Analysis
-
max time kernel
63s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2023, 19:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.b5c68ff97c6d0c5065d7e3c736c2cd60_JC.exe
Resource
win7-20231023-en
5 signatures
150 seconds
General
-
Target
NEAS.b5c68ff97c6d0c5065d7e3c736c2cd60_JC.exe
-
Size
357KB
-
MD5
b5c68ff97c6d0c5065d7e3c736c2cd60
-
SHA1
8368d95e640ed4932a5d2a36ea3e5d82abf42271
-
SHA256
1622e5e8320f053169c5e0ef42da27eefb1a7b3c2882aa9da53438945842868e
-
SHA512
d70deb526c5587d8196563e9b0cd5b711b7fec4e4024a27f6433295ac044e669230610c82ff5dde3ff5c3b7693649a6ef2d517f568d33ca71fe61745da041c55
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjD8296gnzeZhBu0:n3C9ytvngQj429nnzeZhBP
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral2/memory/1912-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/704-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/892-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-335-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-344-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 232 vhpdp.exe 1720 njddf.exe 2680 pftjbhn.exe 4152 hnnhvj.exe 3828 ndrrpx.exe 3588 jrrph.exe 704 vvdddph.exe 3628 tdrptp.exe 5104 htbnbhr.exe 4508 xfnpddf.exe 2964 lxxvjlv.exe 1864 lhtdlv.exe 2700 xvvttlb.exe 4916 vfdjfnn.exe 4872 ppjtpd.exe 3564 fjfhr.exe 4020 lpdvvj.exe 4064 phdnlnv.exe 3088 lnvlt.exe 1340 dvpnf.exe 892 ffhjt.exe 4852 vxltjlt.exe 4484 ptvphln.exe 1404 bjbxhxx.exe 644 pppdjp.exe 2272 tnflf.exe 1840 jxnrjxh.exe 2756 fntfdf.exe 2328 ntlfdn.exe 3084 tpxvjfb.exe 1904 drxlvrn.exe 4464 jvdxfn.exe 1704 dhrht.exe 3572 jlfnv.exe 1036 xhfxr.exe 2816 hnhdpnt.exe 3368 vjttf.exe 4100 fxthnh.exe 4356 vvfnn.exe 3124 xbnrhdr.exe 1912 lxbtn.exe 380 flbjpdn.exe 1720 bbvndhn.exe 4436 flxndbd.exe 4152 hhjjlnf.exe 3812 djlnt.exe 4884 rthrt.exe 4452 rvjdd.exe 4800 bnfpfrh.exe 872 lbflfh.exe 5104 pdvbd.exe 3776 dtpnb.exe 4424 vpxjvrr.exe 448 rvljlvp.exe 4320 hnjfpdp.exe 4268 tbfjf.exe 4688 nxrnvbj.exe 4232 njlnvjv.exe 1556 nhjlf.exe 2044 pbfbnbv.exe 672 vlvhj.exe 900 jtrftf.exe 3640 bnnrblf.exe 644 bdnvp.exe -
resource yara_rule behavioral2/memory/1912-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/704-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/892-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-335-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-344-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-348-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-357-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-363-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-368-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1912 wrote to memory of 232 1912 NEAS.b5c68ff97c6d0c5065d7e3c736c2cd60_JC.exe 84 PID 1912 wrote to memory of 232 1912 NEAS.b5c68ff97c6d0c5065d7e3c736c2cd60_JC.exe 84 PID 1912 wrote to memory of 232 1912 NEAS.b5c68ff97c6d0c5065d7e3c736c2cd60_JC.exe 84 PID 232 wrote to memory of 1720 232 vhpdp.exe 85 PID 232 wrote to memory of 1720 232 vhpdp.exe 85 PID 232 wrote to memory of 1720 232 vhpdp.exe 85 PID 1720 wrote to memory of 2680 1720 njddf.exe 86 PID 1720 wrote to memory of 2680 1720 njddf.exe 86 PID 1720 wrote to memory of 2680 1720 njddf.exe 86 PID 2680 wrote to memory of 4152 2680 pftjbhn.exe 87 PID 2680 wrote to memory of 4152 2680 pftjbhn.exe 87 PID 2680 wrote to memory of 4152 2680 pftjbhn.exe 87 PID 4152 wrote to memory of 3828 4152 hnnhvj.exe 88 PID 4152 wrote to memory of 3828 4152 hnnhvj.exe 88 PID 4152 wrote to memory of 3828 4152 hnnhvj.exe 88 PID 3828 wrote to memory of 3588 3828 ndrrpx.exe 89 PID 3828 wrote to memory of 3588 3828 ndrrpx.exe 89 PID 3828 wrote to memory of 3588 3828 ndrrpx.exe 89 PID 3588 wrote to memory of 704 3588 jrrph.exe 90 PID 3588 wrote to memory of 704 3588 jrrph.exe 90 PID 3588 wrote to memory of 704 3588 jrrph.exe 90 PID 704 wrote to memory of 3628 704 vvdddph.exe 91 PID 704 wrote to memory of 3628 704 vvdddph.exe 91 PID 704 wrote to memory of 3628 704 vvdddph.exe 91 PID 3628 wrote to memory of 5104 3628 tdrptp.exe 92 PID 3628 wrote to memory of 5104 3628 tdrptp.exe 92 PID 3628 wrote to memory of 5104 3628 tdrptp.exe 92 PID 5104 wrote to memory of 4508 5104 htbnbhr.exe 93 PID 5104 wrote to memory of 4508 5104 htbnbhr.exe 93 PID 5104 wrote to memory of 4508 5104 htbnbhr.exe 93 PID 4508 wrote to memory of 2964 4508 xfnpddf.exe 94 PID 4508 wrote to memory of 2964 4508 xfnpddf.exe 94 PID 4508 wrote to memory of 2964 4508 xfnpddf.exe 94 PID 2964 wrote to memory of 1864 2964 lxxvjlv.exe 95 PID 2964 wrote to memory of 1864 2964 lxxvjlv.exe 95 PID 2964 wrote to memory of 1864 2964 lxxvjlv.exe 95 PID 1864 wrote to memory of 2700 1864 lhtdlv.exe 96 PID 1864 wrote to memory of 2700 1864 lhtdlv.exe 96 PID 1864 wrote to memory of 2700 1864 lhtdlv.exe 96 PID 2700 wrote to memory of 4916 2700 xvvttlb.exe 97 PID 2700 wrote to memory of 4916 2700 xvvttlb.exe 97 PID 2700 wrote to memory of 4916 2700 xvvttlb.exe 97 PID 4916 wrote to memory of 4872 4916 vfdjfnn.exe 98 PID 4916 wrote to memory of 4872 4916 vfdjfnn.exe 98 PID 4916 wrote to memory of 4872 4916 vfdjfnn.exe 98 PID 4872 wrote to memory of 3564 4872 ppjtpd.exe 99 PID 4872 wrote to memory of 3564 4872 ppjtpd.exe 99 PID 4872 wrote to memory of 3564 4872 ppjtpd.exe 99 PID 3564 wrote to memory of 4020 3564 fjfhr.exe 100 PID 3564 wrote to memory of 4020 3564 fjfhr.exe 100 PID 3564 wrote to memory of 4020 3564 fjfhr.exe 100 PID 4020 wrote to memory of 4064 4020 lpdvvj.exe 101 PID 4020 wrote to memory of 4064 4020 lpdvvj.exe 101 PID 4020 wrote to memory of 4064 4020 lpdvvj.exe 101 PID 4064 wrote to memory of 3088 4064 phdnlnv.exe 102 PID 4064 wrote to memory of 3088 4064 phdnlnv.exe 102 PID 4064 wrote to memory of 3088 4064 phdnlnv.exe 102 PID 3088 wrote to memory of 1340 3088 lnvlt.exe 103 PID 3088 wrote to memory of 1340 3088 lnvlt.exe 103 PID 3088 wrote to memory of 1340 3088 lnvlt.exe 103 PID 1340 wrote to memory of 892 1340 dvpnf.exe 104 PID 1340 wrote to memory of 892 1340 dvpnf.exe 104 PID 1340 wrote to memory of 892 1340 dvpnf.exe 104 PID 892 wrote to memory of 4852 892 ffhjt.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.b5c68ff97c6d0c5065d7e3c736c2cd60_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.b5c68ff97c6d0c5065d7e3c736c2cd60_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\vhpdp.exec:\vhpdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\njddf.exec:\njddf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\pftjbhn.exec:\pftjbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\hnnhvj.exec:\hnnhvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\ndrrpx.exec:\ndrrpx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\jrrph.exec:\jrrph.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\vvdddph.exec:\vvdddph.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\tdrptp.exec:\tdrptp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\htbnbhr.exec:\htbnbhr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\xfnpddf.exec:\xfnpddf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\lxxvjlv.exec:\lxxvjlv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\lhtdlv.exec:\lhtdlv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\xvvttlb.exec:\xvvttlb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\vfdjfnn.exec:\vfdjfnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\ppjtpd.exec:\ppjtpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\fjfhr.exec:\fjfhr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\lpdvvj.exec:\lpdvvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\phdnlnv.exec:\phdnlnv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\lnvlt.exec:\lnvlt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\dvpnf.exec:\dvpnf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\ffhjt.exec:\ffhjt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\vxltjlt.exec:\vxltjlt.exe23⤵
- Executes dropped EXE
PID:4852 -
\??\c:\ptvphln.exec:\ptvphln.exe24⤵
- Executes dropped EXE
PID:4484 -
\??\c:\bjbxhxx.exec:\bjbxhxx.exe25⤵
- Executes dropped EXE
PID:1404 -
\??\c:\pppdjp.exec:\pppdjp.exe26⤵
- Executes dropped EXE
PID:644 -
\??\c:\tnflf.exec:\tnflf.exe27⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jxnrjxh.exec:\jxnrjxh.exe28⤵
- Executes dropped EXE
PID:1840 -
\??\c:\fntfdf.exec:\fntfdf.exe29⤵
- Executes dropped EXE
PID:2756 -
\??\c:\ntlfdn.exec:\ntlfdn.exe30⤵
- Executes dropped EXE
PID:2328 -
\??\c:\tpxvjfb.exec:\tpxvjfb.exe31⤵
- Executes dropped EXE
PID:3084 -
\??\c:\drxlvrn.exec:\drxlvrn.exe32⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jvdxfn.exec:\jvdxfn.exe33⤵
- Executes dropped EXE
PID:4464 -
\??\c:\dhrht.exec:\dhrht.exe34⤵
- Executes dropped EXE
PID:1704 -
\??\c:\jlfnv.exec:\jlfnv.exe35⤵
- Executes dropped EXE
PID:3572 -
\??\c:\xhfxr.exec:\xhfxr.exe36⤵
- Executes dropped EXE
PID:1036 -
\??\c:\hnhdpnt.exec:\hnhdpnt.exe37⤵
- Executes dropped EXE
PID:2816 -
\??\c:\vjttf.exec:\vjttf.exe38⤵
- Executes dropped EXE
PID:3368 -
\??\c:\fxthnh.exec:\fxthnh.exe39⤵
- Executes dropped EXE
PID:4100 -
\??\c:\vvfnn.exec:\vvfnn.exe40⤵
- Executes dropped EXE
PID:4356 -
\??\c:\xbnrhdr.exec:\xbnrhdr.exe41⤵
- Executes dropped EXE
PID:3124 -
\??\c:\lxbtn.exec:\lxbtn.exe42⤵
- Executes dropped EXE
PID:1912 -
\??\c:\flbjpdn.exec:\flbjpdn.exe43⤵
- Executes dropped EXE
PID:380 -
\??\c:\bbvndhn.exec:\bbvndhn.exe44⤵
- Executes dropped EXE
PID:1720 -
\??\c:\flxndbd.exec:\flxndbd.exe45⤵
- Executes dropped EXE
PID:4436 -
\??\c:\hhjjlnf.exec:\hhjjlnf.exe46⤵
- Executes dropped EXE
PID:4152 -
\??\c:\djlnt.exec:\djlnt.exe47⤵
- Executes dropped EXE
PID:3812 -
\??\c:\rthrt.exec:\rthrt.exe48⤵
- Executes dropped EXE
PID:4884 -
\??\c:\rvjdd.exec:\rvjdd.exe49⤵
- Executes dropped EXE
PID:4452 -
\??\c:\bnfpfrh.exec:\bnfpfrh.exe50⤵
- Executes dropped EXE
PID:4800 -
\??\c:\lbflfh.exec:\lbflfh.exe51⤵
- Executes dropped EXE
PID:872 -
\??\c:\pdvbd.exec:\pdvbd.exe52⤵
- Executes dropped EXE
PID:5104 -
\??\c:\dtpnb.exec:\dtpnb.exe53⤵
- Executes dropped EXE
PID:3776 -
\??\c:\vpxjvrr.exec:\vpxjvrr.exe54⤵
- Executes dropped EXE
PID:4424 -
\??\c:\rvljlvp.exec:\rvljlvp.exe55⤵
- Executes dropped EXE
PID:448 -
\??\c:\ftphfbv.exec:\ftphfbv.exe56⤵PID:4320
-
\??\c:\tbfjf.exec:\tbfjf.exe57⤵
- Executes dropped EXE
PID:4268 -
\??\c:\nxrnvbj.exec:\nxrnvbj.exe58⤵
- Executes dropped EXE
PID:4688 -
\??\c:\njlnvjv.exec:\njlnvjv.exe59⤵
- Executes dropped EXE
PID:4232 -
\??\c:\nhjlf.exec:\nhjlf.exe60⤵
- Executes dropped EXE
PID:1556 -
\??\c:\pbfbnbv.exec:\pbfbnbv.exe61⤵
- Executes dropped EXE
PID:2044 -
\??\c:\vlvhj.exec:\vlvhj.exe62⤵
- Executes dropped EXE
PID:672 -
\??\c:\jtrftf.exec:\jtrftf.exe63⤵
- Executes dropped EXE
PID:900 -
\??\c:\bnnrblf.exec:\bnnrblf.exe64⤵
- Executes dropped EXE
PID:3640 -
\??\c:\bdnvp.exec:\bdnvp.exe65⤵
- Executes dropped EXE
PID:644 -
\??\c:\jvfxr.exec:\jvfxr.exe66⤵PID:4536
-
\??\c:\xljjnfd.exec:\xljjnfd.exe67⤵PID:1456
-
\??\c:\nxvrth.exec:\nxvrth.exe68⤵PID:3264
-
\??\c:\vhbnv.exec:\vhbnv.exe69⤵PID:4128
-
\??\c:\rjtljl.exec:\rjtljl.exe70⤵PID:1540
-
\??\c:\flnrb.exec:\flnrb.exe71⤵PID:3824
-
\??\c:\hvdhp.exec:\hvdhp.exe72⤵PID:216
-
\??\c:\vvlnnv.exec:\vvlnnv.exe73⤵PID:4864
-
\??\c:\jnndp.exec:\jnndp.exe74⤵PID:4156
-
\??\c:\ffvdt.exec:\ffvdt.exe75⤵PID:3780
-
\??\c:\drdplh.exec:\drdplh.exe76⤵PID:3044
-
\??\c:\rrpfxf.exec:\rrpfxf.exe77⤵PID:4120
-
\??\c:\djtjvv.exec:\djtjvv.exe78⤵PID:4396
-
\??\c:\vjpbr.exec:\vjpbr.exe79⤵PID:5064
-
\??\c:\plrxltf.exec:\plrxltf.exe80⤵PID:4512
-
\??\c:\nvthrbl.exec:\nvthrbl.exe81⤵PID:4836
-
\??\c:\rpfhtrx.exec:\rpfhtrx.exe82⤵PID:4868
-
\??\c:\ffrjhjp.exec:\ffrjhjp.exe83⤵PID:4832
-
\??\c:\rxtnrj.exec:\rxtnrj.exe84⤵PID:416
-
\??\c:\jtxhdr.exec:\jtxhdr.exe85⤵PID:3320
-
\??\c:\fxffxp.exec:\fxffxp.exe86⤵PID:1488
-
\??\c:\ntfppv.exec:\ntfppv.exe87⤵PID:744
-
\??\c:\rfhnhl.exec:\rfhnhl.exe88⤵PID:3588
-
\??\c:\phxxdx.exec:\phxxdx.exe89⤵PID:1292
-
\??\c:\lhtdj.exec:\lhtdj.exe90⤵PID:4144
-
\??\c:\xxpjr.exec:\xxpjr.exe91⤵PID:1196
-
\??\c:\vndnvr.exec:\vndnvr.exe92⤵PID:3976
-
\??\c:\fnvfn.exec:\fnvfn.exe93⤵PID:4284
-
\??\c:\vbphpfd.exec:\vbphpfd.exe94⤵PID:4028
-
\??\c:\hnjfpdp.exec:\hnjfpdp.exe95⤵
- Executes dropped EXE
PID:4320 -
\??\c:\pbttrv.exec:\pbttrv.exe96⤵PID:1224
-
\??\c:\nhxrlnp.exec:\nhxrlnp.exe97⤵PID:3956
-
\??\c:\vdfrj.exec:\vdfrj.exe98⤵PID:3096
-
\??\c:\dbhjnp.exec:\dbhjnp.exe99⤵PID:928
-
\??\c:\fbvnpb.exec:\fbvnpb.exe100⤵PID:1216
-
\??\c:\vvxvfrd.exec:\vvxvfrd.exe101⤵PID:3316
-
\??\c:\frfnd.exec:\frfnd.exe102⤵PID:1896
-
\??\c:\pnfdhfb.exec:\pnfdhfb.exe103⤵PID:2068
-
\??\c:\tjlbdfl.exec:\tjlbdfl.exe104⤵PID:4816
-
\??\c:\hftnjfv.exec:\hftnjfv.exe105⤵PID:2024
-
\??\c:\xvbhnjr.exec:\xvbhnjr.exe106⤵PID:888
-
\??\c:\dtdhlhh.exec:\dtdhlhh.exe107⤵PID:580
-
\??\c:\rfrpljh.exec:\rfrpljh.exe108⤵PID:3084
-
\??\c:\dpnldpl.exec:\dpnldpl.exe109⤵PID:3608
-
\??\c:\ppbrbxd.exec:\ppbrbxd.exe110⤵PID:5068
-
\??\c:\lxltj.exec:\lxltj.exe111⤵PID:3572
-
\??\c:\jbdbn.exec:\jbdbn.exe112⤵PID:1036
-
\??\c:\dxxjjd.exec:\dxxjjd.exe113⤵PID:1172
-
\??\c:\pnjrph.exec:\pnjrph.exe114⤵PID:2156
-
\??\c:\tfhrjrt.exec:\tfhrjrt.exe115⤵PID:4240
-
\??\c:\ppxdl.exec:\ppxdl.exe116⤵PID:4636
-
\??\c:\nvvjfnf.exec:\nvvjfnf.exe117⤵PID:4356
-
\??\c:\frbdxp.exec:\frbdxp.exe118⤵PID:4520
-
\??\c:\xttrvh.exec:\xttrvh.exe119⤵PID:4512
-
\??\c:\bjjflvp.exec:\bjjflvp.exe120⤵PID:260
-
\??\c:\fbtxf.exec:\fbtxf.exe121⤵PID:4708
-
\??\c:\xffphh.exec:\xffphh.exe122⤵PID:2360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-