Analysis
-
max time kernel
106s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 14:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.a391014537f7a960140f5954f40b65a0.exe
Resource
win7-20231023-en
5 signatures
150 seconds
General
-
Target
NEAS.a391014537f7a960140f5954f40b65a0.exe
-
Size
88KB
-
MD5
a391014537f7a960140f5954f40b65a0
-
SHA1
d2eb165af0ce2a40d3c824e10e84f1bac38f28f2
-
SHA256
8cd871fcda57e2fbf5e665fba39d2002716626fa5ea962106baabad13dd8b216
-
SHA512
b41957ec471054e342252bec1d875c62bf79d2693a988876699343bc758c5a9c9207259f64982581028d7772192577686f2d4a263e87ab13bc2da53b79d3aacd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/aF8:ymb3NkkiQ3mdBjFo73PYP1lri3K8c8
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral1/memory/2360-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1876-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1104-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/940-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-347-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-364-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-375-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-389-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-462-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1876 pjfvb.exe 1104 npjpnjv.exe 3056 drdlbl.exe 2700 vhjfv.exe 1092 tttlv.exe 2608 trlnhl.exe 2516 dhfff.exe 2492 lvnpt.exe 2456 pdpbf.exe 2972 ntblhd.exe 844 jrljl.exe 3008 lljbdff.exe 2024 fnxtjdt.exe 2668 nbrvdfl.exe 1512 fttjprx.exe 940 jfrlvt.exe 2824 blprpt.exe 1524 nlllfvv.exe 2120 ndvvp.exe 2220 fvhrnf.exe 2272 ffbjv.exe 2004 pjnvxd.exe 2836 nxlrntj.exe 1672 xjlfvnj.exe 1644 hrfnp.exe 980 bddrdvv.exe 2028 ffnhh.exe 1740 xtftl.exe 876 pxlnl.exe 3020 pnnjj.exe 1600 bhnlt.exe 1708 ntlfdx.exe 2576 ltdhhjb.exe 2640 jltlb.exe 2696 njrphjf.exe 2752 ltbxt.exe 2624 rlphhl.exe 2740 rttjpvp.exe 2508 tftjdl.exe 2612 drtjffh.exe 2536 nfbhrv.exe 2456 ldlfjj.exe 292 ppbblv.exe 2820 nlpfdjp.exe 1184 xhrdjr.exe 2032 rdxtbnx.exe 1932 rrdrrl.exe 1928 njdvxtf.exe 1080 vlxnn.exe 2840 thxhrtb.exe 1920 vdhrj.exe 1636 flhvrj.exe 1728 nnfttff.exe 2316 jnfrjt.exe 2112 vldnhnf.exe 1192 fpffnl.exe 3048 ddbtnr.exe 1304 bjxjlx.exe 2836 ttrvtfd.exe 1256 bfdbxf.exe 808 xhthf.exe 948 bffvl.exe 2036 bprnrv.exe 888 xtnhbp.exe -
resource yara_rule behavioral1/memory/2360-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1876-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1104-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/940-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/940-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1600-318-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-328-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-346-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-355-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-363-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-364-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-372-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-375-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-389-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-397-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-405-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-413-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/292-421-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-429-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1184-437-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-445-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-453-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-461-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-462-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-470-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-478-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1876 2360 NEAS.a391014537f7a960140f5954f40b65a0.exe 28 PID 2360 wrote to memory of 1876 2360 NEAS.a391014537f7a960140f5954f40b65a0.exe 28 PID 2360 wrote to memory of 1876 2360 NEAS.a391014537f7a960140f5954f40b65a0.exe 28 PID 2360 wrote to memory of 1876 2360 NEAS.a391014537f7a960140f5954f40b65a0.exe 28 PID 1876 wrote to memory of 1104 1876 pjfvb.exe 29 PID 1876 wrote to memory of 1104 1876 pjfvb.exe 29 PID 1876 wrote to memory of 1104 1876 pjfvb.exe 29 PID 1876 wrote to memory of 1104 1876 pjfvb.exe 29 PID 1104 wrote to memory of 3056 1104 npjpnjv.exe 30 PID 1104 wrote to memory of 3056 1104 npjpnjv.exe 30 PID 1104 wrote to memory of 3056 1104 npjpnjv.exe 30 PID 1104 wrote to memory of 3056 1104 npjpnjv.exe 30 PID 3056 wrote to memory of 2700 3056 drdlbl.exe 31 PID 3056 wrote to memory of 2700 3056 drdlbl.exe 31 PID 3056 wrote to memory of 2700 3056 drdlbl.exe 31 PID 3056 wrote to memory of 2700 3056 drdlbl.exe 31 PID 2700 wrote to memory of 1092 2700 vhjfv.exe 32 PID 2700 wrote to memory of 1092 2700 vhjfv.exe 32 PID 2700 wrote to memory of 1092 2700 vhjfv.exe 32 PID 2700 wrote to memory of 1092 2700 vhjfv.exe 32 PID 1092 wrote to memory of 2608 1092 tttlv.exe 33 PID 1092 wrote to memory of 2608 1092 tttlv.exe 33 PID 1092 wrote to memory of 2608 1092 tttlv.exe 33 PID 1092 wrote to memory of 2608 1092 tttlv.exe 33 PID 2608 wrote to memory of 2516 2608 trlnhl.exe 35 PID 2608 wrote to memory of 2516 2608 trlnhl.exe 35 PID 2608 wrote to memory of 2516 2608 trlnhl.exe 35 PID 2608 wrote to memory of 2516 2608 trlnhl.exe 35 PID 2516 wrote to memory of 2492 2516 dhfff.exe 34 PID 2516 wrote to memory of 2492 2516 dhfff.exe 34 PID 2516 wrote to memory of 2492 2516 dhfff.exe 34 PID 2516 wrote to memory of 2492 2516 dhfff.exe 34 PID 2492 wrote to memory of 2456 2492 lvnpt.exe 36 PID 2492 wrote to memory of 2456 2492 lvnpt.exe 36 PID 2492 wrote to memory of 2456 2492 lvnpt.exe 36 PID 2492 wrote to memory of 2456 2492 lvnpt.exe 36 PID 2456 wrote to memory of 2972 2456 pdpbf.exe 40 PID 2456 wrote to memory of 2972 2456 pdpbf.exe 40 PID 2456 wrote to memory of 2972 2456 pdpbf.exe 40 PID 2456 wrote to memory of 2972 2456 pdpbf.exe 40 PID 2972 wrote to memory of 844 2972 ntblhd.exe 37 PID 2972 wrote to memory of 844 2972 ntblhd.exe 37 PID 2972 wrote to memory of 844 2972 ntblhd.exe 37 PID 2972 wrote to memory of 844 2972 ntblhd.exe 37 PID 844 wrote to memory of 3008 844 jrljl.exe 38 PID 844 wrote to memory of 3008 844 jrljl.exe 38 PID 844 wrote to memory of 3008 844 jrljl.exe 38 PID 844 wrote to memory of 3008 844 jrljl.exe 38 PID 3008 wrote to memory of 2024 3008 lljbdff.exe 39 PID 3008 wrote to memory of 2024 3008 lljbdff.exe 39 PID 3008 wrote to memory of 2024 3008 lljbdff.exe 39 PID 3008 wrote to memory of 2024 3008 lljbdff.exe 39 PID 2024 wrote to memory of 2668 2024 fnxtjdt.exe 41 PID 2024 wrote to memory of 2668 2024 fnxtjdt.exe 41 PID 2024 wrote to memory of 2668 2024 fnxtjdt.exe 41 PID 2024 wrote to memory of 2668 2024 fnxtjdt.exe 41 PID 2668 wrote to memory of 1512 2668 nbrvdfl.exe 42 PID 2668 wrote to memory of 1512 2668 nbrvdfl.exe 42 PID 2668 wrote to memory of 1512 2668 nbrvdfl.exe 42 PID 2668 wrote to memory of 1512 2668 nbrvdfl.exe 42 PID 1512 wrote to memory of 940 1512 fttjprx.exe 43 PID 1512 wrote to memory of 940 1512 fttjprx.exe 43 PID 1512 wrote to memory of 940 1512 fttjprx.exe 43 PID 1512 wrote to memory of 940 1512 fttjprx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.a391014537f7a960140f5954f40b65a0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.a391014537f7a960140f5954f40b65a0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\pjfvb.exec:\pjfvb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\npjpnjv.exec:\npjpnjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\drdlbl.exec:\drdlbl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\vhjfv.exec:\vhjfv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\tttlv.exec:\tttlv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\trlnhl.exec:\trlnhl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\dhfff.exec:\dhfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516
-
-
-
-
-
-
-
-
\??\c:\lvnpt.exec:\lvnpt.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\pdpbf.exec:\pdpbf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\ntblhd.exec:\ntblhd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972
-
-
-
\??\c:\jrljl.exec:\jrljl.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\lljbdff.exec:\lljbdff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\fnxtjdt.exec:\fnxtjdt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\nbrvdfl.exec:\nbrvdfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\fttjprx.exec:\fttjprx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\jfrlvt.exec:\jfrlvt.exe6⤵
- Executes dropped EXE
PID:940 -
\??\c:\blprpt.exec:\blprpt.exe7⤵
- Executes dropped EXE
PID:2824 -
\??\c:\nlllfvv.exec:\nlllfvv.exe8⤵
- Executes dropped EXE
PID:1524 -
\??\c:\ndvvp.exec:\ndvvp.exe9⤵
- Executes dropped EXE
PID:2120 -
\??\c:\fvhrnf.exec:\fvhrnf.exe10⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ffbjv.exec:\ffbjv.exe11⤵
- Executes dropped EXE
PID:2272 -
\??\c:\pjnvxd.exec:\pjnvxd.exe12⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nxlrntj.exec:\nxlrntj.exe13⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xjlfvnj.exec:\xjlfvnj.exe14⤵
- Executes dropped EXE
PID:1672 -
\??\c:\hrfnp.exec:\hrfnp.exe15⤵
- Executes dropped EXE
PID:1644 -
\??\c:\bddrdvv.exec:\bddrdvv.exe16⤵
- Executes dropped EXE
PID:980 -
\??\c:\ffnhh.exec:\ffnhh.exe17⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xtftl.exec:\xtftl.exe18⤵
- Executes dropped EXE
PID:1740 -
\??\c:\pxlnl.exec:\pxlnl.exe19⤵
- Executes dropped EXE
PID:876 -
\??\c:\pnnjj.exec:\pnnjj.exe20⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bhnlt.exec:\bhnlt.exe21⤵
- Executes dropped EXE
PID:1600 -
\??\c:\ntlfdx.exec:\ntlfdx.exe22⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ltdhhjb.exec:\ltdhhjb.exe23⤵
- Executes dropped EXE
PID:2576 -
\??\c:\jltlb.exec:\jltlb.exe24⤵
- Executes dropped EXE
PID:2640 -
\??\c:\njrphjf.exec:\njrphjf.exe25⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ltbxt.exec:\ltbxt.exe26⤵
- Executes dropped EXE
PID:2752 -
\??\c:\rlphhl.exec:\rlphhl.exe27⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rttjpvp.exec:\rttjpvp.exe28⤵
- Executes dropped EXE
PID:2740 -
\??\c:\tftjdl.exec:\tftjdl.exe29⤵
- Executes dropped EXE
PID:2508 -
\??\c:\drtjffh.exec:\drtjffh.exe30⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nfbhrv.exec:\nfbhrv.exe31⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ldlfjj.exec:\ldlfjj.exe32⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ppbblv.exec:\ppbblv.exe33⤵
- Executes dropped EXE
PID:292 -
\??\c:\nlpfdjp.exec:\nlpfdjp.exe34⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xhrdjr.exec:\xhrdjr.exe35⤵
- Executes dropped EXE
PID:1184 -
\??\c:\rdxtbnx.exec:\rdxtbnx.exe36⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rrdrrl.exec:\rrdrrl.exe37⤵
- Executes dropped EXE
PID:1932 -
\??\c:\njdvxtf.exec:\njdvxtf.exe38⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vlxnn.exec:\vlxnn.exe39⤵
- Executes dropped EXE
PID:1080 -
\??\c:\thxhrtb.exec:\thxhrtb.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\vdhrj.exec:\vdhrj.exe41⤵
- Executes dropped EXE
PID:1920 -
\??\c:\flhvrj.exec:\flhvrj.exe42⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nnfttff.exec:\nnfttff.exe43⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jnfrjt.exec:\jnfrjt.exe44⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vldnhnf.exec:\vldnhnf.exe45⤵
- Executes dropped EXE
PID:2112 -
\??\c:\fpffnl.exec:\fpffnl.exe46⤵
- Executes dropped EXE
PID:1192 -
\??\c:\ddbtnr.exec:\ddbtnr.exe47⤵
- Executes dropped EXE
PID:3048 -
\??\c:\bjxjlx.exec:\bjxjlx.exe48⤵
- Executes dropped EXE
PID:1304 -
\??\c:\ttrvtfd.exec:\ttrvtfd.exe49⤵
- Executes dropped EXE
PID:2836 -
\??\c:\bfdbxf.exec:\bfdbxf.exe50⤵
- Executes dropped EXE
PID:1256 -
\??\c:\xhthf.exec:\xhthf.exe51⤵
- Executes dropped EXE
PID:808 -
\??\c:\bffvl.exec:\bffvl.exe52⤵
- Executes dropped EXE
PID:948 -
\??\c:\bprnrv.exec:\bprnrv.exe53⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xtnhbp.exec:\xtnhbp.exe54⤵
- Executes dropped EXE
PID:888 -
\??\c:\xnlblr.exec:\xnlblr.exe55⤵PID:1992
-
\??\c:\txxdtbf.exec:\txxdtbf.exe56⤵PID:2460
-
\??\c:\vnnff.exec:\vnnff.exe57⤵PID:2924
-
\??\c:\lpdnjrt.exec:\lpdnjrt.exe58⤵PID:1580
-
\??\c:\drlhf.exec:\drlhf.exe59⤵PID:1500
-
\??\c:\vvndjb.exec:\vvndjb.exe60⤵PID:2156
-
\??\c:\fbdljhv.exec:\fbdljhv.exe61⤵PID:2576
-
\??\c:\tnrvlff.exec:\tnrvlff.exe62⤵PID:2700
-
\??\c:\dbpjrpj.exec:\dbpjrpj.exe63⤵PID:2636
-
\??\c:\bfhdjh.exec:\bfhdjh.exe64⤵PID:2796
-
\??\c:\nfhjd.exec:\nfhjd.exe65⤵PID:1224
-
\??\c:\vrlrh.exec:\vrlrh.exe66⤵PID:2740
-
\??\c:\tlrhxjf.exec:\tlrhxjf.exe67⤵PID:2172
-
\??\c:\tpdrvvb.exec:\tpdrvvb.exe68⤵PID:2544
-
\??\c:\tjrvnn.exec:\tjrvnn.exe69⤵PID:572
-
\??\c:\lxrhb.exec:\lxrhb.exe70⤵PID:2536
-
\??\c:\tfddhvf.exec:\tfddhvf.exe71⤵PID:1452
-
\??\c:\prvrfh.exec:\prvrfh.exe72⤵PID:268
-
\??\c:\jnhlj.exec:\jnhlj.exe73⤵PID:3000
-
\??\c:\nrtvttr.exec:\nrtvttr.exe74⤵PID:764
-
\??\c:\fhjfb.exec:\fhjfb.exe75⤵PID:2588
-
\??\c:\fdpdp.exec:\fdpdp.exe76⤵PID:2164
-
\??\c:\xhdvd.exec:\xhdvd.exe77⤵PID:2780
-
\??\c:\vrjnr.exec:\vrjnr.exe78⤵PID:2404
-
\??\c:\jdbtp.exec:\jdbtp.exe79⤵PID:2840
-
\??\c:\plrxht.exec:\plrxht.exe80⤵PID:1288
-
\??\c:\frltjv.exec:\frltjv.exe81⤵PID:1696
-
\??\c:\njxpth.exec:\njxpth.exe82⤵PID:1768
-
\??\c:\bvvxlf.exec:\bvvxlf.exe83⤵PID:1052
-
\??\c:\bhvxxf.exec:\bhvxxf.exe84⤵PID:440
-
\??\c:\dhlbtdl.exec:\dhlbtdl.exe85⤵PID:1616
-
\??\c:\njxxdj.exec:\njxxdj.exe86⤵PID:984
-
\??\c:\phtrhj.exec:\phtrhj.exe87⤵PID:1652
-
\??\c:\jrnnj.exec:\jrnnj.exe88⤵PID:1812
-
\??\c:\jfdjph.exec:\jfdjph.exe89⤵PID:964
-
\??\c:\nnnfn.exec:\nnnfn.exe90⤵PID:1256
-
\??\c:\vlndtdb.exec:\vlndtdb.exe91⤵PID:544
-
\??\c:\brpdnrj.exec:\brpdnrj.exe92⤵PID:1460
-
\??\c:\lnbnlb.exec:\lnbnlb.exe93⤵PID:2932
-
\??\c:\xrbppjl.exec:\xrbppjl.exe94⤵PID:2148
-
\??\c:\jfjddhh.exec:\jfjddhh.exe95⤵PID:2268
-
\??\c:\fxftpn.exec:\fxftpn.exe96⤵PID:1880
-
\??\c:\xttxn.exec:\xttxn.exe97⤵PID:2340
-
\??\c:\drpbtbx.exec:\drpbtbx.exe98⤵PID:2928
-
\??\c:\bvvprfb.exec:\bvvprfb.exe99⤵PID:2640
-
\??\c:\pjjrj.exec:\pjjrj.exe100⤵PID:2276
-
\??\c:\vbndvv.exec:\vbndvv.exe101⤵PID:1172
-
\??\c:\bpbvrb.exec:\bpbvrb.exe102⤵PID:2652
-
\??\c:\fptjtvv.exec:\fptjtvv.exe103⤵PID:2660
-
\??\c:\dllxp.exec:\dllxp.exe104⤵PID:2012
-
\??\c:\fjtbflv.exec:\fjtbflv.exe105⤵PID:804
-
\??\c:\lvpptf.exec:\lvpptf.exe106⤵PID:2524
-
\??\c:\dhvfr.exec:\dhvfr.exe107⤵PID:1216
-
\??\c:\nlbjt.exec:\nlbjt.exe108⤵PID:1912
-
\??\c:\dlppfrv.exec:\dlppfrv.exe109⤵PID:572
-
\??\c:\nffhhrh.exec:\nffhhrh.exe110⤵PID:844
-
\??\c:\jxhbfrl.exec:\jxhbfrl.exe111⤵PID:1908
-
\??\c:\nthfvr.exec:\nthfvr.exe112⤵PID:2732
-
\??\c:\dddjd.exec:\dddjd.exe113⤵PID:2800
-
\??\c:\nhntfv.exec:\nhntfv.exe114⤵PID:764
-
\??\c:\hnxdjvb.exec:\hnxdjvb.exe115⤵PID:936
-
\??\c:\lvdlbfj.exec:\lvdlbfj.exe116⤵PID:1932
-
\??\c:\bxdxtvr.exec:\bxdxtvr.exe117⤵PID:2816
-
\??\c:\drrfl.exec:\drrfl.exe118⤵PID:2792
-
\??\c:\tfjrlxx.exec:\tfjrlxx.exe119⤵PID:552
-
\??\c:\vdbtb.exec:\vdbtb.exe120⤵PID:1680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\pfdnjj.exec:\pfdnjj.exe1⤵PID:1548
-
\??\c:\hhdhn.exec:\hhdhn.exe2⤵PID:528
-
\??\c:\ndlvhhr.exec:\ndlvhhr.exe3⤵PID:1064
-
\??\c:\hbjrxd.exec:\hbjrxd.exe4⤵PID:2112
-
\??\c:\hlrnn.exec:\hlrnn.exe5⤵PID:1904
-
\??\c:\jhpdff.exec:\jhpdff.exe6⤵PID:1540
-
\??\c:\nxjdn.exec:\nxjdn.exe7⤵PID:2372
-
\??\c:\ntrrr.exec:\ntrrr.exe8⤵PID:1812
-
\??\c:\vdnfl.exec:\vdnfl.exe9⤵PID:2292
-
\??\c:\frblbrd.exec:\frblbrd.exe10⤵PID:2400
-
\??\c:\djpjl.exec:\djpjl.exe11⤵PID:544
-
\??\c:\flxdv.exec:\flxdv.exe12⤵PID:2216
-
\??\c:\jtbbxjn.exec:\jtbbxjn.exe13⤵PID:3012
-
\??\c:\bpxtlbn.exec:\bpxtlbn.exe14⤵PID:2460
-
\??\c:\nbrpxhb.exec:\nbrpxhb.exe15⤵PID:2008
-
\??\c:\djvlbb.exec:\djvlbb.exe16⤵PID:2440
-
\??\c:\dnjrjtf.exec:\dnjrjtf.exe17⤵PID:2928
-
\??\c:\tfrpbt.exec:\tfrpbt.exe18⤵PID:2648
-
\??\c:\jtjbbjb.exec:\jtjbbjb.exe19⤵PID:2700
-
\??\c:\xdlhf.exec:\xdlhf.exe20⤵PID:2812
-
\??\c:\vhnbjjb.exec:\vhnbjjb.exe21⤵PID:2504
-
\??\c:\vvhnnhh.exec:\vvhnnhh.exe22⤵PID:2660
-
\??\c:\xndxtn.exec:\xndxtn.exe23⤵PID:2964
-
\??\c:\vbfbvl.exec:\vbfbvl.exe24⤵PID:2172
-
\??\c:\vnnjr.exec:\vnnjr.exe25⤵PID:1584
-
\??\c:\vhnjn.exec:\vhnjn.exe26⤵PID:1456
-
\??\c:\xthld.exec:\xthld.exe27⤵PID:2296
-
\??\c:\bnlllnb.exec:\bnlllnb.exe28⤵PID:2076
-
\??\c:\fxrntrj.exec:\fxrntrj.exe29⤵PID:2088
-
\??\c:\pnlvjr.exec:\pnlvjr.exe30⤵PID:2024
-
\??\c:\dtlht.exec:\dtlht.exe31⤵PID:2668
-
\??\c:\jbtbr.exec:\jbtbr.exe32⤵PID:2552
-
\??\c:\jhbplnh.exec:\jhbplnh.exe33⤵PID:1588
-
\??\c:\xrbhxr.exec:\xrbhxr.exe34⤵PID:1596
-
\??\c:\bxvlr.exec:\bxvlr.exe35⤵PID:908
-
\??\c:\rxhdbll.exec:\rxhdbll.exe36⤵PID:2792
-
\??\c:\bfjhlrn.exec:\bfjhlrn.exe37⤵PID:1360
-
\??\c:\xbhjv.exec:\xbhjv.exe38⤵PID:1696
-
\??\c:\jvpjbtn.exec:\jvpjbtn.exe39⤵PID:1132
-
\??\c:\bhrbnrn.exec:\bhrbnrn.exe40⤵PID:1056
-
\??\c:\bvhvff.exec:\bvhvff.exe41⤵PID:1344
-
\??\c:\bhxnjhh.exec:\bhxnjhh.exe42⤵PID:3040
-
\??\c:\dbrfjr.exec:\dbrfjr.exe43⤵PID:1904
-
\??\c:\fvhhr.exec:\fvhhr.exe44⤵PID:2836
-
\??\c:\rrdjb.exec:\rrdjb.exe45⤵PID:2904
-
\??\c:\bvbvnh.exec:\bvbvnh.exe46⤵PID:980
-
\??\c:\bxpxlj.exec:\bxpxlj.exe47⤵PID:948
-
\??\c:\hrtxxfj.exec:\hrtxxfj.exe48⤵PID:2248
-
\??\c:\xvtdhh.exec:\xvtdhh.exe49⤵PID:2304
-
\??\c:\nhxfd.exec:\nhxfd.exe50⤵PID:2360
-
\??\c:\rfnfdt.exec:\rfnfdt.exe51⤵PID:2208
-
\??\c:\fnvvxl.exec:\fnvvxl.exe52⤵PID:1880
-
\??\c:\xrhjjnf.exec:\xrhjjnf.exe53⤵PID:1500
-
\??\c:\rtfrxdv.exec:\rtfrxdv.exe54⤵PID:2440
-
\??\c:\dhlfphf.exec:\dhlfphf.exe55⤵PID:2644
-
\??\c:\bfvnlxl.exec:\bfvnlxl.exe56⤵PID:2976
-
\??\c:\ftdbt.exec:\ftdbt.exe57⤵PID:2356
-
\??\c:\fxlvtb.exec:\fxlvtb.exe58⤵PID:2604
-
\??\c:\vrjhrfp.exec:\vrjhrfp.exe59⤵PID:1976
-
\??\c:\fphjv.exec:\fphjv.exe60⤵PID:2492
-
\??\c:\rxnlr.exec:\rxnlr.exe61⤵PID:2256
-
\??\c:\bjvth.exec:\bjvth.exe62⤵PID:2312
-
\??\c:\tjbbxb.exec:\tjbbxb.exe63⤵PID:2396
-
\??\c:\rdpjntn.exec:\rdpjntn.exe64⤵PID:1436
-
\??\c:\pvfvp.exec:\pvfvp.exe65⤵PID:2936
-
\??\c:\fnrnlx.exec:\fnrnlx.exe66⤵PID:1916
-
\??\c:\nfdvlv.exec:\nfdvlv.exe67⤵PID:1752
-
\??\c:\vtxlp.exec:\vtxlp.exe68⤵PID:1168
-
\??\c:\rhxpn.exec:\rhxpn.exe69⤵PID:936
-
\??\c:\vjnlx.exec:\vjnlx.exe70⤵PID:1932
-
\??\c:\bnprfn.exec:\bnprfn.exe71⤵PID:2824
-
\??\c:\xndjdhv.exec:\xndjdhv.exe72⤵PID:1568
-
\??\c:\tdlrdbr.exec:\tdlrdbr.exe73⤵PID:1532
-
\??\c:\brjlbnf.exec:\brjlbnf.exe74⤵PID:2792
-
\??\c:\xrdpd.exec:\xrdpd.exe75⤵PID:3064
-
\??\c:\llbhxjd.exec:\llbhxjd.exe76⤵PID:2072
-
\??\c:\rhnfbj.exec:\rhnfbj.exe77⤵PID:1052
-
\??\c:\vvxfxj.exec:\vvxfxj.exe78⤵PID:2092
-
\??\c:\nnfpj.exec:\nnfpj.exe79⤵PID:1076
-
\??\c:\djrhff.exec:\djrhff.exe80⤵PID:3040
-
\??\c:\xlfpjbj.exec:\xlfpjbj.exe81⤵PID:616
-
\??\c:\tdhhlh.exec:\tdhhlh.exe82⤵PID:2836
-
\??\c:\vhthh.exec:\vhthh.exe83⤵PID:1308
-
\??\c:\npxvn.exec:\npxvn.exe84⤵PID:808
-
\??\c:\rhdvpl.exec:\rhdvpl.exe85⤵PID:1760
-
\??\c:\xljfptj.exec:\xljfptj.exe86⤵PID:876
-
\??\c:\xvrrd.exec:\xvrrd.exe87⤵PID:2572
-
\??\c:\lxjpjv.exec:\lxjpjv.exe88⤵PID:1876
-
\??\c:\drjvbj.exec:\drjvbj.exe89⤵PID:2460
-
\??\c:\vxldlv.exec:\vxldlv.exe90⤵PID:2352
-
\??\c:\hbhhh.exec:\hbhhh.exe91⤵PID:2620
-
\??\c:\ttfnhd.exec:\ttfnhd.exe92⤵PID:2676
-
\??\c:\tbnlltj.exec:\tbnlltj.exe93⤵PID:2640
-
\??\c:\vrlfxh.exec:\vrlfxh.exe94⤵PID:2696
-
\??\c:\npnrnvx.exec:\npnrnvx.exe95⤵PID:2608
-
\??\c:\tfjrdvh.exec:\tfjrdvh.exe96⤵PID:2748
-
\??\c:\xnfhjd.exec:\xnfhjd.exe97⤵PID:2956
-
\??\c:\lxtfh.exec:\lxtfh.exe98⤵PID:2960
-
\??\c:\bhppv.exec:\bhppv.exe99⤵PID:804
-
\??\c:\nntlb.exec:\nntlb.exe100⤵PID:2456
-
\??\c:\fdxtdn.exec:\fdxtdn.exe101⤵PID:1152
-
\??\c:\rtbrf.exec:\rtbrf.exe102⤵PID:768
-
\??\c:\fnffjtb.exec:\fnffjtb.exe103⤵PID:1908
-
\??\c:\xxnln.exec:\xxnln.exe104⤵PID:2432
-
\??\c:\ldddfbh.exec:\ldddfbh.exe105⤵PID:772
-
\??\c:\dvvnl.exec:\dvvnl.exe106⤵PID:2176
-
\??\c:\tnxjjf.exec:\tnxjjf.exe107⤵PID:2592
-
\??\c:\ltxntdx.exec:\ltxntdx.exe108⤵PID:1712
-
\??\c:\xhhnlbj.exec:\xhhnlbj.exe109⤵PID:1932
-
\??\c:\fpttt.exec:\fpttt.exe110⤵PID:1536
-
\??\c:\vbxjl.exec:\vbxjl.exe111⤵PID:1596
-
\??\c:\brjvxnt.exec:\brjvxnt.exe112⤵PID:1728
-
\??\c:\pvllnj.exec:\pvllnj.exe113⤵PID:1360
-
\??\c:\lvlth.exec:\lvlth.exe114⤵PID:836
-
\??\c:\nlnbhdb.exec:\nlnbhdb.exe115⤵PID:440
-
\??\c:\tnxhh.exec:\tnxhh.exe116⤵PID:1556
-
\??\c:\dpdxl.exec:\dpdxl.exe117⤵PID:1344
-
\??\c:\bpvllf.exec:\bpvllf.exe118⤵PID:1076
-
\??\c:\hfhbhjx.exec:\hfhbhjx.exe119⤵PID:2940
-
\??\c:\pvprnt.exec:\pvprnt.exe120⤵PID:1644
-
\??\c:\pbbph.exec:\pbbph.exe121⤵PID:1252
-
\??\c:\ffpbn.exec:\ffpbn.exe122⤵PID:2160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-