Analysis
-
max time kernel
127s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21-10-2023 21:17
Behavioral task
behavioral1
Sample
NEAS.3736f85318ad9b2720306cdebb0c1c70.exe
Resource
win7-20231020-en
windows7-x64
5 signatures
150 seconds
General
-
Target
NEAS.3736f85318ad9b2720306cdebb0c1c70.exe
-
Size
200KB
-
MD5
3736f85318ad9b2720306cdebb0c1c70
-
SHA1
0db0f320b4881c576d6ef03188726b434a41fbd8
-
SHA256
76eba39d5ba0feea71033be72348b934aaffe91e7680c7e2e00d7e38138bc8b1
-
SHA512
ef3230ded08bc1730e01e45fa1ce44eeb28a7b74475380ff334a16c56a27540d216a6e0cf777168a8bb50c24c0b22dd312e195e641a6174e5d2ef0f2c5ce737a
-
SSDEEP
6144:9cm4FmowdHoSyAszBd+za/p1slTjZXvEQo9dfG:/4wFHoSy1zBR/pMT9XvEhdfG
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1808-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5056-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3472-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3112-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3812-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3640-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1456-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3004-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2900-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2324-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1808-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4740-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1108-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3812-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1508-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/728-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2144-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/544-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3124-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3796-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3640-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2900-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-513-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-759-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1896-1095-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-1114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-1487-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-1564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3504-2412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5056 dnvxj.exe 4148 tfnlp.exe 3472 jpvrr.exe 1512 jpvvjdx.exe 4004 dbddf.exe 3808 dthvlv.exe 4128 lxrjxfx.exe 3112 prhxj.exe 3812 xnvpjn.exe 4824 djtxfjr.exe 3640 fjttbtf.exe 4444 njllp.exe 2040 xbvnx.exe 4388 bdnnhpv.exe 1456 dxfdfh.exe 3720 jdxntd.exe 3004 nxxtdf.exe 4872 bfdpnbv.exe 4340 jdbdx.exe 4796 ffvbfpb.exe 4852 dnjdtr.exe 2900 vdtld.exe 2324 jdbjp.exe 4644 vbljxj.exe 2944 rtjjj.exe 2912 hdpljjd.exe 3056 xfrhrnl.exe 2028 tjxtx.exe 3256 ljtbf.exe 4924 bpvht.exe 828 xfdtbx.exe 4492 bbtdl.exe 2452 plthn.exe 4904 pvplnjb.exe 3668 npnjpr.exe 4040 xjbvt.exe 2772 jvlrjfj.exe 872 lllllfj.exe 4468 dlvlvr.exe 4224 djxhjf.exe 1444 vbnprn.exe 5040 ltjfhlv.exe 4580 fndxj.exe 964 bjvjjr.exe 3776 nxvtf.exe 3244 lfntjj.exe 4724 dpnvrn.exe 1808 rhxvl.exe 4740 xbvdd.exe 4060 pfbrld.exe 2164 bbphjlp.exe 2068 lbbvfff.exe 1872 hpptjff.exe 1108 pbfpdr.exe 1740 dhjfvl.exe 4276 lnfrfbv.exe 1508 rlltrx.exe 3812 hltdtl.exe 2420 jxthd.exe 4292 xvjpjfn.exe 4564 dpjnd.exe 4836 vfjdxh.exe 3956 txrjfn.exe 728 nbvnx.exe -
resource yara_rule behavioral2/memory/1808-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1808-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022e81-4.dat upx behavioral2/files/0x0008000000022e81-3.dat upx behavioral2/memory/5056-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022e84-10.dat upx behavioral2/files/0x0008000000022e84-11.dat upx behavioral2/files/0x0008000000022e89-12.dat upx behavioral2/files/0x0008000000022e89-15.dat upx behavioral2/memory/3472-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4148-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e8a-21.dat upx behavioral2/files/0x0007000000022e8a-20.dat upx behavioral2/files/0x0008000000022e89-14.dat upx behavioral2/files/0x0007000000022e8b-26.dat upx behavioral2/files/0x0007000000022e8b-25.dat upx behavioral2/memory/4004-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e8c-33.dat upx behavioral2/files/0x0007000000022e8c-32.dat upx behavioral2/memory/3808-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e8e-38.dat upx behavioral2/files/0x0007000000022e8e-36.dat upx behavioral2/files/0x0007000000022e8f-41.dat upx behavioral2/memory/4128-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e8f-43.dat upx behavioral2/files/0x0007000000022e90-46.dat upx behavioral2/memory/3112-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e90-48.dat upx behavioral2/files/0x0007000000022e91-53.dat upx behavioral2/memory/4824-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3812-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e91-51.dat upx behavioral2/files/0x0007000000022e93-58.dat upx behavioral2/files/0x0007000000022e93-57.dat upx behavioral2/memory/3640-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e94-63.dat upx behavioral2/files/0x0007000000022e94-64.dat upx behavioral2/files/0x0007000000022e95-68.dat upx behavioral2/files/0x0007000000022e95-69.dat upx behavioral2/memory/2040-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4444-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e96-75.dat upx behavioral2/memory/2040-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4388-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e96-73.dat upx behavioral2/files/0x0007000000022e97-80.dat upx behavioral2/files/0x0007000000022e97-81.dat upx behavioral2/files/0x0007000000022e98-84.dat upx behavioral2/memory/1456-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e98-86.dat upx behavioral2/files/0x0007000000022e99-91.dat upx behavioral2/files/0x0007000000022e99-89.dat upx behavioral2/memory/3004-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3720-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e9a-95.dat upx behavioral2/files/0x0007000000022e9a-97.dat upx behavioral2/files/0x0007000000022e9b-99.dat upx behavioral2/files/0x0007000000022e9b-102.dat upx behavioral2/files/0x0007000000022e9c-105.dat upx behavioral2/files/0x0007000000022e9c-107.dat upx behavioral2/memory/4796-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e9d-110.dat upx behavioral2/files/0x0007000000022e9d-112.dat upx behavioral2/files/0x0008000000022e9f-115.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1808 wrote to memory of 5056 1808 NEAS.3736f85318ad9b2720306cdebb0c1c70.exe 83 PID 1808 wrote to memory of 5056 1808 NEAS.3736f85318ad9b2720306cdebb0c1c70.exe 83 PID 1808 wrote to memory of 5056 1808 NEAS.3736f85318ad9b2720306cdebb0c1c70.exe 83 PID 5056 wrote to memory of 4148 5056 dnvxj.exe 84 PID 5056 wrote to memory of 4148 5056 dnvxj.exe 84 PID 5056 wrote to memory of 4148 5056 dnvxj.exe 84 PID 4148 wrote to memory of 3472 4148 tfnlp.exe 85 PID 4148 wrote to memory of 3472 4148 tfnlp.exe 85 PID 4148 wrote to memory of 3472 4148 tfnlp.exe 85 PID 3472 wrote to memory of 1512 3472 jpvrr.exe 86 PID 3472 wrote to memory of 1512 3472 jpvrr.exe 86 PID 3472 wrote to memory of 1512 3472 jpvrr.exe 86 PID 1512 wrote to memory of 4004 1512 jpvvjdx.exe 88 PID 1512 wrote to memory of 4004 1512 jpvvjdx.exe 88 PID 1512 wrote to memory of 4004 1512 jpvvjdx.exe 88 PID 4004 wrote to memory of 3808 4004 dbddf.exe 89 PID 4004 wrote to memory of 3808 4004 dbddf.exe 89 PID 4004 wrote to memory of 3808 4004 dbddf.exe 89 PID 3808 wrote to memory of 4128 3808 dthvlv.exe 90 PID 3808 wrote to memory of 4128 3808 dthvlv.exe 90 PID 3808 wrote to memory of 4128 3808 dthvlv.exe 90 PID 4128 wrote to memory of 3112 4128 lxrjxfx.exe 91 PID 4128 wrote to memory of 3112 4128 lxrjxfx.exe 91 PID 4128 wrote to memory of 3112 4128 lxrjxfx.exe 91 PID 3112 wrote to memory of 3812 3112 prhxj.exe 92 PID 3112 wrote to memory of 3812 3112 prhxj.exe 92 PID 3112 wrote to memory of 3812 3112 prhxj.exe 92 PID 3812 wrote to memory of 4824 3812 xnvpjn.exe 94 PID 3812 wrote to memory of 4824 3812 xnvpjn.exe 94 PID 3812 wrote to memory of 4824 3812 xnvpjn.exe 94 PID 4824 wrote to memory of 3640 4824 djtxfjr.exe 95 PID 4824 wrote to memory of 3640 4824 djtxfjr.exe 95 PID 4824 wrote to memory of 3640 4824 djtxfjr.exe 95 PID 3640 wrote to memory of 4444 3640 fjttbtf.exe 96 PID 3640 wrote to memory of 4444 3640 fjttbtf.exe 96 PID 3640 wrote to memory of 4444 3640 fjttbtf.exe 96 PID 4444 wrote to memory of 2040 4444 njllp.exe 97 PID 4444 wrote to memory of 2040 4444 njllp.exe 97 PID 4444 wrote to memory of 2040 4444 njllp.exe 97 PID 2040 wrote to memory of 4388 2040 xbvnx.exe 99 PID 2040 wrote to memory of 4388 2040 xbvnx.exe 99 PID 2040 wrote to memory of 4388 2040 xbvnx.exe 99 PID 4388 wrote to memory of 1456 4388 bdnnhpv.exe 100 PID 4388 wrote to memory of 1456 4388 bdnnhpv.exe 100 PID 4388 wrote to memory of 1456 4388 bdnnhpv.exe 100 PID 1456 wrote to memory of 3720 1456 dxfdfh.exe 101 PID 1456 wrote to memory of 3720 1456 dxfdfh.exe 101 PID 1456 wrote to memory of 3720 1456 dxfdfh.exe 101 PID 3720 wrote to memory of 3004 3720 jdxntd.exe 102 PID 3720 wrote to memory of 3004 3720 jdxntd.exe 102 PID 3720 wrote to memory of 3004 3720 jdxntd.exe 102 PID 3004 wrote to memory of 4872 3004 nxxtdf.exe 103 PID 3004 wrote to memory of 4872 3004 nxxtdf.exe 103 PID 3004 wrote to memory of 4872 3004 nxxtdf.exe 103 PID 4872 wrote to memory of 4340 4872 bfdpnbv.exe 104 PID 4872 wrote to memory of 4340 4872 bfdpnbv.exe 104 PID 4872 wrote to memory of 4340 4872 bfdpnbv.exe 104 PID 4340 wrote to memory of 4796 4340 jdbdx.exe 105 PID 4340 wrote to memory of 4796 4340 jdbdx.exe 105 PID 4340 wrote to memory of 4796 4340 jdbdx.exe 105 PID 4796 wrote to memory of 4852 4796 ffvbfpb.exe 106 PID 4796 wrote to memory of 4852 4796 ffvbfpb.exe 106 PID 4796 wrote to memory of 4852 4796 ffvbfpb.exe 106 PID 4852 wrote to memory of 2900 4852 dnjdtr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.3736f85318ad9b2720306cdebb0c1c70.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.3736f85318ad9b2720306cdebb0c1c70.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\dnvxj.exec:\dnvxj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\tfnlp.exec:\tfnlp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\jpvrr.exec:\jpvrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\jpvvjdx.exec:\jpvvjdx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\dbddf.exec:\dbddf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\dthvlv.exec:\dthvlv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\lxrjxfx.exec:\lxrjxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\prhxj.exec:\prhxj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\xnvpjn.exec:\xnvpjn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\djtxfjr.exec:\djtxfjr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\fjttbtf.exec:\fjttbtf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\njllp.exec:\njllp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\xbvnx.exec:\xbvnx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\bdnnhpv.exec:\bdnnhpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\dxfdfh.exec:\dxfdfh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\jdxntd.exec:\jdxntd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\nxxtdf.exec:\nxxtdf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\bfdpnbv.exec:\bfdpnbv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\jdbdx.exec:\jdbdx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\ffvbfpb.exec:\ffvbfpb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\dnjdtr.exec:\dnjdtr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\vdtld.exec:\vdtld.exe23⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jdbjp.exec:\jdbjp.exe24⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vbljxj.exec:\vbljxj.exe25⤵
- Executes dropped EXE
PID:4644 -
\??\c:\rtjjj.exec:\rtjjj.exe26⤵
- Executes dropped EXE
PID:2944 -
\??\c:\hdpljjd.exec:\hdpljjd.exe27⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xfrhrnl.exec:\xfrhrnl.exe28⤵
- Executes dropped EXE
PID:3056 -
\??\c:\tjxtx.exec:\tjxtx.exe29⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ljtbf.exec:\ljtbf.exe30⤵
- Executes dropped EXE
PID:3256 -
\??\c:\bpvht.exec:\bpvht.exe31⤵
- Executes dropped EXE
PID:4924 -
\??\c:\xfdtbx.exec:\xfdtbx.exe32⤵
- Executes dropped EXE
PID:828 -
\??\c:\bbtdl.exec:\bbtdl.exe33⤵
- Executes dropped EXE
PID:4492 -
\??\c:\plthn.exec:\plthn.exe34⤵
- Executes dropped EXE
PID:2452 -
\??\c:\pvplnjb.exec:\pvplnjb.exe35⤵
- Executes dropped EXE
PID:4904 -
\??\c:\npnjpr.exec:\npnjpr.exe36⤵
- Executes dropped EXE
PID:3668 -
\??\c:\xjbvt.exec:\xjbvt.exe37⤵
- Executes dropped EXE
PID:4040 -
\??\c:\jvlrjfj.exec:\jvlrjfj.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lllllfj.exec:\lllllfj.exe39⤵
- Executes dropped EXE
PID:872 -
\??\c:\dlvlvr.exec:\dlvlvr.exe40⤵
- Executes dropped EXE
PID:4468 -
\??\c:\djxhjf.exec:\djxhjf.exe41⤵
- Executes dropped EXE
PID:4224 -
\??\c:\vbnprn.exec:\vbnprn.exe42⤵
- Executes dropped EXE
PID:1444 -
\??\c:\ltjfhlv.exec:\ltjfhlv.exe43⤵
- Executes dropped EXE
PID:5040 -
\??\c:\fndxj.exec:\fndxj.exe44⤵
- Executes dropped EXE
PID:4580 -
\??\c:\bjvjjr.exec:\bjvjjr.exe45⤵
- Executes dropped EXE
PID:964 -
\??\c:\nxvtf.exec:\nxvtf.exe46⤵
- Executes dropped EXE
PID:3776 -
\??\c:\dlnvrrr.exec:\dlnvrrr.exe47⤵PID:4952
-
\??\c:\lfntjj.exec:\lfntjj.exe48⤵
- Executes dropped EXE
PID:3244 -
\??\c:\dpnvrn.exec:\dpnvrn.exe49⤵
- Executes dropped EXE
PID:4724 -
\??\c:\rhxvl.exec:\rhxvl.exe50⤵
- Executes dropped EXE
PID:1808 -
\??\c:\xbvdd.exec:\xbvdd.exe51⤵
- Executes dropped EXE
PID:4740 -
\??\c:\pfbrld.exec:\pfbrld.exe52⤵
- Executes dropped EXE
PID:4060 -
\??\c:\bbphjlp.exec:\bbphjlp.exe53⤵
- Executes dropped EXE
PID:2164 -
\??\c:\lbbvfff.exec:\lbbvfff.exe54⤵
- Executes dropped EXE
PID:2068 -
\??\c:\hpptjff.exec:\hpptjff.exe55⤵
- Executes dropped EXE
PID:1872 -
\??\c:\pbfpdr.exec:\pbfpdr.exe56⤵
- Executes dropped EXE
PID:1108 -
\??\c:\dhjfvl.exec:\dhjfvl.exe57⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lnfrfbv.exec:\lnfrfbv.exe58⤵
- Executes dropped EXE
PID:4276 -
\??\c:\rlltrx.exec:\rlltrx.exe59⤵
- Executes dropped EXE
PID:1508 -
\??\c:\hltdtl.exec:\hltdtl.exe60⤵
- Executes dropped EXE
PID:3812 -
\??\c:\jxthd.exec:\jxthd.exe61⤵
- Executes dropped EXE
PID:2420 -
\??\c:\xvjpjfn.exec:\xvjpjfn.exe62⤵
- Executes dropped EXE
PID:4292 -
\??\c:\dpjnd.exec:\dpjnd.exe63⤵
- Executes dropped EXE
PID:4564 -
\??\c:\vfjdxh.exec:\vfjdxh.exe64⤵
- Executes dropped EXE
PID:4836 -
\??\c:\txrjfn.exec:\txrjfn.exe65⤵
- Executes dropped EXE
PID:3956 -
\??\c:\nbvnx.exec:\nbvnx.exe66⤵
- Executes dropped EXE
PID:728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\djdbht.exec:\djdbht.exe50⤵PID:5056
-
\??\c:\lbbpvlj.exec:\lbbpvlj.exe51⤵PID:664
-
\??\c:\dffhdb.exec:\dffhdb.exe52⤵PID:1532
-
\??\c:\rhljvn.exec:\rhljvn.exe53⤵PID:3536
-
\??\c:\tbrprfp.exec:\tbrprfp.exe54⤵PID:3876
-
\??\c:\hpthnd.exec:\hpthnd.exe55⤵PID:4136
-
\??\c:\tnvljdt.exec:\tnvljdt.exe56⤵PID:3980
-
\??\c:\fhrfvf.exec:\fhrfvf.exe57⤵PID:2888
-
\??\c:\tldbt.exec:\tldbt.exe58⤵PID:4328
-
\??\c:\rnttj.exec:\rnttj.exe59⤵PID:4128
-
\??\c:\dnxtff.exec:\dnxtff.exe60⤵PID:3812
-
\??\c:\tvbndd.exec:\tvbndd.exe61⤵PID:1672
-
\??\c:\lhrddn.exec:\lhrddn.exe62⤵PID:1080
-
\??\c:\lphbr.exec:\lphbr.exe63⤵PID:4596
-
\??\c:\jxjnpv.exec:\jxjnpv.exe64⤵PID:3148
-
\??\c:\xtvfptd.exec:\xtvfptd.exe65⤵PID:1864
-
\??\c:\bxpdvdn.exec:\bxpdvdn.exe66⤵PID:1412
-
\??\c:\ddnnpx.exec:\ddnnpx.exe67⤵PID:3288
-
\??\c:\xxnvxhj.exec:\xxnvxhj.exe68⤵PID:4512
-
\??\c:\rbntdfr.exec:\rbntdfr.exe69⤵PID:968
-
\??\c:\fpjrrx.exec:\fpjrrx.exe70⤵PID:3108
-
\??\c:\hdvbrnn.exec:\hdvbrnn.exe71⤵PID:636
-
\??\c:\lnjlfl.exec:\lnjlfl.exe72⤵PID:1640
-
\??\c:\bbpjrvt.exec:\bbpjrvt.exe73⤵PID:2336
-
\??\c:\fvjfbh.exec:\fvjfbh.exe74⤵PID:2456
-
\??\c:\xxtvr.exec:\xxtvr.exe75⤵PID:1948
-
\??\c:\fhbpr.exec:\fhbpr.exe76⤵PID:3828
-
\??\c:\vxplfdr.exec:\vxplfdr.exe77⤵PID:832
-
\??\c:\ltvbtl.exec:\ltvbtl.exe78⤵PID:1992
-
\??\c:\hfjxl.exec:\hfjxl.exe79⤵PID:4572
-
\??\c:\pthpj.exec:\pthpj.exe80⤵PID:3932
-
\??\c:\tdnxlj.exec:\tdnxlj.exe81⤵PID:4340
-
\??\c:\hfxrl.exec:\hfxrl.exe82⤵PID:4956
-
\??\c:\hfxrphb.exec:\hfxrphb.exe83⤵PID:4900
-
\??\c:\lrrhvd.exec:\lrrhvd.exe84⤵PID:652
-
\??\c:\thtrbv.exec:\thtrbv.exe85⤵PID:976
-
\??\c:\ttpbjx.exec:\ttpbjx.exe86⤵PID:3984
-
\??\c:\xpdvjlr.exec:\xpdvjlr.exe87⤵PID:1564
-
\??\c:\hhlrbl.exec:\hhlrbl.exe88⤵PID:2912
-
\??\c:\bljfjpn.exec:\bljfjpn.exe89⤵PID:1268
-
\??\c:\fpnljnj.exec:\fpnljnj.exe90⤵PID:4600
-
\??\c:\xblrpj.exec:\xblrpj.exe91⤵PID:4960
-
\??\c:\npfpj.exec:\npfpj.exe92⤵PID:4924
-
\??\c:\fxxnj.exec:\fxxnj.exe93⤵PID:4892
-
\??\c:\xtblb.exec:\xtblb.exe94⤵PID:3740
-
\??\c:\tlndfdx.exec:\tlndfdx.exe95⤵PID:4384
-
\??\c:\vnbrp.exec:\vnbrp.exe96⤵PID:4832
-
\??\c:\ltvlvrb.exec:\ltvlvrb.exe97⤵PID:796
-
\??\c:\hvrrn.exec:\hvrrn.exe98⤵PID:828
-
\??\c:\rtfthtl.exec:\rtfthtl.exe99⤵PID:3468
-
\??\c:\vfvffdj.exec:\vfvffdj.exe100⤵PID:3520
-
\??\c:\bfdvjj.exec:\bfdvjj.exe101⤵PID:744
-
\??\c:\bnnxph.exec:\bnnxph.exe102⤵PID:1404
-
\??\c:\tvffvvl.exec:\tvffvvl.exe103⤵PID:4768
-
\??\c:\ffbhbpt.exec:\ffbhbpt.exe104⤵PID:3968
-
\??\c:\plljrnn.exec:\plljrnn.exe105⤵PID:4072
-
\??\c:\ftbxrdf.exec:\ftbxrdf.exe106⤵PID:3076
-
\??\c:\jnlvh.exec:\jnlvh.exe107⤵PID:4280
-
\??\c:\vpntn.exec:\vpntn.exe108⤵PID:4532
-
\??\c:\dbvlbtx.exec:\dbvlbtx.exe109⤵PID:3208
-
\??\c:\xrxjnnt.exec:\xrxjnnt.exe110⤵PID:60
-
\??\c:\xlnnttp.exec:\xlnnttp.exe111⤵PID:8
-
\??\c:\tlndnr.exec:\tlndnr.exe112⤵PID:4240
-
\??\c:\pdhxbt.exec:\pdhxbt.exe113⤵PID:3528
-
\??\c:\llvrrxr.exec:\llvrrxr.exe114⤵PID:4932
-
\??\c:\bldvnp.exec:\bldvnp.exe115⤵PID:1148
-
\??\c:\nddtdhj.exec:\nddtdhj.exe116⤵PID:1040
-
\??\c:\dnjfvtv.exec:\dnjfvtv.exe117⤵PID:1384
-
\??\c:\rhdvbh.exec:\rhdvbh.exe118⤵PID:4024
-
\??\c:\nhnppfr.exec:\nhnppfr.exe119⤵PID:2088
-
\??\c:\htdphh.exec:\htdphh.exe120⤵PID:2156
-
\??\c:\lxxbvpx.exec:\lxxbvpx.exe121⤵PID:1492
-
\??\c:\hthhh.exec:\hthhh.exe122⤵PID:3212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-