Analysis
-
max time kernel
115s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 22:45
Behavioral task
behavioral1
Sample
4f9fb8a485adeda2f471551c7c2624c0be6f8ac0cf6a83e5495006efea26f2a4.exe
Resource
win7-20231129-en
General
-
Target
4f9fb8a485adeda2f471551c7c2624c0be6f8ac0cf6a83e5495006efea26f2a4.exe
-
Size
294KB
-
MD5
267dcc77604fa2cdc37573ebfaba5590
-
SHA1
4b6597d51a86c6886424d8d17c72ec69f7cced84
-
SHA256
4f9fb8a485adeda2f471551c7c2624c0be6f8ac0cf6a83e5495006efea26f2a4
-
SHA512
dffddd160a81aa01a2c9a90ff3b065156e335ed2efc03ee9b16cd8bea55db569317cccbd0f85851ad274e6677296ee093bd442f24d48fdc35313d27791474861
-
SSDEEP
6144:ccm4FmowdHoSQkuObHq9ltAszBd+za/p1slTjZXvEQo9dftON:K4wFHoSQkuUHk1zBR/pMT9XvEhdf+
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/1276-7-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2196-11-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1940-27-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2556-46-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2636-55-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2852-64-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2476-67-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2468-86-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2496-83-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2088-102-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1344-119-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2016-127-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2028-153-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2548-156-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2060-173-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1696-196-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/784-214-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1484-223-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/988-243-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2848-256-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2740-314-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2448-376-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2520-377-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2520-384-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/856-415-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2172-435-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2780-442-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1092-455-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2052-474-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2272-505-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1796-524-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1448-580-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2376-583-0x00000000002B0000-0x00000000002E4000-memory.dmp family_blackmoon behavioral1/memory/1184-720-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2772-723-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2768-735-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2352-756-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2148-1039-0x00000000002D0000-0x0000000000304000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 33 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \??\c:\dddjd.exe family_berbew \??\c:\rlrfrfl.exe family_berbew C:\jvvvd.exe family_berbew C:\lfxlrxl.exe family_berbew C:\ntnnbb.exe family_berbew C:\djvdp.exe family_berbew C:\tbhbnb.exe family_berbew C:\1jpvv.exe family_berbew \??\c:\ffrxflr.exe family_berbew C:\bnnnbb.exe family_berbew C:\lfrrllr.exe family_berbew C:\rlxxrrr.exe family_berbew C:\btnhth.exe family_berbew behavioral1/memory/1344-116-0x0000000000220000-0x0000000000254000-memory.dmp family_berbew C:\lxxfrxl.exe family_berbew C:\tthtbt.exe family_berbew C:\hthbth.exe family_berbew C:\dvjvd.exe family_berbew C:\fllrxlx.exe family_berbew C:\bthnth.exe family_berbew C:\1vppv.exe family_berbew C:\lflrxrx.exe family_berbew C:\bhbhbb.exe family_berbew C:\djpdp.exe family_berbew C:\3lffllr.exe family_berbew C:\nhtbnh.exe family_berbew C:\vjjpv.exe family_berbew \??\c:\ffxflrf.exe family_berbew C:\xrxxlxr.exe family_berbew \??\c:\htbbbh.exe family_berbew C:\jdjdp.exe family_berbew C:\nbbhnt.exe family_berbew C:\vpdjv.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
dddjd.exerlrfrfl.exejvvvd.exelfxlrxl.exentnnbb.exedjvdp.exetbhbnb.exe1jpvv.exeffrxflr.exebnnnbb.exelfrrllr.exerlxxrrr.exebtnhth.exelxxfrxl.exetthtbt.exehthbth.exedvjvd.exefllrxlx.exebthnth.exe1vppv.exelflrxrx.exebhbhbb.exedjpdp.exe3lffllr.exenhtbnh.exevjjpv.exeffxflrf.exexrxxlxr.exehtbbbh.exejdjdp.exenbbhnt.exevpdjv.exe5dvjp.exexxlxxfr.exehbhntb.exebthnbt.exepppvv.exerlxlrxf.exelfrfxxl.exenhnhnn.exevjppp.exejvddj.exe3lxlrfx.exefxrrllr.exe1nnnnh.exehbntbh.exepjpdd.exerfrllrx.exe9rlfrrr.exe5btnth.exedppdv.exevjddj.exefxxlrrf.exethtthh.exetnhtth.exedvppj.exepdpvv.exefffrxfr.exehbnbbh.exe5hhhhb.exevjpdd.exeffxxffl.exe7fllrrx.exehhtthn.exepid process 2196 dddjd.exe 1940 rlrfrfl.exe 2388 jvvvd.exe 2556 lfxlrxl.exe 2636 ntnnbb.exe 2852 djvdp.exe 2476 tbhbnb.exe 2496 1jpvv.exe 2468 ffrxflr.exe 2928 bnnnbb.exe 2088 lfrrllr.exe 1344 rlxxrrr.exe 2016 btnhth.exe 1196 lxxfrxl.exe 1660 tthtbt.exe 2028 hthbth.exe 2548 dvjvd.exe 1096 fllrxlx.exe 2060 bthnth.exe 1524 1vppv.exe 1696 lflrxrx.exe 2108 bhbhbb.exe 784 djpdp.exe 1484 3lffllr.exe 2084 nhtbnh.exe 1740 vjjpv.exe 988 ffxflrf.exe 2848 xrxxlxr.exe 1996 htbbbh.exe 2200 jdjdp.exe 1772 nbbhnt.exe 112 vpdjv.exe 1748 5dvjp.exe 1688 xxlxxfr.exe 1108 hbhntb.exe 3044 bthnbt.exe 2740 pppvv.exe 2320 rlxlrxf.exe 1680 lfrfxxl.exe 2648 nhnhnn.exe 2592 vjppp.exe 2640 jvddj.exe 2604 3lxlrfx.exe 2824 fxrrllr.exe 2588 1nnnnh.exe 2448 hbntbh.exe 2520 pjpdd.exe 2572 rfrllrx.exe 2620 9rlfrrr.exe 1640 5btnth.exe 2508 dppdv.exe 856 vjddj.exe 1788 fxxlrrf.exe 1768 thtthh.exe 2172 tnhtth.exe 2780 dvppj.exe 2788 pdpvv.exe 1092 fffrxfr.exe 500 hbnbbh.exe 2148 5hhhhb.exe 2052 vjpdd.exe 1904 ffxxffl.exe 2240 7fllrrx.exe 676 hhtthn.exe -
Processes:
resource yara_rule behavioral1/memory/1276-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1276-7-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\dddjd.exe upx behavioral1/memory/2196-11-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\rlrfrfl.exe upx behavioral1/memory/1940-27-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2388-28-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jvvvd.exe upx C:\lfxlrxl.exe upx behavioral1/memory/2388-32-0x0000000000220000-0x0000000000254000-memory.dmp upx behavioral1/memory/2556-38-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2556-46-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\ntnnbb.exe upx C:\djvdp.exe upx behavioral1/memory/2636-55-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\tbhbnb.exe upx behavioral1/memory/2852-64-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2476-67-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\1jpvv.exe upx behavioral1/memory/2468-86-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\ffrxflr.exe upx behavioral1/memory/2496-83-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\bnnnbb.exe upx C:\lfrrllr.exe upx behavioral1/memory/2088-102-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rlxxrrr.exe upx C:\btnhth.exe upx behavioral1/memory/1344-119-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2016-127-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\lxxfrxl.exe upx C:\tthtbt.exe upx C:\hthbth.exe upx C:\dvjvd.exe upx behavioral1/memory/2028-153-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2548-156-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\fllrxlx.exe upx C:\bthnth.exe upx behavioral1/memory/2060-173-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\1vppv.exe upx C:\lflrxrx.exe upx C:\bhbhbb.exe upx behavioral1/memory/1696-196-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\djpdp.exe upx behavioral1/memory/784-205-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/784-214-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\3lffllr.exe upx behavioral1/memory/1484-223-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\nhtbnh.exe upx C:\vjjpv.exe upx \??\c:\ffxflrf.exe upx behavioral1/memory/988-243-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xrxxlxr.exe upx \??\c:\htbbbh.exe upx behavioral1/memory/2848-256-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jdjdp.exe upx C:\nbbhnt.exe upx C:\vpdjv.exe upx behavioral1/memory/1108-301-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2740-314-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2448-369-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2448-376-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2520-377-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2520-384-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/856-415-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4f9fb8a485adeda2f471551c7c2624c0be6f8ac0cf6a83e5495006efea26f2a4.exedddjd.exerlrfrfl.exejvvvd.exelfxlrxl.exentnnbb.exedjvdp.exetbhbnb.exe1jpvv.exeffrxflr.exebnnnbb.exelfrrllr.exerlxxrrr.exebtnhth.exelxxfrxl.exetthtbt.exedescription pid process target process PID 1276 wrote to memory of 2196 1276 4f9fb8a485adeda2f471551c7c2624c0be6f8ac0cf6a83e5495006efea26f2a4.exe dddjd.exe PID 1276 wrote to memory of 2196 1276 4f9fb8a485adeda2f471551c7c2624c0be6f8ac0cf6a83e5495006efea26f2a4.exe dddjd.exe PID 1276 wrote to memory of 2196 1276 4f9fb8a485adeda2f471551c7c2624c0be6f8ac0cf6a83e5495006efea26f2a4.exe dddjd.exe PID 1276 wrote to memory of 2196 1276 4f9fb8a485adeda2f471551c7c2624c0be6f8ac0cf6a83e5495006efea26f2a4.exe dddjd.exe PID 2196 wrote to memory of 1940 2196 dddjd.exe rlrfrfl.exe PID 2196 wrote to memory of 1940 2196 dddjd.exe rlrfrfl.exe PID 2196 wrote to memory of 1940 2196 dddjd.exe rlrfrfl.exe PID 2196 wrote to memory of 1940 2196 dddjd.exe rlrfrfl.exe PID 1940 wrote to memory of 2388 1940 rlrfrfl.exe jvvvd.exe PID 1940 wrote to memory of 2388 1940 rlrfrfl.exe jvvvd.exe PID 1940 wrote to memory of 2388 1940 rlrfrfl.exe jvvvd.exe PID 1940 wrote to memory of 2388 1940 rlrfrfl.exe jvvvd.exe PID 2388 wrote to memory of 2556 2388 jvvvd.exe lfxlrxl.exe PID 2388 wrote to memory of 2556 2388 jvvvd.exe lfxlrxl.exe PID 2388 wrote to memory of 2556 2388 jvvvd.exe lfxlrxl.exe PID 2388 wrote to memory of 2556 2388 jvvvd.exe lfxlrxl.exe PID 2556 wrote to memory of 2636 2556 lfxlrxl.exe ntnnbb.exe PID 2556 wrote to memory of 2636 2556 lfxlrxl.exe ntnnbb.exe PID 2556 wrote to memory of 2636 2556 lfxlrxl.exe ntnnbb.exe PID 2556 wrote to memory of 2636 2556 lfxlrxl.exe ntnnbb.exe PID 2636 wrote to memory of 2852 2636 ntnnbb.exe djvdp.exe PID 2636 wrote to memory of 2852 2636 ntnnbb.exe djvdp.exe PID 2636 wrote to memory of 2852 2636 ntnnbb.exe djvdp.exe PID 2636 wrote to memory of 2852 2636 ntnnbb.exe djvdp.exe PID 2852 wrote to memory of 2476 2852 djvdp.exe tbhbnb.exe PID 2852 wrote to memory of 2476 2852 djvdp.exe tbhbnb.exe PID 2852 wrote to memory of 2476 2852 djvdp.exe tbhbnb.exe PID 2852 wrote to memory of 2476 2852 djvdp.exe tbhbnb.exe PID 2476 wrote to memory of 2496 2476 tbhbnb.exe 1jpvv.exe PID 2476 wrote to memory of 2496 2476 tbhbnb.exe 1jpvv.exe PID 2476 wrote to memory of 2496 2476 tbhbnb.exe 1jpvv.exe PID 2476 wrote to memory of 2496 2476 tbhbnb.exe 1jpvv.exe PID 2496 wrote to memory of 2468 2496 1jpvv.exe ffrxflr.exe PID 2496 wrote to memory of 2468 2496 1jpvv.exe ffrxflr.exe PID 2496 wrote to memory of 2468 2496 1jpvv.exe ffrxflr.exe PID 2496 wrote to memory of 2468 2496 1jpvv.exe ffrxflr.exe PID 2468 wrote to memory of 2928 2468 ffrxflr.exe bnnnbb.exe PID 2468 wrote to memory of 2928 2468 ffrxflr.exe bnnnbb.exe PID 2468 wrote to memory of 2928 2468 ffrxflr.exe bnnnbb.exe PID 2468 wrote to memory of 2928 2468 ffrxflr.exe bnnnbb.exe PID 2928 wrote to memory of 2088 2928 bnnnbb.exe lfrrllr.exe PID 2928 wrote to memory of 2088 2928 bnnnbb.exe lfrrllr.exe PID 2928 wrote to memory of 2088 2928 bnnnbb.exe lfrrllr.exe PID 2928 wrote to memory of 2088 2928 bnnnbb.exe lfrrllr.exe PID 2088 wrote to memory of 1344 2088 lfrrllr.exe rlxxrrr.exe PID 2088 wrote to memory of 1344 2088 lfrrllr.exe rlxxrrr.exe PID 2088 wrote to memory of 1344 2088 lfrrllr.exe rlxxrrr.exe PID 2088 wrote to memory of 1344 2088 lfrrllr.exe rlxxrrr.exe PID 1344 wrote to memory of 2016 1344 rlxxrrr.exe btnhth.exe PID 1344 wrote to memory of 2016 1344 rlxxrrr.exe btnhth.exe PID 1344 wrote to memory of 2016 1344 rlxxrrr.exe btnhth.exe PID 1344 wrote to memory of 2016 1344 rlxxrrr.exe btnhth.exe PID 2016 wrote to memory of 1196 2016 btnhth.exe lxxfrxl.exe PID 2016 wrote to memory of 1196 2016 btnhth.exe lxxfrxl.exe PID 2016 wrote to memory of 1196 2016 btnhth.exe lxxfrxl.exe PID 2016 wrote to memory of 1196 2016 btnhth.exe lxxfrxl.exe PID 1196 wrote to memory of 1660 1196 lxxfrxl.exe tthtbt.exe PID 1196 wrote to memory of 1660 1196 lxxfrxl.exe tthtbt.exe PID 1196 wrote to memory of 1660 1196 lxxfrxl.exe tthtbt.exe PID 1196 wrote to memory of 1660 1196 lxxfrxl.exe tthtbt.exe PID 1660 wrote to memory of 2028 1660 tthtbt.exe hthbth.exe PID 1660 wrote to memory of 2028 1660 tthtbt.exe hthbth.exe PID 1660 wrote to memory of 2028 1660 tthtbt.exe hthbth.exe PID 1660 wrote to memory of 2028 1660 tthtbt.exe hthbth.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f9fb8a485adeda2f471551c7c2624c0be6f8ac0cf6a83e5495006efea26f2a4.exe"C:\Users\Admin\AppData\Local\Temp\4f9fb8a485adeda2f471551c7c2624c0be6f8ac0cf6a83e5495006efea26f2a4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\dddjd.exec:\dddjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlrfrfl.exec:\rlrfrfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvvvd.exec:\jvvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxlrxl.exec:\lfxlrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntnnbb.exec:\ntnnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djvdp.exec:\djvdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbhbnb.exec:\tbhbnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1jpvv.exec:\1jpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrxflr.exec:\ffrxflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnnnbb.exec:\bnnnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfrrllr.exec:\lfrrllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btnhth.exec:\btnhth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxxfrxl.exec:\lxxfrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tthtbt.exec:\tthtbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hthbth.exec:\hthbth.exe17⤵
- Executes dropped EXE
-
\??\c:\dvjvd.exec:\dvjvd.exe18⤵
- Executes dropped EXE
-
\??\c:\fllrxlx.exec:\fllrxlx.exe19⤵
- Executes dropped EXE
-
\??\c:\bthnth.exec:\bthnth.exe20⤵
- Executes dropped EXE
-
\??\c:\1vppv.exec:\1vppv.exe21⤵
- Executes dropped EXE
-
\??\c:\lflrxrx.exec:\lflrxrx.exe22⤵
- Executes dropped EXE
-
\??\c:\bhbhbb.exec:\bhbhbb.exe23⤵
- Executes dropped EXE
-
\??\c:\djpdp.exec:\djpdp.exe24⤵
- Executes dropped EXE
-
\??\c:\3lffllr.exec:\3lffllr.exe25⤵
- Executes dropped EXE
-
\??\c:\nhtbnh.exec:\nhtbnh.exe26⤵
- Executes dropped EXE
-
\??\c:\vjjpv.exec:\vjjpv.exe27⤵
- Executes dropped EXE
-
\??\c:\ffxflrf.exec:\ffxflrf.exe28⤵
- Executes dropped EXE
-
\??\c:\xrxxlxr.exec:\xrxxlxr.exe29⤵
- Executes dropped EXE
-
\??\c:\htbbbh.exec:\htbbbh.exe30⤵
- Executes dropped EXE
-
\??\c:\jdjdp.exec:\jdjdp.exe31⤵
- Executes dropped EXE
-
\??\c:\nbbhnt.exec:\nbbhnt.exe32⤵
- Executes dropped EXE
-
\??\c:\vpdjv.exec:\vpdjv.exe33⤵
- Executes dropped EXE
-
\??\c:\5dvjp.exec:\5dvjp.exe34⤵
- Executes dropped EXE
-
\??\c:\xxlxxfr.exec:\xxlxxfr.exe35⤵
- Executes dropped EXE
-
\??\c:\hbhntb.exec:\hbhntb.exe36⤵
- Executes dropped EXE
-
\??\c:\bthnbt.exec:\bthnbt.exe37⤵
- Executes dropped EXE
-
\??\c:\pppvv.exec:\pppvv.exe38⤵
- Executes dropped EXE
-
\??\c:\rlxlrxf.exec:\rlxlrxf.exe39⤵
- Executes dropped EXE
-
\??\c:\lfrfxxl.exec:\lfrfxxl.exe40⤵
- Executes dropped EXE
-
\??\c:\nhnhnn.exec:\nhnhnn.exe41⤵
- Executes dropped EXE
-
\??\c:\vjppp.exec:\vjppp.exe42⤵
- Executes dropped EXE
-
\??\c:\jvddj.exec:\jvddj.exe43⤵
- Executes dropped EXE
-
\??\c:\3lxlrfx.exec:\3lxlrfx.exe44⤵
- Executes dropped EXE
-
\??\c:\fxrrllr.exec:\fxrrllr.exe45⤵
- Executes dropped EXE
-
\??\c:\1nnnnh.exec:\1nnnnh.exe46⤵
- Executes dropped EXE
-
\??\c:\hbntbh.exec:\hbntbh.exe47⤵
- Executes dropped EXE
-
\??\c:\pjpdd.exec:\pjpdd.exe48⤵
- Executes dropped EXE
-
\??\c:\rfrllrx.exec:\rfrllrx.exe49⤵
- Executes dropped EXE
-
\??\c:\9rlfrrr.exec:\9rlfrrr.exe50⤵
- Executes dropped EXE
-
\??\c:\5btnth.exec:\5btnth.exe51⤵
- Executes dropped EXE
-
\??\c:\dppdv.exec:\dppdv.exe52⤵
- Executes dropped EXE
-
\??\c:\vjddj.exec:\vjddj.exe53⤵
- Executes dropped EXE
-
\??\c:\fxxlrrf.exec:\fxxlrrf.exe54⤵
- Executes dropped EXE
-
\??\c:\thtthh.exec:\thtthh.exe55⤵
- Executes dropped EXE
-
\??\c:\tnhtth.exec:\tnhtth.exe56⤵
- Executes dropped EXE
-
\??\c:\dvppj.exec:\dvppj.exe57⤵
- Executes dropped EXE
-
\??\c:\pdpvv.exec:\pdpvv.exe58⤵
- Executes dropped EXE
-
\??\c:\fffrxfr.exec:\fffrxfr.exe59⤵
- Executes dropped EXE
-
\??\c:\hbnbbh.exec:\hbnbbh.exe60⤵
- Executes dropped EXE
-
\??\c:\5hhhhb.exec:\5hhhhb.exe61⤵
- Executes dropped EXE
-
\??\c:\vjpdd.exec:\vjpdd.exe62⤵
- Executes dropped EXE
-
\??\c:\ffxxffl.exec:\ffxxffl.exe63⤵
- Executes dropped EXE
-
\??\c:\7fllrrx.exec:\7fllrrx.exe64⤵
- Executes dropped EXE
-
\??\c:\hhtthn.exec:\hhtthn.exe65⤵
- Executes dropped EXE
-
\??\c:\bnttbh.exec:\bnttbh.exe66⤵
-
\??\c:\7pvpp.exec:\7pvpp.exe67⤵
-
\??\c:\pdjdd.exec:\pdjdd.exe68⤵
-
\??\c:\5rlllfl.exec:\5rlllfl.exe69⤵
-
\??\c:\3bhttt.exec:\3bhttt.exe70⤵
-
\??\c:\thtbhh.exec:\thtbhh.exe71⤵
-
\??\c:\jjdjv.exec:\jjdjv.exe72⤵
-
\??\c:\pvdvv.exec:\pvdvv.exe73⤵
-
\??\c:\rrxflrf.exec:\rrxflrf.exe74⤵
-
\??\c:\bhnhbb.exec:\bhnhbb.exe75⤵
-
\??\c:\hbhbbb.exec:\hbhbbb.exe76⤵
-
\??\c:\ppjdd.exec:\ppjdd.exe77⤵
-
\??\c:\frlfrlf.exec:\frlfrlf.exe78⤵
-
\??\c:\fflrlxl.exec:\fflrlxl.exe79⤵
-
\??\c:\thbbhn.exec:\thbbhn.exe80⤵
-
\??\c:\vjdvj.exec:\vjdvj.exe81⤵
-
\??\c:\frlxfxr.exec:\frlxfxr.exe82⤵
-
\??\c:\lxfffll.exec:\lxfffll.exe83⤵
-
\??\c:\bbhhbh.exec:\bbhhbh.exe84⤵
-
\??\c:\hbntnt.exec:\hbntnt.exe85⤵
-
\??\c:\jvddj.exec:\jvddj.exe86⤵
-
\??\c:\xllxffx.exec:\xllxffx.exe87⤵
-
\??\c:\xrxflrr.exec:\xrxflrr.exe88⤵
-
\??\c:\hhbhnt.exec:\hhbhnt.exe89⤵
-
\??\c:\httttt.exec:\httttt.exe90⤵
-
\??\c:\vpjpd.exec:\vpjpd.exe91⤵
-
\??\c:\pjvjp.exec:\pjvjp.exe92⤵
-
\??\c:\lxfrxrx.exec:\lxfrxrx.exe93⤵
-
\??\c:\hbhhnt.exec:\hbhhnt.exe94⤵
-
\??\c:\nbbnnh.exec:\nbbnnh.exe95⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe96⤵
-
\??\c:\dvddv.exec:\dvddv.exe97⤵
-
\??\c:\9xlllll.exec:\9xlllll.exe98⤵
-
\??\c:\nhbhnn.exec:\nhbhnn.exe99⤵
-
\??\c:\htbbhb.exec:\htbbhb.exe100⤵
-
\??\c:\vpdpv.exec:\vpdpv.exe101⤵
-
\??\c:\fxfxxlr.exec:\fxfxxlr.exe102⤵
-
\??\c:\rfrxrfx.exec:\rfrxrfx.exe103⤵
-
\??\c:\ttthbn.exec:\ttthbn.exe104⤵
-
\??\c:\jvdvd.exec:\jvdvd.exe105⤵
-
\??\c:\rfxxxfx.exec:\rfxxxfx.exe106⤵
-
\??\c:\lfxrxlf.exec:\lfxrxlf.exe107⤵
-
\??\c:\ntbttb.exec:\ntbttb.exe108⤵
-
\??\c:\jppdd.exec:\jppdd.exe109⤵
-
\??\c:\xffrlrl.exec:\xffrlrl.exe110⤵
-
\??\c:\rlfrflx.exec:\rlfrflx.exe111⤵
-
\??\c:\thnhtb.exec:\thnhtb.exe112⤵
-
\??\c:\jvddj.exec:\jvddj.exe113⤵
-
\??\c:\jdpvp.exec:\jdpvp.exe114⤵
-
\??\c:\xxrlfrx.exec:\xxrlfrx.exe115⤵
-
\??\c:\llxflrx.exec:\llxflrx.exe116⤵
-
\??\c:\hhtbth.exec:\hhtbth.exe117⤵
-
\??\c:\pjpvd.exec:\pjpvd.exe118⤵
-
\??\c:\ddvjd.exec:\ddvjd.exe119⤵
-
\??\c:\rrlxrlx.exec:\rrlxrlx.exe120⤵
-
\??\c:\nhtbbb.exec:\nhtbbb.exe121⤵
-
\??\c:\tnttbh.exec:\tnttbh.exe122⤵
-
\??\c:\jdjpv.exec:\jdjpv.exe123⤵
-
\??\c:\jpdvv.exec:\jpdvv.exe124⤵
-
\??\c:\rrlrffx.exec:\rrlrffx.exe125⤵
-
\??\c:\frffffl.exec:\frffffl.exe126⤵
-
\??\c:\ntbtth.exec:\ntbtth.exe127⤵
-
\??\c:\nnhtht.exec:\nnhtht.exe128⤵
-
\??\c:\jdvjj.exec:\jdvjj.exe129⤵
-
\??\c:\pvpvp.exec:\pvpvp.exe130⤵
-
\??\c:\ffxlxlx.exec:\ffxlxlx.exe131⤵
-
\??\c:\tnbbtt.exec:\tnbbtt.exe132⤵
-
\??\c:\5btbht.exec:\5btbht.exe133⤵
-
\??\c:\jvjdd.exec:\jvjdd.exe134⤵
-
\??\c:\1pppv.exec:\1pppv.exe135⤵
-
\??\c:\5lrlxll.exec:\5lrlxll.exe136⤵
-
\??\c:\hhtnth.exec:\hhtnth.exe137⤵
-
\??\c:\9hbbnb.exec:\9hbbnb.exe138⤵
-
\??\c:\dddpd.exec:\dddpd.exe139⤵
-
\??\c:\1rllxxf.exec:\1rllxxf.exe140⤵
-
\??\c:\bthtnt.exec:\bthtnt.exe141⤵
-
\??\c:\bbthtb.exec:\bbthtb.exe142⤵
-
\??\c:\ppdjp.exec:\ppdjp.exe143⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe144⤵
-
\??\c:\rlxffrl.exec:\rlxffrl.exe145⤵
-
\??\c:\9nhttt.exec:\9nhttt.exe146⤵
-
\??\c:\hhtbnh.exec:\hhtbnh.exe147⤵
-
\??\c:\jdjpv.exec:\jdjpv.exe148⤵
-
\??\c:\7dvdp.exec:\7dvdp.exe149⤵
-
\??\c:\rfrxxrl.exec:\rfrxxrl.exe150⤵
-
\??\c:\bbnthn.exec:\bbnthn.exe151⤵
-
\??\c:\btthhn.exec:\btthhn.exe152⤵
-
\??\c:\pppvp.exec:\pppvp.exe153⤵
-
\??\c:\nnhtnt.exec:\nnhtnt.exe154⤵
-
\??\c:\7hthhn.exec:\7hthhn.exe155⤵
-
\??\c:\vdvjd.exec:\vdvjd.exe156⤵
-
\??\c:\5xlllrr.exec:\5xlllrr.exe157⤵
-
\??\c:\llxflrf.exec:\llxflrf.exe158⤵
-
\??\c:\hhbhhn.exec:\hhbhhn.exe159⤵
-
\??\c:\jdvjp.exec:\jdvjp.exe160⤵
-
\??\c:\pjvdp.exec:\pjvdp.exe161⤵
-
\??\c:\1lflrrx.exec:\1lflrrx.exe162⤵
-
\??\c:\rrlxlrf.exec:\rrlxlrf.exe163⤵
-
\??\c:\hnnhhb.exec:\hnnhhb.exe164⤵
-
\??\c:\7bbntn.exec:\7bbntn.exe165⤵
-
\??\c:\7jpvd.exec:\7jpvd.exe166⤵
-
\??\c:\fxrflfr.exec:\fxrflfr.exe167⤵
-
\??\c:\lxlfrrf.exec:\lxlfrrf.exe168⤵
-
\??\c:\hbtbbb.exec:\hbtbbb.exe169⤵
-
\??\c:\7jdjd.exec:\7jdjd.exe170⤵
-
\??\c:\jpdvd.exec:\jpdvd.exe171⤵
-
\??\c:\flflxfr.exec:\flflxfr.exe172⤵
-
\??\c:\lllfrlx.exec:\lllfrlx.exe173⤵
-
\??\c:\nhbbnn.exec:\nhbbnn.exe174⤵
-
\??\c:\btnhnt.exec:\btnhnt.exe175⤵
-
\??\c:\dpjdv.exec:\dpjdv.exe176⤵
-
\??\c:\xrrxllx.exec:\xrrxllx.exe177⤵
-
\??\c:\3frxrxl.exec:\3frxrxl.exe178⤵
-
\??\c:\hbbhtb.exec:\hbbhtb.exe179⤵
-
\??\c:\7pppp.exec:\7pppp.exe180⤵
-
\??\c:\vpvvj.exec:\vpvvj.exe181⤵
-
\??\c:\rlfflrx.exec:\rlfflrx.exe182⤵
-
\??\c:\nbntbt.exec:\nbntbt.exe183⤵
-
\??\c:\bntnnn.exec:\bntnnn.exe184⤵
-
\??\c:\3pdjv.exec:\3pdjv.exe185⤵
-
\??\c:\pppvj.exec:\pppvj.exe186⤵
-
\??\c:\lrfxfrr.exec:\lrfxfrr.exe187⤵
-
\??\c:\7ffrrxl.exec:\7ffrrxl.exe188⤵
-
\??\c:\9hnbnt.exec:\9hnbnt.exe189⤵
-
\??\c:\nnhtht.exec:\nnhtht.exe190⤵
-
\??\c:\jppvj.exec:\jppvj.exe191⤵
-
\??\c:\jjjvp.exec:\jjjvp.exe192⤵
-
\??\c:\1llflfx.exec:\1llflfx.exe193⤵
-
\??\c:\7nbnth.exec:\7nbnth.exe194⤵
-
\??\c:\nhbhhn.exec:\nhbhhn.exe195⤵
-
\??\c:\vdvdv.exec:\vdvdv.exe196⤵
-
\??\c:\dvjpv.exec:\dvjpv.exe197⤵
-
\??\c:\9rlrffl.exec:\9rlrffl.exe198⤵
-
\??\c:\llxlxxl.exec:\llxlxxl.exe199⤵
-
\??\c:\bttnht.exec:\bttnht.exe200⤵
-
\??\c:\nnbtht.exec:\nnbtht.exe201⤵
-
\??\c:\1vppp.exec:\1vppp.exe202⤵
-
\??\c:\lrrlxxf.exec:\lrrlxxf.exe203⤵
-
\??\c:\xflrlrl.exec:\xflrlrl.exe204⤵
-
\??\c:\1htbnt.exec:\1htbnt.exe205⤵
-
\??\c:\vjdpv.exec:\vjdpv.exe206⤵
-
\??\c:\pjvdp.exec:\pjvdp.exe207⤵
-
\??\c:\llfflrf.exec:\llfflrf.exe208⤵
-
\??\c:\xllxrrr.exec:\xllxrrr.exe209⤵
-
\??\c:\btthnb.exec:\btthnb.exe210⤵
-
\??\c:\jdvpv.exec:\jdvpv.exe211⤵
-
\??\c:\ddjpj.exec:\ddjpj.exe212⤵
-
\??\c:\xrxxxrx.exec:\xrxxxrx.exe213⤵
-
\??\c:\fxlfrlf.exec:\fxlfrlf.exe214⤵
-
\??\c:\nnthth.exec:\nnthth.exe215⤵
-
\??\c:\5hbbnb.exec:\5hbbnb.exe216⤵
-
\??\c:\vvvdp.exec:\vvvdp.exe217⤵
-
\??\c:\dvppp.exec:\dvppp.exe218⤵
-
\??\c:\llflrxf.exec:\llflrxf.exe219⤵
-
\??\c:\rfrxlrr.exec:\rfrxlrr.exe220⤵
-
\??\c:\btntbb.exec:\btntbb.exe221⤵
-
\??\c:\3vvjd.exec:\3vvjd.exe222⤵
-
\??\c:\ddvpv.exec:\ddvpv.exe223⤵
-
\??\c:\lfxrxlx.exec:\lfxrxlx.exe224⤵
-
\??\c:\lrflrrl.exec:\lrflrrl.exe225⤵
-
\??\c:\bbtthn.exec:\bbtthn.exe226⤵
-
\??\c:\pdppj.exec:\pdppj.exe227⤵
-
\??\c:\pjjdj.exec:\pjjdj.exe228⤵
-
\??\c:\rxrfxlx.exec:\rxrfxlx.exe229⤵
-
\??\c:\rrffrxr.exec:\rrffrxr.exe230⤵
-
\??\c:\ttbnbn.exec:\ttbnbn.exe231⤵
-
\??\c:\ppjpj.exec:\ppjpj.exe232⤵
-
\??\c:\jvppv.exec:\jvppv.exe233⤵
-
\??\c:\fxfllxf.exec:\fxfllxf.exe234⤵
-
\??\c:\lllxflx.exec:\lllxflx.exe235⤵
-
\??\c:\9hnnnn.exec:\9hnnnn.exe236⤵
-
\??\c:\jvvdj.exec:\jvvdj.exe237⤵
-
\??\c:\djvvp.exec:\djvvp.exe238⤵
-
\??\c:\rffxlrl.exec:\rffxlrl.exe239⤵
-
\??\c:\1xrrrlx.exec:\1xrrrlx.exe240⤵
-
\??\c:\htnntn.exec:\htnntn.exe241⤵