Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 08:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dcb6cada3493d7c18a05e16ebde07b7aef003dd27fa7817759ac3c9c7e1e3806.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
dcb6cada3493d7c18a05e16ebde07b7aef003dd27fa7817759ac3c9c7e1e3806.exe
-
Size
57KB
-
MD5
d5a10b61d149715a486ac88ed95683f0
-
SHA1
d4e9f4b1a4c8a1da55b0ac15dc8deae948ab492f
-
SHA256
dcb6cada3493d7c18a05e16ebde07b7aef003dd27fa7817759ac3c9c7e1e3806
-
SHA512
dd656ee59c3eea62726312be601aae234558540bbc68cd01d4d5d6e72679404c5540090146287ebcb71deb5e8db77c5492111526f4dff5490bcf084f35fc8e34
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuSwFN7:ymb3NkkiQ3mdBjFIvIFN7
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/4252-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/712-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-52-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2072-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2020-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5bnnnh.exe1xffxxx.exefxffxxx.exebttntn.exedvdvj.exevjddd.exeflrrlll.exenthnnn.exepppjd.exelfllfxr.exerllfffx.exetbttth.exevdppp.exexlrrfff.exenbhnbb.exetnnnhh.exeddddv.exedvvpj.exexlfflrl.exehbbntn.exenttttn.exe9pvvd.exedvvvj.exe7xffxxr.exelflffll.exetnnhnn.exethhhbn.exevvvpv.exejppvp.exexrrrrrf.exenhnnhh.exehtbbtt.exejvddd.exepjdvv.exexrxxxxr.exenhbthh.exebnnnhn.exeppdvp.exexrfxrrl.exexlrlflf.exenbhbtn.exettbtnn.exevpvvv.exefrrrrxx.exe1frrlrl.exepjjdd.exexllfffx.exehbbbtb.exepjpjj.exejdjjj.exerllrlll.exexrllllf.exe3bhhhh.exepjjvj.exepjvpp.exe7xxrllf.exelffxrrl.exenbbbbh.exehtbttt.exe1nbbnn.exevpjvp.exejpdvp.exe3rxrfff.exe5bnntt.exepid process 3016 5bnnnh.exe 3604 1xffxxx.exe 4156 fxffxxx.exe 712 bttntn.exe 4160 dvdvj.exe 2072 vjddd.exe 1684 flrrlll.exe 2224 nthnnn.exe 4908 pppjd.exe 4864 lfllfxr.exe 1988 rllfffx.exe 1696 tbttth.exe 3576 vdppp.exe 2728 xlrrfff.exe 1472 nbhnbb.exe 540 tnnnhh.exe 4728 ddddv.exe 4816 dvvpj.exe 3708 xlfflrl.exe 4544 hbbntn.exe 880 nttttn.exe 4900 9pvvd.exe 3836 dvvvj.exe 2020 7xffxxr.exe 4312 lflffll.exe 3560 tnnhnn.exe 756 thhhbn.exe 1116 vvvpv.exe 1804 jppvp.exe 2608 xrrrrrf.exe 4428 nhnnhh.exe 3188 htbbtt.exe 4896 jvddd.exe 4588 pjdvv.exe 4792 xrxxxxr.exe 4396 nhbthh.exe 1788 bnnnhn.exe 1208 ppdvp.exe 3472 xrfxrrl.exe 2460 xlrlflf.exe 4156 nbhbtn.exe 4440 ttbtnn.exe 3020 vpvvv.exe 3220 frrrrxx.exe 3440 1frrlrl.exe 2540 pjjdd.exe 4968 xllfffx.exe 2604 hbbbtb.exe 4752 pjpjj.exe 1128 jdjjj.exe 4948 rllrlll.exe 3116 xrllllf.exe 4856 3bhhhh.exe 5108 pjjvj.exe 4812 pjvpp.exe 4788 7xxrllf.exe 2724 lffxrrl.exe 4728 nbbbbh.exe 1424 htbttt.exe 4424 1nbbnn.exe 4844 vpjvp.exe 4472 jpdvp.exe 4732 3rxrfff.exe 2400 5bnntt.exe -
Processes:
resource yara_rule behavioral2/memory/4252-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/712-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2020-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dcb6cada3493d7c18a05e16ebde07b7aef003dd27fa7817759ac3c9c7e1e3806.exe5bnnnh.exe1xffxxx.exefxffxxx.exebttntn.exedvdvj.exevjddd.exeflrrlll.exenthnnn.exepppjd.exelfllfxr.exerllfffx.exetbttth.exevdppp.exexlrrfff.exenbhnbb.exetnnnhh.exeddddv.exedvvpj.exexlfflrl.exehbbntn.exenttttn.exedescription pid process target process PID 4252 wrote to memory of 3016 4252 dcb6cada3493d7c18a05e16ebde07b7aef003dd27fa7817759ac3c9c7e1e3806.exe 5bnnnh.exe PID 4252 wrote to memory of 3016 4252 dcb6cada3493d7c18a05e16ebde07b7aef003dd27fa7817759ac3c9c7e1e3806.exe 5bnnnh.exe PID 4252 wrote to memory of 3016 4252 dcb6cada3493d7c18a05e16ebde07b7aef003dd27fa7817759ac3c9c7e1e3806.exe 5bnnnh.exe PID 3016 wrote to memory of 3604 3016 5bnnnh.exe 1xffxxx.exe PID 3016 wrote to memory of 3604 3016 5bnnnh.exe 1xffxxx.exe PID 3016 wrote to memory of 3604 3016 5bnnnh.exe 1xffxxx.exe PID 3604 wrote to memory of 4156 3604 1xffxxx.exe fxffxxx.exe PID 3604 wrote to memory of 4156 3604 1xffxxx.exe fxffxxx.exe PID 3604 wrote to memory of 4156 3604 1xffxxx.exe fxffxxx.exe PID 4156 wrote to memory of 712 4156 fxffxxx.exe bttntn.exe PID 4156 wrote to memory of 712 4156 fxffxxx.exe bttntn.exe PID 4156 wrote to memory of 712 4156 fxffxxx.exe bttntn.exe PID 712 wrote to memory of 4160 712 bttntn.exe dvdvj.exe PID 712 wrote to memory of 4160 712 bttntn.exe dvdvj.exe PID 712 wrote to memory of 4160 712 bttntn.exe dvdvj.exe PID 4160 wrote to memory of 2072 4160 dvdvj.exe vjddd.exe PID 4160 wrote to memory of 2072 4160 dvdvj.exe vjddd.exe PID 4160 wrote to memory of 2072 4160 dvdvj.exe vjddd.exe PID 2072 wrote to memory of 1684 2072 vjddd.exe flrrlll.exe PID 2072 wrote to memory of 1684 2072 vjddd.exe flrrlll.exe PID 2072 wrote to memory of 1684 2072 vjddd.exe flrrlll.exe PID 1684 wrote to memory of 2224 1684 flrrlll.exe nthnnn.exe PID 1684 wrote to memory of 2224 1684 flrrlll.exe nthnnn.exe PID 1684 wrote to memory of 2224 1684 flrrlll.exe nthnnn.exe PID 2224 wrote to memory of 4908 2224 nthnnn.exe pppjd.exe PID 2224 wrote to memory of 4908 2224 nthnnn.exe pppjd.exe PID 2224 wrote to memory of 4908 2224 nthnnn.exe pppjd.exe PID 4908 wrote to memory of 4864 4908 pppjd.exe lfllfxr.exe PID 4908 wrote to memory of 4864 4908 pppjd.exe lfllfxr.exe PID 4908 wrote to memory of 4864 4908 pppjd.exe lfllfxr.exe PID 4864 wrote to memory of 1988 4864 lfllfxr.exe rllfffx.exe PID 4864 wrote to memory of 1988 4864 lfllfxr.exe rllfffx.exe PID 4864 wrote to memory of 1988 4864 lfllfxr.exe rllfffx.exe PID 1988 wrote to memory of 1696 1988 rllfffx.exe tbttth.exe PID 1988 wrote to memory of 1696 1988 rllfffx.exe tbttth.exe PID 1988 wrote to memory of 1696 1988 rllfffx.exe tbttth.exe PID 1696 wrote to memory of 3576 1696 tbttth.exe vdppp.exe PID 1696 wrote to memory of 3576 1696 tbttth.exe vdppp.exe PID 1696 wrote to memory of 3576 1696 tbttth.exe vdppp.exe PID 3576 wrote to memory of 2728 3576 vdppp.exe xlrrfff.exe PID 3576 wrote to memory of 2728 3576 vdppp.exe xlrrfff.exe PID 3576 wrote to memory of 2728 3576 vdppp.exe xlrrfff.exe PID 2728 wrote to memory of 1472 2728 xlrrfff.exe nbhnbb.exe PID 2728 wrote to memory of 1472 2728 xlrrfff.exe nbhnbb.exe PID 2728 wrote to memory of 1472 2728 xlrrfff.exe nbhnbb.exe PID 1472 wrote to memory of 540 1472 nbhnbb.exe tnnnhh.exe PID 1472 wrote to memory of 540 1472 nbhnbb.exe tnnnhh.exe PID 1472 wrote to memory of 540 1472 nbhnbb.exe tnnnhh.exe PID 540 wrote to memory of 4728 540 tnnnhh.exe ddddv.exe PID 540 wrote to memory of 4728 540 tnnnhh.exe ddddv.exe PID 540 wrote to memory of 4728 540 tnnnhh.exe ddddv.exe PID 4728 wrote to memory of 4816 4728 ddddv.exe dvvpj.exe PID 4728 wrote to memory of 4816 4728 ddddv.exe dvvpj.exe PID 4728 wrote to memory of 4816 4728 ddddv.exe dvvpj.exe PID 4816 wrote to memory of 3708 4816 dvvpj.exe xlfflrl.exe PID 4816 wrote to memory of 3708 4816 dvvpj.exe xlfflrl.exe PID 4816 wrote to memory of 3708 4816 dvvpj.exe xlfflrl.exe PID 3708 wrote to memory of 4544 3708 xlfflrl.exe hbbntn.exe PID 3708 wrote to memory of 4544 3708 xlfflrl.exe hbbntn.exe PID 3708 wrote to memory of 4544 3708 xlfflrl.exe hbbntn.exe PID 4544 wrote to memory of 880 4544 hbbntn.exe nttttn.exe PID 4544 wrote to memory of 880 4544 hbbntn.exe nttttn.exe PID 4544 wrote to memory of 880 4544 hbbntn.exe nttttn.exe PID 880 wrote to memory of 4900 880 nttttn.exe 9pvvd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcb6cada3493d7c18a05e16ebde07b7aef003dd27fa7817759ac3c9c7e1e3806.exe"C:\Users\Admin\AppData\Local\Temp\dcb6cada3493d7c18a05e16ebde07b7aef003dd27fa7817759ac3c9c7e1e3806.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\5bnnnh.exec:\5bnnnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\1xffxxx.exec:\1xffxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\fxffxxx.exec:\fxffxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\bttntn.exec:\bttntn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\dvdvj.exec:\dvdvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\vjddd.exec:\vjddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\flrrlll.exec:\flrrlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\nthnnn.exec:\nthnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\pppjd.exec:\pppjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\lfllfxr.exec:\lfllfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\rllfffx.exec:\rllfffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\tbttth.exec:\tbttth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\vdppp.exec:\vdppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\xlrrfff.exec:\xlrrfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\nbhnbb.exec:\nbhnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\tnnnhh.exec:\tnnnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\ddddv.exec:\ddddv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\dvvpj.exec:\dvvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\xlfflrl.exec:\xlfflrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\hbbntn.exec:\hbbntn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\nttttn.exec:\nttttn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\9pvvd.exec:\9pvvd.exe23⤵
- Executes dropped EXE
PID:4900 -
\??\c:\dvvvj.exec:\dvvvj.exe24⤵
- Executes dropped EXE
PID:3836 -
\??\c:\7xffxxr.exec:\7xffxxr.exe25⤵
- Executes dropped EXE
PID:2020 -
\??\c:\lflffll.exec:\lflffll.exe26⤵
- Executes dropped EXE
PID:4312 -
\??\c:\tnnhnn.exec:\tnnhnn.exe27⤵
- Executes dropped EXE
PID:3560 -
\??\c:\thhhbn.exec:\thhhbn.exe28⤵
- Executes dropped EXE
PID:756 -
\??\c:\vvvpv.exec:\vvvpv.exe29⤵
- Executes dropped EXE
PID:1116 -
\??\c:\jppvp.exec:\jppvp.exe30⤵
- Executes dropped EXE
PID:1804 -
\??\c:\xrrrrrf.exec:\xrrrrrf.exe31⤵
- Executes dropped EXE
PID:2608 -
\??\c:\nhnnhh.exec:\nhnnhh.exe32⤵
- Executes dropped EXE
PID:4428 -
\??\c:\htbbtt.exec:\htbbtt.exe33⤵
- Executes dropped EXE
PID:3188 -
\??\c:\jvddd.exec:\jvddd.exe34⤵
- Executes dropped EXE
PID:4896 -
\??\c:\pjdvv.exec:\pjdvv.exe35⤵
- Executes dropped EXE
PID:4588 -
\??\c:\xrxxxxr.exec:\xrxxxxr.exe36⤵
- Executes dropped EXE
PID:4792 -
\??\c:\nhbthh.exec:\nhbthh.exe37⤵
- Executes dropped EXE
PID:4396 -
\??\c:\bnnnhn.exec:\bnnnhn.exe38⤵
- Executes dropped EXE
PID:1788 -
\??\c:\ppdvp.exec:\ppdvp.exe39⤵
- Executes dropped EXE
PID:1208 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe40⤵
- Executes dropped EXE
PID:3472 -
\??\c:\xlrlflf.exec:\xlrlflf.exe41⤵
- Executes dropped EXE
PID:2460 -
\??\c:\nbhbtn.exec:\nbhbtn.exe42⤵
- Executes dropped EXE
PID:4156 -
\??\c:\ttbtnn.exec:\ttbtnn.exe43⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vpvvv.exec:\vpvvv.exe44⤵
- Executes dropped EXE
PID:3020 -
\??\c:\frrrrxx.exec:\frrrrxx.exe45⤵
- Executes dropped EXE
PID:3220 -
\??\c:\1frrlrl.exec:\1frrlrl.exe46⤵
- Executes dropped EXE
PID:3440 -
\??\c:\pjjdd.exec:\pjjdd.exe47⤵
- Executes dropped EXE
PID:2540 -
\??\c:\xllfffx.exec:\xllfffx.exe48⤵
- Executes dropped EXE
PID:4968 -
\??\c:\hbbbtb.exec:\hbbbtb.exe49⤵
- Executes dropped EXE
PID:2604 -
\??\c:\pjpjj.exec:\pjpjj.exe50⤵
- Executes dropped EXE
PID:4752 -
\??\c:\jdjjj.exec:\jdjjj.exe51⤵
- Executes dropped EXE
PID:1128 -
\??\c:\rllrlll.exec:\rllrlll.exe52⤵
- Executes dropped EXE
PID:4948 -
\??\c:\xrllllf.exec:\xrllllf.exe53⤵
- Executes dropped EXE
PID:3116 -
\??\c:\3bhhhh.exec:\3bhhhh.exe54⤵
- Executes dropped EXE
PID:4856 -
\??\c:\pjjvj.exec:\pjjvj.exe55⤵
- Executes dropped EXE
PID:5108 -
\??\c:\pjvpp.exec:\pjvpp.exe56⤵
- Executes dropped EXE
PID:4812 -
\??\c:\7xxrllf.exec:\7xxrllf.exe57⤵
- Executes dropped EXE
PID:4788 -
\??\c:\lffxrrl.exec:\lffxrrl.exe58⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nbbbbh.exec:\nbbbbh.exe59⤵
- Executes dropped EXE
PID:4728 -
\??\c:\htbttt.exec:\htbttt.exe60⤵
- Executes dropped EXE
PID:1424 -
\??\c:\1nbbnn.exec:\1nbbnn.exe61⤵
- Executes dropped EXE
PID:4424 -
\??\c:\vpjvp.exec:\vpjvp.exe62⤵
- Executes dropped EXE
PID:4844 -
\??\c:\jpdvp.exec:\jpdvp.exe63⤵
- Executes dropped EXE
PID:4472 -
\??\c:\3rxrfff.exec:\3rxrfff.exe64⤵
- Executes dropped EXE
PID:4732 -
\??\c:\5bnntt.exec:\5bnntt.exe65⤵
- Executes dropped EXE
PID:2400 -
\??\c:\tnbbhh.exec:\tnbbhh.exe66⤵PID:824
-
\??\c:\jjjdv.exec:\jjjdv.exe67⤵PID:2052
-
\??\c:\lfflflr.exec:\lfflflr.exe68⤵PID:1580
-
\??\c:\lrxrllr.exec:\lrxrllr.exe69⤵PID:4568
-
\??\c:\nntttt.exec:\nntttt.exe70⤵PID:4344
-
\??\c:\tnnnnn.exec:\tnnnnn.exe71⤵PID:1984
-
\??\c:\dpvdv.exec:\dpvdv.exe72⤵PID:756
-
\??\c:\ddddv.exec:\ddddv.exe73⤵PID:4204
-
\??\c:\flffrxx.exec:\flffrxx.exe74⤵PID:3476
-
\??\c:\ffrllfx.exec:\ffrllfx.exe75⤵PID:4196
-
\??\c:\tntbtb.exec:\tntbtb.exe76⤵PID:3416
-
\??\c:\nbthth.exec:\nbthth.exe77⤵PID:4404
-
\??\c:\jppjj.exec:\jppjj.exe78⤵PID:700
-
\??\c:\vpvpj.exec:\vpvpj.exe79⤵PID:3032
-
\??\c:\1rxxrrl.exec:\1rxxrrl.exe80⤵PID:4588
-
\??\c:\xlfxxxr.exec:\xlfxxxr.exe81⤵PID:2804
-
\??\c:\9bhhbb.exec:\9bhhbb.exe82⤵PID:1228
-
\??\c:\hhtttt.exec:\hhtttt.exe83⤵PID:968
-
\??\c:\vjvpp.exec:\vjvpp.exe84⤵PID:4012
-
\??\c:\jpppd.exec:\jpppd.exe85⤵PID:4868
-
\??\c:\rrlrlll.exec:\rrlrlll.exe86⤵PID:4572
-
\??\c:\rllllll.exec:\rllllll.exe87⤵PID:2160
-
\??\c:\tnbbhh.exec:\tnbbhh.exe88⤵PID:3412
-
\??\c:\btbbbb.exec:\btbbbb.exe89⤵PID:3948
-
\??\c:\dvppp.exec:\dvppp.exe90⤵PID:1032
-
\??\c:\vpjjd.exec:\vpjjd.exe91⤵PID:3192
-
\??\c:\rrrrlll.exec:\rrrrlll.exe92⤵PID:3440
-
\??\c:\rlfflfx.exec:\rlfflfx.exe93⤵PID:2540
-
\??\c:\bthnhn.exec:\bthnhn.exe94⤵PID:3868
-
\??\c:\ddddp.exec:\ddddp.exe95⤵PID:2604
-
\??\c:\dvjpj.exec:\dvjpj.exe96⤵PID:4752
-
\??\c:\xlfxxfr.exec:\xlfxxfr.exe97⤵PID:4956
-
\??\c:\rflffrl.exec:\rflffrl.exe98⤵PID:2920
-
\??\c:\bttttt.exec:\bttttt.exe99⤵PID:3576
-
\??\c:\pjpjj.exec:\pjpjj.exe100⤵PID:4856
-
\??\c:\9pvpd.exec:\9pvpd.exe101⤵PID:2068
-
\??\c:\rxxrxxr.exec:\rxxrxxr.exe102⤵PID:2732
-
\??\c:\xlllxxx.exec:\xlllxxx.exe103⤵PID:3960
-
\??\c:\bnnhhn.exec:\bnnhhn.exe104⤵PID:1692
-
\??\c:\7bbtnn.exec:\7bbtnn.exe105⤵PID:2388
-
\??\c:\7vddd.exec:\7vddd.exe106⤵PID:4544
-
\??\c:\dvvvv.exec:\dvvvv.exe107⤵PID:468
-
\??\c:\lrxllrr.exec:\lrxllrr.exe108⤵PID:752
-
\??\c:\rlllflr.exec:\rlllflr.exe109⤵PID:3824
-
\??\c:\bthhhh.exec:\bthhhh.exe110⤵PID:4944
-
\??\c:\hbnhnn.exec:\hbnhnn.exe111⤵PID:4044
-
\??\c:\vpjdp.exec:\vpjdp.exe112⤵PID:1332
-
\??\c:\dvddv.exec:\dvddv.exe113⤵PID:4056
-
\??\c:\xrflxrl.exec:\xrflxrl.exe114⤵PID:2232
-
\??\c:\xrrrlll.exec:\xrrrlll.exe115⤵PID:452
-
\??\c:\nnbttb.exec:\nnbttb.exe116⤵PID:3656
-
\??\c:\nbhtnh.exec:\nbhtnh.exe117⤵PID:740
-
\??\c:\3jvpp.exec:\3jvpp.exe118⤵PID:1804
-
\??\c:\jvdvp.exec:\jvdvp.exe119⤵PID:4592
-
\??\c:\rfrlfff.exec:\rfrlfff.exe120⤵PID:4428
-
\??\c:\nhnnnn.exec:\nhnnnn.exe121⤵PID:2644
-
\??\c:\thnhbb.exec:\thnhbb.exe122⤵PID:3700
-
\??\c:\jvvvp.exec:\jvvvp.exe123⤵PID:4264
-
\??\c:\pppdj.exec:\pppdj.exe124⤵PID:912
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe125⤵PID:4252
-
\??\c:\fxrrrxx.exec:\fxrrrxx.exe126⤵PID:2064
-
\??\c:\bnbbtb.exec:\bnbbtb.exe127⤵PID:4356
-
\??\c:\hhtnhb.exec:\hhtnhb.exe128⤵PID:4868
-
\??\c:\5pjjd.exec:\5pjjd.exe129⤵PID:2488
-
\??\c:\5jppd.exec:\5jppd.exe130⤵PID:4940
-
\??\c:\xrxrfll.exec:\xrxrfll.exe131⤵PID:2600
-
\??\c:\rllfrrr.exec:\rllfrrr.exe132⤵PID:1732
-
\??\c:\9vvvv.exec:\9vvvv.exe133⤵PID:4952
-
\??\c:\lfrlllr.exec:\lfrlllr.exe134⤵PID:4528
-
\??\c:\hbhnhh.exec:\hbhnhh.exe135⤵PID:1456
-
\??\c:\nhbtnt.exec:\nhbtnt.exe136⤵PID:1152
-
\??\c:\vvvvp.exec:\vvvvp.exe137⤵PID:2740
-
\??\c:\xllfxxf.exec:\xllfxxf.exe138⤵PID:1128
-
\??\c:\rxfxlxl.exec:\rxfxlxl.exe139⤵PID:4948
-
\??\c:\1hbbtb.exec:\1hbbtb.exe140⤵PID:4956
-
\??\c:\nhbtbb.exec:\nhbtbb.exe141⤵PID:2920
-
\??\c:\jdddv.exec:\jdddv.exe142⤵PID:5108
-
\??\c:\lfxrrxx.exec:\lfxrrxx.exe143⤵PID:1472
-
\??\c:\1fxrlrl.exec:\1fxrlrl.exe144⤵PID:3704
-
\??\c:\7tttnh.exec:\7tttnh.exe145⤵PID:4728
-
\??\c:\1hhbnn.exec:\1hhbnn.exe146⤵PID:1192
-
\??\c:\jdjdd.exec:\jdjdd.exe147⤵PID:1704
-
\??\c:\rflfxxr.exec:\rflfxxr.exe148⤵PID:468
-
\??\c:\fxxrllf.exec:\fxxrllf.exe149⤵PID:4936
-
\??\c:\5bhhbh.exec:\5bhhbh.exe150⤵PID:4732
-
\??\c:\7jjdv.exec:\7jjdv.exe151⤵PID:3836
-
\??\c:\3xxxxxf.exec:\3xxxxxf.exe152⤵PID:2020
-
\??\c:\jdvvp.exec:\jdvvp.exe153⤵PID:1332
-
\??\c:\dvvvj.exec:\dvvvj.exe154⤵PID:4344
-
\??\c:\bbbttt.exec:\bbbttt.exe155⤵PID:2228
-
\??\c:\jpdvp.exec:\jpdvp.exe156⤵PID:4064
-
\??\c:\dvjjd.exec:\dvjjd.exe157⤵PID:4804
-
\??\c:\ttnhtt.exec:\ttnhtt.exe158⤵PID:3688
-
\??\c:\frlfffx.exec:\frlfffx.exe159⤵PID:4196
-
\??\c:\7rrrrrl.exec:\7rrrrrl.exe160⤵PID:2404
-
\??\c:\hhhhbh.exec:\hhhhbh.exe161⤵PID:3416
-
\??\c:\tbhhhh.exec:\tbhhhh.exe162⤵PID:2168
-
\??\c:\jjjjj.exec:\jjjjj.exe163⤵PID:4384
-
\??\c:\vdjjj.exec:\vdjjj.exe164⤵PID:768
-
\??\c:\xfllllr.exec:\xfllllr.exe165⤵PID:5040
-
\??\c:\bbbttt.exec:\bbbttt.exe166⤵PID:4340
-
\??\c:\tntbtb.exec:\tntbtb.exe167⤵PID:2064
-
\??\c:\dvjjp.exec:\dvjjp.exe168⤵PID:4356
-
\??\c:\vpvvv.exec:\vpvvv.exe169⤵PID:4868
-
\??\c:\lfffffx.exec:\lfffffx.exe170⤵PID:2488
-
\??\c:\nbntnn.exec:\nbntnn.exe171⤵PID:2204
-
\??\c:\thhbbb.exec:\thhbbb.exe172⤵PID:4556
-
\??\c:\jdjdj.exec:\jdjdj.exe173⤵PID:3184
-
\??\c:\1jppj.exec:\1jppj.exe174⤵PID:3164
-
\??\c:\5rfllrr.exec:\5rfllrr.exe175⤵PID:3440
-
\??\c:\lxfffff.exec:\lxfffff.exe176⤵PID:2324
-
\??\c:\5nbthh.exec:\5nbthh.exe177⤵PID:4688
-
\??\c:\nhthhh.exec:\nhthhh.exe178⤵PID:1988
-
\??\c:\jdvpj.exec:\jdvpj.exe179⤵PID:1112
-
\??\c:\dddpd.exec:\dddpd.exe180⤵PID:4956
-
\??\c:\flrlrrl.exec:\flrlrrl.exe181⤵PID:4812
-
\??\c:\9llflrl.exec:\9llflrl.exe182⤵PID:3960
-
\??\c:\llfxxxr.exec:\llfxxxr.exe183⤵PID:1628
-
\??\c:\nhbbtt.exec:\nhbbtt.exe184⤵PID:2192
-
\??\c:\htnnhb.exec:\htnnhb.exe185⤵PID:4472
-
\??\c:\djjjd.exec:\djjjd.exe186⤵PID:5100
-
\??\c:\jjdpj.exec:\jjdpj.exe187⤵PID:3824
-
\??\c:\jdjdv.exec:\jdjdv.exe188⤵PID:2792
-
\??\c:\9xfxrrr.exec:\9xfxrrr.exe189⤵PID:4084
-
\??\c:\tnnthb.exec:\tnnthb.exe190⤵PID:3516
-
\??\c:\7jpvp.exec:\7jpvp.exe191⤵PID:2232
-
\??\c:\vjpjd.exec:\vjpjd.exe192⤵PID:592
-
\??\c:\rxlfrxr.exec:\rxlfrxr.exe193⤵PID:4204
-
\??\c:\hbtnbh.exec:\hbtnbh.exe194⤵PID:5048
-
\??\c:\dvpjj.exec:\dvpjj.exe195⤵PID:3688
-
\??\c:\lrxrlxr.exec:\lrxrlxr.exe196⤵PID:212
-
\??\c:\thnthn.exec:\thnthn.exe197⤵PID:3252
-
\??\c:\5tnhhh.exec:\5tnhhh.exe198⤵PID:3416
-
\??\c:\ddddj.exec:\ddddj.exe199⤵PID:2168
-
\??\c:\9xflfxl.exec:\9xflfxl.exe200⤵PID:2904
-
\??\c:\ntbbtt.exec:\ntbbtt.exe201⤵PID:4192
-
\??\c:\vpddj.exec:\vpddj.exe202⤵PID:5040
-
\??\c:\rrffrxf.exec:\rrffrxf.exe203⤵PID:4380
-
\??\c:\vpvpv.exec:\vpvpv.exe204⤵PID:2064
-
\??\c:\xrllxxf.exec:\xrllxxf.exe205⤵PID:4156
-
\??\c:\vpvvp.exec:\vpvvp.exe206⤵PID:5080
-
\??\c:\dvvjd.exec:\dvvjd.exe207⤵PID:2488
-
\??\c:\3xlfrrl.exec:\3xlfrrl.exe208⤵PID:4832
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe209⤵PID:1776
-
\??\c:\tthhnn.exec:\tthhnn.exe210⤵PID:4972
-
\??\c:\btnhbt.exec:\btnhbt.exe211⤵PID:4968
-
\??\c:\vjpjd.exec:\vjpjd.exe212⤵PID:544
-
\??\c:\pvdpv.exec:\pvdpv.exe213⤵PID:2740
-
\??\c:\rllfllr.exec:\rllfllr.exe214⤵PID:4948
-
\??\c:\xrxllrr.exec:\xrxllrr.exe215⤵PID:3268
-
\??\c:\hhnttb.exec:\hhnttb.exe216⤵PID:2596
-
\??\c:\jvpjv.exec:\jvpjv.exe217⤵PID:2828
-
\??\c:\5dvvp.exec:\5dvvp.exe218⤵PID:4332
-
\??\c:\pjddd.exec:\pjddd.exe219⤵PID:1192
-
\??\c:\xlxxffx.exec:\xlxxffx.exe220⤵PID:752
-
\??\c:\9frrxfl.exec:\9frrxfl.exe221⤵PID:4348
-
\??\c:\htbbbb.exec:\htbbbb.exe222⤵PID:4840
-
\??\c:\1bhbtt.exec:\1bhbtt.exe223⤵PID:4308
-
\??\c:\jvvvd.exec:\jvvvd.exe224⤵PID:4568
-
\??\c:\1dpjj.exec:\1dpjj.exe225⤵PID:4056
-
\??\c:\frflrrf.exec:\frflrrf.exe226⤵PID:656
-
\??\c:\hbbtnh.exec:\hbbtnh.exe227⤵PID:3672
-
\??\c:\7nbttt.exec:\7nbttt.exe228⤵PID:3476
-
\??\c:\vjjdv.exec:\vjjdv.exe229⤵PID:2928
-
\??\c:\lrrlffx.exec:\lrrlffx.exe230⤵PID:1200
-
\??\c:\lxxxlll.exec:\lxxxlll.exe231⤵PID:1140
-
\??\c:\btbntb.exec:\btbntb.exe232⤵PID:2676
-
\??\c:\ttbtnn.exec:\ttbtnn.exe233⤵PID:368
-
\??\c:\pjdvv.exec:\pjdvv.exe234⤵PID:3544
-
\??\c:\ppjjp.exec:\ppjjp.exe235⤵PID:912
-
\??\c:\llxxlff.exec:\llxxlff.exe236⤵PID:968
-
\??\c:\9rfxffl.exec:\9rfxffl.exe237⤵PID:5040
-
\??\c:\thbbbb.exec:\thbbbb.exe238⤵PID:4380
-
\??\c:\hnhbtt.exec:\hnhbtt.exe239⤵PID:712
-
\??\c:\dppjd.exec:\dppjd.exe240⤵PID:4156
-
\??\c:\vjpjd.exec:\vjpjd.exe241⤵PID:5080
-
\??\c:\rlrrflx.exec:\rlrrflx.exe242⤵PID:4556