Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 13:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b4c618e8cab5807bc899c1f542639cc9.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
b4c618e8cab5807bc899c1f542639cc9.exe
-
Size
474KB
-
MD5
b4c618e8cab5807bc899c1f542639cc9
-
SHA1
e5a9dbc15cd5cf127aa33cd6aec59ba107b53ada
-
SHA256
81e229d1e03a996f0ab7404eeafdd357a22dd8e4a2cda9134d07a293df212850
-
SHA512
3553adda8709c553f1a7a593f18a5306ededac741cd71160045ae998e3f4b6662b809be3e60dad858c1cca7008f71baea41912626e0c11814b278818b9191443
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93svqTP+E4QJP:n3C9yMo+S0L9xRnoq7H9QYJxP
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral2/memory/3536-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4236-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/632-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2812-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3832-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/508-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-344-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-375-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-382-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1676 vpddj.exe 1548 bntthn.exe 2828 rflxxxl.exe 3540 ffxxrrr.exe 4800 lxfxrrl.exe 4944 vvjjd.exe 5108 nbbttn.exe 3504 xrlllll.exe 816 hhnhhh.exe 2992 frxrrrl.exe 2928 hhnhbt.exe 4952 rrlfxxf.exe 748 jdvpj.exe 3132 hhbttt.exe 3732 jvddv.exe 3428 1jdvj.exe 4372 tnhbtn.exe 3388 jvvdd.exe 4236 nhnnhn.exe 404 rrxrrrr.exe 1180 7bnnbb.exe 1752 hhbttn.exe 2520 fffrfrl.exe 3116 jvdpj.exe 2652 bttnbb.exe 2400 fflfxxx.exe 2512 rrfxrrx.exe 2488 9vppv.exe 632 1nhbtn.exe 448 9rrlfff.exe 4428 pppjv.exe 2484 jppdv.exe 2812 ntbtnn.exe 2456 3pvvp.exe 216 5flffff.exe 3328 jddvj.exe 4052 9thbtn.exe 2796 dddvp.exe 2704 lxxrxxr.exe 4616 vdpjj.exe 1044 jdvdp.exe 2976 bnhhtn.exe 1432 7vvpd.exe 5116 hhnhnh.exe 3832 vdjjv.exe 3172 lflxfff.exe 528 dvvjv.exe 4364 3lllxxr.exe 4952 vvvjv.exe 748 xlrlrll.exe 1248 3nhnnh.exe 2912 rlflrxr.exe 3156 nttnbt.exe 3428 lxlxrrf.exe 508 7hhhbt.exe 1184 jvjjd.exe 3588 bnhhbh.exe 4424 rrxxlfl.exe 2272 9rrlrlr.exe 1928 vjddv.exe 4824 hbbtnn.exe 3320 dpdvj.exe 2880 rllrlxr.exe 544 7bhbtn.exe -
resource yara_rule behavioral2/memory/3536-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2652-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2812-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2812-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3832-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3832-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/508-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-344-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-349-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-375-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-379-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-382-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3536 wrote to memory of 1676 3536 b4c618e8cab5807bc899c1f542639cc9.exe 88 PID 3536 wrote to memory of 1676 3536 b4c618e8cab5807bc899c1f542639cc9.exe 88 PID 3536 wrote to memory of 1676 3536 b4c618e8cab5807bc899c1f542639cc9.exe 88 PID 1676 wrote to memory of 1548 1676 vpddj.exe 89 PID 1676 wrote to memory of 1548 1676 vpddj.exe 89 PID 1676 wrote to memory of 1548 1676 vpddj.exe 89 PID 1548 wrote to memory of 2828 1548 bntthn.exe 90 PID 1548 wrote to memory of 2828 1548 bntthn.exe 90 PID 1548 wrote to memory of 2828 1548 bntthn.exe 90 PID 2828 wrote to memory of 3540 2828 rflxxxl.exe 91 PID 2828 wrote to memory of 3540 2828 rflxxxl.exe 91 PID 2828 wrote to memory of 3540 2828 rflxxxl.exe 91 PID 3540 wrote to memory of 4800 3540 ffxxrrr.exe 92 PID 3540 wrote to memory of 4800 3540 ffxxrrr.exe 92 PID 3540 wrote to memory of 4800 3540 ffxxrrr.exe 92 PID 4800 wrote to memory of 4944 4800 lxfxrrl.exe 93 PID 4800 wrote to memory of 4944 4800 lxfxrrl.exe 93 PID 4800 wrote to memory of 4944 4800 lxfxrrl.exe 93 PID 4944 wrote to memory of 5108 4944 vvjjd.exe 94 PID 4944 wrote to memory of 5108 4944 vvjjd.exe 94 PID 4944 wrote to memory of 5108 4944 vvjjd.exe 94 PID 5108 wrote to memory of 3504 5108 nbbttn.exe 95 PID 5108 wrote to memory of 3504 5108 nbbttn.exe 95 PID 5108 wrote to memory of 3504 5108 nbbttn.exe 95 PID 3504 wrote to memory of 816 3504 xrlllll.exe 96 PID 3504 wrote to memory of 816 3504 xrlllll.exe 96 PID 3504 wrote to memory of 816 3504 xrlllll.exe 96 PID 816 wrote to memory of 2992 816 hhnhhh.exe 97 PID 816 wrote to memory of 2992 816 hhnhhh.exe 97 PID 816 wrote to memory of 2992 816 hhnhhh.exe 97 PID 2992 wrote to memory of 2928 2992 frxrrrl.exe 98 PID 2992 wrote to memory of 2928 2992 frxrrrl.exe 98 PID 2992 wrote to memory of 2928 2992 frxrrrl.exe 98 PID 2928 wrote to memory of 4952 2928 hhnhbt.exe 99 PID 2928 wrote to memory of 4952 2928 hhnhbt.exe 99 PID 2928 wrote to memory of 4952 2928 hhnhbt.exe 99 PID 4952 wrote to memory of 748 4952 rrlfxxf.exe 100 PID 4952 wrote to memory of 748 4952 rrlfxxf.exe 100 PID 4952 wrote to memory of 748 4952 rrlfxxf.exe 100 PID 748 wrote to memory of 3132 748 jdvpj.exe 101 PID 748 wrote to memory of 3132 748 jdvpj.exe 101 PID 748 wrote to memory of 3132 748 jdvpj.exe 101 PID 3132 wrote to memory of 3732 3132 hhbttt.exe 102 PID 3132 wrote to memory of 3732 3132 hhbttt.exe 102 PID 3132 wrote to memory of 3732 3132 hhbttt.exe 102 PID 3732 wrote to memory of 3428 3732 jvddv.exe 103 PID 3732 wrote to memory of 3428 3732 jvddv.exe 103 PID 3732 wrote to memory of 3428 3732 jvddv.exe 103 PID 3428 wrote to memory of 4372 3428 1jdvj.exe 104 PID 3428 wrote to memory of 4372 3428 1jdvj.exe 104 PID 3428 wrote to memory of 4372 3428 1jdvj.exe 104 PID 4372 wrote to memory of 3388 4372 tnhbtn.exe 105 PID 4372 wrote to memory of 3388 4372 tnhbtn.exe 105 PID 4372 wrote to memory of 3388 4372 tnhbtn.exe 105 PID 3388 wrote to memory of 4236 3388 jvvdd.exe 106 PID 3388 wrote to memory of 4236 3388 jvvdd.exe 106 PID 3388 wrote to memory of 4236 3388 jvvdd.exe 106 PID 4236 wrote to memory of 404 4236 nhnnhn.exe 107 PID 4236 wrote to memory of 404 4236 nhnnhn.exe 107 PID 4236 wrote to memory of 404 4236 nhnnhn.exe 107 PID 404 wrote to memory of 1180 404 rrxrrrr.exe 108 PID 404 wrote to memory of 1180 404 rrxrrrr.exe 108 PID 404 wrote to memory of 1180 404 rrxrrrr.exe 108 PID 1180 wrote to memory of 1752 1180 7bnnbb.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4c618e8cab5807bc899c1f542639cc9.exe"C:\Users\Admin\AppData\Local\Temp\b4c618e8cab5807bc899c1f542639cc9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\vpddj.exec:\vpddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\bntthn.exec:\bntthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\rflxxxl.exec:\rflxxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\ffxxrrr.exec:\ffxxrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\vvjjd.exec:\vvjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\nbbttn.exec:\nbbttn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\xrlllll.exec:\xrlllll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\hhnhhh.exec:\hhnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\frxrrrl.exec:\frxrrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\hhnhbt.exec:\hhnhbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\rrlfxxf.exec:\rrlfxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\jdvpj.exec:\jdvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\hhbttt.exec:\hhbttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\jvddv.exec:\jvddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\1jdvj.exec:\1jdvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\tnhbtn.exec:\tnhbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\jvvdd.exec:\jvvdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\nhnnhn.exec:\nhnnhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\7bnnbb.exec:\7bnnbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\hhbttn.exec:\hhbttn.exe23⤵
- Executes dropped EXE
PID:1752 -
\??\c:\fffrfrl.exec:\fffrfrl.exe24⤵
- Executes dropped EXE
PID:2520 -
\??\c:\jvdpj.exec:\jvdpj.exe25⤵
- Executes dropped EXE
PID:3116 -
\??\c:\bttnbb.exec:\bttnbb.exe26⤵
- Executes dropped EXE
PID:2652 -
\??\c:\fflfxxx.exec:\fflfxxx.exe27⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rrfxrrx.exec:\rrfxrrx.exe28⤵
- Executes dropped EXE
PID:2512 -
\??\c:\9vppv.exec:\9vppv.exe29⤵
- Executes dropped EXE
PID:2488 -
\??\c:\1nhbtn.exec:\1nhbtn.exe30⤵
- Executes dropped EXE
PID:632 -
\??\c:\9rrlfff.exec:\9rrlfff.exe31⤵
- Executes dropped EXE
PID:448 -
\??\c:\pppjv.exec:\pppjv.exe32⤵
- Executes dropped EXE
PID:4428 -
\??\c:\jppdv.exec:\jppdv.exe33⤵
- Executes dropped EXE
PID:2484 -
\??\c:\ntbtnn.exec:\ntbtnn.exe34⤵
- Executes dropped EXE
PID:2812 -
\??\c:\3pvvp.exec:\3pvvp.exe35⤵
- Executes dropped EXE
PID:2456 -
\??\c:\5flffff.exec:\5flffff.exe36⤵
- Executes dropped EXE
PID:216 -
\??\c:\jddvj.exec:\jddvj.exe37⤵
- Executes dropped EXE
PID:3328 -
\??\c:\9thbtn.exec:\9thbtn.exe38⤵
- Executes dropped EXE
PID:4052 -
\??\c:\dddvp.exec:\dddvp.exe39⤵
- Executes dropped EXE
PID:2796 -
\??\c:\lxxrxxr.exec:\lxxrxxr.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\vdpjj.exec:\vdpjj.exe41⤵
- Executes dropped EXE
PID:4616 -
\??\c:\jdvdp.exec:\jdvdp.exe42⤵
- Executes dropped EXE
PID:1044 -
\??\c:\bnhhtn.exec:\bnhhtn.exe43⤵
- Executes dropped EXE
PID:2976 -
\??\c:\7vvpd.exec:\7vvpd.exe44⤵
- Executes dropped EXE
PID:1432 -
\??\c:\hhnhnh.exec:\hhnhnh.exe45⤵
- Executes dropped EXE
PID:5116 -
\??\c:\vdjjv.exec:\vdjjv.exe46⤵
- Executes dropped EXE
PID:3832 -
\??\c:\lflxfff.exec:\lflxfff.exe47⤵
- Executes dropped EXE
PID:3172 -
\??\c:\dvvjv.exec:\dvvjv.exe48⤵
- Executes dropped EXE
PID:528 -
\??\c:\3lllxxr.exec:\3lllxxr.exe49⤵
- Executes dropped EXE
PID:4364 -
\??\c:\vvvjv.exec:\vvvjv.exe50⤵
- Executes dropped EXE
PID:4952 -
\??\c:\xlrlrll.exec:\xlrlrll.exe51⤵
- Executes dropped EXE
PID:748 -
\??\c:\3nhnnh.exec:\3nhnnh.exe52⤵
- Executes dropped EXE
PID:1248 -
\??\c:\rlflrxr.exec:\rlflrxr.exe53⤵
- Executes dropped EXE
PID:2912 -
\??\c:\nttnbt.exec:\nttnbt.exe54⤵
- Executes dropped EXE
PID:3156 -
\??\c:\lxlxrrf.exec:\lxlxrrf.exe55⤵
- Executes dropped EXE
PID:3428 -
\??\c:\7hhhbt.exec:\7hhhbt.exe56⤵
- Executes dropped EXE
PID:508 -
\??\c:\jvjjd.exec:\jvjjd.exe57⤵
- Executes dropped EXE
PID:1184 -
\??\c:\bnhhbh.exec:\bnhhbh.exe58⤵
- Executes dropped EXE
PID:3588 -
\??\c:\rrxxlfl.exec:\rrxxlfl.exe59⤵
- Executes dropped EXE
PID:4424 -
\??\c:\9rrlrlr.exec:\9rrlrlr.exe60⤵
- Executes dropped EXE
PID:2272 -
\??\c:\vjddv.exec:\vjddv.exe61⤵
- Executes dropped EXE
PID:1928 -
\??\c:\hbbtnn.exec:\hbbtnn.exe62⤵
- Executes dropped EXE
PID:4824 -
\??\c:\dpdvj.exec:\dpdvj.exe63⤵
- Executes dropped EXE
PID:3320 -
\??\c:\rllrlxr.exec:\rllrlxr.exe64⤵
- Executes dropped EXE
PID:2880 -
\??\c:\7bhbtn.exec:\7bhbtn.exe65⤵
- Executes dropped EXE
PID:544 -
\??\c:\xxxlxrl.exec:\xxxlxrl.exe66⤵PID:2608
-
\??\c:\hhbtnh.exec:\hhbtnh.exe67⤵PID:4500
-
\??\c:\lffxxxx.exec:\lffxxxx.exe68⤵PID:2612
-
\??\c:\bnnnnn.exec:\bnnnnn.exe69⤵PID:1656
-
\??\c:\fxxllll.exec:\fxxllll.exe70⤵PID:2488
-
\??\c:\nhbtnh.exec:\nhbtnh.exe71⤵PID:4720
-
\??\c:\lrlxrxr.exec:\lrlxrxr.exe72⤵PID:1952
-
\??\c:\7btnnh.exec:\7btnnh.exe73⤵PID:2996
-
\??\c:\jppjp.exec:\jppjp.exe74⤵PID:4428
-
\??\c:\9ffrfxr.exec:\9ffrfxr.exe75⤵PID:3924
-
\??\c:\bttbtn.exec:\bttbtn.exe76⤵PID:3996
-
\??\c:\dpdpd.exec:\dpdpd.exe77⤵PID:1596
-
\??\c:\9fffrxr.exec:\9fffrxr.exe78⤵PID:324
-
\??\c:\jdjvd.exec:\jdjvd.exe79⤵PID:4856
-
\??\c:\llfxxrl.exec:\llfxxrl.exe80⤵PID:3220
-
\??\c:\djjvv.exec:\djjvv.exe81⤵PID:992
-
\??\c:\rrffrrl.exec:\rrffrrl.exe82⤵PID:5108
-
\??\c:\vvpjd.exec:\vvpjd.exe83⤵PID:4696
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe84⤵PID:4416
-
\??\c:\thnnhn.exec:\thnnhn.exe85⤵PID:1992
-
\??\c:\pdjjp.exec:\pdjjp.exe86⤵PID:4912
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe87⤵PID:2476
-
\??\c:\pvvvp.exec:\pvvvp.exe88⤵PID:3124
-
\??\c:\bnnbnh.exec:\bnnbnh.exe89⤵PID:3916
-
\??\c:\frrlxlx.exec:\frrlxlx.exe90⤵PID:4772
-
\??\c:\ttthhh.exec:\ttthhh.exe91⤵PID:4952
-
\??\c:\ffrlrrr.exec:\ffrlrrr.exe92⤵PID:748
-
\??\c:\tnnhbt.exec:\tnnhbt.exe93⤵PID:1716
-
\??\c:\5rxrrrl.exec:\5rxrrrl.exe94⤵PID:4472
-
\??\c:\pvdvd.exec:\pvdvd.exe95⤵PID:1908
-
\??\c:\llxxrff.exec:\llxxrff.exe96⤵PID:720
-
\??\c:\djpdv.exec:\djpdv.exe97⤵PID:4176
-
\??\c:\5lrxrll.exec:\5lrxrll.exe98⤵PID:1144
-
\??\c:\ddvvp.exec:\ddvvp.exe99⤵PID:404
-
\??\c:\xlxrlff.exec:\xlxrlff.exe100⤵PID:3756
-
\??\c:\vpjdp.exec:\vpjdp.exe101⤵PID:1224
-
\??\c:\rfrlfxx.exec:\rfrlfxx.exe102⤵PID:3600
-
\??\c:\1ddvp.exec:\1ddvp.exe103⤵PID:3320
-
\??\c:\dvdvj.exec:\dvdvj.exe104⤵PID:1400
-
\??\c:\hhtnbb.exec:\hhtnbb.exe105⤵PID:4796
-
\??\c:\pjpjj.exec:\pjpjj.exe106⤵PID:2608
-
\??\c:\thhbtt.exec:\thhbtt.exe107⤵PID:4144
-
\??\c:\jjjpp.exec:\jjjpp.exe108⤵PID:4604
-
\??\c:\tttnhh.exec:\tttnhh.exe109⤵PID:676
-
\??\c:\jppjp.exec:\jppjp.exe110⤵PID:4480
-
\??\c:\bhhbbt.exec:\bhhbbt.exe111⤵PID:3532
-
\??\c:\jdjvv.exec:\jdjvv.exe112⤵PID:1972
-
\??\c:\fxrlffx.exec:\fxrlffx.exe113⤵PID:4512
-
\??\c:\btbtnn.exec:\btbtnn.exe114⤵PID:4896
-
\??\c:\7rlfxxr.exec:\7rlfxxr.exe115⤵PID:3272
-
\??\c:\7dddv.exec:\7dddv.exe116⤵PID:216
-
\??\c:\tbnbnh.exec:\tbnbnh.exe117⤵PID:2844
-
\??\c:\1nbtbb.exec:\1nbtbb.exe118⤵PID:324
-
\??\c:\rffrlrr.exec:\rffrlrr.exe119⤵PID:220
-
\??\c:\jvpjd.exec:\jvpjd.exe120⤵PID:4628
-
\??\c:\lfxrfff.exec:\lfxrfff.exe121⤵PID:992
-
\??\c:\httnhh.exec:\httnhh.exe122⤵PID:5108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-