Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 10:42
Behavioral task
behavioral1
Sample
78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89.exe
Resource
win7-20240419-en
General
-
Target
78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89.exe
-
Size
440KB
-
MD5
0e30696faf2af47c270f0ea2e75f3960
-
SHA1
2cdab8659ccd4679da2efb27df740ac3b33b87dc
-
SHA256
78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89
-
SHA512
e5f203d4b47016b71afaa4cb115985cbf5cd77cd4b0c15fe51038738109b509970e6a554f79731578b4c7a8ab857d60e4a8109bb33a7d027276b51999513f304
-
SSDEEP
12288:w4wFHoS9KxbNnidEhjEJd1kNpeUgI95yRoZHVaoJMOxFXnRV4PiGO0hUmHt:kKxbNndhjEJd1kNpeUgI95yRoZHgoJMX
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-12-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1992-8-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2696-31-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3004-27-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2756-40-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2600-58-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2936-83-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1644-95-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1472-109-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2660-118-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1548-127-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1576-156-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2580-188-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2108-197-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3028-223-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1208-231-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1312-250-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2004-291-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2292-298-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2272-305-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1664-318-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2484-364-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2560-377-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1088-384-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1232-422-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/348-435-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/760-448-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2132-543-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1904-589-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2672-628-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2476-654-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1088-679-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1548-718-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/340-824-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1860-892-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3064-905-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1508-973-0x00000000003B0000-0x00000000003E4000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\bbtbnn.exe family_berbew \??\c:\jpjjv.exe family_berbew C:\lxrlrrf.exe family_berbew \??\c:\1nhhtb.exe family_berbew C:\pppdp.exe family_berbew C:\xflrrlr.exe family_berbew C:\pjpjd.exe family_berbew C:\flflrxr.exe family_berbew C:\vvjdj.exe family_berbew \??\c:\7jdpv.exe family_berbew C:\frfxrrx.exe family_berbew C:\xrrfrfr.exe family_berbew C:\3tbtbh.exe family_berbew C:\9rrlxfl.exe family_berbew C:\1jvjv.exe family_berbew C:\rrrxffr.exe family_berbew \??\c:\tnhhtt.exe family_berbew C:\jjdjv.exe family_berbew \??\c:\lrrfrfx.exe family_berbew C:\hbbtbh.exe family_berbew C:\9thhtt.exe family_berbew C:\pjppv.exe family_berbew C:\tbthtb.exe family_berbew C:\jpjjv.exe family_berbew \??\c:\hbttbb.exe family_berbew C:\jjddp.exe family_berbew C:\bnbbhh.exe family_berbew C:\7vpvd.exe family_berbew C:\llfxlfr.exe family_berbew C:\nhbbnt.exe family_berbew C:\frlrflx.exe family_berbew C:\lfxxllr.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
bbtbnn.exejpjjv.exelxrlrrf.exe1nhhtb.exepppdp.exexflrrlr.exepjpjd.exeflflrxr.exevvjdj.exe7jdpv.exefrfxrrx.exexrrfrfr.exe3tbtbh.exe9rrlxfl.exe1jvjv.exerrrxffr.exetnhhtt.exejjdjv.exelrrfrfx.exehbbtbh.exe9thhtt.exepjppv.exetbthtb.exejpjjv.exehbttbb.exejjddp.exebnbbhh.exe7vpvd.exellfxlfr.exenhbbnt.exefrlrflx.exelfxxllr.exejdvdj.exerlxxffl.exelxrxffr.exehbthtt.exejdddp.exe9ffrffr.exefxrrflx.exebnbhtt.exe1jpdd.exe9vjvd.exelfrxflr.exehhtbnt.exejdvdp.exefrlllrx.exe9httbb.exenhbbnh.exeddvdv.exerrlxflx.exebtnbtb.exennhbhh.exe5dddj.exelfxlxfr.exexlxflrf.exennhbnb.exe1vpvp.exexxlxrxl.exexrlrxfl.exetnhhnn.exepjdjp.exerfxrrxx.exe7lflrxf.exebthnbh.exepid process 1664 bbtbnn.exe 3004 jpjjv.exe 2696 lxrlrrf.exe 2756 1nhhtb.exe 2600 pppdp.exe 2648 xflrrlr.exe 2496 pjpjd.exe 2936 flflrxr.exe 2932 vvjdj.exe 1644 7jdpv.exe 1472 frfxrrx.exe 2660 xrrfrfr.exe 1548 3tbtbh.exe 820 9rrlxfl.exe 2148 1jvjv.exe 1572 rrrxffr.exe 1576 tnhhtt.exe 1456 jjdjv.exe 2328 lrrfrfx.exe 2580 hbbtbh.exe 2108 9thhtt.exe 2212 pjppv.exe 980 tbthtb.exe 3028 jpjjv.exe 1208 hbttbb.exe 2276 jjddp.exe 1312 bnbbhh.exe 2360 7vpvd.exe 868 llfxlfr.exe 2060 nhbbnt.exe 784 frlrflx.exe 2004 lfxxllr.exe 2292 jdvdj.exe 2272 rlxxffl.exe 1916 lxrxffr.exe 2980 hbthtt.exe 1664 jdddp.exe 2672 9ffrffr.exe 2692 fxrrflx.exe 2736 bnbhtt.exe 2632 1jpdd.exe 2756 9vjvd.exe 2744 lfrxflr.exe 2484 hhtbnt.exe 2560 jdvdp.exe 2544 frlllrx.exe 1088 9httbb.exe 2368 nhbbnh.exe 1372 ddvdv.exe 2728 rrlxflx.exe 1952 btnbtb.exe 1232 nnhbhh.exe 756 5dddj.exe 348 lfxlxfr.exe 900 xlxflrf.exe 760 nnhbnb.exe 1572 1vpvp.exe 1484 xxlxrxl.exe 1452 xrlrxfl.exe 1456 tnhhnn.exe 2000 pjdjp.exe 2200 rfxrrxx.exe 2580 7lflrxf.exe 264 bthnbh.exe -
Processes:
resource yara_rule behavioral1/memory/1992-0-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\bbtbnn.exe upx behavioral1/memory/1664-12-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1992-8-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\jpjjv.exe upx C:\lxrlrrf.exe upx behavioral1/memory/2696-31-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/3004-27-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2756-40-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\1nhhtb.exe upx C:\pppdp.exe upx behavioral1/memory/2756-46-0x0000000000440000-0x0000000000474000-memory.dmp upx behavioral1/memory/2600-49-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xflrrlr.exe upx behavioral1/memory/2600-58-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pjpjd.exe upx C:\flflrxr.exe upx C:\vvjdj.exe upx behavioral1/memory/2932-84-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2936-83-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1644-95-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\7jdpv.exe upx C:\frfxrrx.exe upx C:\xrrfrfr.exe upx behavioral1/memory/1472-109-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\3tbtbh.exe upx behavioral1/memory/2660-118-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\9rrlxfl.exe upx behavioral1/memory/1548-127-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\1jvjv.exe upx C:\rrrxffr.exe upx \??\c:\tnhhtt.exe upx behavioral1/memory/1576-156-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jjdjv.exe upx \??\c:\lrrfrfx.exe upx C:\hbbtbh.exe upx C:\9thhtt.exe upx behavioral1/memory/2580-188-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2108-197-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pjppv.exe upx C:\tbthtb.exe upx C:\jpjjv.exe upx behavioral1/memory/3028-223-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\hbttbb.exe upx C:\jjddp.exe upx behavioral1/memory/1208-231-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\bnbbhh.exe upx behavioral1/memory/1312-250-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\7vpvd.exe upx C:\llfxlfr.exe upx C:\nhbbnt.exe upx C:\frlrflx.exe upx C:\lfxxllr.exe upx behavioral1/memory/2004-291-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2292-298-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2272-305-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1664-318-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2632-343-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2756-351-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2484-364-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2560-377-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1088-384-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1232-422-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/348-435-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89.exebbtbnn.exejpjjv.exelxrlrrf.exe1nhhtb.exepppdp.exexflrrlr.exepjpjd.exeflflrxr.exevvjdj.exe7jdpv.exefrfxrrx.exexrrfrfr.exe3tbtbh.exe9rrlxfl.exe1jvjv.exedescription pid process target process PID 1992 wrote to memory of 1664 1992 78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89.exe bbtbnn.exe PID 1992 wrote to memory of 1664 1992 78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89.exe bbtbnn.exe PID 1992 wrote to memory of 1664 1992 78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89.exe bbtbnn.exe PID 1992 wrote to memory of 1664 1992 78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89.exe bbtbnn.exe PID 1664 wrote to memory of 3004 1664 bbtbnn.exe jpjjv.exe PID 1664 wrote to memory of 3004 1664 bbtbnn.exe jpjjv.exe PID 1664 wrote to memory of 3004 1664 bbtbnn.exe jpjjv.exe PID 1664 wrote to memory of 3004 1664 bbtbnn.exe jpjjv.exe PID 3004 wrote to memory of 2696 3004 jpjjv.exe lxrlrrf.exe PID 3004 wrote to memory of 2696 3004 jpjjv.exe lxrlrrf.exe PID 3004 wrote to memory of 2696 3004 jpjjv.exe lxrlrrf.exe PID 3004 wrote to memory of 2696 3004 jpjjv.exe lxrlrrf.exe PID 2696 wrote to memory of 2756 2696 lxrlrrf.exe 1nhhtb.exe PID 2696 wrote to memory of 2756 2696 lxrlrrf.exe 1nhhtb.exe PID 2696 wrote to memory of 2756 2696 lxrlrrf.exe 1nhhtb.exe PID 2696 wrote to memory of 2756 2696 lxrlrrf.exe 1nhhtb.exe PID 2756 wrote to memory of 2600 2756 1nhhtb.exe pppdp.exe PID 2756 wrote to memory of 2600 2756 1nhhtb.exe pppdp.exe PID 2756 wrote to memory of 2600 2756 1nhhtb.exe pppdp.exe PID 2756 wrote to memory of 2600 2756 1nhhtb.exe pppdp.exe PID 2600 wrote to memory of 2648 2600 pppdp.exe xflrrlr.exe PID 2600 wrote to memory of 2648 2600 pppdp.exe xflrrlr.exe PID 2600 wrote to memory of 2648 2600 pppdp.exe xflrrlr.exe PID 2600 wrote to memory of 2648 2600 pppdp.exe xflrrlr.exe PID 2648 wrote to memory of 2496 2648 xflrrlr.exe pjpjd.exe PID 2648 wrote to memory of 2496 2648 xflrrlr.exe pjpjd.exe PID 2648 wrote to memory of 2496 2648 xflrrlr.exe pjpjd.exe PID 2648 wrote to memory of 2496 2648 xflrrlr.exe pjpjd.exe PID 2496 wrote to memory of 2936 2496 pjpjd.exe flflrxr.exe PID 2496 wrote to memory of 2936 2496 pjpjd.exe flflrxr.exe PID 2496 wrote to memory of 2936 2496 pjpjd.exe flflrxr.exe PID 2496 wrote to memory of 2936 2496 pjpjd.exe flflrxr.exe PID 2936 wrote to memory of 2932 2936 flflrxr.exe vvjdj.exe PID 2936 wrote to memory of 2932 2936 flflrxr.exe vvjdj.exe PID 2936 wrote to memory of 2932 2936 flflrxr.exe vvjdj.exe PID 2936 wrote to memory of 2932 2936 flflrxr.exe vvjdj.exe PID 2932 wrote to memory of 1644 2932 vvjdj.exe 7jdpv.exe PID 2932 wrote to memory of 1644 2932 vvjdj.exe 7jdpv.exe PID 2932 wrote to memory of 1644 2932 vvjdj.exe 7jdpv.exe PID 2932 wrote to memory of 1644 2932 vvjdj.exe 7jdpv.exe PID 1644 wrote to memory of 1472 1644 7jdpv.exe frfxrrx.exe PID 1644 wrote to memory of 1472 1644 7jdpv.exe frfxrrx.exe PID 1644 wrote to memory of 1472 1644 7jdpv.exe frfxrrx.exe PID 1644 wrote to memory of 1472 1644 7jdpv.exe frfxrrx.exe PID 1472 wrote to memory of 2660 1472 frfxrrx.exe xrrfrfr.exe PID 1472 wrote to memory of 2660 1472 frfxrrx.exe xrrfrfr.exe PID 1472 wrote to memory of 2660 1472 frfxrrx.exe xrrfrfr.exe PID 1472 wrote to memory of 2660 1472 frfxrrx.exe xrrfrfr.exe PID 2660 wrote to memory of 1548 2660 xrrfrfr.exe 3tbtbh.exe PID 2660 wrote to memory of 1548 2660 xrrfrfr.exe 3tbtbh.exe PID 2660 wrote to memory of 1548 2660 xrrfrfr.exe 3tbtbh.exe PID 2660 wrote to memory of 1548 2660 xrrfrfr.exe 3tbtbh.exe PID 1548 wrote to memory of 820 1548 3tbtbh.exe 9rrlxfl.exe PID 1548 wrote to memory of 820 1548 3tbtbh.exe 9rrlxfl.exe PID 1548 wrote to memory of 820 1548 3tbtbh.exe 9rrlxfl.exe PID 1548 wrote to memory of 820 1548 3tbtbh.exe 9rrlxfl.exe PID 820 wrote to memory of 2148 820 9rrlxfl.exe 1jvjv.exe PID 820 wrote to memory of 2148 820 9rrlxfl.exe 1jvjv.exe PID 820 wrote to memory of 2148 820 9rrlxfl.exe 1jvjv.exe PID 820 wrote to memory of 2148 820 9rrlxfl.exe 1jvjv.exe PID 2148 wrote to memory of 1572 2148 1jvjv.exe rrrxffr.exe PID 2148 wrote to memory of 1572 2148 1jvjv.exe rrrxffr.exe PID 2148 wrote to memory of 1572 2148 1jvjv.exe rrrxffr.exe PID 2148 wrote to memory of 1572 2148 1jvjv.exe rrrxffr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89.exe"C:\Users\Admin\AppData\Local\Temp\78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\bbtbnn.exec:\bbtbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\jpjjv.exec:\jpjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\lxrlrrf.exec:\lxrlrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\1nhhtb.exec:\1nhhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\pppdp.exec:\pppdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\xflrrlr.exec:\xflrrlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\pjpjd.exec:\pjpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\flflrxr.exec:\flflrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\vvjdj.exec:\vvjdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\7jdpv.exec:\7jdpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\frfxrrx.exec:\frfxrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\xrrfrfr.exec:\xrrfrfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\3tbtbh.exec:\3tbtbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\9rrlxfl.exec:\9rrlxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\1jvjv.exec:\1jvjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\rrrxffr.exec:\rrrxffr.exe17⤵
- Executes dropped EXE
PID:1572 -
\??\c:\tnhhtt.exec:\tnhhtt.exe18⤵
- Executes dropped EXE
PID:1576 -
\??\c:\jjdjv.exec:\jjdjv.exe19⤵
- Executes dropped EXE
PID:1456 -
\??\c:\lrrfrfx.exec:\lrrfrfx.exe20⤵
- Executes dropped EXE
PID:2328 -
\??\c:\hbbtbh.exec:\hbbtbh.exe21⤵
- Executes dropped EXE
PID:2580 -
\??\c:\9thhtt.exec:\9thhtt.exe22⤵
- Executes dropped EXE
PID:2108 -
\??\c:\pjppv.exec:\pjppv.exe23⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tbthtb.exec:\tbthtb.exe24⤵
- Executes dropped EXE
PID:980 -
\??\c:\jpjjv.exec:\jpjjv.exe25⤵
- Executes dropped EXE
PID:3028 -
\??\c:\hbttbb.exec:\hbttbb.exe26⤵
- Executes dropped EXE
PID:1208 -
\??\c:\jjddp.exec:\jjddp.exe27⤵
- Executes dropped EXE
PID:2276 -
\??\c:\bnbbhh.exec:\bnbbhh.exe28⤵
- Executes dropped EXE
PID:1312 -
\??\c:\7vpvd.exec:\7vpvd.exe29⤵
- Executes dropped EXE
PID:2360 -
\??\c:\llfxlfr.exec:\llfxlfr.exe30⤵
- Executes dropped EXE
PID:868 -
\??\c:\nhbbnt.exec:\nhbbnt.exe31⤵
- Executes dropped EXE
PID:2060 -
\??\c:\frlrflx.exec:\frlrflx.exe32⤵
- Executes dropped EXE
PID:784 -
\??\c:\lfxxllr.exec:\lfxxllr.exe33⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jdvdj.exec:\jdvdj.exe34⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rlxxffl.exec:\rlxxffl.exe35⤵
- Executes dropped EXE
PID:2272 -
\??\c:\lxrxffr.exec:\lxrxffr.exe36⤵
- Executes dropped EXE
PID:1916 -
\??\c:\hbthtt.exec:\hbthtt.exe37⤵
- Executes dropped EXE
PID:2980 -
\??\c:\jdddp.exec:\jdddp.exe38⤵
- Executes dropped EXE
PID:1664 -
\??\c:\9ffrffr.exec:\9ffrffr.exe39⤵
- Executes dropped EXE
PID:2672 -
\??\c:\fxrrflx.exec:\fxrrflx.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\bnbhtt.exec:\bnbhtt.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\1jpdd.exec:\1jpdd.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\9vjvd.exec:\9vjvd.exe43⤵
- Executes dropped EXE
PID:2756 -
\??\c:\lfrxflr.exec:\lfrxflr.exe44⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hhtbnt.exec:\hhtbnt.exe45⤵
- Executes dropped EXE
PID:2484 -
\??\c:\jdvdp.exec:\jdvdp.exe46⤵
- Executes dropped EXE
PID:2560 -
\??\c:\frlllrx.exec:\frlllrx.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\9httbb.exec:\9httbb.exe48⤵
- Executes dropped EXE
PID:1088 -
\??\c:\nhbbnh.exec:\nhbbnh.exe49⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ddvdv.exec:\ddvdv.exe50⤵
- Executes dropped EXE
PID:1372 -
\??\c:\rrlxflx.exec:\rrlxflx.exe51⤵
- Executes dropped EXE
PID:2728 -
\??\c:\btnbtb.exec:\btnbtb.exe52⤵
- Executes dropped EXE
PID:1952 -
\??\c:\nnhbhh.exec:\nnhbhh.exe53⤵
- Executes dropped EXE
PID:1232 -
\??\c:\5dddj.exec:\5dddj.exe54⤵
- Executes dropped EXE
PID:756 -
\??\c:\lfxlxfr.exec:\lfxlxfr.exe55⤵
- Executes dropped EXE
PID:348 -
\??\c:\xlxflrf.exec:\xlxflrf.exe56⤵
- Executes dropped EXE
PID:900 -
\??\c:\nnhbnb.exec:\nnhbnb.exe57⤵
- Executes dropped EXE
PID:760 -
\??\c:\1vpvp.exec:\1vpvp.exe58⤵
- Executes dropped EXE
PID:1572 -
\??\c:\xxlxrxl.exec:\xxlxrxl.exe59⤵
- Executes dropped EXE
PID:1484 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe60⤵
- Executes dropped EXE
PID:1452 -
\??\c:\tnhhnn.exec:\tnhhnn.exe61⤵
- Executes dropped EXE
PID:1456 -
\??\c:\pjdjp.exec:\pjdjp.exe62⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rfxrrxx.exec:\rfxrrxx.exe63⤵
- Executes dropped EXE
PID:2200 -
\??\c:\7lflrxf.exec:\7lflrxf.exe64⤵
- Executes dropped EXE
PID:2580 -
\??\c:\bthnbh.exec:\bthnbh.exe65⤵
- Executes dropped EXE
PID:264 -
\??\c:\7pddd.exec:\7pddd.exe66⤵PID:2212
-
\??\c:\3fffrrf.exec:\3fffrrf.exe67⤵PID:2008
-
\??\c:\xrffrxl.exec:\xrffrxl.exe68⤵PID:832
-
\??\c:\nbntbb.exec:\nbntbb.exe69⤵PID:988
-
\??\c:\1jjdj.exec:\1jjdj.exe70⤵PID:1276
-
\??\c:\pjjpd.exec:\pjjpd.exe71⤵PID:948
-
\??\c:\fxfrrxl.exec:\fxfrrxl.exe72⤵PID:928
-
\??\c:\3bhnnt.exec:\3bhnnt.exe73⤵PID:2132
-
\??\c:\bhbhtt.exec:\bhbhtt.exe74⤵PID:2360
-
\??\c:\ppjdp.exec:\ppjdp.exe75⤵PID:1184
-
\??\c:\rfflxxr.exec:\rfflxxr.exe76⤵PID:1348
-
\??\c:\hthbhb.exec:\hthbhb.exe77⤵PID:2444
-
\??\c:\jpddp.exec:\jpddp.exe78⤵PID:2224
-
\??\c:\llfrxfx.exec:\llfrxfx.exe79⤵PID:1436
-
\??\c:\xlxllfl.exec:\xlxllfl.exe80⤵PID:1904
-
\??\c:\bbntbt.exec:\bbntbt.exe81⤵PID:1632
-
\??\c:\pjdjd.exec:\pjdjd.exe82⤵PID:1992
-
\??\c:\jvppv.exec:\jvppv.exe83⤵PID:2612
-
\??\c:\lfxlrxr.exec:\lfxlrxr.exe84⤵PID:2708
-
\??\c:\5tbntt.exec:\5tbntt.exe85⤵PID:2672
-
\??\c:\dvjpd.exec:\dvjpd.exe86⤵PID:1108
-
\??\c:\xlflrrf.exec:\xlflrrf.exe87⤵PID:2848
-
\??\c:\9btbhh.exec:\9btbhh.exe88⤵PID:2824
-
\??\c:\nnbhnt.exec:\nnbhnt.exe89⤵PID:2756
-
\??\c:\3ppdv.exec:\3ppdv.exe90⤵PID:2476
-
\??\c:\7xrxrrf.exec:\7xrxrrf.exe91⤵PID:2984
-
\??\c:\htnnhh.exec:\htnnhh.exe92⤵PID:2332
-
\??\c:\pvvjp.exec:\pvvjp.exe93⤵PID:2544
-
\??\c:\fxrxflf.exec:\fxrxflf.exe94⤵PID:1088
-
\??\c:\rllrlrl.exec:\rllrlrl.exe95⤵PID:2368
-
\??\c:\hbnnhn.exec:\hbnnhn.exe96⤵PID:2792
-
\??\c:\3jvdp.exec:\3jvdp.exe97⤵PID:1740
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe98⤵PID:352
-
\??\c:\rlxrxfr.exec:\rlxrxfr.exe99⤵PID:1548
-
\??\c:\hbthth.exec:\hbthth.exe100⤵PID:2136
-
\??\c:\vpjpd.exec:\vpjpd.exe101⤵PID:348
-
\??\c:\pdpdp.exec:\pdpdp.exe102⤵PID:2148
-
\??\c:\xrffrrx.exec:\xrffrrx.exe103⤵PID:760
-
\??\c:\tttthn.exec:\tttthn.exe104⤵PID:1572
-
\??\c:\nhbnbh.exec:\nhbnbh.exe105⤵PID:844
-
\??\c:\jddpv.exec:\jddpv.exe106⤵PID:1452
-
\??\c:\fxrffxl.exec:\fxrffxl.exe107⤵PID:1244
-
\??\c:\9nbbhh.exec:\9nbbhh.exe108⤵PID:2428
-
\??\c:\7nhhnt.exec:\7nhhnt.exe109⤵PID:2220
-
\??\c:\pdjpv.exec:\pdjpv.exe110⤵PID:592
-
\??\c:\rffrxxf.exec:\rffrxxf.exe111⤵PID:2252
-
\??\c:\ttnntb.exec:\ttnntb.exe112⤵PID:2996
-
\??\c:\nhtbhh.exec:\nhtbhh.exe113⤵PID:444
-
\??\c:\dpddj.exec:\dpddj.exe114⤵PID:1076
-
\??\c:\9llxlrl.exec:\9llxlrl.exe115⤵PID:1480
-
\??\c:\hbhnbb.exec:\hbhnbb.exe116⤵PID:952
-
\??\c:\fxlrllx.exec:\fxlrllx.exe117⤵PID:340
-
\??\c:\hbttbh.exec:\hbttbh.exe118⤵PID:1004
-
\??\c:\nhbhtb.exec:\nhbhtb.exe119⤵PID:1988
-
\??\c:\rrrxllr.exec:\rrrxllr.exe120⤵PID:2360
-
\??\c:\9rlrxxl.exec:\9rlrxxl.exe121⤵PID:868
-
\??\c:\9tntnn.exec:\9tntnn.exe122⤵PID:1692
-
\??\c:\jvjpd.exec:\jvjpd.exe123⤵PID:2184
-
\??\c:\jdvdd.exec:\jdvdd.exe124⤵PID:2180
-
\??\c:\5lxxxff.exec:\5lxxxff.exe125⤵PID:2904
-
\??\c:\5fffllr.exec:\5fffllr.exe126⤵PID:2856
-
\??\c:\nbnbhb.exec:\nbnbhb.exe127⤵PID:2204
-
\??\c:\9pjvd.exec:\9pjvd.exe128⤵PID:1860
-
\??\c:\llflrxl.exec:\llflrxl.exe129⤵PID:2324
-
\??\c:\lfrflrf.exec:\lfrflrf.exe130⤵PID:3064
-
\??\c:\httbnn.exec:\httbnn.exe131⤵PID:3060
-
\??\c:\vpvjp.exec:\vpvjp.exe132⤵PID:2736
-
\??\c:\vdpjp.exec:\vdpjp.exe133⤵PID:2632
-
\??\c:\rflrxrx.exec:\rflrxrx.exe134⤵PID:2644
-
\??\c:\5xxxfff.exec:\5xxxfff.exe135⤵PID:2536
-
\??\c:\hnhntt.exec:\hnhntt.exe136⤵PID:2532
-
\??\c:\1djpv.exec:\1djpv.exe137⤵PID:2500
-
\??\c:\vpjvj.exec:\vpjvj.exe138⤵PID:1656
-
\??\c:\ffxxffr.exec:\ffxxffr.exe139⤵PID:2932
-
\??\c:\nhtbnt.exec:\nhtbnt.exe140⤵PID:1508
-
\??\c:\nnhbbb.exec:\nnhbbb.exe141⤵PID:2720
-
\??\c:\pdpvd.exec:\pdpvd.exe142⤵PID:2584
-
\??\c:\7rllxfl.exec:\7rllxfl.exe143⤵PID:2800
-
\??\c:\thbbhn.exec:\thbbhn.exe144⤵PID:1740
-
\??\c:\nbthnt.exec:\nbthnt.exe145⤵PID:1932
-
\??\c:\pjdjp.exec:\pjdjp.exe146⤵PID:820
-
\??\c:\jjdjp.exec:\jjdjp.exe147⤵PID:1712
-
\??\c:\5fxfllx.exec:\5fxfllx.exe148⤵PID:2388
-
\??\c:\1ttthn.exec:\1ttthn.exe149⤵PID:1188
-
\??\c:\htnttb.exec:\htnttb.exe150⤵PID:2820
-
\??\c:\7vvvd.exec:\7vvvd.exe151⤵PID:2424
-
\??\c:\llfrflr.exec:\llfrflr.exe152⤵PID:844
-
\??\c:\xrllxxl.exec:\xrllxxl.exe153⤵PID:1456
-
\??\c:\ntthbh.exec:\ntthbh.exe154⤵PID:1244
-
\??\c:\jdjvv.exec:\jdjvv.exe155⤵PID:2200
-
\??\c:\dvjdj.exec:\dvjdj.exe156⤵PID:2220
-
\??\c:\rllrxxf.exec:\rllrxxf.exe157⤵PID:592
-
\??\c:\rlxxllx.exec:\rlxxllx.exe158⤵PID:2252
-
\??\c:\bthhhn.exec:\bthhhn.exe159⤵PID:3028
-
\??\c:\jdddj.exec:\jdddj.exe160⤵PID:3032
-
\??\c:\5dvvd.exec:\5dvvd.exe161⤵PID:1076
-
\??\c:\5rxxlrx.exec:\5rxxlrx.exe162⤵PID:1744
-
\??\c:\9btthh.exec:\9btthh.exe163⤵PID:1292
-
\??\c:\htnbhn.exec:\htnbhn.exe164⤵PID:2028
-
\??\c:\3jjvd.exec:\3jjvd.exe165⤵PID:928
-
\??\c:\xlfrxfr.exec:\xlfrxfr.exe166⤵PID:1828
-
\??\c:\xrffrrf.exec:\xrffrrf.exe167⤵PID:2216
-
\??\c:\tnbhnn.exec:\tnbhnn.exe168⤵PID:1592
-
\??\c:\vjvdd.exec:\vjvdd.exe169⤵PID:3020
-
\??\c:\3vvdj.exec:\3vvdj.exe170⤵PID:1852
-
\??\c:\xrrxflx.exec:\xrrxflx.exe171⤵PID:1100
-
\??\c:\5btbhh.exec:\5btbhh.exe172⤵PID:2292
-
\??\c:\9bhntb.exec:\9bhntb.exe173⤵PID:1436
-
\??\c:\vvpvd.exec:\vvpvd.exe174⤵PID:1528
-
\??\c:\rfrxffl.exec:\rfrxffl.exe175⤵PID:1532
-
\??\c:\9fxfrrf.exec:\9fxfrrf.exe176⤵PID:2624
-
\??\c:\tbnhbn.exec:\tbnhbn.exe177⤵PID:2700
-
\??\c:\jjjvd.exec:\jjjvd.exe178⤵PID:2704
-
\??\c:\dppdd.exec:\dppdd.exe179⤵PID:2672
-
\??\c:\rrrflxl.exec:\rrrflxl.exe180⤵PID:2732
-
\??\c:\llffrrf.exec:\llffrrf.exe181⤵PID:2504
-
\??\c:\tnnhtt.exec:\tnnhtt.exe182⤵PID:2824
-
\??\c:\pjdvd.exec:\pjdvd.exe183⤵PID:2528
-
\??\c:\vjvvd.exec:\vjvvd.exe184⤵PID:2484
-
\??\c:\ffxfllx.exec:\ffxfllx.exe185⤵PID:2300
-
\??\c:\tbbhbn.exec:\tbbhbn.exe186⤵PID:2308
-
\??\c:\tnbnhh.exec:\tnbnhh.exe187⤵PID:2372
-
\??\c:\jdpvd.exec:\jdpvd.exe188⤵PID:2932
-
\??\c:\1rffrxl.exec:\1rffrxl.exe189⤵PID:1372
-
\??\c:\rrlrllf.exec:\rrlrllf.exe190⤵PID:2720
-
\??\c:\ttntbh.exec:\ttntbh.exe191⤵PID:2584
-
\??\c:\nbtbhh.exec:\nbtbhh.exe192⤵PID:1552
-
\??\c:\ddvjv.exec:\ddvjv.exe193⤵PID:1940
-
\??\c:\1bnnhn.exec:\1bnnhn.exe194⤵PID:1932
-
\??\c:\bnhhnn.exec:\bnhhnn.exe195⤵PID:1708
-
\??\c:\vjvdd.exec:\vjvdd.exe196⤵PID:2124
-
\??\c:\5frxllr.exec:\5frxllr.exe197⤵PID:2388
-
\??\c:\3lrrlrf.exec:\3lrrlrf.exe198⤵PID:1188
-
\??\c:\thbntt.exec:\thbntt.exe199⤵PID:2316
-
\??\c:\vjppv.exec:\vjppv.exe200⤵PID:2424
-
\??\c:\pjjvd.exec:\pjjvd.exe201⤵PID:844
-
\??\c:\xxrflrf.exec:\xxrflrf.exe202⤵PID:1456
-
\??\c:\rfxlrrf.exec:\rfxlrrf.exe203⤵PID:2232
-
\??\c:\thhbnt.exec:\thhbnt.exe204⤵PID:2200
-
\??\c:\vjddj.exec:\vjddj.exe205⤵PID:572
-
\??\c:\fxrrffl.exec:\fxrrffl.exe206⤵PID:592
-
\??\c:\7nnthh.exec:\7nnthh.exe207⤵PID:2008
-
\??\c:\nbthnn.exec:\nbthnn.exe208⤵PID:3028
-
\??\c:\vvpvj.exec:\vvpvj.exe209⤵PID:1964
-
\??\c:\lrlrflr.exec:\lrlrflr.exe210⤵PID:1076
-
\??\c:\9xlrrxl.exec:\9xlrrxl.exe211⤵PID:1744
-
\??\c:\nnnhbh.exec:\nnnhbh.exe212⤵PID:948
-
\??\c:\pjddj.exec:\pjddj.exe213⤵PID:2028
-
\??\c:\dvpvj.exec:\dvpvj.exe214⤵PID:1748
-
\??\c:\lxrrrxf.exec:\lxrrrxf.exe215⤵PID:1828
-
\??\c:\tnhtbh.exec:\tnhtbh.exe216⤵PID:1984
-
\??\c:\bnhnnn.exec:\bnhnnn.exe217⤵PID:2036
-
\??\c:\djdvj.exec:\djdvj.exe218⤵PID:784
-
\??\c:\xrrrllx.exec:\xrrrllx.exe219⤵PID:2184
-
\??\c:\3htntt.exec:\3htntt.exe220⤵PID:984
-
\??\c:\nbhnbh.exec:\nbhnbh.exe221⤵PID:2292
-
\??\c:\pjpdp.exec:\pjpdp.exe222⤵PID:1524
-
\??\c:\pdvjp.exec:\pdvjp.exe223⤵PID:1528
-
\??\c:\rlfrxfx.exec:\rlfrxfx.exe224⤵PID:1676
-
\??\c:\tnhnbh.exec:\tnhnbh.exe225⤵PID:3004
-
\??\c:\nntntn.exec:\nntntn.exe226⤵PID:2676
-
\??\c:\7jpjv.exec:\7jpjv.exe227⤵PID:2704
-
\??\c:\xxrxlfl.exec:\xxrxlfl.exe228⤵PID:2588
-
\??\c:\flrrxrf.exec:\flrrxrf.exe229⤵PID:2848
-
\??\c:\hbbhbh.exec:\hbbhbh.exe230⤵PID:2376
-
\??\c:\3djvj.exec:\3djvj.exe231⤵PID:2756
-
\??\c:\vjdjv.exec:\vjdjv.exe232⤵PID:2600
-
\??\c:\rrrfxfx.exec:\rrrfxfx.exe233⤵PID:2524
-
\??\c:\bbtbnb.exec:\bbtbnb.exe234⤵PID:2652
-
\??\c:\nthhnn.exec:\nthhnn.exe235⤵PID:2308
-
\??\c:\pjdjp.exec:\pjdjp.exe236⤵PID:1636
-
\??\c:\3rfrlrx.exec:\3rfrlrx.exe237⤵PID:2932
-
\??\c:\9rlrxxx.exec:\9rlrxxx.exe238⤵PID:2540
-
\??\c:\tnnbhh.exec:\tnnbhh.exe239⤵PID:2720
-
\??\c:\dvpvd.exec:\dvpvd.exe240⤵PID:1684
-
\??\c:\5pvdj.exec:\5pvdj.exe241⤵PID:1552
-
\??\c:\rxrxlxr.exec:\rxrxlxr.exe242⤵PID:1940