Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-06-2024 23:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c164f79531d3c2e02c117f04f4ba087f450e5281552e7a2e833faa7c0ca7566.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
7c164f79531d3c2e02c117f04f4ba087f450e5281552e7a2e833faa7c0ca7566.exe
-
Size
77KB
-
MD5
7eca1619dc0b3af265d2f918a8ab6b7a
-
SHA1
6d3484b570ae4e8e43088425b60085e6a8f271ff
-
SHA256
7c164f79531d3c2e02c117f04f4ba087f450e5281552e7a2e833faa7c0ca7566
-
SHA512
217ee96b2cd881106e178b6bf2c59b9e7a9e6b6095fbede86811944da70f2ddc25ef83332d8649c11aa4d1f898a32cf55a3765630a72fc66ebfbd295464d552f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAX8YieVIJclPvPJtcdcY:ymb3NkkiQ3mdBjFo68YBVIJc9JtxY
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/6084-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4376-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/820-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1896-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5532-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5576-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5648-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 24 IoCs
resource yara_rule behavioral2/memory/6084-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/6084-9-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1556-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3900-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4408-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4376-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5056-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1492-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1492-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1224-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3076-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4952-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4104-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2144-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/820-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1896-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5532-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3988-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5576-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5648-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4848-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1924-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2720-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1776-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1556 vvvvv.exe 3900 fxfxfxx.exe 4376 xrffflf.exe 4408 nnhhbb.exe 5056 dvvpp.exe 1492 3ffxxxf.exe 1224 xxffrrr.exe 3076 1nnhhh.exe 4952 pvvpj.exe 4104 9pjjd.exe 1416 hhhtnt.exe 2144 9vdvp.exe 820 xrfffll.exe 4452 nthbbb.exe 4220 bnbbbh.exe 4624 vpjvp.exe 5644 frlfrrl.exe 1896 hnhnhh.exe 4484 htbttt.exe 5532 vpddp.exe 3988 rrxrlxl.exe 5576 hbntbb.exe 5648 vdvdp.exe 1872 rllllll.exe 4064 5tbtbh.exe 4848 hhhbbb.exe 1924 pjpjd.exe 4672 rrrxxxl.exe 700 rlxrllf.exe 2720 nhbttt.exe 1776 7httbb.exe 2288 dvvjp.exe 1488 xfrrlrr.exe 5304 bnnhhh.exe 3824 7bhbtt.exe 5504 pvdvp.exe 5560 fxrlxxl.exe 5156 xxrrllf.exe 4228 bnttnh.exe 5960 vvpjj.exe 5380 jdddv.exe 4884 5lxflll.exe 5136 rflrlll.exe 3796 hhbtnn.exe 4904 htbtnn.exe 4732 vdjjj.exe 4036 dpvpp.exe 5164 xlxxrll.exe 3492 lfrlffr.exe 5716 nhhtbb.exe 3028 7jpdv.exe 5744 lxxrfff.exe 5472 tnnhbb.exe 3992 9tbbtt.exe 2428 jddvv.exe 5272 pvvdv.exe 1144 3llfrrf.exe 4068 tnhhbb.exe 3740 dpjvp.exe 5772 jjjjv.exe 6104 frxlffx.exe 3688 lfxxrrx.exe 6016 bntbtt.exe 6088 tnnhhb.exe -
resource yara_rule behavioral2/memory/6084-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6084-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/820-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1896-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5532-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5576-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5648-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6084 wrote to memory of 1556 6084 7c164f79531d3c2e02c117f04f4ba087f450e5281552e7a2e833faa7c0ca7566.exe 83 PID 6084 wrote to memory of 1556 6084 7c164f79531d3c2e02c117f04f4ba087f450e5281552e7a2e833faa7c0ca7566.exe 83 PID 6084 wrote to memory of 1556 6084 7c164f79531d3c2e02c117f04f4ba087f450e5281552e7a2e833faa7c0ca7566.exe 83 PID 1556 wrote to memory of 3900 1556 vvvvv.exe 84 PID 1556 wrote to memory of 3900 1556 vvvvv.exe 84 PID 1556 wrote to memory of 3900 1556 vvvvv.exe 84 PID 3900 wrote to memory of 4376 3900 fxfxfxx.exe 85 PID 3900 wrote to memory of 4376 3900 fxfxfxx.exe 85 PID 3900 wrote to memory of 4376 3900 fxfxfxx.exe 85 PID 4376 wrote to memory of 4408 4376 xrffflf.exe 86 PID 4376 wrote to memory of 4408 4376 xrffflf.exe 86 PID 4376 wrote to memory of 4408 4376 xrffflf.exe 86 PID 4408 wrote to memory of 5056 4408 nnhhbb.exe 87 PID 4408 wrote to memory of 5056 4408 nnhhbb.exe 87 PID 4408 wrote to memory of 5056 4408 nnhhbb.exe 87 PID 5056 wrote to memory of 1492 5056 dvvpp.exe 88 PID 5056 wrote to memory of 1492 5056 dvvpp.exe 88 PID 5056 wrote to memory of 1492 5056 dvvpp.exe 88 PID 1492 wrote to memory of 1224 1492 3ffxxxf.exe 89 PID 1492 wrote to memory of 1224 1492 3ffxxxf.exe 89 PID 1492 wrote to memory of 1224 1492 3ffxxxf.exe 89 PID 1224 wrote to memory of 3076 1224 xxffrrr.exe 90 PID 1224 wrote to memory of 3076 1224 xxffrrr.exe 90 PID 1224 wrote to memory of 3076 1224 xxffrrr.exe 90 PID 3076 wrote to memory of 4952 3076 1nnhhh.exe 91 PID 3076 wrote to memory of 4952 3076 1nnhhh.exe 91 PID 3076 wrote to memory of 4952 3076 1nnhhh.exe 91 PID 4952 wrote to memory of 4104 4952 pvvpj.exe 92 PID 4952 wrote to memory of 4104 4952 pvvpj.exe 92 PID 4952 wrote to memory of 4104 4952 pvvpj.exe 92 PID 4104 wrote to memory of 1416 4104 9pjjd.exe 93 PID 4104 wrote to memory of 1416 4104 9pjjd.exe 93 PID 4104 wrote to memory of 1416 4104 9pjjd.exe 93 PID 1416 wrote to memory of 2144 1416 hhhtnt.exe 94 PID 1416 wrote to memory of 2144 1416 hhhtnt.exe 94 PID 1416 wrote to memory of 2144 1416 hhhtnt.exe 94 PID 2144 wrote to memory of 820 2144 9vdvp.exe 95 PID 2144 wrote to memory of 820 2144 9vdvp.exe 95 PID 2144 wrote to memory of 820 2144 9vdvp.exe 95 PID 820 wrote to memory of 4452 820 xrfffll.exe 96 PID 820 wrote to memory of 4452 820 xrfffll.exe 96 PID 820 wrote to memory of 4452 820 xrfffll.exe 96 PID 4452 wrote to memory of 4220 4452 nthbbb.exe 97 PID 4452 wrote to memory of 4220 4452 nthbbb.exe 97 PID 4452 wrote to memory of 4220 4452 nthbbb.exe 97 PID 4220 wrote to memory of 4624 4220 bnbbbh.exe 98 PID 4220 wrote to memory of 4624 4220 bnbbbh.exe 98 PID 4220 wrote to memory of 4624 4220 bnbbbh.exe 98 PID 4624 wrote to memory of 5644 4624 vpjvp.exe 99 PID 4624 wrote to memory of 5644 4624 vpjvp.exe 99 PID 4624 wrote to memory of 5644 4624 vpjvp.exe 99 PID 5644 wrote to memory of 1896 5644 frlfrrl.exe 100 PID 5644 wrote to memory of 1896 5644 frlfrrl.exe 100 PID 5644 wrote to memory of 1896 5644 frlfrrl.exe 100 PID 1896 wrote to memory of 4484 1896 hnhnhh.exe 102 PID 1896 wrote to memory of 4484 1896 hnhnhh.exe 102 PID 1896 wrote to memory of 4484 1896 hnhnhh.exe 102 PID 4484 wrote to memory of 5532 4484 htbttt.exe 103 PID 4484 wrote to memory of 5532 4484 htbttt.exe 103 PID 4484 wrote to memory of 5532 4484 htbttt.exe 103 PID 5532 wrote to memory of 3988 5532 vpddp.exe 104 PID 5532 wrote to memory of 3988 5532 vpddp.exe 104 PID 5532 wrote to memory of 3988 5532 vpddp.exe 104 PID 3988 wrote to memory of 5576 3988 rrxrlxl.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c164f79531d3c2e02c117f04f4ba087f450e5281552e7a2e833faa7c0ca7566.exe"C:\Users\Admin\AppData\Local\Temp\7c164f79531d3c2e02c117f04f4ba087f450e5281552e7a2e833faa7c0ca7566.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6084 -
\??\c:\vvvvv.exec:\vvvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\fxfxfxx.exec:\fxfxfxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\xrffflf.exec:\xrffflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\nnhhbb.exec:\nnhhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\dvvpp.exec:\dvvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\3ffxxxf.exec:\3ffxxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\xxffrrr.exec:\xxffrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\1nnhhh.exec:\1nnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\pvvpj.exec:\pvvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\9pjjd.exec:\9pjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\hhhtnt.exec:\hhhtnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\9vdvp.exec:\9vdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\xrfffll.exec:\xrfffll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\nthbbb.exec:\nthbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\bnbbbh.exec:\bnbbbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\vpjvp.exec:\vpjvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\frlfrrl.exec:\frlfrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
\??\c:\hnhnhh.exec:\hnhnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\htbttt.exec:\htbttt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\vpddp.exec:\vpddp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
\??\c:\rrxrlxl.exec:\rrxrlxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\hbntbb.exec:\hbntbb.exe23⤵
- Executes dropped EXE
PID:5576 -
\??\c:\vdvdp.exec:\vdvdp.exe24⤵
- Executes dropped EXE
PID:5648 -
\??\c:\rllllll.exec:\rllllll.exe25⤵
- Executes dropped EXE
PID:1872 -
\??\c:\5tbtbh.exec:\5tbtbh.exe26⤵
- Executes dropped EXE
PID:4064 -
\??\c:\hhhbbb.exec:\hhhbbb.exe27⤵
- Executes dropped EXE
PID:4848 -
\??\c:\pjpjd.exec:\pjpjd.exe28⤵
- Executes dropped EXE
PID:1924 -
\??\c:\rrrxxxl.exec:\rrrxxxl.exe29⤵
- Executes dropped EXE
PID:4672 -
\??\c:\rlxrllf.exec:\rlxrllf.exe30⤵
- Executes dropped EXE
PID:700 -
\??\c:\nhbttt.exec:\nhbttt.exe31⤵
- Executes dropped EXE
PID:2720 -
\??\c:\7httbb.exec:\7httbb.exe32⤵
- Executes dropped EXE
PID:1776 -
\??\c:\dvvjp.exec:\dvvjp.exe33⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xfrrlrr.exec:\xfrrlrr.exe34⤵
- Executes dropped EXE
PID:1488 -
\??\c:\bnnhhh.exec:\bnnhhh.exe35⤵
- Executes dropped EXE
PID:5304 -
\??\c:\7bhbtt.exec:\7bhbtt.exe36⤵
- Executes dropped EXE
PID:3824 -
\??\c:\pvdvp.exec:\pvdvp.exe37⤵
- Executes dropped EXE
PID:5504 -
\??\c:\fxrlxxl.exec:\fxrlxxl.exe38⤵
- Executes dropped EXE
PID:5560 -
\??\c:\xxrrllf.exec:\xxrrllf.exe39⤵
- Executes dropped EXE
PID:5156 -
\??\c:\bnttnh.exec:\bnttnh.exe40⤵
- Executes dropped EXE
PID:4228 -
\??\c:\vvpjj.exec:\vvpjj.exe41⤵
- Executes dropped EXE
PID:5960 -
\??\c:\jdddv.exec:\jdddv.exe42⤵
- Executes dropped EXE
PID:5380 -
\??\c:\5lxflll.exec:\5lxflll.exe43⤵
- Executes dropped EXE
PID:4884 -
\??\c:\rflrlll.exec:\rflrlll.exe44⤵
- Executes dropped EXE
PID:5136 -
\??\c:\hhbtnn.exec:\hhbtnn.exe45⤵
- Executes dropped EXE
PID:3796 -
\??\c:\htbtnn.exec:\htbtnn.exe46⤵
- Executes dropped EXE
PID:4904 -
\??\c:\vdjjj.exec:\vdjjj.exe47⤵
- Executes dropped EXE
PID:4732 -
\??\c:\dpvpp.exec:\dpvpp.exe48⤵
- Executes dropped EXE
PID:4036 -
\??\c:\xlxxrll.exec:\xlxxrll.exe49⤵
- Executes dropped EXE
PID:5164 -
\??\c:\lfrlffr.exec:\lfrlffr.exe50⤵
- Executes dropped EXE
PID:3492 -
\??\c:\nhhtbb.exec:\nhhtbb.exe51⤵
- Executes dropped EXE
PID:5716 -
\??\c:\7jpdv.exec:\7jpdv.exe52⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lxxrfff.exec:\lxxrfff.exe53⤵
- Executes dropped EXE
PID:5744 -
\??\c:\tnnhbb.exec:\tnnhbb.exe54⤵
- Executes dropped EXE
PID:5472 -
\??\c:\9tbbtt.exec:\9tbbtt.exe55⤵
- Executes dropped EXE
PID:3992 -
\??\c:\jddvv.exec:\jddvv.exe56⤵
- Executes dropped EXE
PID:2428 -
\??\c:\pvvdv.exec:\pvvdv.exe57⤵
- Executes dropped EXE
PID:5272 -
\??\c:\3llfrrf.exec:\3llfrrf.exe58⤵
- Executes dropped EXE
PID:1144 -
\??\c:\tnhhbb.exec:\tnhhbb.exe59⤵
- Executes dropped EXE
PID:4068 -
\??\c:\dpjvp.exec:\dpjvp.exe60⤵
- Executes dropped EXE
PID:3740 -
\??\c:\jjjjv.exec:\jjjjv.exe61⤵
- Executes dropped EXE
PID:5772 -
\??\c:\frxlffx.exec:\frxlffx.exe62⤵
- Executes dropped EXE
PID:6104 -
\??\c:\lfxxrrx.exec:\lfxxrrx.exe63⤵
- Executes dropped EXE
PID:3688 -
\??\c:\bntbtt.exec:\bntbtt.exe64⤵
- Executes dropped EXE
PID:6016 -
\??\c:\tnnhhb.exec:\tnnhhb.exe65⤵
- Executes dropped EXE
PID:6088 -
\??\c:\jvpjd.exec:\jvpjd.exe66⤵PID:4608
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe67⤵PID:2556
-
\??\c:\nhhhbb.exec:\nhhhbb.exe68⤵PID:1592
-
\??\c:\pddvd.exec:\pddvd.exe69⤵PID:3580
-
\??\c:\1fllrfr.exec:\1fllrfr.exe70⤵PID:3124
-
\??\c:\lrrxflx.exec:\lrrxflx.exe71⤵PID:4408
-
\??\c:\httnnn.exec:\httnnn.exe72⤵PID:2384
-
\??\c:\vvpjd.exec:\vvpjd.exe73⤵PID:6128
-
\??\c:\jjdjv.exec:\jjdjv.exe74⤵PID:1712
-
\??\c:\7xrllff.exec:\7xrllff.exe75⤵PID:3088
-
\??\c:\ffrrllf.exec:\ffrrllf.exe76⤵PID:2552
-
\??\c:\btnhbt.exec:\btnhbt.exe77⤵PID:556
-
\??\c:\pvpdj.exec:\pvpdj.exe78⤵PID:4448
-
\??\c:\7jvpd.exec:\7jvpd.exe79⤵PID:1764
-
\??\c:\rlfxllf.exec:\rlfxllf.exe80⤵PID:6012
-
\??\c:\fxxrrxr.exec:\fxxrrxr.exe81⤵PID:4940
-
\??\c:\nhhbtt.exec:\nhhbtt.exe82⤵PID:1380
-
\??\c:\5tnhbt.exec:\5tnhbt.exe83⤵PID:4916
-
\??\c:\jpvpd.exec:\jpvpd.exe84⤵PID:4436
-
\??\c:\1ddvj.exec:\1ddvj.exe85⤵PID:3604
-
\??\c:\9flfrfx.exec:\9flfrfx.exe86⤵PID:4624
-
\??\c:\fxxrrll.exec:\fxxrrll.exe87⤵PID:5940
-
\??\c:\hnnhbb.exec:\hnnhbb.exe88⤵PID:5680
-
\??\c:\7vvvv.exec:\7vvvv.exe89⤵PID:3136
-
\??\c:\djdpj.exec:\djdpj.exe90⤵PID:5328
-
\??\c:\rlllfxr.exec:\rlllfxr.exe91⤵PID:4052
-
\??\c:\nbbbnn.exec:\nbbbnn.exe92⤵PID:5980
-
\??\c:\tnhbtt.exec:\tnhbtt.exe93⤵PID:5600
-
\??\c:\vppjd.exec:\vppjd.exe94⤵PID:5584
-
\??\c:\vjpjv.exec:\vjpjv.exe95⤵PID:5604
-
\??\c:\xxrlffx.exec:\xxrlffx.exe96⤵PID:2292
-
\??\c:\lxxxxrr.exec:\lxxxxrr.exe97⤵PID:2352
-
\??\c:\bnhhbb.exec:\bnhhbb.exe98⤵PID:4064
-
\??\c:\vppvp.exec:\vppvp.exe99⤵PID:5132
-
\??\c:\vjdvp.exec:\vjdvp.exe100⤵PID:3620
-
\??\c:\9rlllll.exec:\9rlllll.exe101⤵PID:3020
-
\??\c:\5rrrrrl.exec:\5rrrrrl.exe102⤵PID:1584
-
\??\c:\tnttnt.exec:\tnttnt.exe103⤵PID:572
-
\??\c:\nhnhhh.exec:\nhnhhh.exe104⤵PID:1960
-
\??\c:\dvppd.exec:\dvppd.exe105⤵PID:2684
-
\??\c:\lfffllx.exec:\lfffllx.exe106⤵PID:5516
-
\??\c:\frxrllf.exec:\frxrllf.exe107⤵PID:2848
-
\??\c:\nbnhtt.exec:\nbnhtt.exe108⤵PID:4824
-
\??\c:\tthhnn.exec:\tthhnn.exe109⤵PID:748
-
\??\c:\3vvpd.exec:\3vvpd.exe110⤵PID:5304
-
\??\c:\7vpvj.exec:\7vpvj.exe111⤵PID:2328
-
\??\c:\lffxlll.exec:\lffxlll.exe112⤵PID:3968
-
\??\c:\rlllfxx.exec:\rlllfxx.exe113⤵PID:3100
-
\??\c:\ntbtnn.exec:\ntbtnn.exe114⤵PID:5284
-
\??\c:\hbttnn.exec:\hbttnn.exe115⤵PID:4684
-
\??\c:\dpdjj.exec:\dpdjj.exe116⤵PID:3080
-
\??\c:\fxxrrrf.exec:\fxxrrrf.exe117⤵PID:4304
-
\??\c:\1ntnnn.exec:\1ntnnn.exe118⤵PID:5492
-
\??\c:\1hnnhn.exec:\1hnnhn.exe119⤵PID:1644
-
\??\c:\7vjdp.exec:\7vjdp.exe120⤵PID:844
-
\??\c:\rrrrlrl.exec:\rrrrlrl.exe121⤵PID:2448
-
\??\c:\hbbhbb.exec:\hbbhbb.exe122⤵PID:4708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-