Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 04:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aa0c454113290f64a7faab811d8e27f98fd7d58b08d22e208c984aa1d6ce7ebb.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
aa0c454113290f64a7faab811d8e27f98fd7d58b08d22e208c984aa1d6ce7ebb.exe
-
Size
483KB
-
MD5
29ab3c436993c7f0c3a55f9c4c729850
-
SHA1
77cbaeea5edab68d8dfba5a463df648a8c588181
-
SHA256
aa0c454113290f64a7faab811d8e27f98fd7d58b08d22e208c984aa1d6ce7ebb
-
SHA512
da80a146f729c9274b0186491f1b558518f75ab3d7912237b71c4b8708a45072ccaee46ee6099bdb2cce80401f4a6419ca9f08c930d9ca9266016d36a9e29df0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwu1b26X1wjhtSizjZ:q7Tc2NYHUrAwqzcX
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/3000-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-45-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2756-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1144-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1360-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1144-243-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1296-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-923-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-1003-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-1028-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2220-1068-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1908-1186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tnhhtb.exettnbtb.exetnbttt.exejddjp.exebbttnt.exevddvp.exe1lllrrl.exevvpvj.exenbttbh.exevjvvd.exenhbnbh.exedddjp.exe3rllxlr.exenbtbnn.exexlxxffr.exehhhnbh.exexlxxxfl.exerlxflrx.exerfllxxf.exepjvjp.exenbnthb.exe1nhbnn.exehtnnhh.exepvpvj.exehhtbhn.exejdpjv.exennhhtn.exe5dvvv.exebbnntt.exe5vjdj.exethbhnn.exe5pjdj.exebtntbb.exehbttnt.exe3dpvd.exefflfllx.exennhntt.exenhhhtn.exe3vpjp.exe5lrrlrr.exelrlrffr.exetnbtbt.exejjddp.exepjvdj.exefxllrlx.exetnhbnn.exe5vvdd.exeddpjv.exe1lfrxfr.exetnhnbh.exejdjpd.exefxfllxf.exehbnhhh.exepdvdp.exepdvvd.exefrrrfxr.exe3ntnbb.exevjvpv.exepdppp.exerrlrxff.exenhttbh.exe1pjpp.exejdpvv.exerfxxffl.exepid process 2100 tnhhtb.exe 2556 ttnbtb.exe 2620 tnbttt.exe 2660 jddjp.exe 2756 bbttnt.exe 2500 vddvp.exe 2752 1lllrrl.exe 2540 vvpvj.exe 2636 nbttbh.exe 316 vjvvd.exe 1628 nhbnbh.exe 2692 dddjp.exe 756 3rllxlr.exe 2384 nbtbnn.exe 544 xlxxffr.exe 1872 hhhnbh.exe 2104 xlxxxfl.exe 1144 rlxflrx.exe 1360 rfllxxf.exe 2552 pjvjp.exe 2212 nbnthb.exe 2560 1nhbnn.exe 776 htnnhh.exe 608 pvpvj.exe 1644 hhtbhn.exe 2084 jdpjv.exe 1296 nnhhtn.exe 1292 5dvvv.exe 2848 bbnntt.exe 636 5vjdj.exe 2936 thbhnn.exe 2304 5pjdj.exe 1700 btntbb.exe 1400 hbttnt.exe 2892 3dpvd.exe 3000 fflfllx.exe 3024 nnhntt.exe 2780 nhhhtn.exe 2100 3vpjp.exe 2672 5lrrlrr.exe 2656 lrlrffr.exe 2748 tnbtbt.exe 2772 jjddp.exe 2792 pjvdj.exe 2804 fxllrlx.exe 2492 tnhbnn.exe 2904 5vvdd.exe 2908 ddpjv.exe 2636 1lfrxfr.exe 2112 tnhnbh.exe 2436 jdjpd.exe 2716 fxfllxf.exe 2364 hbnhhh.exe 1868 pdvdp.exe 1196 pdvvd.exe 1544 frrrfxr.exe 2272 3ntnbb.exe 1888 vjvpv.exe 1460 pdppp.exe 1416 rrlrxff.exe 1520 nhttbh.exe 2896 1pjpp.exe 1200 jdpvv.exe 1204 rfxxffl.exe -
Processes:
resource yara_rule behavioral1/memory/3000-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-592-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2584-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-770-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-880-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-923-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-942-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-955-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-1003-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-1129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-1148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-1173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-1186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-1217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-1249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-1281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-1288-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
aa0c454113290f64a7faab811d8e27f98fd7d58b08d22e208c984aa1d6ce7ebb.exetnhhtb.exettnbtb.exetnbttt.exejddjp.exebbttnt.exevddvp.exe1lllrrl.exevvpvj.exenbttbh.exevjvvd.exenhbnbh.exedddjp.exe3rllxlr.exenbtbnn.exexlxxffr.exedescription pid process target process PID 3000 wrote to memory of 2100 3000 aa0c454113290f64a7faab811d8e27f98fd7d58b08d22e208c984aa1d6ce7ebb.exe tnhhtb.exe PID 3000 wrote to memory of 2100 3000 aa0c454113290f64a7faab811d8e27f98fd7d58b08d22e208c984aa1d6ce7ebb.exe tnhhtb.exe PID 3000 wrote to memory of 2100 3000 aa0c454113290f64a7faab811d8e27f98fd7d58b08d22e208c984aa1d6ce7ebb.exe tnhhtb.exe PID 3000 wrote to memory of 2100 3000 aa0c454113290f64a7faab811d8e27f98fd7d58b08d22e208c984aa1d6ce7ebb.exe tnhhtb.exe PID 2100 wrote to memory of 2556 2100 tnhhtb.exe ttnbtb.exe PID 2100 wrote to memory of 2556 2100 tnhhtb.exe ttnbtb.exe PID 2100 wrote to memory of 2556 2100 tnhhtb.exe ttnbtb.exe PID 2100 wrote to memory of 2556 2100 tnhhtb.exe ttnbtb.exe PID 2556 wrote to memory of 2620 2556 ttnbtb.exe tnbttt.exe PID 2556 wrote to memory of 2620 2556 ttnbtb.exe tnbttt.exe PID 2556 wrote to memory of 2620 2556 ttnbtb.exe tnbttt.exe PID 2556 wrote to memory of 2620 2556 ttnbtb.exe tnbttt.exe PID 2620 wrote to memory of 2660 2620 tnbttt.exe jddjp.exe PID 2620 wrote to memory of 2660 2620 tnbttt.exe jddjp.exe PID 2620 wrote to memory of 2660 2620 tnbttt.exe jddjp.exe PID 2620 wrote to memory of 2660 2620 tnbttt.exe jddjp.exe PID 2660 wrote to memory of 2756 2660 jddjp.exe bbttnt.exe PID 2660 wrote to memory of 2756 2660 jddjp.exe bbttnt.exe PID 2660 wrote to memory of 2756 2660 jddjp.exe bbttnt.exe PID 2660 wrote to memory of 2756 2660 jddjp.exe bbttnt.exe PID 2756 wrote to memory of 2500 2756 bbttnt.exe vddvp.exe PID 2756 wrote to memory of 2500 2756 bbttnt.exe vddvp.exe PID 2756 wrote to memory of 2500 2756 bbttnt.exe vddvp.exe PID 2756 wrote to memory of 2500 2756 bbttnt.exe vddvp.exe PID 2500 wrote to memory of 2752 2500 vddvp.exe 1lllrrl.exe PID 2500 wrote to memory of 2752 2500 vddvp.exe 1lllrrl.exe PID 2500 wrote to memory of 2752 2500 vddvp.exe 1lllrrl.exe PID 2500 wrote to memory of 2752 2500 vddvp.exe 1lllrrl.exe PID 2752 wrote to memory of 2540 2752 1lllrrl.exe vvpvj.exe PID 2752 wrote to memory of 2540 2752 1lllrrl.exe vvpvj.exe PID 2752 wrote to memory of 2540 2752 1lllrrl.exe vvpvj.exe PID 2752 wrote to memory of 2540 2752 1lllrrl.exe vvpvj.exe PID 2540 wrote to memory of 2636 2540 vvpvj.exe nbttbh.exe PID 2540 wrote to memory of 2636 2540 vvpvj.exe nbttbh.exe PID 2540 wrote to memory of 2636 2540 vvpvj.exe nbttbh.exe PID 2540 wrote to memory of 2636 2540 vvpvj.exe nbttbh.exe PID 2636 wrote to memory of 316 2636 nbttbh.exe vjvvd.exe PID 2636 wrote to memory of 316 2636 nbttbh.exe vjvvd.exe PID 2636 wrote to memory of 316 2636 nbttbh.exe vjvvd.exe PID 2636 wrote to memory of 316 2636 nbttbh.exe vjvvd.exe PID 316 wrote to memory of 1628 316 vjvvd.exe nhbnbh.exe PID 316 wrote to memory of 1628 316 vjvvd.exe nhbnbh.exe PID 316 wrote to memory of 1628 316 vjvvd.exe nhbnbh.exe PID 316 wrote to memory of 1628 316 vjvvd.exe nhbnbh.exe PID 1628 wrote to memory of 2692 1628 nhbnbh.exe dddjp.exe PID 1628 wrote to memory of 2692 1628 nhbnbh.exe dddjp.exe PID 1628 wrote to memory of 2692 1628 nhbnbh.exe dddjp.exe PID 1628 wrote to memory of 2692 1628 nhbnbh.exe dddjp.exe PID 2692 wrote to memory of 756 2692 dddjp.exe 3rllxlr.exe PID 2692 wrote to memory of 756 2692 dddjp.exe 3rllxlr.exe PID 2692 wrote to memory of 756 2692 dddjp.exe 3rllxlr.exe PID 2692 wrote to memory of 756 2692 dddjp.exe 3rllxlr.exe PID 756 wrote to memory of 2384 756 3rllxlr.exe nbtbnn.exe PID 756 wrote to memory of 2384 756 3rllxlr.exe nbtbnn.exe PID 756 wrote to memory of 2384 756 3rllxlr.exe nbtbnn.exe PID 756 wrote to memory of 2384 756 3rllxlr.exe nbtbnn.exe PID 2384 wrote to memory of 544 2384 nbtbnn.exe xlxxffr.exe PID 2384 wrote to memory of 544 2384 nbtbnn.exe xlxxffr.exe PID 2384 wrote to memory of 544 2384 nbtbnn.exe xlxxffr.exe PID 2384 wrote to memory of 544 2384 nbtbnn.exe xlxxffr.exe PID 544 wrote to memory of 1872 544 xlxxffr.exe hhhnbh.exe PID 544 wrote to memory of 1872 544 xlxxffr.exe hhhnbh.exe PID 544 wrote to memory of 1872 544 xlxxffr.exe hhhnbh.exe PID 544 wrote to memory of 1872 544 xlxxffr.exe hhhnbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa0c454113290f64a7faab811d8e27f98fd7d58b08d22e208c984aa1d6ce7ebb.exe"C:\Users\Admin\AppData\Local\Temp\aa0c454113290f64a7faab811d8e27f98fd7d58b08d22e208c984aa1d6ce7ebb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\tnhhtb.exec:\tnhhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\ttnbtb.exec:\ttnbtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\tnbttt.exec:\tnbttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\jddjp.exec:\jddjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\bbttnt.exec:\bbttnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\vddvp.exec:\vddvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\1lllrrl.exec:\1lllrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\vvpvj.exec:\vvpvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\nbttbh.exec:\nbttbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\vjvvd.exec:\vjvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\nhbnbh.exec:\nhbnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\dddjp.exec:\dddjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\3rllxlr.exec:\3rllxlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\nbtbnn.exec:\nbtbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\xlxxffr.exec:\xlxxffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\hhhnbh.exec:\hhhnbh.exe17⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xlxxxfl.exec:\xlxxxfl.exe18⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rlxflrx.exec:\rlxflrx.exe19⤵
- Executes dropped EXE
PID:1144 -
\??\c:\rfllxxf.exec:\rfllxxf.exe20⤵
- Executes dropped EXE
PID:1360 -
\??\c:\pjvjp.exec:\pjvjp.exe21⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nbnthb.exec:\nbnthb.exe22⤵
- Executes dropped EXE
PID:2212 -
\??\c:\1nhbnn.exec:\1nhbnn.exe23⤵
- Executes dropped EXE
PID:2560 -
\??\c:\htnnhh.exec:\htnnhh.exe24⤵
- Executes dropped EXE
PID:776 -
\??\c:\pvpvj.exec:\pvpvj.exe25⤵
- Executes dropped EXE
PID:608 -
\??\c:\hhtbhn.exec:\hhtbhn.exe26⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jdpjv.exec:\jdpjv.exe27⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nnhhtn.exec:\nnhhtn.exe28⤵
- Executes dropped EXE
PID:1296 -
\??\c:\5dvvv.exec:\5dvvv.exe29⤵
- Executes dropped EXE
PID:1292 -
\??\c:\bbnntt.exec:\bbnntt.exe30⤵
- Executes dropped EXE
PID:2848 -
\??\c:\5vjdj.exec:\5vjdj.exe31⤵
- Executes dropped EXE
PID:636 -
\??\c:\thbhnn.exec:\thbhnn.exe32⤵
- Executes dropped EXE
PID:2936 -
\??\c:\5pjdj.exec:\5pjdj.exe33⤵
- Executes dropped EXE
PID:2304 -
\??\c:\btntbb.exec:\btntbb.exe34⤵
- Executes dropped EXE
PID:1700 -
\??\c:\hbttnt.exec:\hbttnt.exe35⤵
- Executes dropped EXE
PID:1400 -
\??\c:\3dpvd.exec:\3dpvd.exe36⤵
- Executes dropped EXE
PID:2892 -
\??\c:\fflfllx.exec:\fflfllx.exe37⤵
- Executes dropped EXE
PID:3000 -
\??\c:\nnhntt.exec:\nnhntt.exe38⤵
- Executes dropped EXE
PID:3024 -
\??\c:\nhhhtn.exec:\nhhhtn.exe39⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3vpjp.exec:\3vpjp.exe40⤵
- Executes dropped EXE
PID:2100 -
\??\c:\5lrrlrr.exec:\5lrrlrr.exe41⤵
- Executes dropped EXE
PID:2672 -
\??\c:\lrlrffr.exec:\lrlrffr.exe42⤵
- Executes dropped EXE
PID:2656 -
\??\c:\tnbtbt.exec:\tnbtbt.exe43⤵
- Executes dropped EXE
PID:2748 -
\??\c:\jjddp.exec:\jjddp.exe44⤵
- Executes dropped EXE
PID:2772 -
\??\c:\pjvdj.exec:\pjvdj.exe45⤵
- Executes dropped EXE
PID:2792 -
\??\c:\fxllrlx.exec:\fxllrlx.exe46⤵
- Executes dropped EXE
PID:2804 -
\??\c:\tnhbnn.exec:\tnhbnn.exe47⤵
- Executes dropped EXE
PID:2492 -
\??\c:\5vvdd.exec:\5vvdd.exe48⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ddpjv.exec:\ddpjv.exe49⤵
- Executes dropped EXE
PID:2908 -
\??\c:\1lfrxfr.exec:\1lfrxfr.exe50⤵
- Executes dropped EXE
PID:2636 -
\??\c:\tnhnbh.exec:\tnhnbh.exe51⤵
- Executes dropped EXE
PID:2112 -
\??\c:\jdjpd.exec:\jdjpd.exe52⤵
- Executes dropped EXE
PID:2436 -
\??\c:\fxfllxf.exec:\fxfllxf.exe53⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hbnhhh.exec:\hbnhhh.exe54⤵
- Executes dropped EXE
PID:2364 -
\??\c:\pdvdp.exec:\pdvdp.exe55⤵
- Executes dropped EXE
PID:1868 -
\??\c:\pdvvd.exec:\pdvvd.exe56⤵
- Executes dropped EXE
PID:1196 -
\??\c:\frrrfxr.exec:\frrrfxr.exe57⤵
- Executes dropped EXE
PID:1544 -
\??\c:\3ntnbb.exec:\3ntnbb.exe58⤵
- Executes dropped EXE
PID:2272 -
\??\c:\vjvpv.exec:\vjvpv.exe59⤵
- Executes dropped EXE
PID:1888 -
\??\c:\pdppp.exec:\pdppp.exe60⤵
- Executes dropped EXE
PID:1460 -
\??\c:\rrlrxff.exec:\rrlrxff.exe61⤵
- Executes dropped EXE
PID:1416 -
\??\c:\nhttbh.exec:\nhttbh.exe62⤵
- Executes dropped EXE
PID:1520 -
\??\c:\1pjpp.exec:\1pjpp.exe63⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jdpvv.exec:\jdpvv.exe64⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rfxxffl.exec:\rfxxffl.exe65⤵
- Executes dropped EXE
PID:1204 -
\??\c:\tnhthn.exec:\tnhthn.exe66⤵PID:320
-
\??\c:\3hnttt.exec:\3hnttt.exe67⤵PID:540
-
\??\c:\vpdpd.exec:\vpdpd.exe68⤵PID:1392
-
\??\c:\xlrrxxl.exec:\xlrrxxl.exe69⤵PID:776
-
\??\c:\htbbnn.exec:\htbbnn.exe70⤵PID:444
-
\??\c:\bnbtbb.exec:\bnbtbb.exe71⤵PID:1604
-
\??\c:\ppjpv.exec:\ppjpv.exe72⤵PID:872
-
\??\c:\xrflxxf.exec:\xrflxxf.exe73⤵PID:1456
-
\??\c:\ttnthh.exec:\ttnthh.exe74⤵PID:768
-
\??\c:\pjvdj.exec:\pjvdj.exe75⤵PID:1516
-
\??\c:\vpdjv.exec:\vpdjv.exe76⤵PID:2848
-
\??\c:\xlxxffl.exec:\xlxxffl.exe77⤵PID:1708
-
\??\c:\hhnbth.exec:\hhnbth.exe78⤵PID:2064
-
\??\c:\dvddj.exec:\dvddj.exe79⤵PID:2864
-
\??\c:\7pjdj.exec:\7pjdj.exe80⤵PID:2932
-
\??\c:\rrllrlr.exec:\rrllrlr.exe81⤵PID:2140
-
\??\c:\tnhhbb.exec:\tnhhbb.exe82⤵PID:2888
-
\??\c:\ppdjv.exec:\ppdjv.exe83⤵PID:1912
-
\??\c:\7vjjj.exec:\7vjjj.exe84⤵PID:2968
-
\??\c:\xxrrxxx.exec:\xxrrxxx.exe85⤵PID:2812
-
\??\c:\tnttbh.exec:\tnttbh.exe86⤵PID:2572
-
\??\c:\tththh.exec:\tththh.exe87⤵PID:2676
-
\??\c:\pdpvd.exec:\pdpvd.exe88⤵PID:2588
-
\??\c:\rlfffxf.exec:\rlfffxf.exe89⤵PID:2824
-
\??\c:\rlrxflr.exec:\rlrxflr.exe90⤵PID:2976
-
\??\c:\3nbbbh.exec:\3nbbbh.exe91⤵PID:2600
-
\??\c:\7vjpp.exec:\7vjpp.exe92⤵PID:2792
-
\??\c:\1vdvv.exec:\1vdvv.exe93⤵PID:2804
-
\??\c:\9xlffff.exec:\9xlffff.exe94⤵PID:2740
-
\??\c:\tntttn.exec:\tntttn.exe95⤵PID:2584
-
\??\c:\bnbbhn.exec:\bnbbhn.exe96⤵PID:2508
-
\??\c:\dpdpv.exec:\dpdpv.exe97⤵PID:1732
-
\??\c:\xrllrlr.exec:\xrllrlr.exe98⤵PID:1348
-
\??\c:\xrflrrf.exec:\xrflrrf.exe99⤵PID:2448
-
\??\c:\nhtbnn.exec:\nhtbnn.exe100⤵PID:1884
-
\??\c:\vvdjp.exec:\vvdjp.exe101⤵PID:2688
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe102⤵PID:236
-
\??\c:\xrlfllr.exec:\xrlfllr.exe103⤵PID:2372
-
\??\c:\bnhthn.exec:\bnhthn.exe104⤵PID:352
-
\??\c:\pjvdd.exec:\pjvdd.exe105⤵PID:1924
-
\??\c:\5rlrrlx.exec:\5rlrrlx.exe106⤵PID:1600
-
\??\c:\xfrrfxr.exec:\xfrrfxr.exe107⤵PID:1432
-
\??\c:\1bnnnn.exec:\1bnnnn.exe108⤵PID:1144
-
\??\c:\jdvdj.exec:\jdvdj.exe109⤵PID:2916
-
\??\c:\jvjdj.exec:\jvjdj.exe110⤵PID:2204
-
\??\c:\xrfxfxf.exec:\xrfxfxf.exe111⤵PID:2196
-
\??\c:\7htttt.exec:\7htttt.exe112⤵PID:2280
-
\??\c:\bthntn.exec:\bthntn.exe113⤵PID:332
-
\??\c:\jdppd.exec:\jdppd.exe114⤵PID:912
-
\??\c:\1rfxffl.exec:\1rfxffl.exe115⤵PID:868
-
\??\c:\btnbhh.exec:\btnbhh.exe116⤵PID:2972
-
\??\c:\vpdjv.exec:\vpdjv.exe117⤵PID:1640
-
\??\c:\xlflrxl.exec:\xlflrxl.exe118⤵PID:2648
-
\??\c:\bntthh.exec:\bntthh.exe119⤵PID:1680
-
\??\c:\hthhnn.exec:\hthhnn.exe120⤵PID:1452
-
\??\c:\dvjjv.exec:\dvjjv.exe121⤵PID:3060
-
\??\c:\xrflrxf.exec:\xrflrxf.exe122⤵PID:748
-
\??\c:\hbnthh.exec:\hbnthh.exe123⤵PID:1516
-
\??\c:\5bnttt.exec:\5bnttt.exe124⤵PID:2836
-
\??\c:\dpjjj.exec:\dpjjj.exe125⤵PID:2860
-
\??\c:\5pppv.exec:\5pppv.exe126⤵PID:2064
-
\??\c:\rlxlllx.exec:\rlxlllx.exe127⤵PID:892
-
\??\c:\nnbbhn.exec:\nnbbhn.exe128⤵PID:2932
-
\??\c:\3pdvv.exec:\3pdvv.exe129⤵PID:3028
-
\??\c:\3dvvd.exec:\3dvvd.exe130⤵PID:1508
-
\??\c:\frffrrx.exec:\frffrrx.exe131⤵PID:2992
-
\??\c:\hthhnh.exec:\hthhnh.exe132⤵PID:2984
-
\??\c:\nbtbnn.exec:\nbtbnn.exe133⤵PID:2780
-
\??\c:\vjddp.exec:\vjddp.exe134⤵PID:2556
-
\??\c:\3lrxxfl.exec:\3lrxxfl.exe135⤵PID:2732
-
\??\c:\hbntbb.exec:\hbntbb.exe136⤵PID:2596
-
\??\c:\nbnhtt.exec:\nbnhtt.exe137⤵PID:2284
-
\??\c:\pdppv.exec:\pdppv.exe138⤵PID:2976
-
\??\c:\ppjpv.exec:\ppjpv.exe139⤵PID:2628
-
\??\c:\xxrrffr.exec:\xxrrffr.exe140⤵PID:2524
-
\??\c:\9tbbhh.exec:\9tbbhh.exe141⤵PID:2940
-
\??\c:\jdjdj.exec:\jdjdj.exe142⤵PID:2924
-
\??\c:\vvpvp.exec:\vvpvp.exe143⤵PID:108
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe144⤵PID:2352
-
\??\c:\nnhnbb.exec:\nnhnbb.exe145⤵PID:2532
-
\??\c:\1pppv.exec:\1pppv.exe146⤵PID:2724
-
\??\c:\pdvvj.exec:\pdvvj.exe147⤵PID:756
-
\??\c:\rlxfflx.exec:\rlxfflx.exe148⤵PID:2364
-
\??\c:\nnnbhh.exec:\nnnbhh.exe149⤵PID:1868
-
\??\c:\bnhhhh.exec:\bnhhhh.exe150⤵PID:752
-
\??\c:\pjdjv.exec:\pjdjv.exe151⤵PID:2728
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe152⤵PID:2156
-
\??\c:\rlrrffl.exec:\rlrrffl.exe153⤵PID:2788
-
\??\c:\3ntthh.exec:\3ntthh.exe154⤵PID:1428
-
\??\c:\vpddp.exec:\vpddp.exe155⤵PID:2900
-
\??\c:\jjddp.exec:\jjddp.exe156⤵PID:2220
-
\??\c:\9xlrrxx.exec:\9xlrrxx.exe157⤵PID:2800
-
\??\c:\1htbnn.exec:\1htbnn.exe158⤵PID:2240
-
\??\c:\nhttbb.exec:\nhttbb.exe159⤵PID:2056
-
\??\c:\vvpdv.exec:\vvpdv.exe160⤵PID:1660
-
\??\c:\frffllr.exec:\frffllr.exe161⤵PID:1560
-
\??\c:\1nttnn.exec:\1nttnn.exe162⤵PID:2988
-
\??\c:\9hhhtb.exec:\9hhhtb.exe163⤵PID:3052
-
\??\c:\1dpvj.exec:\1dpvj.exe164⤵PID:1688
-
\??\c:\rrrrxfl.exec:\rrrrxfl.exe165⤵PID:860
-
\??\c:\frffrxf.exec:\frffrxf.exe166⤵PID:2084
-
\??\c:\hbnbhn.exec:\hbnbhn.exe167⤵PID:812
-
\??\c:\jjdjp.exec:\jjdjp.exe168⤵PID:1004
-
\??\c:\ppdjv.exec:\ppdjv.exe169⤵PID:928
-
\??\c:\lxlrxff.exec:\lxlrxff.exe170⤵PID:748
-
\??\c:\1bhhnn.exec:\1bhhnn.exe171⤵PID:1032
-
\??\c:\thtntt.exec:\thtntt.exe172⤵PID:2836
-
\??\c:\1vvvd.exec:\1vvvd.exe173⤵PID:1708
-
\??\c:\5rrrrrx.exec:\5rrrrrx.exe174⤵PID:2864
-
\??\c:\xlrlrrx.exec:\xlrlrrx.exe175⤵PID:1908
-
\??\c:\nhttbh.exec:\nhttbh.exe176⤵PID:2932
-
\??\c:\tnbhtb.exec:\tnbhtb.exe177⤵PID:3028
-
\??\c:\dvpdj.exec:\dvpdj.exe178⤵PID:1500
-
\??\c:\1xllfll.exec:\1xllfll.exe179⤵PID:2992
-
\??\c:\5nbbbb.exec:\5nbbbb.exe180⤵PID:2980
-
\??\c:\7nhhbb.exec:\7nhhbb.exe181⤵PID:2736
-
\??\c:\ddvdp.exec:\ddvdp.exe182⤵PID:2620
-
\??\c:\5dpvd.exec:\5dpvd.exe183⤵PID:2496
-
\??\c:\xlffllx.exec:\xlffllx.exe184⤵PID:2756
-
\??\c:\tnhhnh.exec:\tnhhnh.exe185⤵PID:2284
-
\??\c:\vvjpd.exec:\vvjpd.exe186⤵PID:2480
-
\??\c:\jdvdv.exec:\jdvdv.exe187⤵PID:2536
-
\??\c:\1rlfxxr.exec:\1rlfxxr.exe188⤵PID:2524
-
\??\c:\nnhthh.exec:\nnhthh.exe189⤵PID:2512
-
\??\c:\5bthhh.exec:\5bthhh.exe190⤵PID:2508
-
\??\c:\pvddj.exec:\pvddj.exe191⤵PID:112
-
\??\c:\rlflxxr.exec:\rlflxxr.exe192⤵PID:2520
-
\??\c:\htnttt.exec:\htnttt.exe193⤵PID:2708
-
\??\c:\djdjd.exec:\djdjd.exe194⤵PID:1780
-
\??\c:\pjdjj.exec:\pjdjj.exe195⤵PID:1668
-
\??\c:\frffllr.exec:\frffllr.exe196⤵PID:2376
-
\??\c:\nnbbnt.exec:\nnbbnt.exe197⤵PID:1900
-
\??\c:\thtbhn.exec:\thtbhn.exe198⤵PID:1544
-
\??\c:\dppdv.exec:\dppdv.exe199⤵PID:2272
-
\??\c:\rfrlrrx.exec:\rfrlrrx.exe200⤵PID:1424
-
\??\c:\7rlrxxl.exec:\7rlrxxl.exe201⤵PID:1460
-
\??\c:\nbhbhb.exec:\nbhbhb.exe202⤵PID:2928
-
\??\c:\htbbhn.exec:\htbbhn.exe203⤵PID:1520
-
\??\c:\1vjdd.exec:\1vjdd.exe204⤵PID:2552
-
\??\c:\xlflrrx.exec:\xlflrrx.exe205⤵PID:1928
-
\??\c:\xrxfxrx.exec:\xrxfxrx.exe206⤵PID:2076
-
\??\c:\hbhntt.exec:\hbhntt.exe207⤵PID:536
-
\??\c:\dvpvv.exec:\dvpvv.exe208⤵PID:576
-
\??\c:\vvpvp.exec:\vvpvp.exe209⤵PID:2440
-
\??\c:\lxllflr.exec:\lxllflr.exe210⤵PID:776
-
\??\c:\3tbnnn.exec:\3tbnnn.exe211⤵PID:444
-
\??\c:\hbhbbb.exec:\hbhbbb.exe212⤵PID:2108
-
\??\c:\jdpvd.exec:\jdpvd.exe213⤵PID:1640
-
\??\c:\rlffrxf.exec:\rlffrxf.exe214⤵PID:2648
-
\??\c:\rrflxfl.exec:\rrflxfl.exe215⤵PID:1680
-
\??\c:\3thbhh.exec:\3thbhh.exe216⤵PID:812
-
\??\c:\7dppp.exec:\7dppp.exe217⤵PID:3060
-
\??\c:\dpddd.exec:\dpddd.exe218⤵PID:988
-
\??\c:\xrfflfr.exec:\xrfflfr.exe219⤵PID:748
-
\??\c:\nhnnnt.exec:\nhnnnt.exe220⤵PID:1516
-
\??\c:\3thbbb.exec:\3thbbb.exe221⤵PID:2176
-
\??\c:\dpvvd.exec:\dpvvd.exe222⤵PID:1240
-
\??\c:\llffrrf.exec:\llffrrf.exe223⤵PID:2548
-
\??\c:\rlrlrxf.exec:\rlrlrxf.exe224⤵PID:880
-
\??\c:\5htbnn.exec:\5htbnn.exe225⤵PID:2180
-
\??\c:\ddppp.exec:\ddppp.exe226⤵PID:1508
-
\??\c:\dvjjp.exec:\dvjjp.exe227⤵PID:2192
-
\??\c:\rlrlrlx.exec:\rlrlrlx.exe228⤵PID:2984
-
\??\c:\bntbbh.exec:\bntbbh.exe229⤵PID:2572
-
\??\c:\7tnhhh.exec:\7tnhhh.exe230⤵PID:2592
-
\??\c:\7jvpp.exec:\7jvpp.exe231⤵PID:2668
-
\??\c:\rfrrrrf.exec:\rfrrrrf.exe232⤵PID:2824
-
\??\c:\xrxflrf.exec:\xrxflrf.exe233⤵PID:2764
-
\??\c:\nhbhnn.exec:\nhbhnn.exe234⤵PID:1716
-
\??\c:\vjddd.exec:\vjddd.exe235⤵PID:2472
-
\??\c:\3pdvv.exec:\3pdvv.exe236⤵PID:2528
-
\??\c:\rrfxfff.exec:\rrfxfff.exe237⤵PID:2740
-
\??\c:\hbtbnt.exec:\hbtbnt.exe238⤵PID:2908
-
\??\c:\dpdjj.exec:\dpdjj.exe239⤵PID:396
-
\??\c:\pdvjp.exec:\pdvjp.exe240⤵PID:1732
-
\??\c:\rlfxffl.exec:\rlfxffl.exe241⤵PID:1488
-