Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-05-2024 18:20
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
050f45028831717259d3270306c7cfae152289af950abcf7b83548ea3e8b4c38.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
050f45028831717259d3270306c7cfae152289af950abcf7b83548ea3e8b4c38.exe
-
Size
232KB
-
MD5
50fc3d172fd66f7aaab43f8fe1f20d71
-
SHA1
bd393ab0e814c7440a58dac646dfa1384a129ac6
-
SHA256
050f45028831717259d3270306c7cfae152289af950abcf7b83548ea3e8b4c38
-
SHA512
d22210087e5017349c77f0e0921a9c2cb1ed6d50f5c85b991ee9797ea91a7a179bae0127fa7e8f2b8dd5b4252d41a971e63ef028444041d4e3718a7f3fc1b662
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LAIRUohTF/SjSrbzLAuBjfwFOmoFzMvUpGqC5n+4:n3C9BRo/AIuuFSjA8uBjwI7FjpjC5+4
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2352-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1240-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1096-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 55 IoCs
Processes:
resource yara_rule behavioral1/memory/2352-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\a0620.exe UPX behavioral1/memory/2128-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\a6464.exe UPX behavioral1/memory/1700-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\u084220.exe UPX behavioral1/memory/2152-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\4200662.exe UPX C:\0284626.exe UPX behavioral1/memory/2716-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2716-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\rxrlrlr.exe UPX behavioral1/memory/2592-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2592-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2592-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\9dvdp.exe UPX behavioral1/memory/2592-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\pjdjv.exe UPX C:\486240.exe UPX behavioral1/memory/1240-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\m4808.exe UPX behavioral1/memory/2408-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\nnbtht.exe UPX behavioral1/memory/2852-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\jjvpj.exe UPX C:\80622.exe UPX C:\82062.exe UPX behavioral1/memory/1932-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\862222.exe UPX behavioral1/memory/2656-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1916-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\m2068.exe UPX \??\c:\5ppdv.exe UPX C:\rlxrfxl.exe UPX C:\66226.exe UPX behavioral1/memory/2060-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\9djdd.exe UPX behavioral1/memory/2896-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\hnhhtb.exe UPX behavioral1/memory/1056-208-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\g4246.exe UPX behavioral1/memory/2260-217-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\pjddj.exe UPX C:\pdpvv.exe UPX behavioral1/memory/1096-235-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\hbtthh.exe UPX behavioral1/memory/2208-244-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\6484668.exe UPX C:\ddpvj.exe UPX C:\s6286.exe UPX C:\864462.exe UPX C:\1dddv.exe UPX behavioral1/memory/2340-290-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\tnbtbh.exe UPX C:\rfrxrxf.exe UPX -
Executes dropped EXE 64 IoCs
Processes:
a0620.exea6464.exeu084220.exe4200662.exe0284626.exerxrlrlr.exe9dvdp.exepjdjv.exe486240.exem4808.exennbtht.exejjvpj.exe80622.exe82062.exe862222.exem2068.exe5ppdv.exerlxrfxl.exe66226.exe9djdd.exehnhhtb.exeg4246.exepjddj.exepdpvv.exehbtthh.exe6484668.exeddpvj.exes6286.exe864462.exe1dddv.exetnbtbh.exerfrxrxf.exevjvdp.exepjdjv.exe860648.exe0484040.exe0806844.exevpddd.exe8648884.exe64666.exe04842.exefxlrfxl.exedpddd.exe68680.exe2022288.exeflxrfff.exe246626.exejvjpv.exe1dvpd.exes6844.exehttnhh.exe9jdjp.exe7bhbbt.exenbnnnn.exedvddd.exe00404.exe422228.exe6044062.exe64024.exeq28226.exe9lffllr.exe200000.exedvvvp.exe480022.exepid process 2128 a0620.exe 1700 a6464.exe 2152 u084220.exe 2692 4200662.exe 2716 0284626.exe 2592 rxrlrlr.exe 2596 9dvdp.exe 2464 pjdjv.exe 1240 486240.exe 2408 m4808.exe 2852 nnbtht.exe 3012 jjvpj.exe 1932 80622.exe 2656 82062.exe 1916 862222.exe 1948 m2068.exe 1752 5ppdv.exe 2060 rlxrfxl.exe 2896 66226.exe 1816 9djdd.exe 1056 hnhhtb.exe 2260 g4246.exe 616 pjddj.exe 1096 pdpvv.exe 2208 hbtthh.exe 1764 6484668.exe 1124 ddpvj.exe 844 s6286.exe 700 864462.exe 2340 1dddv.exe 2916 tnbtbh.exe 880 rfrxrxf.exe 1604 vjvdp.exe 2244 pjdjv.exe 2380 860648.exe 2524 0484040.exe 2376 0806844.exe 2724 vpddd.exe 2560 8648884.exe 2440 64666.exe 3056 04842.exe 2712 fxlrfxl.exe 2444 dpddd.exe 1632 68680.exe 1620 2022288.exe 1240 flxrfff.exe 2844 246626.exe 3004 jvjpv.exe 2996 1dvpd.exe 3020 s6844.exe 1932 httnhh.exe 1644 9jdjp.exe 1128 7bhbbt.exe 1956 nbnnnn.exe 2264 dvddd.exe 1908 00404.exe 2900 422228.exe 2892 6044062.exe 1788 64024.exe 1472 q28226.exe 840 9lffllr.exe 556 200000.exe 1136 dvvvp.exe 1140 480022.exe -
Processes:
resource yara_rule behavioral1/memory/2352-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1240-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1096-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
050f45028831717259d3270306c7cfae152289af950abcf7b83548ea3e8b4c38.exea0620.exea6464.exeu084220.exe4200662.exe0284626.exerxrlrlr.exe9dvdp.exepjdjv.exe486240.exem4808.exennbtht.exejjvpj.exe80622.exe82062.exe862222.exedescription pid process target process PID 2352 wrote to memory of 2128 2352 050f45028831717259d3270306c7cfae152289af950abcf7b83548ea3e8b4c38.exe a0620.exe PID 2352 wrote to memory of 2128 2352 050f45028831717259d3270306c7cfae152289af950abcf7b83548ea3e8b4c38.exe a0620.exe PID 2352 wrote to memory of 2128 2352 050f45028831717259d3270306c7cfae152289af950abcf7b83548ea3e8b4c38.exe a0620.exe PID 2352 wrote to memory of 2128 2352 050f45028831717259d3270306c7cfae152289af950abcf7b83548ea3e8b4c38.exe a0620.exe PID 2128 wrote to memory of 1700 2128 a0620.exe a6464.exe PID 2128 wrote to memory of 1700 2128 a0620.exe a6464.exe PID 2128 wrote to memory of 1700 2128 a0620.exe a6464.exe PID 2128 wrote to memory of 1700 2128 a0620.exe a6464.exe PID 1700 wrote to memory of 2152 1700 a6464.exe u084220.exe PID 1700 wrote to memory of 2152 1700 a6464.exe u084220.exe PID 1700 wrote to memory of 2152 1700 a6464.exe u084220.exe PID 1700 wrote to memory of 2152 1700 a6464.exe u084220.exe PID 2152 wrote to memory of 2692 2152 u084220.exe 4200662.exe PID 2152 wrote to memory of 2692 2152 u084220.exe 4200662.exe PID 2152 wrote to memory of 2692 2152 u084220.exe 4200662.exe PID 2152 wrote to memory of 2692 2152 u084220.exe 4200662.exe PID 2692 wrote to memory of 2716 2692 4200662.exe 0284626.exe PID 2692 wrote to memory of 2716 2692 4200662.exe 0284626.exe PID 2692 wrote to memory of 2716 2692 4200662.exe 0284626.exe PID 2692 wrote to memory of 2716 2692 4200662.exe 0284626.exe PID 2716 wrote to memory of 2592 2716 0284626.exe rxrlrlr.exe PID 2716 wrote to memory of 2592 2716 0284626.exe rxrlrlr.exe PID 2716 wrote to memory of 2592 2716 0284626.exe rxrlrlr.exe PID 2716 wrote to memory of 2592 2716 0284626.exe rxrlrlr.exe PID 2592 wrote to memory of 2596 2592 rxrlrlr.exe 9dvdp.exe PID 2592 wrote to memory of 2596 2592 rxrlrlr.exe 9dvdp.exe PID 2592 wrote to memory of 2596 2592 rxrlrlr.exe 9dvdp.exe PID 2592 wrote to memory of 2596 2592 rxrlrlr.exe 9dvdp.exe PID 2596 wrote to memory of 2464 2596 9dvdp.exe pjdjv.exe PID 2596 wrote to memory of 2464 2596 9dvdp.exe pjdjv.exe PID 2596 wrote to memory of 2464 2596 9dvdp.exe pjdjv.exe PID 2596 wrote to memory of 2464 2596 9dvdp.exe pjdjv.exe PID 2464 wrote to memory of 1240 2464 pjdjv.exe 486240.exe PID 2464 wrote to memory of 1240 2464 pjdjv.exe 486240.exe PID 2464 wrote to memory of 1240 2464 pjdjv.exe 486240.exe PID 2464 wrote to memory of 1240 2464 pjdjv.exe 486240.exe PID 1240 wrote to memory of 2408 1240 486240.exe m4808.exe PID 1240 wrote to memory of 2408 1240 486240.exe m4808.exe PID 1240 wrote to memory of 2408 1240 486240.exe m4808.exe PID 1240 wrote to memory of 2408 1240 486240.exe m4808.exe PID 2408 wrote to memory of 2852 2408 m4808.exe nnbtht.exe PID 2408 wrote to memory of 2852 2408 m4808.exe nnbtht.exe PID 2408 wrote to memory of 2852 2408 m4808.exe nnbtht.exe PID 2408 wrote to memory of 2852 2408 m4808.exe nnbtht.exe PID 2852 wrote to memory of 3012 2852 nnbtht.exe jjvpj.exe PID 2852 wrote to memory of 3012 2852 nnbtht.exe jjvpj.exe PID 2852 wrote to memory of 3012 2852 nnbtht.exe jjvpj.exe PID 2852 wrote to memory of 3012 2852 nnbtht.exe jjvpj.exe PID 3012 wrote to memory of 1932 3012 jjvpj.exe 80622.exe PID 3012 wrote to memory of 1932 3012 jjvpj.exe 80622.exe PID 3012 wrote to memory of 1932 3012 jjvpj.exe 80622.exe PID 3012 wrote to memory of 1932 3012 jjvpj.exe 80622.exe PID 1932 wrote to memory of 2656 1932 80622.exe 82062.exe PID 1932 wrote to memory of 2656 1932 80622.exe 82062.exe PID 1932 wrote to memory of 2656 1932 80622.exe 82062.exe PID 1932 wrote to memory of 2656 1932 80622.exe 82062.exe PID 2656 wrote to memory of 1916 2656 82062.exe 862222.exe PID 2656 wrote to memory of 1916 2656 82062.exe 862222.exe PID 2656 wrote to memory of 1916 2656 82062.exe 862222.exe PID 2656 wrote to memory of 1916 2656 82062.exe 862222.exe PID 1916 wrote to memory of 1948 1916 862222.exe m2068.exe PID 1916 wrote to memory of 1948 1916 862222.exe m2068.exe PID 1916 wrote to memory of 1948 1916 862222.exe m2068.exe PID 1916 wrote to memory of 1948 1916 862222.exe m2068.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\050f45028831717259d3270306c7cfae152289af950abcf7b83548ea3e8b4c38.exe"C:\Users\Admin\AppData\Local\Temp\050f45028831717259d3270306c7cfae152289af950abcf7b83548ea3e8b4c38.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\a0620.exec:\a0620.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\a6464.exec:\a6464.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\u084220.exec:\u084220.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\4200662.exec:\4200662.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\0284626.exec:\0284626.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxrlrlr.exec:\rxrlrlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9dvdp.exec:\9dvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjdjv.exec:\pjdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\486240.exec:\486240.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\m4808.exec:\m4808.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnbtht.exec:\nnbtht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjvpj.exec:\jjvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\80622.exec:\80622.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\82062.exec:\82062.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\862222.exec:\862222.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\m2068.exec:\m2068.exe17⤵
- Executes dropped EXE
-
\??\c:\5ppdv.exec:\5ppdv.exe18⤵
- Executes dropped EXE
-
\??\c:\rlxrfxl.exec:\rlxrfxl.exe19⤵
- Executes dropped EXE
-
\??\c:\66226.exec:\66226.exe20⤵
- Executes dropped EXE
-
\??\c:\9djdd.exec:\9djdd.exe21⤵
- Executes dropped EXE
-
\??\c:\hnhhtb.exec:\hnhhtb.exe22⤵
- Executes dropped EXE
-
\??\c:\g4246.exec:\g4246.exe23⤵
- Executes dropped EXE
-
\??\c:\pjddj.exec:\pjddj.exe24⤵
- Executes dropped EXE
-
\??\c:\pdpvv.exec:\pdpvv.exe25⤵
- Executes dropped EXE
-
\??\c:\hbtthh.exec:\hbtthh.exe26⤵
- Executes dropped EXE
-
\??\c:\6484668.exec:\6484668.exe27⤵
- Executes dropped EXE
-
\??\c:\ddpvj.exec:\ddpvj.exe28⤵
- Executes dropped EXE
-
\??\c:\s6286.exec:\s6286.exe29⤵
- Executes dropped EXE
-
\??\c:\864462.exec:\864462.exe30⤵
- Executes dropped EXE
-
\??\c:\1dddv.exec:\1dddv.exe31⤵
- Executes dropped EXE
-
\??\c:\tnbtbh.exec:\tnbtbh.exe32⤵
- Executes dropped EXE
-
\??\c:\rfrxrxf.exec:\rfrxrxf.exe33⤵
- Executes dropped EXE
-
\??\c:\vjvdp.exec:\vjvdp.exe34⤵
- Executes dropped EXE
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe35⤵
-
\??\c:\pjdjv.exec:\pjdjv.exe36⤵
- Executes dropped EXE
-
\??\c:\860648.exec:\860648.exe37⤵
- Executes dropped EXE
-
\??\c:\0484040.exec:\0484040.exe38⤵
- Executes dropped EXE
-
\??\c:\0806844.exec:\0806844.exe39⤵
- Executes dropped EXE
-
\??\c:\vpddd.exec:\vpddd.exe40⤵
- Executes dropped EXE
-
\??\c:\8648884.exec:\8648884.exe41⤵
- Executes dropped EXE
-
\??\c:\64666.exec:\64666.exe42⤵
- Executes dropped EXE
-
\??\c:\04842.exec:\04842.exe43⤵
- Executes dropped EXE
-
\??\c:\fxlrfxl.exec:\fxlrfxl.exe44⤵
- Executes dropped EXE
-
\??\c:\dpddd.exec:\dpddd.exe45⤵
- Executes dropped EXE
-
\??\c:\68680.exec:\68680.exe46⤵
- Executes dropped EXE
-
\??\c:\2022288.exec:\2022288.exe47⤵
- Executes dropped EXE
-
\??\c:\flxrfff.exec:\flxrfff.exe48⤵
- Executes dropped EXE
-
\??\c:\246626.exec:\246626.exe49⤵
- Executes dropped EXE
-
\??\c:\jvjpv.exec:\jvjpv.exe50⤵
- Executes dropped EXE
-
\??\c:\1dvpd.exec:\1dvpd.exe51⤵
- Executes dropped EXE
-
\??\c:\s6844.exec:\s6844.exe52⤵
- Executes dropped EXE
-
\??\c:\httnhh.exec:\httnhh.exe53⤵
- Executes dropped EXE
-
\??\c:\9jdjp.exec:\9jdjp.exe54⤵
- Executes dropped EXE
-
\??\c:\7bhbbt.exec:\7bhbbt.exe55⤵
- Executes dropped EXE
-
\??\c:\nbnnnn.exec:\nbnnnn.exe56⤵
- Executes dropped EXE
-
\??\c:\dvddd.exec:\dvddd.exe57⤵
- Executes dropped EXE
-
\??\c:\00404.exec:\00404.exe58⤵
- Executes dropped EXE
-
\??\c:\422228.exec:\422228.exe59⤵
- Executes dropped EXE
-
\??\c:\6044062.exec:\6044062.exe60⤵
- Executes dropped EXE
-
\??\c:\64024.exec:\64024.exe61⤵
- Executes dropped EXE
-
\??\c:\q28226.exec:\q28226.exe62⤵
- Executes dropped EXE
-
\??\c:\9lffllr.exec:\9lffllr.exe63⤵
- Executes dropped EXE
-
\??\c:\200000.exec:\200000.exe64⤵
- Executes dropped EXE
-
\??\c:\dvvvp.exec:\dvvvp.exe65⤵
- Executes dropped EXE
-
\??\c:\480022.exec:\480022.exe66⤵
- Executes dropped EXE
-
\??\c:\7tbbnt.exec:\7tbbnt.exe67⤵
-
\??\c:\6422840.exec:\6422840.exe68⤵
-
\??\c:\600640.exec:\600640.exe69⤵
-
\??\c:\o606606.exec:\o606606.exe70⤵
-
\??\c:\tnnnnn.exec:\tnnnnn.exe71⤵
-
\??\c:\bbbbnn.exec:\bbbbnn.exe72⤵
-
\??\c:\6400222.exec:\6400222.exe73⤵
-
\??\c:\0442208.exec:\0442208.exe74⤵
-
\??\c:\42006.exec:\42006.exe75⤵
-
\??\c:\xrflrlr.exec:\xrflrlr.exe76⤵
-
\??\c:\4868406.exec:\4868406.exe77⤵
-
\??\c:\pjppv.exec:\pjppv.exe78⤵
-
\??\c:\5vdvj.exec:\5vdvj.exe79⤵
-
\??\c:\2082886.exec:\2082886.exe80⤵
-
\??\c:\82406.exec:\82406.exe81⤵
-
\??\c:\8262062.exec:\8262062.exe82⤵
-
\??\c:\20840.exec:\20840.exe83⤵
-
\??\c:\e86866.exec:\e86866.exe84⤵
-
\??\c:\tbnntt.exec:\tbnntt.exe85⤵
-
\??\c:\6460046.exec:\6460046.exe86⤵
-
\??\c:\7lxrlfl.exec:\7lxrlfl.exe87⤵
-
\??\c:\m6668.exec:\m6668.exe88⤵
-
\??\c:\btbbhh.exec:\btbbhh.exe89⤵
-
\??\c:\fxrxflr.exec:\fxrxflr.exe90⤵
-
\??\c:\420684.exec:\420684.exe91⤵
-
\??\c:\2606262.exec:\2606262.exe92⤵
-
\??\c:\xrxlrxf.exec:\xrxlrxf.exe93⤵
-
\??\c:\lfxfllr.exec:\lfxfllr.exe94⤵
-
\??\c:\e04088.exec:\e04088.exe95⤵
-
\??\c:\026068.exec:\026068.exe96⤵
-
\??\c:\jvppp.exec:\jvppp.exe97⤵
-
\??\c:\9ntbbt.exec:\9ntbbt.exe98⤵
-
\??\c:\826682.exec:\826682.exe99⤵
-
\??\c:\260688.exec:\260688.exe100⤵
-
\??\c:\5xrxllr.exec:\5xrxllr.exe101⤵
-
\??\c:\c606886.exec:\c606886.exe102⤵
-
\??\c:\tnhhtt.exec:\tnhhtt.exe103⤵
-
\??\c:\0428402.exec:\0428402.exe104⤵
-
\??\c:\8206440.exec:\8206440.exe105⤵
-
\??\c:\rlxlrrx.exec:\rlxlrrx.exe106⤵
-
\??\c:\xrxlrfl.exec:\xrxlrfl.exe107⤵
-
\??\c:\3nhnnt.exec:\3nhnnt.exe108⤵
-
\??\c:\xxlrxlx.exec:\xxlrxlx.exe109⤵
-
\??\c:\hhhnhn.exec:\hhhnhn.exe110⤵
-
\??\c:\2606440.exec:\2606440.exe111⤵
-
\??\c:\g6408.exec:\g6408.exe112⤵
-
\??\c:\486244.exec:\486244.exe113⤵
-
\??\c:\5dpvj.exec:\5dpvj.exe114⤵
-
\??\c:\pjdvd.exec:\pjdvd.exe115⤵
-
\??\c:\7dvdj.exec:\7dvdj.exe116⤵
-
\??\c:\9vppp.exec:\9vppp.exe117⤵
-
\??\c:\bthbbb.exec:\bthbbb.exe118⤵
-
\??\c:\824640.exec:\824640.exe119⤵
-
\??\c:\486840.exec:\486840.exe120⤵
-
\??\c:\lxllxrf.exec:\lxllxrf.exe121⤵
-
\??\c:\a6800.exec:\a6800.exe122⤵
-
\??\c:\tnhhbb.exec:\tnhhbb.exe123⤵
-
\??\c:\ffrrflr.exec:\ffrrflr.exe124⤵
-
\??\c:\8260202.exec:\8260202.exe125⤵
-
\??\c:\684882.exec:\684882.exe126⤵
-
\??\c:\424066.exec:\424066.exe127⤵
-
\??\c:\pjddd.exec:\pjddd.exe128⤵
-
\??\c:\g4846.exec:\g4846.exe129⤵
-
\??\c:\5frxxxf.exec:\5frxxxf.exe130⤵
-
\??\c:\260688.exec:\260688.exe131⤵
-
\??\c:\6484664.exec:\6484664.exe132⤵
-
\??\c:\o684600.exec:\o684600.exe133⤵
-
\??\c:\86840.exec:\86840.exe134⤵
-
\??\c:\dpdjj.exec:\dpdjj.exe135⤵
-
\??\c:\rrflrxf.exec:\rrflrxf.exe136⤵
-
\??\c:\s6840.exec:\s6840.exe137⤵
-
\??\c:\bnhhnn.exec:\bnhhnn.exe138⤵
-
\??\c:\tnbbnt.exec:\tnbbnt.exe139⤵
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe140⤵
-
\??\c:\nbhhhh.exec:\nbhhhh.exe141⤵
-
\??\c:\c422284.exec:\c422284.exe142⤵
-
\??\c:\lfrxfxx.exec:\lfrxfxx.exe143⤵
-
\??\c:\04804.exec:\04804.exe144⤵
-
\??\c:\u284280.exec:\u284280.exe145⤵
-
\??\c:\6466820.exec:\6466820.exe146⤵
-
\??\c:\g2068.exec:\g2068.exe147⤵
-
\??\c:\4868444.exec:\4868444.exe148⤵
-
\??\c:\hhtbnh.exec:\hhtbnh.exe149⤵
-
\??\c:\2606842.exec:\2606842.exe150⤵
-
\??\c:\k80626.exec:\k80626.exe151⤵
-
\??\c:\rrfrffr.exec:\rrfrffr.exe152⤵
-
\??\c:\4240662.exec:\4240662.exe153⤵
-
\??\c:\djvjd.exec:\djvjd.exe154⤵
-
\??\c:\2088662.exec:\2088662.exe155⤵
-
\??\c:\6800662.exec:\6800662.exe156⤵
-
\??\c:\nbhntb.exec:\nbhntb.exe157⤵
-
\??\c:\jjjpj.exec:\jjjpj.exe158⤵
-
\??\c:\btbbbh.exec:\btbbbh.exe159⤵
-
\??\c:\7lrlrrf.exec:\7lrlrrf.exe160⤵
-
\??\c:\hbtttt.exec:\hbtttt.exe161⤵
-
\??\c:\5rrlxxx.exec:\5rrlxxx.exe162⤵
-
\??\c:\2042068.exec:\2042068.exe163⤵
-
\??\c:\a2462.exec:\a2462.exe164⤵
-
\??\c:\862806.exec:\862806.exe165⤵
-
\??\c:\dpddj.exec:\dpddj.exe166⤵
-
\??\c:\7vdjj.exec:\7vdjj.exe167⤵
-
\??\c:\u640668.exec:\u640668.exe168⤵
-
\??\c:\hhnthh.exec:\hhnthh.exe169⤵
-
\??\c:\6080006.exec:\6080006.exe170⤵
-
\??\c:\s4208.exec:\s4208.exe171⤵
-
\??\c:\64846.exec:\64846.exe172⤵
-
\??\c:\jjdpv.exec:\jjdpv.exe173⤵
-
\??\c:\6466222.exec:\6466222.exe174⤵
-
\??\c:\4262006.exec:\4262006.exe175⤵
-
\??\c:\nhbhbb.exec:\nhbhbb.exe176⤵
-
\??\c:\604422.exec:\604422.exe177⤵
-
\??\c:\882660.exec:\882660.exe178⤵
-
\??\c:\lfxlxlr.exec:\lfxlxlr.exe179⤵
-
\??\c:\jdpvv.exec:\jdpvv.exe180⤵
-
\??\c:\q80628.exec:\q80628.exe181⤵
-
\??\c:\3tnhhh.exec:\3tnhhh.exe182⤵
-
\??\c:\pjpvd.exec:\pjpvd.exe183⤵
-
\??\c:\048462.exec:\048462.exe184⤵
-
\??\c:\nhbnbh.exec:\nhbnbh.exe185⤵
-
\??\c:\xlrxffx.exec:\xlrxffx.exe186⤵
-
\??\c:\2244686.exec:\2244686.exe187⤵
-
\??\c:\lflrxfr.exec:\lflrxfr.exe188⤵
-
\??\c:\i480406.exec:\i480406.exe189⤵
-
\??\c:\3xlfflr.exec:\3xlfflr.exe190⤵
-
\??\c:\e48626.exec:\e48626.exe191⤵
-
\??\c:\vpdpd.exec:\vpdpd.exe192⤵
-
\??\c:\8404002.exec:\8404002.exe193⤵
-
\??\c:\vpjpv.exec:\vpjpv.exe194⤵
-
\??\c:\046284.exec:\046284.exe195⤵
-
\??\c:\20220.exec:\20220.exe196⤵
-
\??\c:\9vjpv.exec:\9vjpv.exe197⤵
-
\??\c:\5hhbnn.exec:\5hhbnn.exe198⤵
-
\??\c:\5xrlflr.exec:\5xrlflr.exe199⤵
-
\??\c:\i866284.exec:\i866284.exe200⤵
-
\??\c:\llrxrlx.exec:\llrxrlx.exe201⤵
-
\??\c:\bbntbh.exec:\bbntbh.exe202⤵
-
\??\c:\086066.exec:\086066.exe203⤵
-
\??\c:\tnhhnn.exec:\tnhhnn.exe204⤵
-
\??\c:\48268.exec:\48268.exe205⤵
-
\??\c:\lxfflrx.exec:\lxfflrx.exe206⤵
-
\??\c:\k64026.exec:\k64026.exe207⤵
-
\??\c:\0484664.exec:\0484664.exe208⤵
-
\??\c:\424066.exec:\424066.exe209⤵
-
\??\c:\202800.exec:\202800.exe210⤵
-
\??\c:\86408.exec:\86408.exe211⤵
-
\??\c:\lfxlrrf.exec:\lfxlrrf.exe212⤵
-
\??\c:\3jjpv.exec:\3jjpv.exe213⤵
-
\??\c:\c266444.exec:\c266444.exe214⤵
-
\??\c:\nhtntt.exec:\nhtntt.exe215⤵
-
\??\c:\lxlrrxl.exec:\lxlrrxl.exe216⤵
-
\??\c:\608028.exec:\608028.exe217⤵
-
\??\c:\nnhntn.exec:\nnhntn.exe218⤵
-
\??\c:\64688.exec:\64688.exe219⤵
-
\??\c:\rlffllx.exec:\rlffllx.exe220⤵
-
\??\c:\448080.exec:\448080.exe221⤵
-
\??\c:\i404668.exec:\i404668.exe222⤵
-
\??\c:\dvjpv.exec:\dvjpv.exe223⤵
-
\??\c:\428800.exec:\428800.exe224⤵
-
\??\c:\0800628.exec:\0800628.exe225⤵
-
\??\c:\jvpvj.exec:\jvpvj.exe226⤵
-
\??\c:\9tnthn.exec:\9tnthn.exe227⤵
-
\??\c:\462266.exec:\462266.exe228⤵
-
\??\c:\nhthtt.exec:\nhthtt.exe229⤵
-
\??\c:\428408.exec:\428408.exe230⤵
-
\??\c:\66624.exec:\66624.exe231⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe232⤵
-
\??\c:\vpdjd.exec:\vpdjd.exe233⤵
-
\??\c:\206288.exec:\206288.exe234⤵
-
\??\c:\82688.exec:\82688.exe235⤵
-
\??\c:\pdjpp.exec:\pdjpp.exe236⤵
-
\??\c:\dpvdj.exec:\dpvdj.exe237⤵
-
\??\c:\xlrlffl.exec:\xlrlffl.exe238⤵
-
\??\c:\g6008.exec:\g6008.exe239⤵
-
\??\c:\u622222.exec:\u622222.exe240⤵
-
\??\c:\bnbbhh.exec:\bnbbhh.exe241⤵