Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 18:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
00178ee63339cf9336f5f8647bfefb615643da9aae91e980ec4bc6c96c7f2f77.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
00178ee63339cf9336f5f8647bfefb615643da9aae91e980ec4bc6c96c7f2f77.exe
-
Size
144KB
-
MD5
6f353a8cbfde5548f64b6c967a069c52
-
SHA1
7a88dad4952a1a999053b993c3b5ca9cc9e0152f
-
SHA256
00178ee63339cf9336f5f8647bfefb615643da9aae91e980ec4bc6c96c7f2f77
-
SHA512
7ff5bacf8710b546a83731a4c8c3a424fab29f365c767875a9a59678150cbced7cbec02e0bc467f7fa19d4153a3b2f4dddb978296fffe77788500e7fec7e1369
-
SSDEEP
3072:ymb3NkkiQ3mdBjFosxXGPXbXQMFHLgDWSmklgQA:n3C9BRosxW8MFHLMW7QA
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral2/memory/3168-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5188-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5232-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/484-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1096-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5536-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 22 IoCs
Processes:
resource yara_rule behavioral2/memory/3168-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4136-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3612-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2748-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5188-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4176-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4404-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4448-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1520-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5232-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4688-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4580-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/484-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3660-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2044-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4876-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4552-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1408-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3368-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1096-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2192-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5536-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
flllfff.exetthbbn.exerfffxxx.exelflffxx.exehbnnnt.exerlxfffr.exehttbbh.exejpddd.exerlfxxfx.exebtnbht.exellrlrfr.exe1hbhbt.exevdppj.exerlrlxxl.exethhbnn.exejjvpj.exe1bhtbh.exerlllflf.exellllrrx.exenbbttt.exelfxxxff.exe9bnhht.exe7htbbh.exe5vdvp.exexrlflfl.exebhnnhh.exeddddj.exelfrllrf.exe9nnhhh.exejdjvd.exeflrlrlr.exetbbtnb.exevpvvp.exefrfxxxx.exehhbttt.exenbbnnn.exe9dddv.exexxrlxrl.exexlffxll.exehttnnn.exe7ppjj.exedjjvv.exe7lrxrrl.exehbbbbh.exerllrrxx.exexlffxfl.exethtbbh.exejddvv.exellllxff.exerfrfxrr.exe9nbtbt.exe1dpjv.exedvvdp.exexxxrlll.exeflxxrrl.exe3ttttn.exehnntnn.exe5vpjj.exerxxrllf.exerlxxrxr.exebbbbbh.exehbtnnn.exejdvpd.exe3xxfxrx.exepid process 4136 flllfff.exe 3612 tthbbn.exe 5188 rfffxxx.exe 2748 lflffxx.exe 1356 hbnnnt.exe 6040 rlxfffr.exe 5324 httbbh.exe 4176 jpddd.exe 4404 rlfxxfx.exe 4448 btnbht.exe 1520 llrlrfr.exe 5232 1hbhbt.exe 4688 vdppj.exe 4580 rlrlxxl.exe 484 thhbnn.exe 3660 jjvpj.exe 5940 1bhtbh.exe 2044 rlllflf.exe 4348 llllrrx.exe 4876 nbbttt.exe 3988 lfxxxff.exe 5576 9bnhht.exe 4552 7htbbh.exe 5424 5vdvp.exe 1408 xrlflfl.exe 3368 bhnnhh.exe 396 ddddj.exe 1096 lfrllrf.exe 2192 9nnhhh.exe 4056 jdjvd.exe 5536 flrlrlr.exe 2300 tbbtnb.exe 3552 vpvvp.exe 5004 frfxxxx.exe 1528 hhbttt.exe 2792 nbbnnn.exe 1540 9dddv.exe 3456 xxrlxrl.exe 4076 xlffxll.exe 4588 httnnn.exe 4324 7ppjj.exe 1944 djjvv.exe 4304 7lrxrrl.exe 452 hbbbbh.exe 1800 rllrrxx.exe 1680 xlffxfl.exe 5468 thtbbh.exe 2136 jddvv.exe 5008 llllxff.exe 3036 rfrfxrr.exe 1360 9nbtbt.exe 4700 1dpjv.exe 1596 dvvdp.exe 5480 xxxrlll.exe 4308 flxxrrl.exe 1868 3ttttn.exe 5456 hnntnn.exe 5908 5vpjj.exe 5896 rxxrllf.exe 4432 rlxxrxr.exe 3804 bbbbbh.exe 4312 hbtnnn.exe 2928 jdvpd.exe 4416 3xxfxrx.exe -
Processes:
resource yara_rule behavioral2/memory/3168-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5188-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5232-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/484-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1096-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5536-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
00178ee63339cf9336f5f8647bfefb615643da9aae91e980ec4bc6c96c7f2f77.exeflllfff.exetthbbn.exerfffxxx.exelflffxx.exehbnnnt.exerlxfffr.exehttbbh.exejpddd.exerlfxxfx.exebtnbht.exellrlrfr.exe1hbhbt.exevdppj.exerlrlxxl.exethhbnn.exejjvpj.exe1bhtbh.exerlllflf.exellllrrx.exenbbttt.exelfxxxff.exedescription pid process target process PID 3168 wrote to memory of 4136 3168 00178ee63339cf9336f5f8647bfefb615643da9aae91e980ec4bc6c96c7f2f77.exe flllfff.exe PID 3168 wrote to memory of 4136 3168 00178ee63339cf9336f5f8647bfefb615643da9aae91e980ec4bc6c96c7f2f77.exe flllfff.exe PID 3168 wrote to memory of 4136 3168 00178ee63339cf9336f5f8647bfefb615643da9aae91e980ec4bc6c96c7f2f77.exe flllfff.exe PID 4136 wrote to memory of 3612 4136 flllfff.exe tthbbn.exe PID 4136 wrote to memory of 3612 4136 flllfff.exe tthbbn.exe PID 4136 wrote to memory of 3612 4136 flllfff.exe tthbbn.exe PID 3612 wrote to memory of 5188 3612 tthbbn.exe rfffxxx.exe PID 3612 wrote to memory of 5188 3612 tthbbn.exe rfffxxx.exe PID 3612 wrote to memory of 5188 3612 tthbbn.exe rfffxxx.exe PID 5188 wrote to memory of 2748 5188 rfffxxx.exe lflffxx.exe PID 5188 wrote to memory of 2748 5188 rfffxxx.exe lflffxx.exe PID 5188 wrote to memory of 2748 5188 rfffxxx.exe lflffxx.exe PID 2748 wrote to memory of 1356 2748 lflffxx.exe hbnnnt.exe PID 2748 wrote to memory of 1356 2748 lflffxx.exe hbnnnt.exe PID 2748 wrote to memory of 1356 2748 lflffxx.exe hbnnnt.exe PID 1356 wrote to memory of 6040 1356 hbnnnt.exe rlxfffr.exe PID 1356 wrote to memory of 6040 1356 hbnnnt.exe rlxfffr.exe PID 1356 wrote to memory of 6040 1356 hbnnnt.exe rlxfffr.exe PID 6040 wrote to memory of 5324 6040 rlxfffr.exe httbbh.exe PID 6040 wrote to memory of 5324 6040 rlxfffr.exe httbbh.exe PID 6040 wrote to memory of 5324 6040 rlxfffr.exe httbbh.exe PID 5324 wrote to memory of 4176 5324 httbbh.exe jpddd.exe PID 5324 wrote to memory of 4176 5324 httbbh.exe jpddd.exe PID 5324 wrote to memory of 4176 5324 httbbh.exe jpddd.exe PID 4176 wrote to memory of 4404 4176 jpddd.exe rlfxxfx.exe PID 4176 wrote to memory of 4404 4176 jpddd.exe rlfxxfx.exe PID 4176 wrote to memory of 4404 4176 jpddd.exe rlfxxfx.exe PID 4404 wrote to memory of 4448 4404 rlfxxfx.exe btnbht.exe PID 4404 wrote to memory of 4448 4404 rlfxxfx.exe btnbht.exe PID 4404 wrote to memory of 4448 4404 rlfxxfx.exe btnbht.exe PID 4448 wrote to memory of 1520 4448 btnbht.exe llrlrfr.exe PID 4448 wrote to memory of 1520 4448 btnbht.exe llrlrfr.exe PID 4448 wrote to memory of 1520 4448 btnbht.exe llrlrfr.exe PID 1520 wrote to memory of 5232 1520 llrlrfr.exe 1hbhbt.exe PID 1520 wrote to memory of 5232 1520 llrlrfr.exe 1hbhbt.exe PID 1520 wrote to memory of 5232 1520 llrlrfr.exe 1hbhbt.exe PID 5232 wrote to memory of 4688 5232 1hbhbt.exe vdppj.exe PID 5232 wrote to memory of 4688 5232 1hbhbt.exe vdppj.exe PID 5232 wrote to memory of 4688 5232 1hbhbt.exe vdppj.exe PID 4688 wrote to memory of 4580 4688 vdppj.exe rlrlxxl.exe PID 4688 wrote to memory of 4580 4688 vdppj.exe rlrlxxl.exe PID 4688 wrote to memory of 4580 4688 vdppj.exe rlrlxxl.exe PID 4580 wrote to memory of 484 4580 rlrlxxl.exe thhbnn.exe PID 4580 wrote to memory of 484 4580 rlrlxxl.exe thhbnn.exe PID 4580 wrote to memory of 484 4580 rlrlxxl.exe thhbnn.exe PID 484 wrote to memory of 3660 484 thhbnn.exe jjvpj.exe PID 484 wrote to memory of 3660 484 thhbnn.exe jjvpj.exe PID 484 wrote to memory of 3660 484 thhbnn.exe jjvpj.exe PID 3660 wrote to memory of 5940 3660 jjvpj.exe 1bhtbh.exe PID 3660 wrote to memory of 5940 3660 jjvpj.exe 1bhtbh.exe PID 3660 wrote to memory of 5940 3660 jjvpj.exe 1bhtbh.exe PID 5940 wrote to memory of 2044 5940 1bhtbh.exe rlllflf.exe PID 5940 wrote to memory of 2044 5940 1bhtbh.exe rlllflf.exe PID 5940 wrote to memory of 2044 5940 1bhtbh.exe rlllflf.exe PID 2044 wrote to memory of 4348 2044 rlllflf.exe llllrrx.exe PID 2044 wrote to memory of 4348 2044 rlllflf.exe llllrrx.exe PID 2044 wrote to memory of 4348 2044 rlllflf.exe llllrrx.exe PID 4348 wrote to memory of 4876 4348 llllrrx.exe nbbttt.exe PID 4348 wrote to memory of 4876 4348 llllrrx.exe nbbttt.exe PID 4348 wrote to memory of 4876 4348 llllrrx.exe nbbttt.exe PID 4876 wrote to memory of 3988 4876 nbbttt.exe lfxxxff.exe PID 4876 wrote to memory of 3988 4876 nbbttt.exe lfxxxff.exe PID 4876 wrote to memory of 3988 4876 nbbttt.exe lfxxxff.exe PID 3988 wrote to memory of 5576 3988 lfxxxff.exe 9bnhht.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00178ee63339cf9336f5f8647bfefb615643da9aae91e980ec4bc6c96c7f2f77.exe"C:\Users\Admin\AppData\Local\Temp\00178ee63339cf9336f5f8647bfefb615643da9aae91e980ec4bc6c96c7f2f77.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\flllfff.exec:\flllfff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\tthbbn.exec:\tthbbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\rfffxxx.exec:\rfffxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
\??\c:\lflffxx.exec:\lflffxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\hbnnnt.exec:\hbnnnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\rlxfffr.exec:\rlxfffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
\??\c:\httbbh.exec:\httbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
\??\c:\jpddd.exec:\jpddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\rlfxxfx.exec:\rlfxxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\btnbht.exec:\btnbht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\llrlrfr.exec:\llrlrfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\1hbhbt.exec:\1hbhbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
\??\c:\vdppj.exec:\vdppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\rlrlxxl.exec:\rlrlxxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\thhbnn.exec:\thhbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\jjvpj.exec:\jjvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\1bhtbh.exec:\1bhtbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
\??\c:\rlllflf.exec:\rlllflf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\llllrrx.exec:\llllrrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\nbbttt.exec:\nbbttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\lfxxxff.exec:\lfxxxff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\9bnhht.exec:\9bnhht.exe23⤵
- Executes dropped EXE
PID:5576 -
\??\c:\7htbbh.exec:\7htbbh.exe24⤵
- Executes dropped EXE
PID:4552 -
\??\c:\5vdvp.exec:\5vdvp.exe25⤵
- Executes dropped EXE
PID:5424 -
\??\c:\xrlflfl.exec:\xrlflfl.exe26⤵
- Executes dropped EXE
PID:1408 -
\??\c:\bhnnhh.exec:\bhnnhh.exe27⤵
- Executes dropped EXE
PID:3368 -
\??\c:\ddddj.exec:\ddddj.exe28⤵
- Executes dropped EXE
PID:396 -
\??\c:\lfrllrf.exec:\lfrllrf.exe29⤵
- Executes dropped EXE
PID:1096 -
\??\c:\9nnhhh.exec:\9nnhhh.exe30⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jdjvd.exec:\jdjvd.exe31⤵
- Executes dropped EXE
PID:4056 -
\??\c:\flrlrlr.exec:\flrlrlr.exe32⤵
- Executes dropped EXE
PID:5536 -
\??\c:\tbbtnb.exec:\tbbtnb.exe33⤵
- Executes dropped EXE
PID:2300 -
\??\c:\vpvvp.exec:\vpvvp.exe34⤵
- Executes dropped EXE
PID:3552 -
\??\c:\frfxxxx.exec:\frfxxxx.exe35⤵
- Executes dropped EXE
PID:5004 -
\??\c:\hhbttt.exec:\hhbttt.exe36⤵
- Executes dropped EXE
PID:1528 -
\??\c:\nbbnnn.exec:\nbbnnn.exe37⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9dddv.exec:\9dddv.exe38⤵
- Executes dropped EXE
PID:1540 -
\??\c:\xxrlxrl.exec:\xxrlxrl.exe39⤵
- Executes dropped EXE
PID:3456 -
\??\c:\xlffxll.exec:\xlffxll.exe40⤵
- Executes dropped EXE
PID:4076 -
\??\c:\httnnn.exec:\httnnn.exe41⤵
- Executes dropped EXE
PID:4588 -
\??\c:\7ppjj.exec:\7ppjj.exe42⤵
- Executes dropped EXE
PID:4324 -
\??\c:\djjvv.exec:\djjvv.exe43⤵
- Executes dropped EXE
PID:1944 -
\??\c:\7lrxrrl.exec:\7lrxrrl.exe44⤵
- Executes dropped EXE
PID:4304 -
\??\c:\hbbbbh.exec:\hbbbbh.exe45⤵
- Executes dropped EXE
PID:452 -
\??\c:\rllrrxx.exec:\rllrrxx.exe46⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xlffxfl.exec:\xlffxfl.exe47⤵
- Executes dropped EXE
PID:1680 -
\??\c:\thtbbh.exec:\thtbbh.exe48⤵
- Executes dropped EXE
PID:5468 -
\??\c:\jddvv.exec:\jddvv.exe49⤵
- Executes dropped EXE
PID:2136 -
\??\c:\llllxff.exec:\llllxff.exe50⤵
- Executes dropped EXE
PID:5008 -
\??\c:\rfrfxrr.exec:\rfrfxrr.exe51⤵
- Executes dropped EXE
PID:3036 -
\??\c:\9nbtbt.exec:\9nbtbt.exe52⤵
- Executes dropped EXE
PID:1360 -
\??\c:\1dpjv.exec:\1dpjv.exe53⤵
- Executes dropped EXE
PID:4700 -
\??\c:\dvvdp.exec:\dvvdp.exe54⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xxxrlll.exec:\xxxrlll.exe55⤵
- Executes dropped EXE
PID:5480 -
\??\c:\flxxrrl.exec:\flxxrrl.exe56⤵
- Executes dropped EXE
PID:4308 -
\??\c:\3ttttn.exec:\3ttttn.exe57⤵
- Executes dropped EXE
PID:1868 -
\??\c:\hnntnn.exec:\hnntnn.exe58⤵
- Executes dropped EXE
PID:5456 -
\??\c:\5vpjj.exec:\5vpjj.exe59⤵
- Executes dropped EXE
PID:5908 -
\??\c:\rxxrllf.exec:\rxxrllf.exe60⤵
- Executes dropped EXE
PID:5896 -
\??\c:\rlxxrxr.exec:\rlxxrxr.exe61⤵
- Executes dropped EXE
PID:4432 -
\??\c:\bbbbbh.exec:\bbbbbh.exe62⤵
- Executes dropped EXE
PID:3804 -
\??\c:\hbtnnn.exec:\hbtnnn.exe63⤵
- Executes dropped EXE
PID:4312 -
\??\c:\jdvpd.exec:\jdvpd.exe64⤵
- Executes dropped EXE
PID:2928 -
\??\c:\3xxfxrx.exec:\3xxfxrx.exe65⤵
- Executes dropped EXE
PID:4416 -
\??\c:\tntbnn.exec:\tntbnn.exe66⤵PID:1016
-
\??\c:\tnbnbn.exec:\tnbnbn.exe67⤵PID:5920
-
\??\c:\5vddj.exec:\5vddj.exe68⤵PID:1576
-
\??\c:\jpppj.exec:\jpppj.exe69⤵PID:3124
-
\??\c:\xrxrrxx.exec:\xrxrrxx.exe70⤵PID:4408
-
\??\c:\lfffxxx.exec:\lfffxxx.exe71⤵PID:4868
-
\??\c:\5ttbbh.exec:\5ttbbh.exe72⤵PID:3088
-
\??\c:\bhbbnt.exec:\bhbbnt.exe73⤵PID:1216
-
\??\c:\jddvj.exec:\jddvj.exe74⤵PID:3464
-
\??\c:\xlrrflx.exec:\xlrrflx.exe75⤵PID:4276
-
\??\c:\xrllfxr.exec:\xrllfxr.exe76⤵PID:4556
-
\??\c:\nhttnt.exec:\nhttnt.exe77⤵PID:4940
-
\??\c:\ppddj.exec:\ppddj.exe78⤵PID:5220
-
\??\c:\7dpjj.exec:\7dpjj.exe79⤵PID:5208
-
\??\c:\7rrrllf.exec:\7rrrllf.exe80⤵PID:3076
-
\??\c:\hhtthb.exec:\hhtthb.exe81⤵PID:6060
-
\??\c:\7hnnhh.exec:\7hnnhh.exe82⤵PID:3112
-
\??\c:\vvjvp.exec:\vvjvp.exe83⤵PID:2092
-
\??\c:\1xlfffx.exec:\1xlfffx.exe84⤵PID:4584
-
\??\c:\1tntth.exec:\1tntth.exe85⤵PID:4484
-
\??\c:\bntnbb.exec:\bntnbb.exe86⤵PID:1124
-
\??\c:\jppdd.exec:\jppdd.exe87⤵PID:5488
-
\??\c:\rlrxxxx.exec:\rlrxxxx.exe88⤵PID:5420
-
\??\c:\fffffff.exec:\fffffff.exe89⤵PID:3924
-
\??\c:\tbhhbb.exec:\tbhhbb.exe90⤵PID:5596
-
\??\c:\7bhbth.exec:\7bhbth.exe91⤵PID:2852
-
\??\c:\pdddv.exec:\pdddv.exe92⤵PID:5436
-
\??\c:\pvjdd.exec:\pvjdd.exe93⤵PID:4848
-
\??\c:\frflflr.exec:\frflflr.exe94⤵PID:2340
-
\??\c:\1lrrlrl.exec:\1lrrlrl.exe95⤵PID:4968
-
\??\c:\hbttnn.exec:\hbttnn.exe96⤵PID:572
-
\??\c:\jvjjd.exec:\jvjjd.exe97⤵PID:4352
-
\??\c:\jjpjd.exec:\jjpjd.exe98⤵PID:1404
-
\??\c:\flllxlf.exec:\flllxlf.exe99⤵PID:2288
-
\??\c:\flrlffx.exec:\flrlffx.exe100⤵PID:4824
-
\??\c:\bbtbbt.exec:\bbtbbt.exe101⤵PID:4240
-
\??\c:\3nhhbb.exec:\3nhhbb.exe102⤵PID:3644
-
\??\c:\vvvpp.exec:\vvvpp.exe103⤵PID:184
-
\??\c:\xllfffx.exec:\xllfffx.exe104⤵PID:5756
-
\??\c:\llxrllf.exec:\llxrllf.exe105⤵PID:3100
-
\??\c:\hbbbtt.exec:\hbbbtt.exe106⤵PID:2492
-
\??\c:\vjjjj.exec:\vjjjj.exe107⤵PID:4684
-
\??\c:\9xlllll.exec:\9xlllll.exe108⤵PID:4888
-
\??\c:\lxxxrxx.exec:\lxxxrxx.exe109⤵PID:5776
-
\??\c:\hbttnb.exec:\hbttnb.exe110⤵PID:2284
-
\??\c:\vpvpp.exec:\vpvpp.exe111⤵PID:216
-
\??\c:\pjvdv.exec:\pjvdv.exe112⤵PID:4904
-
\??\c:\rrxxxlf.exec:\rrxxxlf.exe113⤵PID:3636
-
\??\c:\htbnhh.exec:\htbnhh.exe114⤵PID:4708
-
\??\c:\jdpjv.exec:\jdpjv.exe115⤵PID:436
-
\??\c:\lxxrrlf.exec:\lxxrrlf.exe116⤵PID:2672
-
\??\c:\ffffxrf.exec:\ffffxrf.exe117⤵PID:2004
-
\??\c:\tnhhhh.exec:\tnhhhh.exe118⤵PID:3036
-
\??\c:\jjjdv.exec:\jjjdv.exe119⤵PID:3992
-
\??\c:\pdjdv.exec:\pdjdv.exe120⤵PID:5568
-
\??\c:\flrlxxx.exec:\flrlxxx.exe121⤵PID:4516
-
\??\c:\1ntnhb.exec:\1ntnhb.exe122⤵PID:2020
-
\??\c:\3pjjj.exec:\3pjjj.exe123⤵PID:4308
-
\??\c:\1thhht.exec:\1thhht.exe124⤵PID:5476
-
\??\c:\pddvv.exec:\pddvv.exe125⤵PID:3936
-
\??\c:\rxffffl.exec:\rxffffl.exe126⤵PID:1228
-
\??\c:\nttbbn.exec:\nttbbn.exe127⤵PID:3584
-
\??\c:\vjjpj.exec:\vjjpj.exe128⤵PID:3408
-
\??\c:\9rrlfff.exec:\9rrlfff.exe129⤵PID:2296
-
\??\c:\nnbbbh.exec:\nnbbbh.exe130⤵PID:6084
-
\??\c:\pdppj.exec:\pdppj.exe131⤵PID:2928
-
\??\c:\ddddd.exec:\ddddd.exe132⤵PID:4416
-
\??\c:\llffxfx.exec:\llffxfx.exe133⤵PID:4204
-
\??\c:\ttnntn.exec:\ttnntn.exe134⤵PID:5920
-
\??\c:\ppdpv.exec:\ppdpv.exe135⤵PID:6128
-
\??\c:\lllfxxx.exec:\lllfxxx.exe136⤵PID:3124
-
\??\c:\9flffff.exec:\9flffff.exe137⤵PID:2384
-
\??\c:\3hhnnn.exec:\3hhnnn.exe138⤵PID:5624
-
\??\c:\nnhthb.exec:\nnhthb.exe139⤵PID:2552
-
\??\c:\1pvpp.exec:\1pvpp.exe140⤵PID:5712
-
\??\c:\vdjjd.exec:\vdjjd.exe141⤵PID:3464
-
\??\c:\9llfxff.exec:\9llfxff.exe142⤵PID:4276
-
\??\c:\9xfxrrl.exec:\9xfxrrl.exe143⤵PID:3188
-
\??\c:\1xxxxxx.exec:\1xxxxxx.exe144⤵PID:820
-
\??\c:\nhnnnh.exec:\nhnnnh.exe145⤵PID:5072
-
\??\c:\3djdv.exec:\3djdv.exe146⤵PID:4688
-
\??\c:\dvvpp.exec:\dvvpp.exe147⤵PID:4660
-
\??\c:\rflfrlr.exec:\rflfrlr.exe148⤵PID:4300
-
\??\c:\nhthht.exec:\nhthht.exe149⤵PID:2412
-
\??\c:\bnhhnn.exec:\bnhhnn.exe150⤵PID:3660
-
\??\c:\ddjpv.exec:\ddjpv.exe151⤵PID:5764
-
\??\c:\ppvdj.exec:\ppvdj.exe152⤵PID:3136
-
\??\c:\1xxxffx.exec:\1xxxffx.exe153⤵PID:4004
-
\??\c:\htbbtn.exec:\htbbtn.exe154⤵PID:5036
-
\??\c:\hbhbbb.exec:\hbhbbb.exe155⤵PID:5980
-
\??\c:\9ddvp.exec:\9ddvp.exe156⤵PID:5584
-
\??\c:\xrlfrrf.exec:\xrlfrrf.exe157⤵PID:4980
-
\??\c:\thhhtn.exec:\thhhtn.exe158⤵PID:840
-
\??\c:\hbhhnn.exec:\hbhhnn.exe159⤵PID:5436
-
\??\c:\9pjjd.exec:\9pjjd.exe160⤵PID:4592
-
\??\c:\lxfxrfx.exec:\lxfxrfx.exe161⤵PID:1612
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe162⤵PID:1096
-
\??\c:\9tnntn.exec:\9tnntn.exe163⤵PID:4912
-
\??\c:\9nbbtt.exec:\9nbbtt.exe164⤵PID:1120
-
\??\c:\jvvvp.exec:\jvvvp.exe165⤵PID:1952
-
\??\c:\lrrlfff.exec:\lrrlfff.exe166⤵PID:2972
-
\??\c:\5lrrrrl.exec:\5lrrrrl.exe167⤵PID:220
-
\??\c:\hhnhbb.exec:\hhnhbb.exe168⤵PID:1532
-
\??\c:\vdpjd.exec:\vdpjd.exe169⤵PID:5560
-
\??\c:\vdddj.exec:\vdddj.exe170⤵PID:5184
-
\??\c:\frrxlrx.exec:\frrxlrx.exe171⤵PID:4400
-
\??\c:\ttbtbb.exec:\ttbtbb.exe172⤵PID:4600
-
\??\c:\ntbtnt.exec:\ntbtnt.exe173⤵PID:2164
-
\??\c:\vpjjd.exec:\vpjjd.exe174⤵PID:3528
-
\??\c:\llrlffl.exec:\llrlffl.exe175⤵PID:4888
-
\??\c:\3flfffr.exec:\3flfffr.exe176⤵PID:5460
-
\??\c:\nnhhbb.exec:\nnhhbb.exe177⤵PID:6008
-
\??\c:\pddjj.exec:\pddjj.exe178⤵PID:5608
-
\??\c:\dvpvv.exec:\dvpvv.exe179⤵PID:3376
-
\??\c:\xlrxflr.exec:\xlrxflr.exe180⤵PID:2572
-
\??\c:\1nbbtt.exec:\1nbbtt.exe181⤵PID:436
-
\??\c:\9tttth.exec:\9tttth.exe182⤵PID:1396
-
\??\c:\jvdjp.exec:\jvdjp.exe183⤵PID:5700
-
\??\c:\rllfllx.exec:\rllfllx.exe184⤵PID:4700
-
\??\c:\xfffrfr.exec:\xfffrfr.exe185⤵PID:3724
-
\??\c:\thnhtb.exec:\thnhtb.exe186⤵PID:1144
-
\??\c:\7hbhbt.exec:\7hbhbt.exe187⤵PID:1608
-
\??\c:\3ddvp.exec:\3ddvp.exe188⤵PID:3056
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe189⤵PID:5456
-
\??\c:\lrrrllf.exec:\lrrrllf.exe190⤵PID:3692
-
\??\c:\5nbtnt.exec:\5nbtnt.exe191⤵PID:6052
-
\??\c:\bnbtht.exec:\bnbtht.exe192⤵PID:3584
-
\??\c:\5djdv.exec:\5djdv.exe193⤵PID:4292
-
\??\c:\xflffxx.exec:\xflffxx.exe194⤵PID:4136
-
\??\c:\thhhbb.exec:\thhhbb.exe195⤵PID:3928
-
\??\c:\bhnnhh.exec:\bhnnhh.exe196⤵PID:2648
-
\??\c:\pvvjd.exec:\pvvjd.exe197⤵PID:1860
-
\??\c:\vjvvp.exec:\vjvvp.exe198⤵PID:4628
-
\??\c:\lfllffx.exec:\lfllffx.exe199⤵PID:1356
-
\??\c:\bthhhb.exec:\bthhhb.exe200⤵PID:2724
-
\??\c:\bnnhbb.exec:\bnnhbb.exe201⤵PID:5428
-
\??\c:\vjdvp.exec:\vjdvp.exe202⤵PID:1828
-
\??\c:\jvjdv.exec:\jvjdv.exe203⤵PID:5712
-
\??\c:\dvpjj.exec:\dvpjj.exe204⤵PID:5212
-
\??\c:\7flfrxr.exec:\7flfrxr.exe205⤵PID:4536
-
\??\c:\9fllffx.exec:\9fllffx.exe206⤵PID:3752
-
\??\c:\3thhnt.exec:\3thhnt.exe207⤵PID:820
-
\??\c:\1thbtb.exec:\1thbtb.exe208⤵PID:3860
-
\??\c:\9jjdv.exec:\9jjdv.exe209⤵PID:1092
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe210⤵PID:484
-
\??\c:\rlrxrrr.exec:\rlrxrrr.exe211⤵PID:2376
-
\??\c:\bhttnn.exec:\bhttnn.exe212⤵PID:2092
-
\??\c:\nbntnt.exec:\nbntnt.exe213⤵PID:848
-
\??\c:\dvjdd.exec:\dvjdd.exe214⤵PID:3952
-
\??\c:\xrffflf.exec:\xrffflf.exe215⤵PID:3196
-
\??\c:\lxrrlrl.exec:\lxrrlrl.exe216⤵PID:5100
-
\??\c:\ttbttb.exec:\ttbttb.exe217⤵PID:5588
-
\??\c:\5hhbbb.exec:\5hhbbb.exe218⤵PID:5064
-
\??\c:\pjpjd.exec:\pjpjd.exe219⤵PID:4248
-
\??\c:\vdjdv.exec:\vdjdv.exe220⤵PID:4064
-
\??\c:\lflfxrr.exec:\lflfxrr.exe221⤵PID:492
-
\??\c:\3ntthn.exec:\3ntthn.exe222⤵PID:4848
-
\??\c:\ntbbtb.exec:\ntbbtb.exe223⤵PID:3844
-
\??\c:\jpjdd.exec:\jpjdd.exe224⤵PID:448
-
\??\c:\xlxxxff.exec:\xlxxxff.exe225⤵PID:5944
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe226⤵PID:3784
-
\??\c:\7nhhnn.exec:\7nhhnn.exe227⤵PID:4824
-
\??\c:\7vppd.exec:\7vppd.exe228⤵PID:5936
-
\??\c:\ddppp.exec:\ddppp.exe229⤵PID:5636
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe230⤵PID:3968
-
\??\c:\fxrrlll.exec:\fxrrlll.exe231⤵PID:3128
-
\??\c:\1bhhhh.exec:\1bhhhh.exe232⤵PID:3456
-
\??\c:\5ppjv.exec:\5ppjv.exe233⤵PID:5184
-
\??\c:\jdpjd.exec:\jdpjd.exe234⤵PID:1316
-
\??\c:\lrxxrrr.exec:\lrxxrrr.exe235⤵PID:1352
-
\??\c:\lfrrlrx.exec:\lfrrlrx.exe236⤵PID:1156
-
\??\c:\bbhbtt.exec:\bbhbtt.exe237⤵PID:2164
-
\??\c:\5ttnhh.exec:\5ttnhh.exe238⤵PID:4884
-
\??\c:\pjjdv.exec:\pjjdv.exe239⤵PID:4888
-
\??\c:\xflffrx.exec:\xflffrx.exe240⤵PID:3616
-
\??\c:\bttnbt.exec:\bttnbt.exe241⤵PID:5676
-
\??\c:\hhhnhh.exec:\hhhnhh.exe242⤵PID:5468