Analysis
-
max time kernel
141s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 00:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
98973006f951fa662bdd11a4a51b86240ccd63dd45473e2ea01be974e4469dc6.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
98973006f951fa662bdd11a4a51b86240ccd63dd45473e2ea01be974e4469dc6.exe
-
Size
78KB
-
MD5
2322231f93a311f16f07540eca337b90
-
SHA1
5e8e1497d84d01135231a9b467560f5a2ae22354
-
SHA256
98973006f951fa662bdd11a4a51b86240ccd63dd45473e2ea01be974e4469dc6
-
SHA512
8b5f48a11403280323619dc02c79969c6c0a5121e1e3792ebbdfd992878878f1d2210f44fa4719b62179da10fd73f29e5168b93ba54e22c9fe9daedf4d6ea065
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfv7+afCD+QsQbKQPV790638ilX:ymb3NkkiQ3mdBjFIfvTfCD+HlQgViJ
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/1704-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-65-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2920-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1360-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/336-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-439-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 29 IoCs
Processes:
resource yara_rule behavioral2/memory/1704-5-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3836-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3836-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/372-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2404-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1924-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4836-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4836-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4828-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3992-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2920-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/528-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4860-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3288-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4656-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2164-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4420-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2036-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4944-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4488-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4684-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1360-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5000-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/336-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3260-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4896-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3716-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5008-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/372-439-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
xllllll.exehbbbbn.exe3djdd.exevdvjd.exefflfxxr.exebhnhbb.exeppvvj.exeddjjd.exe9rrrrrr.exentttbh.exevvppj.exexrrrfff.exebnbbbb.exejdvpd.exe1vvjd.exefxfxrrr.exethbttn.exethtnhh.exe9vvvp.exelrrrrxx.exettbtth.exeppvpj.exevpjvp.exexfrlfff.exennnnnn.exehbbbhh.exedvjdj.exe5vjjp.exe7hhnhh.exebbnhtn.exe7vdvp.exevdvvd.exeflxxrrx.exehttnhh.exe3hhhbh.exepdppp.exepvvdv.exefxxrfff.exe7rrrrrr.exenntttt.exetthhht.exeddddd.exeflxlllr.exexlllfff.exerrxrflx.exenbtnbn.exe5dvvp.exedpvvd.exefxrfxff.exefxlrlll.exenttbhn.exevvjjj.exepppvv.exelflfxff.exexxffrxf.exentnbnn.exethtnhh.exepvpvv.exe5jddv.exelrffxxx.exerfflfll.exehthnnt.exe3bhhtt.exe9dpjj.exepid process 3836 xllllll.exe 2404 hbbbbn.exe 372 3djdd.exe 1924 vdvjd.exe 4836 fflfxxr.exe 4828 bhnhbb.exe 3968 ppvvj.exe 3992 ddjjd.exe 2920 9rrrrrr.exe 528 ntttbh.exe 4860 vvppj.exe 3288 xrrrfff.exe 4656 bnbbbb.exe 2164 jdvpd.exe 4420 1vvjd.exe 2036 fxfxrrr.exe 4944 thbttn.exe 4488 thtnhh.exe 4744 9vvvp.exe 4684 lrrrrxx.exe 1360 ttbtth.exe 5000 ppvpj.exe 336 vpjvp.exe 3512 xfrlfff.exe 3260 nnnnnn.exe 4896 hbbbhh.exe 3716 dvjdj.exe 4816 5vjjp.exe 3240 7hhnhh.exe 5008 bbnhtn.exe 3648 7vdvp.exe 1948 vdvvd.exe 3452 flxxrrx.exe 2988 httnhh.exe 4496 3hhhbh.exe 624 pdppp.exe 4520 pvvdv.exe 4644 fxxrfff.exe 2616 7rrrrrr.exe 4700 nntttt.exe 4624 tthhht.exe 3344 ddddd.exe 4344 flxlllr.exe 952 xlllfff.exe 4836 rrxrflx.exe 3844 nbtnbn.exe 212 5dvvp.exe 3204 dpvvd.exe 512 fxrfxff.exe 1080 fxlrlll.exe 1220 nttbhn.exe 4268 vvjjj.exe 5088 pppvv.exe 3736 lflfxff.exe 4656 xxffrxf.exe 4440 ntnbnn.exe 1576 thtnhh.exe 4088 pvpvv.exe 3304 5jddv.exe 4756 lrffxxx.exe 1468 rfflfll.exe 4812 hthnnt.exe 3056 3bhhtt.exe 3068 9dpjj.exe -
Processes:
resource yara_rule behavioral2/memory/1704-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2404-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1360-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/336-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-439-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
98973006f951fa662bdd11a4a51b86240ccd63dd45473e2ea01be974e4469dc6.exexllllll.exehbbbbn.exe3djdd.exevdvjd.exefflfxxr.exebhnhbb.exeppvvj.exeddjjd.exe9rrrrrr.exentttbh.exevvppj.exexrrrfff.exebnbbbb.exejdvpd.exe1vvjd.exefxfxrrr.exethbttn.exethtnhh.exe9vvvp.exelrrrrxx.exettbtth.exedescription pid process target process PID 1704 wrote to memory of 3836 1704 98973006f951fa662bdd11a4a51b86240ccd63dd45473e2ea01be974e4469dc6.exe xllllll.exe PID 1704 wrote to memory of 3836 1704 98973006f951fa662bdd11a4a51b86240ccd63dd45473e2ea01be974e4469dc6.exe xllllll.exe PID 1704 wrote to memory of 3836 1704 98973006f951fa662bdd11a4a51b86240ccd63dd45473e2ea01be974e4469dc6.exe xllllll.exe PID 3836 wrote to memory of 2404 3836 xllllll.exe hbbbbn.exe PID 3836 wrote to memory of 2404 3836 xllllll.exe hbbbbn.exe PID 3836 wrote to memory of 2404 3836 xllllll.exe hbbbbn.exe PID 2404 wrote to memory of 372 2404 hbbbbn.exe 3djdd.exe PID 2404 wrote to memory of 372 2404 hbbbbn.exe 3djdd.exe PID 2404 wrote to memory of 372 2404 hbbbbn.exe 3djdd.exe PID 372 wrote to memory of 1924 372 3djdd.exe vdvjd.exe PID 372 wrote to memory of 1924 372 3djdd.exe vdvjd.exe PID 372 wrote to memory of 1924 372 3djdd.exe vdvjd.exe PID 1924 wrote to memory of 4836 1924 vdvjd.exe fflfxxr.exe PID 1924 wrote to memory of 4836 1924 vdvjd.exe fflfxxr.exe PID 1924 wrote to memory of 4836 1924 vdvjd.exe fflfxxr.exe PID 4836 wrote to memory of 4828 4836 fflfxxr.exe bhnhbb.exe PID 4836 wrote to memory of 4828 4836 fflfxxr.exe bhnhbb.exe PID 4836 wrote to memory of 4828 4836 fflfxxr.exe bhnhbb.exe PID 4828 wrote to memory of 3968 4828 bhnhbb.exe ppvvj.exe PID 4828 wrote to memory of 3968 4828 bhnhbb.exe ppvvj.exe PID 4828 wrote to memory of 3968 4828 bhnhbb.exe ppvvj.exe PID 3968 wrote to memory of 3992 3968 ppvvj.exe ddjjd.exe PID 3968 wrote to memory of 3992 3968 ppvvj.exe ddjjd.exe PID 3968 wrote to memory of 3992 3968 ppvvj.exe ddjjd.exe PID 3992 wrote to memory of 2920 3992 ddjjd.exe 9rrrrrr.exe PID 3992 wrote to memory of 2920 3992 ddjjd.exe 9rrrrrr.exe PID 3992 wrote to memory of 2920 3992 ddjjd.exe 9rrrrrr.exe PID 2920 wrote to memory of 528 2920 9rrrrrr.exe ntttbh.exe PID 2920 wrote to memory of 528 2920 9rrrrrr.exe ntttbh.exe PID 2920 wrote to memory of 528 2920 9rrrrrr.exe ntttbh.exe PID 528 wrote to memory of 4860 528 ntttbh.exe vvppj.exe PID 528 wrote to memory of 4860 528 ntttbh.exe vvppj.exe PID 528 wrote to memory of 4860 528 ntttbh.exe vvppj.exe PID 4860 wrote to memory of 3288 4860 vvppj.exe xrrrfff.exe PID 4860 wrote to memory of 3288 4860 vvppj.exe xrrrfff.exe PID 4860 wrote to memory of 3288 4860 vvppj.exe xrrrfff.exe PID 3288 wrote to memory of 4656 3288 xrrrfff.exe bnbbbb.exe PID 3288 wrote to memory of 4656 3288 xrrrfff.exe bnbbbb.exe PID 3288 wrote to memory of 4656 3288 xrrrfff.exe bnbbbb.exe PID 4656 wrote to memory of 2164 4656 bnbbbb.exe jdvpd.exe PID 4656 wrote to memory of 2164 4656 bnbbbb.exe jdvpd.exe PID 4656 wrote to memory of 2164 4656 bnbbbb.exe jdvpd.exe PID 2164 wrote to memory of 4420 2164 jdvpd.exe 1vvjd.exe PID 2164 wrote to memory of 4420 2164 jdvpd.exe 1vvjd.exe PID 2164 wrote to memory of 4420 2164 jdvpd.exe 1vvjd.exe PID 4420 wrote to memory of 2036 4420 1vvjd.exe fxfxrrr.exe PID 4420 wrote to memory of 2036 4420 1vvjd.exe fxfxrrr.exe PID 4420 wrote to memory of 2036 4420 1vvjd.exe fxfxrrr.exe PID 2036 wrote to memory of 4944 2036 fxfxrrr.exe thbttn.exe PID 2036 wrote to memory of 4944 2036 fxfxrrr.exe thbttn.exe PID 2036 wrote to memory of 4944 2036 fxfxrrr.exe thbttn.exe PID 4944 wrote to memory of 4488 4944 thbttn.exe thtnhh.exe PID 4944 wrote to memory of 4488 4944 thbttn.exe thtnhh.exe PID 4944 wrote to memory of 4488 4944 thbttn.exe thtnhh.exe PID 4488 wrote to memory of 4744 4488 thtnhh.exe 9vvvp.exe PID 4488 wrote to memory of 4744 4488 thtnhh.exe 9vvvp.exe PID 4488 wrote to memory of 4744 4488 thtnhh.exe 9vvvp.exe PID 4744 wrote to memory of 4684 4744 9vvvp.exe lrrrrxx.exe PID 4744 wrote to memory of 4684 4744 9vvvp.exe lrrrrxx.exe PID 4744 wrote to memory of 4684 4744 9vvvp.exe lrrrrxx.exe PID 4684 wrote to memory of 1360 4684 lrrrrxx.exe ttbtth.exe PID 4684 wrote to memory of 1360 4684 lrrrrxx.exe ttbtth.exe PID 4684 wrote to memory of 1360 4684 lrrrrxx.exe ttbtth.exe PID 1360 wrote to memory of 5000 1360 ttbtth.exe ppvpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\98973006f951fa662bdd11a4a51b86240ccd63dd45473e2ea01be974e4469dc6.exe"C:\Users\Admin\AppData\Local\Temp\98973006f951fa662bdd11a4a51b86240ccd63dd45473e2ea01be974e4469dc6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\xllllll.exec:\xllllll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbbbbn.exec:\hbbbbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3djdd.exec:\3djdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdvjd.exec:\vdvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fflfxxr.exec:\fflfxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhnhbb.exec:\bhnhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppvvj.exec:\ppvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddjjd.exec:\ddjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9rrrrrr.exec:\9rrrrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntttbh.exec:\ntttbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvppj.exec:\vvppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrrrfff.exec:\xrrrfff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnbbbb.exec:\bnbbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvpd.exec:\jdvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1vvjd.exec:\1vvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thbttn.exec:\thbttn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thtnhh.exec:\thtnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9vvvp.exec:\9vvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrrrrxx.exec:\lrrrrxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttbtth.exec:\ttbtth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppvpj.exec:\ppvpj.exe23⤵
- Executes dropped EXE
-
\??\c:\vpjvp.exec:\vpjvp.exe24⤵
- Executes dropped EXE
-
\??\c:\xfrlfff.exec:\xfrlfff.exe25⤵
- Executes dropped EXE
-
\??\c:\nnnnnn.exec:\nnnnnn.exe26⤵
- Executes dropped EXE
-
\??\c:\hbbbhh.exec:\hbbbhh.exe27⤵
- Executes dropped EXE
-
\??\c:\dvjdj.exec:\dvjdj.exe28⤵
- Executes dropped EXE
-
\??\c:\5vjjp.exec:\5vjjp.exe29⤵
- Executes dropped EXE
-
\??\c:\7hhnhh.exec:\7hhnhh.exe30⤵
- Executes dropped EXE
-
\??\c:\bbnhtn.exec:\bbnhtn.exe31⤵
- Executes dropped EXE
-
\??\c:\7vdvp.exec:\7vdvp.exe32⤵
- Executes dropped EXE
-
\??\c:\vdvvd.exec:\vdvvd.exe33⤵
- Executes dropped EXE
-
\??\c:\flxxrrx.exec:\flxxrrx.exe34⤵
- Executes dropped EXE
-
\??\c:\httnhh.exec:\httnhh.exe35⤵
- Executes dropped EXE
-
\??\c:\3hhhbh.exec:\3hhhbh.exe36⤵
- Executes dropped EXE
-
\??\c:\pdppp.exec:\pdppp.exe37⤵
- Executes dropped EXE
-
\??\c:\pvvdv.exec:\pvvdv.exe38⤵
- Executes dropped EXE
-
\??\c:\fxxrfff.exec:\fxxrfff.exe39⤵
- Executes dropped EXE
-
\??\c:\7rrrrrr.exec:\7rrrrrr.exe40⤵
- Executes dropped EXE
-
\??\c:\nntttt.exec:\nntttt.exe41⤵
- Executes dropped EXE
-
\??\c:\tthhht.exec:\tthhht.exe42⤵
- Executes dropped EXE
-
\??\c:\ddddd.exec:\ddddd.exe43⤵
- Executes dropped EXE
-
\??\c:\flxlllr.exec:\flxlllr.exe44⤵
- Executes dropped EXE
-
\??\c:\xlllfff.exec:\xlllfff.exe45⤵
- Executes dropped EXE
-
\??\c:\rrxrflx.exec:\rrxrflx.exe46⤵
- Executes dropped EXE
-
\??\c:\nbtnbn.exec:\nbtnbn.exe47⤵
- Executes dropped EXE
-
\??\c:\5dvvp.exec:\5dvvp.exe48⤵
- Executes dropped EXE
-
\??\c:\dpvvd.exec:\dpvvd.exe49⤵
- Executes dropped EXE
-
\??\c:\fxrfxff.exec:\fxrfxff.exe50⤵
- Executes dropped EXE
-
\??\c:\fxlrlll.exec:\fxlrlll.exe51⤵
- Executes dropped EXE
-
\??\c:\nttbhn.exec:\nttbhn.exe52⤵
- Executes dropped EXE
-
\??\c:\vvjjj.exec:\vvjjj.exe53⤵
- Executes dropped EXE
-
\??\c:\pppvv.exec:\pppvv.exe54⤵
- Executes dropped EXE
-
\??\c:\lflfxff.exec:\lflfxff.exe55⤵
- Executes dropped EXE
-
\??\c:\xxffrxf.exec:\xxffrxf.exe56⤵
- Executes dropped EXE
-
\??\c:\ntnbnn.exec:\ntnbnn.exe57⤵
- Executes dropped EXE
-
\??\c:\thtnhh.exec:\thtnhh.exe58⤵
- Executes dropped EXE
-
\??\c:\pvpvv.exec:\pvpvv.exe59⤵
- Executes dropped EXE
-
\??\c:\5jddv.exec:\5jddv.exe60⤵
- Executes dropped EXE
-
\??\c:\lrffxxx.exec:\lrffxxx.exe61⤵
- Executes dropped EXE
-
\??\c:\rfflfll.exec:\rfflfll.exe62⤵
- Executes dropped EXE
-
\??\c:\hthnnt.exec:\hthnnt.exe63⤵
- Executes dropped EXE
-
\??\c:\3bhhtt.exec:\3bhhtt.exe64⤵
- Executes dropped EXE
-
\??\c:\9dpjj.exec:\9dpjj.exe65⤵
- Executes dropped EXE
-
\??\c:\jdjjp.exec:\jdjjp.exe66⤵
-
\??\c:\fflfllf.exec:\fflfllf.exe67⤵
-
\??\c:\rffxxxx.exec:\rffxxxx.exe68⤵
-
\??\c:\nbbbnb.exec:\nbbbnb.exe69⤵
-
\??\c:\nbntht.exec:\nbntht.exe70⤵
-
\??\c:\jjppj.exec:\jjppj.exe71⤵
-
\??\c:\xlxxrrx.exec:\xlxxrrx.exe72⤵
-
\??\c:\frllxxr.exec:\frllxxr.exe73⤵
-
\??\c:\nhhtbn.exec:\nhhtbn.exe74⤵
-
\??\c:\ddddv.exec:\ddddv.exe75⤵
-
\??\c:\pjppj.exec:\pjppj.exe76⤵
-
\??\c:\thbbtt.exec:\thbbtt.exe77⤵
-
\??\c:\bbnhnh.exec:\bbnhnh.exe78⤵
-
\??\c:\jjjjj.exec:\jjjjj.exe79⤵
-
\??\c:\jvddp.exec:\jvddp.exe80⤵
-
\??\c:\fxxrlll.exec:\fxxrlll.exe81⤵
-
\??\c:\fxxxlxl.exec:\fxxxlxl.exe82⤵
-
\??\c:\bbnhht.exec:\bbnhht.exe83⤵
-
\??\c:\tnnttt.exec:\tnnttt.exe84⤵
-
\??\c:\pjddp.exec:\pjddp.exe85⤵
-
\??\c:\fxflfxx.exec:\fxflfxx.exe86⤵
-
\??\c:\thnbnb.exec:\thnbnb.exe87⤵
-
\??\c:\7ddvd.exec:\7ddvd.exe88⤵
-
\??\c:\5jpvj.exec:\5jpvj.exe89⤵
-
\??\c:\7llfrrf.exec:\7llfrrf.exe90⤵
-
\??\c:\xllfxxl.exec:\xllfxxl.exe91⤵
-
\??\c:\bnttbb.exec:\bnttbb.exe92⤵
-
\??\c:\vjjdp.exec:\vjjdp.exe93⤵
-
\??\c:\7fxxrxr.exec:\7fxxrxr.exe94⤵
-
\??\c:\frfffff.exec:\frfffff.exe95⤵
-
\??\c:\bbhnhh.exec:\bbhnhh.exe96⤵
-
\??\c:\hhtthn.exec:\hhtthn.exe97⤵
-
\??\c:\djpdv.exec:\djpdv.exe98⤵
-
\??\c:\llxrxff.exec:\llxrxff.exe99⤵
-
\??\c:\tnntnn.exec:\tnntnn.exe100⤵
-
\??\c:\btbbtn.exec:\btbbtn.exe101⤵
-
\??\c:\vddvd.exec:\vddvd.exe102⤵
-
\??\c:\jdddd.exec:\jdddd.exe103⤵
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe104⤵
-
\??\c:\nhbhbt.exec:\nhbhbt.exe105⤵
-
\??\c:\bhhhbb.exec:\bhhhbb.exe106⤵
-
\??\c:\pdvjj.exec:\pdvjj.exe107⤵
-
\??\c:\pvdvd.exec:\pvdvd.exe108⤵
-
\??\c:\rrlfxxx.exec:\rrlfxxx.exe109⤵
-
\??\c:\hnbnnb.exec:\hnbnnb.exe110⤵
-
\??\c:\bbbbtb.exec:\bbbbtb.exe111⤵
-
\??\c:\djvpp.exec:\djvpp.exe112⤵
-
\??\c:\vvvvp.exec:\vvvvp.exe113⤵
-
\??\c:\rxffxxx.exec:\rxffxxx.exe114⤵
-
\??\c:\rfffxxr.exec:\rfffxxr.exe115⤵
-
\??\c:\fffxrrf.exec:\fffxrrf.exe116⤵
-
\??\c:\ttbbnn.exec:\ttbbnn.exe117⤵
-
\??\c:\nhnnhh.exec:\nhnnhh.exe118⤵
-
\??\c:\pjjdd.exec:\pjjdd.exe119⤵
-
\??\c:\3vvvj.exec:\3vvvj.exe120⤵
-
\??\c:\rlffrll.exec:\rlffrll.exe121⤵
-
\??\c:\ffffxxx.exec:\ffffxxx.exe122⤵
-
\??\c:\tntttt.exec:\tntttt.exe123⤵
-
\??\c:\5thhhn.exec:\5thhhn.exe124⤵
-
\??\c:\bbnthh.exec:\bbnthh.exe125⤵
-
\??\c:\3pddj.exec:\3pddj.exe126⤵
-
\??\c:\vvjpd.exec:\vvjpd.exe127⤵
-
\??\c:\llrrrff.exec:\llrrrff.exe128⤵
-
\??\c:\frlrfxr.exec:\frlrfxr.exe129⤵
-
\??\c:\hhnnhn.exec:\hhnnhn.exe130⤵
-
\??\c:\nhnnnt.exec:\nhnnnt.exe131⤵
-
\??\c:\jvddp.exec:\jvddp.exe132⤵
-
\??\c:\jjjjj.exec:\jjjjj.exe133⤵
-
\??\c:\rxrlfrr.exec:\rxrlfrr.exe134⤵
-
\??\c:\xrrlrrf.exec:\xrrlrrf.exe135⤵
-
\??\c:\hnhbnn.exec:\hnhbnn.exe136⤵
-
\??\c:\lrrrlrr.exec:\lrrrlrr.exe137⤵
-
\??\c:\rfxrrrl.exec:\rfxrrrl.exe138⤵
-
\??\c:\hhhbbb.exec:\hhhbbb.exe139⤵
-
\??\c:\3tbbnn.exec:\3tbbnn.exe140⤵
-
\??\c:\vvjjj.exec:\vvjjj.exe141⤵
-
\??\c:\vpppd.exec:\vpppd.exe142⤵
-
\??\c:\vpvpj.exec:\vpvpj.exe143⤵
-
\??\c:\3frlrxx.exec:\3frlrxx.exe144⤵
-
\??\c:\tnttnt.exec:\tnttnt.exe145⤵
-
\??\c:\hhhbtt.exec:\hhhbtt.exe146⤵
-
\??\c:\ppjjd.exec:\ppjjd.exe147⤵
-
\??\c:\vpppp.exec:\vpppp.exe148⤵
-
\??\c:\rfrlflx.exec:\rfrlflx.exe149⤵
-
\??\c:\lrrlfff.exec:\lrrlfff.exe150⤵
-
\??\c:\7thhbb.exec:\7thhbb.exe151⤵
-
\??\c:\bhhbhn.exec:\bhhbhn.exe152⤵
-
\??\c:\jjjjd.exec:\jjjjd.exe153⤵
-
\??\c:\jpppj.exec:\jpppj.exe154⤵
-
\??\c:\lxxxxxr.exec:\lxxxxxr.exe155⤵
-
\??\c:\rllllll.exec:\rllllll.exe156⤵
-
\??\c:\7bhbnn.exec:\7bhbnn.exe157⤵
-
\??\c:\ttnbnb.exec:\ttnbnb.exe158⤵
-
\??\c:\dvdpp.exec:\dvdpp.exe159⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe160⤵
-
\??\c:\7lxrflf.exec:\7lxrflf.exe161⤵
-
\??\c:\rfxlxrl.exec:\rfxlxrl.exe162⤵
-
\??\c:\xfrrlxx.exec:\xfrrlxx.exe163⤵
-
\??\c:\nnhnbb.exec:\nnhnbb.exe164⤵
-
\??\c:\nbtbnb.exec:\nbtbnb.exe165⤵
-
\??\c:\jjjdp.exec:\jjjdp.exe166⤵
-
\??\c:\vpvjv.exec:\vpvjv.exe167⤵
-
\??\c:\lffxxxx.exec:\lffxxxx.exe168⤵
-
\??\c:\llllflf.exec:\llllflf.exe169⤵
-
\??\c:\5hntbt.exec:\5hntbt.exe170⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe171⤵
-
\??\c:\jdpvp.exec:\jdpvp.exe172⤵
-
\??\c:\pjdvj.exec:\pjdvj.exe173⤵
-
\??\c:\xrrrrxx.exec:\xrrrrxx.exe174⤵
-
\??\c:\rfxfllr.exec:\rfxfllr.exe175⤵
-
\??\c:\bnbhhh.exec:\bnbhhh.exe176⤵
-
\??\c:\tnhbnt.exec:\tnhbnt.exe177⤵
-
\??\c:\btnntn.exec:\btnntn.exe178⤵
-
\??\c:\ppppp.exec:\ppppp.exe179⤵
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe180⤵
-
\??\c:\bnhbhh.exec:\bnhbhh.exe181⤵
-
\??\c:\1dvpd.exec:\1dvpd.exe182⤵
-
\??\c:\lxllllf.exec:\lxllllf.exe183⤵
-
\??\c:\rfllxxx.exec:\rfllxxx.exe184⤵
-
\??\c:\fxxxffr.exec:\fxxxffr.exe185⤵
-
\??\c:\nbttnh.exec:\nbttnh.exe186⤵
-
\??\c:\pvdjd.exec:\pvdjd.exe187⤵
-
\??\c:\xxfrllr.exec:\xxfrllr.exe188⤵
-
\??\c:\3nhhbh.exec:\3nhhbh.exe189⤵
-
\??\c:\jvjdp.exec:\jvjdp.exe190⤵
-
\??\c:\rllfrrl.exec:\rllfrrl.exe191⤵
-
\??\c:\btbnhb.exec:\btbnhb.exe192⤵
-
\??\c:\vdddj.exec:\vdddj.exe193⤵
-
\??\c:\xxxfxrl.exec:\xxxfxrl.exe194⤵
-
\??\c:\xrlxrlf.exec:\xrlxrlf.exe195⤵
-
\??\c:\hthhbb.exec:\hthhbb.exe196⤵
-
\??\c:\thnbbt.exec:\thnbbt.exe197⤵
-
\??\c:\pdjdj.exec:\pdjdj.exe198⤵
-
\??\c:\9lrrxxx.exec:\9lrrxxx.exe199⤵
-
\??\c:\lfxlfrl.exec:\lfxlfrl.exe200⤵
-
\??\c:\5hbttt.exec:\5hbttt.exe201⤵
-
\??\c:\jdvvj.exec:\jdvvj.exe202⤵
-
\??\c:\vjppj.exec:\vjppj.exe203⤵
-
\??\c:\lfffflf.exec:\lfffflf.exe204⤵
-
\??\c:\hnhntb.exec:\hnhntb.exe205⤵
-
\??\c:\jppjv.exec:\jppjv.exe206⤵
-
\??\c:\jvddd.exec:\jvddd.exe207⤵
-
\??\c:\3xxxrxr.exec:\3xxxrxr.exe208⤵
-
\??\c:\rfrxxrl.exec:\rfrxxrl.exe209⤵
-
\??\c:\1hbnbt.exec:\1hbnbt.exe210⤵
-
\??\c:\ppppp.exec:\ppppp.exe211⤵
-
\??\c:\djdpv.exec:\djdpv.exe212⤵
-
\??\c:\flrxxrl.exec:\flrxxrl.exe213⤵
-
\??\c:\bnbtbb.exec:\bnbtbb.exe214⤵
-
\??\c:\hbnhtt.exec:\hbnhtt.exe215⤵
-
\??\c:\dvjpv.exec:\dvjpv.exe216⤵
-
\??\c:\pjvdd.exec:\pjvdd.exe217⤵
-
\??\c:\xxrffff.exec:\xxrffff.exe218⤵
-
\??\c:\7rfxxrf.exec:\7rfxxrf.exe219⤵
-
\??\c:\thnhbb.exec:\thnhbb.exe220⤵
-
\??\c:\hnhbnt.exec:\hnhbnt.exe221⤵
-
\??\c:\dpdjd.exec:\dpdjd.exe222⤵
-
\??\c:\1rllxfl.exec:\1rllxfl.exe223⤵
-
\??\c:\xrffrrx.exec:\xrffrrx.exe224⤵
-
\??\c:\1nhbbt.exec:\1nhbbt.exe225⤵
-
\??\c:\hbhbbt.exec:\hbhbbt.exe226⤵
-
\??\c:\vjvpd.exec:\vjvpd.exe227⤵
-
\??\c:\7dpjj.exec:\7dpjj.exe228⤵
-
\??\c:\frlxrfx.exec:\frlxrfx.exe229⤵
-
\??\c:\rrlxlxl.exec:\rrlxlxl.exe230⤵
-
\??\c:\bnhbtn.exec:\bnhbtn.exe231⤵
-
\??\c:\hhnbbn.exec:\hhnbbn.exe232⤵
-
\??\c:\ppjjd.exec:\ppjjd.exe233⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe234⤵
-
\??\c:\1frfrrx.exec:\1frfrrx.exe235⤵
-
\??\c:\7hhhhn.exec:\7hhhhn.exe236⤵
-
\??\c:\bnhttt.exec:\bnhttt.exe237⤵
-
\??\c:\jpjvj.exec:\jpjvj.exe238⤵
-
\??\c:\7vvdp.exec:\7vvdp.exe239⤵
-
\??\c:\rlrffrx.exec:\rlrffrx.exe240⤵
-
\??\c:\rlllffl.exec:\rlllffl.exe241⤵