Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2023 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.957be433c06aab6ca2ed88281a012880.exe
Resource
win7-20230831-en
windows7-x64
5 signatures
150 seconds
General
-
Target
NEAS.957be433c06aab6ca2ed88281a012880.exe
-
Size
89KB
-
MD5
957be433c06aab6ca2ed88281a012880
-
SHA1
41e4d925a484f23412f01f2a946839c23e95c59d
-
SHA256
1bc180dde8d5627af56915b17c86f45682748eafc5c68ac756eb89e73d7d74a1
-
SHA512
7964edb206fb75c2919d474b27c56d5401faefe990161de8372d6d8b62f6119939d27948556d5405cac59eea805aa1ea3b577e59d0467f7b4d81ad8dd09dcc7b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxE6vr/mAt:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+bQ
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral2/memory/4564-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1140-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2596-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-329-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-343-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5004 tnhdfnt.exe 2384 tlddhlh.exe 4760 xrbjndd.exe 4300 nrvdplx.exe 468 fbljx.exe 1660 nbvtj.exe 4416 bbppj.exe 4620 ttppffp.exe 636 hxddvpv.exe 3720 xvfvdhx.exe 1840 hjnpjv.exe 3968 xndfdbr.exe 3732 ftlfh.exe 1704 nrjdr.exe 4400 nvlnnx.exe 4880 hjhhpbf.exe 3632 flhrfn.exe 1384 nntnd.exe 2068 prljxfb.exe 4804 trxrj.exe 3876 lrjjf.exe 4920 xxjhr.exe 2772 hllxb.exe 2176 jpvlnvh.exe 3244 hvprr.exe 2788 bvptprl.exe 1244 rvbfbf.exe 3464 hdrvhn.exe 640 dhxxtbp.exe 1140 hpjftd.exe 3684 llntd.exe 2596 frxhxl.exe 4952 jnbdppf.exe 1784 vxtpj.exe 3880 bffvblp.exe 4344 dfxttvt.exe 4712 bhpjdhv.exe 1284 xdjrpvt.exe 2536 txxvdxr.exe 2816 fnrxbln.exe 1968 rnbfjbj.exe 4760 nrrlf.exe 5016 brvtpx.exe 468 bjnvx.exe 4300 dfbxrrn.exe 2460 hxnddjd.exe 1500 bffpn.exe 3276 ljrhjjn.exe 636 nbhdfjt.exe 5108 ppndxjt.exe 1584 xxtbn.exe 3968 xrxrbbv.exe 4124 nfffr.exe 4160 tdvrfl.exe 1436 fbftld.exe 4444 dfntlfj.exe 3676 rjlnxpn.exe 3928 npvtpbf.exe 3296 lntlljj.exe 1096 brlth.exe 2804 pbrlhhr.exe 2424 lldffv.exe 776 bpvvr.exe 2772 lltjhj.exe -
resource yara_rule behavioral2/memory/4564-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1140-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2596-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2596-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2536-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-323-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-329-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-343-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-348-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4564 wrote to memory of 5004 4564 NEAS.957be433c06aab6ca2ed88281a012880.exe 81 PID 4564 wrote to memory of 5004 4564 NEAS.957be433c06aab6ca2ed88281a012880.exe 81 PID 4564 wrote to memory of 5004 4564 NEAS.957be433c06aab6ca2ed88281a012880.exe 81 PID 5004 wrote to memory of 2384 5004 tnhdfnt.exe 82 PID 5004 wrote to memory of 2384 5004 tnhdfnt.exe 82 PID 5004 wrote to memory of 2384 5004 tnhdfnt.exe 82 PID 2384 wrote to memory of 4760 2384 tlddhlh.exe 83 PID 2384 wrote to memory of 4760 2384 tlddhlh.exe 83 PID 2384 wrote to memory of 4760 2384 tlddhlh.exe 83 PID 4760 wrote to memory of 4300 4760 xrbjndd.exe 84 PID 4760 wrote to memory of 4300 4760 xrbjndd.exe 84 PID 4760 wrote to memory of 4300 4760 xrbjndd.exe 84 PID 4300 wrote to memory of 468 4300 nrvdplx.exe 85 PID 4300 wrote to memory of 468 4300 nrvdplx.exe 85 PID 4300 wrote to memory of 468 4300 nrvdplx.exe 85 PID 468 wrote to memory of 1660 468 fbljx.exe 87 PID 468 wrote to memory of 1660 468 fbljx.exe 87 PID 468 wrote to memory of 1660 468 fbljx.exe 87 PID 1660 wrote to memory of 4416 1660 nbvtj.exe 88 PID 1660 wrote to memory of 4416 1660 nbvtj.exe 88 PID 1660 wrote to memory of 4416 1660 nbvtj.exe 88 PID 4416 wrote to memory of 4620 4416 bbppj.exe 89 PID 4416 wrote to memory of 4620 4416 bbppj.exe 89 PID 4416 wrote to memory of 4620 4416 bbppj.exe 89 PID 4620 wrote to memory of 636 4620 ttppffp.exe 92 PID 4620 wrote to memory of 636 4620 ttppffp.exe 92 PID 4620 wrote to memory of 636 4620 ttppffp.exe 92 PID 636 wrote to memory of 3720 636 hxddvpv.exe 90 PID 636 wrote to memory of 3720 636 hxddvpv.exe 90 PID 636 wrote to memory of 3720 636 hxddvpv.exe 90 PID 3720 wrote to memory of 1840 3720 xvfvdhx.exe 91 PID 3720 wrote to memory of 1840 3720 xvfvdhx.exe 91 PID 3720 wrote to memory of 1840 3720 xvfvdhx.exe 91 PID 1840 wrote to memory of 3968 1840 hjnpjv.exe 93 PID 1840 wrote to memory of 3968 1840 hjnpjv.exe 93 PID 1840 wrote to memory of 3968 1840 hjnpjv.exe 93 PID 3968 wrote to memory of 3732 3968 xndfdbr.exe 94 PID 3968 wrote to memory of 3732 3968 xndfdbr.exe 94 PID 3968 wrote to memory of 3732 3968 xndfdbr.exe 94 PID 3732 wrote to memory of 1704 3732 ftlfh.exe 95 PID 3732 wrote to memory of 1704 3732 ftlfh.exe 95 PID 3732 wrote to memory of 1704 3732 ftlfh.exe 95 PID 1704 wrote to memory of 4400 1704 nrjdr.exe 96 PID 1704 wrote to memory of 4400 1704 nrjdr.exe 96 PID 1704 wrote to memory of 4400 1704 nrjdr.exe 96 PID 4400 wrote to memory of 4880 4400 nvlnnx.exe 97 PID 4400 wrote to memory of 4880 4400 nvlnnx.exe 97 PID 4400 wrote to memory of 4880 4400 nvlnnx.exe 97 PID 4880 wrote to memory of 3632 4880 hjhhpbf.exe 98 PID 4880 wrote to memory of 3632 4880 hjhhpbf.exe 98 PID 4880 wrote to memory of 3632 4880 hjhhpbf.exe 98 PID 3632 wrote to memory of 1384 3632 flhrfn.exe 99 PID 3632 wrote to memory of 1384 3632 flhrfn.exe 99 PID 3632 wrote to memory of 1384 3632 flhrfn.exe 99 PID 1384 wrote to memory of 2068 1384 nntnd.exe 100 PID 1384 wrote to memory of 2068 1384 nntnd.exe 100 PID 1384 wrote to memory of 2068 1384 nntnd.exe 100 PID 2068 wrote to memory of 4804 2068 prljxfb.exe 101 PID 2068 wrote to memory of 4804 2068 prljxfb.exe 101 PID 2068 wrote to memory of 4804 2068 prljxfb.exe 101 PID 4804 wrote to memory of 3876 4804 trxrj.exe 102 PID 4804 wrote to memory of 3876 4804 trxrj.exe 102 PID 4804 wrote to memory of 3876 4804 trxrj.exe 102 PID 3876 wrote to memory of 4920 3876 lrjjf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.957be433c06aab6ca2ed88281a012880.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.957be433c06aab6ca2ed88281a012880.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\tnhdfnt.exec:\tnhdfnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\tlddhlh.exec:\tlddhlh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\xrbjndd.exec:\xrbjndd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\nrvdplx.exec:\nrvdplx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\fbljx.exec:\fbljx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\nbvtj.exec:\nbvtj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\bbppj.exec:\bbppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\ttppffp.exec:\ttppffp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\hxddvpv.exec:\hxddvpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636
-
-
-
-
-
-
-
-
-
-
\??\c:\xvfvdhx.exec:\xvfvdhx.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\hjnpjv.exec:\hjnpjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\xndfdbr.exec:\xndfdbr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\ftlfh.exec:\ftlfh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\nrjdr.exec:\nrjdr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\nvlnnx.exec:\nvlnnx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\hjhhpbf.exec:\hjhhpbf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\flhrfn.exec:\flhrfn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\nntnd.exec:\nntnd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\prljxfb.exec:\prljxfb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\trxrj.exec:\trxrj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\lrjjf.exec:\lrjjf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\xxjhr.exec:\xxjhr.exe13⤵
- Executes dropped EXE
PID:4920 -
\??\c:\hllxb.exec:\hllxb.exe14⤵
- Executes dropped EXE
PID:2772 -
\??\c:\jpvlnvh.exec:\jpvlnvh.exe15⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hvprr.exec:\hvprr.exe16⤵
- Executes dropped EXE
PID:3244 -
\??\c:\bvptprl.exec:\bvptprl.exe17⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rvbfbf.exec:\rvbfbf.exe18⤵
- Executes dropped EXE
PID:1244 -
\??\c:\hdrvhn.exec:\hdrvhn.exe19⤵
- Executes dropped EXE
PID:3464 -
\??\c:\dhxxtbp.exec:\dhxxtbp.exe20⤵
- Executes dropped EXE
PID:640 -
\??\c:\hpjftd.exec:\hpjftd.exe21⤵
- Executes dropped EXE
PID:1140 -
\??\c:\llntd.exec:\llntd.exe22⤵
- Executes dropped EXE
PID:3684 -
\??\c:\frxhxl.exec:\frxhxl.exe23⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jnbdppf.exec:\jnbdppf.exe24⤵
- Executes dropped EXE
PID:4952 -
\??\c:\vxtpj.exec:\vxtpj.exe25⤵
- Executes dropped EXE
PID:1784 -
\??\c:\bffvblp.exec:\bffvblp.exe26⤵
- Executes dropped EXE
PID:3880 -
\??\c:\dfxttvt.exec:\dfxttvt.exe27⤵
- Executes dropped EXE
PID:4344 -
\??\c:\bhpjdhv.exec:\bhpjdhv.exe28⤵
- Executes dropped EXE
PID:4712 -
\??\c:\xdjrpvt.exec:\xdjrpvt.exe29⤵
- Executes dropped EXE
PID:1284 -
\??\c:\txxvdxr.exec:\txxvdxr.exe30⤵
- Executes dropped EXE
PID:2536 -
\??\c:\fnrxbln.exec:\fnrxbln.exe31⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rnbfjbj.exec:\rnbfjbj.exe32⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nrrlf.exec:\nrrlf.exe33⤵
- Executes dropped EXE
PID:4760 -
\??\c:\brvtpx.exec:\brvtpx.exe34⤵
- Executes dropped EXE
PID:5016 -
\??\c:\bjnvx.exec:\bjnvx.exe35⤵
- Executes dropped EXE
PID:468 -
\??\c:\dfbxrrn.exec:\dfbxrrn.exe36⤵
- Executes dropped EXE
PID:4300 -
\??\c:\hxnddjd.exec:\hxnddjd.exe37⤵
- Executes dropped EXE
PID:2460 -
\??\c:\bffpn.exec:\bffpn.exe38⤵
- Executes dropped EXE
PID:1500 -
\??\c:\ljrhjjn.exec:\ljrhjjn.exe39⤵
- Executes dropped EXE
PID:3276 -
\??\c:\nbhdfjt.exec:\nbhdfjt.exe40⤵
- Executes dropped EXE
PID:636 -
\??\c:\ppndxjt.exec:\ppndxjt.exe41⤵
- Executes dropped EXE
PID:5108 -
\??\c:\xxtbn.exec:\xxtbn.exe42⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xrxrbbv.exec:\xrxrbbv.exe43⤵
- Executes dropped EXE
PID:3968 -
\??\c:\nfffr.exec:\nfffr.exe44⤵
- Executes dropped EXE
PID:4124 -
\??\c:\tdvrfl.exec:\tdvrfl.exe45⤵
- Executes dropped EXE
PID:4160 -
\??\c:\fbftld.exec:\fbftld.exe46⤵
- Executes dropped EXE
PID:1436 -
\??\c:\dfntlfj.exec:\dfntlfj.exe47⤵
- Executes dropped EXE
PID:4444 -
\??\c:\rjlnxpn.exec:\rjlnxpn.exe48⤵
- Executes dropped EXE
PID:3676 -
\??\c:\npvtpbf.exec:\npvtpbf.exe49⤵
- Executes dropped EXE
PID:3928 -
\??\c:\lntlljj.exec:\lntlljj.exe50⤵
- Executes dropped EXE
PID:3296 -
\??\c:\brlth.exec:\brlth.exe51⤵
- Executes dropped EXE
PID:1096 -
\??\c:\pbrlhhr.exec:\pbrlhhr.exe52⤵
- Executes dropped EXE
PID:2804 -
\??\c:\lldffv.exec:\lldffv.exe53⤵
- Executes dropped EXE
PID:2424 -
\??\c:\bpvvr.exec:\bpvvr.exe54⤵
- Executes dropped EXE
PID:776 -
\??\c:\lltjhj.exec:\lltjhj.exe55⤵
- Executes dropped EXE
PID:2772 -
\??\c:\btrrtt.exec:\btrrtt.exe56⤵PID:1532
-
\??\c:\fthftl.exec:\fthftl.exe57⤵PID:1680
-
\??\c:\njhtb.exec:\njhtb.exe58⤵PID:4148
-
\??\c:\vjrlfdj.exec:\vjrlfdj.exe59⤵PID:3784
-
\??\c:\bvtnr.exec:\bvtnr.exe60⤵PID:4748
-
\??\c:\lxvhb.exec:\lxvhb.exe61⤵PID:3312
-
\??\c:\njvth.exec:\njvth.exe62⤵PID:1496
-
\??\c:\trtttbj.exec:\trtttbj.exe63⤵PID:4332
-
\??\c:\hrhrlt.exec:\hrhrlt.exe64⤵PID:3240
-
\??\c:\tvjbp.exec:\tvjbp.exe65⤵PID:2672
-
\??\c:\hfjtn.exec:\hfjtn.exe66⤵PID:2304
-
\??\c:\xxvthph.exec:\xxvthph.exe67⤵PID:1304
-
\??\c:\rrjvjf.exec:\rrjvjf.exe68⤵PID:1880
-
\??\c:\xffdht.exec:\xffdht.exe69⤵PID:1128
-
\??\c:\vrnvv.exec:\vrnvv.exe70⤵PID:5004
-
\??\c:\vbrvnn.exec:\vbrvnn.exe71⤵PID:3520
-
\??\c:\nndrjn.exec:\nndrjn.exe72⤵PID:2384
-
\??\c:\jvttn.exec:\jvttn.exe73⤵PID:3912
-
\??\c:\jlrpxtt.exec:\jlrpxtt.exe74⤵PID:1844
-
\??\c:\lfrdnfv.exec:\lfrdnfv.exe75⤵PID:3536
-
\??\c:\lbrrj.exec:\lbrrj.exe76⤵PID:4376
-
\??\c:\hprjp.exec:\hprjp.exe77⤵PID:3620
-
\??\c:\pnfrx.exec:\pnfrx.exe78⤵PID:4340
-
\??\c:\fpxlh.exec:\fpxlh.exe79⤵PID:3276
-
\??\c:\nddrj.exec:\nddrj.exe80⤵PID:3780
-
\??\c:\ddjtrr.exec:\ddjtrr.exe81⤵PID:4028
-
\??\c:\ntpprtl.exec:\ntpprtl.exe82⤵PID:872
-
\??\c:\lnxjf.exec:\lnxjf.exe83⤵PID:1704
-
\??\c:\nnhdf.exec:\nnhdf.exe84⤵PID:1528
-
\??\c:\rxvvr.exec:\rxvvr.exe85⤵PID:4524
-
\??\c:\xlfjbhf.exec:\xlfjbhf.exe86⤵PID:2200
-
\??\c:\bfnnvnv.exec:\bfnnvnv.exe87⤵PID:4368
-
\??\c:\txxffb.exec:\txxffb.exe88⤵PID:3632
-
\??\c:\vfhfdx.exec:\vfhfdx.exe89⤵PID:3492
-
\??\c:\ffhlfbp.exec:\ffhlfbp.exe90⤵PID:668
-
\??\c:\ldvdfpr.exec:\ldvdfpr.exe91⤵PID:2704
-
\??\c:\ljdfv.exec:\ljdfv.exe92⤵PID:5060
-
\??\c:\rtbvl.exec:\rtbvl.exe93⤵PID:2804
-
\??\c:\dxxpnnt.exec:\dxxpnnt.exe94⤵PID:1168
-
\??\c:\jxbrb.exec:\jxbrb.exe95⤵PID:2768
-
\??\c:\vpjlxx.exec:\vpjlxx.exe96⤵PID:852
-
\??\c:\ttvrh.exec:\ttvrh.exe97⤵PID:1244
-
\??\c:\vtxhb.exec:\vtxhb.exe98⤵PID:1492
-
\??\c:\rvxff.exec:\rvxff.exe99⤵PID:3884
-
\??\c:\vfvvh.exec:\vfvvh.exe100⤵PID:2956
-
\??\c:\bjlrjhp.exec:\bjlrjhp.exe101⤵PID:3580
-
\??\c:\jtnftt.exec:\jtnftt.exe102⤵PID:2064
-
\??\c:\btjbtb.exec:\btjbtb.exe103⤵PID:4884
-
\??\c:\xnjxplr.exec:\xnjxplr.exe104⤵PID:3880
-
\??\c:\vvnlr.exec:\vvnlr.exe105⤵PID:2480
-
\??\c:\rvvrljp.exec:\rvvrljp.exe106⤵PID:1864
-
\??\c:\plhdlhn.exec:\plhdlhn.exe107⤵PID:408
-
\??\c:\rnphxpn.exec:\rnphxpn.exe108⤵PID:1408
-
\??\c:\rjvnf.exec:\rjvnf.exe109⤵PID:2684
-
\??\c:\bdlfn.exec:\bdlfn.exe110⤵PID:1128
-
\??\c:\vpjxlff.exec:\vpjxlff.exe111⤵PID:4632
-
\??\c:\dhthhv.exec:\dhthhv.exe112⤵PID:912
-
\??\c:\xdfhj.exec:\xdfhj.exe113⤵PID:228
-
\??\c:\fjnnj.exec:\fjnnj.exe114⤵PID:4672
-
\??\c:\bbxjr.exec:\bbxjr.exe115⤵PID:4948
-
\??\c:\bjxrdb.exec:\bjxrdb.exe116⤵PID:1936
-
\??\c:\hxxpxjr.exec:\hxxpxjr.exe117⤵PID:4416
-
\??\c:\hhltdb.exec:\hhltdb.exe118⤵PID:1372
-
\??\c:\vvpxvfv.exec:\vvpxvfv.exe119⤵PID:2580
-
\??\c:\nxdxhd.exec:\nxdxhd.exe120⤵PID:4968
-
\??\c:\vjdbn.exec:\vjdbn.exe121⤵PID:636
-
\??\c:\dnptjh.exec:\dnptjh.exe122⤵PID:3176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-