Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2023, 18:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.c5ea32ae497af4390cfe2a8ef7337430.exe
Resource
win7-20230831-en
5 signatures
150 seconds
General
-
Target
NEAS.c5ea32ae497af4390cfe2a8ef7337430.exe
-
Size
91KB
-
MD5
c5ea32ae497af4390cfe2a8ef7337430
-
SHA1
7b4e601378cf8c9b864c1c7f0438dd1af88c52f8
-
SHA256
1c99bb5dda234a869e9df9ca9c7e29399a388a4c88329658af43ccc1d1aca4e4
-
SHA512
92efdaf8e7ba111844eb3e7a240746777f2c766781354174567c8a8f1ec38fd3533b18a0023ad1244a28ecd5234ee22ca7c9b31a640aa9356dcfcdb57631d7be
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxE6vr/mA4:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+b5
Malware Config
Signatures
-
Detect Blackmoon payload 34 IoCs
resource yara_rule behavioral2/memory/2812-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1592-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-325-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-343-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4344 lpnrlhj.exe 3264 xbxjj.exe 5092 rbxbf.exe 1592 ndtxj.exe 1924 hnjhfdl.exe 3844 bxtjbn.exe 1036 nrvdvn.exe 4672 jfphhdx.exe 4244 xxlndrl.exe 4640 vpfjn.exe 3396 phxdl.exe 4820 ltpjr.exe 2280 dnhxdt.exe 3000 vrpnx.exe 2548 blhnbvd.exe 1436 fnbvjb.exe 2908 vrtjpv.exe 3576 pvnxpp.exe 3080 llnbj.exe 4580 bbtjb.exe 2004 vvnpx.exe 1172 hrnbxl.exe 2132 hfnxdrd.exe 4536 pdjnp.exe 4632 frhvxrd.exe 448 ffvthpj.exe 4116 jrpbjbd.exe 1980 jjftnth.exe 3652 frfjvlj.exe 4468 ffjpfpj.exe 3592 tjlrf.exe 2516 vxrffdf.exe 3948 btlrv.exe 3512 httpd.exe 4788 fljftph.exe 412 vbxjvnv.exe 3764 nlxvnh.exe 3340 rbjbx.exe 4968 jjndl.exe 4212 pjnpx.exe 3704 xtdprj.exe 632 vpvnd.exe 4344 nhpbnt.exe 1608 dhvfrv.exe 3356 dxnnhp.exe 2228 jhdhr.exe 3260 ffnjx.exe 4904 dnjlt.exe 2056 bptjrr.exe 3124 jdhfnp.exe 3272 xbbxb.exe 1288 lpdbrx.exe 2996 vvfvjfj.exe 3396 rvlbbtl.exe 3132 fbnvp.exe 2280 ljddd.exe 644 pnldpx.exe 3240 hljlfbh.exe 4696 xpftb.exe 4540 jfpvlvh.exe 2740 fvlxnlv.exe 1680 plfjtjj.exe 920 nxlpdp.exe 3060 rlvtnpn.exe -
resource yara_rule behavioral2/memory/2812-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2812-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-325-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-343-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-352-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2812 wrote to memory of 4344 2812 NEAS.c5ea32ae497af4390cfe2a8ef7337430.exe 81 PID 2812 wrote to memory of 4344 2812 NEAS.c5ea32ae497af4390cfe2a8ef7337430.exe 81 PID 2812 wrote to memory of 4344 2812 NEAS.c5ea32ae497af4390cfe2a8ef7337430.exe 81 PID 4344 wrote to memory of 3264 4344 lpnrlhj.exe 82 PID 4344 wrote to memory of 3264 4344 lpnrlhj.exe 82 PID 4344 wrote to memory of 3264 4344 lpnrlhj.exe 82 PID 3264 wrote to memory of 5092 3264 xbxjj.exe 83 PID 3264 wrote to memory of 5092 3264 xbxjj.exe 83 PID 3264 wrote to memory of 5092 3264 xbxjj.exe 83 PID 5092 wrote to memory of 1592 5092 rbxbf.exe 84 PID 5092 wrote to memory of 1592 5092 rbxbf.exe 84 PID 5092 wrote to memory of 1592 5092 rbxbf.exe 84 PID 1592 wrote to memory of 1924 1592 ndtxj.exe 85 PID 1592 wrote to memory of 1924 1592 ndtxj.exe 85 PID 1592 wrote to memory of 1924 1592 ndtxj.exe 85 PID 1924 wrote to memory of 3844 1924 hnjhfdl.exe 86 PID 1924 wrote to memory of 3844 1924 hnjhfdl.exe 86 PID 1924 wrote to memory of 3844 1924 hnjhfdl.exe 86 PID 3844 wrote to memory of 1036 3844 bxtjbn.exe 87 PID 3844 wrote to memory of 1036 3844 bxtjbn.exe 87 PID 3844 wrote to memory of 1036 3844 bxtjbn.exe 87 PID 1036 wrote to memory of 4672 1036 nrvdvn.exe 88 PID 1036 wrote to memory of 4672 1036 nrvdvn.exe 88 PID 1036 wrote to memory of 4672 1036 nrvdvn.exe 88 PID 4672 wrote to memory of 4244 4672 jfphhdx.exe 89 PID 4672 wrote to memory of 4244 4672 jfphhdx.exe 89 PID 4672 wrote to memory of 4244 4672 jfphhdx.exe 89 PID 4244 wrote to memory of 4640 4244 xxlndrl.exe 90 PID 4244 wrote to memory of 4640 4244 xxlndrl.exe 90 PID 4244 wrote to memory of 4640 4244 xxlndrl.exe 90 PID 4640 wrote to memory of 3396 4640 vpfjn.exe 91 PID 4640 wrote to memory of 3396 4640 vpfjn.exe 91 PID 4640 wrote to memory of 3396 4640 vpfjn.exe 91 PID 3396 wrote to memory of 4820 3396 phxdl.exe 92 PID 3396 wrote to memory of 4820 3396 phxdl.exe 92 PID 3396 wrote to memory of 4820 3396 phxdl.exe 92 PID 4820 wrote to memory of 2280 4820 ltpjr.exe 93 PID 4820 wrote to memory of 2280 4820 ltpjr.exe 93 PID 4820 wrote to memory of 2280 4820 ltpjr.exe 93 PID 2280 wrote to memory of 3000 2280 dnhxdt.exe 94 PID 2280 wrote to memory of 3000 2280 dnhxdt.exe 94 PID 2280 wrote to memory of 3000 2280 dnhxdt.exe 94 PID 3000 wrote to memory of 2548 3000 vrpnx.exe 95 PID 3000 wrote to memory of 2548 3000 vrpnx.exe 95 PID 3000 wrote to memory of 2548 3000 vrpnx.exe 95 PID 2548 wrote to memory of 1436 2548 blhnbvd.exe 96 PID 2548 wrote to memory of 1436 2548 blhnbvd.exe 96 PID 2548 wrote to memory of 1436 2548 blhnbvd.exe 96 PID 1436 wrote to memory of 2908 1436 fnbvjb.exe 97 PID 1436 wrote to memory of 2908 1436 fnbvjb.exe 97 PID 1436 wrote to memory of 2908 1436 fnbvjb.exe 97 PID 2908 wrote to memory of 3576 2908 vrtjpv.exe 98 PID 2908 wrote to memory of 3576 2908 vrtjpv.exe 98 PID 2908 wrote to memory of 3576 2908 vrtjpv.exe 98 PID 3576 wrote to memory of 3080 3576 pvnxpp.exe 99 PID 3576 wrote to memory of 3080 3576 pvnxpp.exe 99 PID 3576 wrote to memory of 3080 3576 pvnxpp.exe 99 PID 3080 wrote to memory of 4580 3080 llnbj.exe 100 PID 3080 wrote to memory of 4580 3080 llnbj.exe 100 PID 3080 wrote to memory of 4580 3080 llnbj.exe 100 PID 4580 wrote to memory of 2004 4580 bbtjb.exe 101 PID 4580 wrote to memory of 2004 4580 bbtjb.exe 101 PID 4580 wrote to memory of 2004 4580 bbtjb.exe 101 PID 2004 wrote to memory of 1172 2004 vvnpx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.c5ea32ae497af4390cfe2a8ef7337430.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.c5ea32ae497af4390cfe2a8ef7337430.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\lpnrlhj.exec:\lpnrlhj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\xbxjj.exec:\xbxjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\rbxbf.exec:\rbxbf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\ndtxj.exec:\ndtxj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\hnjhfdl.exec:\hnjhfdl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\bxtjbn.exec:\bxtjbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\nrvdvn.exec:\nrvdvn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\jfphhdx.exec:\jfphhdx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\xxlndrl.exec:\xxlndrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\vpfjn.exec:\vpfjn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\phxdl.exec:\phxdl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\ltpjr.exec:\ltpjr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\dnhxdt.exec:\dnhxdt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\vrpnx.exec:\vrpnx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\blhnbvd.exec:\blhnbvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\fnbvjb.exec:\fnbvjb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\vrtjpv.exec:\vrtjpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\pvnxpp.exec:\pvnxpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\llnbj.exec:\llnbj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\bbtjb.exec:\bbtjb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\vvnpx.exec:\vvnpx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\hrnbxl.exec:\hrnbxl.exe23⤵
- Executes dropped EXE
PID:1172 -
\??\c:\hfnxdrd.exec:\hfnxdrd.exe24⤵
- Executes dropped EXE
PID:2132 -
\??\c:\pdjnp.exec:\pdjnp.exe25⤵
- Executes dropped EXE
PID:4536 -
\??\c:\frhvxrd.exec:\frhvxrd.exe26⤵
- Executes dropped EXE
PID:4632 -
\??\c:\ffvthpj.exec:\ffvthpj.exe27⤵
- Executes dropped EXE
PID:448 -
\??\c:\jrpbjbd.exec:\jrpbjbd.exe28⤵
- Executes dropped EXE
PID:4116 -
\??\c:\jjftnth.exec:\jjftnth.exe29⤵
- Executes dropped EXE
PID:1980 -
\??\c:\frfjvlj.exec:\frfjvlj.exe30⤵
- Executes dropped EXE
PID:3652 -
\??\c:\ffjpfpj.exec:\ffjpfpj.exe31⤵
- Executes dropped EXE
PID:4468 -
\??\c:\tjlrf.exec:\tjlrf.exe32⤵
- Executes dropped EXE
PID:3592 -
\??\c:\vxrffdf.exec:\vxrffdf.exe33⤵
- Executes dropped EXE
PID:2516 -
\??\c:\btlrv.exec:\btlrv.exe34⤵
- Executes dropped EXE
PID:3948 -
\??\c:\httpd.exec:\httpd.exe35⤵
- Executes dropped EXE
PID:3512 -
\??\c:\fljftph.exec:\fljftph.exe36⤵
- Executes dropped EXE
PID:4788 -
\??\c:\vbxjvnv.exec:\vbxjvnv.exe37⤵
- Executes dropped EXE
PID:412 -
\??\c:\nlxvnh.exec:\nlxvnh.exe38⤵
- Executes dropped EXE
PID:3764 -
\??\c:\rbjbx.exec:\rbjbx.exe39⤵
- Executes dropped EXE
PID:3340 -
\??\c:\jjndl.exec:\jjndl.exe40⤵
- Executes dropped EXE
PID:4968 -
\??\c:\pjnpx.exec:\pjnpx.exe41⤵
- Executes dropped EXE
PID:4212 -
\??\c:\xtdprj.exec:\xtdprj.exe42⤵
- Executes dropped EXE
PID:3704 -
\??\c:\vpvnd.exec:\vpvnd.exe43⤵
- Executes dropped EXE
PID:632 -
\??\c:\nhpbnt.exec:\nhpbnt.exe44⤵
- Executes dropped EXE
PID:4344 -
\??\c:\dhvfrv.exec:\dhvfrv.exe45⤵
- Executes dropped EXE
PID:1608 -
\??\c:\dxnnhp.exec:\dxnnhp.exe46⤵
- Executes dropped EXE
PID:3356 -
\??\c:\jhdhr.exec:\jhdhr.exe47⤵
- Executes dropped EXE
PID:2228 -
\??\c:\ffnjx.exec:\ffnjx.exe48⤵
- Executes dropped EXE
PID:3260 -
\??\c:\dnjlt.exec:\dnjlt.exe49⤵
- Executes dropped EXE
PID:4904 -
\??\c:\bptjrr.exec:\bptjrr.exe50⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jdhfnp.exec:\jdhfnp.exe51⤵
- Executes dropped EXE
PID:3124 -
\??\c:\xbbxb.exec:\xbbxb.exe52⤵
- Executes dropped EXE
PID:3272 -
\??\c:\lpdbrx.exec:\lpdbrx.exe53⤵
- Executes dropped EXE
PID:1288 -
\??\c:\vvfvjfj.exec:\vvfvjfj.exe54⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rvlbbtl.exec:\rvlbbtl.exe55⤵
- Executes dropped EXE
PID:3396 -
\??\c:\fbnvp.exec:\fbnvp.exe56⤵
- Executes dropped EXE
PID:3132 -
\??\c:\ljddd.exec:\ljddd.exe57⤵
- Executes dropped EXE
PID:2280 -
\??\c:\pnldpx.exec:\pnldpx.exe58⤵
- Executes dropped EXE
PID:644 -
\??\c:\hljlfbh.exec:\hljlfbh.exe59⤵
- Executes dropped EXE
PID:3240 -
\??\c:\xpftb.exec:\xpftb.exe60⤵
- Executes dropped EXE
PID:4696 -
\??\c:\jfpvlvh.exec:\jfpvlvh.exe61⤵
- Executes dropped EXE
PID:4540 -
\??\c:\fvlxnlv.exec:\fvlxnlv.exe62⤵
- Executes dropped EXE
PID:2740 -
\??\c:\plfjtjj.exec:\plfjtjj.exe63⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nxlpdp.exec:\nxlpdp.exe64⤵
- Executes dropped EXE
PID:920 -
\??\c:\rlvtnpn.exec:\rlvtnpn.exe65⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hfvdfp.exec:\hfvdfp.exe66⤵PID:2004
-
\??\c:\bjdjnl.exec:\bjdjnl.exe67⤵PID:2804
-
\??\c:\fnlbd.exec:\fnlbd.exe68⤵PID:5112
-
\??\c:\dppvrvt.exec:\dppvrvt.exe69⤵PID:5084
-
\??\c:\vfnvx.exec:\vfnvx.exe70⤵PID:1416
-
\??\c:\bvlhrhr.exec:\bvlhrhr.exe71⤵PID:1384
-
\??\c:\bltnj.exec:\bltnj.exe72⤵PID:4612
-
\??\c:\pjptp.exec:\pjptp.exe73⤵PID:1640
-
\??\c:\lhlljvp.exec:\lhlljvp.exe74⤵PID:2476
-
\??\c:\fvjnhn.exec:\fvjnhn.exe75⤵PID:3968
-
\??\c:\bvptp.exec:\bvptp.exe76⤵PID:3316
-
\??\c:\vppvh.exec:\vppvh.exe77⤵PID:3852
-
\??\c:\flbndrr.exec:\flbndrr.exe78⤵PID:2784
-
\??\c:\rtthf.exec:\rtthf.exe79⤵PID:4788
-
\??\c:\pxlllx.exec:\pxlllx.exe80⤵PID:1952
-
\??\c:\dbrltp.exec:\dbrltp.exe81⤵PID:4548
-
\??\c:\xbrrjjt.exec:\xbrrjjt.exe82⤵PID:4184
-
\??\c:\nbrpxjh.exec:\nbrpxjh.exe83⤵PID:1756
-
\??\c:\flntjnd.exec:\flntjnd.exe84⤵PID:3924
-
\??\c:\fxxjbf.exec:\fxxjbf.exe85⤵PID:1868
-
\??\c:\lpvjlh.exec:\lpvjlh.exe86⤵PID:3372
-
\??\c:\pdpnrhb.exec:\pdpnrhb.exe87⤵PID:1312
-
\??\c:\hntjxfh.exec:\hntjxfh.exe88⤵PID:4368
-
\??\c:\pxbnfbd.exec:\pxbnfbd.exe89⤵PID:1512
-
\??\c:\rltdhbr.exec:\rltdhbr.exe90⤵PID:4904
-
\??\c:\tvxphn.exec:\tvxphn.exe91⤵PID:1752
-
\??\c:\nbplrvb.exec:\nbplrvb.exe92⤵PID:1304
-
\??\c:\bnvlbpt.exec:\bnvlbpt.exe93⤵PID:2140
-
\??\c:\jbjlxx.exec:\jbjlxx.exe94⤵PID:3056
-
\??\c:\jnbxfnv.exec:\jnbxfnv.exe95⤵PID:4332
-
\??\c:\htjdd.exec:\htjdd.exe96⤵PID:3296
-
\??\c:\pppnpv.exec:\pppnpv.exe97⤵PID:3744
-
\??\c:\prvjp.exec:\prvjp.exe98⤵PID:5024
-
\??\c:\tfjbtnp.exec:\tfjbtnp.exe99⤵PID:2572
-
\??\c:\nbrnp.exec:\nbrnp.exe100⤵PID:4768
-
\??\c:\pjnxp.exec:\pjnxp.exe101⤵PID:4696
-
\??\c:\lxvrnfb.exec:\lxvrnfb.exe102⤵PID:2612
-
\??\c:\xlxppn.exec:\xlxppn.exe103⤵PID:2740
-
\??\c:\vddftdd.exec:\vddftdd.exe104⤵PID:3576
-
\??\c:\hjplxlb.exec:\hjplxlb.exe105⤵PID:4108
-
\??\c:\nxnjbnp.exec:\nxnjbnp.exe106⤵PID:3060
-
\??\c:\vnvhpnl.exec:\vnvhpnl.exe107⤵PID:4172
-
\??\c:\ftxvpt.exec:\ftxvpt.exe108⤵PID:1380
-
\??\c:\jlxvl.exec:\jlxvl.exe109⤵PID:2744
-
\??\c:\jffrprl.exec:\jffrprl.exe110⤵PID:5084
-
\??\c:\tbjlbv.exec:\tbjlbv.exe111⤵PID:2468
-
\??\c:\rvbvpjr.exec:\rvbvpjr.exe112⤵PID:1384
-
\??\c:\xjnfhnx.exec:\xjnfhnx.exe113⤵PID:5040
-
\??\c:\hvrvrbn.exec:\hvrvrbn.exe114⤵PID:4228
-
\??\c:\rpffrtl.exec:\rpffrtl.exe115⤵PID:3268
-
\??\c:\hxtvv.exec:\hxtvv.exe116⤵PID:4620
-
\??\c:\fdjdpr.exec:\fdjdpr.exe117⤵PID:1220
-
\??\c:\njfvjb.exec:\njfvjb.exe118⤵PID:3424
-
\??\c:\xnnlj.exec:\xnnlj.exe119⤵PID:1052
-
\??\c:\rrvvf.exec:\rrvvf.exe120⤵PID:1860
-
\??\c:\dbvjh.exec:\dbvjh.exe121⤵PID:2024
-
\??\c:\jlrlh.exec:\jlrlh.exe122⤵PID:216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-