Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 03:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe
-
Size
345KB
-
MD5
190831908333df1dbde6f87601ea90b6
-
SHA1
7ce05d6cc63a19b512521e1515417ff3e7c4d214
-
SHA256
dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82
-
SHA512
8d1887df78b9c083d13403fee900ae0f118f5067fc7902bd92c2a860917d0d261724a4e34b81cb225296cc80db6b6cd17d5fa3d51130c862c802ac78fcb04e0a
-
SSDEEP
6144:n3C9BRo/AIX2MUXownfWQkyCpxwJz9e0pQowLh3EhToK9cT085mnFhXjmnwJQyIl:n3C9uDnUXoSWlnwJv90aKToFqwfIBL
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/876-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1300-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 25 IoCs
resource yara_rule behavioral2/memory/876-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5112-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4872-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/516-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5060-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1712-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1672-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4896-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4832-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3268-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3268-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3268-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3268-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2060-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2324-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1300-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2320-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3712-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1748-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4288-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4368-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2468-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3044-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3452-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4836-186-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 5112 pdppd.exe 4872 rxrllff.exe 4896 9hnbht.exe 1672 5pddv.exe 516 9rlxrrl.exe 5060 frrxrlf.exe 1712 vvdpd.exe 4112 xlfffxx.exe 4832 vjjjj.exe 3268 xrxrrxx.exe 3292 3jjvp.exe 2060 tnbtbb.exe 2324 lfxrrrr.exe 1300 bntnnn.exe 2320 rflfffx.exe 3712 1tntth.exe 1748 xrlxllx.exe 3752 vvdpd.exe 4288 1xllrxr.exe 3272 fxlflll.exe 1504 jdvpv.exe 380 xlxxfrl.exe 4368 hhnhnt.exe 2468 jpvvv.exe 3044 lfrfrrx.exe 4872 httnhn.exe 3452 rrlfxxf.exe 4836 llllfff.exe 2996 fxxxrrr.exe 2600 vjjdv.exe 704 djjpp.exe 60 xrxrlxr.exe 3796 bthbtb.exe 4832 1vdpj.exe 2028 xffxrff.exe 4028 fxxrlll.exe 2708 btthnb.exe 2204 pdjdv.exe 556 frflfxr.exe 3160 lfrlffx.exe 4136 bhhhbt.exe 3708 jvvdv.exe 1832 9fffxxr.exe 1196 tbnnht.exe 2596 vpvvv.exe 2416 pjvpd.exe 5096 5lfxlrf.exe 460 5bbbtt.exe 4828 btnbnh.exe 4772 3pvpp.exe 2668 lrfrffx.exe 4564 rfxrlfx.exe 380 bnnhhh.exe 4352 vjvjj.exe 3276 jvdpj.exe 4336 xrlrlrr.exe 4896 7ntnhh.exe 2124 jppjd.exe 1672 7lrlfll.exe 4836 lfllrxx.exe 1008 bhnnnt.exe 2308 jdjdv.exe 400 rlrlffx.exe 4572 htbbtt.exe -
resource yara_rule behavioral2/memory/876-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-186-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 876 wrote to memory of 5112 876 dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe 92 PID 876 wrote to memory of 5112 876 dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe 92 PID 876 wrote to memory of 5112 876 dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe 92 PID 5112 wrote to memory of 4872 5112 pdppd.exe 93 PID 5112 wrote to memory of 4872 5112 pdppd.exe 93 PID 5112 wrote to memory of 4872 5112 pdppd.exe 93 PID 4872 wrote to memory of 4896 4872 rxrllff.exe 94 PID 4872 wrote to memory of 4896 4872 rxrllff.exe 94 PID 4872 wrote to memory of 4896 4872 rxrllff.exe 94 PID 4896 wrote to memory of 1672 4896 9hnbht.exe 95 PID 4896 wrote to memory of 1672 4896 9hnbht.exe 95 PID 4896 wrote to memory of 1672 4896 9hnbht.exe 95 PID 1672 wrote to memory of 516 1672 5pddv.exe 96 PID 1672 wrote to memory of 516 1672 5pddv.exe 96 PID 1672 wrote to memory of 516 1672 5pddv.exe 96 PID 516 wrote to memory of 5060 516 9rlxrrl.exe 97 PID 516 wrote to memory of 5060 516 9rlxrrl.exe 97 PID 516 wrote to memory of 5060 516 9rlxrrl.exe 97 PID 5060 wrote to memory of 1712 5060 frrxrlf.exe 98 PID 5060 wrote to memory of 1712 5060 frrxrlf.exe 98 PID 5060 wrote to memory of 1712 5060 frrxrlf.exe 98 PID 1712 wrote to memory of 4112 1712 vvdpd.exe 99 PID 1712 wrote to memory of 4112 1712 vvdpd.exe 99 PID 1712 wrote to memory of 4112 1712 vvdpd.exe 99 PID 4112 wrote to memory of 4832 4112 xlfffxx.exe 100 PID 4112 wrote to memory of 4832 4112 xlfffxx.exe 100 PID 4112 wrote to memory of 4832 4112 xlfffxx.exe 100 PID 4832 wrote to memory of 3268 4832 vjjjj.exe 101 PID 4832 wrote to memory of 3268 4832 vjjjj.exe 101 PID 4832 wrote to memory of 3268 4832 vjjjj.exe 101 PID 3268 wrote to memory of 3292 3268 xrxrrxx.exe 103 PID 3268 wrote to memory of 3292 3268 xrxrrxx.exe 103 PID 3268 wrote to memory of 3292 3268 xrxrrxx.exe 103 PID 3292 wrote to memory of 2060 3292 3jjvp.exe 104 PID 3292 wrote to memory of 2060 3292 3jjvp.exe 104 PID 3292 wrote to memory of 2060 3292 3jjvp.exe 104 PID 2060 wrote to memory of 2324 2060 tnbtbb.exe 105 PID 2060 wrote to memory of 2324 2060 tnbtbb.exe 105 PID 2060 wrote to memory of 2324 2060 tnbtbb.exe 105 PID 2324 wrote to memory of 1300 2324 lfxrrrr.exe 106 PID 2324 wrote to memory of 1300 2324 lfxrrrr.exe 106 PID 2324 wrote to memory of 1300 2324 lfxrrrr.exe 106 PID 1300 wrote to memory of 2320 1300 bntnnn.exe 107 PID 1300 wrote to memory of 2320 1300 bntnnn.exe 107 PID 1300 wrote to memory of 2320 1300 bntnnn.exe 107 PID 2320 wrote to memory of 3712 2320 rflfffx.exe 108 PID 2320 wrote to memory of 3712 2320 rflfffx.exe 108 PID 2320 wrote to memory of 3712 2320 rflfffx.exe 108 PID 3712 wrote to memory of 1748 3712 1tntth.exe 109 PID 3712 wrote to memory of 1748 3712 1tntth.exe 109 PID 3712 wrote to memory of 1748 3712 1tntth.exe 109 PID 1748 wrote to memory of 3752 1748 xrlxllx.exe 110 PID 1748 wrote to memory of 3752 1748 xrlxllx.exe 110 PID 1748 wrote to memory of 3752 1748 xrlxllx.exe 110 PID 3752 wrote to memory of 4288 3752 vvdpd.exe 111 PID 3752 wrote to memory of 4288 3752 vvdpd.exe 111 PID 3752 wrote to memory of 4288 3752 vvdpd.exe 111 PID 4288 wrote to memory of 3272 4288 1xllrxr.exe 112 PID 4288 wrote to memory of 3272 4288 1xllrxr.exe 112 PID 4288 wrote to memory of 3272 4288 1xllrxr.exe 112 PID 3272 wrote to memory of 1504 3272 fxlflll.exe 113 PID 3272 wrote to memory of 1504 3272 fxlflll.exe 113 PID 3272 wrote to memory of 1504 3272 fxlflll.exe 113 PID 1504 wrote to memory of 380 1504 jdvpv.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe"C:\Users\Admin\AppData\Local\Temp\dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\pdppd.exec:\pdppd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\rxrllff.exec:\rxrllff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\9hnbht.exec:\9hnbht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\5pddv.exec:\5pddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\9rlxrrl.exec:\9rlxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\frrxrlf.exec:\frrxrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\vvdpd.exec:\vvdpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\xlfffxx.exec:\xlfffxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\vjjjj.exec:\vjjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\xrxrrxx.exec:\xrxrrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\3jjvp.exec:\3jjvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\tnbtbb.exec:\tnbtbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\lfxrrrr.exec:\lfxrrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\bntnnn.exec:\bntnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\rflfffx.exec:\rflfffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\1tntth.exec:\1tntth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\xrlxllx.exec:\xrlxllx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\vvdpd.exec:\vvdpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\1xllrxr.exec:\1xllrxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\fxlflll.exec:\fxlflll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\jdvpv.exec:\jdvpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\xlxxfrl.exec:\xlxxfrl.exe23⤵
- Executes dropped EXE
PID:380 -
\??\c:\hhnhnt.exec:\hhnhnt.exe24⤵
- Executes dropped EXE
PID:4368 -
\??\c:\jpvvv.exec:\jpvvv.exe25⤵
- Executes dropped EXE
PID:2468 -
\??\c:\lfrfrrx.exec:\lfrfrrx.exe26⤵
- Executes dropped EXE
PID:3044 -
\??\c:\httnhn.exec:\httnhn.exe27⤵
- Executes dropped EXE
PID:4872 -
\??\c:\rrlfxxf.exec:\rrlfxxf.exe28⤵
- Executes dropped EXE
PID:3452 -
\??\c:\llllfff.exec:\llllfff.exe29⤵
- Executes dropped EXE
PID:4836 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe30⤵
- Executes dropped EXE
PID:2996 -
\??\c:\vjjdv.exec:\vjjdv.exe31⤵
- Executes dropped EXE
PID:2600 -
\??\c:\djjpp.exec:\djjpp.exe32⤵
- Executes dropped EXE
PID:704 -
\??\c:\xrxrlxr.exec:\xrxrlxr.exe33⤵
- Executes dropped EXE
PID:60 -
\??\c:\bthbtb.exec:\bthbtb.exe34⤵
- Executes dropped EXE
PID:3796 -
\??\c:\1vdpj.exec:\1vdpj.exe35⤵
- Executes dropped EXE
PID:4832 -
\??\c:\xffxrff.exec:\xffxrff.exe36⤵
- Executes dropped EXE
PID:2028 -
\??\c:\fxxrlll.exec:\fxxrlll.exe37⤵
- Executes dropped EXE
PID:4028 -
\??\c:\btthnb.exec:\btthnb.exe38⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pdjdv.exec:\pdjdv.exe39⤵
- Executes dropped EXE
PID:2204 -
\??\c:\frflfxr.exec:\frflfxr.exe40⤵
- Executes dropped EXE
PID:556 -
\??\c:\lfrlffx.exec:\lfrlffx.exe41⤵
- Executes dropped EXE
PID:3160 -
\??\c:\bhhhbt.exec:\bhhhbt.exe42⤵
- Executes dropped EXE
PID:4136 -
\??\c:\jvvdv.exec:\jvvdv.exe43⤵
- Executes dropped EXE
PID:3708 -
\??\c:\9fffxxr.exec:\9fffxxr.exe44⤵
- Executes dropped EXE
PID:1832 -
\??\c:\tbnnht.exec:\tbnnht.exe45⤵
- Executes dropped EXE
PID:1196 -
\??\c:\vpvvv.exec:\vpvvv.exe46⤵
- Executes dropped EXE
PID:2596 -
\??\c:\pjvpd.exec:\pjvpd.exe47⤵
- Executes dropped EXE
PID:2416 -
\??\c:\5lfxlrf.exec:\5lfxlrf.exe48⤵
- Executes dropped EXE
PID:5096 -
\??\c:\5bbbtt.exec:\5bbbtt.exe49⤵
- Executes dropped EXE
PID:460 -
\??\c:\btnbnh.exec:\btnbnh.exe50⤵
- Executes dropped EXE
PID:4828 -
\??\c:\3pvpp.exec:\3pvpp.exe51⤵
- Executes dropped EXE
PID:4772 -
\??\c:\lrfrffx.exec:\lrfrffx.exe52⤵
- Executes dropped EXE
PID:2668 -
\??\c:\rfxrlfx.exec:\rfxrlfx.exe53⤵
- Executes dropped EXE
PID:4564 -
\??\c:\bnnhhh.exec:\bnnhhh.exe54⤵
- Executes dropped EXE
PID:380 -
\??\c:\vjvjj.exec:\vjvjj.exe55⤵
- Executes dropped EXE
PID:4352 -
\??\c:\jvdpj.exec:\jvdpj.exe56⤵
- Executes dropped EXE
PID:3276 -
\??\c:\xrlrlrr.exec:\xrlrlrr.exe57⤵
- Executes dropped EXE
PID:4336 -
\??\c:\7ntnhh.exec:\7ntnhh.exe58⤵
- Executes dropped EXE
PID:4896 -
\??\c:\jppjd.exec:\jppjd.exe59⤵
- Executes dropped EXE
PID:2124 -
\??\c:\7lrlfll.exec:\7lrlfll.exe60⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lfllrxx.exec:\lfllrxx.exe61⤵
- Executes dropped EXE
PID:4836 -
\??\c:\bhnnnt.exec:\bhnnnt.exe62⤵
- Executes dropped EXE
PID:1008 -
\??\c:\jdjdv.exec:\jdjdv.exe63⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rlrlffx.exec:\rlrlffx.exe64⤵
- Executes dropped EXE
PID:400 -
\??\c:\htbbtt.exec:\htbbtt.exe65⤵
- Executes dropped EXE
PID:4572 -
\??\c:\jdddv.exec:\jdddv.exe66⤵PID:3256
-
\??\c:\jdjjd.exec:\jdjjd.exe67⤵PID:1964
-
\??\c:\fffxxxr.exec:\fffxxxr.exe68⤵PID:4832
-
\??\c:\nbnnnn.exec:\nbnnnn.exe69⤵PID:2028
-
\??\c:\vpdvp.exec:\vpdvp.exe70⤵PID:4968
-
\??\c:\vvvvd.exec:\vvvvd.exe71⤵PID:2060
-
\??\c:\fxlfxrf.exec:\fxlfxrf.exe72⤵PID:2204
-
\??\c:\nbhhbn.exec:\nbhhbn.exe73⤵PID:556
-
\??\c:\9dvpp.exec:\9dvpp.exe74⤵PID:3160
-
\??\c:\fllfrrf.exec:\fllfrrf.exe75⤵PID:636
-
\??\c:\llrlffx.exec:\llrlffx.exe76⤵PID:2652
-
\??\c:\hbtnhb.exec:\hbtnhb.exe77⤵PID:4048
-
\??\c:\pvvpp.exec:\pvvpp.exe78⤵PID:3712
-
\??\c:\xffxrll.exec:\xffxrll.exe79⤵PID:1748
-
\??\c:\ttnhnn.exec:\ttnhnn.exe80⤵PID:3720
-
\??\c:\ddvpd.exec:\ddvpd.exe81⤵PID:1596
-
\??\c:\rlllffx.exec:\rlllffx.exe82⤵PID:4828
-
\??\c:\ntbttt.exec:\ntbttt.exe83⤵PID:1064
-
\??\c:\7ppdv.exec:\7ppdv.exe84⤵PID:4144
-
\??\c:\vvddd.exec:\vvddd.exe85⤵PID:4564
-
\??\c:\1xrllrr.exec:\1xrllrr.exe86⤵PID:380
-
\??\c:\nnttnh.exec:\nnttnh.exe87⤵PID:3852
-
\??\c:\3bbthh.exec:\3bbthh.exe88⤵PID:4736
-
\??\c:\vvvpp.exec:\vvvpp.exe89⤵PID:2564
-
\??\c:\xxfxrll.exec:\xxfxrll.exe90⤵PID:4896
-
\??\c:\7xxfrfl.exec:\7xxfrfl.exe91⤵PID:1112
-
\??\c:\5ttnhn.exec:\5ttnhn.exe92⤵PID:2188
-
\??\c:\5jdjp.exec:\5jdjp.exe93⤵PID:4644
-
\??\c:\3llfxxr.exec:\3llfxxr.exe94⤵PID:3108
-
\??\c:\xflfrlr.exec:\xflfrlr.exe95⤵PID:2172
-
\??\c:\9nnbbb.exec:\9nnbbb.exe96⤵PID:2588
-
\??\c:\jpvvv.exec:\jpvvv.exe97⤵PID:1084
-
\??\c:\vppdv.exec:\vppdv.exe98⤵PID:4980
-
\??\c:\lrfxfrl.exec:\lrfxfrl.exe99⤵PID:4616
-
\??\c:\7bthnb.exec:\7bthnb.exe100⤵PID:2028
-
\??\c:\3tbtnh.exec:\3tbtnh.exe101⤵PID:3224
-
\??\c:\fxflxxr.exec:\fxflxxr.exe102⤵PID:4408
-
\??\c:\xfffffx.exec:\xfffffx.exe103⤵PID:2204
-
\??\c:\bnbbtt.exec:\bnbbtt.exe104⤵PID:2320
-
\??\c:\vvpjv.exec:\vvpjv.exe105⤵PID:3160
-
\??\c:\5jdpp.exec:\5jdpp.exe106⤵PID:636
-
\??\c:\lrxrffr.exec:\lrxrffr.exe107⤵PID:4428
-
\??\c:\thnhbb.exec:\thnhbb.exe108⤵PID:4048
-
\??\c:\nhhbtt.exec:\nhhbtt.exe109⤵PID:3712
-
\??\c:\vdpdj.exec:\vdpdj.exe110⤵PID:3660
-
\??\c:\jvpdv.exec:\jvpdv.exe111⤵PID:3752
-
\??\c:\xlrlrxf.exec:\xlrlrxf.exe112⤵PID:2108
-
\??\c:\hntnhb.exec:\hntnhb.exe113⤵PID:2296
-
\??\c:\7ntnnn.exec:\7ntnnn.exe114⤵PID:224
-
\??\c:\jvvpj.exec:\jvvpj.exe115⤵PID:4732
-
\??\c:\rflfxfx.exec:\rflfxfx.exe116⤵PID:2920
-
\??\c:\xlxrrll.exec:\xlxrrll.exe117⤵PID:4556
-
\??\c:\hbbthh.exec:\hbbthh.exe118⤵PID:4900
-
\??\c:\dvjjp.exec:\dvjjp.exe119⤵PID:2996
-
\??\c:\7jppv.exec:\7jppv.exe120⤵PID:2684
-
\??\c:\5llfxxr.exec:\5llfxxr.exe121⤵PID:1008
-
\??\c:\ttbtnb.exec:\ttbtnb.exe122⤵PID:704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-