Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 06:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ca1242062c5298ac900027beedeb01402ab597cdae12f48b9717fb78969ca17b.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
ca1242062c5298ac900027beedeb01402ab597cdae12f48b9717fb78969ca17b.exe
-
Size
81KB
-
MD5
b1cc20b00ff1607ef6999f2f9022bea0
-
SHA1
9cf47f3f63fc361af590e3fb603f369d71617922
-
SHA256
ca1242062c5298ac900027beedeb01402ab597cdae12f48b9717fb78969ca17b
-
SHA512
7b45c109d414ea261cdba8b1ce73a72ba151e81c351aba62fffa455459c2decff76f1bcc57a784338e892dabff0dde3c39adc82c1fa59890d164cd1022974239
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7xCkTsIwtOa2dYS8njX:ymb3NkkiQ3mdBjFo7LAIbT6jX
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/2456-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/668-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/900-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3340-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1xrrrxx.exehnnhbn.exevjppp.exenhnnhh.exellfffrr.exe5llllrr.exebhntht.exelflfxxl.exenttnhh.exehnhbtt.exeddpjj.exe1xxlfxr.exerffxrlr.exehnbthh.exe9pvvv.exerlfllff.exetthhbb.exe9ttnhh.exejjvvp.exelxffflf.exe7tttnn.exenhbtnh.exeddpjp.exe3lrlfxx.exerlfxlxf.exe7tbtnt.exebbhtnn.exeddddv.exedvvpp.exexxlfxxl.exeflrrllf.exebhnhhb.exehbtbtt.exepjddv.exelfrlrrx.exe9ffxrlf.exe1nbhbh.exebtnhbn.exepdvjd.exevpppp.exexlfxllf.exerlfxrrr.exehhhbnn.exepjjdv.exe7pdvv.exe3lrfxxx.exennnhtn.exebnnbbb.exedvddv.exedvdvj.exexrffflr.exetnnhhh.exe5pddd.exe5lfrfxx.exerrrlrlr.exehthnhh.exe9hnnhh.exejvdvj.exerlrrlrr.exe5xflrrl.exenhnbnh.exe7hhbnt.exe5vddd.exe9vdvp.exepid process 668 1xrrrxx.exe 4332 hnnhbn.exe 1560 vjppp.exe 1912 nhnnhh.exe 1468 llfffrr.exe 2344 5llllrr.exe 5056 bhntht.exe 3144 lflfxxl.exe 3780 nttnhh.exe 1232 hnhbtt.exe 1004 ddpjj.exe 432 1xxlfxr.exe 1700 rffxrlr.exe 3504 hnbthh.exe 3180 9pvvv.exe 2848 rlfllff.exe 2228 tthhbb.exe 4880 9ttnhh.exe 900 jjvvp.exe 4848 lxffflf.exe 1444 7tttnn.exe 624 nhbtnh.exe 1616 ddpjp.exe 1860 3lrlfxx.exe 4528 rlfxlxf.exe 4608 7tbtnt.exe 4856 bbhtnn.exe 3340 ddddv.exe 816 dvvpp.exe 4636 xxlfxxl.exe 3984 flrrllf.exe 620 bhnhhb.exe 1960 hbtbtt.exe 3840 pjddv.exe 4964 lfrlrrx.exe 3384 9ffxrlf.exe 1968 1nbhbh.exe 4440 btnhbn.exe 4348 pdvjd.exe 696 vpppp.exe 1032 xlfxllf.exe 4136 rlfxrrr.exe 768 hhhbnn.exe 4176 pjjdv.exe 1560 7pdvv.exe 3568 3lrfxxx.exe 3596 nnnhtn.exe 3084 bnnbbb.exe 3348 dvddv.exe 336 dvdvj.exe 4736 xrffflr.exe 4580 tnnhhh.exe 1084 5pddd.exe 3572 5lfrfxx.exe 1004 rrrlrlr.exe 3380 hthnhh.exe 3496 9hnnhh.exe 4772 jvdvj.exe 4680 rlrrlrr.exe 4308 5xflrrl.exe 2848 nhnbnh.exe 3076 7hhbnt.exe 1936 5vddd.exe 3472 9vdvp.exe -
Processes:
resource yara_rule behavioral2/memory/2456-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/668-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/668-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/668-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/668-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3780-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3180-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/900-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ca1242062c5298ac900027beedeb01402ab597cdae12f48b9717fb78969ca17b.exe1xrrrxx.exehnnhbn.exevjppp.exenhnnhh.exellfffrr.exe5llllrr.exebhntht.exelflfxxl.exenttnhh.exehnhbtt.exeddpjj.exe1xxlfxr.exerffxrlr.exehnbthh.exe9pvvv.exerlfllff.exetthhbb.exe9ttnhh.exejjvvp.exelxffflf.exe7tttnn.exedescription pid process target process PID 2456 wrote to memory of 668 2456 ca1242062c5298ac900027beedeb01402ab597cdae12f48b9717fb78969ca17b.exe 1xrrrxx.exe PID 2456 wrote to memory of 668 2456 ca1242062c5298ac900027beedeb01402ab597cdae12f48b9717fb78969ca17b.exe 1xrrrxx.exe PID 2456 wrote to memory of 668 2456 ca1242062c5298ac900027beedeb01402ab597cdae12f48b9717fb78969ca17b.exe 1xrrrxx.exe PID 668 wrote to memory of 4332 668 1xrrrxx.exe hnnhbn.exe PID 668 wrote to memory of 4332 668 1xrrrxx.exe hnnhbn.exe PID 668 wrote to memory of 4332 668 1xrrrxx.exe hnnhbn.exe PID 4332 wrote to memory of 1560 4332 hnnhbn.exe vjppp.exe PID 4332 wrote to memory of 1560 4332 hnnhbn.exe vjppp.exe PID 4332 wrote to memory of 1560 4332 hnnhbn.exe vjppp.exe PID 1560 wrote to memory of 1912 1560 vjppp.exe nhnnhh.exe PID 1560 wrote to memory of 1912 1560 vjppp.exe nhnnhh.exe PID 1560 wrote to memory of 1912 1560 vjppp.exe nhnnhh.exe PID 1912 wrote to memory of 1468 1912 nhnnhh.exe llfffrr.exe PID 1912 wrote to memory of 1468 1912 nhnnhh.exe llfffrr.exe PID 1912 wrote to memory of 1468 1912 nhnnhh.exe llfffrr.exe PID 1468 wrote to memory of 2344 1468 llfffrr.exe 5llllrr.exe PID 1468 wrote to memory of 2344 1468 llfffrr.exe 5llllrr.exe PID 1468 wrote to memory of 2344 1468 llfffrr.exe 5llllrr.exe PID 2344 wrote to memory of 5056 2344 5llllrr.exe bhntht.exe PID 2344 wrote to memory of 5056 2344 5llllrr.exe bhntht.exe PID 2344 wrote to memory of 5056 2344 5llllrr.exe bhntht.exe PID 5056 wrote to memory of 3144 5056 bhntht.exe lflfxxl.exe PID 5056 wrote to memory of 3144 5056 bhntht.exe lflfxxl.exe PID 5056 wrote to memory of 3144 5056 bhntht.exe lflfxxl.exe PID 3144 wrote to memory of 3780 3144 lflfxxl.exe nttnhh.exe PID 3144 wrote to memory of 3780 3144 lflfxxl.exe nttnhh.exe PID 3144 wrote to memory of 3780 3144 lflfxxl.exe nttnhh.exe PID 3780 wrote to memory of 1232 3780 nttnhh.exe hnhbtt.exe PID 3780 wrote to memory of 1232 3780 nttnhh.exe hnhbtt.exe PID 3780 wrote to memory of 1232 3780 nttnhh.exe hnhbtt.exe PID 1232 wrote to memory of 1004 1232 hnhbtt.exe ddpjj.exe PID 1232 wrote to memory of 1004 1232 hnhbtt.exe ddpjj.exe PID 1232 wrote to memory of 1004 1232 hnhbtt.exe ddpjj.exe PID 1004 wrote to memory of 432 1004 ddpjj.exe 1xxlfxr.exe PID 1004 wrote to memory of 432 1004 ddpjj.exe 1xxlfxr.exe PID 1004 wrote to memory of 432 1004 ddpjj.exe 1xxlfxr.exe PID 432 wrote to memory of 1700 432 1xxlfxr.exe rffxrlr.exe PID 432 wrote to memory of 1700 432 1xxlfxr.exe rffxrlr.exe PID 432 wrote to memory of 1700 432 1xxlfxr.exe rffxrlr.exe PID 1700 wrote to memory of 3504 1700 rffxrlr.exe hnbthh.exe PID 1700 wrote to memory of 3504 1700 rffxrlr.exe hnbthh.exe PID 1700 wrote to memory of 3504 1700 rffxrlr.exe hnbthh.exe PID 3504 wrote to memory of 3180 3504 hnbthh.exe 9pvvv.exe PID 3504 wrote to memory of 3180 3504 hnbthh.exe 9pvvv.exe PID 3504 wrote to memory of 3180 3504 hnbthh.exe 9pvvv.exe PID 3180 wrote to memory of 2848 3180 9pvvv.exe rlfllff.exe PID 3180 wrote to memory of 2848 3180 9pvvv.exe rlfllff.exe PID 3180 wrote to memory of 2848 3180 9pvvv.exe rlfllff.exe PID 2848 wrote to memory of 2228 2848 rlfllff.exe tthhbb.exe PID 2848 wrote to memory of 2228 2848 rlfllff.exe tthhbb.exe PID 2848 wrote to memory of 2228 2848 rlfllff.exe tthhbb.exe PID 2228 wrote to memory of 4880 2228 tthhbb.exe 9ttnhh.exe PID 2228 wrote to memory of 4880 2228 tthhbb.exe 9ttnhh.exe PID 2228 wrote to memory of 4880 2228 tthhbb.exe 9ttnhh.exe PID 4880 wrote to memory of 900 4880 9ttnhh.exe jjvvp.exe PID 4880 wrote to memory of 900 4880 9ttnhh.exe jjvvp.exe PID 4880 wrote to memory of 900 4880 9ttnhh.exe jjvvp.exe PID 900 wrote to memory of 4848 900 jjvvp.exe lxffflf.exe PID 900 wrote to memory of 4848 900 jjvvp.exe lxffflf.exe PID 900 wrote to memory of 4848 900 jjvvp.exe lxffflf.exe PID 4848 wrote to memory of 1444 4848 lxffflf.exe 7tttnn.exe PID 4848 wrote to memory of 1444 4848 lxffflf.exe 7tttnn.exe PID 4848 wrote to memory of 1444 4848 lxffflf.exe 7tttnn.exe PID 1444 wrote to memory of 624 1444 7tttnn.exe nhbtnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca1242062c5298ac900027beedeb01402ab597cdae12f48b9717fb78969ca17b.exe"C:\Users\Admin\AppData\Local\Temp\ca1242062c5298ac900027beedeb01402ab597cdae12f48b9717fb78969ca17b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\1xrrrxx.exec:\1xrrrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\hnnhbn.exec:\hnnhbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\vjppp.exec:\vjppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\nhnnhh.exec:\nhnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\llfffrr.exec:\llfffrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\5llllrr.exec:\5llllrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\bhntht.exec:\bhntht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\lflfxxl.exec:\lflfxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\nttnhh.exec:\nttnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\hnhbtt.exec:\hnhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\ddpjj.exec:\ddpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\1xxlfxr.exec:\1xxlfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\rffxrlr.exec:\rffxrlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\hnbthh.exec:\hnbthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\9pvvv.exec:\9pvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\rlfllff.exec:\rlfllff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\tthhbb.exec:\tthhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\9ttnhh.exec:\9ttnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\jjvvp.exec:\jjvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\lxffflf.exec:\lxffflf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\7tttnn.exec:\7tttnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\nhbtnh.exec:\nhbtnh.exe23⤵
- Executes dropped EXE
PID:624 -
\??\c:\ddpjp.exec:\ddpjp.exe24⤵
- Executes dropped EXE
PID:1616 -
\??\c:\3lrlfxx.exec:\3lrlfxx.exe25⤵
- Executes dropped EXE
PID:1860 -
\??\c:\rlfxlxf.exec:\rlfxlxf.exe26⤵
- Executes dropped EXE
PID:4528 -
\??\c:\7tbtnt.exec:\7tbtnt.exe27⤵
- Executes dropped EXE
PID:4608 -
\??\c:\bbhtnn.exec:\bbhtnn.exe28⤵
- Executes dropped EXE
PID:4856 -
\??\c:\ddddv.exec:\ddddv.exe29⤵
- Executes dropped EXE
PID:3340 -
\??\c:\dvvpp.exec:\dvvpp.exe30⤵
- Executes dropped EXE
PID:816 -
\??\c:\xxlfxxl.exec:\xxlfxxl.exe31⤵
- Executes dropped EXE
PID:4636 -
\??\c:\flrrllf.exec:\flrrllf.exe32⤵
- Executes dropped EXE
PID:3984 -
\??\c:\bhnhhb.exec:\bhnhhb.exe33⤵
- Executes dropped EXE
PID:620 -
\??\c:\hbtbtt.exec:\hbtbtt.exe34⤵
- Executes dropped EXE
PID:1960 -
\??\c:\pjddv.exec:\pjddv.exe35⤵
- Executes dropped EXE
PID:3840 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe36⤵
- Executes dropped EXE
PID:4964 -
\??\c:\9ffxrlf.exec:\9ffxrlf.exe37⤵
- Executes dropped EXE
PID:3384 -
\??\c:\1nbhbh.exec:\1nbhbh.exe38⤵
- Executes dropped EXE
PID:1968 -
\??\c:\btnhbn.exec:\btnhbn.exe39⤵
- Executes dropped EXE
PID:4440 -
\??\c:\pdvjd.exec:\pdvjd.exe40⤵
- Executes dropped EXE
PID:4348 -
\??\c:\vpppp.exec:\vpppp.exe41⤵
- Executes dropped EXE
PID:696 -
\??\c:\xlfxllf.exec:\xlfxllf.exe42⤵
- Executes dropped EXE
PID:1032 -
\??\c:\rlfxrrr.exec:\rlfxrrr.exe43⤵
- Executes dropped EXE
PID:4136 -
\??\c:\hhhbnn.exec:\hhhbnn.exe44⤵
- Executes dropped EXE
PID:768 -
\??\c:\pjjdv.exec:\pjjdv.exe45⤵
- Executes dropped EXE
PID:4176 -
\??\c:\7pdvv.exec:\7pdvv.exe46⤵
- Executes dropped EXE
PID:1560 -
\??\c:\3lrfxxx.exec:\3lrfxxx.exe47⤵
- Executes dropped EXE
PID:3568 -
\??\c:\nnnhtn.exec:\nnnhtn.exe48⤵
- Executes dropped EXE
PID:3596 -
\??\c:\bnnbbb.exec:\bnnbbb.exe49⤵
- Executes dropped EXE
PID:3084 -
\??\c:\dvddv.exec:\dvddv.exe50⤵
- Executes dropped EXE
PID:3348 -
\??\c:\dvdvj.exec:\dvdvj.exe51⤵
- Executes dropped EXE
PID:336 -
\??\c:\xrffflr.exec:\xrffflr.exe52⤵
- Executes dropped EXE
PID:4736 -
\??\c:\tnnhhh.exec:\tnnhhh.exe53⤵
- Executes dropped EXE
PID:4580 -
\??\c:\5pddd.exec:\5pddd.exe54⤵
- Executes dropped EXE
PID:1084 -
\??\c:\5lfrfxx.exec:\5lfrfxx.exe55⤵
- Executes dropped EXE
PID:3572 -
\??\c:\rrrlrlr.exec:\rrrlrlr.exe56⤵
- Executes dropped EXE
PID:1004 -
\??\c:\hthnhh.exec:\hthnhh.exe57⤵
- Executes dropped EXE
PID:3380 -
\??\c:\9hnnhh.exec:\9hnnhh.exe58⤵
- Executes dropped EXE
PID:3496 -
\??\c:\jvdvj.exec:\jvdvj.exe59⤵
- Executes dropped EXE
PID:4772 -
\??\c:\rlrrlrr.exec:\rlrrlrr.exe60⤵
- Executes dropped EXE
PID:4680 -
\??\c:\5xflrrl.exec:\5xflrrl.exe61⤵
- Executes dropped EXE
PID:4308 -
\??\c:\nhnbnh.exec:\nhnbnh.exe62⤵
- Executes dropped EXE
PID:2848 -
\??\c:\7hhbnt.exec:\7hhbnt.exe63⤵
- Executes dropped EXE
PID:3076 -
\??\c:\5vddd.exec:\5vddd.exe64⤵
- Executes dropped EXE
PID:1936 -
\??\c:\9vdvp.exec:\9vdvp.exe65⤵
- Executes dropped EXE
PID:3472 -
\??\c:\rrrfxrx.exec:\rrrfxrx.exe66⤵PID:4164
-
\??\c:\nbhtnh.exec:\nbhtnh.exe67⤵PID:4720
-
\??\c:\nnhbnn.exec:\nnhbnn.exe68⤵PID:2908
-
\??\c:\vppvj.exec:\vppvj.exe69⤵PID:2548
-
\??\c:\pjppj.exec:\pjppj.exe70⤵PID:2520
-
\??\c:\fflxrrl.exec:\fflxrrl.exe71⤵PID:4924
-
\??\c:\bbbtnh.exec:\bbbtnh.exe72⤵PID:952
-
\??\c:\vdppp.exec:\vdppp.exe73⤵PID:1964
-
\??\c:\5vvvp.exec:\5vvvp.exe74⤵PID:1484
-
\??\c:\9djjd.exec:\9djjd.exe75⤵PID:220
-
\??\c:\fxxxlll.exec:\fxxxlll.exe76⤵PID:2420
-
\??\c:\fxrllfl.exec:\fxrllfl.exe77⤵PID:3660
-
\??\c:\tttbbb.exec:\tttbbb.exe78⤵PID:3984
-
\??\c:\jjdpv.exec:\jjdpv.exe79⤵PID:2184
-
\??\c:\jpvdj.exec:\jpvdj.exe80⤵PID:4400
-
\??\c:\fxxffxl.exec:\fxxffxl.exe81⤵PID:3840
-
\??\c:\xxfrlrr.exec:\xxfrlrr.exe82⤵PID:2464
-
\??\c:\tnhhbh.exec:\tnhhbh.exe83⤵PID:1124
-
\??\c:\9nttnn.exec:\9nttnn.exe84⤵PID:4492
-
\??\c:\1jpjv.exec:\1jpjv.exe85⤵PID:3600
-
\??\c:\xllfrlx.exec:\xllfrlx.exe86⤵PID:4348
-
\??\c:\lfxxfff.exec:\lfxxfff.exe87⤵PID:696
-
\??\c:\tbhnbb.exec:\tbhnbb.exe88⤵PID:4080
-
\??\c:\1nhhhh.exec:\1nhhhh.exe89⤵PID:2880
-
\??\c:\ppddv.exec:\ppddv.exe90⤵PID:1488
-
\??\c:\lrrllll.exec:\lrrllll.exe91⤵PID:2388
-
\??\c:\9rrrllf.exec:\9rrrllf.exe92⤵PID:3148
-
\??\c:\3thhhh.exec:\3thhhh.exe93⤵PID:2092
-
\??\c:\nhbttb.exec:\nhbttb.exe94⤵PID:3728
-
\??\c:\7jdpj.exec:\7jdpj.exe95⤵PID:4344
-
\??\c:\vpvpd.exec:\vpvpd.exe96⤵PID:2080
-
\??\c:\rlrlxxx.exec:\rlrlxxx.exe97⤵PID:4524
-
\??\c:\lxxrrrl.exec:\lxxrrrl.exe98⤵PID:1352
-
\??\c:\7bnnhh.exec:\7bnnhh.exe99⤵PID:4548
-
\??\c:\nhnnnn.exec:\nhnnnn.exe100⤵PID:3648
-
\??\c:\hntnhh.exec:\hntnhh.exe101⤵PID:1388
-
\??\c:\vpppj.exec:\vpppj.exe102⤵PID:4312
-
\??\c:\jvdvp.exec:\jvdvp.exe103⤵PID:4896
-
\??\c:\lfxrllf.exec:\lfxrllf.exe104⤵PID:1104
-
\??\c:\5ffxxff.exec:\5ffxxff.exe105⤵PID:2224
-
\??\c:\nnbnbb.exec:\nnbnbb.exe106⤵PID:2228
-
\??\c:\bntttt.exec:\bntttt.exe107⤵PID:2232
-
\??\c:\jdddd.exec:\jdddd.exe108⤵PID:4412
-
\??\c:\vvdvj.exec:\vvdvj.exe109⤵PID:796
-
\??\c:\xrxrllx.exec:\xrxrllx.exe110⤵PID:3704
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe111⤵PID:3404
-
\??\c:\nbtnbb.exec:\nbtnbb.exe112⤵PID:1972
-
\??\c:\djddp.exec:\djddp.exe113⤵PID:3740
-
\??\c:\vvpjj.exec:\vvpjj.exe114⤵PID:2520
-
\??\c:\1dvjj.exec:\1dvjj.exe115⤵PID:3516
-
\??\c:\1rllxxx.exec:\1rllxxx.exe116⤵PID:408
-
\??\c:\lxrlffx.exec:\lxrlffx.exe117⤵PID:1472
-
\??\c:\htbhhh.exec:\htbhhh.exe118⤵PID:936
-
\??\c:\tthhtt.exec:\tthhtt.exe119⤵PID:3460
-
\??\c:\dddvv.exec:\dddvv.exe120⤵PID:396
-
\??\c:\dpddp.exec:\dpddp.exe121⤵PID:3228
-
\??\c:\fxrlxrr.exec:\fxrlxrr.exe122⤵PID:4388
-
\??\c:\xxffrrl.exec:\xxffrrl.exe123⤵PID:2108
-
\??\c:\9bhntt.exec:\9bhntt.exe124⤵PID:2596
-
\??\c:\nbbthb.exec:\nbbthb.exe125⤵PID:2636
-
\??\c:\pjvjd.exec:\pjvjd.exe126⤵PID:4464
-
\??\c:\pjpjd.exec:\pjpjd.exe127⤵PID:3580
-
\??\c:\fxlfffx.exec:\fxlfffx.exe128⤵PID:3824
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe129⤵PID:3124
-
\??\c:\hhbthb.exec:\hhbthb.exe130⤵PID:4132
-
\??\c:\vpvpp.exec:\vpvpp.exe131⤵PID:4496
-
\??\c:\ffllfff.exec:\ffllfff.exe132⤵PID:1676
-
\??\c:\lflllrx.exec:\lflllrx.exe133⤵PID:4460
-
\??\c:\ttnbnh.exec:\ttnbnh.exe134⤵PID:3104
-
\??\c:\jjjdv.exec:\jjjdv.exe135⤵PID:3084
-
\??\c:\vpdjj.exec:\vpdjj.exe136⤵PID:1260
-
\??\c:\rlllfll.exec:\rlllfll.exe137⤵PID:5012
-
\??\c:\5xflllf.exec:\5xflllf.exe138⤵PID:4016
-
\??\c:\nnbttt.exec:\nnbttt.exe139⤵PID:4724
-
\??\c:\1vjpd.exec:\1vjpd.exe140⤵PID:3572
-
\??\c:\dpppp.exec:\dpppp.exe141⤵PID:1216
-
\??\c:\3pddd.exec:\3pddd.exe142⤵PID:4764
-
\??\c:\nhttht.exec:\nhttht.exe143⤵PID:4756
-
\??\c:\hhhntb.exec:\hhhntb.exe144⤵PID:1388
-
\??\c:\jjjjj.exec:\jjjjj.exe145⤵PID:3024
-
\??\c:\lfrxxll.exec:\lfrxxll.exe146⤵PID:4448
-
\??\c:\5ttbbh.exec:\5ttbbh.exe147⤵PID:3920
-
\??\c:\jdjjd.exec:\jdjjd.exe148⤵PID:3160
-
\??\c:\rrrrrrx.exec:\rrrrrrx.exe149⤵PID:452
-
\??\c:\hhnhht.exec:\hhnhht.exe150⤵PID:1544
-
\??\c:\vjpvv.exec:\vjpvv.exe151⤵PID:4884
-
\??\c:\vppvp.exec:\vppvp.exe152⤵PID:1224
-
\??\c:\rrfflrf.exec:\rrfflrf.exe153⤵PID:3560
-
\??\c:\tthttb.exec:\tthttb.exe154⤵PID:4360
-
\??\c:\jjjvp.exec:\jjjvp.exe155⤵PID:732
-
\??\c:\vpjdv.exec:\vpjdv.exe156⤵PID:4852
-
\??\c:\lxxxrlf.exec:\lxxxrlf.exe157⤵PID:2872
-
\??\c:\1bnhbh.exec:\1bnhbh.exe158⤵PID:3516
-
\??\c:\vjppj.exec:\vjppj.exe159⤵PID:408
-
\??\c:\dpjjd.exec:\dpjjd.exe160⤵PID:1472
-
\??\c:\5rrffff.exec:\5rrffff.exe161⤵PID:2284
-
\??\c:\lrlrrxr.exec:\lrlrrxr.exe162⤵PID:4592
-
\??\c:\nnbbbb.exec:\nnbbbb.exe163⤵PID:3660
-
\??\c:\bhntnb.exec:\bhntnb.exe164⤵PID:2184
-
\??\c:\pjvdv.exec:\pjvdv.exe165⤵PID:4400
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe166⤵PID:444
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe167⤵PID:2464
-
\??\c:\9nbbbh.exec:\9nbbbh.exe168⤵PID:4984
-
\??\c:\nthhhb.exec:\nthhhb.exe169⤵PID:4492
-
\??\c:\vvvpj.exec:\vvvpj.exe170⤵PID:2576
-
\??\c:\pdjjj.exec:\pdjjj.exe171⤵PID:4332
-
\??\c:\llllffl.exec:\llllffl.exe172⤵PID:4932
-
\??\c:\5lfflll.exec:\5lfflll.exe173⤵PID:4136
-
\??\c:\3nnhhh.exec:\3nnhhh.exe174⤵PID:1220
-
\??\c:\nbnhnt.exec:\nbnhnt.exe175⤵PID:4176
-
\??\c:\hthnnn.exec:\hthnnn.exe176⤵PID:1488
-
\??\c:\jddvv.exec:\jddvv.exe177⤵PID:5028
-
\??\c:\ppppp.exec:\ppppp.exe178⤵PID:2260
-
\??\c:\rxlxfxl.exec:\rxlxfxl.exe179⤵PID:3132
-
\??\c:\xxrrrrx.exec:\xxrrrrx.exe180⤵PID:4652
-
\??\c:\nhhbnn.exec:\nhhbnn.exe181⤵PID:3144
-
\??\c:\btnttt.exec:\btnttt.exe182⤵PID:3272
-
\??\c:\7ddpp.exec:\7ddpp.exe183⤵PID:1352
-
\??\c:\dvjjj.exec:\dvjjj.exe184⤵PID:3380
-
\??\c:\xxfffll.exec:\xxfffll.exe185⤵PID:5044
-
\??\c:\hbtthh.exec:\hbtthh.exe186⤵PID:1380
-
\??\c:\hhbbtt.exec:\hhbbtt.exe187⤵PID:1104
-
\??\c:\7vdvv.exec:\7vdvv.exe188⤵PID:1504
-
\??\c:\djvvp.exec:\djvvp.exe189⤵PID:4848
-
\??\c:\xlfrxll.exec:\xlfrxll.exe190⤵PID:4180
-
\??\c:\rrrllrl.exec:\rrrllrl.exe191⤵PID:3800
-
\??\c:\3bbbbb.exec:\3bbbbb.exe192⤵PID:3560
-
\??\c:\btnnnt.exec:\btnnnt.exe193⤵PID:4360
-
\??\c:\jjddd.exec:\jjddd.exe194⤵PID:2732
-
\??\c:\9ppvp.exec:\9ppvp.exe195⤵PID:620
-
\??\c:\5rrrlxf.exec:\5rrrlxf.exe196⤵PID:1960
-
\??\c:\nbhnnh.exec:\nbhnnh.exe197⤵PID:4388
-
\??\c:\vpvvp.exec:\vpvvp.exe198⤵PID:3840
-
\??\c:\5pdjj.exec:\5pdjj.exe199⤵PID:2372
-
\??\c:\frxrlff.exec:\frxrlff.exe200⤵PID:4284
-
\??\c:\nbntnn.exec:\nbntnn.exe201⤵PID:5052
-
\??\c:\1jvvp.exec:\1jvvp.exe202⤵PID:5004
-
\??\c:\xxrxrxr.exec:\xxrxrxr.exe203⤵PID:3068
-
\??\c:\rxrrrll.exec:\rxrrrll.exe204⤵PID:4932
-
\??\c:\hhhnnn.exec:\hhhnnn.exe205⤵PID:4900
-
\??\c:\nnhnhn.exec:\nnhnhn.exe206⤵PID:1220
-
\??\c:\3frrxfr.exec:\3frrxfr.exe207⤵PID:4176
-
\??\c:\xxlllll.exec:\xxlllll.exe208⤵PID:3104
-
\??\c:\nhnhhh.exec:\nhnhhh.exe209⤵PID:640
-
\??\c:\9pvvv.exec:\9pvvv.exe210⤵PID:3348
-
\??\c:\frfllxf.exec:\frfllxf.exe211⤵PID:3764
-
\??\c:\xffffll.exec:\xffffll.exe212⤵PID:5024
-
\??\c:\3hhhtn.exec:\3hhhtn.exe213⤵PID:3572
-
\??\c:\7flllrr.exec:\7flllrr.exe214⤵PID:4764
-
\??\c:\9bhtbb.exec:\9bhtbb.exe215⤵PID:1000
-
\??\c:\ddvvp.exec:\ddvvp.exe216⤵PID:3024
-
\??\c:\lrxxxff.exec:\lrxxxff.exe217⤵PID:3020
-
\??\c:\vdppp.exec:\vdppp.exe218⤵PID:2848
-
\??\c:\djppj.exec:\djppj.exe219⤵PID:3160
-
\??\c:\hthnnn.exec:\hthnnn.exe220⤵PID:1936
-
\??\c:\bhthhn.exec:\bhthhn.exe221⤵PID:3204
-
\??\c:\jpvpp.exec:\jpvpp.exe222⤵PID:1840
-
\??\c:\dpvdj.exec:\dpvdj.exe223⤵PID:2548
-
\??\c:\llrfxrx.exec:\llrfxrx.exe224⤵PID:4940
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe225⤵PID:5040
-
\??\c:\9tbtnn.exec:\9tbtnn.exe226⤵PID:1368
-
\??\c:\tbhhbb.exec:\tbhhbb.exe227⤵PID:392
-
\??\c:\vpdjj.exec:\vpdjj.exe228⤵PID:1484
-
\??\c:\djvdj.exec:\djvdj.exe229⤵PID:3460
-
\??\c:\frlfflr.exec:\frlfflr.exe230⤵PID:3988
-
\??\c:\xrlllrr.exec:\xrlllrr.exe231⤵PID:952
-
\??\c:\9nbhbh.exec:\9nbhbh.exe232⤵PID:3536
-
\??\c:\1hnnnt.exec:\1hnnnt.exe233⤵PID:2600
-
\??\c:\jvddd.exec:\jvddd.exe234⤵PID:4768
-
\??\c:\ddjpj.exec:\ddjpj.exe235⤵PID:4456
-
\??\c:\1llrlff.exec:\1llrlff.exe236⤵PID:1124
-
\??\c:\3xlrfff.exec:\3xlrfff.exe237⤵PID:3456
-
\??\c:\htbbhb.exec:\htbbhb.exe238⤵PID:5052
-
\??\c:\9hhhhh.exec:\9hhhhh.exe239⤵PID:3124
-
\??\c:\djppj.exec:\djppj.exe240⤵PID:4932
-
\??\c:\pvjjj.exec:\pvjjj.exe241⤵PID:1940
-
\??\c:\xxffxxx.exec:\xxffxxx.exe242⤵PID:1212