Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 20:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c8415a7b5e7c8df370d46a95619ffa6f158fd2c966ba57be350b068e654258f.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
2c8415a7b5e7c8df370d46a95619ffa6f158fd2c966ba57be350b068e654258f.exe
-
Size
61KB
-
MD5
bfb2519c1b47fddbcaf08bb169f534f7
-
SHA1
91210fd8cf5bd3241833f0384db9acae9428c21d
-
SHA256
2c8415a7b5e7c8df370d46a95619ffa6f158fd2c966ba57be350b068e654258f
-
SHA512
8dfdaa1755796922f8c7427d2e6a95eb3398839e90fa6a91733d6ec4b21647fda9e82ee3898de2da50b51cb649b8bc5490da2a3bdb63db35254714ca8436068d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9U1y:ymb3NkkiQ3mdBjFIvlq1y
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/3168-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/808-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 25 IoCs
resource yara_rule behavioral2/memory/3168-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4544-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3628-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1616-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2252-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5032-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3236-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2328-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4792-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1176-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1680-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1680-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1680-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4788-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5052-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2388-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2996-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2204-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1776-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2240-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/808-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4036-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4336-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/464-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2208-186-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4544 jvpjj.exe 3628 pjpdj.exe 1616 rrffxxx.exe 2252 hbhhbh.exe 5032 vppjd.exe 3236 jdjjj.exe 2328 xrllrlr.exe 4792 ttnnbb.exe 1176 ppdpj.exe 1680 vvvdp.exe 4788 9xffrxx.exe 3128 hnnhbb.exe 5052 vppjj.exe 2388 1lffxff.exe 2996 thhhht.exe 2204 hbhhnn.exe 1776 5jppv.exe 4988 ffflllf.exe 2240 nnhhbb.exe 808 bttbbb.exe 4036 ppvvd.exe 4336 1xxxxrr.exe 464 btttnn.exe 1276 nntbhh.exe 3524 7pdjd.exe 2888 1xrrxff.exe 1820 9tttbb.exe 2208 bnnnnn.exe 4040 vdvjj.exe 4116 djvpv.exe 3216 lrrxrxx.exe 3364 lffffff.exe 1472 hbtttt.exe 4068 jvjdv.exe 2512 3vvvj.exe 4424 rrxxrrr.exe 1468 5lxrlrr.exe 4636 bhttnn.exe 1392 9bntht.exe 4180 jjvdd.exe 1992 pvvpd.exe 4876 lllxrrr.exe 4680 rlrlrrx.exe 4048 tnbhbh.exe 3724 nhnnnn.exe 2688 dvvvp.exe 3340 dvpjd.exe 3860 rfrfxlf.exe 1764 3ffrllx.exe 3352 nntttt.exe 4072 dvdpj.exe 864 jvvvv.exe 4456 lfffxxf.exe 4184 xlrrlll.exe 4792 ttnnhh.exe 2572 bnttth.exe 1784 jjvvj.exe 3336 dvppv.exe 4176 frrfxxr.exe 3356 llfllfx.exe 3684 5hnntt.exe 5104 3hnhhh.exe 4140 dvvpp.exe 2456 9vppd.exe -
resource yara_rule behavioral2/memory/3168-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/808-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-186-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3168 wrote to memory of 4544 3168 2c8415a7b5e7c8df370d46a95619ffa6f158fd2c966ba57be350b068e654258f.exe 82 PID 3168 wrote to memory of 4544 3168 2c8415a7b5e7c8df370d46a95619ffa6f158fd2c966ba57be350b068e654258f.exe 82 PID 3168 wrote to memory of 4544 3168 2c8415a7b5e7c8df370d46a95619ffa6f158fd2c966ba57be350b068e654258f.exe 82 PID 4544 wrote to memory of 3628 4544 jvpjj.exe 83 PID 4544 wrote to memory of 3628 4544 jvpjj.exe 83 PID 4544 wrote to memory of 3628 4544 jvpjj.exe 83 PID 3628 wrote to memory of 1616 3628 pjpdj.exe 84 PID 3628 wrote to memory of 1616 3628 pjpdj.exe 84 PID 3628 wrote to memory of 1616 3628 pjpdj.exe 84 PID 1616 wrote to memory of 2252 1616 rrffxxx.exe 85 PID 1616 wrote to memory of 2252 1616 rrffxxx.exe 85 PID 1616 wrote to memory of 2252 1616 rrffxxx.exe 85 PID 2252 wrote to memory of 5032 2252 hbhhbh.exe 87 PID 2252 wrote to memory of 5032 2252 hbhhbh.exe 87 PID 2252 wrote to memory of 5032 2252 hbhhbh.exe 87 PID 5032 wrote to memory of 3236 5032 vppjd.exe 88 PID 5032 wrote to memory of 3236 5032 vppjd.exe 88 PID 5032 wrote to memory of 3236 5032 vppjd.exe 88 PID 3236 wrote to memory of 2328 3236 jdjjj.exe 89 PID 3236 wrote to memory of 2328 3236 jdjjj.exe 89 PID 3236 wrote to memory of 2328 3236 jdjjj.exe 89 PID 2328 wrote to memory of 4792 2328 xrllrlr.exe 90 PID 2328 wrote to memory of 4792 2328 xrllrlr.exe 90 PID 2328 wrote to memory of 4792 2328 xrllrlr.exe 90 PID 4792 wrote to memory of 1176 4792 ttnnbb.exe 91 PID 4792 wrote to memory of 1176 4792 ttnnbb.exe 91 PID 4792 wrote to memory of 1176 4792 ttnnbb.exe 91 PID 1176 wrote to memory of 1680 1176 ppdpj.exe 92 PID 1176 wrote to memory of 1680 1176 ppdpj.exe 92 PID 1176 wrote to memory of 1680 1176 ppdpj.exe 92 PID 1680 wrote to memory of 4788 1680 vvvdp.exe 94 PID 1680 wrote to memory of 4788 1680 vvvdp.exe 94 PID 1680 wrote to memory of 4788 1680 vvvdp.exe 94 PID 4788 wrote to memory of 3128 4788 9xffrxx.exe 95 PID 4788 wrote to memory of 3128 4788 9xffrxx.exe 95 PID 4788 wrote to memory of 3128 4788 9xffrxx.exe 95 PID 3128 wrote to memory of 5052 3128 hnnhbb.exe 96 PID 3128 wrote to memory of 5052 3128 hnnhbb.exe 96 PID 3128 wrote to memory of 5052 3128 hnnhbb.exe 96 PID 5052 wrote to memory of 2388 5052 vppjj.exe 97 PID 5052 wrote to memory of 2388 5052 vppjj.exe 97 PID 5052 wrote to memory of 2388 5052 vppjj.exe 97 PID 2388 wrote to memory of 2996 2388 1lffxff.exe 98 PID 2388 wrote to memory of 2996 2388 1lffxff.exe 98 PID 2388 wrote to memory of 2996 2388 1lffxff.exe 98 PID 2996 wrote to memory of 2204 2996 thhhht.exe 99 PID 2996 wrote to memory of 2204 2996 thhhht.exe 99 PID 2996 wrote to memory of 2204 2996 thhhht.exe 99 PID 2204 wrote to memory of 1776 2204 hbhhnn.exe 100 PID 2204 wrote to memory of 1776 2204 hbhhnn.exe 100 PID 2204 wrote to memory of 1776 2204 hbhhnn.exe 100 PID 1776 wrote to memory of 4988 1776 5jppv.exe 101 PID 1776 wrote to memory of 4988 1776 5jppv.exe 101 PID 1776 wrote to memory of 4988 1776 5jppv.exe 101 PID 4988 wrote to memory of 2240 4988 ffflllf.exe 102 PID 4988 wrote to memory of 2240 4988 ffflllf.exe 102 PID 4988 wrote to memory of 2240 4988 ffflllf.exe 102 PID 2240 wrote to memory of 808 2240 nnhhbb.exe 104 PID 2240 wrote to memory of 808 2240 nnhhbb.exe 104 PID 2240 wrote to memory of 808 2240 nnhhbb.exe 104 PID 808 wrote to memory of 4036 808 bttbbb.exe 105 PID 808 wrote to memory of 4036 808 bttbbb.exe 105 PID 808 wrote to memory of 4036 808 bttbbb.exe 105 PID 4036 wrote to memory of 4336 4036 ppvvd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c8415a7b5e7c8df370d46a95619ffa6f158fd2c966ba57be350b068e654258f.exe"C:\Users\Admin\AppData\Local\Temp\2c8415a7b5e7c8df370d46a95619ffa6f158fd2c966ba57be350b068e654258f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\jvpjj.exec:\jvpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\pjpdj.exec:\pjpdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\rrffxxx.exec:\rrffxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\hbhhbh.exec:\hbhhbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\vppjd.exec:\vppjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\jdjjj.exec:\jdjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\xrllrlr.exec:\xrllrlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\ttnnbb.exec:\ttnnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\ppdpj.exec:\ppdpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\vvvdp.exec:\vvvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\9xffrxx.exec:\9xffrxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\hnnhbb.exec:\hnnhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\vppjj.exec:\vppjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\1lffxff.exec:\1lffxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\thhhht.exec:\thhhht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\hbhhnn.exec:\hbhhnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\5jppv.exec:\5jppv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\ffflllf.exec:\ffflllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\nnhhbb.exec:\nnhhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\bttbbb.exec:\bttbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\ppvvd.exec:\ppvvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\1xxxxrr.exec:\1xxxxrr.exe23⤵
- Executes dropped EXE
PID:4336 -
\??\c:\btttnn.exec:\btttnn.exe24⤵
- Executes dropped EXE
PID:464 -
\??\c:\nntbhh.exec:\nntbhh.exe25⤵
- Executes dropped EXE
PID:1276 -
\??\c:\7pdjd.exec:\7pdjd.exe26⤵
- Executes dropped EXE
PID:3524 -
\??\c:\1xrrxff.exec:\1xrrxff.exe27⤵
- Executes dropped EXE
PID:2888 -
\??\c:\9tttbb.exec:\9tttbb.exe28⤵
- Executes dropped EXE
PID:1820 -
\??\c:\bnnnnn.exec:\bnnnnn.exe29⤵
- Executes dropped EXE
PID:2208 -
\??\c:\vdvjj.exec:\vdvjj.exe30⤵
- Executes dropped EXE
PID:4040 -
\??\c:\djvpv.exec:\djvpv.exe31⤵
- Executes dropped EXE
PID:4116 -
\??\c:\lrrxrxx.exec:\lrrxrxx.exe32⤵
- Executes dropped EXE
PID:3216 -
\??\c:\lffffff.exec:\lffffff.exe33⤵
- Executes dropped EXE
PID:3364 -
\??\c:\hbtttt.exec:\hbtttt.exe34⤵
- Executes dropped EXE
PID:1472 -
\??\c:\jvjdv.exec:\jvjdv.exe35⤵
- Executes dropped EXE
PID:4068 -
\??\c:\3vvvj.exec:\3vvvj.exe36⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rrxxrrr.exec:\rrxxrrr.exe37⤵
- Executes dropped EXE
PID:4424 -
\??\c:\5lxrlrr.exec:\5lxrlrr.exe38⤵
- Executes dropped EXE
PID:1468 -
\??\c:\bhttnn.exec:\bhttnn.exe39⤵
- Executes dropped EXE
PID:4636 -
\??\c:\9bntht.exec:\9bntht.exe40⤵
- Executes dropped EXE
PID:1392 -
\??\c:\jjvdd.exec:\jjvdd.exe41⤵
- Executes dropped EXE
PID:4180 -
\??\c:\pvvpd.exec:\pvvpd.exe42⤵
- Executes dropped EXE
PID:1992 -
\??\c:\lllxrrr.exec:\lllxrrr.exe43⤵
- Executes dropped EXE
PID:4876 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe44⤵
- Executes dropped EXE
PID:4680 -
\??\c:\tnbhbh.exec:\tnbhbh.exe45⤵
- Executes dropped EXE
PID:4048 -
\??\c:\nhnnnn.exec:\nhnnnn.exe46⤵
- Executes dropped EXE
PID:3724 -
\??\c:\dvvvp.exec:\dvvvp.exe47⤵
- Executes dropped EXE
PID:2688 -
\??\c:\dvpjd.exec:\dvpjd.exe48⤵
- Executes dropped EXE
PID:3340 -
\??\c:\rfrfxlf.exec:\rfrfxlf.exe49⤵
- Executes dropped EXE
PID:3860 -
\??\c:\3ffrllx.exec:\3ffrllx.exe50⤵
- Executes dropped EXE
PID:1764 -
\??\c:\nntttt.exec:\nntttt.exe51⤵
- Executes dropped EXE
PID:3352 -
\??\c:\dvdpj.exec:\dvdpj.exe52⤵
- Executes dropped EXE
PID:4072 -
\??\c:\jvvvv.exec:\jvvvv.exe53⤵
- Executes dropped EXE
PID:864 -
\??\c:\lfffxxf.exec:\lfffxxf.exe54⤵
- Executes dropped EXE
PID:4456 -
\??\c:\xlrrlll.exec:\xlrrlll.exe55⤵
- Executes dropped EXE
PID:4184 -
\??\c:\ttnnhh.exec:\ttnnhh.exe56⤵
- Executes dropped EXE
PID:4792 -
\??\c:\bnttth.exec:\bnttth.exe57⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jjvvj.exec:\jjvvj.exe58⤵
- Executes dropped EXE
PID:1784 -
\??\c:\dvppv.exec:\dvppv.exe59⤵
- Executes dropped EXE
PID:3336 -
\??\c:\frrfxxr.exec:\frrfxxr.exe60⤵
- Executes dropped EXE
PID:4176 -
\??\c:\llfllfx.exec:\llfllfx.exe61⤵
- Executes dropped EXE
PID:3356 -
\??\c:\5hnntt.exec:\5hnntt.exe62⤵
- Executes dropped EXE
PID:3684 -
\??\c:\3hnhhh.exec:\3hnhhh.exe63⤵
- Executes dropped EXE
PID:5104 -
\??\c:\dvvpp.exec:\dvvpp.exe64⤵
- Executes dropped EXE
PID:4140 -
\??\c:\9vppd.exec:\9vppd.exe65⤵
- Executes dropped EXE
PID:2456 -
\??\c:\frxrlll.exec:\frxrlll.exe66⤵PID:4228
-
\??\c:\bttnnn.exec:\bttnnn.exe67⤵PID:2204
-
\??\c:\ttthbb.exec:\ttthbb.exe68⤵PID:1020
-
\??\c:\vvvvp.exec:\vvvvp.exe69⤵PID:4028
-
\??\c:\3pjvd.exec:\3pjvd.exe70⤵PID:3180
-
\??\c:\lfffxll.exec:\lfffxll.exe71⤵PID:4620
-
\??\c:\btbtnn.exec:\btbtnn.exe72⤵PID:2720
-
\??\c:\ddjvp.exec:\ddjvp.exe73⤵PID:5112
-
\??\c:\dpvpj.exec:\dpvpj.exe74⤵PID:4036
-
\??\c:\fxxllll.exec:\fxxllll.exe75⤵PID:800
-
\??\c:\lxfffxx.exec:\lxfffxx.exe76⤵PID:3140
-
\??\c:\tnnnnn.exec:\tnnnnn.exe77⤵PID:464
-
\??\c:\thhbtt.exec:\thhbtt.exe78⤵PID:1276
-
\??\c:\9jppj.exec:\9jppj.exe79⤵PID:968
-
\??\c:\dvdvp.exec:\dvdvp.exe80⤵PID:560
-
\??\c:\xrffffr.exec:\xrffffr.exe81⤵PID:1940
-
\??\c:\xlrrlrl.exec:\xlrrlrl.exe82⤵PID:3624
-
\??\c:\hhhhhh.exec:\hhhhhh.exe83⤵PID:1084
-
\??\c:\hhhhnn.exec:\hhhhnn.exe84⤵PID:1816
-
\??\c:\pvjjd.exec:\pvjjd.exe85⤵PID:4064
-
\??\c:\jjdpp.exec:\jjdpp.exe86⤵PID:1912
-
\??\c:\fxffrrl.exec:\fxffrrl.exe87⤵PID:5108
-
\??\c:\xxfxffr.exec:\xxfxffr.exe88⤵PID:3216
-
\??\c:\tnnhhb.exec:\tnnhhb.exe89⤵PID:4812
-
\??\c:\vjvpv.exec:\vjvpv.exe90⤵PID:1720
-
\??\c:\1fffllr.exec:\1fffllr.exe91⤵PID:2480
-
\??\c:\rlllxxf.exec:\rlllxxf.exe92⤵PID:2492
-
\??\c:\nttttt.exec:\nttttt.exe93⤵PID:4672
-
\??\c:\tnbnhb.exec:\tnbnhb.exe94⤵PID:1292
-
\??\c:\pjjjd.exec:\pjjjd.exe95⤵PID:4908
-
\??\c:\fffxxxx.exec:\fffxxxx.exe96⤵PID:3772
-
\??\c:\xrlrffl.exec:\xrlrffl.exe97⤵PID:1936
-
\??\c:\hhnnhh.exec:\hhnnhh.exe98⤵PID:1192
-
\??\c:\jdvpp.exec:\jdvpp.exe99⤵PID:4292
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe100⤵PID:3168
-
\??\c:\xlfxrlx.exec:\xlfxrlx.exe101⤵PID:4752
-
\??\c:\ddddd.exec:\ddddd.exe102⤵PID:4544
-
\??\c:\vdvpv.exec:\vdvpv.exe103⤵PID:3308
-
\??\c:\llrlffx.exec:\llrlffx.exe104⤵PID:2532
-
\??\c:\tbbbtt.exec:\tbbbtt.exe105⤵PID:1440
-
\??\c:\3fxfrff.exec:\3fxfrff.exe106⤵PID:3000
-
\??\c:\bhbtnn.exec:\bhbtnn.exe107⤵PID:3028
-
\??\c:\7nnbnn.exec:\7nnbnn.exe108⤵PID:3276
-
\??\c:\ddpjv.exec:\ddpjv.exe109⤵PID:3740
-
\??\c:\djvjd.exec:\djvjd.exe110⤵PID:1300
-
\??\c:\lxllrlr.exec:\lxllrlr.exe111⤵PID:1012
-
\??\c:\hbhbbb.exec:\hbhbbb.exe112⤵PID:1572
-
\??\c:\tnhbnh.exec:\tnhbnh.exe113⤵PID:3056
-
\??\c:\pdvpp.exec:\pdvpp.exe114⤵PID:4772
-
\??\c:\rlfffrr.exec:\rlfffrr.exe115⤵PID:2740
-
\??\c:\ffrxrxx.exec:\ffrxrxx.exe116⤵PID:3768
-
\??\c:\nnbhnb.exec:\nnbhnb.exe117⤵PID:4944
-
\??\c:\jvvpd.exec:\jvvpd.exe118⤵PID:3260
-
\??\c:\pvvpj.exec:\pvvpj.exe119⤵PID:4628
-
\??\c:\ffxxllf.exec:\ffxxllf.exe120⤵PID:1360
-
\??\c:\tththh.exec:\tththh.exe121⤵PID:2412
-
\??\c:\nhhhbb.exec:\nhhhbb.exe122⤵PID:3368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-