c:\tntnbh.exec:\tntnbh.exe160⤵PID:4376
-
\??\c:\jpvpp.exec:\jpvpp.exe161⤵PID:4324
-
\??\c:\3jddp.exec:\3jddp.exe162⤵PID:3088
-
\??\c:\xfllrrx.exec:\xfllrrx.exe163⤵PID:4244
-
\??\c:\thnhhb.exec:\thnhhb.exe164⤵PID:2684
-
\??\c:\pdjdp.exec:\pdjdp.exe165⤵PID:2788
-
\??\c:\fxxlllr.exec:\fxxlllr.exe166⤵PID:2924
-
\??\c:\xfllffx.exec:\xfllffx.exe167⤵PID:3656
-
\??\c:\bhtnnn.exec:\bhtnnn.exe168⤵PID:5016
-
\??\c:\pjpjv.exec:\pjpjv.exe169⤵PID:1612
-
\??\c:\3vpjv.exec:\3vpjv.exe170⤵PID:1260
-
\??\c:\9flfxrr.exec:\9flfxrr.exe171⤵PID:1896
-
\??\c:\1rfffff.exec:\1rfffff.exe172⤵PID:4992
-
\??\c:\ntnbbb.exec:\ntnbbb.exe173⤵PID:3876
-
\??\c:\9jjdv.exec:\9jjdv.exe174⤵PID:2356
-
\??\c:\vpdpp.exec:\vpdpp.exe175⤵PID:1276
-
\??\c:\lrfrxrf.exec:\lrfrxrf.exe176⤵PID:4420
-
\??\c:\bntnhh.exec:\bntnhh.exe177⤵PID:4852
-
\??\c:\nbnhtt.exec:\nbnhtt.exe178⤵PID:4756
-
\??\c:\vdjjj.exec:\vdjjj.exe179⤵PID:4000
-
\??\c:\ddvpd.exec:\ddvpd.exe180⤵PID:4576
-
\??\c:\lrrxlxx.exec:\lrrxlxx.exe181⤵PID:2404
-
\??\c:\9xxrrrl.exec:\9xxrrrl.exe182⤵PID:4828
-
\??\c:\bnntht.exec:\bnntht.exe183⤵PID:948
-
\??\c:\pdjdp.exec:\pdjdp.exe184⤵PID:4480
-
\??\c:\pjvvd.exec:\pjvvd.exe185⤵PID:1128
-
\??\c:\frlxrlf.exec:\frlxrlf.exe186⤵PID:1748
-
\??\c:\thhbnh.exec:\thhbnh.exe187⤵PID:676
-
\??\c:\hbhbbb.exec:\hbhbbb.exe188⤵PID:3856
-
\??\c:\jpjdp.exec:\jpjdp.exe189⤵PID:3300
-
\??\c:\djjdp.exec:\djjdp.exe190⤵PID:3092
-
\??\c:\lfrrrxf.exec:\lfrrrxf.exe191⤵PID:2488
-
\??\c:\frrlllf.exec:\frrlllf.exe192⤵PID:1360
-
\??\c:\bnbbnn.exec:\bnbbnn.exe193⤵PID:3356
-
\??\c:\3thtbb.exec:\3thtbb.exe194⤵PID:2872
-
\??\c:\pjvjv.exec:\pjvjv.exe195⤵PID:4268
-
\??\c:\9rrlxrl.exec:\9rrlxrl.exe196⤵PID:3900
-
\??\c:\xllrlll.exec:\xllrlll.exe197⤵PID:4432
-
\??\c:\3hbntn.exec:\3hbntn.exe198⤵PID:4376
-
\??\c:\nhbthb.exec:\nhbthb.exe199⤵PID:3904
-
\??\c:\jvdvv.exec:\jvdvv.exe200⤵PID:884
-
\??\c:\9vpdp.exec:\9vpdp.exe201⤵PID:4876
-
\??\c:\3lrlffl.exec:\3lrlffl.exe202⤵PID:1264
-
\??\c:\3tnhbh.exec:\3tnhbh.exe203⤵PID:3796
-
\??\c:\hbbhbn.exec:\hbbhbn.exe204⤵PID:4960
-
\??\c:\vdvvp.exec:\vdvvp.exe205⤵PID:1604
-
\??\c:\rfxrlff.exec:\rfxrlff.exe206⤵PID:4964
-
\??\c:\5rllrrx.exec:\5rllrrx.exe207⤵PID:4240
-
\??\c:\ntbbtt.exec:\ntbbtt.exe208⤵PID:3400
-
\??\c:\tttnbt.exec:\tttnbt.exe209⤵PID:2408
-
\??\c:\ttnbtt.exec:\ttnbtt.exe210⤵PID:228
-
\??\c:\jdjdj.exec:\jdjdj.exe211⤵PID:744
-
\??\c:\vjjdp.exec:\vjjdp.exe212⤵PID:3364
-
\??\c:\lxrflff.exec:\lxrflff.exe213⤵PID:3292
-
\??\c:\7lrlfll.exec:\7lrlfll.exe214⤵PID:4352
-
\??\c:\nbtnnh.exec:\nbtnnh.exe215⤵PID:2264
-
\??\c:\nbnttb.exec:\nbnttb.exe216⤵PID:2232
-
\??\c:\pjddv.exec:\pjddv.exe217⤵PID:3012
-
\??\c:\1lxlxff.exec:\1lxlxff.exe218⤵PID:4596
-
\??\c:\rrlxxxl.exec:\rrlxxxl.exe219⤵PID:1064
-
\??\c:\hbhbtn.exec:\hbhbtn.exe220⤵PID:2220
-
\??\c:\7vdpp.exec:\7vdpp.exe221⤵PID:948
-
\??\c:\dvvpd.exec:\dvvpd.exe222⤵PID:2248
-
\??\c:\flrxrxf.exec:\flrxrxf.exe223⤵PID:1128
-
\??\c:\5lrlllx.exec:\5lrlllx.exe224⤵PID:2648
-
\??\c:\hbhtbt.exec:\hbhtbt.exe225⤵PID:676
-
\??\c:\bbbthb.exec:\bbbthb.exe226⤵PID:2304
-
\??\c:\jvdvd.exec:\jvdvd.exe227⤵PID:3684
-
\??\c:\djjvj.exec:\djjvj.exe228⤵PID:1204
-
\??\c:\flrlfrl.exec:\flrlfrl.exe229⤵PID:3336
-
\??\c:\3rxrrxr.exec:\3rxrrxr.exe230⤵PID:1360
-
\??\c:\bhbtnh.exec:\bhbtnh.exe231⤵PID:2200
-
\??\c:\tnhbnh.exec:\tnhbnh.exe232⤵PID:1656
-
\??\c:\jdjdv.exec:\jdjdv.exe233⤵PID:2348
-
\??\c:\7ppjv.exec:\7ppjv.exe234⤵PID:4304
-
\??\c:\rrlfrlf.exec:\rrlfrlf.exe235⤵PID:2068
-
\??\c:\thnhhh.exec:\thnhhh.exe236⤵PID:4856
-
\??\c:\3vpdv.exec:\3vpdv.exe237⤵PID:4776
-
\??\c:\3pjjd.exec:\3pjjd.exe238⤵PID:2788
-
\??\c:\rlfxlfr.exec:\rlfxlfr.exe239⤵PID:2764
-
\??\c:\9hhbtn.exec:\9hhbtn.exe240⤵PID:3800
-
\??\c:\hbnhnh.exec:\hbnhnh.exe241⤵PID:5076
-
\??\c:\vvjvj.exec:\vvjvj.exe242⤵PID:3944