Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 22:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4bed605c0c3cb63d04ccb5b529cb57e5e6b11e48162d859612a9d9c031a4776a.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
4bed605c0c3cb63d04ccb5b529cb57e5e6b11e48162d859612a9d9c031a4776a.exe
-
Size
78KB
-
MD5
658c5738d0a091bca866df4b9bbd4589
-
SHA1
b41b9da5cc1d293f7cabb566c5c1be1ed6de09ce
-
SHA256
4bed605c0c3cb63d04ccb5b529cb57e5e6b11e48162d859612a9d9c031a4776a
-
SHA512
e5b042addb9b0bf1c8b4fb403bc1d26ad547a2e9a9d029e883c9d64d6bb7a12dc48029bc49ca942325b375a0c678a05c6898f7049527450d691d2a123cdd1f2a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIYgC/KSLJEd2aw:ymb3NkkiQ3mdBjFI3eFC/w
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/4520-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2176-34-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/332-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/996-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 30 IoCs
Processes:
resource yara_rule behavioral2/memory/4520-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4008-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2540-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1244-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3516-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3104-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4040-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4040-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3576-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/844-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/844-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/844-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/844-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3540-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4560-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4176-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1756-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5084-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4936-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2040-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2372-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/332-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4216-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4480-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1148-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/996-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2272-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4924-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4592-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5096-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
nnhbtn.exeddpjd.exevjvjj.exelfffxxr.exerlrrlff.exehbnhhh.exevppjd.exedvdvv.exexfxxfxf.exevvjdv.exejvvpd.exebnhnnt.exevjjdv.exelffxllf.exehttttt.exepjddd.exejjjjj.exelrrllff.exe7htnnh.exehtbnhb.exevdvdv.exerrfxrlf.exexlrlxrx.exenhnbbb.exedjppj.exeffffxxx.exellrrllf.exe3hhbtt.exepdppv.exepdjdv.exefxxrrll.exehbbtnn.exenhtthb.exeppvpv.exeppjjv.exelflxxlx.exellrflll.exettnhbb.exeddvvv.exedjjdv.exeflfffxf.exexrrlfff.exenhhhtb.exehtnnbt.exeppjjd.exepjvpd.exelllfrrl.exettnbbt.exelllflll.exe7xrrrfx.exehbntbn.exetnthbt.exepddvv.exexxffllr.exefxxxffl.exehhnbhn.exevpjdd.exelrxlrfr.exehhtnhb.exebbbnbb.exevpjdv.exe9fffxfx.exefxfrlxx.exeffxxxxx.exepid process 4008 nnhbtn.exe 2540 ddpjd.exe 1244 vjvjj.exe 2176 lfffxxr.exe 3516 rlrrlff.exe 3104 hbnhhh.exe 4040 vppjd.exe 3576 dvdvv.exe 844 xfxxfxf.exe 3540 vvjdv.exe 4560 jvvpd.exe 4176 bnhnnt.exe 1756 vjjdv.exe 5084 lffxllf.exe 4936 httttt.exe 2040 pjddd.exe 2372 jjjjj.exe 332 lrrllff.exe 1700 7htnnh.exe 4480 htbnhb.exe 4216 vdvdv.exe 1148 rrfxrlf.exe 996 xlrlxrx.exe 2272 nhnbbb.exe 3548 djppj.exe 4924 ffffxxx.exe 4592 llrrllf.exe 3300 3hhbtt.exe 5096 pdppv.exe 2220 pdjdv.exe 436 fxxrrll.exe 3764 hbbtnn.exe 2584 nhtthb.exe 3292 ppvpv.exe 3244 ppjjv.exe 552 lflxxlx.exe 2212 llrflll.exe 4760 ttnhbb.exe 4444 ddvvv.exe 2440 djjdv.exe 5064 flfffxf.exe 1704 xrrlfff.exe 4720 nhhhtb.exe 1144 htnnbt.exe 4868 ppjjd.exe 3104 pjvpd.exe 3096 lllfrrl.exe 4640 ttnbbt.exe 4656 lllflll.exe 1328 7xrrrfx.exe 4104 hbntbn.exe 2468 tnthbt.exe 2676 pddvv.exe 3156 xxffllr.exe 3296 fxxxffl.exe 452 hhnbhn.exe 3200 vpjdd.exe 3264 lrxlrfr.exe 2064 hhtnhb.exe 5056 bbbnbb.exe 4984 vpjdv.exe 60 9fffxfx.exe 5072 fxfrlxx.exe 1604 ffxxxxx.exe -
Processes:
resource yara_rule behavioral2/memory/4520-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/332-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-195-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4bed605c0c3cb63d04ccb5b529cb57e5e6b11e48162d859612a9d9c031a4776a.exennhbtn.exeddpjd.exevjvjj.exelfffxxr.exerlrrlff.exehbnhhh.exevppjd.exedvdvv.exexfxxfxf.exevvjdv.exejvvpd.exebnhnnt.exevjjdv.exelffxllf.exehttttt.exepjddd.exejjjjj.exelrrllff.exe7htnnh.exehtbnhb.exevdvdv.exedescription pid process target process PID 4520 wrote to memory of 4008 4520 4bed605c0c3cb63d04ccb5b529cb57e5e6b11e48162d859612a9d9c031a4776a.exe nnhbtn.exe PID 4520 wrote to memory of 4008 4520 4bed605c0c3cb63d04ccb5b529cb57e5e6b11e48162d859612a9d9c031a4776a.exe nnhbtn.exe PID 4520 wrote to memory of 4008 4520 4bed605c0c3cb63d04ccb5b529cb57e5e6b11e48162d859612a9d9c031a4776a.exe nnhbtn.exe PID 4008 wrote to memory of 2540 4008 nnhbtn.exe ddpjd.exe PID 4008 wrote to memory of 2540 4008 nnhbtn.exe ddpjd.exe PID 4008 wrote to memory of 2540 4008 nnhbtn.exe ddpjd.exe PID 2540 wrote to memory of 1244 2540 ddpjd.exe vjvjj.exe PID 2540 wrote to memory of 1244 2540 ddpjd.exe vjvjj.exe PID 2540 wrote to memory of 1244 2540 ddpjd.exe vjvjj.exe PID 1244 wrote to memory of 2176 1244 vjvjj.exe lfffxxr.exe PID 1244 wrote to memory of 2176 1244 vjvjj.exe lfffxxr.exe PID 1244 wrote to memory of 2176 1244 vjvjj.exe lfffxxr.exe PID 2176 wrote to memory of 3516 2176 lfffxxr.exe rlrrlff.exe PID 2176 wrote to memory of 3516 2176 lfffxxr.exe rlrrlff.exe PID 2176 wrote to memory of 3516 2176 lfffxxr.exe rlrrlff.exe PID 3516 wrote to memory of 3104 3516 rlrrlff.exe hbnhhh.exe PID 3516 wrote to memory of 3104 3516 rlrrlff.exe hbnhhh.exe PID 3516 wrote to memory of 3104 3516 rlrrlff.exe hbnhhh.exe PID 3104 wrote to memory of 4040 3104 hbnhhh.exe vppjd.exe PID 3104 wrote to memory of 4040 3104 hbnhhh.exe vppjd.exe PID 3104 wrote to memory of 4040 3104 hbnhhh.exe vppjd.exe PID 4040 wrote to memory of 3576 4040 vppjd.exe dvdvv.exe PID 4040 wrote to memory of 3576 4040 vppjd.exe dvdvv.exe PID 4040 wrote to memory of 3576 4040 vppjd.exe dvdvv.exe PID 3576 wrote to memory of 844 3576 dvdvv.exe xfxxfxf.exe PID 3576 wrote to memory of 844 3576 dvdvv.exe xfxxfxf.exe PID 3576 wrote to memory of 844 3576 dvdvv.exe xfxxfxf.exe PID 844 wrote to memory of 3540 844 xfxxfxf.exe vvjdv.exe PID 844 wrote to memory of 3540 844 xfxxfxf.exe vvjdv.exe PID 844 wrote to memory of 3540 844 xfxxfxf.exe vvjdv.exe PID 3540 wrote to memory of 4560 3540 vvjdv.exe jvvpd.exe PID 3540 wrote to memory of 4560 3540 vvjdv.exe jvvpd.exe PID 3540 wrote to memory of 4560 3540 vvjdv.exe jvvpd.exe PID 4560 wrote to memory of 4176 4560 jvvpd.exe bnhnnt.exe PID 4560 wrote to memory of 4176 4560 jvvpd.exe bnhnnt.exe PID 4560 wrote to memory of 4176 4560 jvvpd.exe bnhnnt.exe PID 4176 wrote to memory of 1756 4176 bnhnnt.exe vjjdv.exe PID 4176 wrote to memory of 1756 4176 bnhnnt.exe vjjdv.exe PID 4176 wrote to memory of 1756 4176 bnhnnt.exe vjjdv.exe PID 1756 wrote to memory of 5084 1756 vjjdv.exe lffxllf.exe PID 1756 wrote to memory of 5084 1756 vjjdv.exe lffxllf.exe PID 1756 wrote to memory of 5084 1756 vjjdv.exe lffxllf.exe PID 5084 wrote to memory of 4936 5084 lffxllf.exe httttt.exe PID 5084 wrote to memory of 4936 5084 lffxllf.exe httttt.exe PID 5084 wrote to memory of 4936 5084 lffxllf.exe httttt.exe PID 4936 wrote to memory of 2040 4936 httttt.exe pjddd.exe PID 4936 wrote to memory of 2040 4936 httttt.exe pjddd.exe PID 4936 wrote to memory of 2040 4936 httttt.exe pjddd.exe PID 2040 wrote to memory of 2372 2040 pjddd.exe jjjjj.exe PID 2040 wrote to memory of 2372 2040 pjddd.exe jjjjj.exe PID 2040 wrote to memory of 2372 2040 pjddd.exe jjjjj.exe PID 2372 wrote to memory of 332 2372 jjjjj.exe lrrllff.exe PID 2372 wrote to memory of 332 2372 jjjjj.exe lrrllff.exe PID 2372 wrote to memory of 332 2372 jjjjj.exe lrrllff.exe PID 332 wrote to memory of 1700 332 lrrllff.exe 7htnnh.exe PID 332 wrote to memory of 1700 332 lrrllff.exe 7htnnh.exe PID 332 wrote to memory of 1700 332 lrrllff.exe 7htnnh.exe PID 1700 wrote to memory of 4480 1700 7htnnh.exe htbnhb.exe PID 1700 wrote to memory of 4480 1700 7htnnh.exe htbnhb.exe PID 1700 wrote to memory of 4480 1700 7htnnh.exe htbnhb.exe PID 4480 wrote to memory of 4216 4480 htbnhb.exe vdvdv.exe PID 4480 wrote to memory of 4216 4480 htbnhb.exe vdvdv.exe PID 4480 wrote to memory of 4216 4480 htbnhb.exe vdvdv.exe PID 4216 wrote to memory of 1148 4216 vdvdv.exe rrfxrlf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4bed605c0c3cb63d04ccb5b529cb57e5e6b11e48162d859612a9d9c031a4776a.exe"C:\Users\Admin\AppData\Local\Temp\4bed605c0c3cb63d04ccb5b529cb57e5e6b11e48162d859612a9d9c031a4776a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\nnhbtn.exec:\nnhbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\ddpjd.exec:\ddpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\vjvjj.exec:\vjvjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\lfffxxr.exec:\lfffxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\rlrrlff.exec:\rlrrlff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\hbnhhh.exec:\hbnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\vppjd.exec:\vppjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\dvdvv.exec:\dvdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\xfxxfxf.exec:\xfxxfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\vvjdv.exec:\vvjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\jvvpd.exec:\jvvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\bnhnnt.exec:\bnhnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\vjjdv.exec:\vjjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\lffxllf.exec:\lffxllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\httttt.exec:\httttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\pjddd.exec:\pjddd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\jjjjj.exec:\jjjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\lrrllff.exec:\lrrllff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\7htnnh.exec:\7htnnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\htbnhb.exec:\htbnhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\vdvdv.exec:\vdvdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\rrfxrlf.exec:\rrfxrlf.exe23⤵
- Executes dropped EXE
PID:1148 -
\??\c:\xlrlxrx.exec:\xlrlxrx.exe24⤵
- Executes dropped EXE
PID:996 -
\??\c:\nhnbbb.exec:\nhnbbb.exe25⤵
- Executes dropped EXE
PID:2272 -
\??\c:\djppj.exec:\djppj.exe26⤵
- Executes dropped EXE
PID:3548 -
\??\c:\ffffxxx.exec:\ffffxxx.exe27⤵
- Executes dropped EXE
PID:4924 -
\??\c:\llrrllf.exec:\llrrllf.exe28⤵
- Executes dropped EXE
PID:4592 -
\??\c:\3hhbtt.exec:\3hhbtt.exe29⤵
- Executes dropped EXE
PID:3300 -
\??\c:\pdppv.exec:\pdppv.exe30⤵
- Executes dropped EXE
PID:5096 -
\??\c:\pdjdv.exec:\pdjdv.exe31⤵
- Executes dropped EXE
PID:2220 -
\??\c:\fxxrrll.exec:\fxxrrll.exe32⤵
- Executes dropped EXE
PID:436 -
\??\c:\hbbtnn.exec:\hbbtnn.exe33⤵
- Executes dropped EXE
PID:3764 -
\??\c:\nhtthb.exec:\nhtthb.exe34⤵
- Executes dropped EXE
PID:2584 -
\??\c:\ppvpv.exec:\ppvpv.exe35⤵
- Executes dropped EXE
PID:3292 -
\??\c:\ppjjv.exec:\ppjjv.exe36⤵
- Executes dropped EXE
PID:3244 -
\??\c:\lflxxlx.exec:\lflxxlx.exe37⤵
- Executes dropped EXE
PID:552 -
\??\c:\llrflll.exec:\llrflll.exe38⤵
- Executes dropped EXE
PID:2212 -
\??\c:\ttnhbb.exec:\ttnhbb.exe39⤵
- Executes dropped EXE
PID:4760 -
\??\c:\ddvvv.exec:\ddvvv.exe40⤵
- Executes dropped EXE
PID:4444 -
\??\c:\djjdv.exec:\djjdv.exe41⤵
- Executes dropped EXE
PID:2440 -
\??\c:\flfffxf.exec:\flfffxf.exe42⤵
- Executes dropped EXE
PID:5064 -
\??\c:\xrrlfff.exec:\xrrlfff.exe43⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nhhhtb.exec:\nhhhtb.exe44⤵
- Executes dropped EXE
PID:4720 -
\??\c:\htnnbt.exec:\htnnbt.exe45⤵
- Executes dropped EXE
PID:1144 -
\??\c:\ppjjd.exec:\ppjjd.exe46⤵
- Executes dropped EXE
PID:4868 -
\??\c:\pjvpd.exec:\pjvpd.exe47⤵
- Executes dropped EXE
PID:3104 -
\??\c:\lllfrrl.exec:\lllfrrl.exe48⤵
- Executes dropped EXE
PID:3096 -
\??\c:\ttnbbt.exec:\ttnbbt.exe49⤵
- Executes dropped EXE
PID:4640 -
\??\c:\lllflll.exec:\lllflll.exe50⤵
- Executes dropped EXE
PID:4656 -
\??\c:\7xrrrfx.exec:\7xrrrfx.exe51⤵
- Executes dropped EXE
PID:1328 -
\??\c:\hbntbn.exec:\hbntbn.exe52⤵
- Executes dropped EXE
PID:4104 -
\??\c:\tnthbt.exec:\tnthbt.exe53⤵
- Executes dropped EXE
PID:2468 -
\??\c:\pddvv.exec:\pddvv.exe54⤵
- Executes dropped EXE
PID:2676 -
\??\c:\xxffllr.exec:\xxffllr.exe55⤵
- Executes dropped EXE
PID:3156 -
\??\c:\fxxxffl.exec:\fxxxffl.exe56⤵
- Executes dropped EXE
PID:3296 -
\??\c:\hhnbhn.exec:\hhnbhn.exe57⤵
- Executes dropped EXE
PID:452 -
\??\c:\vpjdd.exec:\vpjdd.exe58⤵
- Executes dropped EXE
PID:3200 -
\??\c:\lrxlrfr.exec:\lrxlrfr.exe59⤵
- Executes dropped EXE
PID:3264 -
\??\c:\hhtnhb.exec:\hhtnhb.exe60⤵
- Executes dropped EXE
PID:2064 -
\??\c:\bbbnbb.exec:\bbbnbb.exe61⤵
- Executes dropped EXE
PID:5056 -
\??\c:\vpjdv.exec:\vpjdv.exe62⤵
- Executes dropped EXE
PID:4984 -
\??\c:\9fffxfx.exec:\9fffxfx.exe63⤵
- Executes dropped EXE
PID:60 -
\??\c:\fxfrlxx.exec:\fxfrlxx.exe64⤵
- Executes dropped EXE
PID:5072 -
\??\c:\ffxxxxx.exec:\ffxxxxx.exe65⤵
- Executes dropped EXE
PID:1604 -
\??\c:\tnnhhb.exec:\tnnhhb.exe66⤵PID:996
-
\??\c:\httbnb.exec:\httbnb.exe67⤵PID:2416
-
\??\c:\jvpjd.exec:\jvpjd.exe68⤵PID:3708
-
\??\c:\xrlrlxr.exec:\xrlrlxr.exe69⤵PID:2868
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe70⤵PID:4924
-
\??\c:\htttnn.exec:\htttnn.exe71⤵PID:4564
-
\??\c:\vvvpj.exec:\vvvpj.exe72⤵PID:688
-
\??\c:\pjdvp.exec:\pjdvp.exe73⤵PID:3504
-
\??\c:\xrlrffl.exec:\xrlrffl.exe74⤵PID:2220
-
\??\c:\3rxrlrl.exec:\3rxrlrl.exe75⤵PID:436
-
\??\c:\bbttnn.exec:\bbttnn.exe76⤵PID:4052
-
\??\c:\hnnhbb.exec:\hnnhbb.exe77⤵PID:4920
-
\??\c:\frrrllf.exec:\frrrllf.exe78⤵PID:3252
-
\??\c:\lxxrlxf.exec:\lxxrlxf.exe79⤵PID:232
-
\??\c:\bttnhh.exec:\bttnhh.exe80⤵PID:212
-
\??\c:\9bhbnb.exec:\9bhbnb.exe81⤵PID:224
-
\??\c:\pjdvp.exec:\pjdvp.exe82⤵PID:4512
-
\??\c:\lrllfll.exec:\lrllfll.exe83⤵PID:2144
-
\??\c:\htbbbb.exec:\htbbbb.exe84⤵PID:2440
-
\??\c:\bthbbt.exec:\bthbbt.exe85⤵PID:5064
-
\??\c:\jdvpp.exec:\jdvpp.exe86⤵PID:1244
-
\??\c:\xflfrrl.exec:\xflfrrl.exe87⤵PID:3120
-
\??\c:\lxrfrfr.exec:\lxrfrfr.exe88⤵PID:3116
-
\??\c:\tnbthh.exec:\tnbthh.exe89⤵PID:216
-
\??\c:\hhnbtn.exec:\hhnbtn.exe90⤵PID:2988
-
\??\c:\vjvvp.exec:\vjvvp.exe91⤵PID:3600
-
\??\c:\pjdvp.exec:\pjdvp.exe92⤵PID:1984
-
\??\c:\rlxlrlr.exec:\rlxlrlr.exe93⤵PID:1828
-
\??\c:\xffxrrl.exec:\xffxrrl.exe94⤵PID:4912
-
\??\c:\nhnhhh.exec:\nhnhhh.exe95⤵PID:4560
-
\??\c:\nhhntt.exec:\nhhntt.exe96⤵PID:888
-
\??\c:\ppvpd.exec:\ppvpd.exe97⤵PID:2216
-
\??\c:\jjdvj.exec:\jjdvj.exe98⤵PID:1340
-
\??\c:\rlrxrxx.exec:\rlrxrxx.exe99⤵PID:3768
-
\??\c:\rfffxxx.exec:\rfffxxx.exe100⤵PID:2244
-
\??\c:\bnhbtt.exec:\bnhbtt.exe101⤵PID:3296
-
\??\c:\btbtnn.exec:\btbtnn.exe102⤵PID:452
-
\??\c:\3vjvp.exec:\3vjvp.exe103⤵PID:4956
-
\??\c:\5vvvp.exec:\5vvvp.exe104⤵PID:4904
-
\??\c:\lrrfrxr.exec:\lrrfrxr.exe105⤵PID:2064
-
\??\c:\fxrrrrl.exec:\fxrrrrl.exe106⤵PID:5060
-
\??\c:\hbnnhh.exec:\hbnnhh.exe107⤵PID:4984
-
\??\c:\jjddd.exec:\jjddd.exe108⤵PID:60
-
\??\c:\dvjjv.exec:\dvjjv.exe109⤵PID:5072
-
\??\c:\rrxlffr.exec:\rrxlffr.exe110⤵PID:1604
-
\??\c:\ffrrxlf.exec:\ffrrxlf.exe111⤵PID:3424
-
\??\c:\tnnbbh.exec:\tnnbbh.exe112⤵PID:4324
-
\??\c:\vjdpv.exec:\vjdpv.exe113⤵PID:4456
-
\??\c:\9pppd.exec:\9pppd.exe114⤵PID:924
-
\??\c:\5lrlllr.exec:\5lrlllr.exe115⤵PID:4924
-
\??\c:\xlffxxx.exec:\xlffxxx.exe116⤵PID:2716
-
\??\c:\bnbtnn.exec:\bnbtnn.exe117⤵PID:3180
-
\??\c:\bhnbtt.exec:\bhnbtt.exe118⤵PID:220
-
\??\c:\vdpjj.exec:\vdpjj.exe119⤵PID:416
-
\??\c:\pppjv.exec:\pppjv.exe120⤵PID:3856
-
\??\c:\fxrlfff.exec:\fxrlfff.exe121⤵PID:2584
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe122⤵PID:5000
-
\??\c:\ntbhbb.exec:\ntbhbb.exe123⤵PID:4748
-
\??\c:\hhnhhb.exec:\hhnhhb.exe124⤵PID:2448
-
\??\c:\jjdvv.exec:\jjdvv.exe125⤵PID:964
-
\??\c:\ddddv.exec:\ddddv.exe126⤵PID:4584
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe127⤵PID:3100
-
\??\c:\ntnhbb.exec:\ntnhbb.exe128⤵PID:1484
-
\??\c:\htbthh.exec:\htbthh.exe129⤵PID:4400
-
\??\c:\7btnhh.exec:\7btnhh.exe130⤵PID:1244
-
\??\c:\jpvpp.exec:\jpvpp.exe131⤵PID:632
-
\??\c:\jvjdv.exec:\jvjdv.exe132⤵PID:3116
-
\??\c:\rllfrrl.exec:\rllfrrl.exe133⤵PID:2660
-
\??\c:\hbnnbb.exec:\hbnnbb.exe134⤵PID:1696
-
\??\c:\btnnhn.exec:\btnnhn.exe135⤵PID:4656
-
\??\c:\7pvpj.exec:\7pvpj.exe136⤵PID:2752
-
\??\c:\hthhtn.exec:\hthhtn.exe137⤵PID:3804
-
\??\c:\btbtnh.exec:\btbtnh.exe138⤵PID:2812
-
\??\c:\jvdpj.exec:\jvdpj.exe139⤵PID:4388
-
\??\c:\jvvvp.exec:\jvvvp.exe140⤵PID:2116
-
\??\c:\9frlxrf.exec:\9frlxrf.exe141⤵PID:4728
-
\??\c:\lxxxrlf.exec:\lxxxrlf.exe142⤵PID:452
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe143⤵PID:4460
-
\??\c:\3hhbnh.exec:\3hhbnh.exe144⤵PID:3460
-
\??\c:\7tnbnh.exec:\7tnbnh.exe145⤵PID:2024
-
\??\c:\jddpj.exec:\jddpj.exe146⤵PID:3612
-
\??\c:\fxrfxrl.exec:\fxrfxrl.exe147⤵PID:5052
-
\??\c:\9rrlffx.exec:\9rrlffx.exe148⤵PID:5068
-
\??\c:\5tbtnb.exec:\5tbtnb.exe149⤵PID:996
-
\??\c:\pppjv.exec:\pppjv.exe150⤵PID:2260
-
\??\c:\jjjdv.exec:\jjjdv.exe151⤵PID:2416
-
\??\c:\rrxrllf.exec:\rrxrllf.exe152⤵PID:2868
-
\??\c:\tnnbtn.exec:\tnnbtn.exe153⤵PID:2932
-
\??\c:\7jdvp.exec:\7jdvp.exe154⤵PID:3300
-
\??\c:\vjdvd.exec:\vjdvd.exe155⤵PID:400
-
\??\c:\7lrlrlr.exec:\7lrlrlr.exe156⤵PID:3904
-
\??\c:\7hhbbt.exec:\7hhbbt.exe157⤵PID:2316
-
\??\c:\btnnhn.exec:\btnnhn.exe158⤵PID:2368
-
\??\c:\vjjvj.exec:\vjjvj.exe159⤵PID:4920
-
\??\c:\pddvj.exec:\pddvj.exe160⤵PID:1924
-
\??\c:\xrrfrfx.exec:\xrrfrfx.exe161⤵PID:3252
-
\??\c:\3ttnnn.exec:\3ttnnn.exe162⤵PID:1632
-
\??\c:\thbtbb.exec:\thbtbb.exe163⤵PID:552
-
\??\c:\vvdpj.exec:\vvdpj.exe164⤵PID:4760
-
\??\c:\pppdp.exec:\pppdp.exe165⤵PID:4444
-
\??\c:\lrrlfff.exec:\lrrlfff.exe166⤵PID:4220
-
\??\c:\rxrlfll.exec:\rxrlfll.exe167⤵PID:1228
-
\??\c:\9nttnh.exec:\9nttnh.exe168⤵PID:4992
-
\??\c:\pvjpj.exec:\pvjpj.exe169⤵PID:640
-
\??\c:\xxrlfxx.exec:\xxrlfxx.exe170⤵PID:4372
-
\??\c:\rllfrrl.exec:\rllfrrl.exe171⤵PID:4172
-
\??\c:\xrxxlfx.exec:\xrxxlfx.exe172⤵PID:4700
-
\??\c:\nhbhht.exec:\nhbhht.exe173⤵PID:1828
-
\??\c:\hnnhhn.exec:\hnnhhn.exe174⤵PID:4656
-
\??\c:\dvvpd.exec:\dvvpd.exe175⤵PID:1852
-
\??\c:\lxxrlff.exec:\lxxrlff.exe176⤵PID:3156
-
\??\c:\9lllfxr.exec:\9lllfxr.exe177⤵PID:3688
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe178⤵PID:3036
-
\??\c:\nbtnhh.exec:\nbtnhh.exe179⤵PID:4684
-
\??\c:\1tnhtn.exec:\1tnhtn.exe180⤵PID:1700
-
\??\c:\vvvdp.exec:\vvvdp.exe181⤵PID:1652
-
\??\c:\7rrfrlf.exec:\7rrfrlf.exe182⤵PID:3520
-
\??\c:\hhbnhb.exec:\hhbnhb.exe183⤵PID:2420
-
\??\c:\bnnhnn.exec:\bnnhnn.exe184⤵PID:60
-
\??\c:\5pdvv.exec:\5pdvv.exe185⤵PID:2444
-
\??\c:\pjjjv.exec:\pjjjv.exe186⤵PID:1560
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe187⤵PID:3708
-
\??\c:\rxxrllf.exec:\rxxrllf.exe188⤵PID:2816
-
\??\c:\hhtnhb.exec:\hhtnhb.exe189⤵PID:820
-
\??\c:\bbnnnh.exec:\bbnnnh.exe190⤵PID:2944
-
\??\c:\dvpjd.exec:\dvpjd.exe191⤵PID:4924
-
\??\c:\rlfxllf.exec:\rlfxllf.exe192⤵PID:392
-
\??\c:\9rrrrrr.exec:\9rrrrrr.exe193⤵PID:3180
-
\??\c:\nnbhtb.exec:\nnbhtb.exe194⤵PID:3764
-
\??\c:\btnnnh.exec:\btnnnh.exe195⤵PID:2368
-
\??\c:\5dpjv.exec:\5dpjv.exe196⤵PID:4920
-
\??\c:\frrlxxr.exec:\frrlxxr.exe197⤵PID:3244
-
\??\c:\ffrfxrf.exec:\ffrfxrf.exe198⤵PID:232
-
\??\c:\3bbbbb.exec:\3bbbbb.exe199⤵PID:2980
-
\??\c:\pvdpj.exec:\pvdpj.exe200⤵PID:3456
-
\??\c:\frxxxxl.exec:\frxxxxl.exe201⤵PID:4584
-
\??\c:\rfxrfxr.exec:\rfxrfxr.exe202⤵PID:4444
-
\??\c:\nbthbt.exec:\nbthbt.exe203⤵PID:4220
-
\??\c:\tnhbhh.exec:\tnhbhh.exe204⤵PID:1128
-
\??\c:\pvjvj.exec:\pvjvj.exe205⤵PID:3120
-
\??\c:\jvddv.exec:\jvddv.exe206⤵PID:2988
-
\??\c:\xrxlxrf.exec:\xrxlxrf.exe207⤵PID:560
-
\??\c:\bnhbnh.exec:\bnhbnh.exe208⤵PID:516
-
\??\c:\hnnnhh.exec:\hnnnhh.exe209⤵PID:4568
-
\??\c:\vjvpv.exec:\vjvpv.exe210⤵PID:2752
-
\??\c:\vvvvj.exec:\vvvvj.exe211⤵PID:4656
-
\??\c:\xlxfrfr.exec:\xlxfrfr.exe212⤵PID:2812
-
\??\c:\thbtnh.exec:\thbtnh.exe213⤵PID:3156
-
\??\c:\hnnhhb.exec:\hnnhhb.exe214⤵PID:4328
-
\??\c:\hbthtn.exec:\hbthtn.exe215⤵PID:3596
-
\??\c:\dvdvv.exec:\dvdvv.exe216⤵PID:4684
-
\??\c:\dvpvj.exec:\dvpvj.exe217⤵PID:4064
-
\??\c:\lrrrllf.exec:\lrrrllf.exe218⤵PID:1652
-
\??\c:\frfxlrf.exec:\frfxlrf.exe219⤵PID:3520
-
\??\c:\bnnnhn.exec:\bnnnhn.exe220⤵PID:3064
-
\??\c:\hbtnbb.exec:\hbtnbb.exe221⤵PID:4252
-
\??\c:\jpppv.exec:\jpppv.exe222⤵PID:376
-
\??\c:\5jjdp.exec:\5jjdp.exe223⤵PID:1560
-
\??\c:\llrlfxx.exec:\llrlfxx.exe224⤵PID:3708
-
\??\c:\hbbtbb.exec:\hbbtbb.exe225⤵PID:924
-
\??\c:\7tnhtt.exec:\7tnhtt.exe226⤵PID:820
-
\??\c:\nbbnnn.exec:\nbbnnn.exe227⤵PID:2944
-
\??\c:\vvdjv.exec:\vvdjv.exe228⤵PID:1260
-
\??\c:\dvdvv.exec:\dvdvv.exe229⤵PID:416
-
\??\c:\1xxrffx.exec:\1xxrffx.exe230⤵PID:4124
-
\??\c:\lxlxxxx.exec:\lxlxxxx.exe231⤵PID:4780
-
\??\c:\tbnnhb.exec:\tbnnhb.exe232⤵PID:2368
-
\??\c:\hntbhb.exec:\hntbhb.exe233⤵PID:5000
-
\??\c:\vdjdp.exec:\vdjdp.exe234⤵PID:4448
-
\??\c:\rxxlxrf.exec:\rxxlxrf.exe235⤵PID:4512
-
\??\c:\rrfrffr.exec:\rrfrffr.exe236⤵PID:4280
-
\??\c:\tttttb.exec:\tttttb.exe237⤵PID:4584
-
\??\c:\tnntnt.exec:\tnntnt.exe238⤵PID:3568
-
\??\c:\pdpjj.exec:\pdpjj.exe239⤵PID:4992
-
\??\c:\djpdp.exec:\djpdp.exe240⤵PID:3116
-
\??\c:\lfllllx.exec:\lfllllx.exe241⤵PID:2208
-
\??\c:\frlfrrf.exec:\frlfrrf.exe242⤵PID:3704