Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 02:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bcd54e49bbf2773b7c7814d5a046355edacc6d9076303a79d084619402bcadb6.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
bcd54e49bbf2773b7c7814d5a046355edacc6d9076303a79d084619402bcadb6.exe
-
Size
60KB
-
MD5
b1d78eda28759d793ad52edc71ca2de1
-
SHA1
b9b16910ace100761677f44464237f9e326d05cf
-
SHA256
bcd54e49bbf2773b7c7814d5a046355edacc6d9076303a79d084619402bcadb6
-
SHA512
5355931f6ee39447b0150be10cc3876108a121578e934c92f909883428425e72d1d8086c23e3688fb7db5a6fd74adfbcae26fc0c1afc66998ba192cf06d125b6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9Uz:ymb3NkkiQ3mdBjFIvlqz
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/928-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3096-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-68-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 25 IoCs
Processes:
resource yara_rule behavioral2/memory/928-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3096-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4008-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5076-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1908-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1472-30-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3048-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3288-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1736-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3644-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2068-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3724-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4152-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1564-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4740-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4680-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2064-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3956-137-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2468-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4888-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1764-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4020-177-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4288-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2008-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4744-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
ntbttt.exevpvvd.exe5xxrfff.exellfxllr.exentnhbb.exe7tnhtt.exeddppd.exexxrfxrr.exexfrrxff.exehnthbb.exetbhbth.exejddvp.exevjjdv.exebbhbtn.exejddvp.exevvvvj.exeflxrlff.exe9ntthh.exe7ttthh.exellfrlfx.exelxlffff.exe3htttt.exejdvpd.exerllrfll.exefxxrllf.exenntnhh.exe5jppp.exelrxrrrr.exejvjdd.exetbhbtb.exebnhbtn.exedvpjj.exefrllfff.exehbhhhn.exethbtnh.exeddddd.exejddvv.exerxlrflf.exenntbnn.exejjppj.exelrrfxfx.exerlfxrrr.exehbnhbb.exebbtthh.exe3vddv.exeffxrlrr.exerllfxxx.exe1bttnt.exedvpjj.exe9rrrffl.exenbbbbh.exehbbthh.exevdddp.exeppjdd.exebntnnn.exe1pvpd.exevpvpd.exelxxxrrl.exe5hnnhn.exetbnhbb.exetntttt.exe5pvvj.exexlrlxxr.exerfxxrrl.exepid process 2068 ntbttt.exe 3644 vpvvd.exe 1472 5xxrfff.exe 3096 llfxllr.exe 4008 ntnhbb.exe 5076 7tnhtt.exe 2960 ddppd.exe 1908 xxrfxrr.exe 1736 xfrrxff.exe 3048 hnthbb.exe 3288 tbhbth.exe 3724 jddvp.exe 4152 vjjdv.exe 4028 bbhbtn.exe 1564 jddvp.exe 4740 vvvvj.exe 4680 flxrlff.exe 2064 9ntthh.exe 1548 7ttthh.exe 3956 llfrlfx.exe 2468 lxlffff.exe 2192 3htttt.exe 4888 jdvpd.exe 3716 rllrfll.exe 1764 fxxrllf.exe 1056 nntnhh.exe 4020 5jppp.exe 4288 lrxrrrr.exe 2008 jvjdd.exe 4744 tbhbtb.exe 5088 bnhbtn.exe 4292 dvpjj.exe 2764 frllfff.exe 1064 hbhhhn.exe 3684 thbtnh.exe 4276 ddddd.exe 2456 jddvv.exe 3748 rxlrflf.exe 3668 nntbnn.exe 4180 jjppj.exe 2044 lrrfxfx.exe 3992 rlfxrrr.exe 820 hbnhbb.exe 3516 bbtthh.exe 436 3vddv.exe 2552 ffxrlrr.exe 4344 rllfxxx.exe 2724 1bttnt.exe 3176 dvpjj.exe 1940 9rrrffl.exe 1944 nbbbbh.exe 5040 hbbthh.exe 4036 vdddp.exe 4468 ppjdd.exe 4116 bntnnn.exe 2424 1pvpd.exe 1468 vpvpd.exe 3932 lxxxrrl.exe 3652 5hnnhn.exe 2844 tbnhbb.exe 4340 tntttt.exe 3288 5pvvj.exe 1208 xlrlxxr.exe 2208 rfxxrrl.exe -
Processes:
resource yara_rule behavioral2/memory/928-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bcd54e49bbf2773b7c7814d5a046355edacc6d9076303a79d084619402bcadb6.exentbttt.exevpvvd.exe5xxrfff.exellfxllr.exentnhbb.exe7tnhtt.exeddppd.exexxrfxrr.exexfrrxff.exehnthbb.exetbhbth.exejddvp.exevjjdv.exebbhbtn.exejddvp.exevvvvj.exeflxrlff.exe9ntthh.exe7ttthh.exellfrlfx.exelxlffff.exedescription pid process target process PID 928 wrote to memory of 2068 928 bcd54e49bbf2773b7c7814d5a046355edacc6d9076303a79d084619402bcadb6.exe ntbttt.exe PID 928 wrote to memory of 2068 928 bcd54e49bbf2773b7c7814d5a046355edacc6d9076303a79d084619402bcadb6.exe ntbttt.exe PID 928 wrote to memory of 2068 928 bcd54e49bbf2773b7c7814d5a046355edacc6d9076303a79d084619402bcadb6.exe ntbttt.exe PID 2068 wrote to memory of 3644 2068 ntbttt.exe vpvvd.exe PID 2068 wrote to memory of 3644 2068 ntbttt.exe vpvvd.exe PID 2068 wrote to memory of 3644 2068 ntbttt.exe vpvvd.exe PID 3644 wrote to memory of 1472 3644 vpvvd.exe 5xxrfff.exe PID 3644 wrote to memory of 1472 3644 vpvvd.exe 5xxrfff.exe PID 3644 wrote to memory of 1472 3644 vpvvd.exe 5xxrfff.exe PID 1472 wrote to memory of 3096 1472 5xxrfff.exe llfxllr.exe PID 1472 wrote to memory of 3096 1472 5xxrfff.exe llfxllr.exe PID 1472 wrote to memory of 3096 1472 5xxrfff.exe llfxllr.exe PID 3096 wrote to memory of 4008 3096 llfxllr.exe ntnhbb.exe PID 3096 wrote to memory of 4008 3096 llfxllr.exe ntnhbb.exe PID 3096 wrote to memory of 4008 3096 llfxllr.exe ntnhbb.exe PID 4008 wrote to memory of 5076 4008 ntnhbb.exe 7tnhtt.exe PID 4008 wrote to memory of 5076 4008 ntnhbb.exe 7tnhtt.exe PID 4008 wrote to memory of 5076 4008 ntnhbb.exe 7tnhtt.exe PID 5076 wrote to memory of 2960 5076 7tnhtt.exe ddppd.exe PID 5076 wrote to memory of 2960 5076 7tnhtt.exe ddppd.exe PID 5076 wrote to memory of 2960 5076 7tnhtt.exe ddppd.exe PID 2960 wrote to memory of 1908 2960 ddppd.exe xxrfxrr.exe PID 2960 wrote to memory of 1908 2960 ddppd.exe xxrfxrr.exe PID 2960 wrote to memory of 1908 2960 ddppd.exe xxrfxrr.exe PID 1908 wrote to memory of 1736 1908 xxrfxrr.exe xfrrxff.exe PID 1908 wrote to memory of 1736 1908 xxrfxrr.exe xfrrxff.exe PID 1908 wrote to memory of 1736 1908 xxrfxrr.exe xfrrxff.exe PID 1736 wrote to memory of 3048 1736 xfrrxff.exe hnthbb.exe PID 1736 wrote to memory of 3048 1736 xfrrxff.exe hnthbb.exe PID 1736 wrote to memory of 3048 1736 xfrrxff.exe hnthbb.exe PID 3048 wrote to memory of 3288 3048 hnthbb.exe tbhbth.exe PID 3048 wrote to memory of 3288 3048 hnthbb.exe tbhbth.exe PID 3048 wrote to memory of 3288 3048 hnthbb.exe tbhbth.exe PID 3288 wrote to memory of 3724 3288 tbhbth.exe jddvp.exe PID 3288 wrote to memory of 3724 3288 tbhbth.exe jddvp.exe PID 3288 wrote to memory of 3724 3288 tbhbth.exe jddvp.exe PID 3724 wrote to memory of 4152 3724 jddvp.exe vjjdv.exe PID 3724 wrote to memory of 4152 3724 jddvp.exe vjjdv.exe PID 3724 wrote to memory of 4152 3724 jddvp.exe vjjdv.exe PID 4152 wrote to memory of 4028 4152 vjjdv.exe bbhbtn.exe PID 4152 wrote to memory of 4028 4152 vjjdv.exe bbhbtn.exe PID 4152 wrote to memory of 4028 4152 vjjdv.exe bbhbtn.exe PID 4028 wrote to memory of 1564 4028 bbhbtn.exe jddvp.exe PID 4028 wrote to memory of 1564 4028 bbhbtn.exe jddvp.exe PID 4028 wrote to memory of 1564 4028 bbhbtn.exe jddvp.exe PID 1564 wrote to memory of 4740 1564 jddvp.exe vvvvj.exe PID 1564 wrote to memory of 4740 1564 jddvp.exe vvvvj.exe PID 1564 wrote to memory of 4740 1564 jddvp.exe vvvvj.exe PID 4740 wrote to memory of 4680 4740 vvvvj.exe flxrlff.exe PID 4740 wrote to memory of 4680 4740 vvvvj.exe flxrlff.exe PID 4740 wrote to memory of 4680 4740 vvvvj.exe flxrlff.exe PID 4680 wrote to memory of 2064 4680 flxrlff.exe 9ntthh.exe PID 4680 wrote to memory of 2064 4680 flxrlff.exe 9ntthh.exe PID 4680 wrote to memory of 2064 4680 flxrlff.exe 9ntthh.exe PID 2064 wrote to memory of 1548 2064 9ntthh.exe 7ttthh.exe PID 2064 wrote to memory of 1548 2064 9ntthh.exe 7ttthh.exe PID 2064 wrote to memory of 1548 2064 9ntthh.exe 7ttthh.exe PID 1548 wrote to memory of 3956 1548 7ttthh.exe llfrlfx.exe PID 1548 wrote to memory of 3956 1548 7ttthh.exe llfrlfx.exe PID 1548 wrote to memory of 3956 1548 7ttthh.exe llfrlfx.exe PID 3956 wrote to memory of 2468 3956 llfrlfx.exe lxlffff.exe PID 3956 wrote to memory of 2468 3956 llfrlfx.exe lxlffff.exe PID 3956 wrote to memory of 2468 3956 llfrlfx.exe lxlffff.exe PID 2468 wrote to memory of 2192 2468 lxlffff.exe 3htttt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcd54e49bbf2773b7c7814d5a046355edacc6d9076303a79d084619402bcadb6.exe"C:\Users\Admin\AppData\Local\Temp\bcd54e49bbf2773b7c7814d5a046355edacc6d9076303a79d084619402bcadb6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\ntbttt.exec:\ntbttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvvd.exec:\vpvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5xxrfff.exec:\5xxrfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llfxllr.exec:\llfxllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntnhbb.exec:\ntnhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7tnhtt.exec:\7tnhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddppd.exec:\ddppd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxrfxrr.exec:\xxrfxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfrrxff.exec:\xfrrxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnthbb.exec:\hnthbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbhbth.exec:\tbhbth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jddvp.exec:\jddvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjjdv.exec:\vjjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbhbtn.exec:\bbhbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jddvp.exec:\jddvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvvvj.exec:\vvvvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flxrlff.exec:\flxrlff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9ntthh.exec:\9ntthh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7ttthh.exec:\7ttthh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llfrlfx.exec:\llfrlfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxlffff.exec:\lxlffff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3htttt.exec:\3htttt.exe23⤵
- Executes dropped EXE
-
\??\c:\jdvpd.exec:\jdvpd.exe24⤵
- Executes dropped EXE
-
\??\c:\rllrfll.exec:\rllrfll.exe25⤵
- Executes dropped EXE
-
\??\c:\fxxrllf.exec:\fxxrllf.exe26⤵
- Executes dropped EXE
-
\??\c:\nntnhh.exec:\nntnhh.exe27⤵
- Executes dropped EXE
-
\??\c:\5jppp.exec:\5jppp.exe28⤵
- Executes dropped EXE
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe29⤵
- Executes dropped EXE
-
\??\c:\jvjdd.exec:\jvjdd.exe30⤵
- Executes dropped EXE
-
\??\c:\tbhbtb.exec:\tbhbtb.exe31⤵
- Executes dropped EXE
-
\??\c:\bnhbtn.exec:\bnhbtn.exe32⤵
- Executes dropped EXE
-
\??\c:\dvpjj.exec:\dvpjj.exe33⤵
- Executes dropped EXE
-
\??\c:\frllfff.exec:\frllfff.exe34⤵
- Executes dropped EXE
-
\??\c:\hbhhhn.exec:\hbhhhn.exe35⤵
- Executes dropped EXE
-
\??\c:\thbtnh.exec:\thbtnh.exe36⤵
- Executes dropped EXE
-
\??\c:\ddddd.exec:\ddddd.exe37⤵
- Executes dropped EXE
-
\??\c:\jddvv.exec:\jddvv.exe38⤵
- Executes dropped EXE
-
\??\c:\rxlrflf.exec:\rxlrflf.exe39⤵
- Executes dropped EXE
-
\??\c:\nntbnn.exec:\nntbnn.exe40⤵
- Executes dropped EXE
-
\??\c:\jjppj.exec:\jjppj.exe41⤵
- Executes dropped EXE
-
\??\c:\lrrfxfx.exec:\lrrfxfx.exe42⤵
- Executes dropped EXE
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe43⤵
- Executes dropped EXE
-
\??\c:\hbnhbb.exec:\hbnhbb.exe44⤵
- Executes dropped EXE
-
\??\c:\bbtthh.exec:\bbtthh.exe45⤵
- Executes dropped EXE
-
\??\c:\3vddv.exec:\3vddv.exe46⤵
- Executes dropped EXE
-
\??\c:\ffxrlrr.exec:\ffxrlrr.exe47⤵
- Executes dropped EXE
-
\??\c:\rllfxxx.exec:\rllfxxx.exe48⤵
- Executes dropped EXE
-
\??\c:\1bttnt.exec:\1bttnt.exe49⤵
- Executes dropped EXE
-
\??\c:\dvpjj.exec:\dvpjj.exe50⤵
- Executes dropped EXE
-
\??\c:\9rrrffl.exec:\9rrrffl.exe51⤵
- Executes dropped EXE
-
\??\c:\nbbbbh.exec:\nbbbbh.exe52⤵
- Executes dropped EXE
-
\??\c:\hbbthh.exec:\hbbthh.exe53⤵
- Executes dropped EXE
-
\??\c:\vdddp.exec:\vdddp.exe54⤵
- Executes dropped EXE
-
\??\c:\ppjdd.exec:\ppjdd.exe55⤵
- Executes dropped EXE
-
\??\c:\bntnnn.exec:\bntnnn.exe56⤵
- Executes dropped EXE
-
\??\c:\1pvpd.exec:\1pvpd.exe57⤵
- Executes dropped EXE
-
\??\c:\vpvpd.exec:\vpvpd.exe58⤵
- Executes dropped EXE
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe59⤵
- Executes dropped EXE
-
\??\c:\5hnnhn.exec:\5hnnhn.exe60⤵
- Executes dropped EXE
-
\??\c:\tbnhbb.exec:\tbnhbb.exe61⤵
- Executes dropped EXE
-
\??\c:\tntttt.exec:\tntttt.exe62⤵
- Executes dropped EXE
-
\??\c:\5pvvj.exec:\5pvvj.exe63⤵
- Executes dropped EXE
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe64⤵
- Executes dropped EXE
-
\??\c:\rfxxrrl.exec:\rfxxrrl.exe65⤵
- Executes dropped EXE
-
\??\c:\tbnnnn.exec:\tbnnnn.exe66⤵
-
\??\c:\btbbnn.exec:\btbbnn.exe67⤵
-
\??\c:\ppvvj.exec:\ppvvj.exe68⤵
-
\??\c:\1pvvd.exec:\1pvvd.exe69⤵
-
\??\c:\5rlfrrl.exec:\5rlfrrl.exe70⤵
-
\??\c:\rrfxrrl.exec:\rrfxrrl.exe71⤵
-
\??\c:\bbhntt.exec:\bbhntt.exe72⤵
-
\??\c:\nhhbtt.exec:\nhhbtt.exe73⤵
-
\??\c:\bbhbbb.exec:\bbhbbb.exe74⤵
-
\??\c:\ddppd.exec:\ddppd.exe75⤵
-
\??\c:\ffxrrrl.exec:\ffxrrrl.exe76⤵
-
\??\c:\3nnhbb.exec:\3nnhbb.exe77⤵
-
\??\c:\jvddp.exec:\jvddp.exe78⤵
-
\??\c:\dvvdv.exec:\dvvdv.exe79⤵
-
\??\c:\3rxrlll.exec:\3rxrlll.exe80⤵
-
\??\c:\bhhbtt.exec:\bhhbtt.exe81⤵
-
\??\c:\3bbbtt.exec:\3bbbtt.exe82⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe83⤵
-
\??\c:\1ffxrrr.exec:\1ffxrrr.exe84⤵
-
\??\c:\rfllffx.exec:\rfllffx.exe85⤵
-
\??\c:\hbbbbb.exec:\hbbbbb.exe86⤵
-
\??\c:\5nhbhb.exec:\5nhbhb.exe87⤵
-
\??\c:\jvdvv.exec:\jvdvv.exe88⤵
-
\??\c:\5dddv.exec:\5dddv.exe89⤵
-
\??\c:\llrrlrl.exec:\llrrlrl.exe90⤵
-
\??\c:\rxrrlll.exec:\rxrrlll.exe91⤵
-
\??\c:\tbbtnn.exec:\tbbtnn.exe92⤵
-
\??\c:\9jdvv.exec:\9jdvv.exe93⤵
-
\??\c:\3jpjd.exec:\3jpjd.exe94⤵
-
\??\c:\llrlfff.exec:\llrlfff.exe95⤵
-
\??\c:\9lxrxxx.exec:\9lxrxxx.exe96⤵
-
\??\c:\tbnbtt.exec:\tbnbtt.exe97⤵
-
\??\c:\pdjjv.exec:\pdjjv.exe98⤵
-
\??\c:\vpvvv.exec:\vpvvv.exe99⤵
-
\??\c:\9lrlffx.exec:\9lrlffx.exe100⤵
-
\??\c:\1lrlllf.exec:\1lrlllf.exe101⤵
-
\??\c:\thnhbh.exec:\thnhbh.exe102⤵
-
\??\c:\3bhbnb.exec:\3bhbnb.exe103⤵
-
\??\c:\vpdvj.exec:\vpdvj.exe104⤵
-
\??\c:\vppjd.exec:\vppjd.exe105⤵
-
\??\c:\9rxrffx.exec:\9rxrffx.exe106⤵
-
\??\c:\nbhbtt.exec:\nbhbtt.exe107⤵
-
\??\c:\tnbttn.exec:\tnbttn.exe108⤵
-
\??\c:\1djdj.exec:\1djdj.exe109⤵
-
\??\c:\vjvjd.exec:\vjvjd.exe110⤵
-
\??\c:\fxrlrrf.exec:\fxrlrrf.exe111⤵
-
\??\c:\bhbbtt.exec:\bhbbtt.exe112⤵
-
\??\c:\bnnnhh.exec:\bnnnhh.exe113⤵
-
\??\c:\pvvjv.exec:\pvvjv.exe114⤵
-
\??\c:\1jvvj.exec:\1jvvj.exe115⤵
-
\??\c:\1llfxrr.exec:\1llfxrr.exe116⤵
-
\??\c:\rxflflx.exec:\rxflflx.exe117⤵
-
\??\c:\bnbtnh.exec:\bnbtnh.exe118⤵
-
\??\c:\vdvdp.exec:\vdvdp.exe119⤵
-
\??\c:\jpvpj.exec:\jpvpj.exe120⤵
-
\??\c:\lxrlxxx.exec:\lxrlxxx.exe121⤵
-
\??\c:\fflfffx.exec:\fflfffx.exe122⤵
-
\??\c:\nnhhbb.exec:\nnhhbb.exe123⤵
-
\??\c:\nhthbn.exec:\nhthbn.exe124⤵
-
\??\c:\7vjjd.exec:\7vjjd.exe125⤵
-
\??\c:\vvjdv.exec:\vvjdv.exe126⤵
-
\??\c:\7rxxlxx.exec:\7rxxlxx.exe127⤵
-
\??\c:\pjppv.exec:\pjppv.exe128⤵
-
\??\c:\ppdvj.exec:\ppdvj.exe129⤵
-
\??\c:\9llfrrl.exec:\9llfrrl.exe130⤵
-
\??\c:\5xrlrxf.exec:\5xrlrxf.exe131⤵
-
\??\c:\bntnnn.exec:\bntnnn.exe132⤵
-
\??\c:\hbttnn.exec:\hbttnn.exe133⤵
-
\??\c:\pvddp.exec:\pvddp.exe134⤵
-
\??\c:\rllfxxr.exec:\rllfxxr.exe135⤵
-
\??\c:\lfxlfrf.exec:\lfxlfrf.exe136⤵
-
\??\c:\hbhbtn.exec:\hbhbtn.exe137⤵
-
\??\c:\jdddv.exec:\jdddv.exe138⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe139⤵
-
\??\c:\3rffxxx.exec:\3rffxxx.exe140⤵
-
\??\c:\xxflrrl.exec:\xxflrrl.exe141⤵
-
\??\c:\btbbhh.exec:\btbbhh.exe142⤵
-
\??\c:\9pvpj.exec:\9pvpj.exe143⤵
-
\??\c:\jpvpp.exec:\jpvpp.exe144⤵
-
\??\c:\7xrlrrl.exec:\7xrlrrl.exe145⤵
-
\??\c:\1lrrlrr.exec:\1lrrlrr.exe146⤵
-
\??\c:\hbttnn.exec:\hbttnn.exe147⤵
-
\??\c:\7hhhtb.exec:\7hhhtb.exe148⤵
-
\??\c:\jjjvp.exec:\jjjvp.exe149⤵
-
\??\c:\lxxrllf.exec:\lxxrllf.exe150⤵
-
\??\c:\1lrrrrr.exec:\1lrrrrr.exe151⤵
-
\??\c:\9nhhhh.exec:\9nhhhh.exe152⤵
-
\??\c:\bnbnhh.exec:\bnbnhh.exe153⤵
-
\??\c:\jjjvp.exec:\jjjvp.exe154⤵
-
\??\c:\9vvjj.exec:\9vvjj.exe155⤵
-
\??\c:\fllfrrr.exec:\fllfrrr.exe156⤵
-
\??\c:\ttnntb.exec:\ttnntb.exe157⤵
-
\??\c:\hnntbh.exec:\hnntbh.exe158⤵
-
\??\c:\5djdd.exec:\5djdd.exe159⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe160⤵
-
\??\c:\dpjdp.exec:\dpjdp.exe161⤵
-
\??\c:\lxfxxrx.exec:\lxfxxrx.exe162⤵
-
\??\c:\5rrlffx.exec:\5rrlffx.exe163⤵
-
\??\c:\9hhhbb.exec:\9hhhbb.exe164⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe165⤵
-
\??\c:\rfxrrll.exec:\rfxrrll.exe166⤵
-
\??\c:\thhnhh.exec:\thhnhh.exe167⤵
-
\??\c:\xxllrxr.exec:\xxllrxr.exe168⤵
-
\??\c:\rlrxxxf.exec:\rlrxxxf.exe169⤵
-
\??\c:\bbbbtt.exec:\bbbbtt.exe170⤵
-
\??\c:\rxflfrr.exec:\rxflfrr.exe171⤵
-
\??\c:\7xlrrrl.exec:\7xlrrrl.exe172⤵
-
\??\c:\ntbbhh.exec:\ntbbhh.exe173⤵
-
\??\c:\dpjdv.exec:\dpjdv.exe174⤵
-
\??\c:\1dvjd.exec:\1dvjd.exe175⤵
-
\??\c:\flrxflr.exec:\flrxflr.exe176⤵
-
\??\c:\fxffxff.exec:\fxffxff.exe177⤵
-
\??\c:\3btnhh.exec:\3btnhh.exe178⤵
-
\??\c:\vjpjv.exec:\vjpjv.exe179⤵
-
\??\c:\pjdvp.exec:\pjdvp.exe180⤵
-
\??\c:\1rrfffx.exec:\1rrfffx.exe181⤵
-
\??\c:\hbnnnn.exec:\hbnnnn.exe182⤵
-
\??\c:\hbtthh.exec:\hbtthh.exe183⤵
-
\??\c:\jpjdv.exec:\jpjdv.exe184⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe185⤵
-
\??\c:\1rfxllf.exec:\1rfxllf.exe186⤵
-
\??\c:\1hbtbb.exec:\1hbtbb.exe187⤵
-
\??\c:\pdpjv.exec:\pdpjv.exe188⤵
-
\??\c:\dvvpd.exec:\dvvpd.exe189⤵
-
\??\c:\5frrrfx.exec:\5frrrfx.exe190⤵
-
\??\c:\llllffx.exec:\llllffx.exe191⤵
-
\??\c:\bbhbhh.exec:\bbhbhh.exe192⤵
-
\??\c:\7tbntn.exec:\7tbntn.exe193⤵
-
\??\c:\jvddp.exec:\jvddp.exe194⤵
-
\??\c:\dpjjd.exec:\dpjjd.exe195⤵
-
\??\c:\fxrlffx.exec:\fxrlffx.exe196⤵
-
\??\c:\flxfxxx.exec:\flxfxxx.exe197⤵
-
\??\c:\bbbbnb.exec:\bbbbnb.exe198⤵
-
\??\c:\9pdvp.exec:\9pdvp.exe199⤵
-
\??\c:\3jjdp.exec:\3jjdp.exe200⤵
-
\??\c:\rffxxxr.exec:\rffxxxr.exe201⤵
-
\??\c:\9nnhtn.exec:\9nnhtn.exe202⤵
-
\??\c:\nthhtn.exec:\nthhtn.exe203⤵
-
\??\c:\djvvv.exec:\djvvv.exe204⤵
-
\??\c:\dvdvj.exec:\dvdvj.exe205⤵
-
\??\c:\rfffrrl.exec:\rfffrrl.exe206⤵
-
\??\c:\rrxlfrl.exec:\rrxlfrl.exe207⤵
-
\??\c:\7thnnn.exec:\7thnnn.exe208⤵
-
\??\c:\bnhnnt.exec:\bnhnnt.exe209⤵
-
\??\c:\vvjdv.exec:\vvjdv.exe210⤵
-
\??\c:\1xfxlll.exec:\1xfxlll.exe211⤵
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe212⤵
-
\??\c:\3ntnhb.exec:\3ntnhb.exe213⤵
-
\??\c:\bhnhnn.exec:\bhnhnn.exe214⤵
-
\??\c:\3vvpd.exec:\3vvpd.exe215⤵
-
\??\c:\djpjv.exec:\djpjv.exe216⤵
-
\??\c:\flrrffx.exec:\flrrffx.exe217⤵
-
\??\c:\hnthbt.exec:\hnthbt.exe218⤵
-
\??\c:\btnhtt.exec:\btnhtt.exe219⤵
-
\??\c:\9djdj.exec:\9djdj.exe220⤵
-
\??\c:\5jjdp.exec:\5jjdp.exe221⤵
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe222⤵
-
\??\c:\flrlxxr.exec:\flrlxxr.exe223⤵
-
\??\c:\9ttnnh.exec:\9ttnnh.exe224⤵
-
\??\c:\bnttbb.exec:\bnttbb.exe225⤵
-
\??\c:\1ppjd.exec:\1ppjd.exe226⤵
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe227⤵
-
\??\c:\llrlllf.exec:\llrlllf.exe228⤵
-
\??\c:\lfrlrrr.exec:\lfrlrrr.exe229⤵
-
\??\c:\3nttnn.exec:\3nttnn.exe230⤵
-
\??\c:\3ppjj.exec:\3ppjj.exe231⤵
-
\??\c:\3lrrlll.exec:\3lrrlll.exe232⤵
-
\??\c:\xflfxlf.exec:\xflfxlf.exe233⤵
-
\??\c:\3bttnb.exec:\3bttnb.exe234⤵
-
\??\c:\nthhnt.exec:\nthhnt.exe235⤵
-
\??\c:\1jppd.exec:\1jppd.exe236⤵
-
\??\c:\jddjv.exec:\jddjv.exe237⤵
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe238⤵
-
\??\c:\fxxrlxr.exec:\fxxrlxr.exe239⤵
-
\??\c:\rffxrrl.exec:\rffxrrl.exe240⤵
-
\??\c:\nhtttt.exec:\nhtttt.exe241⤵