Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
15/11/2023, 01:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.2ccbdd852c95da0aab8ffeb900c48110.exe
Resource
win7-20231023-en
5 signatures
150 seconds
General
-
Target
NEAS.2ccbdd852c95da0aab8ffeb900c48110.exe
-
Size
118KB
-
MD5
2ccbdd852c95da0aab8ffeb900c48110
-
SHA1
66c2be690b80429afe73e6b18d51640447fe91db
-
SHA256
244a451ad7f86cc1a531f2acb6488e3906eca3da92e586ee61acec040ba61328
-
SHA512
086e9a99d1e71725740517f87252e28281c103b79f5f42b08cb3d065a97e12dc898bccaf860bd2496bca0d4e90b9b404ea711a29e203dc4b9144986ebc87e3af
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHvmQ+EZMYX2CDr:n3C9BRW0j/uVEZF2CDr
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral1/memory/2040-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1420-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1372-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1208-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/284-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-377-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-408-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1460-418-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-454-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-500-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-508-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-525-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-553-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-561-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-633-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1420 dnxvr.exe 2816 ndlddxn.exe 3000 ptrdtt.exe 2616 vbvjn.exe 2728 vllvp.exe 2484 xbjjr.exe 2508 lxlhxd.exe 2492 fnprnn.exe 2512 vhfnj.exe 1508 ttnrhb.exe 1372 lftpf.exe 2520 txlhh.exe 2776 hhbbxtn.exe 2796 vrpfpxx.exe 1664 nbdvr.exe 2248 ldxblhl.exe 2804 jbnnb.exe 1708 vbfdpn.exe 1628 fplvjht.exe 3068 tfttf.exe 1208 rntvf.exe 2856 vffpx.exe 2228 phnrdd.exe 440 bjdhv.exe 708 bbrvhf.exe 1368 tltrd.exe 1812 rtxlbff.exe 284 bjrnnl.exe 2184 fdbxtdd.exe 2092 jfdjb.exe 2172 rhfbhbb.exe 1760 dxnbrdj.exe 2056 ltlfpxl.exe 1172 vnplp.exe 2652 ppnhxh.exe 2128 lrfpxvh.exe 2200 jrtbxn.exe 2736 prhhpf.exe 2992 tvlnx.exe 2772 xvltrrn.exe 2660 nnnhhfh.exe 2472 pfdbxf.exe 2536 hrjbb.exe 1460 lxbvxrl.exe 2240 bntxt.exe 1132 vntvfdt.exe 1744 flljx.exe 2680 plhfxt.exe 2552 lxhdh.exe 2784 tfdvptv.exe 2008 tbbvjxh.exe 1728 bjjdvdn.exe 864 pvbjvbh.exe 1696 dntlx.exe 2800 txhjl.exe 1640 ltrfx.exe 2560 fdjnb.exe 2332 pvbnd.exe 268 htjpnp.exe 1208 fpjnl.exe 1536 lvhphl.exe 2104 nvvrl.exe 1552 nphrd.exe 1528 nntdbxn.exe -
resource yara_rule behavioral1/memory/2040-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1420-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1372-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1208-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/708-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/284-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-329-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1172-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-345-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-360-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-368-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-377-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-385-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-408-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1460-418-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1460-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-425-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-454-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/864-483-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-498-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-500-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-508-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-525-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-522-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-545-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-553-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-561-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-569-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-577-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-585-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-593-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-608-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-616-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-631-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-633-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2040 wrote to memory of 1420 2040 NEAS.2ccbdd852c95da0aab8ffeb900c48110.exe 28 PID 2040 wrote to memory of 1420 2040 NEAS.2ccbdd852c95da0aab8ffeb900c48110.exe 28 PID 2040 wrote to memory of 1420 2040 NEAS.2ccbdd852c95da0aab8ffeb900c48110.exe 28 PID 2040 wrote to memory of 1420 2040 NEAS.2ccbdd852c95da0aab8ffeb900c48110.exe 28 PID 1420 wrote to memory of 2816 1420 dnxvr.exe 29 PID 1420 wrote to memory of 2816 1420 dnxvr.exe 29 PID 1420 wrote to memory of 2816 1420 dnxvr.exe 29 PID 1420 wrote to memory of 2816 1420 dnxvr.exe 29 PID 2816 wrote to memory of 3000 2816 ndlddxn.exe 30 PID 2816 wrote to memory of 3000 2816 ndlddxn.exe 30 PID 2816 wrote to memory of 3000 2816 ndlddxn.exe 30 PID 2816 wrote to memory of 3000 2816 ndlddxn.exe 30 PID 3000 wrote to memory of 2616 3000 ptrdtt.exe 31 PID 3000 wrote to memory of 2616 3000 ptrdtt.exe 31 PID 3000 wrote to memory of 2616 3000 ptrdtt.exe 31 PID 3000 wrote to memory of 2616 3000 ptrdtt.exe 31 PID 2616 wrote to memory of 2728 2616 vbvjn.exe 32 PID 2616 wrote to memory of 2728 2616 vbvjn.exe 32 PID 2616 wrote to memory of 2728 2616 vbvjn.exe 32 PID 2616 wrote to memory of 2728 2616 vbvjn.exe 32 PID 2728 wrote to memory of 2484 2728 vllvp.exe 33 PID 2728 wrote to memory of 2484 2728 vllvp.exe 33 PID 2728 wrote to memory of 2484 2728 vllvp.exe 33 PID 2728 wrote to memory of 2484 2728 vllvp.exe 33 PID 2484 wrote to memory of 2508 2484 xbjjr.exe 34 PID 2484 wrote to memory of 2508 2484 xbjjr.exe 34 PID 2484 wrote to memory of 2508 2484 xbjjr.exe 34 PID 2484 wrote to memory of 2508 2484 xbjjr.exe 34 PID 2508 wrote to memory of 2492 2508 lxlhxd.exe 35 PID 2508 wrote to memory of 2492 2508 lxlhxd.exe 35 PID 2508 wrote to memory of 2492 2508 lxlhxd.exe 35 PID 2508 wrote to memory of 2492 2508 lxlhxd.exe 35 PID 2492 wrote to memory of 2512 2492 fnprnn.exe 36 PID 2492 wrote to memory of 2512 2492 fnprnn.exe 36 PID 2492 wrote to memory of 2512 2492 fnprnn.exe 36 PID 2492 wrote to memory of 2512 2492 fnprnn.exe 36 PID 2512 wrote to memory of 1508 2512 vhfnj.exe 37 PID 2512 wrote to memory of 1508 2512 vhfnj.exe 37 PID 2512 wrote to memory of 1508 2512 vhfnj.exe 37 PID 2512 wrote to memory of 1508 2512 vhfnj.exe 37 PID 1508 wrote to memory of 1372 1508 ttnrhb.exe 38 PID 1508 wrote to memory of 1372 1508 ttnrhb.exe 38 PID 1508 wrote to memory of 1372 1508 ttnrhb.exe 38 PID 1508 wrote to memory of 1372 1508 ttnrhb.exe 38 PID 1372 wrote to memory of 2520 1372 lftpf.exe 39 PID 1372 wrote to memory of 2520 1372 lftpf.exe 39 PID 1372 wrote to memory of 2520 1372 lftpf.exe 39 PID 1372 wrote to memory of 2520 1372 lftpf.exe 39 PID 2520 wrote to memory of 2776 2520 txlhh.exe 40 PID 2520 wrote to memory of 2776 2520 txlhh.exe 40 PID 2520 wrote to memory of 2776 2520 txlhh.exe 40 PID 2520 wrote to memory of 2776 2520 txlhh.exe 40 PID 2776 wrote to memory of 2796 2776 hhbbxtn.exe 41 PID 2776 wrote to memory of 2796 2776 hhbbxtn.exe 41 PID 2776 wrote to memory of 2796 2776 hhbbxtn.exe 41 PID 2776 wrote to memory of 2796 2776 hhbbxtn.exe 41 PID 2796 wrote to memory of 1664 2796 vrpfpxx.exe 42 PID 2796 wrote to memory of 1664 2796 vrpfpxx.exe 42 PID 2796 wrote to memory of 1664 2796 vrpfpxx.exe 42 PID 2796 wrote to memory of 1664 2796 vrpfpxx.exe 42 PID 1664 wrote to memory of 2248 1664 nbdvr.exe 43 PID 1664 wrote to memory of 2248 1664 nbdvr.exe 43 PID 1664 wrote to memory of 2248 1664 nbdvr.exe 43 PID 1664 wrote to memory of 2248 1664 nbdvr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2ccbdd852c95da0aab8ffeb900c48110.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2ccbdd852c95da0aab8ffeb900c48110.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\dnxvr.exec:\dnxvr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\ndlddxn.exec:\ndlddxn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\ptrdtt.exec:\ptrdtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\vbvjn.exec:\vbvjn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\vllvp.exec:\vllvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\xbjjr.exec:\xbjjr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\lxlhxd.exec:\lxlhxd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\fnprnn.exec:\fnprnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\vhfnj.exec:\vhfnj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\ttnrhb.exec:\ttnrhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\lftpf.exec:\lftpf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\txlhh.exec:\txlhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\hhbbxtn.exec:\hhbbxtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\vrpfpxx.exec:\vrpfpxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\nbdvr.exec:\nbdvr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\ldxblhl.exec:\ldxblhl.exe17⤵
- Executes dropped EXE
PID:2248 -
\??\c:\jbnnb.exec:\jbnnb.exe18⤵
- Executes dropped EXE
PID:2804 -
\??\c:\vbfdpn.exec:\vbfdpn.exe19⤵
- Executes dropped EXE
PID:1708 -
\??\c:\fplvjht.exec:\fplvjht.exe20⤵
- Executes dropped EXE
PID:1628 -
\??\c:\tfttf.exec:\tfttf.exe21⤵
- Executes dropped EXE
PID:3068 -
\??\c:\rntvf.exec:\rntvf.exe22⤵
- Executes dropped EXE
PID:1208 -
\??\c:\vffpx.exec:\vffpx.exe23⤵
- Executes dropped EXE
PID:2856 -
\??\c:\phnrdd.exec:\phnrdd.exe24⤵
- Executes dropped EXE
PID:2228 -
\??\c:\bjdhv.exec:\bjdhv.exe25⤵
- Executes dropped EXE
PID:440 -
\??\c:\bbrvhf.exec:\bbrvhf.exe26⤵
- Executes dropped EXE
PID:708 -
\??\c:\tltrd.exec:\tltrd.exe27⤵
- Executes dropped EXE
PID:1368 -
\??\c:\rtxlbff.exec:\rtxlbff.exe28⤵
- Executes dropped EXE
PID:1812 -
\??\c:\bjrnnl.exec:\bjrnnl.exe29⤵
- Executes dropped EXE
PID:284 -
\??\c:\fdbxtdd.exec:\fdbxtdd.exe30⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jfdjb.exec:\jfdjb.exe31⤵
- Executes dropped EXE
PID:2092 -
\??\c:\rhfbhbb.exec:\rhfbhbb.exe32⤵
- Executes dropped EXE
PID:2172 -
\??\c:\dxnbrdj.exec:\dxnbrdj.exe33⤵
- Executes dropped EXE
PID:1760 -
\??\c:\ltlfpxl.exec:\ltlfpxl.exe34⤵
- Executes dropped EXE
PID:2056 -
\??\c:\vnplp.exec:\vnplp.exe35⤵
- Executes dropped EXE
PID:1172 -
\??\c:\ppnhxh.exec:\ppnhxh.exe36⤵
- Executes dropped EXE
PID:2652 -
\??\c:\lrfpxvh.exec:\lrfpxvh.exe37⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jrtbxn.exec:\jrtbxn.exe38⤵
- Executes dropped EXE
PID:2200 -
\??\c:\prhhpf.exec:\prhhpf.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\tvlnx.exec:\tvlnx.exe40⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xvltrrn.exec:\xvltrrn.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\nnnhhfh.exec:\nnnhhfh.exe42⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pfdbxf.exec:\pfdbxf.exe43⤵
- Executes dropped EXE
PID:2472 -
\??\c:\hrjbb.exec:\hrjbb.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\lxbvxrl.exec:\lxbvxrl.exe45⤵
- Executes dropped EXE
PID:1460 -
\??\c:\bntxt.exec:\bntxt.exe46⤵
- Executes dropped EXE
PID:2240 -
\??\c:\vntvfdt.exec:\vntvfdt.exe47⤵
- Executes dropped EXE
PID:1132 -
\??\c:\flljx.exec:\flljx.exe48⤵
- Executes dropped EXE
PID:1744 -
\??\c:\plhfxt.exec:\plhfxt.exe49⤵
- Executes dropped EXE
PID:2680 -
\??\c:\lxhdh.exec:\lxhdh.exe50⤵
- Executes dropped EXE
PID:2552 -
\??\c:\tfdvptv.exec:\tfdvptv.exe51⤵
- Executes dropped EXE
PID:2784 -
\??\c:\tbbvjxh.exec:\tbbvjxh.exe52⤵
- Executes dropped EXE
PID:2008 -
\??\c:\bjjdvdn.exec:\bjjdvdn.exe53⤵
- Executes dropped EXE
PID:1728 -
\??\c:\pvbjvbh.exec:\pvbjvbh.exe54⤵
- Executes dropped EXE
PID:864 -
\??\c:\dntlx.exec:\dntlx.exe55⤵
- Executes dropped EXE
PID:1696 -
\??\c:\txhjl.exec:\txhjl.exe56⤵
- Executes dropped EXE
PID:2800 -
\??\c:\ltrfx.exec:\ltrfx.exe57⤵
- Executes dropped EXE
PID:1640 -
\??\c:\fdjnb.exec:\fdjnb.exe58⤵
- Executes dropped EXE
PID:2560 -
\??\c:\pvbnd.exec:\pvbnd.exe59⤵
- Executes dropped EXE
PID:2332 -
\??\c:\htjpnp.exec:\htjpnp.exe60⤵
- Executes dropped EXE
PID:268 -
\??\c:\fpjnl.exec:\fpjnl.exe61⤵
- Executes dropped EXE
PID:1208 -
\??\c:\lvhphl.exec:\lvhphl.exe62⤵
- Executes dropped EXE
PID:1536 -
\??\c:\nvvrl.exec:\nvvrl.exe63⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nphrd.exec:\nphrd.exe64⤵
- Executes dropped EXE
PID:1552 -
\??\c:\nntdbxn.exec:\nntdbxn.exe65⤵
- Executes dropped EXE
PID:1528 -
\??\c:\lrfpb.exec:\lrfpb.exe66⤵PID:2256
-
\??\c:\xxhnfh.exec:\xxhnfh.exe67⤵PID:1368
-
\??\c:\rhlvlh.exec:\rhlvlh.exe68⤵PID:1584
-
\??\c:\nrfrv.exec:\nrfrv.exe69⤵PID:1388
-
\??\c:\jhtdfp.exec:\jhtdfp.exe70⤵PID:840
-
\??\c:\rvfpn.exec:\rvfpn.exe71⤵PID:1972
-
\??\c:\lfvnfnn.exec:\lfvnfnn.exe72⤵PID:1676
-
\??\c:\ndbbh.exec:\ndbbh.exe73⤵PID:2172
-
\??\c:\nhfxpf.exec:\nhfxpf.exe74⤵PID:1344
-
\??\c:\hlnlj.exec:\hlnlj.exe75⤵PID:2388
-
\??\c:\jxndp.exec:\jxndp.exe76⤵PID:1608
-
\??\c:\lvrft.exec:\lvrft.exe77⤵PID:2760
-
\??\c:\lxvjrhj.exec:\lxvjrhj.exe78⤵PID:1008
-
\??\c:\jrddp.exec:\jrddp.exe79⤵PID:2976
-
\??\c:\ddfbjd.exec:\ddfbjd.exe80⤵PID:2620
-
\??\c:\rvfnxlr.exec:\rvfnxlr.exe81⤵PID:2496
-
\??\c:\xnldt.exec:\xnldt.exe82⤵PID:2236
-
\??\c:\lrnxp.exec:\lrnxp.exe83⤵PID:2516
-
\??\c:\lrvlbb.exec:\lrvlbb.exe84⤵PID:2464
-
\??\c:\lvnnr.exec:\lvnnr.exe85⤵PID:2524
-
\??\c:\blbtj.exec:\blbtj.exe86⤵PID:2948
-
\??\c:\xhhtvh.exec:\xhhtvh.exe87⤵PID:2432
-
\??\c:\ndtrf.exec:\ndtrf.exe88⤵PID:2440
-
\??\c:\nnbbjj.exec:\nnbbjj.exe89⤵PID:776
-
\??\c:\bhrtdpv.exec:\bhrtdpv.exe90⤵PID:2672
-
\??\c:\fhrbn.exec:\fhrbn.exe91⤵PID:2564
-
\??\c:\nbxtnlb.exec:\nbxtnlb.exe92⤵PID:2028
-
\??\c:\lxtxtfn.exec:\lxtxtfn.exe93⤵PID:2032
-
\??\c:\rlplddf.exec:\rlplddf.exe94⤵PID:1724
-
\??\c:\tfhbtrr.exec:\tfhbtrr.exe95⤵PID:1804
-
\??\c:\bdljfp.exec:\bdljfp.exe96⤵PID:1100
-
\??\c:\tvjll.exec:\tvjll.exe97⤵PID:1716
-
\??\c:\vxjtblr.exec:\vxjtblr.exe98⤵PID:1712
-
\??\c:\xbnrpvp.exec:\xbnrpvp.exe99⤵PID:1992
-
\??\c:\rfpfp.exec:\rfpfp.exe100⤵PID:788
-
\??\c:\pjjrrrp.exec:\pjjrrrp.exe101⤵PID:3068
-
\??\c:\dvvxdd.exec:\dvvxdd.exe102⤵PID:680
-
\??\c:\dnhtbbl.exec:\dnhtbbl.exe103⤵PID:660
-
\??\c:\nhfndtp.exec:\nhfndtp.exe104⤵PID:1536
-
\??\c:\jtvbfr.exec:\jtvbfr.exe105⤵PID:1392
-
\??\c:\vnjhbj.exec:\vnjhbj.exe106⤵PID:1844
-
\??\c:\lnjrh.exec:\lnjrh.exe107⤵PID:1532
-
\??\c:\jxrjdd.exec:\jxrjdd.exe108⤵PID:2952
-
\??\c:\ttflbf.exec:\ttflbf.exe109⤵PID:2216
-
\??\c:\rtrhd.exec:\rtrhd.exe110⤵PID:3012
-
\??\c:\tdblnh.exec:\tdblnh.exe111⤵PID:1876
-
\??\c:\bjlld.exec:\bjlld.exe112⤵PID:2640
-
\??\c:\pdhbv.exec:\pdhbv.exe113⤵PID:308
-
\??\c:\djvpxp.exec:\djvpxp.exe114⤵PID:1960
-
\??\c:\bfhvdl.exec:\bfhvdl.exe115⤵PID:2244
-
\??\c:\tnphfx.exec:\tnphfx.exe116⤵PID:2368
-
\??\c:\rnpnhnp.exec:\rnpnhnp.exe117⤵PID:1576
-
\??\c:\tnljr.exec:\tnljr.exe118⤵PID:1172
-
\??\c:\fnhbfhl.exec:\fnhbfhl.exe119⤵PID:2592
-
\??\c:\rdnbl.exec:\rdnbl.exe120⤵PID:2760
-
\??\c:\vpnrpjr.exec:\vpnrpjr.exe121⤵PID:2200
-
\??\c:\tvfrhfb.exec:\tvfrhfb.exe122⤵PID:2588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-