Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 21:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427.exe
-
Size
72KB
-
MD5
0ceabfd083f145e8ec4effcef1a8ca80
-
SHA1
328ddcfea411bb426508e8c3da2a44f50d1c6c15
-
SHA256
3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427
-
SHA512
ef44dede8d7bd46fb9519c8556a5bdc4d0b2d5a2e16fb18284a4194c1ac9e4adb1bcf2b925e870564657d4c87aaf2a3fd28bf0cf281bade2c82027212c09930b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJSsD+cGUFzJ3:ymb3NkkiQ3mdBjFIwsDhbNF
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/1724-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-13-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5pvpj.exevdjjd.exexxllrlf.exehbhhhh.exenhnhhb.exejdjjv.exexrrlfxx.exe3nntnn.exehtnhhn.exexrxrrrl.exerlxrllf.exenhbbtt.exepdjdj.exedpjjj.exe9rlllll.exenhbnhn.exepdvpj.exelllfxxr.exetthbhn.exe9ttnhn.exexrrxrfx.exenbnhbh.exepvppd.exejvjjd.exerfrlffx.exetnttbb.exennthtt.exejjvjv.exe7jpjv.exe9rlfxrr.exe7nnhbb.exettbthh.exe7ddjv.exe7lfxrfx.exebnnbbb.exehtnhtn.exedjjjd.exelrrlxxl.exebthbtn.exevddvj.exe3jjjv.exepjpjd.exebhnbth.exe7pjvp.exedpjvd.exefxfflfl.exenhhbtn.exe3tnbtn.exejvdvp.exevpvpd.exe3rrxllf.exexrlfxxr.exenntnnn.exejdvpj.exepvvvp.exevjjdp.exerrrxllr.exentbhbb.exebbnhnh.exe1vppd.exejddvp.exefxlfrrl.exerxxxfxr.exebbttnh.exepid process 4244 5pvpj.exe 1548 vdjjd.exe 4468 xxllrlf.exe 636 hbhhhh.exe 512 nhnhhb.exe 868 jdjjv.exe 3000 xrrlfxx.exe 3608 3nntnn.exe 2488 htnhhn.exe 1768 xrxrrrl.exe 2116 rlxrllf.exe 2496 nhbbtt.exe 1816 pdjdj.exe 5112 dpjjj.exe 4556 9rlllll.exe 4940 nhbnhn.exe 2432 pdvpj.exe 3864 lllfxxr.exe 2380 tthbhn.exe 4624 9ttnhn.exe 4660 xrrxrfx.exe 628 nbnhbh.exe 4628 pvppd.exe 4104 jvjjd.exe 1920 rfrlffx.exe 980 tnttbb.exe 3972 nnthtt.exe 4456 jjvjv.exe 4088 7jpjv.exe 4788 9rlfxrr.exe 3948 7nnhbb.exe 3816 ttbthh.exe 4452 7ddjv.exe 1876 7lfxrfx.exe 4044 bnnbbb.exe 884 htnhtn.exe 1344 djjjd.exe 1552 lrrlxxl.exe 3516 bthbtn.exe 1656 vddvj.exe 4280 3jjjv.exe 1724 pjpjd.exe 1548 bhnbth.exe 4976 7pjvp.exe 2940 dpjvd.exe 396 fxfflfl.exe 2476 nhhbtn.exe 920 3tnbtn.exe 4292 jvdvp.exe 2132 vpvpd.exe 1720 3rrxllf.exe 2512 xrlfxxr.exe 64 nntnnn.exe 1532 jdvpj.exe 2496 pvvvp.exe 3812 vjjdp.exe 2716 rrrxllr.exe 800 ntbhbb.exe 1252 bbnhnh.exe 4476 1vppd.exe 1320 jddvp.exe 4220 fxlfrrl.exe 2100 rxxxfxr.exe 4172 bbttnh.exe -
Processes:
resource yara_rule behavioral2/memory/1724-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3864-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427.exe5pvpj.exevdjjd.exexxllrlf.exehbhhhh.exenhnhhb.exejdjjv.exexrrlfxx.exe3nntnn.exehtnhhn.exexrxrrrl.exerlxrllf.exenhbbtt.exepdjdj.exedpjjj.exe9rlllll.exenhbnhn.exepdvpj.exelllfxxr.exetthbhn.exe9ttnhn.exexrrxrfx.exedescription pid process target process PID 1724 wrote to memory of 4244 1724 3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427.exe 5pvpj.exe PID 1724 wrote to memory of 4244 1724 3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427.exe 5pvpj.exe PID 1724 wrote to memory of 4244 1724 3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427.exe 5pvpj.exe PID 4244 wrote to memory of 1548 4244 5pvpj.exe vdjjd.exe PID 4244 wrote to memory of 1548 4244 5pvpj.exe vdjjd.exe PID 4244 wrote to memory of 1548 4244 5pvpj.exe vdjjd.exe PID 1548 wrote to memory of 4468 1548 vdjjd.exe xxllrlf.exe PID 1548 wrote to memory of 4468 1548 vdjjd.exe xxllrlf.exe PID 1548 wrote to memory of 4468 1548 vdjjd.exe xxllrlf.exe PID 4468 wrote to memory of 636 4468 xxllrlf.exe hbhhhh.exe PID 4468 wrote to memory of 636 4468 xxllrlf.exe hbhhhh.exe PID 4468 wrote to memory of 636 4468 xxllrlf.exe hbhhhh.exe PID 636 wrote to memory of 512 636 hbhhhh.exe nhnhhb.exe PID 636 wrote to memory of 512 636 hbhhhh.exe nhnhhb.exe PID 636 wrote to memory of 512 636 hbhhhh.exe nhnhhb.exe PID 512 wrote to memory of 868 512 nhnhhb.exe jdjjv.exe PID 512 wrote to memory of 868 512 nhnhhb.exe jdjjv.exe PID 512 wrote to memory of 868 512 nhnhhb.exe jdjjv.exe PID 868 wrote to memory of 3000 868 jdjjv.exe xrrlfxx.exe PID 868 wrote to memory of 3000 868 jdjjv.exe xrrlfxx.exe PID 868 wrote to memory of 3000 868 jdjjv.exe xrrlfxx.exe PID 3000 wrote to memory of 3608 3000 xrrlfxx.exe 3nntnn.exe PID 3000 wrote to memory of 3608 3000 xrrlfxx.exe 3nntnn.exe PID 3000 wrote to memory of 3608 3000 xrrlfxx.exe 3nntnn.exe PID 3608 wrote to memory of 2488 3608 3nntnn.exe htnhhn.exe PID 3608 wrote to memory of 2488 3608 3nntnn.exe htnhhn.exe PID 3608 wrote to memory of 2488 3608 3nntnn.exe htnhhn.exe PID 2488 wrote to memory of 1768 2488 htnhhn.exe xrxrrrl.exe PID 2488 wrote to memory of 1768 2488 htnhhn.exe xrxrrrl.exe PID 2488 wrote to memory of 1768 2488 htnhhn.exe xrxrrrl.exe PID 1768 wrote to memory of 2116 1768 xrxrrrl.exe rlxrllf.exe PID 1768 wrote to memory of 2116 1768 xrxrrrl.exe rlxrllf.exe PID 1768 wrote to memory of 2116 1768 xrxrrrl.exe rlxrllf.exe PID 2116 wrote to memory of 2496 2116 rlxrllf.exe nhbbtt.exe PID 2116 wrote to memory of 2496 2116 rlxrllf.exe nhbbtt.exe PID 2116 wrote to memory of 2496 2116 rlxrllf.exe nhbbtt.exe PID 2496 wrote to memory of 1816 2496 nhbbtt.exe pdjdj.exe PID 2496 wrote to memory of 1816 2496 nhbbtt.exe pdjdj.exe PID 2496 wrote to memory of 1816 2496 nhbbtt.exe pdjdj.exe PID 1816 wrote to memory of 5112 1816 pdjdj.exe dpjjj.exe PID 1816 wrote to memory of 5112 1816 pdjdj.exe dpjjj.exe PID 1816 wrote to memory of 5112 1816 pdjdj.exe dpjjj.exe PID 5112 wrote to memory of 4556 5112 dpjjj.exe 9rlllll.exe PID 5112 wrote to memory of 4556 5112 dpjjj.exe 9rlllll.exe PID 5112 wrote to memory of 4556 5112 dpjjj.exe 9rlllll.exe PID 4556 wrote to memory of 4940 4556 9rlllll.exe nhbnhn.exe PID 4556 wrote to memory of 4940 4556 9rlllll.exe nhbnhn.exe PID 4556 wrote to memory of 4940 4556 9rlllll.exe nhbnhn.exe PID 4940 wrote to memory of 2432 4940 nhbnhn.exe pdvpj.exe PID 4940 wrote to memory of 2432 4940 nhbnhn.exe pdvpj.exe PID 4940 wrote to memory of 2432 4940 nhbnhn.exe pdvpj.exe PID 2432 wrote to memory of 3864 2432 pdvpj.exe lllfxxr.exe PID 2432 wrote to memory of 3864 2432 pdvpj.exe lllfxxr.exe PID 2432 wrote to memory of 3864 2432 pdvpj.exe lllfxxr.exe PID 3864 wrote to memory of 2380 3864 lllfxxr.exe tthbhn.exe PID 3864 wrote to memory of 2380 3864 lllfxxr.exe tthbhn.exe PID 3864 wrote to memory of 2380 3864 lllfxxr.exe tthbhn.exe PID 2380 wrote to memory of 4624 2380 tthbhn.exe 9ttnhn.exe PID 2380 wrote to memory of 4624 2380 tthbhn.exe 9ttnhn.exe PID 2380 wrote to memory of 4624 2380 tthbhn.exe 9ttnhn.exe PID 4624 wrote to memory of 4660 4624 9ttnhn.exe xrrxrfx.exe PID 4624 wrote to memory of 4660 4624 9ttnhn.exe xrrxrfx.exe PID 4624 wrote to memory of 4660 4624 9ttnhn.exe xrrxrfx.exe PID 4660 wrote to memory of 628 4660 xrrxrfx.exe nbnhbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427.exe"C:\Users\Admin\AppData\Local\Temp\3f8793cc4d9c90b236b10c79209638a99a997fc243ec8e5f4d9825d721339427.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\5pvpj.exec:\5pvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdjjd.exec:\vdjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxllrlf.exec:\xxllrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhhhh.exec:\hbhhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhnhhb.exec:\nhnhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjjv.exec:\jdjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3nntnn.exec:\3nntnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htnhhn.exec:\htnhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxrllf.exec:\rlxrllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbbtt.exec:\nhbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdjdj.exec:\pdjdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpjjj.exec:\dpjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9rlllll.exec:\9rlllll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbnhn.exec:\nhbnhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdvpj.exec:\pdvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lllfxxr.exec:\lllfxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tthbhn.exec:\tthbhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9ttnhn.exec:\9ttnhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrrxrfx.exec:\xrrxrfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbnhbh.exec:\nbnhbh.exe23⤵
- Executes dropped EXE
-
\??\c:\pvppd.exec:\pvppd.exe24⤵
- Executes dropped EXE
-
\??\c:\jvjjd.exec:\jvjjd.exe25⤵
- Executes dropped EXE
-
\??\c:\rfrlffx.exec:\rfrlffx.exe26⤵
- Executes dropped EXE
-
\??\c:\tnttbb.exec:\tnttbb.exe27⤵
- Executes dropped EXE
-
\??\c:\nnthtt.exec:\nnthtt.exe28⤵
- Executes dropped EXE
-
\??\c:\jjvjv.exec:\jjvjv.exe29⤵
- Executes dropped EXE
-
\??\c:\7jpjv.exec:\7jpjv.exe30⤵
- Executes dropped EXE
-
\??\c:\9rlfxrr.exec:\9rlfxrr.exe31⤵
- Executes dropped EXE
-
\??\c:\7nnhbb.exec:\7nnhbb.exe32⤵
- Executes dropped EXE
-
\??\c:\ttbthh.exec:\ttbthh.exe33⤵
- Executes dropped EXE
-
\??\c:\7ddjv.exec:\7ddjv.exe34⤵
- Executes dropped EXE
-
\??\c:\7lfxrfx.exec:\7lfxrfx.exe35⤵
- Executes dropped EXE
-
\??\c:\bnnbbb.exec:\bnnbbb.exe36⤵
- Executes dropped EXE
-
\??\c:\htnhtn.exec:\htnhtn.exe37⤵
- Executes dropped EXE
-
\??\c:\djjjd.exec:\djjjd.exe38⤵
- Executes dropped EXE
-
\??\c:\lrrlxxl.exec:\lrrlxxl.exe39⤵
- Executes dropped EXE
-
\??\c:\bthbtn.exec:\bthbtn.exe40⤵
- Executes dropped EXE
-
\??\c:\vddvj.exec:\vddvj.exe41⤵
- Executes dropped EXE
-
\??\c:\3jjjv.exec:\3jjjv.exe42⤵
- Executes dropped EXE
-
\??\c:\pjpjd.exec:\pjpjd.exe43⤵
- Executes dropped EXE
-
\??\c:\bhnbth.exec:\bhnbth.exe44⤵
- Executes dropped EXE
-
\??\c:\7pjvp.exec:\7pjvp.exe45⤵
- Executes dropped EXE
-
\??\c:\dpjvd.exec:\dpjvd.exe46⤵
- Executes dropped EXE
-
\??\c:\fxfflfl.exec:\fxfflfl.exe47⤵
- Executes dropped EXE
-
\??\c:\nhhbtn.exec:\nhhbtn.exe48⤵
- Executes dropped EXE
-
\??\c:\3tnbtn.exec:\3tnbtn.exe49⤵
- Executes dropped EXE
-
\??\c:\jvdvp.exec:\jvdvp.exe50⤵
- Executes dropped EXE
-
\??\c:\vpvpd.exec:\vpvpd.exe51⤵
- Executes dropped EXE
-
\??\c:\3rrxllf.exec:\3rrxllf.exe52⤵
- Executes dropped EXE
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe53⤵
- Executes dropped EXE
-
\??\c:\nntnnn.exec:\nntnnn.exe54⤵
- Executes dropped EXE
-
\??\c:\jdvpj.exec:\jdvpj.exe55⤵
- Executes dropped EXE
-
\??\c:\pvvvp.exec:\pvvvp.exe56⤵
- Executes dropped EXE
-
\??\c:\vjjdp.exec:\vjjdp.exe57⤵
- Executes dropped EXE
-
\??\c:\rrrxllr.exec:\rrrxllr.exe58⤵
- Executes dropped EXE
-
\??\c:\ntbhbb.exec:\ntbhbb.exe59⤵
- Executes dropped EXE
-
\??\c:\bbnhnh.exec:\bbnhnh.exe60⤵
- Executes dropped EXE
-
\??\c:\1vppd.exec:\1vppd.exe61⤵
- Executes dropped EXE
-
\??\c:\jddvp.exec:\jddvp.exe62⤵
- Executes dropped EXE
-
\??\c:\fxlfrrl.exec:\fxlfrrl.exe63⤵
- Executes dropped EXE
-
\??\c:\rxxxfxr.exec:\rxxxfxr.exe64⤵
- Executes dropped EXE
-
\??\c:\bbttnh.exec:\bbttnh.exe65⤵
- Executes dropped EXE
-
\??\c:\nhtnbh.exec:\nhtnbh.exe66⤵
-
\??\c:\pdvpd.exec:\pdvpd.exe67⤵
-
\??\c:\jpvpj.exec:\jpvpj.exe68⤵
-
\??\c:\ffllxll.exec:\ffllxll.exe69⤵
-
\??\c:\flrlxxr.exec:\flrlxxr.exe70⤵
-
\??\c:\nttnhh.exec:\nttnhh.exe71⤵
-
\??\c:\nhnntn.exec:\nhnntn.exe72⤵
-
\??\c:\dddjj.exec:\dddjj.exe73⤵
-
\??\c:\pjjvd.exec:\pjjvd.exe74⤵
-
\??\c:\9rfxfxr.exec:\9rfxfxr.exe75⤵
-
\??\c:\7xxrrfx.exec:\7xxrrfx.exe76⤵
-
\??\c:\hnnbhn.exec:\hnnbhn.exe77⤵
-
\??\c:\hnbbnt.exec:\hnbbnt.exe78⤵
-
\??\c:\3dppv.exec:\3dppv.exe79⤵
-
\??\c:\jdpjv.exec:\jdpjv.exe80⤵
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe81⤵
-
\??\c:\xfflllr.exec:\xfflllr.exe82⤵
-
\??\c:\nnnhtt.exec:\nnnhtt.exe83⤵
-
\??\c:\jpvpd.exec:\jpvpd.exe84⤵
-
\??\c:\rllfrxf.exec:\rllfrxf.exe85⤵
-
\??\c:\lxlfffx.exec:\lxlfffx.exe86⤵
-
\??\c:\jvdvv.exec:\jvdvv.exe87⤵
-
\??\c:\rxxrffx.exec:\rxxrffx.exe88⤵
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe89⤵
-
\??\c:\tbbbtn.exec:\tbbbtn.exe90⤵
-
\??\c:\pjpjd.exec:\pjpjd.exe91⤵
-
\??\c:\djppj.exec:\djppj.exe92⤵
-
\??\c:\5lffxff.exec:\5lffxff.exe93⤵
-
\??\c:\hbhttn.exec:\hbhttn.exe94⤵
-
\??\c:\jppjv.exec:\jppjv.exe95⤵
-
\??\c:\pjdpj.exec:\pjdpj.exe96⤵
-
\??\c:\9llxrrl.exec:\9llxrrl.exe97⤵
-
\??\c:\xlrrlfx.exec:\xlrrlfx.exe98⤵
-
\??\c:\1hhhbb.exec:\1hhhbb.exe99⤵
-
\??\c:\jddjd.exec:\jddjd.exe100⤵
-
\??\c:\flxrffr.exec:\flxrffr.exe101⤵
-
\??\c:\xrrllfx.exec:\xrrllfx.exe102⤵
-
\??\c:\hhthnh.exec:\hhthnh.exe103⤵
-
\??\c:\dpjjd.exec:\dpjjd.exe104⤵
-
\??\c:\3djjv.exec:\3djjv.exe105⤵
-
\??\c:\rlrllrx.exec:\rlrllrx.exe106⤵
-
\??\c:\lfxlfxf.exec:\lfxlfxf.exe107⤵
-
\??\c:\nttbtt.exec:\nttbtt.exe108⤵
-
\??\c:\hnhhtb.exec:\hnhhtb.exe109⤵
-
\??\c:\pvppj.exec:\pvppj.exe110⤵
-
\??\c:\rxxrxxf.exec:\rxxrxxf.exe111⤵
-
\??\c:\fxrlffx.exec:\fxrlffx.exe112⤵
-
\??\c:\nbnnhh.exec:\nbnnhh.exe113⤵
-
\??\c:\bbntbb.exec:\bbntbb.exe114⤵
-
\??\c:\vjpjj.exec:\vjpjj.exe115⤵
-
\??\c:\3vdpj.exec:\3vdpj.exe116⤵
-
\??\c:\9lllfxf.exec:\9lllfxf.exe117⤵
-
\??\c:\lxlfxrf.exec:\lxlfxrf.exe118⤵
-
\??\c:\7tbbtt.exec:\7tbbtt.exe119⤵
-
\??\c:\ntbnbt.exec:\ntbnbt.exe120⤵
-
\??\c:\pdpvv.exec:\pdpvv.exe121⤵
-
\??\c:\vjdvp.exec:\vjdvp.exe122⤵
-
\??\c:\xrxrlff.exec:\xrxrlff.exe123⤵
-
\??\c:\tnbtbb.exec:\tnbtbb.exe124⤵
-
\??\c:\5nhttn.exec:\5nhttn.exe125⤵
-
\??\c:\jddpj.exec:\jddpj.exe126⤵
-
\??\c:\pjpjd.exec:\pjpjd.exe127⤵
-
\??\c:\jjjpj.exec:\jjjpj.exe128⤵
-
\??\c:\lfxrfff.exec:\lfxrfff.exe129⤵
-
\??\c:\rlfxffx.exec:\rlfxffx.exe130⤵
-
\??\c:\jpvpd.exec:\jpvpd.exe131⤵
-
\??\c:\1xffxxx.exec:\1xffxxx.exe132⤵
-
\??\c:\1xrlllf.exec:\1xrlllf.exe133⤵
-
\??\c:\hbhhhh.exec:\hbhhhh.exe134⤵
-
\??\c:\vdddp.exec:\vdddp.exe135⤵
-
\??\c:\vjjdp.exec:\vjjdp.exe136⤵
-
\??\c:\9jddv.exec:\9jddv.exe137⤵
-
\??\c:\lxrlllf.exec:\lxrlllf.exe138⤵
-
\??\c:\nhbttn.exec:\nhbttn.exe139⤵
-
\??\c:\hnhbnn.exec:\hnhbnn.exe140⤵
-
\??\c:\dpvjd.exec:\dpvjd.exe141⤵
-
\??\c:\7ppjv.exec:\7ppjv.exe142⤵
-
\??\c:\jvvpp.exec:\jvvpp.exe143⤵
-
\??\c:\7lrlrlx.exec:\7lrlrlx.exe144⤵
-
\??\c:\xxxfxxl.exec:\xxxfxxl.exe145⤵
-
\??\c:\bbbtnh.exec:\bbbtnh.exe146⤵
-
\??\c:\7jddp.exec:\7jddp.exe147⤵
-
\??\c:\jvvjv.exec:\jvvjv.exe148⤵
-
\??\c:\llrrfxr.exec:\llrrfxr.exe149⤵
-
\??\c:\rfrllfr.exec:\rfrllfr.exe150⤵
-
\??\c:\nntbtn.exec:\nntbtn.exe151⤵
-
\??\c:\jjdpj.exec:\jjdpj.exe152⤵
-
\??\c:\7vpjd.exec:\7vpjd.exe153⤵
-
\??\c:\fxrlxfx.exec:\fxrlxfx.exe154⤵
-
\??\c:\1fffrrr.exec:\1fffrrr.exe155⤵
-
\??\c:\bnnhbt.exec:\bnnhbt.exe156⤵
-
\??\c:\5nbhbb.exec:\5nbhbb.exe157⤵
-
\??\c:\ppvvv.exec:\ppvvv.exe158⤵
-
\??\c:\ppvdv.exec:\ppvdv.exe159⤵
-
\??\c:\7fxrllf.exec:\7fxrllf.exe160⤵
-
\??\c:\tbbhbt.exec:\tbbhbt.exe161⤵
-
\??\c:\tntbnt.exec:\tntbnt.exe162⤵
-
\??\c:\jvdpj.exec:\jvdpj.exe163⤵
-
\??\c:\fxlfllr.exec:\fxlfllr.exe164⤵
-
\??\c:\bbnhht.exec:\bbnhht.exe165⤵
-
\??\c:\bbbbnh.exec:\bbbbnh.exe166⤵
-
\??\c:\jdvpd.exec:\jdvpd.exe167⤵
-
\??\c:\ppvvp.exec:\ppvvp.exe168⤵
-
\??\c:\tnnhtb.exec:\tnnhtb.exe169⤵
-
\??\c:\bthbtn.exec:\bthbtn.exe170⤵
-
\??\c:\3jpdp.exec:\3jpdp.exe171⤵
-
\??\c:\pjdpd.exec:\pjdpd.exe172⤵
-
\??\c:\tnhnhb.exec:\tnhnhb.exe173⤵
-
\??\c:\hbthbt.exec:\hbthbt.exe174⤵
-
\??\c:\dpvvj.exec:\dpvvj.exe175⤵
-
\??\c:\9lrlllx.exec:\9lrlllx.exe176⤵
-
\??\c:\lxxrffx.exec:\lxxrffx.exe177⤵
-
\??\c:\htbthh.exec:\htbthh.exe178⤵
-
\??\c:\nnthbt.exec:\nnthbt.exe179⤵
-
\??\c:\pjjjv.exec:\pjjjv.exe180⤵
-
\??\c:\dvppv.exec:\dvppv.exe181⤵
-
\??\c:\5frlrrf.exec:\5frlrrf.exe182⤵
-
\??\c:\btbbhb.exec:\btbbhb.exe183⤵
-
\??\c:\jdjdv.exec:\jdjdv.exe184⤵
-
\??\c:\vvppd.exec:\vvppd.exe185⤵
-
\??\c:\7rrlffx.exec:\7rrlffx.exe186⤵
-
\??\c:\lfxxfrr.exec:\lfxxfrr.exe187⤵
-
\??\c:\ttnnbb.exec:\ttnnbb.exe188⤵
-
\??\c:\htnnhh.exec:\htnnhh.exe189⤵
-
\??\c:\7vvjv.exec:\7vvjv.exe190⤵
-
\??\c:\jddvj.exec:\jddvj.exe191⤵
-
\??\c:\vvdvp.exec:\vvdvp.exe192⤵
-
\??\c:\9ffxrrr.exec:\9ffxrrr.exe193⤵
-
\??\c:\lffxrfx.exec:\lffxrfx.exe194⤵
-
\??\c:\hhhbnn.exec:\hhhbnn.exe195⤵
-
\??\c:\tnnhht.exec:\tnnhht.exe196⤵
-
\??\c:\vjjdv.exec:\vjjdv.exe197⤵
-
\??\c:\vpjdv.exec:\vpjdv.exe198⤵
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe199⤵
-
\??\c:\xfxxflr.exec:\xfxxflr.exe200⤵
-
\??\c:\ntttth.exec:\ntttth.exe201⤵
-
\??\c:\bbtntt.exec:\bbtntt.exe202⤵
-
\??\c:\bbthbt.exec:\bbthbt.exe203⤵
-
\??\c:\rfrlrrx.exec:\rfrlrrx.exe204⤵
-
\??\c:\bbhnhh.exec:\bbhnhh.exe205⤵
-
\??\c:\vjvpj.exec:\vjvpj.exe206⤵
-
\??\c:\vjpdj.exec:\vjpdj.exe207⤵
-
\??\c:\llxrllf.exec:\llxrllf.exe208⤵
-
\??\c:\thbbtt.exec:\thbbtt.exe209⤵
-
\??\c:\bthhbb.exec:\bthhbb.exe210⤵
-
\??\c:\jpppd.exec:\jpppd.exe211⤵
-
\??\c:\xffxrrr.exec:\xffxrrr.exe212⤵
-
\??\c:\tbtnhn.exec:\tbtnhn.exe213⤵
-
\??\c:\pjjjv.exec:\pjjjv.exe214⤵
-
\??\c:\dvddv.exec:\dvddv.exe215⤵
-
\??\c:\thhbtt.exec:\thhbtt.exe216⤵
-
\??\c:\bttnhn.exec:\bttnhn.exe217⤵
-
\??\c:\nhhbtn.exec:\nhhbtn.exe218⤵
-
\??\c:\vdjpj.exec:\vdjpj.exe219⤵
-
\??\c:\rllfrrr.exec:\rllfrrr.exe220⤵
-
\??\c:\xrllllf.exec:\xrllllf.exe221⤵
-
\??\c:\1tbbtn.exec:\1tbbtn.exe222⤵
-
\??\c:\bbttnt.exec:\bbttnt.exe223⤵
-
\??\c:\nnnnhb.exec:\nnnnhb.exe224⤵
-
\??\c:\vdpjd.exec:\vdpjd.exe225⤵
-
\??\c:\dvpjd.exec:\dvpjd.exe226⤵
-
\??\c:\fxfxffl.exec:\fxfxffl.exe227⤵
-
\??\c:\lfffxxr.exec:\lfffxxr.exe228⤵
-
\??\c:\tnhhhh.exec:\tnhhhh.exe229⤵
-
\??\c:\nnhhbn.exec:\nnhhbn.exe230⤵
-
\??\c:\nhhbhh.exec:\nhhbhh.exe231⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe232⤵
-
\??\c:\vjpjj.exec:\vjpjj.exe233⤵
-
\??\c:\rrllfxr.exec:\rrllfxr.exe234⤵
-
\??\c:\rfrlfff.exec:\rfrlfff.exe235⤵
-
\??\c:\ntbbbb.exec:\ntbbbb.exe236⤵
-
\??\c:\3htthn.exec:\3htthn.exe237⤵
-
\??\c:\vjjdp.exec:\vjjdp.exe238⤵
-
\??\c:\jjjjd.exec:\jjjjd.exe239⤵
-
\??\c:\xrrllff.exec:\xrrllff.exe240⤵
-
\??\c:\rllfffx.exec:\rllfffx.exe241⤵