Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 20:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30f587a2a157873fcc69ec770805a9905c0e65e46791b9c4c3b537e7e14c915a.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
30f587a2a157873fcc69ec770805a9905c0e65e46791b9c4c3b537e7e14c915a.exe
-
Size
72KB
-
MD5
266fb7410c75ec6e80e77104e4dde8fd
-
SHA1
fc81b4dd28ffd0669df07d14dd9634fb119954d6
-
SHA256
30f587a2a157873fcc69ec770805a9905c0e65e46791b9c4c3b537e7e14c915a
-
SHA512
81f399c44883e39f82c7149aab492de7536f9c5ba725c601521d62a644b65d9fd48c95372b8562ee690ddb6b5b2d2df56afaad8205157754e6282d8023f0eef5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgUVyiAnaHN:ymb3NkkiQ3mdBjFIgUEg
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/1692-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/444-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-79-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1364-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2804-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/832-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3148-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/932-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hbbnhh.exebtbbtt.exedvpjv.exedpddv.exenbnnnt.exedvjjd.exelfrrxfr.exe7rrffff.exeffrrxxx.exepvddd.exejvddv.exe1xlrlff.exelffffff.exenthhbh.exejdddd.exepdjpp.exexxffxxx.exe9xlrlrr.exehtbbbh.exevdjjj.exerrrrlrl.exerllxrxx.exelfxrxxf.exehtbhhn.exeddddd.exelrfffrr.exetbnnhn.exenntbhn.exevvdvj.exepppjd.exedvdjd.exelflfxfx.exebtbhhn.exehtbttt.exetbhbtt.exeppdpj.exevdddv.exellfffxx.exexrllfrr.exetntttb.exe3frlrxr.exeflxrxxf.exehbhnhh.exevdpjj.exe7jddv.exe9bhbbb.exetntnnn.exedddpp.exepppvv.exe7lxrlrr.exerlflxxx.exehhhhnn.exebbtttb.exe3jjjd.exepjppp.exebntbtt.exebbhhhb.exevdvvv.exe5vppj.exerxffrlr.exeflxxrxl.exennnnbb.exejvjdv.exevvjpd.exepid process 4440 hbbnhh.exe 444 btbbtt.exe 228 dvpjv.exe 2888 dpddv.exe 3500 nbnnnt.exe 1168 dvjjd.exe 1312 lfrrxfr.exe 1436 7rrffff.exe 3892 ffrrxxx.exe 2216 pvddd.exe 4964 jvddv.exe 1364 1xlrlff.exe 3900 lffffff.exe 2804 nthhbh.exe 4848 jdddd.exe 832 pdjpp.exe 3148 xxffxxx.exe 1676 9xlrlrr.exe 2144 htbbbh.exe 3052 vdjjj.exe 4648 rrrrlrl.exe 932 rllxrxx.exe 452 lfxrxxf.exe 4936 htbhhn.exe 3508 ddddd.exe 4144 lrfffrr.exe 5084 tbnnhn.exe 2876 nntbhn.exe 60 vvdvj.exe 5116 pppjd.exe 1532 dvdjd.exe 3504 lflfxfx.exe 2424 btbhhn.exe 876 htbttt.exe 1968 tbhbtt.exe 3192 ppdpj.exe 2908 vdddv.exe 4052 llfffxx.exe 4316 xrllfrr.exe 2848 tntttb.exe 2628 3frlrxr.exe 4368 flxrxxf.exe 4428 hbhnhh.exe 3840 vdpjj.exe 444 7jddv.exe 1176 9bhbbb.exe 4948 tntnnn.exe 3512 dddpp.exe 1800 pppvv.exe 1680 7lxrlrr.exe 968 rlflxxx.exe 2024 hhhhnn.exe 2344 bbtttb.exe 4836 3jjjd.exe 3844 pjppp.exe 3972 bntbtt.exe 2764 bbhhhb.exe 4740 vdvvv.exe 2716 5vppj.exe 4892 rxffrlr.exe 3148 flxxrxl.exe 4432 nnnnbb.exe 3448 jvjdv.exe 1284 vvjpd.exe -
Processes:
resource yara_rule behavioral2/memory/1692-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/444-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1364-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2804-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/832-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/932-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-185-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
30f587a2a157873fcc69ec770805a9905c0e65e46791b9c4c3b537e7e14c915a.exehbbnhh.exebtbbtt.exedvpjv.exedpddv.exenbnnnt.exedvjjd.exelfrrxfr.exe7rrffff.exeffrrxxx.exepvddd.exejvddv.exe1xlrlff.exelffffff.exenthhbh.exejdddd.exepdjpp.exexxffxxx.exe9xlrlrr.exehtbbbh.exevdjjj.exerrrrlrl.exedescription pid process target process PID 1692 wrote to memory of 4440 1692 30f587a2a157873fcc69ec770805a9905c0e65e46791b9c4c3b537e7e14c915a.exe hbbnhh.exe PID 1692 wrote to memory of 4440 1692 30f587a2a157873fcc69ec770805a9905c0e65e46791b9c4c3b537e7e14c915a.exe hbbnhh.exe PID 1692 wrote to memory of 4440 1692 30f587a2a157873fcc69ec770805a9905c0e65e46791b9c4c3b537e7e14c915a.exe hbbnhh.exe PID 4440 wrote to memory of 444 4440 hbbnhh.exe btbbtt.exe PID 4440 wrote to memory of 444 4440 hbbnhh.exe btbbtt.exe PID 4440 wrote to memory of 444 4440 hbbnhh.exe btbbtt.exe PID 444 wrote to memory of 228 444 btbbtt.exe dvpjv.exe PID 444 wrote to memory of 228 444 btbbtt.exe dvpjv.exe PID 444 wrote to memory of 228 444 btbbtt.exe dvpjv.exe PID 228 wrote to memory of 2888 228 dvpjv.exe dpddv.exe PID 228 wrote to memory of 2888 228 dvpjv.exe dpddv.exe PID 228 wrote to memory of 2888 228 dvpjv.exe dpddv.exe PID 2888 wrote to memory of 3500 2888 dpddv.exe nbnnnt.exe PID 2888 wrote to memory of 3500 2888 dpddv.exe nbnnnt.exe PID 2888 wrote to memory of 3500 2888 dpddv.exe nbnnnt.exe PID 3500 wrote to memory of 1168 3500 nbnnnt.exe dvjjd.exe PID 3500 wrote to memory of 1168 3500 nbnnnt.exe dvjjd.exe PID 3500 wrote to memory of 1168 3500 nbnnnt.exe dvjjd.exe PID 1168 wrote to memory of 1312 1168 dvjjd.exe lfrrxfr.exe PID 1168 wrote to memory of 1312 1168 dvjjd.exe lfrrxfr.exe PID 1168 wrote to memory of 1312 1168 dvjjd.exe lfrrxfr.exe PID 1312 wrote to memory of 1436 1312 lfrrxfr.exe 7rrffff.exe PID 1312 wrote to memory of 1436 1312 lfrrxfr.exe 7rrffff.exe PID 1312 wrote to memory of 1436 1312 lfrrxfr.exe 7rrffff.exe PID 1436 wrote to memory of 3892 1436 7rrffff.exe ffrrxxx.exe PID 1436 wrote to memory of 3892 1436 7rrffff.exe ffrrxxx.exe PID 1436 wrote to memory of 3892 1436 7rrffff.exe ffrrxxx.exe PID 3892 wrote to memory of 2216 3892 ffrrxxx.exe pvddd.exe PID 3892 wrote to memory of 2216 3892 ffrrxxx.exe pvddd.exe PID 3892 wrote to memory of 2216 3892 ffrrxxx.exe pvddd.exe PID 2216 wrote to memory of 4964 2216 pvddd.exe jvddv.exe PID 2216 wrote to memory of 4964 2216 pvddd.exe jvddv.exe PID 2216 wrote to memory of 4964 2216 pvddd.exe jvddv.exe PID 4964 wrote to memory of 1364 4964 jvddv.exe 1xlrlff.exe PID 4964 wrote to memory of 1364 4964 jvddv.exe 1xlrlff.exe PID 4964 wrote to memory of 1364 4964 jvddv.exe 1xlrlff.exe PID 1364 wrote to memory of 3900 1364 1xlrlff.exe lffffff.exe PID 1364 wrote to memory of 3900 1364 1xlrlff.exe lffffff.exe PID 1364 wrote to memory of 3900 1364 1xlrlff.exe lffffff.exe PID 3900 wrote to memory of 2804 3900 lffffff.exe nthhbh.exe PID 3900 wrote to memory of 2804 3900 lffffff.exe nthhbh.exe PID 3900 wrote to memory of 2804 3900 lffffff.exe nthhbh.exe PID 2804 wrote to memory of 4848 2804 nthhbh.exe jdddd.exe PID 2804 wrote to memory of 4848 2804 nthhbh.exe jdddd.exe PID 2804 wrote to memory of 4848 2804 nthhbh.exe jdddd.exe PID 4848 wrote to memory of 832 4848 jdddd.exe pdjpp.exe PID 4848 wrote to memory of 832 4848 jdddd.exe pdjpp.exe PID 4848 wrote to memory of 832 4848 jdddd.exe pdjpp.exe PID 832 wrote to memory of 3148 832 pdjpp.exe xxffxxx.exe PID 832 wrote to memory of 3148 832 pdjpp.exe xxffxxx.exe PID 832 wrote to memory of 3148 832 pdjpp.exe xxffxxx.exe PID 3148 wrote to memory of 1676 3148 xxffxxx.exe 9xlrlrr.exe PID 3148 wrote to memory of 1676 3148 xxffxxx.exe 9xlrlrr.exe PID 3148 wrote to memory of 1676 3148 xxffxxx.exe 9xlrlrr.exe PID 1676 wrote to memory of 2144 1676 9xlrlrr.exe htbbbh.exe PID 1676 wrote to memory of 2144 1676 9xlrlrr.exe htbbbh.exe PID 1676 wrote to memory of 2144 1676 9xlrlrr.exe htbbbh.exe PID 2144 wrote to memory of 3052 2144 htbbbh.exe vdjjj.exe PID 2144 wrote to memory of 3052 2144 htbbbh.exe vdjjj.exe PID 2144 wrote to memory of 3052 2144 htbbbh.exe vdjjj.exe PID 3052 wrote to memory of 4648 3052 vdjjj.exe rrrrlrl.exe PID 3052 wrote to memory of 4648 3052 vdjjj.exe rrrrlrl.exe PID 3052 wrote to memory of 4648 3052 vdjjj.exe rrrrlrl.exe PID 4648 wrote to memory of 932 4648 rrrrlrl.exe rllxrxx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30f587a2a157873fcc69ec770805a9905c0e65e46791b9c4c3b537e7e14c915a.exe"C:\Users\Admin\AppData\Local\Temp\30f587a2a157873fcc69ec770805a9905c0e65e46791b9c4c3b537e7e14c915a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\hbbnhh.exec:\hbbnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\btbbtt.exec:\btbbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\dvpjv.exec:\dvpjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\dpddv.exec:\dpddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\nbnnnt.exec:\nbnnnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\dvjjd.exec:\dvjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\lfrrxfr.exec:\lfrrxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\7rrffff.exec:\7rrffff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\ffrrxxx.exec:\ffrrxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\pvddd.exec:\pvddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\jvddv.exec:\jvddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\1xlrlff.exec:\1xlrlff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\lffffff.exec:\lffffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\nthhbh.exec:\nthhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\jdddd.exec:\jdddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\pdjpp.exec:\pdjpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\xxffxxx.exec:\xxffxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\9xlrlrr.exec:\9xlrlrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\htbbbh.exec:\htbbbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\vdjjj.exec:\vdjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\rrrrlrl.exec:\rrrrlrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\rllxrxx.exec:\rllxrxx.exe23⤵
- Executes dropped EXE
PID:932 -
\??\c:\lfxrxxf.exec:\lfxrxxf.exe24⤵
- Executes dropped EXE
PID:452 -
\??\c:\htbhhn.exec:\htbhhn.exe25⤵
- Executes dropped EXE
PID:4936 -
\??\c:\ddddd.exec:\ddddd.exe26⤵
- Executes dropped EXE
PID:3508 -
\??\c:\lrfffrr.exec:\lrfffrr.exe27⤵
- Executes dropped EXE
PID:4144 -
\??\c:\tbnnhn.exec:\tbnnhn.exe28⤵
- Executes dropped EXE
PID:5084 -
\??\c:\nntbhn.exec:\nntbhn.exe29⤵
- Executes dropped EXE
PID:2876 -
\??\c:\vvdvj.exec:\vvdvj.exe30⤵
- Executes dropped EXE
PID:60 -
\??\c:\pppjd.exec:\pppjd.exe31⤵
- Executes dropped EXE
PID:5116 -
\??\c:\dvdjd.exec:\dvdjd.exe32⤵
- Executes dropped EXE
PID:1532 -
\??\c:\lflfxfx.exec:\lflfxfx.exe33⤵
- Executes dropped EXE
PID:3504 -
\??\c:\btbhhn.exec:\btbhhn.exe34⤵
- Executes dropped EXE
PID:2424 -
\??\c:\htbttt.exec:\htbttt.exe35⤵
- Executes dropped EXE
PID:876 -
\??\c:\tbhbtt.exec:\tbhbtt.exe36⤵
- Executes dropped EXE
PID:1968 -
\??\c:\ppdpj.exec:\ppdpj.exe37⤵
- Executes dropped EXE
PID:3192 -
\??\c:\vdddv.exec:\vdddv.exe38⤵
- Executes dropped EXE
PID:2908 -
\??\c:\llfffxx.exec:\llfffxx.exe39⤵
- Executes dropped EXE
PID:4052 -
\??\c:\xrllfrr.exec:\xrllfrr.exe40⤵
- Executes dropped EXE
PID:4316 -
\??\c:\tntttb.exec:\tntttb.exe41⤵
- Executes dropped EXE
PID:2848 -
\??\c:\3frlrxr.exec:\3frlrxr.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\flxrxxf.exec:\flxrxxf.exe43⤵
- Executes dropped EXE
PID:4368 -
\??\c:\hbhnhh.exec:\hbhnhh.exe44⤵
- Executes dropped EXE
PID:4428 -
\??\c:\vdpjj.exec:\vdpjj.exe45⤵
- Executes dropped EXE
PID:3840 -
\??\c:\7jddv.exec:\7jddv.exe46⤵
- Executes dropped EXE
PID:444 -
\??\c:\9bhbbb.exec:\9bhbbb.exe47⤵
- Executes dropped EXE
PID:1176 -
\??\c:\tntnnn.exec:\tntnnn.exe48⤵
- Executes dropped EXE
PID:4948 -
\??\c:\dddpp.exec:\dddpp.exe49⤵
- Executes dropped EXE
PID:3512 -
\??\c:\pppvv.exec:\pppvv.exe50⤵
- Executes dropped EXE
PID:1800 -
\??\c:\7lxrlrr.exec:\7lxrlrr.exe51⤵
- Executes dropped EXE
PID:1680 -
\??\c:\rlflxxx.exec:\rlflxxx.exe52⤵
- Executes dropped EXE
PID:968 -
\??\c:\hhhhnn.exec:\hhhhnn.exe53⤵
- Executes dropped EXE
PID:2024 -
\??\c:\bbtttb.exec:\bbtttb.exe54⤵
- Executes dropped EXE
PID:2344 -
\??\c:\3jjjd.exec:\3jjjd.exe55⤵
- Executes dropped EXE
PID:4836 -
\??\c:\pjppp.exec:\pjppp.exe56⤵
- Executes dropped EXE
PID:3844 -
\??\c:\bntbtt.exec:\bntbtt.exe57⤵
- Executes dropped EXE
PID:3972 -
\??\c:\bbhhhb.exec:\bbhhhb.exe58⤵
- Executes dropped EXE
PID:2764 -
\??\c:\vdvvv.exec:\vdvvv.exe59⤵
- Executes dropped EXE
PID:4740 -
\??\c:\5vppj.exec:\5vppj.exe60⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rxffrlr.exec:\rxffrlr.exe61⤵
- Executes dropped EXE
PID:4892 -
\??\c:\flxxrxl.exec:\flxxrxl.exe62⤵
- Executes dropped EXE
PID:3148 -
\??\c:\nnnnbb.exec:\nnnnbb.exe63⤵
- Executes dropped EXE
PID:4432 -
\??\c:\jvjdv.exec:\jvjdv.exe64⤵
- Executes dropped EXE
PID:3448 -
\??\c:\vvjpd.exec:\vvjpd.exe65⤵
- Executes dropped EXE
PID:1284 -
\??\c:\dpvdv.exec:\dpvdv.exe66⤵PID:884
-
\??\c:\7frlfff.exec:\7frlfff.exe67⤵PID:3416
-
\??\c:\lfllflf.exec:\lfllflf.exe68⤵PID:3112
-
\??\c:\hbhnnt.exec:\hbhnnt.exe69⤵PID:1848
-
\??\c:\btttnt.exec:\btttnt.exe70⤵PID:3596
-
\??\c:\vvjdv.exec:\vvjdv.exe71⤵PID:2136
-
\??\c:\7pjdv.exec:\7pjdv.exe72⤵PID:1920
-
\??\c:\5xxxxff.exec:\5xxxxff.exe73⤵PID:1960
-
\??\c:\flxxxff.exec:\flxxxff.exe74⤵PID:456
-
\??\c:\hhnttt.exec:\hhnttt.exe75⤵PID:2104
-
\??\c:\hbttnt.exec:\hbttnt.exe76⤵PID:2704
-
\??\c:\vpppj.exec:\vpppj.exe77⤵PID:1028
-
\??\c:\ppppj.exec:\ppppj.exe78⤵PID:2844
-
\??\c:\jdjjd.exec:\jdjjd.exe79⤵PID:1532
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe80⤵PID:2784
-
\??\c:\hhtbtt.exec:\hhtbtt.exe81⤵PID:3632
-
\??\c:\bhbbtt.exec:\bhbbtt.exe82⤵PID:2248
-
\??\c:\djjdp.exec:\djjdp.exe83⤵PID:744
-
\??\c:\rrrlffx.exec:\rrrlffx.exe84⤵PID:1300
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe85⤵PID:4392
-
\??\c:\htbbbh.exec:\htbbbh.exe86⤵PID:4300
-
\??\c:\hntnhh.exec:\hntnhh.exe87⤵PID:4332
-
\??\c:\jjddv.exec:\jjddv.exe88⤵PID:2924
-
\??\c:\xfrrlll.exec:\xfrrlll.exe89⤵PID:4440
-
\??\c:\9thhbb.exec:\9thhbb.exe90⤵PID:3496
-
\??\c:\hnttbb.exec:\hnttbb.exe91⤵PID:2088
-
\??\c:\jdpdv.exec:\jdpdv.exe92⤵PID:4088
-
\??\c:\xxfxrxf.exec:\xxfxrxf.exe93⤵PID:3608
-
\??\c:\nnntnt.exec:\nnntnt.exe94⤵PID:1168
-
\??\c:\nnnnhn.exec:\nnnnhn.exe95⤵PID:4652
-
\??\c:\pvjdv.exec:\pvjdv.exe96⤵PID:1180
-
\??\c:\jjppj.exec:\jjppj.exe97⤵PID:1436
-
\??\c:\lfxxrrx.exec:\lfxxrrx.exe98⤵PID:612
-
\??\c:\bthbtb.exec:\bthbtb.exe99⤵PID:5096
-
\??\c:\hbbbbh.exec:\hbbbbh.exe100⤵PID:1472
-
\??\c:\dvddd.exec:\dvddd.exe101⤵PID:3672
-
\??\c:\pppjj.exec:\pppjj.exe102⤵PID:1688
-
\??\c:\flffxff.exec:\flffxff.exe103⤵PID:3972
-
\??\c:\3hbhnt.exec:\3hbhnt.exe104⤵PID:4064
-
\??\c:\hbntnn.exec:\hbntnn.exe105⤵PID:3832
-
\??\c:\vvddv.exec:\vvddv.exe106⤵PID:3788
-
\??\c:\9rfxrrl.exec:\9rfxrrl.exe107⤵PID:2384
-
\??\c:\nbnnnn.exec:\nbnnnn.exe108⤵PID:4464
-
\??\c:\3pjjj.exec:\3pjjj.exe109⤵PID:3676
-
\??\c:\jdddd.exec:\jdddd.exe110⤵PID:4184
-
\??\c:\fffxrrr.exec:\fffxrrr.exe111⤵PID:404
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe112⤵PID:932
-
\??\c:\5hnntt.exec:\5hnntt.exe113⤵PID:4348
-
\??\c:\nntnnn.exec:\nntnnn.exe114⤵PID:4872
-
\??\c:\1jppj.exec:\1jppj.exe115⤵PID:1988
-
\??\c:\jdpjd.exec:\jdpjd.exe116⤵PID:1820
-
\??\c:\rrllrrr.exec:\rrllrrr.exe117⤵PID:4120
-
\??\c:\frxxxff.exec:\frxxxff.exe118⤵PID:1920
-
\??\c:\bhnttb.exec:\bhnttb.exe119⤵PID:4200
-
\??\c:\hnhnhh.exec:\hnhnhh.exe120⤵PID:1240
-
\??\c:\3btthn.exec:\3btthn.exe121⤵PID:1624
-
\??\c:\ppppv.exec:\ppppv.exe122⤵PID:1004
-
\??\c:\vpppj.exec:\vpppj.exe123⤵PID:1464
-
\??\c:\xrflfff.exec:\xrflfff.exe124⤵PID:4668
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe125⤵PID:3104
-
\??\c:\hbhhhn.exec:\hbhhhn.exe126⤵PID:1968
-
\??\c:\hbntbb.exec:\hbntbb.exe127⤵PID:1776
-
\??\c:\9pvpj.exec:\9pvpj.exe128⤵PID:2552
-
\??\c:\jpvvp.exec:\jpvvp.exe129⤵PID:4320
-
\??\c:\vpvvv.exec:\vpvvv.exe130⤵PID:4856
-
\??\c:\fffxxff.exec:\fffxxff.exe131⤵PID:3272
-
\??\c:\hhhhhn.exec:\hhhhhn.exe132⤵PID:3904
-
\??\c:\tbnnnn.exec:\tbnnnn.exe133⤵PID:836
-
\??\c:\dpvvv.exec:\dpvvv.exe134⤵PID:4204
-
\??\c:\dvvvj.exec:\dvvvj.exe135⤵PID:2260
-
\??\c:\xlrrrrx.exec:\xlrrrrx.exe136⤵PID:1176
-
\??\c:\fflllxl.exec:\fflllxl.exe137⤵PID:4472
-
\??\c:\lxxffff.exec:\lxxffff.exe138⤵PID:828
-
\??\c:\tthhtb.exec:\tthhtb.exe139⤵PID:1752
-
\??\c:\3tbbbb.exec:\3tbbbb.exe140⤵PID:3780
-
\??\c:\pdppp.exec:\pdppp.exe141⤵PID:4484
-
\??\c:\dpvpj.exec:\dpvpj.exe142⤵PID:968
-
\??\c:\3xxxxlr.exec:\3xxxxlr.exe143⤵PID:3552
-
\??\c:\rrllfff.exec:\rrllfff.exe144⤵PID:1472
-
\??\c:\bbhhbh.exec:\bbhhbh.exe145⤵PID:516
-
\??\c:\nthbtb.exec:\nthbtb.exe146⤵PID:4832
-
\??\c:\9pppj.exec:\9pppj.exe147⤵PID:4064
-
\??\c:\1llllrl.exec:\1llllrl.exe148⤵PID:1448
-
\??\c:\hbhhhn.exec:\hbhhhn.exe149⤵PID:3148
-
\??\c:\9btbhn.exec:\9btbhn.exe150⤵PID:1676
-
\??\c:\pjjjd.exec:\pjjjd.exe151⤵PID:3676
-
\??\c:\vpddd.exec:\vpddd.exe152⤵PID:4196
-
\??\c:\frxflrr.exec:\frxflrr.exe153⤵PID:4308
-
\??\c:\3rxxxxx.exec:\3rxxxxx.exe154⤵PID:4208
-
\??\c:\hbnbbb.exec:\hbnbbb.exe155⤵PID:3980
-
\??\c:\nhbhhn.exec:\nhbhhn.exe156⤵PID:1796
-
\??\c:\vpvjd.exec:\vpvjd.exe157⤵PID:4244
-
\??\c:\vpddv.exec:\vpddv.exe158⤵PID:1960
-
\??\c:\lflrlrl.exec:\lflrlrl.exe159⤵PID:1196
-
\??\c:\tthnbb.exec:\tthnbb.exe160⤵PID:2688
-
\??\c:\9djdd.exec:\9djdd.exe161⤵PID:1028
-
\??\c:\jppdv.exec:\jppdv.exe162⤵PID:1464
-
\??\c:\xxxxfll.exec:\xxxxfll.exe163⤵PID:2724
-
\??\c:\bthhhn.exec:\bthhhn.exe164⤵PID:1272
-
\??\c:\bthhbb.exec:\bthhbb.exe165⤵PID:2508
-
\??\c:\1pvvp.exec:\1pvvp.exe166⤵PID:2796
-
\??\c:\rrxxffl.exec:\rrxxffl.exe167⤵PID:4316
-
\??\c:\rrrxrxx.exec:\rrrxrxx.exe168⤵PID:4392
-
\??\c:\tnhhhh.exec:\tnhhhh.exe169⤵PID:2044
-
\??\c:\bnhntt.exec:\bnhntt.exe170⤵PID:2472
-
\??\c:\jjjpj.exec:\jjjpj.exe171⤵PID:3232
-
\??\c:\7jjpj.exec:\7jjpj.exe172⤵PID:4752
-
\??\c:\9lfffll.exec:\9lfffll.exe173⤵PID:444
-
\??\c:\llrxxfx.exec:\llrxxfx.exe174⤵PID:3252
-
\??\c:\9bhhnn.exec:\9bhhnn.exe175⤵PID:856
-
\??\c:\btbbbh.exec:\btbbbh.exe176⤵PID:1168
-
\??\c:\vvjjj.exec:\vvjjj.exe177⤵PID:1800
-
\??\c:\1dddd.exec:\1dddd.exe178⤵PID:4652
-
\??\c:\pvddv.exec:\pvddv.exe179⤵PID:1736
-
\??\c:\1flllll.exec:\1flllll.exe180⤵PID:4676
-
\??\c:\bhhhbb.exec:\bhhhbb.exe181⤵PID:5096
-
\??\c:\tttnnb.exec:\tttnnb.exe182⤵PID:3328
-
\??\c:\ppvjj.exec:\ppvjj.exe183⤵PID:4576
-
\??\c:\frrlfff.exec:\frrlfff.exe184⤵PID:1556
-
\??\c:\bthhhn.exec:\bthhhn.exe185⤵PID:4832
-
\??\c:\rxllrxf.exec:\rxllrxf.exe186⤵PID:4824
-
\??\c:\flfffff.exec:\flfffff.exe187⤵PID:2384
-
\??\c:\nnbbnn.exec:\nnbbnn.exe188⤵PID:4188
-
\??\c:\3vddj.exec:\3vddj.exe189⤵PID:3800
-
\??\c:\rlfxlfr.exec:\rlfxlfr.exe190⤵PID:404
-
\??\c:\bnnnhn.exec:\bnnnhn.exe191⤵PID:4056
-
\??\c:\1htbtb.exec:\1htbtb.exe192⤵PID:4308
-
\??\c:\jpppj.exec:\jpppj.exe193⤵PID:4180
-
\??\c:\pvjpp.exec:\pvjpp.exe194⤵PID:3980
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe195⤵PID:2852
-
\??\c:\xxrfrrf.exec:\xxrfrrf.exe196⤵PID:3812
-
\??\c:\3rxffff.exec:\3rxffff.exe197⤵PID:3976
-
\??\c:\ttbbbh.exec:\ttbbbh.exe198⤵PID:1652
-
\??\c:\7bbbtt.exec:\7bbbtt.exe199⤵PID:2988
-
\??\c:\3pppj.exec:\3pppj.exe200⤵PID:2784
-
\??\c:\vpppp.exec:\vpppp.exe201⤵PID:1416
-
\??\c:\ddppp.exec:\ddppp.exe202⤵PID:2908
-
\??\c:\fflflrf.exec:\fflflrf.exe203⤵PID:4324
-
\??\c:\5rfflrf.exec:\5rfflrf.exe204⤵PID:2692
-
\??\c:\ntttnn.exec:\ntttnn.exe205⤵PID:4772
-
\??\c:\thnntt.exec:\thnntt.exe206⤵PID:3040
-
\??\c:\vppdd.exec:\vppdd.exe207⤵PID:2800
-
\??\c:\vvvvv.exec:\vvvvv.exe208⤵PID:4376
-
\??\c:\vpvvp.exec:\vpvvp.exe209⤵PID:3904
-
\??\c:\xxfxrff.exec:\xxfxrff.exe210⤵PID:2088
-
\??\c:\rfllrrr.exec:\rfllrrr.exe211⤵PID:1380
-
\??\c:\hhhhhn.exec:\hhhhhn.exe212⤵PID:3252
-
\??\c:\3ttttt.exec:\3ttttt.exe213⤵PID:4876
-
\??\c:\vpddp.exec:\vpddp.exe214⤵PID:900
-
\??\c:\jdvpp.exec:\jdvpp.exe215⤵PID:976
-
\??\c:\ppvpj.exec:\ppvpj.exe216⤵PID:4900
-
\??\c:\xxxxlrl.exec:\xxxxlrl.exe217⤵PID:2264
-
\??\c:\xlxfffl.exec:\xlxfffl.exe218⤵PID:2496
-
\??\c:\hntbth.exec:\hntbth.exe219⤵PID:5096
-
\??\c:\bhttnn.exec:\bhttnn.exe220⤵PID:516
-
\??\c:\hbnnhh.exec:\hbnnhh.exe221⤵PID:4960
-
\??\c:\vpvvv.exec:\vpvvv.exe222⤵PID:4064
-
\??\c:\pvjpj.exec:\pvjpj.exe223⤵PID:1448
-
\??\c:\jjvvp.exec:\jjvvp.exe224⤵PID:2144
-
\??\c:\ffrlfff.exec:\ffrlfff.exe225⤵PID:4852
-
\??\c:\ffxxffx.exec:\ffxxffx.exe226⤵PID:3984
-
\??\c:\tbbhhh.exec:\tbbhhh.exe227⤵PID:4196
-
\??\c:\htbbnt.exec:\htbbnt.exe228⤵PID:4052
-
\??\c:\1jjdv.exec:\1jjdv.exe229⤵PID:4488
-
\??\c:\1xxrlrr.exec:\1xxrlrr.exe230⤵PID:3112
-
\??\c:\bbnhhb.exec:\bbnhhb.exe231⤵PID:1820
-
\??\c:\tnbhhn.exec:\tnbhhn.exe232⤵PID:436
-
\??\c:\5bttnn.exec:\5bttnn.exe233⤵PID:5084
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe234⤵PID:2980
-
\??\c:\xllrrxx.exec:\xllrrxx.exe235⤵PID:564
-
\??\c:\bnbbtt.exec:\bnbbtt.exe236⤵PID:3992
-
\??\c:\tbttbb.exec:\tbttbb.exe237⤵PID:1568
-
\??\c:\5pjjd.exec:\5pjjd.exe238⤵PID:1004
-
\??\c:\dddvv.exec:\dddvv.exe239⤵PID:3632
-
\??\c:\vpppp.exec:\vpppp.exe240⤵PID:3104
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe241⤵PID:744
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe242⤵PID:5020