Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 03:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0f3b32e128ec7a107a86ff544929ad0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a0f3b32e128ec7a107a86ff544929ad0_NeikiAnalytics.exe
-
Size
66KB
-
MD5
a0f3b32e128ec7a107a86ff544929ad0
-
SHA1
efac7d94926431c491b443a5da5548afe1e7103c
-
SHA256
8cb19b216ea0dd4adb88d569212bde5a4db058e2b5856ae2fd78c774934aab1a
-
SHA512
5346b794f438393f728aff3f7db2506e0135600322139f07eb14155d656b9032861fdc68fc4e520acde6dd6bb07ca4098c9fbae1c9ceabccc3374c6b5921c3b2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUPqrDZu:ymb3NkkiQ3mdBjF0yUmY
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/1688-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1188-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/936-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ppnlnnj.exendbnf.exerbfrxvx.exenvpxb.exebbjvx.exelrxpp.exevblnj.exerhhjhj.exedndvjn.exexpvvjp.exedhdrb.exenxhph.exephvvbjf.exehhpndj.exebtpdln.exejhfhj.exexbtvp.exexfhxfd.exebhbjtpj.exedrvtr.exevfbnn.exerrbrjn.exeblppt.exennnvv.exeljbbhh.exefllrhx.exejbjrn.exeptldrj.exexhtbrtd.exexdhrxr.exelfdpp.exedrhdr.exetrlbxrd.exelnnxdpn.exepxbhjnj.exejnndn.exevbhjn.exebxnnfpp.exevfbbhn.exehxvlj.exelppnft.exebdbbpx.exetvbhn.exepjvnfnv.exedpvhlrb.exejjvjx.exevxbvtbn.exeflhnxp.exebnxlv.exebpfhxfl.exebbhhnd.exenxxtxj.exebfrtdlp.exerhrnf.exedtdvd.exebxxdhx.exertjxd.exejfnxlx.exelrpvhf.exerhnhjb.exebvhrd.exenvbrdnp.exevtvnhn.exelprjxd.exepid process 2428 ppnlnnj.exe 2460 ndbnf.exe 2612 rbfrxvx.exe 2636 nvpxb.exe 2536 bbjvx.exe 2464 lrxpp.exe 2420 vblnj.exe 2988 rhhjhj.exe 1492 dndvjn.exe 1188 xpvvjp.exe 1508 dhdrb.exe 1856 nxhph.exe 2032 phvvbjf.exe 1452 hhpndj.exe 1620 btpdln.exe 1812 jhfhj.exe 936 xbtvp.exe 1676 xfhxfd.exe 2052 bhbjtpj.exe 1552 drvtr.exe 2848 vfbnn.exe 2980 rrbrjn.exe 2928 blppt.exe 668 nnnvv.exe 1780 ljbbhh.exe 1784 fllrhx.exe 2824 jbjrn.exe 2304 ptldrj.exe 2696 xhtbrtd.exe 1076 xdhrxr.exe 2088 lfdpp.exe 1500 drhdr.exe 1580 trlbxrd.exe 2176 lnnxdpn.exe 2856 pxbhjnj.exe 2500 jnndn.exe 2508 vbhjn.exe 2576 bxnnfpp.exe 2624 vfbbhn.exe 2664 hxvlj.exe 2376 lppnft.exe 2404 bdbbpx.exe 2472 tvbhn.exe 2952 pjvnfnv.exe 2212 dpvhlrb.exe 960 jjvjx.exe 1608 vxbvtbn.exe 832 flhnxp.exe 752 bnxlv.exe 3020 bpfhxfl.exe 1668 bbhhnd.exe 2000 nxxtxj.exe 1072 bfrtdlp.exe 1804 rhrnf.exe 620 dtdvd.exe 804 bxxdhx.exe 936 rtjxd.exe 2072 jfnxlx.exe 1916 lrpvhf.exe 2872 rhnhjb.exe 1720 bvhrd.exe 2844 nvbrdnp.exe 2980 vtvnhn.exe 1144 lprjxd.exe -
Processes:
resource yara_rule behavioral1/memory/1688-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1188-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/936-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a0f3b32e128ec7a107a86ff544929ad0_NeikiAnalytics.exeppnlnnj.exendbnf.exerbfrxvx.exenvpxb.exebbjvx.exelrxpp.exevblnj.exerhhjhj.exedndvjn.exexpvvjp.exedhdrb.exenxhph.exephvvbjf.exehhpndj.exebtpdln.exedescription pid process target process PID 1688 wrote to memory of 2428 1688 a0f3b32e128ec7a107a86ff544929ad0_NeikiAnalytics.exe ppnlnnj.exe PID 1688 wrote to memory of 2428 1688 a0f3b32e128ec7a107a86ff544929ad0_NeikiAnalytics.exe ppnlnnj.exe PID 1688 wrote to memory of 2428 1688 a0f3b32e128ec7a107a86ff544929ad0_NeikiAnalytics.exe ppnlnnj.exe PID 1688 wrote to memory of 2428 1688 a0f3b32e128ec7a107a86ff544929ad0_NeikiAnalytics.exe ppnlnnj.exe PID 2428 wrote to memory of 2460 2428 ppnlnnj.exe ndbnf.exe PID 2428 wrote to memory of 2460 2428 ppnlnnj.exe ndbnf.exe PID 2428 wrote to memory of 2460 2428 ppnlnnj.exe ndbnf.exe PID 2428 wrote to memory of 2460 2428 ppnlnnj.exe ndbnf.exe PID 2460 wrote to memory of 2612 2460 ndbnf.exe rbfrxvx.exe PID 2460 wrote to memory of 2612 2460 ndbnf.exe rbfrxvx.exe PID 2460 wrote to memory of 2612 2460 ndbnf.exe rbfrxvx.exe PID 2460 wrote to memory of 2612 2460 ndbnf.exe rbfrxvx.exe PID 2612 wrote to memory of 2636 2612 rbfrxvx.exe nvpxb.exe PID 2612 wrote to memory of 2636 2612 rbfrxvx.exe nvpxb.exe PID 2612 wrote to memory of 2636 2612 rbfrxvx.exe nvpxb.exe PID 2612 wrote to memory of 2636 2612 rbfrxvx.exe nvpxb.exe PID 2636 wrote to memory of 2536 2636 nvpxb.exe bbjvx.exe PID 2636 wrote to memory of 2536 2636 nvpxb.exe bbjvx.exe PID 2636 wrote to memory of 2536 2636 nvpxb.exe bbjvx.exe PID 2636 wrote to memory of 2536 2636 nvpxb.exe bbjvx.exe PID 2536 wrote to memory of 2464 2536 bbjvx.exe lrxpp.exe PID 2536 wrote to memory of 2464 2536 bbjvx.exe lrxpp.exe PID 2536 wrote to memory of 2464 2536 bbjvx.exe lrxpp.exe PID 2536 wrote to memory of 2464 2536 bbjvx.exe lrxpp.exe PID 2464 wrote to memory of 2420 2464 lrxpp.exe vblnj.exe PID 2464 wrote to memory of 2420 2464 lrxpp.exe vblnj.exe PID 2464 wrote to memory of 2420 2464 lrxpp.exe vblnj.exe PID 2464 wrote to memory of 2420 2464 lrxpp.exe vblnj.exe PID 2420 wrote to memory of 2988 2420 vblnj.exe rhhjhj.exe PID 2420 wrote to memory of 2988 2420 vblnj.exe rhhjhj.exe PID 2420 wrote to memory of 2988 2420 vblnj.exe rhhjhj.exe PID 2420 wrote to memory of 2988 2420 vblnj.exe rhhjhj.exe PID 2988 wrote to memory of 1492 2988 rhhjhj.exe dndvjn.exe PID 2988 wrote to memory of 1492 2988 rhhjhj.exe dndvjn.exe PID 2988 wrote to memory of 1492 2988 rhhjhj.exe dndvjn.exe PID 2988 wrote to memory of 1492 2988 rhhjhj.exe dndvjn.exe PID 1492 wrote to memory of 1188 1492 dndvjn.exe xpvvjp.exe PID 1492 wrote to memory of 1188 1492 dndvjn.exe xpvvjp.exe PID 1492 wrote to memory of 1188 1492 dndvjn.exe xpvvjp.exe PID 1492 wrote to memory of 1188 1492 dndvjn.exe xpvvjp.exe PID 1188 wrote to memory of 1508 1188 xpvvjp.exe dhdrb.exe PID 1188 wrote to memory of 1508 1188 xpvvjp.exe dhdrb.exe PID 1188 wrote to memory of 1508 1188 xpvvjp.exe dhdrb.exe PID 1188 wrote to memory of 1508 1188 xpvvjp.exe dhdrb.exe PID 1508 wrote to memory of 1856 1508 dhdrb.exe nxhph.exe PID 1508 wrote to memory of 1856 1508 dhdrb.exe nxhph.exe PID 1508 wrote to memory of 1856 1508 dhdrb.exe nxhph.exe PID 1508 wrote to memory of 1856 1508 dhdrb.exe nxhph.exe PID 1856 wrote to memory of 2032 1856 nxhph.exe phvvbjf.exe PID 1856 wrote to memory of 2032 1856 nxhph.exe phvvbjf.exe PID 1856 wrote to memory of 2032 1856 nxhph.exe phvvbjf.exe PID 1856 wrote to memory of 2032 1856 nxhph.exe phvvbjf.exe PID 2032 wrote to memory of 1452 2032 phvvbjf.exe hhpndj.exe PID 2032 wrote to memory of 1452 2032 phvvbjf.exe hhpndj.exe PID 2032 wrote to memory of 1452 2032 phvvbjf.exe hhpndj.exe PID 2032 wrote to memory of 1452 2032 phvvbjf.exe hhpndj.exe PID 1452 wrote to memory of 1620 1452 hhpndj.exe btpdln.exe PID 1452 wrote to memory of 1620 1452 hhpndj.exe btpdln.exe PID 1452 wrote to memory of 1620 1452 hhpndj.exe btpdln.exe PID 1452 wrote to memory of 1620 1452 hhpndj.exe btpdln.exe PID 1620 wrote to memory of 1812 1620 btpdln.exe jhfhj.exe PID 1620 wrote to memory of 1812 1620 btpdln.exe jhfhj.exe PID 1620 wrote to memory of 1812 1620 btpdln.exe jhfhj.exe PID 1620 wrote to memory of 1812 1620 btpdln.exe jhfhj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0f3b32e128ec7a107a86ff544929ad0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a0f3b32e128ec7a107a86ff544929ad0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\ppnlnnj.exec:\ppnlnnj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\ndbnf.exec:\ndbnf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\rbfrxvx.exec:\rbfrxvx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\nvpxb.exec:\nvpxb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\bbjvx.exec:\bbjvx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\lrxpp.exec:\lrxpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\vblnj.exec:\vblnj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\rhhjhj.exec:\rhhjhj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\dndvjn.exec:\dndvjn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\xpvvjp.exec:\xpvvjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\dhdrb.exec:\dhdrb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\nxhph.exec:\nxhph.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\phvvbjf.exec:\phvvbjf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\hhpndj.exec:\hhpndj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\btpdln.exec:\btpdln.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\jhfhj.exec:\jhfhj.exe17⤵
- Executes dropped EXE
PID:1812 -
\??\c:\xbtvp.exec:\xbtvp.exe18⤵
- Executes dropped EXE
PID:936 -
\??\c:\xfhxfd.exec:\xfhxfd.exe19⤵
- Executes dropped EXE
PID:1676 -
\??\c:\bhbjtpj.exec:\bhbjtpj.exe20⤵
- Executes dropped EXE
PID:2052 -
\??\c:\drvtr.exec:\drvtr.exe21⤵
- Executes dropped EXE
PID:1552 -
\??\c:\vfbnn.exec:\vfbnn.exe22⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rrbrjn.exec:\rrbrjn.exe23⤵
- Executes dropped EXE
PID:2980 -
\??\c:\blppt.exec:\blppt.exe24⤵
- Executes dropped EXE
PID:2928 -
\??\c:\nnnvv.exec:\nnnvv.exe25⤵
- Executes dropped EXE
PID:668 -
\??\c:\ljbbhh.exec:\ljbbhh.exe26⤵
- Executes dropped EXE
PID:1780 -
\??\c:\fllrhx.exec:\fllrhx.exe27⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jbjrn.exec:\jbjrn.exe28⤵
- Executes dropped EXE
PID:2824 -
\??\c:\ptldrj.exec:\ptldrj.exe29⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xhtbrtd.exec:\xhtbrtd.exe30⤵
- Executes dropped EXE
PID:2696 -
\??\c:\xdhrxr.exec:\xdhrxr.exe31⤵
- Executes dropped EXE
PID:1076 -
\??\c:\lfdpp.exec:\lfdpp.exe32⤵
- Executes dropped EXE
PID:2088 -
\??\c:\drhdr.exec:\drhdr.exe33⤵
- Executes dropped EXE
PID:1500 -
\??\c:\trlbxrd.exec:\trlbxrd.exe34⤵
- Executes dropped EXE
PID:1580 -
\??\c:\njvrn.exec:\njvrn.exe35⤵PID:1688
-
\??\c:\lnnxdpn.exec:\lnnxdpn.exe36⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pxbhjnj.exec:\pxbhjnj.exe37⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jnndn.exec:\jnndn.exe38⤵
- Executes dropped EXE
PID:2500 -
\??\c:\vbhjn.exec:\vbhjn.exe39⤵
- Executes dropped EXE
PID:2508 -
\??\c:\bxnnfpp.exec:\bxnnfpp.exe40⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vfbbhn.exec:\vfbbhn.exe41⤵
- Executes dropped EXE
PID:2624 -
\??\c:\hxvlj.exec:\hxvlj.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\lppnft.exec:\lppnft.exe43⤵
- Executes dropped EXE
PID:2376 -
\??\c:\bdbbpx.exec:\bdbbpx.exe44⤵
- Executes dropped EXE
PID:2404 -
\??\c:\tvbhn.exec:\tvbhn.exe45⤵
- Executes dropped EXE
PID:2472 -
\??\c:\pjvnfnv.exec:\pjvnfnv.exe46⤵
- Executes dropped EXE
PID:2952 -
\??\c:\dpvhlrb.exec:\dpvhlrb.exe47⤵
- Executes dropped EXE
PID:2212 -
\??\c:\jjvjx.exec:\jjvjx.exe48⤵
- Executes dropped EXE
PID:960 -
\??\c:\vxbvtbn.exec:\vxbvtbn.exe49⤵
- Executes dropped EXE
PID:1608 -
\??\c:\flhnxp.exec:\flhnxp.exe50⤵
- Executes dropped EXE
PID:832 -
\??\c:\bnxlv.exec:\bnxlv.exe51⤵
- Executes dropped EXE
PID:752 -
\??\c:\bpfhxfl.exec:\bpfhxfl.exe52⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bbhhnd.exec:\bbhhnd.exe53⤵
- Executes dropped EXE
PID:1668 -
\??\c:\nxxtxj.exec:\nxxtxj.exe54⤵
- Executes dropped EXE
PID:2000 -
\??\c:\bfrtdlp.exec:\bfrtdlp.exe55⤵
- Executes dropped EXE
PID:1072 -
\??\c:\rhrnf.exec:\rhrnf.exe56⤵
- Executes dropped EXE
PID:1804 -
\??\c:\dtdvd.exec:\dtdvd.exe57⤵
- Executes dropped EXE
PID:620 -
\??\c:\bxxdhx.exec:\bxxdhx.exe58⤵
- Executes dropped EXE
PID:804 -
\??\c:\rtjxd.exec:\rtjxd.exe59⤵
- Executes dropped EXE
PID:936 -
\??\c:\jfnxlx.exec:\jfnxlx.exe60⤵
- Executes dropped EXE
PID:2072 -
\??\c:\lrpvhf.exec:\lrpvhf.exe61⤵
- Executes dropped EXE
PID:1916 -
\??\c:\rhnhjb.exec:\rhnhjb.exe62⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bvhrd.exec:\bvhrd.exe63⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nvbrdnp.exec:\nvbrdnp.exe64⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vtvnhn.exec:\vtvnhn.exe65⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lprjxd.exec:\lprjxd.exe66⤵
- Executes dropped EXE
PID:1144 -
\??\c:\xhxbf.exec:\xhxbf.exe67⤵PID:964
-
\??\c:\jnnvr.exec:\jnnvr.exe68⤵PID:1992
-
\??\c:\tnxpjnt.exec:\tnxpjnt.exe69⤵PID:1976
-
\??\c:\tthjtbr.exec:\tthjtbr.exe70⤵PID:1964
-
\??\c:\brhrhxx.exec:\brhrhxx.exe71⤵PID:2528
-
\??\c:\hrprbf.exec:\hrprbf.exe72⤵PID:2760
-
\??\c:\rlvhpbv.exec:\rlvhpbv.exe73⤵PID:2808
-
\??\c:\hdfvnj.exec:\hdfvnj.exe74⤵PID:1636
-
\??\c:\hrthhr.exec:\hrthhr.exe75⤵PID:2816
-
\??\c:\lhpfnv.exec:\lhpfnv.exe76⤵PID:2088
-
\??\c:\ljfdb.exec:\ljfdb.exe77⤵PID:2224
-
\??\c:\xtbxppd.exec:\xtbxppd.exe78⤵PID:1604
-
\??\c:\jhndftd.exec:\jhndftd.exe79⤵PID:2532
-
\??\c:\njnvxld.exec:\njnvxld.exe80⤵PID:2176
-
\??\c:\rrvnj.exec:\rrvnj.exe81⤵PID:2560
-
\??\c:\rfjtr.exec:\rfjtr.exe82⤵PID:2608
-
\??\c:\rbrnjr.exec:\rbrnjr.exe83⤵PID:2712
-
\??\c:\nhthldr.exec:\nhthldr.exe84⤵PID:2512
-
\??\c:\flvbrr.exec:\flvbrr.exe85⤵PID:2828
-
\??\c:\pjrhb.exec:\pjrhb.exe86⤵PID:2524
-
\??\c:\vjfvx.exec:\vjfvx.exe87⤵PID:2360
-
\??\c:\fbjpld.exec:\fbjpld.exe88⤵PID:2832
-
\??\c:\bhxff.exec:\bhxff.exe89⤵PID:2420
-
\??\c:\jjbnlbn.exec:\jjbnlbn.exe90⤵PID:2988
-
\??\c:\vjrbfh.exec:\vjrbfh.exe91⤵PID:568
-
\??\c:\nljfvf.exec:\nljfvf.exe92⤵PID:488
-
\??\c:\rhttbb.exec:\rhttbb.exe93⤵PID:536
-
\??\c:\vjxtbh.exec:\vjxtbh.exe94⤵PID:3028
-
\??\c:\plfpnlb.exec:\plfpnlb.exe95⤵PID:832
-
\??\c:\jrpbt.exec:\jrpbt.exe96⤵PID:2308
-
\??\c:\tlfhvtl.exec:\tlfhvtl.exe97⤵PID:3020
-
\??\c:\rjtdf.exec:\rjtdf.exe98⤵PID:1528
-
\??\c:\bnbrtn.exec:\bnbrtn.exe99⤵PID:1424
-
\??\c:\bfvrr.exec:\bfvrr.exe100⤵PID:1820
-
\??\c:\nlxdr.exec:\nlxdr.exe101⤵PID:1748
-
\??\c:\drxtvjf.exec:\drxtvjf.exe102⤵PID:1512
-
\??\c:\ffvdrv.exec:\ffvdrv.exe103⤵PID:1344
-
\??\c:\tnhnnj.exec:\tnhnnj.exe104⤵PID:1256
-
\??\c:\vdxffv.exec:\vdxffv.exe105⤵PID:2276
-
\??\c:\dftflhb.exec:\dftflhb.exe106⤵PID:1552
-
\??\c:\ljrvr.exec:\ljrvr.exe107⤵PID:644
-
\??\c:\jnjrpht.exec:\jnjrpht.exe108⤵PID:2208
-
\??\c:\rhlbj.exec:\rhlbj.exe109⤵PID:1048
-
\??\c:\jdhvjt.exec:\jdhvjt.exe110⤵PID:2268
-
\??\c:\dlrhxx.exec:\dlrhxx.exe111⤵PID:668
-
\??\c:\rnpvp.exec:\rnpvp.exe112⤵PID:944
-
\??\c:\flfpjbr.exec:\flfpjbr.exe113⤵PID:1972
-
\??\c:\bnvxbxp.exec:\bnvxbxp.exe114⤵PID:320
-
\??\c:\vhfjl.exec:\vhfjl.exe115⤵PID:2256
-
\??\c:\xrpbn.exec:\xrpbn.exe116⤵PID:1940
-
\??\c:\lpnnhdx.exec:\lpnnhdx.exe117⤵PID:1708
-
\??\c:\pvjddlx.exec:\pvjddlx.exe118⤵PID:1004
-
\??\c:\bltln.exec:\bltln.exe119⤵PID:1636
-
\??\c:\bnnjlf.exec:\bnnjlf.exe120⤵PID:1944
-
\??\c:\lnjhf.exec:\lnjhf.exe121⤵PID:2228
-
\??\c:\rdtbb.exec:\rdtbb.exe122⤵PID:2204
-
\??\c:\bvlhp.exec:\bvlhp.exe123⤵PID:2108
-
\??\c:\jxvbb.exec:\jxvbb.exe124⤵PID:3024
-
\??\c:\tljff.exec:\tljff.exe125⤵PID:2504
-
\??\c:\jbdnbjd.exec:\jbdnbjd.exe126⤵PID:2456
-
\??\c:\jvjfvxl.exec:\jvjfvxl.exe127⤵PID:2468
-
\??\c:\ffljj.exec:\ffljj.exe128⤵PID:2636
-
\??\c:\nprvr.exec:\nprvr.exe129⤵PID:2664
-
\??\c:\tnbrdh.exec:\tnbrdh.exe130⤵PID:2400
-
\??\c:\nnfbh.exec:\nnfbh.exe131⤵PID:2344
-
\??\c:\rptfvx.exec:\rptfvx.exe132⤵PID:2472
-
\??\c:\rbtxr.exec:\rbtxr.exe133⤵PID:1412
-
\??\c:\ndvtn.exec:\ndvtn.exe134⤵PID:1480
-
\??\c:\nfvff.exec:\nfvff.exe135⤵PID:1800
-
\??\c:\dhpllhd.exec:\dhpllhd.exe136⤵PID:572
-
\??\c:\lnldj.exec:\lnldj.exe137⤵PID:1060
-
\??\c:\xxjjxr.exec:\xxjjxr.exe138⤵PID:2888
-
\??\c:\nxbprt.exec:\nxbprt.exe139⤵PID:2168
-
\??\c:\dnlpxnv.exec:\dnlpxnv.exe140⤵PID:1228
-
\??\c:\flvljl.exec:\flvljl.exe141⤵PID:824
-
\??\c:\vhvlnf.exec:\vhvlnf.exe142⤵PID:2032
-
\??\c:\lldpx.exec:\lldpx.exe143⤵PID:2408
-
\??\c:\rdrhtvx.exec:\rdrhtvx.exe144⤵PID:1092
-
\??\c:\lhnhxxl.exec:\lhnhxxl.exe145⤵PID:932
-
\??\c:\vhpbp.exec:\vhpbp.exe146⤵PID:880
-
\??\c:\xjjrv.exec:\xjjrv.exe147⤵PID:1852
-
\??\c:\ptnxx.exec:\ptnxx.exe148⤵PID:476
-
\??\c:\hbjfbv.exec:\hbjfbv.exe149⤵PID:2896
-
\??\c:\xdnjdrh.exec:\xdnjdrh.exe150⤵PID:372
-
\??\c:\jpllhdl.exec:\jpllhdl.exe151⤵PID:2932
-
\??\c:\fbdnbfb.exec:\fbdnbfb.exe152⤵PID:3016
-
\??\c:\fblrnj.exec:\fblrnj.exe153⤵PID:1548
-
\??\c:\fttvxbf.exec:\fttvxbf.exe154⤵PID:1828
-
\??\c:\vtllhd.exec:\vtllhd.exe155⤵PID:1000
-
\??\c:\fhbvpnj.exec:\fhbvpnj.exe156⤵PID:1992
-
\??\c:\fdnlhn.exec:\fdnlhn.exe157⤵PID:744
-
\??\c:\pdnfr.exec:\pdnfr.exe158⤵PID:1536
-
\??\c:\dflntnb.exec:\dflntnb.exe159⤵PID:320
-
\??\c:\pfpjbh.exec:\pfpjbh.exe160⤵PID:2740
-
\??\c:\xlvjxv.exec:\xlvjxv.exe161⤵PID:1740
-
\??\c:\jpffbjn.exec:\jpffbjn.exe162⤵PID:2312
-
\??\c:\vnfvrrj.exec:\vnfvrrj.exe163⤵PID:1004
-
\??\c:\bltpjh.exec:\bltpjh.exe164⤵PID:2112
-
\??\c:\llldp.exec:\llldp.exe165⤵PID:1600
-
\??\c:\rhrfnjn.exec:\rhrfnjn.exe166⤵PID:2852
-
\??\c:\jlfxvn.exec:\jlfxvn.exe167⤵PID:1576
-
\??\c:\fhjpfh.exec:\fhjpfh.exe168⤵PID:2028
-
\??\c:\ndlvt.exec:\ndlvt.exe169⤵PID:2564
-
\??\c:\jhtrhhx.exec:\jhtrhhx.exe170⤵PID:2272
-
\??\c:\lpvdtd.exec:\lpvdtd.exe171⤵PID:2600
-
\??\c:\vnvtj.exec:\vnvtj.exe172⤵PID:2468
-
\??\c:\lbvrddh.exec:\lbvrddh.exe173⤵PID:2876
-
\??\c:\pjljdt.exec:\pjljdt.exe174⤵PID:2664
-
\??\c:\dfpjh.exec:\dfpjh.exe175⤵PID:2400
-
\??\c:\jtpbjl.exec:\jtpbjl.exe176⤵PID:2344
-
\??\c:\dxxvp.exec:\dxxvp.exe177⤵PID:2328
-
\??\c:\jxvbr.exec:\jxvbr.exe178⤵PID:1412
-
\??\c:\xprbf.exec:\xprbf.exe179⤵PID:2212
-
\??\c:\rrrrvv.exec:\rrrrvv.exe180⤵PID:1800
-
\??\c:\hfrjpt.exec:\hfrjpt.exe181⤵PID:564
-
\??\c:\vnxrpnt.exec:\vnxrpnt.exe182⤵PID:1060
-
\??\c:\pblhl.exec:\pblhl.exe183⤵PID:2888
-
\??\c:\xfdrtfn.exec:\xfdrtfn.exe184⤵PID:2168
-
\??\c:\pjtbn.exec:\pjtbn.exe185⤵PID:1428
-
\??\c:\ndvxd.exec:\ndvxd.exe186⤵PID:824
-
\??\c:\rldflv.exec:\rldflv.exe187⤵PID:2332
-
\??\c:\dtndb.exec:\dtndb.exe188⤵PID:2408
-
\??\c:\dxnxln.exec:\dxnxln.exe189⤵PID:1092
-
\??\c:\blfbrh.exec:\blfbrh.exe190⤵PID:932
-
\??\c:\dbbdjn.exec:\dbbdjn.exe191⤵PID:880
-
\??\c:\bhhxvrh.exec:\bhhxvrh.exe192⤵PID:2052
-
\??\c:\phjrrv.exec:\phjrrv.exe193⤵PID:476
-
\??\c:\ppthvfj.exec:\ppthvfj.exe194⤵PID:2896
-
\??\c:\lpxlbtv.exec:\lpxlbtv.exe195⤵PID:2864
-
\??\c:\fjvbrlf.exec:\fjvbrlf.exe196⤵PID:2932
-
\??\c:\bbbndt.exec:\bbbndt.exe197⤵PID:1728
-
\??\c:\pffjdb.exec:\pffjdb.exe198⤵PID:1548
-
\??\c:\httlxjp.exec:\httlxjp.exe199⤵PID:1660
-
\??\c:\tftrll.exec:\tftrll.exe200⤵PID:1000
-
\??\c:\ptftb.exec:\ptftb.exe201⤵PID:1992
-
\??\c:\xrvhrxn.exec:\xrvhrxn.exe202⤵PID:1964
-
\??\c:\thnrh.exec:\thnrh.exe203⤵PID:2528
-
\??\c:\rbrnn.exec:\rbrnn.exe204⤵PID:2348
-
\??\c:\lrbfnpx.exec:\lrbfnpx.exe205⤵PID:2124
-
\??\c:\vllfxl.exec:\vllfxl.exe206⤵PID:1628
-
\??\c:\xnnbr.exec:\xnnbr.exe207⤵PID:2312
-
\??\c:\tvvjb.exec:\tvvjb.exe208⤵PID:1004
-
\??\c:\tbpplh.exec:\tbpplh.exe209⤵PID:2180
-
\??\c:\rjdtr.exec:\rjdtr.exe210⤵PID:1600
-
\??\c:\xrphjj.exec:\xrphjj.exe211⤵PID:2852
-
\??\c:\xfljdxx.exec:\xfljdxx.exe212⤵PID:1576
-
\??\c:\rxlhjjh.exec:\rxlhjjh.exe213⤵PID:2028
-
\??\c:\pdrdhnd.exec:\pdrdhnd.exe214⤵PID:2564
-
\??\c:\dvpnptf.exec:\dvpnptf.exe215⤵PID:2272
-
\??\c:\xhdptb.exec:\xhdptb.exe216⤵PID:2600
-
\??\c:\xnxtrl.exec:\xnxtrl.exe217⤵PID:2468
-
\??\c:\pndtv.exec:\pndtv.exe218⤵PID:2876
-
\??\c:\fxbbrpb.exec:\fxbbrpb.exe219⤵PID:2664
-
\??\c:\jnjtfpj.exec:\jnjtfpj.exe220⤵PID:2832
-
\??\c:\xxtlp.exec:\xxtlp.exe221⤵PID:1476
-
\??\c:\trfvpfl.exec:\trfvpfl.exe222⤵PID:628
-
\??\c:\bdjbt.exec:\bdjbt.exe223⤵PID:1876
-
\??\c:\bdvhrrn.exec:\bdvhrrn.exe224⤵PID:488
-
\??\c:\bhtfvrb.exec:\bhtfvrb.exe225⤵PID:1760
-
\??\c:\vhbxvv.exec:\vhbxvv.exe226⤵PID:564
-
\??\c:\dpxhv.exec:\dpxhv.exe227⤵PID:1060
-
\??\c:\vnrrd.exec:\vnrrd.exe228⤵PID:2888
-
\??\c:\bfjdvb.exec:\bfjdvb.exe229⤵PID:2168
-
\??\c:\dtrnxpx.exec:\dtrnxpx.exe230⤵PID:1428
-
\??\c:\jjpfdt.exec:\jjpfdt.exe231⤵PID:824
-
\??\c:\tfdfpt.exec:\tfdfpt.exe232⤵PID:2332
-
\??\c:\rbbftr.exec:\rbbftr.exe233⤵PID:2408
-
\??\c:\hpvlht.exec:\hpvlht.exe234⤵PID:1092
-
\??\c:\fdnxnlv.exec:\fdnxnlv.exe235⤵PID:932
-
\??\c:\dxbfffp.exec:\dxbfffp.exe236⤵PID:880
-
\??\c:\fhptbl.exec:\fhptbl.exe237⤵PID:772
-
\??\c:\vblvf.exec:\vblvf.exe238⤵PID:2848
-
\??\c:\tjbpp.exec:\tjbpp.exe239⤵PID:2136
-
\??\c:\pbdlr.exec:\pbdlr.exe240⤵PID:2208
-
\??\c:\rrnlvlp.exec:\rrnlvlp.exe241⤵PID:940
-
\??\c:\ntvdtt.exec:\ntvdtt.exe242⤵PID:1612