Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 11:59
Behavioral task
behavioral1
Sample
d98b040e611868a09af0e983e9946730_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
d98b040e611868a09af0e983e9946730_NeikiAnalytics.exe
-
Size
441KB
-
MD5
d98b040e611868a09af0e983e9946730
-
SHA1
39fd2b00c4d73c131f211443baf0151697e1dde4
-
SHA256
730cec8b85ac2341dfb4421d651fea8c427e51dec405cdef5fc8d7afd7045162
-
SHA512
485012eeaa6a9c2658176da24f377d3643c6c089080ff00b50ad36706d7149fd721d3cba60427178ab20a57203777861eeebba215c42fc233efacfd46031f659
-
SSDEEP
12288:M4wFHoSpg4wFHonR/nPF2LnFL4wF04wFK4wFK4wluWI:UrR/nPm
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/2820-9-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2456-53-0x0000000000320000-0x00000000003AC000-memory.dmp family_blackmoon behavioral1/memory/2604-68-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1312-109-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/3000-289-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2264-321-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2896-347-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/760-408-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1308-415-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2196-429-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2196-428-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/572-422-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1856-401-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/3064-394-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2504-374-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2568-381-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2176-437-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2944-442-0x0000000001CE0000-0x0000000001D6C000-memory.dmp family_blackmoon behavioral1/memory/2944-446-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1648-463-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2584-480-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/576-479-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1064-511-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1100-512-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1064-510-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1100-519-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2788-502-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2664-627-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2544-633-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1208-657-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1716-597-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2788-496-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2724-495-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2724-488-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2584-487-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/940-472-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1916-455-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1916-454-0x0000000000490000-0x000000000051C000-memory.dmp family_blackmoon behavioral1/memory/2484-360-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2148-340-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/3028-308-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/3028-302-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2992-298-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1980-270-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/3000-283-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/908-279-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1564-252-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/720-261-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1292-243-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2908-234-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2156-217-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2428-207-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1944-198-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1112-189-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/956-180-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1648-171-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1360-162-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2184-143-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2168-152-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/828-126-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1312-116-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2312-106-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1856-97-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1856-91-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2084 vxrnr.exe 1324 fbnrdbr.exe 2840 bttjbv.exe 2532 xhbhhbd.exe 2456 thrfpx.exe 2604 vxrxdp.exe 2552 hhhvd.exe 2404 fhhhfl.exe 1856 pthfjr.exe 2312 pfrhfxp.exe 1312 fxttjb.exe 828 tvfrbjx.exe 2196 fjtvlpl.exe 2184 lthvh.exe 2168 vdppbfl.exe 1360 fbdtnpf.exe 1648 nxxfvtr.exe 956 lrpbdhj.exe 1112 djdtlhj.exe 1944 hrldn.exe 2428 nttrv.exe 2156 pjjjnv.exe 2120 xbfbtr.exe 2908 bphhnvj.exe 1292 djpbvnh.exe 1564 vfxpd.exe 720 hltldrx.exe 1980 pftnh.exe 908 jbrdx.exe 3000 brbrxt.exe 2992 bdfrdpf.exe 3028 trptjbd.exe 880 fjfdxbr.exe 2264 tdjfjbd.exe 2268 drpxx.exe 1612 fxtlxvp.exe 2148 tbdxj.exe 2896 rhjjjj.exe 2204 xldrh.exe 2484 vlvddp.exe 2424 npxtvr.exe 2504 fltln.exe 2568 xtddrn.exe 2460 xpdfh.exe 3064 vhflx.exe 1856 vnppjt.exe 760 dxtblj.exe 1308 fhnrhjn.exe 572 rbbxl.exe 2196 bhbjpnp.exe 2176 dlthv.exe 2944 pfnlrx.exe 1916 ldjpp.exe 1648 xjdbbj.exe 940 rlrdpj.exe 576 xdbfr.exe 2584 xjntd.exe 2724 llfvph.exe 2788 rntplvh.exe 1064 vjvfjt.exe 1100 vhvbx.exe 920 xbfjrrj.exe 1844 pxvbfx.exe 2208 vdjdtbj.exe -
resource yara_rule behavioral1/memory/2820-0-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x000b000000014fe1-5.dat upx behavioral1/memory/2084-11-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2820-9-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2820-7-0x00000000002A0000-0x000000000032C000-memory.dmp upx behavioral1/files/0x00090000000155d9-21.dat upx behavioral1/memory/1324-23-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x00090000000155e2-31.dat upx behavioral1/memory/2532-42-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0007000000015c2f-50.dat upx behavioral1/files/0x0007000000015c3c-59.dat upx behavioral1/memory/2604-68-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0009000000015c52-70.dat upx behavioral1/files/0x0006000000016042-78.dat upx behavioral1/files/0x000900000001560a-98.dat upx behavioral1/memory/1312-109-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0006000000016476-128.dat upx behavioral1/files/0x000600000001663d-144.dat upx behavioral1/files/0x0006000000016b5e-164.dat upx behavioral1/files/0x0006000000016b96-173.dat upx behavioral1/files/0x0006000000016c10-182.dat upx behavioral1/files/0x0006000000016c1a-191.dat upx behavioral1/files/0x0006000000016c90-208.dat upx behavioral1/files/0x0006000000016ca9-219.dat upx behavioral1/files/0x0006000000016cd4-236.dat upx behavioral1/files/0x0006000000016d36-281.dat upx behavioral1/memory/3000-289-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2264-321-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2896-347-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/760-408-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1308-415-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2196-429-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2196-428-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/572-422-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1856-401-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/3064-394-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2504-374-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2568-381-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2944-438-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2176-437-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2944-442-0x0000000001CE0000-0x0000000001D6C000-memory.dmp upx behavioral1/memory/1916-447-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2944-446-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/940-464-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1648-463-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2584-480-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/576-479-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1064-511-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1100-512-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1100-519-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2788-502-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1064-504-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1916-503-0x0000000000490000-0x000000000051C000-memory.dmp upx behavioral1/memory/2664-627-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2544-633-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1208-657-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/1716-597-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2788-496-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2724-495-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2724-488-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2584-487-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/940-472-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/940-471-0x0000000000490000-0x000000000051C000-memory.dmp upx behavioral1/memory/1916-455-0x0000000000400000-0x000000000048C000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2084 2820 d98b040e611868a09af0e983e9946730_NeikiAnalytics.exe 28 PID 2820 wrote to memory of 2084 2820 d98b040e611868a09af0e983e9946730_NeikiAnalytics.exe 28 PID 2820 wrote to memory of 2084 2820 d98b040e611868a09af0e983e9946730_NeikiAnalytics.exe 28 PID 2820 wrote to memory of 2084 2820 d98b040e611868a09af0e983e9946730_NeikiAnalytics.exe 28 PID 2084 wrote to memory of 1324 2084 vxrnr.exe 29 PID 2084 wrote to memory of 1324 2084 vxrnr.exe 29 PID 2084 wrote to memory of 1324 2084 vxrnr.exe 29 PID 2084 wrote to memory of 1324 2084 vxrnr.exe 29 PID 1324 wrote to memory of 2840 1324 fbnrdbr.exe 30 PID 1324 wrote to memory of 2840 1324 fbnrdbr.exe 30 PID 1324 wrote to memory of 2840 1324 fbnrdbr.exe 30 PID 1324 wrote to memory of 2840 1324 fbnrdbr.exe 30 PID 2840 wrote to memory of 2532 2840 bttjbv.exe 31 PID 2840 wrote to memory of 2532 2840 bttjbv.exe 31 PID 2840 wrote to memory of 2532 2840 bttjbv.exe 31 PID 2840 wrote to memory of 2532 2840 bttjbv.exe 31 PID 2532 wrote to memory of 2456 2532 xhbhhbd.exe 32 PID 2532 wrote to memory of 2456 2532 xhbhhbd.exe 32 PID 2532 wrote to memory of 2456 2532 xhbhhbd.exe 32 PID 2532 wrote to memory of 2456 2532 xhbhhbd.exe 32 PID 2456 wrote to memory of 2604 2456 thrfpx.exe 33 PID 2456 wrote to memory of 2604 2456 thrfpx.exe 33 PID 2456 wrote to memory of 2604 2456 thrfpx.exe 33 PID 2456 wrote to memory of 2604 2456 thrfpx.exe 33 PID 2604 wrote to memory of 2552 2604 vxrxdp.exe 34 PID 2604 wrote to memory of 2552 2604 vxrxdp.exe 34 PID 2604 wrote to memory of 2552 2604 vxrxdp.exe 34 PID 2604 wrote to memory of 2552 2604 vxrxdp.exe 34 PID 2552 wrote to memory of 2404 2552 hhhvd.exe 35 PID 2552 wrote to memory of 2404 2552 hhhvd.exe 35 PID 2552 wrote to memory of 2404 2552 hhhvd.exe 35 PID 2552 wrote to memory of 2404 2552 hhhvd.exe 35 PID 2404 wrote to memory of 1856 2404 fhhhfl.exe 36 PID 2404 wrote to memory of 1856 2404 fhhhfl.exe 36 PID 2404 wrote to memory of 1856 2404 fhhhfl.exe 36 PID 2404 wrote to memory of 1856 2404 fhhhfl.exe 36 PID 1856 wrote to memory of 2312 1856 pthfjr.exe 37 PID 1856 wrote to memory of 2312 1856 pthfjr.exe 37 PID 1856 wrote to memory of 2312 1856 pthfjr.exe 37 PID 1856 wrote to memory of 2312 1856 pthfjr.exe 37 PID 2312 wrote to memory of 1312 2312 pfrhfxp.exe 38 PID 2312 wrote to memory of 1312 2312 pfrhfxp.exe 38 PID 2312 wrote to memory of 1312 2312 pfrhfxp.exe 38 PID 2312 wrote to memory of 1312 2312 pfrhfxp.exe 38 PID 1312 wrote to memory of 828 1312 fxttjb.exe 118 PID 1312 wrote to memory of 828 1312 fxttjb.exe 118 PID 1312 wrote to memory of 828 1312 fxttjb.exe 118 PID 1312 wrote to memory of 828 1312 fxttjb.exe 118 PID 828 wrote to memory of 2196 828 tvfrbjx.exe 40 PID 828 wrote to memory of 2196 828 tvfrbjx.exe 40 PID 828 wrote to memory of 2196 828 tvfrbjx.exe 40 PID 828 wrote to memory of 2196 828 tvfrbjx.exe 40 PID 2196 wrote to memory of 2184 2196 fjtvlpl.exe 41 PID 2196 wrote to memory of 2184 2196 fjtvlpl.exe 41 PID 2196 wrote to memory of 2184 2196 fjtvlpl.exe 41 PID 2196 wrote to memory of 2184 2196 fjtvlpl.exe 41 PID 2184 wrote to memory of 2168 2184 lthvh.exe 42 PID 2184 wrote to memory of 2168 2184 lthvh.exe 42 PID 2184 wrote to memory of 2168 2184 lthvh.exe 42 PID 2184 wrote to memory of 2168 2184 lthvh.exe 42 PID 2168 wrote to memory of 1360 2168 vdppbfl.exe 43 PID 2168 wrote to memory of 1360 2168 vdppbfl.exe 43 PID 2168 wrote to memory of 1360 2168 vdppbfl.exe 43 PID 2168 wrote to memory of 1360 2168 vdppbfl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\d98b040e611868a09af0e983e9946730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d98b040e611868a09af0e983e9946730_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\vxrnr.exec:\vxrnr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\fbnrdbr.exec:\fbnrdbr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\bttjbv.exec:\bttjbv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\xhbhhbd.exec:\xhbhhbd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\thrfpx.exec:\thrfpx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\vxrxdp.exec:\vxrxdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\hhhvd.exec:\hhhvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\fhhhfl.exec:\fhhhfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\pthfjr.exec:\pthfjr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\pfrhfxp.exec:\pfrhfxp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\fxttjb.exec:\fxttjb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\tvfrbjx.exec:\tvfrbjx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\fjtvlpl.exec:\fjtvlpl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\lthvh.exec:\lthvh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\vdppbfl.exec:\vdppbfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\fbdtnpf.exec:\fbdtnpf.exe17⤵
- Executes dropped EXE
PID:1360 -
\??\c:\nxxfvtr.exec:\nxxfvtr.exe18⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lrpbdhj.exec:\lrpbdhj.exe19⤵
- Executes dropped EXE
PID:956 -
\??\c:\djdtlhj.exec:\djdtlhj.exe20⤵
- Executes dropped EXE
PID:1112 -
\??\c:\hrldn.exec:\hrldn.exe21⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nttrv.exec:\nttrv.exe22⤵
- Executes dropped EXE
PID:2428 -
\??\c:\pjjjnv.exec:\pjjjnv.exe23⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xbfbtr.exec:\xbfbtr.exe24⤵
- Executes dropped EXE
PID:2120 -
\??\c:\bphhnvj.exec:\bphhnvj.exe25⤵
- Executes dropped EXE
PID:2908 -
\??\c:\djpbvnh.exec:\djpbvnh.exe26⤵
- Executes dropped EXE
PID:1292 -
\??\c:\vfxpd.exec:\vfxpd.exe27⤵
- Executes dropped EXE
PID:1564 -
\??\c:\hltldrx.exec:\hltldrx.exe28⤵
- Executes dropped EXE
PID:720 -
\??\c:\pftnh.exec:\pftnh.exe29⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jbrdx.exec:\jbrdx.exe30⤵
- Executes dropped EXE
PID:908 -
\??\c:\brbrxt.exec:\brbrxt.exe31⤵
- Executes dropped EXE
PID:3000 -
\??\c:\bdfrdpf.exec:\bdfrdpf.exe32⤵
- Executes dropped EXE
PID:2992 -
\??\c:\trptjbd.exec:\trptjbd.exe33⤵
- Executes dropped EXE
PID:3028 -
\??\c:\fjfdxbr.exec:\fjfdxbr.exe34⤵
- Executes dropped EXE
PID:880 -
\??\c:\tdjfjbd.exec:\tdjfjbd.exe35⤵
- Executes dropped EXE
PID:2264 -
\??\c:\drpxx.exec:\drpxx.exe36⤵
- Executes dropped EXE
PID:2268 -
\??\c:\fxtlxvp.exec:\fxtlxvp.exe37⤵
- Executes dropped EXE
PID:1612 -
\??\c:\tbdxj.exec:\tbdxj.exe38⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rhjjjj.exec:\rhjjjj.exe39⤵
- Executes dropped EXE
PID:2896 -
\??\c:\xldrh.exec:\xldrh.exe40⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vlvddp.exec:\vlvddp.exe41⤵
- Executes dropped EXE
PID:2484 -
\??\c:\npxtvr.exec:\npxtvr.exe42⤵
- Executes dropped EXE
PID:2424 -
\??\c:\fltln.exec:\fltln.exe43⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xtddrn.exec:\xtddrn.exe44⤵
- Executes dropped EXE
PID:2568 -
\??\c:\xpdfh.exec:\xpdfh.exe45⤵
- Executes dropped EXE
PID:2460 -
\??\c:\vhflx.exec:\vhflx.exe46⤵
- Executes dropped EXE
PID:3064 -
\??\c:\vnppjt.exec:\vnppjt.exe47⤵
- Executes dropped EXE
PID:1856 -
\??\c:\dxtblj.exec:\dxtblj.exe48⤵
- Executes dropped EXE
PID:760 -
\??\c:\fhnrhjn.exec:\fhnrhjn.exe49⤵
- Executes dropped EXE
PID:1308 -
\??\c:\rbbxl.exec:\rbbxl.exe50⤵
- Executes dropped EXE
PID:572 -
\??\c:\bhbjpnp.exec:\bhbjpnp.exe51⤵
- Executes dropped EXE
PID:2196 -
\??\c:\dlthv.exec:\dlthv.exe52⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pfnlrx.exec:\pfnlrx.exe53⤵
- Executes dropped EXE
PID:2944 -
\??\c:\ldjpp.exec:\ldjpp.exe54⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xjdbbj.exec:\xjdbbj.exe55⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rlrdpj.exec:\rlrdpj.exe56⤵
- Executes dropped EXE
PID:940 -
\??\c:\xdbfr.exec:\xdbfr.exe57⤵
- Executes dropped EXE
PID:576 -
\??\c:\xjntd.exec:\xjntd.exe58⤵
- Executes dropped EXE
PID:2584 -
\??\c:\llfvph.exec:\llfvph.exe59⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rntplvh.exec:\rntplvh.exe60⤵
- Executes dropped EXE
PID:2788 -
\??\c:\vjvfjt.exec:\vjvfjt.exe61⤵
- Executes dropped EXE
PID:1064 -
\??\c:\vhvbx.exec:\vhvbx.exe62⤵
- Executes dropped EXE
PID:1100 -
\??\c:\xbfjrrj.exec:\xbfjrrj.exe63⤵
- Executes dropped EXE
PID:920 -
\??\c:\pxvbfx.exec:\pxvbfx.exe64⤵
- Executes dropped EXE
PID:1844 -
\??\c:\vdjdtbj.exec:\vdjdtbj.exe65⤵
- Executes dropped EXE
PID:2208 -
\??\c:\pxvfbnh.exec:\pxvfbnh.exe66⤵PID:976
-
\??\c:\trrdrp.exec:\trrdrp.exe67⤵PID:328
-
\??\c:\nbttldf.exec:\nbttldf.exe68⤵PID:2124
-
\??\c:\rhxpfhb.exec:\rhxpfhb.exe69⤵PID:584
-
\??\c:\xrtpr.exec:\xrtpr.exe70⤵PID:1436
-
\??\c:\fxbjbrb.exec:\fxbjbrb.exe71⤵PID:2264
-
\??\c:\ldbrvxr.exec:\ldbrvxr.exe72⤵PID:1664
-
\??\c:\ftttfbt.exec:\ftttfbt.exe73⤵PID:1612
-
\??\c:\btjln.exec:\btjln.exe74⤵PID:2820
-
\??\c:\xbvvnrv.exec:\xbvvnrv.exe75⤵PID:1716
-
\??\c:\hhhrtdl.exec:\hhhrtdl.exe76⤵PID:2220
-
\??\c:\hjpttp.exec:\hjpttp.exe77⤵PID:2440
-
\??\c:\lprnvfx.exec:\lprnvfx.exe78⤵PID:2484
-
\??\c:\prpljdf.exec:\prpljdf.exe79⤵PID:2520
-
\??\c:\nffjxnp.exec:\nffjxnp.exe80⤵PID:2664
-
\??\c:\fxfrl.exec:\fxfrl.exe81⤵PID:2544
-
\??\c:\jxhrrlp.exec:\jxhrrlp.exe82⤵PID:1540
-
\??\c:\xfntnt.exec:\xfntnt.exe83⤵PID:1956
-
\??\c:\rfddx.exec:\rfddx.exe84⤵PID:2408
-
\??\c:\ftnfhjh.exec:\ftnfhjh.exe85⤵PID:1208
-
\??\c:\njnpfrd.exec:\njnpfrd.exe86⤵PID:2328
-
\??\c:\lprhxr.exec:\lprhxr.exe87⤵PID:2784
-
\??\c:\rthpvt.exec:\rthpvt.exe88⤵PID:2640
-
\??\c:\ptxtbdx.exec:\ptxtbdx.exe89⤵PID:2588
-
\??\c:\blpjbx.exec:\blpjbx.exe90⤵PID:1424
-
\??\c:\lxvfbxh.exec:\lxvfbxh.exe91⤵PID:2396
-
\??\c:\ttphd.exec:\ttphd.exe92⤵PID:828
-
\??\c:\nvxjx.exec:\nvxjx.exe93⤵PID:1168
-
\??\c:\nvpxblt.exec:\nvpxblt.exe94⤵PID:2032
-
\??\c:\xhpvvjn.exec:\xhpvvjn.exe95⤵PID:2832
-
\??\c:\nndhfft.exec:\nndhfft.exe96⤵PID:2892
-
\??\c:\lfxtf.exec:\lfxtf.exe97⤵PID:2696
-
\??\c:\tjhrddf.exec:\tjhrddf.exe98⤵PID:1184
-
\??\c:\dxrtxx.exec:\dxrtxx.exe99⤵PID:1368
-
\??\c:\xtxfxv.exec:\xtxfxv.exe100⤵PID:2352
-
\??\c:\rjtrtd.exec:\rjtrtd.exe101⤵PID:1052
-
\??\c:\rxnxb.exec:\rxnxb.exe102⤵PID:1096
-
\??\c:\hrjvfn.exec:\hrjvfn.exe103⤵PID:2020
-
\??\c:\pjttvl.exec:\pjttvl.exe104⤵PID:884
-
\??\c:\jhxntb.exec:\jhxntb.exe105⤵PID:564
-
\??\c:\bdlnxvx.exec:\bdlnxvx.exe106⤵PID:1940
-
\??\c:\frtnvj.exec:\frtnvj.exe107⤵PID:2120
-
\??\c:\frnrv.exec:\frnrv.exe108⤵PID:2916
-
\??\c:\lvvxh.exec:\lvvxh.exe109⤵PID:2792
-
\??\c:\rdfnbh.exec:\rdfnbh.exe110⤵PID:1064
-
\??\c:\ppjvt.exec:\ppjvt.exe111⤵PID:1988
-
\??\c:\dttrrhf.exec:\dttrrhf.exe112⤵PID:460
-
\??\c:\htrvv.exec:\htrvv.exe113⤵PID:1840
-
\??\c:\lnxlx.exec:\lnxlx.exe114⤵PID:1972
-
\??\c:\jtbrnd.exec:\jtbrnd.exe115⤵PID:2708
-
\??\c:\dllrrd.exec:\dllrrd.exe116⤵PID:1852
-
\??\c:\xldjpvb.exec:\xldjpvb.exe117⤵PID:1508
-
\??\c:\dxnpv.exec:\dxnpv.exe118⤵PID:536
-
\??\c:\dhpjrl.exec:\dhpjrl.exe119⤵PID:720
-
\??\c:\lxpbh.exec:\lxpbh.exe120⤵PID:880
-
\??\c:\rbtvt.exec:\rbtvt.exe121⤵PID:892
-
\??\c:\hhnxj.exec:\hhnxj.exe122⤵PID:2248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-