Analysis
- max time kernel
149s - max time network
110s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 22:34
Behavioral task
behavioral1
Sample
4d5ea2027e761d42bb29d5d49ee647dc9dce3141f1b32acacbc22fe7030e463f.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
- Target 4d5ea2027e761d42bb29d5d49ee647dc9dce3141f1b32acacbc22fe7030e463f.exe
- Size 62KB
- Sample240519-2hch6aec86
- SHA256 4d5ea2027e761d42bb29d5d49ee647dc9dce3141f1b32acacbc22fe7030e463f
- MD5 d873afa1c12ff92eb38b063191b50d70
- SHA1 2aefede21ea7231cc95e2a58739f59451eacb135
- SHA512 07babfc56c863b1a616eb2270a27ff556d737cc758ffe84f3539aa9398f0e3b3c9d9e53e4a20d2375ac50f159de18608bcece4b3397cd78dba944bed0c1ceb55
- SSDEEP 1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+EMdH:zhOmTsF93UYfwC6GIoutiTWMdH
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3496-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3928-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1416-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/948-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/656-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1940-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1948-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1080-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2136-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3644-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2916-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2980-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3684-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2456-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/916-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2772-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1792-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3452-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2576-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4104-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2104-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1772-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1080-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3392-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3336-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3760-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1036-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3884-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1916-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/544-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2688-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3772-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2540-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/432-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2576-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4236-492-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1900-676-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1140-675-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-710-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/232-848-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2576-930-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4700 hnthbb.exe 116 xlrrrll.exe 3928 bttttt.exe 1408 vpdpv.exe 1416 rrlxlll.exe 4020 ntthbb.exe 948 dvppd.exe 656 xrlxfxf.exe 4580 rxfxflr.exe 1940 pjppj.exe 1948 9dddp.exe 2000 ffffxxx.exe 1080 nbnnnn.exe 2136 7jvpp.exe 3644 fxffllx.exe 2980 btttbb.exe 2916 vpppp.exe 2504 ddpdd.exe 4148 rfxllfx.exe 4932 hhtttt.exe 3684 vjvvv.exe 2456 ppdjj.exe 916 lxllrxx.exe 3008 ffxxlrf.exe 2908 htbhnb.exe 2220 pvjdv.exe 4144 rxllfxr.exe 2772 rxlfrrf.exe 3596 hnnbnh.exe 1420 vdjdj.exe 1792 frxlrxf.exe 468 nntbtb.exe 3180 btthtn.exe 1756 pjddd.exe 404 pdpdd.exe 4180 xfxllfx.exe 1976 xllfrlx.exe 4008 hnbhhn.exe 2960 jpdvd.exe 1924 djppd.exe 3156 xfrxxff.exe 4560 ttbbhn.exe 3452 tbbbbh.exe 3116 vvpvp.exe 3496 nbbbtt.exe 224 hbbttt.exe 2884 dvddp.exe 3892 3rfflrx.exe 4964 xflrllr.exe 2576 vpdvp.exe 4104 djpvp.exe 2928 xxxrrxr.exe 2104 tttnht.exe 2064 tbhnbn.exe 1996 vdjjj.exe 1772 fxrrrll.exe 1784 xlfxxxr.exe 4172 nthhnt.exe 840 jvvvj.exe 1056 9rffxfx.exe 1080 xfrlfxr.exe 3212 hnhnnn.exe 1044 pvdvp.exe 1608 5djdv.exe -
resource yara_rule behavioral2/memory/3496-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3496-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c0000000233da-3.dat upx behavioral2/files/0x0007000000023427-8.dat upx behavioral2/memory/4700-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/116-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-12.dat upx behavioral2/memory/116-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023429-19.dat upx behavioral2/memory/3928-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-24.dat upx behavioral2/memory/1416-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-28.dat upx behavioral2/files/0x000700000002342c-33.dat upx behavioral2/memory/4020-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-38.dat upx behavioral2/memory/948-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/656-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342e-43.dat upx behavioral2/files/0x000700000002342f-48.dat upx behavioral2/memory/4580-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023430-53.dat upx behavioral2/memory/1940-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-58.dat upx behavioral2/memory/1948-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023432-63.dat upx behavioral2/files/0x0007000000023433-67.dat upx behavioral2/memory/1080-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2136-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023434-74.dat upx behavioral2/files/0x0007000000023435-77.dat upx behavioral2/memory/3644-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023436-82.dat upx behavioral2/files/0x0007000000023437-88.dat upx behavioral2/memory/2916-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2980-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023438-92.dat upx behavioral2/memory/4148-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023439-97.dat upx behavioral2/memory/4932-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343a-102.dat upx behavioral2/memory/3684-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343b-106.dat upx behavioral2/memory/2456-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343c-113.dat upx behavioral2/memory/916-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343d-117.dat upx behavioral2/files/0x000700000002343e-121.dat upx behavioral2/memory/2908-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343f-126.dat upx behavioral2/files/0x0008000000023424-131.dat upx behavioral2/memory/4144-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023440-134.dat upx behavioral2/memory/2772-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2772-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023441-141.dat upx behavioral2/memory/3596-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023442-146.dat upx behavioral2/memory/1420-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023443-152.dat upx behavioral2/memory/1792-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023444-156.dat upx behavioral2/memory/404-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/404-168-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3496 wrote to memory of 4700 3496 4d5ea2027e761d42bb29d5d49ee647dc9dce3141f1b32acacbc22fe7030e463f.exe 83 PID 3496 wrote to memory of 4700 3496 4d5ea2027e761d42bb29d5d49ee647dc9dce3141f1b32acacbc22fe7030e463f.exe 83 PID 3496 wrote to memory of 4700 3496 4d5ea2027e761d42bb29d5d49ee647dc9dce3141f1b32acacbc22fe7030e463f.exe 83 PID 4700 wrote to memory of 116 4700 hnthbb.exe 84 PID 4700 wrote to memory of 116 4700 hnthbb.exe 84 PID 4700 wrote to memory of 116 4700 hnthbb.exe 84 PID 116 wrote to memory of 3928 116 xlrrrll.exe 85 PID 116 wrote to memory of 3928 116 xlrrrll.exe 85 PID 116 wrote to memory of 3928 116 xlrrrll.exe 85 PID 3928 wrote to memory of 1408 3928 bttttt.exe 86 PID 3928 wrote to memory of 1408 3928 bttttt.exe 86 PID 3928 wrote to memory of 1408 3928 bttttt.exe 86 PID 1408 wrote to memory of 1416 1408 vpdpv.exe 87 PID 1408 wrote to memory of 1416 1408 vpdpv.exe 87 PID 1408 wrote to memory of 1416 1408 vpdpv.exe 87 PID 1416 wrote to memory of 4020 1416 rrlxlll.exe 88 PID 1416 wrote to memory of 4020 1416 rrlxlll.exe 88 PID 1416 wrote to memory of 4020 1416 rrlxlll.exe 88 PID 4020 wrote to memory of 948 4020 ntthbb.exe 89 PID 4020 wrote to memory of 948 4020 ntthbb.exe 89 PID 4020 wrote to memory of 948 4020 ntthbb.exe 89 PID 948 wrote to memory of 656 948 dvppd.exe 90 PID 948 wrote to memory of 656 948 dvppd.exe 90 PID 948 wrote to memory of 656 948 dvppd.exe 90 PID 656 wrote to memory of 4580 656 xrlxfxf.exe 91 PID 656 wrote to memory of 4580 656 xrlxfxf.exe 91 PID 656 wrote to memory of 4580 656 xrlxfxf.exe 91 PID 4580 wrote to memory of 1940 4580 rxfxflr.exe 92 PID 4580 wrote to memory of 1940 4580 rxfxflr.exe 92 PID 4580 wrote to memory of 1940 4580 rxfxflr.exe 92 PID 1940 wrote to memory of 1948 1940 pjppj.exe 93 PID 1940 wrote to memory of 1948 1940 pjppj.exe 93 PID 1940 wrote to memory of 1948 1940 pjppj.exe 93 PID 1948 wrote to memory of 2000 1948 9dddp.exe 94 PID 1948 wrote to memory of 2000 1948 9dddp.exe 94 PID 1948 wrote to memory of 2000 1948 9dddp.exe 94 PID 2000 wrote to memory of 1080 2000 ffffxxx.exe 95 PID 2000 wrote to memory of 1080 2000 ffffxxx.exe 95 PID 2000 wrote to memory of 1080 2000 ffffxxx.exe 95 PID 1080 wrote to memory of 2136 1080 nbnnnn.exe 96 PID 1080 wrote to memory of 2136 1080 nbnnnn.exe 96 PID 1080 wrote to memory of 2136 1080 nbnnnn.exe 96 PID 2136 wrote to memory of 3644 2136 7jvpp.exe 97 PID 2136 wrote to memory of 3644 2136 7jvpp.exe 97 PID 2136 wrote to memory of 3644 2136 7jvpp.exe 97 PID 3644 wrote to memory of 2980 3644 fxffllx.exe 98 PID 3644 wrote to memory of 2980 3644 fxffllx.exe 98 PID 3644 wrote to memory of 2980 3644 fxffllx.exe 98 PID 2980 wrote to memory of 2916 2980 btttbb.exe 99 PID 2980 wrote to memory of 2916 2980 btttbb.exe 99 PID 2980 wrote to memory of 2916 2980 btttbb.exe 99 PID 2916 wrote to memory of 2504 2916 vpppp.exe 100 PID 2916 wrote to memory of 2504 2916 vpppp.exe 100 PID 2916 wrote to memory of 2504 2916 vpppp.exe 100 PID 2504 wrote to memory of 4148 2504 ddpdd.exe 101 PID 2504 wrote to memory of 4148 2504 ddpdd.exe 101 PID 2504 wrote to memory of 4148 2504 ddpdd.exe 101 PID 4148 wrote to memory of 4932 4148 rfxllfx.exe 102 PID 4148 wrote to memory of 4932 4148 rfxllfx.exe 102 PID 4148 wrote to memory of 4932 4148 rfxllfx.exe 102 PID 4932 wrote to memory of 3684 4932 hhtttt.exe 103 PID 4932 wrote to memory of 3684 4932 hhtttt.exe 103 PID 4932 wrote to memory of 3684 4932 hhtttt.exe 103 PID 3684 wrote to memory of 2456 3684 vjvvv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d5ea2027e761d42bb29d5d49ee647dc9dce3141f1b32acacbc22fe7030e463f.exe"C:\Users\Admin\AppData\Local\Temp\4d5ea2027e761d42bb29d5d49ee647dc9dce3141f1b32acacbc22fe7030e463f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\hnthbb.exec:\hnthbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\xlrrrll.exec:\xlrrrll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\bttttt.exec:\bttttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\vpdpv.exec:\vpdpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\rrlxlll.exec:\rrlxlll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\ntthbb.exec:\ntthbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\dvppd.exec:\dvppd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\xrlxfxf.exec:\xrlxfxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\rxfxflr.exec:\rxfxflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\pjppj.exec:\pjppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\9dddp.exec:\9dddp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\ffffxxx.exec:\ffffxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\nbnnnn.exec:\nbnnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\7jvpp.exec:\7jvpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\fxffllx.exec:\fxffllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\btttbb.exec:\btttbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\vpppp.exec:\vpppp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\ddpdd.exec:\ddpdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\rfxllfx.exec:\rfxllfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\hhtttt.exec:\hhtttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\vjvvv.exec:\vjvvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\ppdjj.exec:\ppdjj.exe23⤵
- Executes dropped EXE
PID:2456 -
\??\c:\lxllrxx.exec:\lxllrxx.exe24⤵
- Executes dropped EXE
PID:916 -
\??\c:\ffxxlrf.exec:\ffxxlrf.exe25⤵
- Executes dropped EXE
PID:3008 -
\??\c:\htbhnb.exec:\htbhnb.exe26⤵
- Executes dropped EXE
PID:2908 -
\??\c:\pvjdv.exec:\pvjdv.exe27⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rxllfxr.exec:\rxllfxr.exe28⤵
- Executes dropped EXE
PID:4144 -
\??\c:\rxlfrrf.exec:\rxlfrrf.exe29⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hnnbnh.exec:\hnnbnh.exe30⤵
- Executes dropped EXE
PID:3596 -
\??\c:\vdjdj.exec:\vdjdj.exe31⤵
- Executes dropped EXE
PID:1420 -
\??\c:\frxlrxf.exec:\frxlrxf.exe32⤵
- Executes dropped EXE
PID:1792 -
\??\c:\nntbtb.exec:\nntbtb.exe33⤵
- Executes dropped EXE
PID:468 -
\??\c:\btthtn.exec:\btthtn.exe34⤵
- Executes dropped EXE
PID:3180 -
\??\c:\pjddd.exec:\pjddd.exe35⤵
- Executes dropped EXE
PID:1756 -
\??\c:\pdpdd.exec:\pdpdd.exe36⤵
- Executes dropped EXE
PID:404 -
\??\c:\xfxllfx.exec:\xfxllfx.exe37⤵
- Executes dropped EXE
PID:4180 -
\??\c:\xllfrlx.exec:\xllfrlx.exe38⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hnbhhn.exec:\hnbhhn.exe39⤵
- Executes dropped EXE
PID:4008 -
\??\c:\jpdvd.exec:\jpdvd.exe40⤵
- Executes dropped EXE
PID:2960 -
\??\c:\djppd.exec:\djppd.exe41⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xfrxxff.exec:\xfrxxff.exe42⤵
- Executes dropped EXE
PID:3156 -
\??\c:\ttbbhn.exec:\ttbbhn.exe43⤵
- Executes dropped EXE
PID:4560 -
\??\c:\tbbbbh.exec:\tbbbbh.exe44⤵
- Executes dropped EXE
PID:3452 -
\??\c:\vvpvp.exec:\vvpvp.exe45⤵
- Executes dropped EXE
PID:3116 -
\??\c:\fxxxxxf.exec:\fxxxxxf.exe46⤵PID:1696
-
\??\c:\nbbbtt.exec:\nbbbtt.exe47⤵
- Executes dropped EXE
PID:3496 -
\??\c:\hbbttt.exec:\hbbttt.exe48⤵
- Executes dropped EXE
PID:224 -
\??\c:\dvddp.exec:\dvddp.exe49⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3rfflrx.exec:\3rfflrx.exe50⤵
- Executes dropped EXE
PID:3892 -
\??\c:\xflrllr.exec:\xflrllr.exe51⤵
- Executes dropped EXE
PID:4964 -
\??\c:\vpdvp.exec:\vpdvp.exe52⤵
- Executes dropped EXE
PID:2576 -
\??\c:\djpvp.exec:\djpvp.exe53⤵
- Executes dropped EXE
PID:4104 -
\??\c:\xxxrrxr.exec:\xxxrrxr.exe54⤵
- Executes dropped EXE
PID:2928 -
\??\c:\tttnht.exec:\tttnht.exe55⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tbhnbn.exec:\tbhnbn.exe56⤵
- Executes dropped EXE
PID:2064 -
\??\c:\vdjjj.exec:\vdjjj.exe57⤵
- Executes dropped EXE
PID:1996 -
\??\c:\fxrrrll.exec:\fxrrrll.exe58⤵
- Executes dropped EXE
PID:1772 -
\??\c:\xlfxxxr.exec:\xlfxxxr.exe59⤵
- Executes dropped EXE
PID:1784 -
\??\c:\nthhnt.exec:\nthhnt.exe60⤵
- Executes dropped EXE
PID:4172 -
\??\c:\jvvvj.exec:\jvvvj.exe61⤵
- Executes dropped EXE
PID:840 -
\??\c:\9rffxfx.exec:\9rffxfx.exe62⤵
- Executes dropped EXE
PID:1056 -
\??\c:\xfrlfxr.exec:\xfrlfxr.exe63⤵
- Executes dropped EXE
PID:1080 -
\??\c:\hnhnnn.exec:\hnhnnn.exe64⤵
- Executes dropped EXE
PID:3212 -
\??\c:\pvdvp.exec:\pvdvp.exe65⤵
- Executes dropped EXE
PID:1044 -
\??\c:\5djdv.exec:\5djdv.exe66⤵
- Executes dropped EXE
PID:1608 -
\??\c:\3xfxxxr.exec:\3xfxxxr.exe67⤵PID:4940
-
\??\c:\ttthtn.exec:\ttthtn.exe68⤵PID:3392
-
\??\c:\jjvpd.exec:\jjvpd.exe69⤵PID:4016
-
\??\c:\jpppp.exec:\jpppp.exe70⤵PID:3572
-
\??\c:\xlxfxll.exec:\xlxfxll.exe71⤵PID:3344
-
\??\c:\ffxrxff.exec:\ffxrxff.exe72⤵PID:4780
-
\??\c:\bbtbbb.exec:\bbtbbb.exe73⤵PID:2124
-
\??\c:\vjjjj.exec:\vjjjj.exe74⤵PID:400
-
\??\c:\jvvvp.exec:\jvvvp.exe75⤵PID:4372
-
\??\c:\rlfxxrr.exec:\rlfxxrr.exe76⤵PID:1404
-
\??\c:\nnnnnn.exec:\nnnnnn.exe77⤵PID:3336
-
\??\c:\3ttnhb.exec:\3ttnhb.exe78⤵PID:3760
-
\??\c:\pdvvv.exec:\pdvvv.exe79⤵PID:2200
-
\??\c:\jvddv.exec:\jvddv.exe80⤵PID:4416
-
\??\c:\llfflll.exec:\llfflll.exe81⤵PID:4240
-
\??\c:\thnhbb.exec:\thnhbb.exe82⤵PID:528
-
\??\c:\3hthbh.exec:\3hthbh.exe83⤵PID:1104
-
\??\c:\pdpjp.exec:\pdpjp.exe84⤵PID:3064
-
\??\c:\9xrlxfx.exec:\9xrlxfx.exe85⤵PID:1036
-
\??\c:\nthbht.exec:\nthbht.exe86⤵PID:3884
-
\??\c:\tnhbhb.exec:\tnhbhb.exe87⤵PID:4120
-
\??\c:\vvddv.exec:\vvddv.exe88⤵PID:1916
-
\??\c:\flllfll.exec:\flllfll.exe89⤵PID:544
-
\??\c:\bhbbbb.exec:\bhbbbb.exe90⤵PID:4728
-
\??\c:\hbnhtt.exec:\hbnhtt.exe91⤵PID:4904
-
\??\c:\dvdjp.exec:\dvdjp.exe92⤵PID:4944
-
\??\c:\pdjvp.exec:\pdjvp.exe93⤵PID:1992
-
\??\c:\lxxrlll.exec:\lxxrlll.exe94⤵PID:716
-
\??\c:\hnntth.exec:\hnntth.exe95⤵PID:2688
-
\??\c:\jvddd.exec:\jvddd.exe96⤵PID:1100
-
\??\c:\lxlxrrl.exec:\lxlxrrl.exe97⤵PID:3272
-
\??\c:\bttnhn.exec:\bttnhn.exe98⤵PID:3156
-
\??\c:\hhbhbn.exec:\hhbhbn.exe99⤵PID:4928
-
\??\c:\pvdjv.exec:\pvdjv.exe100⤵PID:4512
-
\??\c:\lflfxlf.exec:\lflfxlf.exe101⤵PID:4488
-
\??\c:\hbhhhb.exec:\hbhhhb.exe102⤵PID:3772
-
\??\c:\tbbtnn.exec:\tbbtnn.exe103⤵PID:224
-
\??\c:\dpddv.exec:\dpddv.exe104⤵PID:2956
-
\??\c:\rlxflfr.exec:\rlxflfr.exe105⤵PID:5036
-
\??\c:\nthnbn.exec:\nthnbn.exe106⤵PID:4528
-
\??\c:\thhbtt.exec:\thhbtt.exe107⤵PID:2212
-
\??\c:\jjpjv.exec:\jjpjv.exe108⤵PID:4104
-
\??\c:\3pvpj.exec:\3pvpj.exe109⤵PID:2928
-
\??\c:\rlrlfff.exec:\rlrlfff.exe110⤵PID:2104
-
\??\c:\xllfflr.exec:\xllfflr.exe111⤵PID:4200
-
\??\c:\bbnbhh.exec:\bbnbhh.exe112⤵PID:232
-
\??\c:\jjppp.exec:\jjppp.exe113⤵PID:3716
-
\??\c:\jdddj.exec:\jdddj.exe114⤵PID:1940
-
\??\c:\3xxfrfx.exec:\3xxfrfx.exe115⤵PID:4080
-
\??\c:\pdpjp.exec:\pdpjp.exe116⤵PID:1872
-
\??\c:\jjvpd.exec:\jjvpd.exe117⤵PID:2416
-
\??\c:\lxfxlfx.exec:\lxfxlfx.exe118⤵PID:2304
-
\??\c:\hnhthb.exec:\hnhthb.exe119⤵PID:3876
-
\??\c:\tthhnt.exec:\tthhnt.exe120⤵PID:2140
-
\??\c:\3dvpv.exec:\3dvpv.exe121⤵PID:2980
-
\??\c:\lrrlllf.exec:\lrrlllf.exe122⤵PID:2540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-