Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 09:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
069b05779525d2e80f6799c71eaeb75156f2ba79955a48b91d42b98b29211de2.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
069b05779525d2e80f6799c71eaeb75156f2ba79955a48b91d42b98b29211de2.exe
-
Size
62KB
-
MD5
072ed69dd7dabf7324974299bc7709a0
-
SHA1
9c238cfb4ae622070731fcfc6b8968712651b36a
-
SHA256
069b05779525d2e80f6799c71eaeb75156f2ba79955a48b91d42b98b29211de2
-
SHA512
2b7e57787706d1cb0caf4e1a6c7bb6817a3c9c22f33def3655212af6df0061c4d8803f8cd3656a320a5e9806cd36537b12df46816545d5aed334edb378a0afa9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJULh1214am:ymb3NkkiQ3mdBjFIFdJmdam
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2012-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1004-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/852-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1068-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hvdllx.exexrrxbtd.exetpdnd.exetxndt.exepnrtt.exelfdphpl.exefvjjflh.exetlbxtpl.exedxdnrrj.exebrbfl.exevnhrjj.exefxnpdl.exexxdhjhd.exejtddpdj.exetprnj.exefhdttt.exenblbxjb.exefnfvdb.exejtvthx.exenvldtrj.exenhrdtbt.exebjvttlb.exerlhfjbh.exehttfnvb.exethjppld.exebrttjt.exenxxdf.exedbtdvh.exervlfht.exehpvvvnr.exebvjxtx.exenhhlrrf.exernrtpvl.exepnfhtf.exetjdtdjv.exerfxvbp.exehttjn.exefrjrlj.exefjbxd.exetjffjpf.exefjnxh.exedbdxxrj.exevtxpp.exervntdl.exenbdvt.exefvdvtl.exerxtld.exentbdfhh.exelvlpv.exenltxfxj.exevxpprf.exevnffl.exejfxvvr.exebnthhr.exeppxnt.exetrbxlxb.exejtrfv.exedpbftnl.exejhpddf.exepfnjfvt.exedxnfp.exebxnpjnh.exefnlrb.exendjrd.exepid process 2012 hvdllx.exe 2932 xrrxbtd.exe 2572 tpdnd.exe 2748 txndt.exe 2620 pnrtt.exe 1644 lfdphpl.exe 2380 fvjjflh.exe 2456 tlbxtpl.exe 1004 dxdnrrj.exe 1040 brbfl.exe 1332 vnhrjj.exe 2644 fxnpdl.exe 2716 xxdhjhd.exe 1836 jtddpdj.exe 1916 tprnj.exe 2316 fhdttt.exe 852 nblbxjb.exe 1760 fnfvdb.exe 1956 jtvthx.exe 544 nvldtrj.exe 2220 nhrdtbt.exe 1068 bjvttlb.exe 3012 rlhfjbh.exe 920 httfnvb.exe 1772 thjppld.exe 1536 brttjt.exe 2628 nxxdf.exe 624 dbtdvh.exe 1652 rvlfht.exe 1676 hpvvvnr.exe 2000 bvjxtx.exe 2172 nhhlrrf.exe 1164 rnrtpvl.exe 1560 pnfhtf.exe 2052 tjdtdjv.exe 2528 rfxvbp.exe 2540 httjn.exe 1656 frjrlj.exe 2680 fjbxd.exe 2696 tjffjpf.exe 2428 fjnxh.exe 2396 dbdxxrj.exe 2432 vtxpp.exe 3044 rvntdl.exe 2840 nbdvt.exe 836 fvdvtl.exe 1216 rxtld.exe 2440 ntbdfhh.exe 2480 lvlpv.exe 2700 nltxfxj.exe 2248 vxpprf.exe 1912 vnffl.exe 1048 jfxvvr.exe 928 bnthhr.exe 2244 ppxnt.exe 1528 trbxlxb.exe 1968 jtrfv.exe 1756 dpbftnl.exe 1780 jhpddf.exe 2240 pfnjfvt.exe 1080 dxnfp.exe 2948 bxnpjnh.exe 1928 fnlrb.exe 1168 ndjrd.exe -
Processes:
resource yara_rule behavioral1/memory/2012-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1004-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1836-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/852-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1068-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-281-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
069b05779525d2e80f6799c71eaeb75156f2ba79955a48b91d42b98b29211de2.exehvdllx.exexrrxbtd.exetpdnd.exetxndt.exepnrtt.exelfdphpl.exefvjjflh.exetlbxtpl.exedxdnrrj.exebrbfl.exevnhrjj.exefxnpdl.exexxdhjhd.exejtddpdj.exetprnj.exedescription pid process target process PID 2196 wrote to memory of 2012 2196 069b05779525d2e80f6799c71eaeb75156f2ba79955a48b91d42b98b29211de2.exe hvdllx.exe PID 2196 wrote to memory of 2012 2196 069b05779525d2e80f6799c71eaeb75156f2ba79955a48b91d42b98b29211de2.exe hvdllx.exe PID 2196 wrote to memory of 2012 2196 069b05779525d2e80f6799c71eaeb75156f2ba79955a48b91d42b98b29211de2.exe hvdllx.exe PID 2196 wrote to memory of 2012 2196 069b05779525d2e80f6799c71eaeb75156f2ba79955a48b91d42b98b29211de2.exe hvdllx.exe PID 2012 wrote to memory of 2932 2012 hvdllx.exe xrrxbtd.exe PID 2012 wrote to memory of 2932 2012 hvdllx.exe xrrxbtd.exe PID 2012 wrote to memory of 2932 2012 hvdllx.exe xrrxbtd.exe PID 2012 wrote to memory of 2932 2012 hvdllx.exe xrrxbtd.exe PID 2932 wrote to memory of 2572 2932 xrrxbtd.exe tpdnd.exe PID 2932 wrote to memory of 2572 2932 xrrxbtd.exe tpdnd.exe PID 2932 wrote to memory of 2572 2932 xrrxbtd.exe tpdnd.exe PID 2932 wrote to memory of 2572 2932 xrrxbtd.exe tpdnd.exe PID 2572 wrote to memory of 2748 2572 tpdnd.exe txndt.exe PID 2572 wrote to memory of 2748 2572 tpdnd.exe txndt.exe PID 2572 wrote to memory of 2748 2572 tpdnd.exe txndt.exe PID 2572 wrote to memory of 2748 2572 tpdnd.exe txndt.exe PID 2748 wrote to memory of 2620 2748 txndt.exe pnrtt.exe PID 2748 wrote to memory of 2620 2748 txndt.exe pnrtt.exe PID 2748 wrote to memory of 2620 2748 txndt.exe pnrtt.exe PID 2748 wrote to memory of 2620 2748 txndt.exe pnrtt.exe PID 2620 wrote to memory of 1644 2620 pnrtt.exe lfdphpl.exe PID 2620 wrote to memory of 1644 2620 pnrtt.exe lfdphpl.exe PID 2620 wrote to memory of 1644 2620 pnrtt.exe lfdphpl.exe PID 2620 wrote to memory of 1644 2620 pnrtt.exe lfdphpl.exe PID 1644 wrote to memory of 2380 1644 lfdphpl.exe fvjjflh.exe PID 1644 wrote to memory of 2380 1644 lfdphpl.exe fvjjflh.exe PID 1644 wrote to memory of 2380 1644 lfdphpl.exe fvjjflh.exe PID 1644 wrote to memory of 2380 1644 lfdphpl.exe fvjjflh.exe PID 2380 wrote to memory of 2456 2380 fvjjflh.exe tlbxtpl.exe PID 2380 wrote to memory of 2456 2380 fvjjflh.exe tlbxtpl.exe PID 2380 wrote to memory of 2456 2380 fvjjflh.exe tlbxtpl.exe PID 2380 wrote to memory of 2456 2380 fvjjflh.exe tlbxtpl.exe PID 2456 wrote to memory of 1004 2456 tlbxtpl.exe dxdnrrj.exe PID 2456 wrote to memory of 1004 2456 tlbxtpl.exe dxdnrrj.exe PID 2456 wrote to memory of 1004 2456 tlbxtpl.exe dxdnrrj.exe PID 2456 wrote to memory of 1004 2456 tlbxtpl.exe dxdnrrj.exe PID 1004 wrote to memory of 1040 1004 dxdnrrj.exe brbfl.exe PID 1004 wrote to memory of 1040 1004 dxdnrrj.exe brbfl.exe PID 1004 wrote to memory of 1040 1004 dxdnrrj.exe brbfl.exe PID 1004 wrote to memory of 1040 1004 dxdnrrj.exe brbfl.exe PID 1040 wrote to memory of 1332 1040 brbfl.exe vnhrjj.exe PID 1040 wrote to memory of 1332 1040 brbfl.exe vnhrjj.exe PID 1040 wrote to memory of 1332 1040 brbfl.exe vnhrjj.exe PID 1040 wrote to memory of 1332 1040 brbfl.exe vnhrjj.exe PID 1332 wrote to memory of 2644 1332 vnhrjj.exe fxnpdl.exe PID 1332 wrote to memory of 2644 1332 vnhrjj.exe fxnpdl.exe PID 1332 wrote to memory of 2644 1332 vnhrjj.exe fxnpdl.exe PID 1332 wrote to memory of 2644 1332 vnhrjj.exe fxnpdl.exe PID 2644 wrote to memory of 2716 2644 fxnpdl.exe xxdhjhd.exe PID 2644 wrote to memory of 2716 2644 fxnpdl.exe xxdhjhd.exe PID 2644 wrote to memory of 2716 2644 fxnpdl.exe xxdhjhd.exe PID 2644 wrote to memory of 2716 2644 fxnpdl.exe xxdhjhd.exe PID 2716 wrote to memory of 1836 2716 xxdhjhd.exe jtddpdj.exe PID 2716 wrote to memory of 1836 2716 xxdhjhd.exe jtddpdj.exe PID 2716 wrote to memory of 1836 2716 xxdhjhd.exe jtddpdj.exe PID 2716 wrote to memory of 1836 2716 xxdhjhd.exe jtddpdj.exe PID 1836 wrote to memory of 1916 1836 jtddpdj.exe tprnj.exe PID 1836 wrote to memory of 1916 1836 jtddpdj.exe tprnj.exe PID 1836 wrote to memory of 1916 1836 jtddpdj.exe tprnj.exe PID 1836 wrote to memory of 1916 1836 jtddpdj.exe tprnj.exe PID 1916 wrote to memory of 2316 1916 tprnj.exe fhdttt.exe PID 1916 wrote to memory of 2316 1916 tprnj.exe fhdttt.exe PID 1916 wrote to memory of 2316 1916 tprnj.exe fhdttt.exe PID 1916 wrote to memory of 2316 1916 tprnj.exe fhdttt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\069b05779525d2e80f6799c71eaeb75156f2ba79955a48b91d42b98b29211de2.exe"C:\Users\Admin\AppData\Local\Temp\069b05779525d2e80f6799c71eaeb75156f2ba79955a48b91d42b98b29211de2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\hvdllx.exec:\hvdllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\xrrxbtd.exec:\xrrxbtd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\tpdnd.exec:\tpdnd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\txndt.exec:\txndt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\pnrtt.exec:\pnrtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\lfdphpl.exec:\lfdphpl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\fvjjflh.exec:\fvjjflh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\tlbxtpl.exec:\tlbxtpl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\dxdnrrj.exec:\dxdnrrj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\brbfl.exec:\brbfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\vnhrjj.exec:\vnhrjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\fxnpdl.exec:\fxnpdl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\xxdhjhd.exec:\xxdhjhd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\jtddpdj.exec:\jtddpdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\tprnj.exec:\tprnj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\fhdttt.exec:\fhdttt.exe17⤵
- Executes dropped EXE
PID:2316 -
\??\c:\nblbxjb.exec:\nblbxjb.exe18⤵
- Executes dropped EXE
PID:852 -
\??\c:\fnfvdb.exec:\fnfvdb.exe19⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jtvthx.exec:\jtvthx.exe20⤵
- Executes dropped EXE
PID:1956 -
\??\c:\nvldtrj.exec:\nvldtrj.exe21⤵
- Executes dropped EXE
PID:544 -
\??\c:\nhrdtbt.exec:\nhrdtbt.exe22⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bjvttlb.exec:\bjvttlb.exe23⤵
- Executes dropped EXE
PID:1068 -
\??\c:\rlhfjbh.exec:\rlhfjbh.exe24⤵
- Executes dropped EXE
PID:3012 -
\??\c:\httfnvb.exec:\httfnvb.exe25⤵
- Executes dropped EXE
PID:920 -
\??\c:\thjppld.exec:\thjppld.exe26⤵
- Executes dropped EXE
PID:1772 -
\??\c:\brttjt.exec:\brttjt.exe27⤵
- Executes dropped EXE
PID:1536 -
\??\c:\nxxdf.exec:\nxxdf.exe28⤵
- Executes dropped EXE
PID:2628 -
\??\c:\dbtdvh.exec:\dbtdvh.exe29⤵
- Executes dropped EXE
PID:624 -
\??\c:\rvlfht.exec:\rvlfht.exe30⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hpvvvnr.exec:\hpvvvnr.exe31⤵
- Executes dropped EXE
PID:1676 -
\??\c:\bvjxtx.exec:\bvjxtx.exe32⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nhhlrrf.exec:\nhhlrrf.exe33⤵
- Executes dropped EXE
PID:2172 -
\??\c:\rnrtpvl.exec:\rnrtpvl.exe34⤵
- Executes dropped EXE
PID:1164 -
\??\c:\dptplrr.exec:\dptplrr.exe35⤵PID:2256
-
\??\c:\pnfhtf.exec:\pnfhtf.exe36⤵
- Executes dropped EXE
PID:1560 -
\??\c:\tjdtdjv.exec:\tjdtdjv.exe37⤵
- Executes dropped EXE
PID:2052 -
\??\c:\rfxvbp.exec:\rfxvbp.exe38⤵
- Executes dropped EXE
PID:2528 -
\??\c:\httjn.exec:\httjn.exe39⤵
- Executes dropped EXE
PID:2540 -
\??\c:\frjrlj.exec:\frjrlj.exe40⤵
- Executes dropped EXE
PID:1656 -
\??\c:\fjbxd.exec:\fjbxd.exe41⤵
- Executes dropped EXE
PID:2680 -
\??\c:\tjffjpf.exec:\tjffjpf.exe42⤵
- Executes dropped EXE
PID:2696 -
\??\c:\fjnxh.exec:\fjnxh.exe43⤵
- Executes dropped EXE
PID:2428 -
\??\c:\dbdxxrj.exec:\dbdxxrj.exe44⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vtxpp.exec:\vtxpp.exe45⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rvntdl.exec:\rvntdl.exe46⤵
- Executes dropped EXE
PID:3044 -
\??\c:\nbdvt.exec:\nbdvt.exe47⤵
- Executes dropped EXE
PID:2840 -
\??\c:\fvdvtl.exec:\fvdvtl.exe48⤵
- Executes dropped EXE
PID:836 -
\??\c:\rxtld.exec:\rxtld.exe49⤵
- Executes dropped EXE
PID:1216 -
\??\c:\ntbdfhh.exec:\ntbdfhh.exe50⤵
- Executes dropped EXE
PID:2440 -
\??\c:\lvlpv.exec:\lvlpv.exe51⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nltxfxj.exec:\nltxfxj.exe52⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vxpprf.exec:\vxpprf.exe53⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vnffl.exec:\vnffl.exe54⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jfxvvr.exec:\jfxvvr.exe55⤵
- Executes dropped EXE
PID:1048 -
\??\c:\bnthhr.exec:\bnthhr.exe56⤵
- Executes dropped EXE
PID:928 -
\??\c:\ppxnt.exec:\ppxnt.exe57⤵
- Executes dropped EXE
PID:2244 -
\??\c:\trbxlxb.exec:\trbxlxb.exe58⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jtrfv.exec:\jtrfv.exe59⤵
- Executes dropped EXE
PID:1968 -
\??\c:\dpbftnl.exec:\dpbftnl.exe60⤵
- Executes dropped EXE
PID:1756 -
\??\c:\jhpddf.exec:\jhpddf.exe61⤵
- Executes dropped EXE
PID:1780 -
\??\c:\pfnjfvt.exec:\pfnjfvt.exe62⤵
- Executes dropped EXE
PID:2240 -
\??\c:\dxnfp.exec:\dxnfp.exe63⤵
- Executes dropped EXE
PID:1080 -
\??\c:\bxnpjnh.exec:\bxnpjnh.exe64⤵
- Executes dropped EXE
PID:2948 -
\??\c:\fnlrb.exec:\fnlrb.exe65⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ndjrd.exec:\ndjrd.exe66⤵
- Executes dropped EXE
PID:1168 -
\??\c:\pbnxr.exec:\pbnxr.exe67⤵PID:968
-
\??\c:\rhlnbvd.exec:\rhlnbvd.exe68⤵PID:2872
-
\??\c:\jnxln.exec:\jnxln.exe69⤵PID:1452
-
\??\c:\nfxff.exec:\nfxff.exe70⤵PID:2800
-
\??\c:\hdtxb.exec:\hdtxb.exe71⤵PID:1312
-
\??\c:\ftvfv.exec:\ftvfv.exe72⤵PID:1632
-
\??\c:\hjnvr.exec:\hjnvr.exe73⤵PID:2888
-
\??\c:\ntrlj.exec:\ntrlj.exe74⤵PID:2812
-
\??\c:\rnhvlhb.exec:\rnhvlhb.exe75⤵PID:2784
-
\??\c:\vtfrfj.exec:\vtfrfj.exe76⤵PID:2172
-
\??\c:\ldtlv.exec:\ldtlv.exe77⤵PID:1588
-
\??\c:\fnjhtb.exec:\fnjhtb.exe78⤵PID:1708
-
\??\c:\dfvrv.exec:\dfvrv.exe79⤵PID:2012
-
\??\c:\vbfrh.exec:\vbfrh.exe80⤵PID:2524
-
\??\c:\frtbv.exec:\frtbv.exe81⤵PID:2676
-
\??\c:\jhhhd.exec:\jhhhd.exe82⤵PID:2624
-
\??\c:\tpfnp.exec:\tpfnp.exe83⤵PID:2500
-
\??\c:\xdfvhtl.exec:\xdfvhtl.exe84⤵PID:2484
-
\??\c:\prtnhx.exec:\prtnhx.exe85⤵PID:2696
-
\??\c:\ttbvp.exec:\ttbvp.exe86⤵PID:2400
-
\??\c:\hlvjjp.exec:\hlvjjp.exe87⤵PID:1948
-
\??\c:\vrrjd.exec:\vrrjd.exe88⤵PID:2988
-
\??\c:\tldhf.exec:\tldhf.exe89⤵PID:1596
-
\??\c:\bbhttft.exec:\bbhttft.exe90⤵PID:1440
-
\??\c:\vpjjpbr.exec:\vpjjpbr.exe91⤵PID:2280
-
\??\c:\rtbxvnh.exec:\rtbxvnh.exe92⤵PID:2656
-
\??\c:\xbrtxdn.exec:\xbrtxdn.exe93⤵PID:2720
-
\??\c:\ldpbdn.exec:\ldpbdn.exe94⤵PID:1408
-
\??\c:\rtlfxvp.exec:\rtlfxvp.exe95⤵PID:1300
-
\??\c:\njtjnjt.exec:\njtjnjt.exe96⤵PID:1120
-
\??\c:\hhbtvlh.exec:\hhbtvlh.exe97⤵PID:916
-
\??\c:\phbdvx.exec:\phbdvx.exe98⤵PID:1672
-
\??\c:\rltlvlh.exec:\rltlvlh.exe99⤵PID:928
-
\??\c:\lfhtjl.exec:\lfhtjl.exe100⤵PID:2096
-
\??\c:\rnpxd.exec:\rnpxd.exe101⤵PID:1740
-
\??\c:\nttxrp.exec:\nttxrp.exe102⤵PID:2260
-
\??\c:\pnbtpx.exec:\pnbtpx.exe103⤵PID:3064
-
\??\c:\vbhrn.exec:\vbhrn.exe104⤵PID:2928
-
\??\c:\tdlvb.exec:\tdlvb.exe105⤵PID:2240
-
\??\c:\rftflhl.exec:\rftflhl.exe106⤵PID:832
-
\??\c:\xbxndr.exec:\xbxndr.exe107⤵PID:2948
-
\??\c:\llldf.exec:\llldf.exe108⤵PID:1688
-
\??\c:\xpdbbfh.exec:\xpdbbfh.exe109⤵PID:924
-
\??\c:\vfbbfdj.exec:\vfbbfdj.exe110⤵PID:2232
-
\??\c:\dtjjv.exec:\dtjjv.exe111⤵PID:1832
-
\??\c:\ldjflvr.exec:\ldjflvr.exe112⤵PID:1056
-
\??\c:\jnjnd.exec:\jnjnd.exe113⤵PID:2876
-
\??\c:\lrltfrx.exec:\lrltfrx.exe114⤵PID:2788
-
\??\c:\dndxd.exec:\dndxd.exe115⤵PID:2100
-
\??\c:\tbpfxh.exec:\tbpfxh.exe116⤵PID:1676
-
\??\c:\fxhvhtv.exec:\fxhvhtv.exe117⤵PID:1684
-
\??\c:\xdhldj.exec:\xdhldj.exe118⤵PID:600
-
\??\c:\jltxrhj.exec:\jltxrhj.exe119⤵PID:2072
-
\??\c:\rtfjpvf.exec:\rtfjpvf.exe120⤵PID:2588
-
\??\c:\jhfxl.exec:\jhfxl.exe121⤵PID:1044
-
\??\c:\ljfpd.exec:\ljfpd.exe122⤵PID:2932
-
\??\c:\tnxhjf.exec:\tnxhjf.exe123⤵PID:2612
-
\??\c:\pvtlrdl.exec:\pvtlrdl.exe124⤵PID:2572
-
\??\c:\hljrx.exec:\hljrx.exe125⤵PID:1524
-
\??\c:\jpdrbh.exec:\jpdrbh.exe126⤵PID:2624
-
\??\c:\xdjlph.exec:\xdjlph.exe127⤵PID:2560
-
\??\c:\xfdrh.exec:\xfdrh.exe128⤵PID:2484
-
\??\c:\ttvhbl.exec:\ttvhbl.exe129⤵PID:2424
-
\??\c:\vtbbx.exec:\vtbbx.exe130⤵PID:2820
-
\??\c:\xnpnjl.exec:\xnpnjl.exe131⤵PID:1568
-
\??\c:\tfpdfv.exec:\tfpdfv.exe132⤵PID:1908
-
\??\c:\tvdvbht.exec:\tvdvbht.exe133⤵PID:1344
-
\??\c:\vxdnhd.exec:\vxdnhd.exe134⤵PID:1640
-
\??\c:\hltbxj.exec:\hltbxj.exe135⤵PID:2368
-
\??\c:\jbjhld.exec:\jbjhld.exe136⤵PID:2656
-
\??\c:\lhrxt.exec:\lhrxt.exe137⤵PID:2128
-
\??\c:\rvbvl.exec:\rvbvl.exe138⤵PID:1892
-
\??\c:\lvpjx.exec:\lvpjx.exe139⤵PID:1472
-
\??\c:\xdhjtrf.exec:\xdhjtrf.exe140⤵PID:1120
-
\??\c:\ldfbt.exec:\ldfbt.exe141⤵PID:1680
-
\??\c:\nrnjlr.exec:\nrnjlr.exe142⤵PID:1736
-
\??\c:\hndfl.exec:\hndfl.exe143⤵PID:2228
-
\??\c:\phrxrl.exec:\phrxrl.exe144⤵PID:2060
-
\??\c:\ffhtrhf.exec:\ffhtrhf.exe145⤵PID:1972
-
\??\c:\lxjbf.exec:\lxjbf.exe146⤵PID:2856
-
\??\c:\rdftdh.exec:\rdftdh.exe147⤵PID:1952
-
\??\c:\drrpvp.exec:\drrpvp.exe148⤵PID:2928
-
\??\c:\nddlxll.exec:\nddlxll.exe149⤵PID:940
-
\??\c:\nrbhfhj.exec:\nrbhfhj.exe150⤵PID:832
-
\??\c:\drfjl.exec:\drfjl.exe151⤵PID:1600
-
\??\c:\fxlftd.exec:\fxlftd.exe152⤵PID:3016
-
\??\c:\bntntf.exec:\bntntf.exe153⤵PID:2348
-
\??\c:\jdxtv.exec:\jdxtv.exe154⤵PID:332
-
\??\c:\nntjrr.exec:\nntjrr.exe155⤵PID:888
-
\??\c:\llbtjpp.exec:\llbtjpp.exe156⤵PID:2976
-
\??\c:\fxdvbjt.exec:\fxdvbjt.exe157⤵PID:2188
-
\??\c:\nntdpr.exec:\nntdpr.exe158⤵PID:1652
-
\??\c:\vhvdp.exec:\vhvdp.exe159⤵PID:2888
-
\??\c:\jtvdxb.exec:\jtvdxb.exe160⤵PID:2968
-
\??\c:\ddjxdl.exec:\ddjxdl.exe161⤵PID:2056
-
\??\c:\dnvtfxx.exec:\dnvtfxx.exe162⤵PID:2264
-
\??\c:\rtndlx.exec:\rtndlx.exe163⤵PID:2732
-
\??\c:\tjlnj.exec:\tjlnj.exe164⤵PID:1940
-
\??\c:\hdhff.exec:\hdhff.exe165⤵PID:2052
-
\??\c:\blnjpx.exec:\blnjpx.exe166⤵PID:2528
-
\??\c:\ftjbv.exec:\ftjbv.exe167⤵PID:2536
-
\??\c:\xhhvhf.exec:\xhhvhf.exe168⤵PID:2616
-
\??\c:\hdbnd.exec:\hdbnd.exe169⤵PID:2408
-
\??\c:\dhfvpt.exec:\dhfvpt.exe170⤵PID:2624
-
\??\c:\vtbdrd.exec:\vtbdrd.exe171⤵PID:2592
-
\??\c:\tljnlh.exec:\tljnlh.exe172⤵PID:2632
-
\??\c:\bdfdf.exec:\bdfdf.exe173⤵PID:2384
-
\??\c:\dxtlj.exec:\dxtlj.exe174⤵PID:1812
-
\??\c:\xntrn.exec:\xntrn.exe175⤵PID:2840
-
\??\c:\hrfnl.exec:\hrfnl.exe176⤵PID:836
-
\??\c:\ltntnd.exec:\ltntnd.exe177⤵PID:2664
-
\??\c:\jrpxt.exec:\jrpxt.exe178⤵PID:2804
-
\??\c:\dtltdnr.exec:\dtltdnr.exe179⤵PID:2704
-
\??\c:\pjvbhr.exec:\pjvbhr.exe180⤵PID:2716
-
\??\c:\bbrljhx.exec:\bbrljhx.exe181⤵PID:1412
-
\??\c:\lbjrd.exec:\lbjrd.exe182⤵PID:1912
-
\??\c:\xlrrpxv.exec:\xlrrpxv.exe183⤵PID:2212
-
\??\c:\vhbdt.exec:\vhbdt.exe184⤵PID:760
-
\??\c:\hdbhdvj.exec:\hdbhdvj.exe185⤵PID:928
-
\??\c:\bhvfhx.exec:\bhvfhx.exe186⤵PID:1268
-
\??\c:\nbnnrtn.exec:\nbnnrtn.exe187⤵PID:2068
-
\??\c:\ftxxrf.exec:\ftxxrf.exe188⤵PID:2980
-
\??\c:\rjdtnb.exec:\rjdtnb.exe189⤵PID:2880
-
\??\c:\fxhxh.exec:\fxhxh.exe190⤵PID:1960
-
\??\c:\njrdvl.exec:\njrdvl.exe191⤵PID:1952
-
\??\c:\rjpddbr.exec:\rjpddbr.exe192⤵PID:1068
-
\??\c:\vhnlfp.exec:\vhnlfp.exe193⤵PID:2180
-
\??\c:\tbfrp.exec:\tbfrp.exe194⤵PID:1604
-
\??\c:\bpdth.exec:\bpdth.exe195⤵PID:1600
-
\??\c:\rdrdxd.exec:\rdrdxd.exe196⤵PID:1096
-
\??\c:\xdfdh.exec:\xdfdh.exe197⤵PID:1480
-
\??\c:\hlbxnbn.exec:\hlbxnbn.exe198⤵PID:1452
-
\??\c:\tvptbf.exec:\tvptbf.exe199⤵PID:3068
-
\??\c:\jtvld.exec:\jtvld.exe200⤵PID:988
-
\??\c:\dxhdlvv.exec:\dxhdlvv.exe201⤵PID:1828
-
\??\c:\ppjtv.exec:\ppjtv.exe202⤵PID:2864
-
\??\c:\lfblr.exec:\lfblr.exe203⤵PID:2044
-
\??\c:\hjpdhhh.exec:\hjpdhhh.exe204⤵PID:1684
-
\??\c:\hntvb.exec:\hntvb.exe205⤵PID:600
-
\??\c:\txrvx.exec:\txrvx.exe206⤵PID:2900
-
\??\c:\dnrlj.exec:\dnrlj.exe207⤵PID:2684
-
\??\c:\lnllxr.exec:\lnllxr.exe208⤵PID:2488
-
\??\c:\rhldhhb.exec:\rhldhhb.exe209⤵PID:2564
-
\??\c:\dhxfp.exec:\dhxfp.exe210⤵PID:2676
-
\??\c:\jbbtfpp.exec:\jbbtfpp.exe211⤵PID:2936
-
\??\c:\hxbdjnn.exec:\hxbdjnn.exe212⤵PID:2816
-
\??\c:\fphxhth.exec:\fphxhth.exe213⤵PID:2552
-
\??\c:\hflvxr.exec:\hflvxr.exe214⤵PID:1724
-
\??\c:\nbhfrd.exec:\nbhfrd.exe215⤵PID:2396
-
\??\c:\xtfxnh.exec:\xtfxnh.exe216⤵PID:2824
-
\??\c:\xprbvdt.exec:\xprbvdt.exe217⤵PID:2504
-
\??\c:\fnjnxh.exec:\fnjnxh.exe218⤵PID:1596
-
\??\c:\bhdvp.exec:\bhdvp.exe219⤵PID:556
-
\??\c:\tlvtn.exec:\tlvtn.exe220⤵PID:1216
-
\??\c:\rpxlrh.exec:\rpxlrh.exe221⤵PID:564
-
\??\c:\hjxrb.exec:\hjxrb.exe222⤵PID:2708
-
\??\c:\jldff.exec:\jldff.exe223⤵PID:2720
-
\??\c:\pjjdjxn.exec:\pjjdjxn.exe224⤵PID:1920
-
\??\c:\jjhjtfx.exec:\jjhjtfx.exe225⤵PID:1892
-
\??\c:\dpxlxfd.exec:\dpxlxfd.exe226⤵PID:1916
-
\??\c:\ttttfd.exec:\ttttfd.exe227⤵PID:2356
-
\??\c:\rbdtlt.exec:\rbdtlt.exe228⤵PID:852
-
\??\c:\dnlddbb.exec:\dnlddbb.exe229⤵PID:824
-
\??\c:\djxdj.exec:\djxdj.exe230⤵PID:2756
-
\??\c:\htbfxv.exec:\htbfxv.exe231⤵PID:524
-
\??\c:\tdfhfh.exec:\tdfhfh.exe232⤵PID:544
-
\??\c:\tdrdtl.exec:\tdrdtl.exe233⤵PID:432
-
\??\c:\nftpf.exec:\nftpf.exe234⤵PID:1080
-
\??\c:\vvjhl.exec:\vvjhl.exe235⤵PID:3032
-
\??\c:\bdjnrxb.exec:\bdjnrxb.exe236⤵PID:1396
-
\??\c:\dhprfr.exec:\dhprfr.exe237⤵PID:2176
-
\??\c:\lvhth.exec:\lvhth.exe238⤵PID:1152
-
\??\c:\bljxd.exec:\bljxd.exe239⤵PID:792
-
\??\c:\bdxjrj.exec:\bdxjrj.exe240⤵PID:3016
-
\??\c:\prllrph.exec:\prllrph.exe241⤵PID:1480
-
\??\c:\nbxtnnd.exec:\nbxtnnd.exe242⤵PID:2796