Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 18:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0bb826603f2f510c8134076126abc2c7486c7ca7b815577a17cad6b6cb8003aa.exe
Resource
win7-20240611-en
6 signatures
150 seconds
General
-
Target
0bb826603f2f510c8134076126abc2c7486c7ca7b815577a17cad6b6cb8003aa.exe
-
Size
79KB
-
MD5
03a45a7fbddc33fac1faeefc970c02a5
-
SHA1
d11c0e236a23b098bb50b69334d524c7443b722d
-
SHA256
0bb826603f2f510c8134076126abc2c7486c7ca7b815577a17cad6b6cb8003aa
-
SHA512
f1f2a3768b76755438a1a53268df64e7fe98cc1113642762031648bd9a724c6a5f5369f1c77f0c297076af047177c3aab66116576a49e014864f20b1abc6750b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINH6Y:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCun
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/1020-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/792-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3336-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 24 IoCs
resource yara_rule behavioral2/memory/1020-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1020-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3648-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1880-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1148-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1148-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1208-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3632-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3308-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3260-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/792-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3336-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2496-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1800-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2548-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1732-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4656-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1860-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/536-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2140-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1684-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/396-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4508-186-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2756-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3648 bhnhbb.exe 1880 pdjdv.exe 1148 vvvpj.exe 1208 xrxfxxx.exe 3632 nnhhbb.exe 3308 7thbbb.exe 3260 lrxrlll.exe 792 7xrrlff.exe 3336 tnnhbt.exe 2496 djvjj.exe 1800 fxfxrrr.exe 2464 thnhhh.exe 2548 3hhhbb.exe 1732 djpvp.exe 600 xrxrlfx.exe 5020 nhnhhh.exe 4656 jdpjd.exe 1860 xlflrrx.exe 536 nhhnbn.exe 2140 pppvv.exe 2004 3fxrrrr.exe 4540 7pjdd.exe 1684 vdjdv.exe 3996 xfrlfff.exe 2928 rfffffx.exe 396 tbnnhh.exe 5076 vdpjj.exe 4508 pjjdd.exe 2756 rflfxxr.exe 848 flrxxxx.exe 2100 ttttth.exe 1472 5dvpp.exe 3020 vddvj.exe 688 1rrlxxf.exe 2148 3nnhbb.exe 1420 1tbttn.exe 1368 dvvjd.exe 772 vvdpp.exe 2152 rlrrlfl.exe 4900 hbnbht.exe 4328 7nnbtt.exe 4568 pddpd.exe 4336 pjpdv.exe 424 fxfxrrl.exe 448 rlfrllr.exe 2808 tntbtt.exe 4532 7bnnbh.exe 2680 pppvv.exe 4436 dvjdp.exe 3612 3ffxrrl.exe 3324 rllffxx.exe 2604 ttttnn.exe 2780 7ddvv.exe 1848 dvvvp.exe 116 9fxrlxr.exe 2012 lfllfff.exe 4388 hbtbtt.exe 2496 tnhhbb.exe 1464 dvjjv.exe 3504 dvvjd.exe 640 xxxxxxx.exe 4252 frrrlrr.exe 3664 hbbtnn.exe 4140 bhbbbt.exe -
resource yara_rule behavioral2/memory/1020-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/792-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3336-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-193-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1020 wrote to memory of 3648 1020 0bb826603f2f510c8134076126abc2c7486c7ca7b815577a17cad6b6cb8003aa.exe 81 PID 1020 wrote to memory of 3648 1020 0bb826603f2f510c8134076126abc2c7486c7ca7b815577a17cad6b6cb8003aa.exe 81 PID 1020 wrote to memory of 3648 1020 0bb826603f2f510c8134076126abc2c7486c7ca7b815577a17cad6b6cb8003aa.exe 81 PID 3648 wrote to memory of 1880 3648 bhnhbb.exe 82 PID 3648 wrote to memory of 1880 3648 bhnhbb.exe 82 PID 3648 wrote to memory of 1880 3648 bhnhbb.exe 82 PID 1880 wrote to memory of 1148 1880 pdjdv.exe 83 PID 1880 wrote to memory of 1148 1880 pdjdv.exe 83 PID 1880 wrote to memory of 1148 1880 pdjdv.exe 83 PID 1148 wrote to memory of 1208 1148 vvvpj.exe 84 PID 1148 wrote to memory of 1208 1148 vvvpj.exe 84 PID 1148 wrote to memory of 1208 1148 vvvpj.exe 84 PID 1208 wrote to memory of 3632 1208 xrxfxxx.exe 85 PID 1208 wrote to memory of 3632 1208 xrxfxxx.exe 85 PID 1208 wrote to memory of 3632 1208 xrxfxxx.exe 85 PID 3632 wrote to memory of 3308 3632 nnhhbb.exe 86 PID 3632 wrote to memory of 3308 3632 nnhhbb.exe 86 PID 3632 wrote to memory of 3308 3632 nnhhbb.exe 86 PID 3308 wrote to memory of 3260 3308 7thbbb.exe 87 PID 3308 wrote to memory of 3260 3308 7thbbb.exe 87 PID 3308 wrote to memory of 3260 3308 7thbbb.exe 87 PID 3260 wrote to memory of 792 3260 lrxrlll.exe 88 PID 3260 wrote to memory of 792 3260 lrxrlll.exe 88 PID 3260 wrote to memory of 792 3260 lrxrlll.exe 88 PID 792 wrote to memory of 3336 792 7xrrlff.exe 89 PID 792 wrote to memory of 3336 792 7xrrlff.exe 89 PID 792 wrote to memory of 3336 792 7xrrlff.exe 89 PID 3336 wrote to memory of 2496 3336 tnnhbt.exe 91 PID 3336 wrote to memory of 2496 3336 tnnhbt.exe 91 PID 3336 wrote to memory of 2496 3336 tnnhbt.exe 91 PID 2496 wrote to memory of 1800 2496 djvjj.exe 92 PID 2496 wrote to memory of 1800 2496 djvjj.exe 92 PID 2496 wrote to memory of 1800 2496 djvjj.exe 92 PID 1800 wrote to memory of 2464 1800 fxfxrrr.exe 93 PID 1800 wrote to memory of 2464 1800 fxfxrrr.exe 93 PID 1800 wrote to memory of 2464 1800 fxfxrrr.exe 93 PID 2464 wrote to memory of 2548 2464 thnhhh.exe 94 PID 2464 wrote to memory of 2548 2464 thnhhh.exe 94 PID 2464 wrote to memory of 2548 2464 thnhhh.exe 94 PID 2548 wrote to memory of 1732 2548 3hhhbb.exe 95 PID 2548 wrote to memory of 1732 2548 3hhhbb.exe 95 PID 2548 wrote to memory of 1732 2548 3hhhbb.exe 95 PID 1732 wrote to memory of 600 1732 djpvp.exe 96 PID 1732 wrote to memory of 600 1732 djpvp.exe 96 PID 1732 wrote to memory of 600 1732 djpvp.exe 96 PID 600 wrote to memory of 5020 600 xrxrlfx.exe 98 PID 600 wrote to memory of 5020 600 xrxrlfx.exe 98 PID 600 wrote to memory of 5020 600 xrxrlfx.exe 98 PID 5020 wrote to memory of 4656 5020 nhnhhh.exe 99 PID 5020 wrote to memory of 4656 5020 nhnhhh.exe 99 PID 5020 wrote to memory of 4656 5020 nhnhhh.exe 99 PID 4656 wrote to memory of 1860 4656 jdpjd.exe 100 PID 4656 wrote to memory of 1860 4656 jdpjd.exe 100 PID 4656 wrote to memory of 1860 4656 jdpjd.exe 100 PID 1860 wrote to memory of 536 1860 xlflrrx.exe 101 PID 1860 wrote to memory of 536 1860 xlflrrx.exe 101 PID 1860 wrote to memory of 536 1860 xlflrrx.exe 101 PID 536 wrote to memory of 2140 536 nhhnbn.exe 103 PID 536 wrote to memory of 2140 536 nhhnbn.exe 103 PID 536 wrote to memory of 2140 536 nhhnbn.exe 103 PID 2140 wrote to memory of 2004 2140 pppvv.exe 104 PID 2140 wrote to memory of 2004 2140 pppvv.exe 104 PID 2140 wrote to memory of 2004 2140 pppvv.exe 104 PID 2004 wrote to memory of 4540 2004 3fxrrrr.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bb826603f2f510c8134076126abc2c7486c7ca7b815577a17cad6b6cb8003aa.exe"C:\Users\Admin\AppData\Local\Temp\0bb826603f2f510c8134076126abc2c7486c7ca7b815577a17cad6b6cb8003aa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\bhnhbb.exec:\bhnhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\pdjdv.exec:\pdjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\vvvpj.exec:\vvvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\xrxfxxx.exec:\xrxfxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\nnhhbb.exec:\nnhhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\7thbbb.exec:\7thbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\lrxrlll.exec:\lrxrlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\7xrrlff.exec:\7xrrlff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\tnnhbt.exec:\tnnhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\djvjj.exec:\djvjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\thnhhh.exec:\thnhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\3hhhbb.exec:\3hhhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\djpvp.exec:\djpvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\xrxrlfx.exec:\xrxrlfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\nhnhhh.exec:\nhnhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\jdpjd.exec:\jdpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\xlflrrx.exec:\xlflrrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\nhhnbn.exec:\nhhnbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\pppvv.exec:\pppvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\3fxrrrr.exec:\3fxrrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\7pjdd.exec:\7pjdd.exe23⤵
- Executes dropped EXE
PID:4540 -
\??\c:\vdjdv.exec:\vdjdv.exe24⤵
- Executes dropped EXE
PID:1684 -
\??\c:\xfrlfff.exec:\xfrlfff.exe25⤵
- Executes dropped EXE
PID:3996 -
\??\c:\rfffffx.exec:\rfffffx.exe26⤵
- Executes dropped EXE
PID:2928 -
\??\c:\tbnnhh.exec:\tbnnhh.exe27⤵
- Executes dropped EXE
PID:396 -
\??\c:\vdpjj.exec:\vdpjj.exe28⤵
- Executes dropped EXE
PID:5076 -
\??\c:\pjjdd.exec:\pjjdd.exe29⤵
- Executes dropped EXE
PID:4508 -
\??\c:\rflfxxr.exec:\rflfxxr.exe30⤵
- Executes dropped EXE
PID:2756 -
\??\c:\flrxxxx.exec:\flrxxxx.exe31⤵
- Executes dropped EXE
PID:848 -
\??\c:\ttttth.exec:\ttttth.exe32⤵
- Executes dropped EXE
PID:2100 -
\??\c:\5dvpp.exec:\5dvpp.exe33⤵
- Executes dropped EXE
PID:1472 -
\??\c:\vddvj.exec:\vddvj.exe34⤵
- Executes dropped EXE
PID:3020 -
\??\c:\1rrlxxf.exec:\1rrlxxf.exe35⤵
- Executes dropped EXE
PID:688 -
\??\c:\3nnhbb.exec:\3nnhbb.exe36⤵
- Executes dropped EXE
PID:2148 -
\??\c:\1tbttn.exec:\1tbttn.exe37⤵
- Executes dropped EXE
PID:1420 -
\??\c:\dvvjd.exec:\dvvjd.exe38⤵
- Executes dropped EXE
PID:1368 -
\??\c:\vvdpp.exec:\vvdpp.exe39⤵
- Executes dropped EXE
PID:772 -
\??\c:\rlrrlfl.exec:\rlrrlfl.exe40⤵
- Executes dropped EXE
PID:2152 -
\??\c:\hbnbht.exec:\hbnbht.exe41⤵
- Executes dropped EXE
PID:4900 -
\??\c:\7nnbtt.exec:\7nnbtt.exe42⤵
- Executes dropped EXE
PID:4328 -
\??\c:\pddpd.exec:\pddpd.exe43⤵
- Executes dropped EXE
PID:4568 -
\??\c:\pjpdv.exec:\pjpdv.exe44⤵
- Executes dropped EXE
PID:4336 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe45⤵
- Executes dropped EXE
PID:424 -
\??\c:\rlfrllr.exec:\rlfrllr.exe46⤵
- Executes dropped EXE
PID:448 -
\??\c:\tntbtt.exec:\tntbtt.exe47⤵
- Executes dropped EXE
PID:2808 -
\??\c:\7bnnbh.exec:\7bnnbh.exe48⤵
- Executes dropped EXE
PID:4532 -
\??\c:\pppvv.exec:\pppvv.exe49⤵
- Executes dropped EXE
PID:2680 -
\??\c:\dvjdp.exec:\dvjdp.exe50⤵
- Executes dropped EXE
PID:4436 -
\??\c:\3ffxrrl.exec:\3ffxrrl.exe51⤵
- Executes dropped EXE
PID:3612 -
\??\c:\rllffxx.exec:\rllffxx.exe52⤵
- Executes dropped EXE
PID:3324 -
\??\c:\ttttnn.exec:\ttttnn.exe53⤵
- Executes dropped EXE
PID:2604 -
\??\c:\7ddvv.exec:\7ddvv.exe54⤵
- Executes dropped EXE
PID:2780 -
\??\c:\dvvvp.exec:\dvvvp.exe55⤵
- Executes dropped EXE
PID:1848 -
\??\c:\9fxrlxr.exec:\9fxrlxr.exe56⤵
- Executes dropped EXE
PID:116 -
\??\c:\lfllfff.exec:\lfllfff.exe57⤵
- Executes dropped EXE
PID:2012 -
\??\c:\hbtbtt.exec:\hbtbtt.exe58⤵
- Executes dropped EXE
PID:4388 -
\??\c:\tnhhbb.exec:\tnhhbb.exe59⤵
- Executes dropped EXE
PID:2496 -
\??\c:\dvjjv.exec:\dvjjv.exe60⤵
- Executes dropped EXE
PID:1464 -
\??\c:\dvvjd.exec:\dvvjd.exe61⤵
- Executes dropped EXE
PID:3504 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe62⤵
- Executes dropped EXE
PID:640 -
\??\c:\frrrlrr.exec:\frrrlrr.exe63⤵
- Executes dropped EXE
PID:4252 -
\??\c:\hbbtnn.exec:\hbbtnn.exe64⤵
- Executes dropped EXE
PID:3664 -
\??\c:\bhbbbt.exec:\bhbbbt.exe65⤵
- Executes dropped EXE
PID:4140 -
\??\c:\dppvp.exec:\dppvp.exe66⤵PID:1032
-
\??\c:\dvdvv.exec:\dvdvv.exe67⤵PID:1036
-
\??\c:\lxxrffx.exec:\lxxrffx.exe68⤵PID:3804
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe69⤵PID:2484
-
\??\c:\bbnnhh.exec:\bbnnhh.exe70⤵PID:2600
-
\??\c:\bbbtnn.exec:\bbbtnn.exe71⤵PID:1808
-
\??\c:\pjvvp.exec:\pjvvp.exe72⤵PID:1092
-
\??\c:\dvpjv.exec:\dvpjv.exe73⤵PID:3984
-
\??\c:\fxflxlr.exec:\fxflxlr.exe74⤵PID:4128
-
\??\c:\flrrllf.exec:\flrrllf.exe75⤵PID:4264
-
\??\c:\9hhbnh.exec:\9hhbnh.exe76⤵PID:5056
-
\??\c:\3pvvv.exec:\3pvvv.exe77⤵PID:2300
-
\??\c:\9vdvj.exec:\9vdvj.exe78⤵PID:4756
-
\??\c:\lrxxllf.exec:\lrxxllf.exe79⤵PID:4052
-
\??\c:\3rrrlll.exec:\3rrrlll.exe80⤵PID:4288
-
\??\c:\bhbbbt.exec:\bhbbbt.exe81⤵PID:4500
-
\??\c:\ttthht.exec:\ttthht.exe82⤵PID:2128
-
\??\c:\dppjd.exec:\dppjd.exe83⤵PID:1972
-
\??\c:\3xrrlff.exec:\3xrrlff.exe84⤵PID:3032
-
\??\c:\5ttnhh.exec:\5ttnhh.exe85⤵PID:3768
-
\??\c:\tthhhh.exec:\tthhhh.exe86⤵PID:5008
-
\??\c:\5pvpd.exec:\5pvpd.exe87⤵PID:3740
-
\??\c:\rxxrrrl.exec:\rxxrrrl.exe88⤵PID:2312
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe89⤵PID:4736
-
\??\c:\rlrrffr.exec:\rlrrffr.exe90⤵PID:1616
-
\??\c:\nhhhtt.exec:\nhhhtt.exe91⤵PID:3980
-
\??\c:\hthbtb.exec:\hthbtb.exe92⤵PID:1276
-
\??\c:\vpjpj.exec:\vpjpj.exe93⤵PID:1612
-
\??\c:\pjjdj.exec:\pjjdj.exe94⤵PID:4812
-
\??\c:\5fxrrrr.exec:\5fxrrrr.exe95⤵PID:3860
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe96⤵PID:3292
-
\??\c:\9nhbtt.exec:\9nhbtt.exe97⤵PID:4516
-
\??\c:\thnhtt.exec:\thnhtt.exe98⤵PID:5064
-
\??\c:\dpvvj.exec:\dpvvj.exe99⤵PID:2232
-
\??\c:\pjjpd.exec:\pjjpd.exe100⤵PID:776
-
\??\c:\rrffrxf.exec:\rrffrxf.exe101⤵PID:4336
-
\??\c:\3xxllfx.exec:\3xxllfx.exe102⤵PID:5104
-
\??\c:\ttttnn.exec:\ttttnn.exe103⤵PID:1212
-
\??\c:\bbttbn.exec:\bbttbn.exe104⤵PID:240
-
\??\c:\7dvpd.exec:\7dvpd.exe105⤵PID:824
-
\??\c:\pjvpv.exec:\pjvpv.exe106⤵PID:4444
-
\??\c:\jvddd.exec:\jvddd.exe107⤵PID:3160
-
\??\c:\lffxllf.exec:\lffxllf.exe108⤵PID:3836
-
\??\c:\nhnnht.exec:\nhnnht.exe109⤵PID:1288
-
\??\c:\dvvpj.exec:\dvvpj.exe110⤵PID:3260
-
\??\c:\jpvpp.exec:\jpvpp.exe111⤵PID:1236
-
\??\c:\flrlxxr.exec:\flrlxxr.exe112⤵PID:1508
-
\??\c:\bhnhbb.exec:\bhnhbb.exe113⤵PID:2416
-
\??\c:\dvdjv.exec:\dvdjv.exe114⤵PID:5100
-
\??\c:\llfxllf.exec:\llfxllf.exe115⤵PID:4304
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe116⤵PID:4496
-
\??\c:\5vvvp.exec:\5vvvp.exe117⤵PID:728
-
\??\c:\xrlllxf.exec:\xrlllxf.exe118⤵PID:4424
-
\??\c:\9hnttt.exec:\9hnttt.exe119⤵PID:3448
-
\??\c:\bhnttt.exec:\bhnttt.exe120⤵PID:3276
-
\??\c:\pvdvv.exec:\pvdvv.exe121⤵PID:4728
-
\??\c:\pjjdv.exec:\pjjdv.exe122⤵PID:3028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-