Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 10:11
Behavioral task
behavioral1
Sample
3628df5a941f5564535474efbbfe92ea4882d699ca40bef75265cefb44088b18.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3628df5a941f5564535474efbbfe92ea4882d699ca40bef75265cefb44088b18.exe
-
Size
381KB
-
MD5
05de1d0cd008069706769119b066c4b0
-
SHA1
34a0b5eebbb3e6a17c305d9e8f9272475a717013
-
SHA256
3628df5a941f5564535474efbbfe92ea4882d699ca40bef75265cefb44088b18
-
SHA512
bb1efe8d6376d762fb6d019e93acd0b249363160d16999bb1895c18e23396b3435432716e39fbd948ead100d30d6e15dc0483f7b42fb49e270b864ef3fcd3b5b
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpSwp9OD0IbswYTr:y4wFHoS3eFaKHpNKbbswer
Malware Config
Signatures
-
Detect Blackmoon payload 48 IoCs
Processes:
resource yara_rule behavioral1/memory/2660-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-26-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2632-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/936-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2192-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/696-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1296-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1120-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2348-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1476-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-171-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/704-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/440-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/840-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1124-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1168-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1980-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1584-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1200-413-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1852-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1092-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-493-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2928-512-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/300-573-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1540-572-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1752-582-0x0000000001C70000-0x0000000001C97000-memory.dmp family_blackmoon behavioral1/memory/2548-664-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/548-722-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/548-723-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2728-737-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1092-794-0x0000000000350000-0x0000000000377000-memory.dmp family_blackmoon behavioral1/memory/1488-846-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1020-873-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1540-905-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2648-948-0x0000000000320000-0x0000000000347000-memory.dmp family_blackmoon behavioral1/memory/2636-963-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/528-995-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dxptprb.exexfhdxbp.exedfnxbhp.exebtnbjp.exelnfhh.exejxhnt.exenpvxp.exenvjtrd.exepdpdjh.exejvhjff.exelhrpdfd.exebpfbbnx.exelfjjr.exevvxjdnj.exepdhrvx.exetjxtbv.exennbft.exepjlvbj.exebrblvdr.exefddjll.exefxjnxnr.exethhvntr.exepfjtrph.exejldfxln.exevdvvddj.exerhptlhr.exerxphndn.exevrdjtnt.exetrlxntb.exenlnnb.exepbhjh.exehrppvhr.exevrfjbxl.exeddrbp.exehnxfdn.exebnbltfx.exehppjdp.exejfxrjtt.exetnblv.exevhrft.exetvlxxhb.exehvxvxjb.exerrxfrnt.exennhrdtl.exeplbldxj.exerbhhh.exexvnjt.exevrbjfb.exervxvrxj.exerhjjbf.exedvthb.exetfblj.exedhvfhj.exedtptjf.exedxphpj.exebnvpp.exerdljv.exethnxj.exebrbptrj.exeppnlpd.exextdxjjb.exebfbbxp.exejnfdfv.exexnljd.exepid process 2744 dxptprb.exe 2632 xfhdxbp.exe 2564 dfnxbhp.exe 2572 btnbjp.exe 2616 lnfhh.exe 936 jxhnt.exe 2488 npvxp.exe 2192 nvjtrd.exe 696 pdpdjh.exe 548 jvhjff.exe 1296 lhrpdfd.exe 1120 bpfbbnx.exe 2512 lfjjr.exe 2304 vvxjdnj.exe 2348 pdhrvx.exe 2328 tjxtbv.exe 1476 nnbft.exe 2044 pjlvbj.exe 1100 brblvdr.exe 704 fddjll.exe 1724 fxjnxnr.exe 2928 thhvntr.exe 3060 pfjtrph.exe 2780 jldfxln.exe 440 vdvvddj.exe 840 rhptlhr.exe 1124 rxphndn.exe 1168 vrdjtnt.exe 1564 trlxntb.exe 2040 nlnnb.exe 2400 pbhjh.exe 1980 hrppvhr.exe 948 vrfjbxl.exe 1536 ddrbp.exe 1972 hnxfdn.exe 1744 bnbltfx.exe 2912 hppjdp.exe 2908 jfxrjtt.exe 2536 tnblv.exe 1584 vhrft.exe 2104 tvlxxhb.exe 2436 hvxvxjb.exe 2416 rrxfrnt.exe 2432 nnhrdtl.exe 2844 plbldxj.exe 2848 rbhhh.exe 684 xvnjt.exe 2032 vrbjfb.exe 884 rvxvrxj.exe 1200 rhjjbf.exe 1296 dvthb.exe 2728 tfblj.exe 2856 dhvfhj.exe 1852 dtptjf.exe 2304 dxphpj.exe 1988 bnvpp.exe 1924 rdljv.exe 1844 thnxj.exe 1476 brbptrj.exe 1760 ppnlpd.exe 1092 xtdxjjb.exe 2180 bfbbxp.exe 1704 jnfdfv.exe 2588 xnljd.exe -
Processes:
resource yara_rule behavioral1/memory/2660-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dxptprb.exe upx behavioral1/memory/2660-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2744-9-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xfhdxbp.exe upx behavioral1/memory/2744-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-26-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\dfnxbhp.exe upx behavioral1/memory/2632-28-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btnbjp.exe upx behavioral1/memory/2564-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lnfhh.exe upx behavioral1/memory/936-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jxhnt.exe upx behavioral1/memory/2616-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/936-64-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\npvxp.exe upx behavioral1/memory/2488-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nvjtrd.exe upx behavioral1/memory/2192-82-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdpdjh.exe upx behavioral1/memory/696-90-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvhjff.exe upx C:\lhrpdfd.exe upx behavioral1/memory/1296-108-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bpfbbnx.exe upx behavioral1/memory/1120-118-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfjjr.exe upx behavioral1/memory/2512-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvxjdnj.exe upx C:\pdhrvx.exe upx C:\tjxtbv.exe upx behavioral1/memory/2348-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2328-145-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnbft.exe upx behavioral1/memory/1476-162-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjlvbj.exe upx behavioral1/memory/2044-163-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\brblvdr.exe upx C:\fddjll.exe upx behavioral1/memory/704-188-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxjnxnr.exe upx C:\thhvntr.exe upx C:\pfjtrph.exe upx C:\jldfxln.exe upx C:\vdvvddj.exe upx C:\rhptlhr.exe upx behavioral1/memory/440-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/840-239-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxphndn.exe upx behavioral1/memory/1168-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1124-248-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vrdjtnt.exe upx behavioral1/memory/1168-258-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1564-259-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\trlxntb.exe upx C:\nlnnb.exe upx \??\c:\pbhjh.exe upx behavioral1/memory/2400-283-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hrppvhr.exe upx behavioral1/memory/1980-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1536-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1972-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/948-319-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3628df5a941f5564535474efbbfe92ea4882d699ca40bef75265cefb44088b18.exedxptprb.exexfhdxbp.exedfnxbhp.exebtnbjp.exelnfhh.exejxhnt.exenpvxp.exenvjtrd.exepdpdjh.exejvhjff.exelhrpdfd.exebpfbbnx.exelfjjr.exevvxjdnj.exepdhrvx.exedescription pid process target process PID 2660 wrote to memory of 2744 2660 3628df5a941f5564535474efbbfe92ea4882d699ca40bef75265cefb44088b18.exe dxptprb.exe PID 2660 wrote to memory of 2744 2660 3628df5a941f5564535474efbbfe92ea4882d699ca40bef75265cefb44088b18.exe dxptprb.exe PID 2660 wrote to memory of 2744 2660 3628df5a941f5564535474efbbfe92ea4882d699ca40bef75265cefb44088b18.exe dxptprb.exe PID 2660 wrote to memory of 2744 2660 3628df5a941f5564535474efbbfe92ea4882d699ca40bef75265cefb44088b18.exe dxptprb.exe PID 2744 wrote to memory of 2632 2744 dxptprb.exe xfhdxbp.exe PID 2744 wrote to memory of 2632 2744 dxptprb.exe xfhdxbp.exe PID 2744 wrote to memory of 2632 2744 dxptprb.exe xfhdxbp.exe PID 2744 wrote to memory of 2632 2744 dxptprb.exe xfhdxbp.exe PID 2632 wrote to memory of 2564 2632 xfhdxbp.exe dfnxbhp.exe PID 2632 wrote to memory of 2564 2632 xfhdxbp.exe dfnxbhp.exe PID 2632 wrote to memory of 2564 2632 xfhdxbp.exe dfnxbhp.exe PID 2632 wrote to memory of 2564 2632 xfhdxbp.exe dfnxbhp.exe PID 2564 wrote to memory of 2572 2564 dfnxbhp.exe btnbjp.exe PID 2564 wrote to memory of 2572 2564 dfnxbhp.exe btnbjp.exe PID 2564 wrote to memory of 2572 2564 dfnxbhp.exe btnbjp.exe PID 2564 wrote to memory of 2572 2564 dfnxbhp.exe btnbjp.exe PID 2572 wrote to memory of 2616 2572 btnbjp.exe lnfhh.exe PID 2572 wrote to memory of 2616 2572 btnbjp.exe lnfhh.exe PID 2572 wrote to memory of 2616 2572 btnbjp.exe lnfhh.exe PID 2572 wrote to memory of 2616 2572 btnbjp.exe lnfhh.exe PID 2616 wrote to memory of 936 2616 lnfhh.exe jxhnt.exe PID 2616 wrote to memory of 936 2616 lnfhh.exe jxhnt.exe PID 2616 wrote to memory of 936 2616 lnfhh.exe jxhnt.exe PID 2616 wrote to memory of 936 2616 lnfhh.exe jxhnt.exe PID 936 wrote to memory of 2488 936 jxhnt.exe npvxp.exe PID 936 wrote to memory of 2488 936 jxhnt.exe npvxp.exe PID 936 wrote to memory of 2488 936 jxhnt.exe npvxp.exe PID 936 wrote to memory of 2488 936 jxhnt.exe npvxp.exe PID 2488 wrote to memory of 2192 2488 npvxp.exe nvjtrd.exe PID 2488 wrote to memory of 2192 2488 npvxp.exe nvjtrd.exe PID 2488 wrote to memory of 2192 2488 npvxp.exe nvjtrd.exe PID 2488 wrote to memory of 2192 2488 npvxp.exe nvjtrd.exe PID 2192 wrote to memory of 696 2192 nvjtrd.exe pdpdjh.exe PID 2192 wrote to memory of 696 2192 nvjtrd.exe pdpdjh.exe PID 2192 wrote to memory of 696 2192 nvjtrd.exe pdpdjh.exe PID 2192 wrote to memory of 696 2192 nvjtrd.exe pdpdjh.exe PID 696 wrote to memory of 548 696 pdpdjh.exe jvhjff.exe PID 696 wrote to memory of 548 696 pdpdjh.exe jvhjff.exe PID 696 wrote to memory of 548 696 pdpdjh.exe jvhjff.exe PID 696 wrote to memory of 548 696 pdpdjh.exe jvhjff.exe PID 548 wrote to memory of 1296 548 jvhjff.exe lhrpdfd.exe PID 548 wrote to memory of 1296 548 jvhjff.exe lhrpdfd.exe PID 548 wrote to memory of 1296 548 jvhjff.exe lhrpdfd.exe PID 548 wrote to memory of 1296 548 jvhjff.exe lhrpdfd.exe PID 1296 wrote to memory of 1120 1296 lhrpdfd.exe bpfbbnx.exe PID 1296 wrote to memory of 1120 1296 lhrpdfd.exe bpfbbnx.exe PID 1296 wrote to memory of 1120 1296 lhrpdfd.exe bpfbbnx.exe PID 1296 wrote to memory of 1120 1296 lhrpdfd.exe bpfbbnx.exe PID 1120 wrote to memory of 2512 1120 bpfbbnx.exe lfjjr.exe PID 1120 wrote to memory of 2512 1120 bpfbbnx.exe lfjjr.exe PID 1120 wrote to memory of 2512 1120 bpfbbnx.exe lfjjr.exe PID 1120 wrote to memory of 2512 1120 bpfbbnx.exe lfjjr.exe PID 2512 wrote to memory of 2304 2512 lfjjr.exe vvxjdnj.exe PID 2512 wrote to memory of 2304 2512 lfjjr.exe vvxjdnj.exe PID 2512 wrote to memory of 2304 2512 lfjjr.exe vvxjdnj.exe PID 2512 wrote to memory of 2304 2512 lfjjr.exe vvxjdnj.exe PID 2304 wrote to memory of 2348 2304 vvxjdnj.exe pdhrvx.exe PID 2304 wrote to memory of 2348 2304 vvxjdnj.exe pdhrvx.exe PID 2304 wrote to memory of 2348 2304 vvxjdnj.exe pdhrvx.exe PID 2304 wrote to memory of 2348 2304 vvxjdnj.exe pdhrvx.exe PID 2348 wrote to memory of 2328 2348 pdhrvx.exe tjxtbv.exe PID 2348 wrote to memory of 2328 2348 pdhrvx.exe tjxtbv.exe PID 2348 wrote to memory of 2328 2348 pdhrvx.exe tjxtbv.exe PID 2348 wrote to memory of 2328 2348 pdhrvx.exe tjxtbv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3628df5a941f5564535474efbbfe92ea4882d699ca40bef75265cefb44088b18.exe"C:\Users\Admin\AppData\Local\Temp\3628df5a941f5564535474efbbfe92ea4882d699ca40bef75265cefb44088b18.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\dxptprb.exec:\dxptprb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\xfhdxbp.exec:\xfhdxbp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\dfnxbhp.exec:\dfnxbhp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\btnbjp.exec:\btnbjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\lnfhh.exec:\lnfhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jxhnt.exec:\jxhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\npvxp.exec:\npvxp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\nvjtrd.exec:\nvjtrd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\pdpdjh.exec:\pdpdjh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\jvhjff.exec:\jvhjff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\lhrpdfd.exec:\lhrpdfd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\bpfbbnx.exec:\bpfbbnx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\lfjjr.exec:\lfjjr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\vvxjdnj.exec:\vvxjdnj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\pdhrvx.exec:\pdhrvx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\tjxtbv.exec:\tjxtbv.exe17⤵
- Executes dropped EXE
PID:2328 -
\??\c:\nnbft.exec:\nnbft.exe18⤵
- Executes dropped EXE
PID:1476 -
\??\c:\pjlvbj.exec:\pjlvbj.exe19⤵
- Executes dropped EXE
PID:2044 -
\??\c:\brblvdr.exec:\brblvdr.exe20⤵
- Executes dropped EXE
PID:1100 -
\??\c:\fddjll.exec:\fddjll.exe21⤵
- Executes dropped EXE
PID:704 -
\??\c:\fxjnxnr.exec:\fxjnxnr.exe22⤵
- Executes dropped EXE
PID:1724 -
\??\c:\thhvntr.exec:\thhvntr.exe23⤵
- Executes dropped EXE
PID:2928 -
\??\c:\pfjtrph.exec:\pfjtrph.exe24⤵
- Executes dropped EXE
PID:3060 -
\??\c:\jldfxln.exec:\jldfxln.exe25⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vdvvddj.exec:\vdvvddj.exe26⤵
- Executes dropped EXE
PID:440 -
\??\c:\rhptlhr.exec:\rhptlhr.exe27⤵
- Executes dropped EXE
PID:840 -
\??\c:\rxphndn.exec:\rxphndn.exe28⤵
- Executes dropped EXE
PID:1124 -
\??\c:\vrdjtnt.exec:\vrdjtnt.exe29⤵
- Executes dropped EXE
PID:1168 -
\??\c:\trlxntb.exec:\trlxntb.exe30⤵
- Executes dropped EXE
PID:1564 -
\??\c:\nlnnb.exec:\nlnnb.exe31⤵
- Executes dropped EXE
PID:2040 -
\??\c:\pbhjh.exec:\pbhjh.exe32⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hrppvhr.exec:\hrppvhr.exe33⤵
- Executes dropped EXE
PID:1980 -
\??\c:\vrfjbxl.exec:\vrfjbxl.exe34⤵
- Executes dropped EXE
PID:948 -
\??\c:\ddrbp.exec:\ddrbp.exe35⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hnxfdn.exec:\hnxfdn.exe36⤵
- Executes dropped EXE
PID:1972 -
\??\c:\bnbltfx.exec:\bnbltfx.exe37⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hppjdp.exec:\hppjdp.exe38⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jfxrjtt.exec:\jfxrjtt.exe39⤵
- Executes dropped EXE
PID:2908 -
\??\c:\tnblv.exec:\tnblv.exe40⤵
- Executes dropped EXE
PID:2536 -
\??\c:\vhrft.exec:\vhrft.exe41⤵
- Executes dropped EXE
PID:1584 -
\??\c:\tvlxxhb.exec:\tvlxxhb.exe42⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hvxvxjb.exec:\hvxvxjb.exe43⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rrxfrnt.exec:\rrxfrnt.exe44⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nnhrdtl.exec:\nnhrdtl.exe45⤵
- Executes dropped EXE
PID:2432 -
\??\c:\plbldxj.exec:\plbldxj.exe46⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rbhhh.exec:\rbhhh.exe47⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xvnjt.exec:\xvnjt.exe48⤵
- Executes dropped EXE
PID:684 -
\??\c:\vrbjfb.exec:\vrbjfb.exe49⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rvxvrxj.exec:\rvxvrxj.exe50⤵
- Executes dropped EXE
PID:884 -
\??\c:\rhjjbf.exec:\rhjjbf.exe51⤵
- Executes dropped EXE
PID:1200 -
\??\c:\dvthb.exec:\dvthb.exe52⤵
- Executes dropped EXE
PID:1296 -
\??\c:\tfblj.exec:\tfblj.exe53⤵
- Executes dropped EXE
PID:2728 -
\??\c:\dhvfhj.exec:\dhvfhj.exe54⤵
- Executes dropped EXE
PID:2856 -
\??\c:\dtptjf.exec:\dtptjf.exe55⤵
- Executes dropped EXE
PID:1852 -
\??\c:\dxphpj.exec:\dxphpj.exe56⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bnvpp.exec:\bnvpp.exe57⤵
- Executes dropped EXE
PID:1988 -
\??\c:\rdljv.exec:\rdljv.exe58⤵
- Executes dropped EXE
PID:1924 -
\??\c:\thnxj.exec:\thnxj.exe59⤵
- Executes dropped EXE
PID:1844 -
\??\c:\brbptrj.exec:\brbptrj.exe60⤵
- Executes dropped EXE
PID:1476 -
\??\c:\ppnlpd.exec:\ppnlpd.exe61⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xtdxjjb.exec:\xtdxjjb.exe62⤵
- Executes dropped EXE
PID:1092 -
\??\c:\bfbbxp.exec:\bfbbxp.exe63⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jnfdfv.exec:\jnfdfv.exe64⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xnljd.exec:\xnljd.exe65⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rdntjpn.exec:\rdntjpn.exe66⤵PID:2928
-
\??\c:\rrxfx.exec:\rrxfx.exe67⤵PID:3044
-
\??\c:\jpxpb.exec:\jpxpb.exe68⤵PID:1664
-
\??\c:\nttnfb.exec:\nttnfb.exe69⤵PID:3012
-
\??\c:\hjtxl.exec:\hjtxl.exe70⤵PID:1696
-
\??\c:\txvnpl.exec:\txvnpl.exe71⤵PID:1500
-
\??\c:\fvhpb.exec:\fvhpb.exe72⤵PID:1752
-
\??\c:\tlpvpjr.exec:\tlpvpjr.exe73⤵PID:844
-
\??\c:\ljrlnn.exec:\ljrlnn.exe74⤵PID:2904
-
\??\c:\nrvnfxf.exec:\nrvnfxf.exe75⤵PID:1540
-
\??\c:\flbtf.exec:\flbtf.exe76⤵PID:300
-
\??\c:\nfdpxdf.exec:\nfdpxdf.exe77⤵PID:2040
-
\??\c:\fxprt.exec:\fxprt.exe78⤵PID:1320
-
\??\c:\ddxjxd.exec:\ddxjxd.exe79⤵PID:1772
-
\??\c:\btxbtvb.exec:\btxbtvb.exe80⤵PID:2108
-
\??\c:\lbbjr.exec:\lbbjr.exe81⤵PID:2232
-
\??\c:\tnbhj.exec:\tnbhj.exe82⤵PID:1928
-
\??\c:\tplhnp.exec:\tplhnp.exe83⤵PID:2932
-
\??\c:\dlftbpn.exec:\dlftbpn.exe84⤵PID:2684
-
\??\c:\nffln.exec:\nffln.exe85⤵PID:2520
-
\??\c:\hnrvvjb.exec:\hnrvvjb.exe86⤵PID:1616
-
\??\c:\bjdpdjj.exec:\bjdpdjj.exe87⤵PID:2536
-
\??\c:\lbnvxr.exec:\lbnvxr.exe88⤵PID:2740
-
\??\c:\bbnbh.exec:\bbnbh.exe89⤵PID:2548
-
\??\c:\hrdhphf.exec:\hrdhphf.exe90⤵PID:2252
-
\??\c:\vpttlj.exec:\vpttlj.exe91⤵PID:2444
-
\??\c:\dbrdpd.exec:\dbrdpd.exe92⤵PID:2612
-
\??\c:\npbdtn.exec:\npbdtn.exe93⤵PID:2488
-
\??\c:\pxldpp.exec:\pxldpp.exe94⤵PID:2852
-
\??\c:\nvnbbnj.exec:\nvnbbnj.exe95⤵PID:684
-
\??\c:\rlvdxb.exec:\rlvdxb.exe96⤵PID:2032
-
\??\c:\pjbdv.exec:\pjbdv.exe97⤵PID:884
-
\??\c:\rjbppf.exec:\rjbppf.exe98⤵PID:548
-
\??\c:\hfrbtnn.exec:\hfrbtnn.exe99⤵PID:2480
-
\??\c:\jprfl.exec:\jprfl.exe100⤵PID:2728
-
\??\c:\xrthfbn.exec:\xrthfbn.exe101⤵PID:2864
-
\??\c:\frvxjf.exec:\frvxjf.exe102⤵PID:2256
-
\??\c:\tpvjvd.exec:\tpvjvd.exe103⤵PID:1964
-
\??\c:\vhxhrpj.exec:\vhxhrpj.exe104⤵PID:1116
-
\??\c:\bpjpt.exec:\bpjpt.exe105⤵PID:1908
-
\??\c:\vhnxn.exec:\vhnxn.exe106⤵PID:2472
-
\??\c:\vhvrjnn.exec:\vhvrjnn.exe107⤵PID:1136
-
\??\c:\ftxvrhb.exec:\ftxvrhb.exe108⤵PID:1104
-
\??\c:\dptbl.exec:\dptbl.exe109⤵PID:1092
-
\??\c:\vvnnjdb.exec:\vvnnjdb.exe110⤵PID:804
-
\??\c:\vrvfft.exec:\vrvfft.exe111⤵PID:2088
-
\??\c:\llxbv.exec:\llxbv.exe112⤵PID:2920
-
\??\c:\pfbjjh.exec:\pfbjjh.exe113⤵PID:2216
-
\??\c:\tljrddl.exec:\tljrddl.exe114⤵PID:2092
-
\??\c:\hjvnbbp.exec:\hjvnbbp.exe115⤵PID:1364
-
\??\c:\rxrnnx.exec:\rxrnnx.exe116⤵PID:3028
-
\??\c:\lbvtf.exec:\lbvtf.exe117⤵PID:1488
-
\??\c:\thdtntp.exec:\thdtntp.exe118⤵PID:840
-
\??\c:\rbpvb.exec:\rbpvb.exe119⤵PID:1560
-
\??\c:\pnxrh.exec:\pnxrh.exe120⤵PID:2016
-
\??\c:\rrjrphj.exec:\rrjrphj.exe121⤵PID:1020
-
\??\c:\htrjvn.exec:\htrjvn.exe122⤵PID:1540
-
\??\c:\bbhbb.exec:\bbhbb.exe123⤵PID:2364
-
\??\c:\xhvftf.exec:\xhvftf.exe124⤵PID:1780
-
\??\c:\txjffl.exec:\txjffl.exe125⤵PID:2120
-
\??\c:\ddfvjn.exec:\ddfvjn.exe126⤵PID:2356
-
\??\c:\vnhdxl.exec:\vnhdxl.exe127⤵PID:1756
-
\??\c:\nvnxhvd.exec:\nvnxhvd.exe128⤵PID:1468
-
\??\c:\dphtv.exec:\dphtv.exe129⤵PID:2136
-
\??\c:\fpbllnt.exec:\fpbllnt.exe130⤵PID:2560
-
\??\c:\nxflh.exec:\nxflh.exe131⤵PID:2636
-
\??\c:\rjtltrb.exec:\rjtltrb.exe132⤵PID:2540
-
\??\c:\djhplp.exec:\djhplp.exe133⤵PID:2648
-
\??\c:\hprpvnl.exec:\hprpvnl.exe134⤵PID:1616
-
\??\c:\plfxnbf.exec:\plfxnbf.exe135⤵PID:2700
-
\??\c:\hrddbrd.exec:\hrddbrd.exe136⤵PID:2572
-
\??\c:\vvljhbj.exec:\vvljhbj.exe137⤵PID:2408
-
\??\c:\hhrtpl.exec:\hhrtpl.exe138⤵PID:2340
-
\??\c:\bffhrxh.exec:\bffhrxh.exe139⤵PID:2840
-
\??\c:\jphbff.exec:\jphbff.exe140⤵PID:528
-
\??\c:\tbvbvj.exec:\tbvbvj.exe141⤵PID:2396
-
\??\c:\rtnjbl.exec:\rtnjbl.exe142⤵PID:596
-
\??\c:\frjvb.exec:\frjvb.exe143⤵PID:1416
-
\??\c:\bjhjvbt.exec:\bjhjvbt.exe144⤵PID:572
-
\??\c:\lfrjrn.exec:\lfrjrn.exe145⤵PID:2676
-
\??\c:\llbpf.exec:\llbpf.exe146⤵PID:2708
-
\??\c:\vnjhx.exec:\vnjhx.exe147⤵PID:2480
-
\??\c:\fxvjdpp.exec:\fxvjdpp.exe148⤵PID:1600
-
\??\c:\pplpjnf.exec:\pplpjnf.exe149⤵PID:2304
-
\??\c:\ntfdbn.exec:\ntfdbn.exe150⤵PID:1360
-
\??\c:\bxnllnt.exec:\bxnllnt.exe151⤵PID:2276
-
\??\c:\hnbph.exec:\hnbph.exe152⤵PID:1116
-
\??\c:\nrxhlj.exec:\nrxhlj.exe153⤵PID:1908
-
\??\c:\rxvjrh.exec:\rxvjrh.exe154⤵PID:2472
-
\??\c:\njrrj.exec:\njrrj.exe155⤵PID:2044
-
\??\c:\vtlxxrd.exec:\vtlxxrd.exe156⤵PID:1104
-
\??\c:\jlhnj.exec:\jlhnj.exe157⤵PID:1092
-
\??\c:\tnrfp.exec:\tnrfp.exe158⤵PID:2096
-
\??\c:\dltfjbr.exec:\dltfjbr.exe159⤵PID:2088
-
\??\c:\bppffjp.exec:\bppffjp.exe160⤵PID:2920
-
\??\c:\blnxtxv.exec:\blnxtxv.exe161⤵PID:2936
-
\??\c:\fhtjftl.exec:\fhtjftl.exe162⤵PID:2092
-
\??\c:\thpvbf.exec:\thpvbf.exe163⤵PID:2996
-
\??\c:\xnnppl.exec:\xnnppl.exe164⤵PID:1252
-
\??\c:\fbdfxh.exec:\fbdfxh.exe165⤵PID:1840
-
\??\c:\brnnnp.exec:\brnnnp.exe166⤵PID:1628
-
\??\c:\jvnpdd.exec:\jvnpdd.exe167⤵PID:1848
-
\??\c:\ltrxdl.exec:\ltrxdl.exe168⤵PID:1148
-
\??\c:\fpbrv.exec:\fpbrv.exe169⤵PID:1144
-
\??\c:\xxjbjxt.exec:\xxjbjxt.exe170⤵PID:2244
-
\??\c:\tjjpj.exec:\tjjpj.exe171⤵PID:2208
-
\??\c:\djxjnb.exec:\djxjnb.exe172⤵PID:2184
-
\??\c:\tjrrhb.exec:\tjrrhb.exe173⤵PID:1320
-
\??\c:\bdfntv.exec:\bdfntv.exe174⤵PID:2212
-
\??\c:\nfbvfh.exec:\nfbvfh.exe175⤵PID:1736
-
\??\c:\btpnjhj.exec:\btpnjhj.exe176⤵PID:2504
-
\??\c:\dnrnlvd.exec:\dnrnlvd.exe177⤵PID:2960
-
\??\c:\bbbrnnr.exec:\bbbrnnr.exe178⤵PID:2932
-
\??\c:\fthtx.exec:\fthtx.exe179⤵PID:2552
-
\??\c:\dvldn.exec:\dvldn.exe180⤵PID:2860
-
\??\c:\vfxxd.exec:\vfxxd.exe181⤵PID:2620
-
\??\c:\htxfb.exec:\htxfb.exe182⤵PID:2420
-
\??\c:\ppbjnh.exec:\ppbjnh.exe183⤵PID:2580
-
\??\c:\bdtht.exec:\bdtht.exe184⤵PID:2584
-
\??\c:\dprpxp.exec:\dprpxp.exe185⤵PID:2416
-
\??\c:\ldfvbtv.exec:\ldfvbtv.exe186⤵PID:2432
-
\??\c:\frprrjf.exec:\frprrjf.exe187⤵PID:2340
-
\??\c:\jdthrx.exec:\jdthrx.exe188⤵PID:592
-
\??\c:\fnxpbpx.exec:\fnxpbpx.exe189⤵PID:528
-
\??\c:\rrllj.exec:\rrllj.exe190⤵PID:1304
-
\??\c:\bddrv.exec:\bddrv.exe191⤵PID:596
-
\??\c:\hlvrp.exec:\hlvrp.exe192⤵PID:1416
-
\??\c:\nrtbndv.exec:\nrtbndv.exe193⤵PID:2080
-
\??\c:\jnfnxx.exec:\jnfnxx.exe194⤵PID:2676
-
\??\c:\vnvfb.exec:\vnvfb.exe195⤵PID:2140
-
\??\c:\ttbbp.exec:\ttbbp.exe196⤵PID:1588
-
\??\c:\ldhprj.exec:\ldhprj.exe197⤵PID:1852
-
\??\c:\ftfrr.exec:\ftfrr.exe198⤵PID:1952
-
\??\c:\xjjxlx.exec:\xjjxlx.exe199⤵PID:1360
-
\??\c:\trnvr.exec:\trnvr.exe200⤵PID:2328
-
\??\c:\bbrxtd.exec:\bbrxtd.exe201⤵PID:1712
-
\??\c:\fjhrf.exec:\fjhrf.exe202⤵PID:2728
-
\??\c:\rrndb.exec:\rrndb.exe203⤵PID:1760
-
\??\c:\pllbddr.exec:\pllbddr.exe204⤵PID:772
-
\??\c:\bdxpjnp.exec:\bdxpjnp.exe205⤵PID:2180
-
\??\c:\hvbvxjb.exec:\hvbvxjb.exe206⤵PID:2776
-
\??\c:\vbnphp.exec:\vbnphp.exe207⤵PID:1704
-
\??\c:\fjfdvp.exec:\fjfdvp.exe208⤵PID:3040
-
\??\c:\djfthfp.exec:\djfthfp.exe209⤵PID:2020
-
\??\c:\hrbbtlx.exec:\hrbbtlx.exe210⤵PID:2780
-
\??\c:\nlldf.exec:\nlldf.exe211⤵PID:1892
-
\??\c:\hbbtv.exec:\hbbtv.exe212⤵PID:1548
-
\??\c:\tlrvn.exec:\tlrvn.exe213⤵PID:1824
-
\??\c:\pnxvt.exec:\pnxvt.exe214⤵PID:792
-
\??\c:\bjllf.exec:\bjllf.exe215⤵PID:2060
-
\??\c:\tjpbt.exec:\tjpbt.exe216⤵PID:1180
-
\??\c:\rbnhht.exec:\rbnhht.exe217⤵PID:1080
-
\??\c:\rvffxtp.exec:\rvffxtp.exe218⤵PID:1020
-
\??\c:\rdndj.exec:\rdndj.exe219⤵PID:2056
-
\??\c:\rdfrjn.exec:\rdfrjn.exe220⤵PID:2364
-
\??\c:\lxjttx.exec:\lxjttx.exe221⤵PID:1776
-
\??\c:\xpfbjxf.exec:\xpfbjxf.exe222⤵PID:1772
-
\??\c:\rbbvtbd.exec:\rbbvtbd.exe223⤵PID:1524
-
\??\c:\tnrdh.exec:\tnrdh.exe224⤵PID:2264
-
\??\c:\blhpj.exec:\blhpj.exe225⤵PID:1468
-
\??\c:\vtprdnd.exec:\vtprdnd.exe226⤵PID:1968
-
\??\c:\vbjrfn.exec:\vbjrfn.exe227⤵PID:2136
-
\??\c:\bhhpdnj.exec:\bhhpdnj.exe228⤵PID:2932
-
\??\c:\nrnrdf.exec:\nrnrdf.exe229⤵PID:2552
-
\??\c:\bxbvn.exec:\bxbvn.exe230⤵PID:1612
-
\??\c:\txjpvr.exec:\txjpvr.exe231⤵PID:2736
-
\??\c:\htrjhtr.exec:\htrjhtr.exe232⤵PID:2468
-
\??\c:\ppfjj.exec:\ppfjj.exe233⤵PID:2740
-
\??\c:\bvpbfr.exec:\bvpbfr.exe234⤵PID:2548
-
\??\c:\bdjbx.exec:\bdjbx.exe235⤵PID:2524
-
\??\c:\vrvjbv.exec:\vrvjbv.exe236⤵PID:2612
-
\??\c:\xbjjrnr.exec:\xbjjrnr.exe237⤵PID:2844
-
\??\c:\vrdpx.exec:\vrdpx.exe238⤵PID:636
-
\??\c:\jltfjv.exec:\jltfjv.exe239⤵PID:1492
-
\??\c:\fhrhp.exec:\fhrhp.exe240⤵PID:2064
-
\??\c:\jfdftrp.exec:\jfdftrp.exe241⤵PID:2712
-
\??\c:\frfxb.exec:\frfxb.exe242⤵PID:1416