Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
45fb6d1618564ab60ecd1885d7691129.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
45fb6d1618564ab60ecd1885d7691129.exe
-
Size
86KB
-
MD5
45fb6d1618564ab60ecd1885d7691129
-
SHA1
924fe2a20095f71c1468a80b3c914cfcf7522284
-
SHA256
558d573492cd5f8ab83b9f1e46c467b4695f1d4d627a26eee6e84c3f7f9bd3b2
-
SHA512
b59bce56b100bbaf3d3d432e9d7e609485f1a1dc1d9e87114e8e270eb9f1036aab3112484e02890b1d144a82b3c1eda9e66bd84546ed96538d37c5442de54078
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2iJvRirE0DmmdL2jqWkj:ymb3NkkiQ3mdBjF+3TU2iBRioSumWs
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral2/memory/4580-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1096-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1096-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1808-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1304-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-187-0x0000000000550000-0x000000000055C000-memory.dmp family_blackmoon behavioral2/memory/2752-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1896-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1192-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-334-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-358-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-362-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/832-376-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-400-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4720 3flxrlf.exe 2848 5vdvj.exe 3728 3ntbbt.exe 1096 lrlrlrl.exe 4776 btntbh.exe 5004 xxrllfr.exe 3008 btnhnt.exe 3640 lxxlrff.exe 1672 hbbbtt.exe 1808 7dvdp.exe 1304 nnhtnh.exe 4520 fxxlffl.exe 2992 9bbhhh.exe 3228 1pddv.exe 4744 bnbbnh.exe 3588 9ffrlff.exe 3140 hbbtnt.exe 4220 5fffxxx.exe 2416 thnnhh.exe 2368 vddvj.exe 3400 9hhhtn.exe 3848 xlrfrrf.exe 4148 jjppv.exe 4572 1rrlflf.exe 2752 jjppp.exe 388 lllrfxl.exe 4772 bnhtnh.exe 1728 llxxflx.exe 1476 hnbnbb.exe 1752 pjvpp.exe 1336 ntttnn.exe 1896 xflfffx.exe 4360 ttthnb.exe 920 ddjdp.exe 1192 xlrxxrx.exe 4696 nhbnbn.exe 1700 jdvpd.exe 3728 1bnntb.exe 4312 lfllfll.exe 4624 htbbhh.exe 2160 3ttbtb.exe 2964 frxlfrl.exe 3676 jvvpp.exe 2940 lfxrlfr.exe 3640 5tbntb.exe 864 5vpjv.exe 1480 rlrlffl.exe 3440 vpvvp.exe 1216 hhnnhb.exe 5100 dpdjj.exe 1492 3rlflxr.exe 1648 vpjdp.exe 2444 ddvpd.exe 4336 bhnttb.exe 1944 dvddd.exe 3212 xxlrflx.exe 1992 fxflflf.exe 844 hhnhtb.exe 4220 rlxxxll.exe 1460 3jjjd.exe 3904 hhnnhn.exe 832 jdpjv.exe 1356 bnhbtn.exe 2948 dppjd.exe -
resource yara_rule behavioral2/memory/4580-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1096-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1096-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1808-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1896-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1192-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1192-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-334-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-358-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-362-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/832-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-388-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-400-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 4720 4580 45fb6d1618564ab60ecd1885d7691129.exe 87 PID 4580 wrote to memory of 4720 4580 45fb6d1618564ab60ecd1885d7691129.exe 87 PID 4580 wrote to memory of 4720 4580 45fb6d1618564ab60ecd1885d7691129.exe 87 PID 4720 wrote to memory of 2848 4720 3flxrlf.exe 88 PID 4720 wrote to memory of 2848 4720 3flxrlf.exe 88 PID 4720 wrote to memory of 2848 4720 3flxrlf.exe 88 PID 2848 wrote to memory of 3728 2848 5vdvj.exe 89 PID 2848 wrote to memory of 3728 2848 5vdvj.exe 89 PID 2848 wrote to memory of 3728 2848 5vdvj.exe 89 PID 3728 wrote to memory of 1096 3728 3ntbbt.exe 90 PID 3728 wrote to memory of 1096 3728 3ntbbt.exe 90 PID 3728 wrote to memory of 1096 3728 3ntbbt.exe 90 PID 1096 wrote to memory of 4776 1096 lrlrlrl.exe 91 PID 1096 wrote to memory of 4776 1096 lrlrlrl.exe 91 PID 1096 wrote to memory of 4776 1096 lrlrlrl.exe 91 PID 4776 wrote to memory of 5004 4776 btntbh.exe 92 PID 4776 wrote to memory of 5004 4776 btntbh.exe 92 PID 4776 wrote to memory of 5004 4776 btntbh.exe 92 PID 5004 wrote to memory of 3008 5004 xxrllfr.exe 93 PID 5004 wrote to memory of 3008 5004 xxrllfr.exe 93 PID 5004 wrote to memory of 3008 5004 xxrllfr.exe 93 PID 3008 wrote to memory of 3640 3008 btnhnt.exe 94 PID 3008 wrote to memory of 3640 3008 btnhnt.exe 94 PID 3008 wrote to memory of 3640 3008 btnhnt.exe 94 PID 3640 wrote to memory of 1672 3640 lxxlrff.exe 96 PID 3640 wrote to memory of 1672 3640 lxxlrff.exe 96 PID 3640 wrote to memory of 1672 3640 lxxlrff.exe 96 PID 1672 wrote to memory of 1808 1672 hbbbtt.exe 97 PID 1672 wrote to memory of 1808 1672 hbbbtt.exe 97 PID 1672 wrote to memory of 1808 1672 hbbbtt.exe 97 PID 1808 wrote to memory of 1304 1808 7dvdp.exe 98 PID 1808 wrote to memory of 1304 1808 7dvdp.exe 98 PID 1808 wrote to memory of 1304 1808 7dvdp.exe 98 PID 1304 wrote to memory of 4520 1304 nnhtnh.exe 99 PID 1304 wrote to memory of 4520 1304 nnhtnh.exe 99 PID 1304 wrote to memory of 4520 1304 nnhtnh.exe 99 PID 4520 wrote to memory of 2992 4520 fxxlffl.exe 100 PID 4520 wrote to memory of 2992 4520 fxxlffl.exe 100 PID 4520 wrote to memory of 2992 4520 fxxlffl.exe 100 PID 2992 wrote to memory of 3228 2992 9bbhhh.exe 101 PID 2992 wrote to memory of 3228 2992 9bbhhh.exe 101 PID 2992 wrote to memory of 3228 2992 9bbhhh.exe 101 PID 3228 wrote to memory of 4744 3228 1pddv.exe 102 PID 3228 wrote to memory of 4744 3228 1pddv.exe 102 PID 3228 wrote to memory of 4744 3228 1pddv.exe 102 PID 4744 wrote to memory of 3588 4744 bnbbnh.exe 103 PID 4744 wrote to memory of 3588 4744 bnbbnh.exe 103 PID 4744 wrote to memory of 3588 4744 bnbbnh.exe 103 PID 3588 wrote to memory of 3140 3588 9ffrlff.exe 104 PID 3588 wrote to memory of 3140 3588 9ffrlff.exe 104 PID 3588 wrote to memory of 3140 3588 9ffrlff.exe 104 PID 3140 wrote to memory of 4220 3140 hbbtnt.exe 105 PID 3140 wrote to memory of 4220 3140 hbbtnt.exe 105 PID 3140 wrote to memory of 4220 3140 hbbtnt.exe 105 PID 4220 wrote to memory of 2416 4220 5fffxxx.exe 106 PID 4220 wrote to memory of 2416 4220 5fffxxx.exe 106 PID 4220 wrote to memory of 2416 4220 5fffxxx.exe 106 PID 2416 wrote to memory of 2368 2416 thnnhh.exe 107 PID 2416 wrote to memory of 2368 2416 thnnhh.exe 107 PID 2416 wrote to memory of 2368 2416 thnnhh.exe 107 PID 2368 wrote to memory of 3400 2368 vddvj.exe 108 PID 2368 wrote to memory of 3400 2368 vddvj.exe 108 PID 2368 wrote to memory of 3400 2368 vddvj.exe 108 PID 3400 wrote to memory of 3848 3400 9hhhtn.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\45fb6d1618564ab60ecd1885d7691129.exe"C:\Users\Admin\AppData\Local\Temp\45fb6d1618564ab60ecd1885d7691129.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\3flxrlf.exec:\3flxrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\5vdvj.exec:\5vdvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\3ntbbt.exec:\3ntbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\lrlrlrl.exec:\lrlrlrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\btntbh.exec:\btntbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\xxrllfr.exec:\xxrllfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\btnhnt.exec:\btnhnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\lxxlrff.exec:\lxxlrff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\hbbbtt.exec:\hbbbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\7dvdp.exec:\7dvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\nnhtnh.exec:\nnhtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\fxxlffl.exec:\fxxlffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\9bbhhh.exec:\9bbhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\1pddv.exec:\1pddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\bnbbnh.exec:\bnbbnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\9ffrlff.exec:\9ffrlff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\hbbtnt.exec:\hbbtnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\5fffxxx.exec:\5fffxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\thnnhh.exec:\thnnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\vddvj.exec:\vddvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\9hhhtn.exec:\9hhhtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\xlrfrrf.exec:\xlrfrrf.exe23⤵
- Executes dropped EXE
PID:3848 -
\??\c:\jjppv.exec:\jjppv.exe24⤵
- Executes dropped EXE
PID:4148 -
\??\c:\1rrlflf.exec:\1rrlflf.exe25⤵
- Executes dropped EXE
PID:4572 -
\??\c:\jjppp.exec:\jjppp.exe26⤵
- Executes dropped EXE
PID:2752 -
\??\c:\lllrfxl.exec:\lllrfxl.exe27⤵
- Executes dropped EXE
PID:388 -
\??\c:\bnhtnh.exec:\bnhtnh.exe28⤵
- Executes dropped EXE
PID:4772 -
\??\c:\llxxflx.exec:\llxxflx.exe29⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hnbnbb.exec:\hnbnbb.exe30⤵
- Executes dropped EXE
PID:1476 -
\??\c:\pjvpp.exec:\pjvpp.exe31⤵
- Executes dropped EXE
PID:1752 -
\??\c:\ntttnn.exec:\ntttnn.exe32⤵
- Executes dropped EXE
PID:1336 -
\??\c:\xflfffx.exec:\xflfffx.exe33⤵
- Executes dropped EXE
PID:1896 -
\??\c:\ttthnb.exec:\ttthnb.exe34⤵
- Executes dropped EXE
PID:4360 -
\??\c:\ddjdp.exec:\ddjdp.exe35⤵
- Executes dropped EXE
PID:920 -
\??\c:\vvvvp.exec:\vvvvp.exe36⤵PID:468
-
\??\c:\xlrxxrx.exec:\xlrxxrx.exe37⤵
- Executes dropped EXE
PID:1192 -
\??\c:\nhbnbn.exec:\nhbnbn.exe38⤵
- Executes dropped EXE
PID:4696 -
\??\c:\jdvpd.exec:\jdvpd.exe39⤵
- Executes dropped EXE
PID:1700 -
\??\c:\1bnntb.exec:\1bnntb.exe40⤵
- Executes dropped EXE
PID:3728 -
\??\c:\lfllfll.exec:\lfllfll.exe41⤵
- Executes dropped EXE
PID:4312 -
\??\c:\htbbhh.exec:\htbbhh.exe42⤵
- Executes dropped EXE
PID:4624 -
\??\c:\3ttbtb.exec:\3ttbtb.exe43⤵
- Executes dropped EXE
PID:2160 -
\??\c:\frxlfrl.exec:\frxlfrl.exe44⤵
- Executes dropped EXE
PID:2964 -
\??\c:\jvvpp.exec:\jvvpp.exe45⤵
- Executes dropped EXE
PID:3676 -
\??\c:\lfxrlfr.exec:\lfxrlfr.exe46⤵
- Executes dropped EXE
PID:2940 -
\??\c:\5tbntb.exec:\5tbntb.exe47⤵
- Executes dropped EXE
PID:3640 -
\??\c:\5vpjv.exec:\5vpjv.exe48⤵
- Executes dropped EXE
PID:864 -
\??\c:\rlrlffl.exec:\rlrlffl.exe49⤵
- Executes dropped EXE
PID:1480 -
\??\c:\vpvvp.exec:\vpvvp.exe50⤵
- Executes dropped EXE
PID:3440 -
\??\c:\hhnnhb.exec:\hhnnhb.exe51⤵
- Executes dropped EXE
PID:1216 -
\??\c:\dpdjj.exec:\dpdjj.exe52⤵
- Executes dropped EXE
PID:5100 -
\??\c:\3rlflxr.exec:\3rlflxr.exe53⤵
- Executes dropped EXE
PID:1492 -
\??\c:\vpjdp.exec:\vpjdp.exe54⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ddvpd.exec:\ddvpd.exe55⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bhnttb.exec:\bhnttb.exe56⤵
- Executes dropped EXE
PID:4336 -
\??\c:\dvddd.exec:\dvddd.exe57⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xxlrflx.exec:\xxlrflx.exe58⤵
- Executes dropped EXE
PID:3212 -
\??\c:\fxflflf.exec:\fxflflf.exe59⤵
- Executes dropped EXE
PID:1992 -
\??\c:\hhnhtb.exec:\hhnhtb.exe60⤵
- Executes dropped EXE
PID:844 -
\??\c:\rlxxxll.exec:\rlxxxll.exe61⤵
- Executes dropped EXE
PID:4220 -
\??\c:\3jjjd.exec:\3jjjd.exe62⤵
- Executes dropped EXE
PID:1460 -
\??\c:\hhnnhn.exec:\hhnnhn.exe63⤵
- Executes dropped EXE
PID:3904 -
\??\c:\jdpjv.exec:\jdpjv.exe64⤵
- Executes dropped EXE
PID:832 -
\??\c:\bnhbtn.exec:\bnhbtn.exe65⤵
- Executes dropped EXE
PID:1356 -
\??\c:\dppjd.exec:\dppjd.exe66⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rrlllrr.exec:\rrlllrr.exe67⤵PID:3700
-
\??\c:\nnhhbb.exec:\nnhhbb.exe68⤵PID:3704
-
\??\c:\rllfrlr.exec:\rllfrlr.exe69⤵PID:1220
-
\??\c:\bntttt.exec:\bntttt.exe70⤵PID:4556
-
\??\c:\5jdpd.exec:\5jdpd.exe71⤵PID:4680
-
\??\c:\thnhhb.exec:\thnhhb.exe72⤵PID:2320
-
\??\c:\rffrflf.exec:\rffrflf.exe73⤵PID:5088
-
\??\c:\nhhthb.exec:\nhhthb.exe74⤵PID:4512
-
\??\c:\pdjjd.exec:\pdjjd.exe75⤵PID:4880
-
\??\c:\dvvvv.exec:\dvvvv.exe76⤵PID:2244
-
\??\c:\nnttnt.exec:\nnttnt.exe77⤵PID:1752
-
\??\c:\jddvj.exec:\jddvj.exe78⤵PID:4800
-
\??\c:\rffrffr.exec:\rffrffr.exe79⤵PID:5064
-
\??\c:\lxxlrff.exec:\lxxlrff.exe80⤵PID:2316
-
\??\c:\frxrrxf.exec:\frxrrxf.exe81⤵PID:872
-
\??\c:\jddvd.exec:\jddvd.exe82⤵PID:1056
-
\??\c:\7flfrlf.exec:\7flfrlf.exe83⤵PID:3524
-
\??\c:\pjdpj.exec:\pjdpj.exe84⤵PID:4356
-
\??\c:\xrlxrlf.exec:\xrlxrlf.exe85⤵PID:3240
-
\??\c:\ntnnhn.exec:\ntnnhn.exe86⤵PID:1196
-
\??\c:\rxxxflr.exec:\rxxxflr.exe87⤵PID:1588
-
\??\c:\btnbhb.exec:\btnbhb.exe88⤵PID:4624
-
\??\c:\pvvvj.exec:\pvvvj.exe89⤵PID:972
-
\??\c:\5rfxlfr.exec:\5rfxlfr.exe90⤵PID:3608
-
\??\c:\3ppjd.exec:\3ppjd.exe91⤵PID:4760
-
\??\c:\xfllfrr.exec:\xfllfrr.exe92⤵PID:3284
-
\??\c:\bthhbt.exec:\bthhbt.exe93⤵PID:1824
-
\??\c:\pjdvv.exec:\pjdvv.exe94⤵PID:1964
-
\??\c:\7xfxlxr.exec:\7xfxlxr.exe95⤵PID:3696
-
\??\c:\pjdvj.exec:\pjdvj.exe96⤵PID:1524
-
\??\c:\9frxlrx.exec:\9frxlrx.exe97⤵PID:1536
-
\??\c:\dvvdd.exec:\dvvdd.exe98⤵PID:4404
-
\??\c:\frxfxfl.exec:\frxfxfl.exe99⤵PID:1176
-
\??\c:\pjpjp.exec:\pjpjp.exe100⤵PID:2056
-
\??\c:\9frxxfr.exec:\9frxxfr.exe101⤵PID:3264
-
\??\c:\bttbbb.exec:\bttbbb.exe102⤵PID:1376
-
\??\c:\frlxlxl.exec:\frlxlxl.exe103⤵PID:2580
-
\??\c:\hntbbh.exec:\hntbbh.exe104⤵PID:1676
-
\??\c:\dpjdv.exec:\dpjdv.exe105⤵PID:1320
-
\??\c:\bhbbtt.exec:\bhbbtt.exe106⤵PID:4232
-
\??\c:\dpjdp.exec:\dpjdp.exe107⤵PID:940
-
\??\c:\bhtbbn.exec:\bhtbbn.exe108⤵PID:5012
-
\??\c:\dddpd.exec:\dddpd.exe109⤵PID:1576
-
\??\c:\xxlxlfx.exec:\xxlxlfx.exe110⤵PID:1048
-
\??\c:\9nbbbb.exec:\9nbbbb.exe111⤵PID:4596
-
\??\c:\jpjdp.exec:\jpjdp.exe112⤵PID:4028
-
\??\c:\rlfrfrl.exec:\rlfrfrl.exe113⤵PID:3124
-
\??\c:\9ttbtn.exec:\9ttbtn.exe114⤵PID:2120
-
\??\c:\9lxfrrl.exec:\9lxfrrl.exe115⤵PID:4988
-
\??\c:\tbtnbh.exec:\tbtnbh.exe116⤵PID:4376
-
\??\c:\vppdp.exec:\vppdp.exe117⤵PID:2348
-
\??\c:\lxxllfx.exec:\lxxllfx.exe118⤵PID:3756
-
\??\c:\pjdpj.exec:\pjdpj.exe119⤵PID:4672
-
\??\c:\7llfxxx.exec:\7llfxxx.exe120⤵PID:4880
-
\??\c:\hnnhbb.exec:\hnnhbb.exe121⤵PID:1832
-
\??\c:\rrxxrfx.exec:\rrxxrfx.exe122⤵PID:3104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-