Overview
overview
10Static
static
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
03-09-2024 14:02
240903-rb57sazdqf 1003-09-2024 13:51
240903-q59avszclf 1002-09-2024 19:51
240902-yk8gtsxbpd 1002-09-2024 02:27
240902-cxh7tazflg 1002-09-2024 02:26
240902-cwxc2sygll 1021-06-2024 19:37
240621-yca7cszgnd 1009-06-2024 17:07
240609-vm7rjadd73 1013-05-2024 17:36
240513-v6qblafe3y 1012-05-2024 17:17
240512-vty3zafh5s 10Analysis
-
max time kernel
1800s -
max time network
1173s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 18:05
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
RAT/31.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
RAT/XClient.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
RAT/file.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
Ransomware/default.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral12
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Stealers/lumma.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240426-en
General
-
Target
Stealers/BlackMoon.exe
-
Size
387KB
-
MD5
336efa7460c08e3d47f29121742eb010
-
SHA1
f41c36cd83879d170309dede056563d35741b87b
-
SHA256
e6dd3fa33ad938b07c8978691f86b73e9f6fd84104b92f42566498bdb6b2930e
-
SHA512
e8d118fbe907a00d89c2514af4de475a0ea54943076bf90174234f77f2ec093a1246a0d4e78d1104a0dcda150b5441d28f4f3d1e768ecb20ae86383a99863c14
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Goo
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral10/memory/4036-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/4336-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/1580-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/4560-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/3040-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/4036-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/2028-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/1036-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/1576-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/5112-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/1332-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/3524-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/436-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/4484-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/4716-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/3180-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/3212-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/2384-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/1848-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/3244-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/3720-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/2120-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/1156-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral10/memory/2432-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vppvp.exelrlfxfx.exettttbt.exehtnnhn.exevjppj.exepvddd.exeppdvj.exelfllfff.exebnhhbb.exefrrlfff.exeflxrxlx.exejvdvv.exexrlffff.exennnhnh.exenbtttn.exepdpjd.exettttnn.exe3hnhbh.exevvvpp.exexxffxfx.exepvddv.exeddppp.exeflrlfxx.exennhhbb.exerfrrrff.exehthhhh.exerlrllll.exevpvpp.exexrlfxrr.exe9thhbb.exejjdvv.exe5xlflrl.exedddjp.exe1jdpj.exe1llfrrr.exetnnbtn.exeddjdd.exexlxfrxl.exe1hnhnb.exehbnhtt.exevvvdd.exexrxrxrl.exetbnnhh.exejvddp.exerlrrllf.exerllfxrl.exehhtnhh.exe3jpjd.exejddvv.exerrfxllf.exebnnhhb.exehhhthh.exepjjjd.exexlllffx.exe5hhhbh.exebhhthb.exedjjpd.exefflflfl.exe5flrrlf.exe9hnhnn.exejjjpj.exejdpjj.exe1llfxxr.exenhhhbb.exepid process 4336 vppvp.exe 3040 lrlfxfx.exe 4560 ttttbt.exe 1580 htnnhn.exe 2028 vjppj.exe 1128 pvddd.exe 1036 ppdvj.exe 1576 lfllfff.exe 1332 bnhhbb.exe 5112 frrlfff.exe 3524 flxrxlx.exe 436 jvdvv.exe 1952 xrlffff.exe 4484 nnnhnh.exe 808 nbtttn.exe 4716 pdpjd.exe 3180 ttttnn.exe 3212 3hnhbh.exe 3492 vvvpp.exe 2384 xxffxfx.exe 1848 pvddv.exe 3244 ddppp.exe 3720 flrlfxx.exe 2120 nnhhbb.exe 2612 rfrrrff.exe 3400 hthhhh.exe 1156 rlrllll.exe 4652 vpvpp.exe 2432 xrlfxrr.exe 1836 9thhbb.exe 4600 jjdvv.exe 1624 5xlflrl.exe 1904 dddjp.exe 4436 1jdpj.exe 1240 1llfrrr.exe 4036 tnnbtn.exe 2668 ddjdd.exe 2756 xlxfrxl.exe 4128 1hnhnb.exe 4868 hbnhtt.exe 2992 vvvdd.exe 2876 xrxrxrl.exe 4208 tbnnhh.exe 1328 jvddp.exe 2804 rlrrllf.exe 936 rllfxrl.exe 1044 hhtnhh.exe 1448 3jpjd.exe 1032 jddvv.exe 712 rrfxllf.exe 3336 bnnhhb.exe 2212 hhhthh.exe 540 pjjjd.exe 3860 xlllffx.exe 4484 5hhhbh.exe 1312 bhhthb.exe 4716 djjpd.exe 2568 fflflfl.exe 2916 5flrrlf.exe 4712 9hnhnn.exe 2448 jjjpj.exe 4464 jdpjj.exe 3492 1llfxxr.exe 2356 nhhhbb.exe -
Processes:
resource yara_rule behavioral10/memory/4036-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/4336-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/1580-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/4560-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/3040-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/4036-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/2028-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/1036-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/1576-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/1332-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/1332-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/1332-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/5112-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/5112-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/5112-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/1332-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/3524-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/436-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/4484-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/4716-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/3180-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/3212-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/2384-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/1848-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/3244-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/3720-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/2120-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/1156-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral10/memory/2432-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BlackMoon.exevppvp.exelrlfxfx.exettttbt.exehtnnhn.exevjppj.exepvddd.exeppdvj.exelfllfff.exebnhhbb.exefrrlfff.exeflxrxlx.exejvdvv.exexrlffff.exennnhnh.exenbtttn.exepdpjd.exettttnn.exe3hnhbh.exevvvpp.exexxffxfx.exepvddv.exedescription pid process target process PID 4036 wrote to memory of 4336 4036 BlackMoon.exe vppvp.exe PID 4036 wrote to memory of 4336 4036 BlackMoon.exe vppvp.exe PID 4036 wrote to memory of 4336 4036 BlackMoon.exe vppvp.exe PID 4336 wrote to memory of 3040 4336 vppvp.exe lrlfxfx.exe PID 4336 wrote to memory of 3040 4336 vppvp.exe lrlfxfx.exe PID 4336 wrote to memory of 3040 4336 vppvp.exe lrlfxfx.exe PID 3040 wrote to memory of 4560 3040 lrlfxfx.exe ttttbt.exe PID 3040 wrote to memory of 4560 3040 lrlfxfx.exe ttttbt.exe PID 3040 wrote to memory of 4560 3040 lrlfxfx.exe ttttbt.exe PID 4560 wrote to memory of 1580 4560 ttttbt.exe htnnhn.exe PID 4560 wrote to memory of 1580 4560 ttttbt.exe htnnhn.exe PID 4560 wrote to memory of 1580 4560 ttttbt.exe htnnhn.exe PID 1580 wrote to memory of 2028 1580 htnnhn.exe vjppj.exe PID 1580 wrote to memory of 2028 1580 htnnhn.exe vjppj.exe PID 1580 wrote to memory of 2028 1580 htnnhn.exe vjppj.exe PID 2028 wrote to memory of 1128 2028 vjppj.exe pvddd.exe PID 2028 wrote to memory of 1128 2028 vjppj.exe pvddd.exe PID 2028 wrote to memory of 1128 2028 vjppj.exe pvddd.exe PID 1128 wrote to memory of 1036 1128 pvddd.exe ppdvj.exe PID 1128 wrote to memory of 1036 1128 pvddd.exe ppdvj.exe PID 1128 wrote to memory of 1036 1128 pvddd.exe ppdvj.exe PID 1036 wrote to memory of 1576 1036 ppdvj.exe lfllfff.exe PID 1036 wrote to memory of 1576 1036 ppdvj.exe lfllfff.exe PID 1036 wrote to memory of 1576 1036 ppdvj.exe lfllfff.exe PID 1576 wrote to memory of 1332 1576 lfllfff.exe bnhhbb.exe PID 1576 wrote to memory of 1332 1576 lfllfff.exe bnhhbb.exe PID 1576 wrote to memory of 1332 1576 lfllfff.exe bnhhbb.exe PID 1332 wrote to memory of 5112 1332 bnhhbb.exe frrlfff.exe PID 1332 wrote to memory of 5112 1332 bnhhbb.exe frrlfff.exe PID 1332 wrote to memory of 5112 1332 bnhhbb.exe frrlfff.exe PID 5112 wrote to memory of 3524 5112 frrlfff.exe flxrxlx.exe PID 5112 wrote to memory of 3524 5112 frrlfff.exe flxrxlx.exe PID 5112 wrote to memory of 3524 5112 frrlfff.exe flxrxlx.exe PID 3524 wrote to memory of 436 3524 flxrxlx.exe jvdvv.exe PID 3524 wrote to memory of 436 3524 flxrxlx.exe jvdvv.exe PID 3524 wrote to memory of 436 3524 flxrxlx.exe jvdvv.exe PID 436 wrote to memory of 1952 436 jvdvv.exe xrlffff.exe PID 436 wrote to memory of 1952 436 jvdvv.exe xrlffff.exe PID 436 wrote to memory of 1952 436 jvdvv.exe xrlffff.exe PID 1952 wrote to memory of 4484 1952 xrlffff.exe nnnhnh.exe PID 1952 wrote to memory of 4484 1952 xrlffff.exe nnnhnh.exe PID 1952 wrote to memory of 4484 1952 xrlffff.exe nnnhnh.exe PID 4484 wrote to memory of 808 4484 nnnhnh.exe nbtttn.exe PID 4484 wrote to memory of 808 4484 nnnhnh.exe nbtttn.exe PID 4484 wrote to memory of 808 4484 nnnhnh.exe nbtttn.exe PID 808 wrote to memory of 4716 808 nbtttn.exe pdpjd.exe PID 808 wrote to memory of 4716 808 nbtttn.exe pdpjd.exe PID 808 wrote to memory of 4716 808 nbtttn.exe pdpjd.exe PID 4716 wrote to memory of 3180 4716 pdpjd.exe ttttnn.exe PID 4716 wrote to memory of 3180 4716 pdpjd.exe ttttnn.exe PID 4716 wrote to memory of 3180 4716 pdpjd.exe ttttnn.exe PID 3180 wrote to memory of 3212 3180 ttttnn.exe 3hnhbh.exe PID 3180 wrote to memory of 3212 3180 ttttnn.exe 3hnhbh.exe PID 3180 wrote to memory of 3212 3180 ttttnn.exe 3hnhbh.exe PID 3212 wrote to memory of 3492 3212 3hnhbh.exe vvvpp.exe PID 3212 wrote to memory of 3492 3212 3hnhbh.exe vvvpp.exe PID 3212 wrote to memory of 3492 3212 3hnhbh.exe vvvpp.exe PID 3492 wrote to memory of 2384 3492 vvvpp.exe xxffxfx.exe PID 3492 wrote to memory of 2384 3492 vvvpp.exe xxffxfx.exe PID 3492 wrote to memory of 2384 3492 vvvpp.exe xxffxfx.exe PID 2384 wrote to memory of 1848 2384 xxffxfx.exe pvddv.exe PID 2384 wrote to memory of 1848 2384 xxffxfx.exe pvddv.exe PID 2384 wrote to memory of 1848 2384 xxffxfx.exe pvddv.exe PID 1848 wrote to memory of 3244 1848 pvddv.exe ddppp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vppvp.exec:\vppvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrlfxfx.exec:\lrlfxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttttbt.exec:\ttttbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htnnhn.exec:\htnnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjppj.exec:\vjppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvddd.exec:\pvddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppdvj.exec:\ppdvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfllfff.exec:\lfllfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnhhbb.exec:\bnhhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frrlfff.exec:\frrlfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flxrxlx.exec:\flxrxlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvdvv.exec:\jvdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrlffff.exec:\xrlffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnnhnh.exec:\nnnhnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbtttn.exec:\nbtttn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdpjd.exec:\pdpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttttnn.exec:\ttttnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3hnhbh.exec:\3hnhbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvvpp.exec:\vvvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxffxfx.exec:\xxffxfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvddv.exec:\pvddv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddppp.exec:\ddppp.exe23⤵
- Executes dropped EXE
-
\??\c:\flrlfxx.exec:\flrlfxx.exe24⤵
- Executes dropped EXE
-
\??\c:\nnhhbb.exec:\nnhhbb.exe25⤵
- Executes dropped EXE
-
\??\c:\rfrrrff.exec:\rfrrrff.exe26⤵
- Executes dropped EXE
-
\??\c:\hthhhh.exec:\hthhhh.exe27⤵
- Executes dropped EXE
-
\??\c:\rlrllll.exec:\rlrllll.exe28⤵
- Executes dropped EXE
-
\??\c:\vpvpp.exec:\vpvpp.exe29⤵
- Executes dropped EXE
-
\??\c:\xrlfxrr.exec:\xrlfxrr.exe30⤵
- Executes dropped EXE
-
\??\c:\9thhbb.exec:\9thhbb.exe31⤵
- Executes dropped EXE
-
\??\c:\jjdvv.exec:\jjdvv.exe32⤵
- Executes dropped EXE
-
\??\c:\5xlflrl.exec:\5xlflrl.exe33⤵
- Executes dropped EXE
-
\??\c:\dddjp.exec:\dddjp.exe34⤵
- Executes dropped EXE
-
\??\c:\1jdpj.exec:\1jdpj.exe35⤵
- Executes dropped EXE
-
\??\c:\1llfrrr.exec:\1llfrrr.exe36⤵
- Executes dropped EXE
-
\??\c:\tnnbtn.exec:\tnnbtn.exe37⤵
- Executes dropped EXE
-
\??\c:\ddjdd.exec:\ddjdd.exe38⤵
- Executes dropped EXE
-
\??\c:\xlxfrxl.exec:\xlxfrxl.exe39⤵
- Executes dropped EXE
-
\??\c:\1hnhnb.exec:\1hnhnb.exe40⤵
- Executes dropped EXE
-
\??\c:\hbnhtt.exec:\hbnhtt.exe41⤵
- Executes dropped EXE
-
\??\c:\vvvdd.exec:\vvvdd.exe42⤵
- Executes dropped EXE
-
\??\c:\xrxrxrl.exec:\xrxrxrl.exe43⤵
- Executes dropped EXE
-
\??\c:\tbnnhh.exec:\tbnnhh.exe44⤵
- Executes dropped EXE
-
\??\c:\jvddp.exec:\jvddp.exe45⤵
- Executes dropped EXE
-
\??\c:\rlrrllf.exec:\rlrrllf.exe46⤵
- Executes dropped EXE
-
\??\c:\rllfxrl.exec:\rllfxrl.exe47⤵
- Executes dropped EXE
-
\??\c:\hhtnhh.exec:\hhtnhh.exe48⤵
- Executes dropped EXE
-
\??\c:\3jpjd.exec:\3jpjd.exe49⤵
- Executes dropped EXE
-
\??\c:\jddvv.exec:\jddvv.exe50⤵
- Executes dropped EXE
-
\??\c:\rrfxllf.exec:\rrfxllf.exe51⤵
- Executes dropped EXE
-
\??\c:\bnnhhb.exec:\bnnhhb.exe52⤵
- Executes dropped EXE
-
\??\c:\hhhthh.exec:\hhhthh.exe53⤵
- Executes dropped EXE
-
\??\c:\pjjjd.exec:\pjjjd.exe54⤵
- Executes dropped EXE
-
\??\c:\xlllffx.exec:\xlllffx.exe55⤵
- Executes dropped EXE
-
\??\c:\5hhhbh.exec:\5hhhbh.exe56⤵
- Executes dropped EXE
-
\??\c:\bhhthb.exec:\bhhthb.exe57⤵
- Executes dropped EXE
-
\??\c:\djjpd.exec:\djjpd.exe58⤵
- Executes dropped EXE
-
\??\c:\fflflfl.exec:\fflflfl.exe59⤵
- Executes dropped EXE
-
\??\c:\5flrrlf.exec:\5flrrlf.exe60⤵
- Executes dropped EXE
-
\??\c:\9hnhnn.exec:\9hnhnn.exe61⤵
- Executes dropped EXE
-
\??\c:\jjjpj.exec:\jjjpj.exe62⤵
- Executes dropped EXE
-
\??\c:\jdpjj.exec:\jdpjj.exe63⤵
- Executes dropped EXE
-
\??\c:\1llfxxr.exec:\1llfxxr.exe64⤵
- Executes dropped EXE
-
\??\c:\nhhhbb.exec:\nhhhbb.exe65⤵
- Executes dropped EXE
-
\??\c:\nnnhbb.exec:\nnnhbb.exe66⤵
-
\??\c:\jpvpj.exec:\jpvpj.exe67⤵
-
\??\c:\fxxrrrx.exec:\fxxrrrx.exe68⤵
-
\??\c:\xlrllll.exec:\xlrllll.exe69⤵
-
\??\c:\hnnnbb.exec:\hnnnbb.exe70⤵
-
\??\c:\jpvjv.exec:\jpvjv.exe71⤵
-
\??\c:\dpvvv.exec:\dpvvv.exe72⤵
-
\??\c:\xlrxlll.exec:\xlrxlll.exe73⤵
-
\??\c:\tthbhh.exec:\tthbhh.exe74⤵
-
\??\c:\nbbtnh.exec:\nbbtnh.exe75⤵
-
\??\c:\dvvpv.exec:\dvvpv.exe76⤵
-
\??\c:\rrxxllf.exec:\rrxxllf.exe77⤵
-
\??\c:\1hbbbt.exec:\1hbbbt.exe78⤵
-
\??\c:\nbhtnn.exec:\nbhtnn.exe79⤵
-
\??\c:\pjddv.exec:\pjddv.exe80⤵
-
\??\c:\lrffxxr.exec:\lrffxxr.exe81⤵
-
\??\c:\xrrlffx.exec:\xrrlffx.exe82⤵
-
\??\c:\ttnnbh.exec:\ttnnbh.exe83⤵
-
\??\c:\9pdvd.exec:\9pdvd.exe84⤵
-
\??\c:\9xxrllf.exec:\9xxrllf.exe85⤵
-
\??\c:\tnttbt.exec:\tnttbt.exe86⤵
-
\??\c:\bnnhhb.exec:\bnnhhb.exe87⤵
-
\??\c:\dddvp.exec:\dddvp.exe88⤵
-
\??\c:\xffxrxr.exec:\xffxrxr.exe89⤵
-
\??\c:\rrlrxrf.exec:\rrlrxrf.exe90⤵
-
\??\c:\9nhbtn.exec:\9nhbtn.exe91⤵
-
\??\c:\pvpjj.exec:\pvpjj.exe92⤵
-
\??\c:\dvpjd.exec:\dvpjd.exe93⤵
-
\??\c:\rrlfrlf.exec:\rrlfrlf.exe94⤵
-
\??\c:\9tnnbb.exec:\9tnnbb.exe95⤵
-
\??\c:\hhbtnn.exec:\hhbtnn.exe96⤵
-
\??\c:\vvdvd.exec:\vvdvd.exe97⤵
-
\??\c:\xffxlll.exec:\xffxlll.exe98⤵
-
\??\c:\lxlxlxl.exec:\lxlxlxl.exe99⤵
-
\??\c:\htthtb.exec:\htthtb.exe100⤵
-
\??\c:\bhnbbb.exec:\bhnbbb.exe101⤵
-
\??\c:\dpjdv.exec:\dpjdv.exe102⤵
-
\??\c:\9rlxrlx.exec:\9rlxrlx.exe103⤵
-
\??\c:\lxrllll.exec:\lxrllll.exe104⤵
-
\??\c:\5bbbtt.exec:\5bbbtt.exe105⤵
-
\??\c:\pdjdj.exec:\pdjdj.exe106⤵
-
\??\c:\pdpjd.exec:\pdpjd.exe107⤵
-
\??\c:\5lllfxx.exec:\5lllfxx.exe108⤵
-
\??\c:\9nnhbb.exec:\9nnhbb.exe109⤵
-
\??\c:\ntbbtt.exec:\ntbbtt.exe110⤵
-
\??\c:\jvppj.exec:\jvppj.exe111⤵
-
\??\c:\rlrlfff.exec:\rlrlfff.exe112⤵
-
\??\c:\lxrrfxl.exec:\lxrrfxl.exe113⤵
-
\??\c:\1ththb.exec:\1ththb.exe114⤵
-
\??\c:\vdddv.exec:\vdddv.exe115⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe116⤵
-
\??\c:\ffxrllf.exec:\ffxrllf.exe117⤵
-
\??\c:\hbbnhh.exec:\hbbnhh.exe118⤵
-
\??\c:\5nhhhh.exec:\5nhhhh.exe119⤵
-
\??\c:\vpdvp.exec:\vpdvp.exe120⤵
-
\??\c:\xflfxxr.exec:\xflfxxr.exe121⤵
-
\??\c:\flrlllf.exec:\flrlllf.exe122⤵
-
\??\c:\tnnbbt.exec:\tnnbbt.exe123⤵
-
\??\c:\bhtntt.exec:\bhtntt.exe124⤵
-
\??\c:\dppdd.exec:\dppdd.exe125⤵
-
\??\c:\llfxffl.exec:\llfxffl.exe126⤵
-
\??\c:\ppdjp.exec:\ppdjp.exe127⤵
-
\??\c:\lxxfrlf.exec:\lxxfrlf.exe128⤵
-
\??\c:\7bbnhb.exec:\7bbnhb.exe129⤵
-
\??\c:\btthnh.exec:\btthnh.exe130⤵
-
\??\c:\pdpdv.exec:\pdpdv.exe131⤵
-
\??\c:\rlrfrrx.exec:\rlrfrrx.exe132⤵
-
\??\c:\bhbnbn.exec:\bhbnbn.exe133⤵
-
\??\c:\tbbnbt.exec:\tbbnbt.exe134⤵
-
\??\c:\ddpdp.exec:\ddpdp.exe135⤵
-
\??\c:\fflffxr.exec:\fflffxr.exe136⤵
-
\??\c:\thbhbh.exec:\thbhbh.exe137⤵
-
\??\c:\hnbnbn.exec:\hnbnbn.exe138⤵
-
\??\c:\pjvjp.exec:\pjvjp.exe139⤵
-
\??\c:\xrlrfxl.exec:\xrlrfxl.exe140⤵
-
\??\c:\hhhthb.exec:\hhhthb.exe141⤵
-
\??\c:\3tnbtn.exec:\3tnbtn.exe142⤵
-
\??\c:\vddvd.exec:\vddvd.exe143⤵
-
\??\c:\ddjvd.exec:\ddjvd.exe144⤵
-
\??\c:\rllxlxr.exec:\rllxlxr.exe145⤵
-
\??\c:\ntthtn.exec:\ntthtn.exe146⤵
-
\??\c:\bntntn.exec:\bntntn.exe147⤵
-
\??\c:\vjpvv.exec:\vjpvv.exe148⤵
-
\??\c:\lrrfxrf.exec:\lrrfxrf.exe149⤵
-
\??\c:\llxrrlx.exec:\llxrrlx.exe150⤵
-
\??\c:\tnthtn.exec:\tnthtn.exe151⤵
-
\??\c:\vppdp.exec:\vppdp.exe152⤵
-
\??\c:\3pjjd.exec:\3pjjd.exe153⤵
-
\??\c:\rfrfxrf.exec:\rfrfxrf.exe154⤵
-
\??\c:\5hhthb.exec:\5hhthb.exe155⤵
-
\??\c:\hhbnht.exec:\hhbnht.exe156⤵
-
\??\c:\fxrfxrl.exec:\fxrfxrl.exe157⤵
-
\??\c:\9llfrxr.exec:\9llfrxr.exe158⤵
-
\??\c:\nnbbnh.exec:\nnbbnh.exe159⤵
-
\??\c:\djjvp.exec:\djjvp.exe160⤵
-
\??\c:\1ddvj.exec:\1ddvj.exe161⤵
-
\??\c:\5rrfxxl.exec:\5rrfxxl.exe162⤵
-
\??\c:\9bbnhb.exec:\9bbnhb.exe163⤵
-
\??\c:\vjdpd.exec:\vjdpd.exe164⤵
-
\??\c:\pjddp.exec:\pjddp.exe165⤵
-
\??\c:\lxlxlff.exec:\lxlxlff.exe166⤵
-
\??\c:\xfrrffx.exec:\xfrrffx.exe167⤵
-
\??\c:\7nntbt.exec:\7nntbt.exe168⤵
-
\??\c:\9pjpd.exec:\9pjpd.exe169⤵
-
\??\c:\xrlxrlr.exec:\xrlxrlr.exe170⤵
-
\??\c:\nnnnth.exec:\nnnnth.exe171⤵
-
\??\c:\tnnbnh.exec:\tnnbnh.exe172⤵
-
\??\c:\7jpdp.exec:\7jpdp.exe173⤵
-
\??\c:\rflfrlf.exec:\rflfrlf.exe174⤵
-
\??\c:\lflfllr.exec:\lflfllr.exe175⤵
-
\??\c:\7bhtnh.exec:\7bhtnh.exe176⤵
-
\??\c:\nntnnh.exec:\nntnnh.exe177⤵
-
\??\c:\3dvjd.exec:\3dvjd.exe178⤵
-
\??\c:\djdpj.exec:\djdpj.exe179⤵
-
\??\c:\rffxfff.exec:\rffxfff.exe180⤵
-
\??\c:\ttnhtn.exec:\ttnhtn.exe181⤵
-
\??\c:\thnnhb.exec:\thnnhb.exe182⤵
-
\??\c:\pjjvd.exec:\pjjvd.exe183⤵
-
\??\c:\vjvjv.exec:\vjvjv.exe184⤵
-
\??\c:\5xxfrlx.exec:\5xxfrlx.exe185⤵
-
\??\c:\xrxrfxx.exec:\xrxrfxx.exe186⤵
-
\??\c:\ttbnbt.exec:\ttbnbt.exe187⤵
-
\??\c:\djjvd.exec:\djjvd.exe188⤵
-
\??\c:\djpdj.exec:\djpdj.exe189⤵
-
\??\c:\xllxlfr.exec:\xllxlfr.exe190⤵
-
\??\c:\rllxrlf.exec:\rllxrlf.exe191⤵
-
\??\c:\7bbnhb.exec:\7bbnhb.exe192⤵
-
\??\c:\7vvvj.exec:\7vvvj.exe193⤵
-
\??\c:\vpdpj.exec:\vpdpj.exe194⤵
-
\??\c:\rxxrfrf.exec:\rxxrfrf.exe195⤵
-
\??\c:\rlfrlfx.exec:\rlfrlfx.exe196⤵
-
\??\c:\btnbtn.exec:\btnbtn.exe197⤵
-
\??\c:\5pjdj.exec:\5pjdj.exe198⤵
-
\??\c:\3dvjv.exec:\3dvjv.exe199⤵
-
\??\c:\llfffrx.exec:\llfffrx.exe200⤵
-
\??\c:\9hhbtn.exec:\9hhbtn.exe201⤵
-
\??\c:\9nnbth.exec:\9nnbth.exe202⤵
-
\??\c:\vjvjd.exec:\vjvjd.exe203⤵
-
\??\c:\fllfrlf.exec:\fllfrlf.exe204⤵
-
\??\c:\xxxlffx.exec:\xxxlffx.exe205⤵
-
\??\c:\tnbtht.exec:\tnbtht.exe206⤵
-
\??\c:\9vpdp.exec:\9vpdp.exe207⤵
-
\??\c:\7pjdj.exec:\7pjdj.exe208⤵
-
\??\c:\llrfxlf.exec:\llrfxlf.exe209⤵
-
\??\c:\rrllxrl.exec:\rrllxrl.exe210⤵
-
\??\c:\nbthtn.exec:\nbthtn.exe211⤵
-
\??\c:\pvddv.exec:\pvddv.exe212⤵
-
\??\c:\3vpjv.exec:\3vpjv.exe213⤵
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe214⤵
-
\??\c:\bnbbbh.exec:\bnbbbh.exe215⤵
-
\??\c:\xllfrfx.exec:\xllfrfx.exe216⤵
-
\??\c:\rlfxlfx.exec:\rlfxlfx.exe217⤵
-
\??\c:\nbhbnn.exec:\nbhbnn.exe218⤵
-
\??\c:\vpdvj.exec:\vpdvj.exe219⤵
-
\??\c:\xxrxfrx.exec:\xxrxfrx.exe220⤵
-
\??\c:\fxxllrx.exec:\fxxllrx.exe221⤵
-
\??\c:\tnnnhh.exec:\tnnnhh.exe222⤵
-
\??\c:\jjvjj.exec:\jjvjj.exe223⤵
-
\??\c:\jpjdv.exec:\jpjdv.exe224⤵
-
\??\c:\rxfrfxl.exec:\rxfrfxl.exe225⤵
-
\??\c:\nbnbth.exec:\nbnbth.exe226⤵
-
\??\c:\nbhtnh.exec:\nbhtnh.exe227⤵
-
\??\c:\dvvvp.exec:\dvvvp.exe228⤵
-
\??\c:\vpjvd.exec:\vpjvd.exe229⤵
-
\??\c:\ffxrlfr.exec:\ffxrlfr.exe230⤵
-
\??\c:\tnhtnt.exec:\tnhtnt.exe231⤵
-
\??\c:\7hbnbn.exec:\7hbnbn.exe232⤵
-
\??\c:\9pjvd.exec:\9pjvd.exe233⤵
-
\??\c:\5frfrlx.exec:\5frfrlx.exe234⤵
-
\??\c:\hbnhhb.exec:\hbnhhb.exe235⤵
-
\??\c:\ttthht.exec:\ttthht.exe236⤵
-
\??\c:\5ppdd.exec:\5ppdd.exe237⤵
-
\??\c:\7ddpj.exec:\7ddpj.exe238⤵
-
\??\c:\xflxfxl.exec:\xflxfxl.exe239⤵
-
\??\c:\1bhthb.exec:\1bhthb.exe240⤵
-
\??\c:\ththbt.exec:\ththbt.exe241⤵