Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 18:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a.exe
-
Size
70KB
-
MD5
126ad0a1e47f8bc52a88946a5ffd7ca1
-
SHA1
9123cbea23bdf4c65b4070769635169186df5b9d
-
SHA256
07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a
-
SHA512
01955836c539db039526217f2248b553c3bb249296b1d06eefdd6f6d8f50ebaf43b70f95ffe347e44d031878c26a6e88448159d3154c2744e4b078d762dcceb4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgUVyiAnfp:ymb3NkkiQ3mdBjFIgUEBp
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
Processes:
resource yara_rule behavioral2/memory/2920-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/992-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/992-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-50-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4208-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2472-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/968-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1956-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 31 IoCs
Processes:
resource yara_rule behavioral2/memory/2920-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2964-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1732-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/992-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5000-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5000-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5000-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4296-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4208-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2472-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/64-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/64-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/64-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4528-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/968-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2136-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3036-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1956-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1724-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4964-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3364-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4052-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2156-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4868-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3208-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1540-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/464-186-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3232-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2548-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4808-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3680-208-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
bbnnht.exe1vjjj.exerlllflr.exerflfflf.exepdddp.exerxfxfrr.exebbhhhh.exedpddd.exejjppv.exerlxrlrr.exejvjvd.exe5lfflrf.exerrfffll.exentnnhh.exe5ppjd.exexfffrxf.exe1rfllrr.exebhnnnn.exedpdvv.exexfllfrx.exeflxxfxf.exebhnnnh.exejpdjj.exexrflflf.exenhhhbt.exepvvdd.exepvpvv.exefxllflf.exenhnnhh.exevvvpj.exe9rrfxrf.exehhbtbh.exevvpdv.exejdjpp.exefxxfffl.exehnhhnn.exejdvvv.exe3jpjj.exe7rllrxl.exe9htnhh.exedvpjd.exepjjdp.exefxxxlrr.exehbhhhn.exettbtnn.exedvpjv.exe5pvdv.exerxlfffx.exenhbbtt.exehtbthb.exe3jpjv.exe1xfxrrl.exerxxrrxx.exebtnnnt.exenhhhnb.exe1dvvp.exeppjdp.exerxxfffl.exehthhhh.exehhnnhh.exepjpjv.exepvdvj.exe3lffxxr.exerllfffx.exepid process 2964 bbnnht.exe 992 1vjjj.exe 1732 rlllflr.exe 5000 rflfflf.exe 640 pdddp.exe 4296 rxfxfrr.exe 4208 bbhhhh.exe 2472 dpddd.exe 64 jjppv.exe 4528 rlxrlrr.exe 968 jvjvd.exe 2136 5lfflrf.exe 3036 rrfffll.exe 1876 ntnnhh.exe 1956 5ppjd.exe 376 xfffrxf.exe 1724 1rfllrr.exe 4964 bhnnnn.exe 3364 dpdvv.exe 1660 xfllfrx.exe 4052 flxxfxf.exe 2156 bhnnnh.exe 4412 jpdjj.exe 4868 xrflflf.exe 3208 nhhhbt.exe 1540 pvvdd.exe 464 pvpvv.exe 2548 fxllflf.exe 3232 nhnnhh.exe 4808 vvvpj.exe 3680 9rrfxrf.exe 2084 hhbtbh.exe 5048 vvpdv.exe 2884 jdjpp.exe 2320 fxxfffl.exe 4516 hnhhnn.exe 2740 jdvvv.exe 4020 3jpjj.exe 4280 7rllrxl.exe 4380 9htnhh.exe 636 dvpjd.exe 4496 pjjdp.exe 1732 fxxxlrr.exe 4404 hbhhhn.exe 3012 ttbtnn.exe 2264 dvpjv.exe 4588 5pvdv.exe 2488 rxlfffx.exe 496 nhbbtt.exe 2448 htbthb.exe 2452 3jpjv.exe 1072 1xfxrrl.exe 4528 rxxrrxx.exe 4540 btnnnt.exe 5032 nhhhnb.exe 1500 1dvvp.exe 4836 ppjdp.exe 2852 rxxfffl.exe 4872 hthhhh.exe 4740 hhnnhh.exe 376 pjpjv.exe 3412 pvdvj.exe 4036 3lffxxr.exe 3132 rllfffx.exe -
Processes:
resource yara_rule behavioral2/memory/2920-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2472-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/968-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a.exebbnnht.exe1vjjj.exerlllflr.exerflfflf.exepdddp.exerxfxfrr.exebbhhhh.exedpddd.exejjppv.exerlxrlrr.exejvjvd.exe5lfflrf.exerrfffll.exentnnhh.exe5ppjd.exexfffrxf.exe1rfllrr.exebhnnnn.exedpdvv.exexfllfrx.exeflxxfxf.exedescription pid process target process PID 2920 wrote to memory of 2964 2920 07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a.exe bbnnht.exe PID 2920 wrote to memory of 2964 2920 07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a.exe bbnnht.exe PID 2920 wrote to memory of 2964 2920 07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a.exe bbnnht.exe PID 2964 wrote to memory of 992 2964 bbnnht.exe 1vjjj.exe PID 2964 wrote to memory of 992 2964 bbnnht.exe 1vjjj.exe PID 2964 wrote to memory of 992 2964 bbnnht.exe 1vjjj.exe PID 992 wrote to memory of 1732 992 1vjjj.exe rlllflr.exe PID 992 wrote to memory of 1732 992 1vjjj.exe rlllflr.exe PID 992 wrote to memory of 1732 992 1vjjj.exe rlllflr.exe PID 1732 wrote to memory of 5000 1732 rlllflr.exe rflfflf.exe PID 1732 wrote to memory of 5000 1732 rlllflr.exe rflfflf.exe PID 1732 wrote to memory of 5000 1732 rlllflr.exe rflfflf.exe PID 5000 wrote to memory of 640 5000 rflfflf.exe pdddp.exe PID 5000 wrote to memory of 640 5000 rflfflf.exe pdddp.exe PID 5000 wrote to memory of 640 5000 rflfflf.exe pdddp.exe PID 640 wrote to memory of 4296 640 pdddp.exe rxfxfrr.exe PID 640 wrote to memory of 4296 640 pdddp.exe rxfxfrr.exe PID 640 wrote to memory of 4296 640 pdddp.exe rxfxfrr.exe PID 4296 wrote to memory of 4208 4296 rxfxfrr.exe bbhhhh.exe PID 4296 wrote to memory of 4208 4296 rxfxfrr.exe bbhhhh.exe PID 4296 wrote to memory of 4208 4296 rxfxfrr.exe bbhhhh.exe PID 4208 wrote to memory of 2472 4208 bbhhhh.exe dpddd.exe PID 4208 wrote to memory of 2472 4208 bbhhhh.exe dpddd.exe PID 4208 wrote to memory of 2472 4208 bbhhhh.exe dpddd.exe PID 2472 wrote to memory of 64 2472 dpddd.exe jjppv.exe PID 2472 wrote to memory of 64 2472 dpddd.exe jjppv.exe PID 2472 wrote to memory of 64 2472 dpddd.exe jjppv.exe PID 64 wrote to memory of 4528 64 jjppv.exe rlxrlrr.exe PID 64 wrote to memory of 4528 64 jjppv.exe rlxrlrr.exe PID 64 wrote to memory of 4528 64 jjppv.exe rlxrlrr.exe PID 4528 wrote to memory of 968 4528 rlxrlrr.exe jvjvd.exe PID 4528 wrote to memory of 968 4528 rlxrlrr.exe jvjvd.exe PID 4528 wrote to memory of 968 4528 rlxrlrr.exe jvjvd.exe PID 968 wrote to memory of 2136 968 jvjvd.exe 5lfflrf.exe PID 968 wrote to memory of 2136 968 jvjvd.exe 5lfflrf.exe PID 968 wrote to memory of 2136 968 jvjvd.exe 5lfflrf.exe PID 2136 wrote to memory of 3036 2136 5lfflrf.exe rrfffll.exe PID 2136 wrote to memory of 3036 2136 5lfflrf.exe rrfffll.exe PID 2136 wrote to memory of 3036 2136 5lfflrf.exe rrfffll.exe PID 3036 wrote to memory of 1876 3036 rrfffll.exe ntnnhh.exe PID 3036 wrote to memory of 1876 3036 rrfffll.exe ntnnhh.exe PID 3036 wrote to memory of 1876 3036 rrfffll.exe ntnnhh.exe PID 1876 wrote to memory of 1956 1876 ntnnhh.exe 5ppjd.exe PID 1876 wrote to memory of 1956 1876 ntnnhh.exe 5ppjd.exe PID 1876 wrote to memory of 1956 1876 ntnnhh.exe 5ppjd.exe PID 1956 wrote to memory of 376 1956 5ppjd.exe xfffrxf.exe PID 1956 wrote to memory of 376 1956 5ppjd.exe xfffrxf.exe PID 1956 wrote to memory of 376 1956 5ppjd.exe xfffrxf.exe PID 376 wrote to memory of 1724 376 xfffrxf.exe 1rfllrr.exe PID 376 wrote to memory of 1724 376 xfffrxf.exe 1rfllrr.exe PID 376 wrote to memory of 1724 376 xfffrxf.exe 1rfllrr.exe PID 1724 wrote to memory of 4964 1724 1rfllrr.exe bhnnnn.exe PID 1724 wrote to memory of 4964 1724 1rfllrr.exe bhnnnn.exe PID 1724 wrote to memory of 4964 1724 1rfllrr.exe bhnnnn.exe PID 4964 wrote to memory of 3364 4964 bhnnnn.exe dpdvv.exe PID 4964 wrote to memory of 3364 4964 bhnnnn.exe dpdvv.exe PID 4964 wrote to memory of 3364 4964 bhnnnn.exe dpdvv.exe PID 3364 wrote to memory of 1660 3364 dpdvv.exe xfllfrx.exe PID 3364 wrote to memory of 1660 3364 dpdvv.exe xfllfrx.exe PID 3364 wrote to memory of 1660 3364 dpdvv.exe xfllfrx.exe PID 1660 wrote to memory of 4052 1660 xfllfrx.exe flxxfxf.exe PID 1660 wrote to memory of 4052 1660 xfllfrx.exe flxxfxf.exe PID 1660 wrote to memory of 4052 1660 xfllfrx.exe flxxfxf.exe PID 4052 wrote to memory of 2156 4052 flxxfxf.exe bhnnnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a.exe"C:\Users\Admin\AppData\Local\Temp\07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\bbnnht.exec:\bbnnht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1vjjj.exec:\1vjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlllflr.exec:\rlllflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rflfflf.exec:\rflfflf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdddp.exec:\pdddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxfxfrr.exec:\rxfxfrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbhhhh.exec:\bbhhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpddd.exec:\dpddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjppv.exec:\jjppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxrlrr.exec:\rlxrlrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvjvd.exec:\jvjvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5lfflrf.exec:\5lfflrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrfffll.exec:\rrfffll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntnnhh.exec:\ntnnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5ppjd.exec:\5ppjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfffrxf.exec:\xfffrxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1rfllrr.exec:\1rfllrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhnnnn.exec:\bhnnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpdvv.exec:\dpdvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfllfrx.exec:\xfllfrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flxxfxf.exec:\flxxfxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhnnnh.exec:\bhnnnh.exe23⤵
- Executes dropped EXE
-
\??\c:\jpdjj.exec:\jpdjj.exe24⤵
- Executes dropped EXE
-
\??\c:\xrflflf.exec:\xrflflf.exe25⤵
- Executes dropped EXE
-
\??\c:\nhhhbt.exec:\nhhhbt.exe26⤵
- Executes dropped EXE
-
\??\c:\pvvdd.exec:\pvvdd.exe27⤵
- Executes dropped EXE
-
\??\c:\pvpvv.exec:\pvpvv.exe28⤵
- Executes dropped EXE
-
\??\c:\fxllflf.exec:\fxllflf.exe29⤵
- Executes dropped EXE
-
\??\c:\nhnnhh.exec:\nhnnhh.exe30⤵
- Executes dropped EXE
-
\??\c:\vvvpj.exec:\vvvpj.exe31⤵
- Executes dropped EXE
-
\??\c:\9rrfxrf.exec:\9rrfxrf.exe32⤵
- Executes dropped EXE
-
\??\c:\hhbtbh.exec:\hhbtbh.exe33⤵
- Executes dropped EXE
-
\??\c:\vvpdv.exec:\vvpdv.exe34⤵
- Executes dropped EXE
-
\??\c:\jdjpp.exec:\jdjpp.exe35⤵
- Executes dropped EXE
-
\??\c:\fxxfffl.exec:\fxxfffl.exe36⤵
- Executes dropped EXE
-
\??\c:\hnhhnn.exec:\hnhhnn.exe37⤵
- Executes dropped EXE
-
\??\c:\jdvvv.exec:\jdvvv.exe38⤵
- Executes dropped EXE
-
\??\c:\3jpjj.exec:\3jpjj.exe39⤵
- Executes dropped EXE
-
\??\c:\7rllrxl.exec:\7rllrxl.exe40⤵
- Executes dropped EXE
-
\??\c:\9htnhh.exec:\9htnhh.exe41⤵
- Executes dropped EXE
-
\??\c:\dvpjd.exec:\dvpjd.exe42⤵
- Executes dropped EXE
-
\??\c:\pjjdp.exec:\pjjdp.exe43⤵
- Executes dropped EXE
-
\??\c:\fxxxlrr.exec:\fxxxlrr.exe44⤵
- Executes dropped EXE
-
\??\c:\hbhhhn.exec:\hbhhhn.exe45⤵
- Executes dropped EXE
-
\??\c:\ttbtnn.exec:\ttbtnn.exe46⤵
- Executes dropped EXE
-
\??\c:\dvpjv.exec:\dvpjv.exe47⤵
- Executes dropped EXE
-
\??\c:\5pvdv.exec:\5pvdv.exe48⤵
- Executes dropped EXE
-
\??\c:\rxlfffx.exec:\rxlfffx.exe49⤵
- Executes dropped EXE
-
\??\c:\nhbbtt.exec:\nhbbtt.exe50⤵
- Executes dropped EXE
-
\??\c:\htbthb.exec:\htbthb.exe51⤵
- Executes dropped EXE
-
\??\c:\3jpjv.exec:\3jpjv.exe52⤵
- Executes dropped EXE
-
\??\c:\1xfxrrl.exec:\1xfxrrl.exe53⤵
- Executes dropped EXE
-
\??\c:\rxxrrxx.exec:\rxxrrxx.exe54⤵
- Executes dropped EXE
-
\??\c:\btnnnt.exec:\btnnnt.exe55⤵
- Executes dropped EXE
-
\??\c:\nhhhnb.exec:\nhhhnb.exe56⤵
- Executes dropped EXE
-
\??\c:\1dvvp.exec:\1dvvp.exe57⤵
- Executes dropped EXE
-
\??\c:\ppjdp.exec:\ppjdp.exe58⤵
- Executes dropped EXE
-
\??\c:\rxxfffl.exec:\rxxfffl.exe59⤵
- Executes dropped EXE
-
\??\c:\hthhhh.exec:\hthhhh.exe60⤵
- Executes dropped EXE
-
\??\c:\hhnnhh.exec:\hhnnhh.exe61⤵
- Executes dropped EXE
-
\??\c:\pjpjv.exec:\pjpjv.exe62⤵
- Executes dropped EXE
-
\??\c:\pvdvj.exec:\pvdvj.exe63⤵
- Executes dropped EXE
-
\??\c:\3lffxxr.exec:\3lffxxr.exe64⤵
- Executes dropped EXE
-
\??\c:\rllfffx.exec:\rllfffx.exe65⤵
- Executes dropped EXE
-
\??\c:\hbnntn.exec:\hbnntn.exe66⤵
-
\??\c:\htbhtt.exec:\htbhtt.exe67⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe68⤵
-
\??\c:\dvpjd.exec:\dvpjd.exe69⤵
-
\??\c:\jjvpj.exec:\jjvpj.exe70⤵
-
\??\c:\fxfxllr.exec:\fxfxllr.exe71⤵
-
\??\c:\llfflrr.exec:\llfflrr.exe72⤵
-
\??\c:\5ttbbb.exec:\5ttbbb.exe73⤵
-
\??\c:\3nttth.exec:\3nttth.exe74⤵
-
\??\c:\vjvvv.exec:\vjvvv.exe75⤵
-
\??\c:\1xrlffx.exec:\1xrlffx.exe76⤵
-
\??\c:\fffrllx.exec:\fffrllx.exe77⤵
-
\??\c:\tnnnhn.exec:\tnnnhn.exe78⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe79⤵
-
\??\c:\lxxlxrr.exec:\lxxlxrr.exe80⤵
-
\??\c:\ffrfxrr.exec:\ffrfxrr.exe81⤵
-
\??\c:\tthhhb.exec:\tthhhb.exe82⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe83⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe84⤵
-
\??\c:\rlrrrff.exec:\rlrrrff.exe85⤵
-
\??\c:\ttbbtt.exec:\ttbbtt.exe86⤵
-
\??\c:\ppddd.exec:\ppddd.exe87⤵
-
\??\c:\lllfrll.exec:\lllfrll.exe88⤵
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe89⤵
-
\??\c:\nhbhbn.exec:\nhbhbn.exe90⤵
-
\??\c:\ppvpj.exec:\ppvpj.exe91⤵
-
\??\c:\pdvpv.exec:\pdvpv.exe92⤵
-
\??\c:\xffllxx.exec:\xffllxx.exe93⤵
-
\??\c:\hhttbn.exec:\hhttbn.exe94⤵
-
\??\c:\ppjjv.exec:\ppjjv.exe95⤵
-
\??\c:\5vpvv.exec:\5vpvv.exe96⤵
-
\??\c:\xrxrfrr.exec:\xrxrfrr.exe97⤵
-
\??\c:\ttbtnn.exec:\ttbtnn.exe98⤵
-
\??\c:\jdddv.exec:\jdddv.exe99⤵
-
\??\c:\jddjj.exec:\jddjj.exe100⤵
-
\??\c:\ffrxffr.exec:\ffrxffr.exe101⤵
-
\??\c:\thhbbt.exec:\thhbbt.exe102⤵
-
\??\c:\nbbbbb.exec:\nbbbbb.exe103⤵
-
\??\c:\jpjdv.exec:\jpjdv.exe104⤵
-
\??\c:\fffxxll.exec:\fffxxll.exe105⤵
-
\??\c:\7xxxrxx.exec:\7xxxrxx.exe106⤵
-
\??\c:\nbhbbt.exec:\nbhbbt.exe107⤵
-
\??\c:\jjppp.exec:\jjppp.exe108⤵
-
\??\c:\9dppv.exec:\9dppv.exe109⤵
-
\??\c:\rrllfff.exec:\rrllfff.exe110⤵
-
\??\c:\3lffffx.exec:\3lffffx.exe111⤵
-
\??\c:\btttnt.exec:\btttnt.exe112⤵
-
\??\c:\ddddv.exec:\ddddv.exe113⤵
-
\??\c:\3xlffff.exec:\3xlffff.exe114⤵
-
\??\c:\7frxfff.exec:\7frxfff.exe115⤵
-
\??\c:\bhnhnt.exec:\bhnhnt.exe116⤵
-
\??\c:\9vvpj.exec:\9vvpj.exe117⤵
-
\??\c:\pjvpj.exec:\pjvpj.exe118⤵
-
\??\c:\7xllffx.exec:\7xllffx.exe119⤵
-
\??\c:\xrlrllf.exec:\xrlrllf.exe120⤵
-
\??\c:\djjdd.exec:\djjdd.exe121⤵
-
\??\c:\lllfxrr.exec:\lllfxrr.exe122⤵
-
\??\c:\3rxxffx.exec:\3rxxffx.exe123⤵
-
\??\c:\tnbhtb.exec:\tnbhtb.exe124⤵
-
\??\c:\pvddv.exec:\pvddv.exe125⤵
-
\??\c:\jpdvp.exec:\jpdvp.exe126⤵
-
\??\c:\lrxxxfl.exec:\lrxxxfl.exe127⤵
-
\??\c:\5xfffff.exec:\5xfffff.exe128⤵
-
\??\c:\thnntb.exec:\thnntb.exe129⤵
-
\??\c:\thnnnn.exec:\thnnnn.exe130⤵
-
\??\c:\jdvpp.exec:\jdvpp.exe131⤵
-
\??\c:\ppjvp.exec:\ppjvp.exe132⤵
-
\??\c:\1flffff.exec:\1flffff.exe133⤵
-
\??\c:\fxllrrr.exec:\fxllrrr.exe134⤵
-
\??\c:\1ttnhh.exec:\1ttnhh.exe135⤵
-
\??\c:\bnttbh.exec:\bnttbh.exe136⤵
-
\??\c:\vdpjv.exec:\vdpjv.exe137⤵
-
\??\c:\jjdvp.exec:\jjdvp.exe138⤵
-
\??\c:\lfxrlxf.exec:\lfxrlxf.exe139⤵
-
\??\c:\lllfrrf.exec:\lllfrrf.exe140⤵
-
\??\c:\dpppp.exec:\dpppp.exe141⤵
-
\??\c:\ddppv.exec:\ddppv.exe142⤵
-
\??\c:\vvvjv.exec:\vvvjv.exe143⤵
-
\??\c:\7llrrrr.exec:\7llrrrr.exe144⤵
-
\??\c:\ntnnhh.exec:\ntnnhh.exe145⤵
-
\??\c:\btbnhh.exec:\btbnhh.exe146⤵
-
\??\c:\jjjdp.exec:\jjjdp.exe147⤵
-
\??\c:\vdvpd.exec:\vdvpd.exe148⤵
-
\??\c:\lffrllf.exec:\lffrllf.exe149⤵
-
\??\c:\5htthh.exec:\5htthh.exe150⤵
-
\??\c:\bntbnt.exec:\bntbnt.exe151⤵
-
\??\c:\vpvvd.exec:\vpvvd.exe152⤵
-
\??\c:\llxxlfl.exec:\llxxlfl.exe153⤵
-
\??\c:\tnttbh.exec:\tnttbh.exe154⤵
-
\??\c:\jdvvd.exec:\jdvvd.exe155⤵
-
\??\c:\fflrlrf.exec:\fflrlrf.exe156⤵
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe157⤵
-
\??\c:\htbttn.exec:\htbttn.exe158⤵
-
\??\c:\jjjjp.exec:\jjjjp.exe159⤵
-
\??\c:\7pddp.exec:\7pddp.exe160⤵
-
\??\c:\llrrrxf.exec:\llrrrxf.exe161⤵
-
\??\c:\9nhnnt.exec:\9nhnnt.exe162⤵
-
\??\c:\9jvpp.exec:\9jvpp.exe163⤵
-
\??\c:\hthnnb.exec:\hthnnb.exe164⤵
-
\??\c:\jdvvd.exec:\jdvvd.exe165⤵
-
\??\c:\jjjjd.exec:\jjjjd.exe166⤵
-
\??\c:\tbhntb.exec:\tbhntb.exe167⤵
-
\??\c:\9jjjp.exec:\9jjjp.exe168⤵
-
\??\c:\ffxflrx.exec:\ffxflrx.exe169⤵
-
\??\c:\hhhtnh.exec:\hhhtnh.exe170⤵
-
\??\c:\pdppv.exec:\pdppv.exe171⤵
-
\??\c:\pjvjj.exec:\pjvjj.exe172⤵
-
\??\c:\xfffxxx.exec:\xfffxxx.exe173⤵
-
\??\c:\rrxxxxf.exec:\rrxxxxf.exe174⤵
-
\??\c:\tnhttt.exec:\tnhttt.exe175⤵
-
\??\c:\nbnhtt.exec:\nbnhtt.exe176⤵
-
\??\c:\3jppj.exec:\3jppj.exe177⤵
-
\??\c:\dvpjv.exec:\dvpjv.exe178⤵
-
\??\c:\9vjpv.exec:\9vjpv.exe179⤵
-
\??\c:\fxlfrxr.exec:\fxlfrxr.exe180⤵
-
\??\c:\llrffxf.exec:\llrffxf.exe181⤵
-
\??\c:\bbttnt.exec:\bbttnt.exe182⤵
-
\??\c:\tthnbh.exec:\tthnbh.exe183⤵
-
\??\c:\nbnhbh.exec:\nbnhbh.exe184⤵
-
\??\c:\9vpvd.exec:\9vpvd.exe185⤵
-
\??\c:\jdjjp.exec:\jdjjp.exe186⤵
-
\??\c:\xrflxfr.exec:\xrflxfr.exe187⤵
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe188⤵
-
\??\c:\tbtbnb.exec:\tbtbnb.exe189⤵
-
\??\c:\tnhhnb.exec:\tnhhnb.exe190⤵
-
\??\c:\3pjjj.exec:\3pjjj.exe191⤵
-
\??\c:\9dvpv.exec:\9dvpv.exe192⤵
-
\??\c:\xxflrrr.exec:\xxflrrr.exe193⤵
-
\??\c:\5xfffff.exec:\5xfffff.exe194⤵
-
\??\c:\7lxxfll.exec:\7lxxfll.exe195⤵
-
\??\c:\bbnbhn.exec:\bbnbhn.exe196⤵
-
\??\c:\ttbbtt.exec:\ttbbtt.exe197⤵
-
\??\c:\9jvvp.exec:\9jvvp.exe198⤵
-
\??\c:\djvvv.exec:\djvvv.exe199⤵
-
\??\c:\lflffff.exec:\lflffff.exe200⤵
-
\??\c:\lrlfxxx.exec:\lrlfxxx.exe201⤵
-
\??\c:\ffllfll.exec:\ffllfll.exe202⤵
-
\??\c:\9hbbtb.exec:\9hbbtb.exe203⤵
-
\??\c:\ddjjd.exec:\ddjjd.exe204⤵
-
\??\c:\ppppp.exec:\ppppp.exe205⤵
-
\??\c:\xrffxff.exec:\xrffxff.exe206⤵
-
\??\c:\hnbbtt.exec:\hnbbtt.exe207⤵
-
\??\c:\ttthbh.exec:\ttthbh.exe208⤵
-
\??\c:\hnttbb.exec:\hnttbb.exe209⤵
-
\??\c:\jdpvd.exec:\jdpvd.exe210⤵
-
\??\c:\ddjdv.exec:\ddjdv.exe211⤵
-
\??\c:\7xffxrl.exec:\7xffxrl.exe212⤵
-
\??\c:\xrffllr.exec:\xrffllr.exe213⤵
-
\??\c:\ttbhtb.exec:\ttbhtb.exe214⤵
-
\??\c:\hbnnnt.exec:\hbnnnt.exe215⤵
-
\??\c:\thbbth.exec:\thbbth.exe216⤵
-
\??\c:\7jdvp.exec:\7jdvp.exe217⤵
-
\??\c:\dvjjv.exec:\dvjjv.exe218⤵
-
\??\c:\fffffff.exec:\fffffff.exe219⤵
-
\??\c:\rxlllll.exec:\rxlllll.exe220⤵
-
\??\c:\7hhnhn.exec:\7hhnhn.exe221⤵
-
\??\c:\nntthn.exec:\nntthn.exe222⤵
-
\??\c:\nhnnhn.exec:\nhnnhn.exe223⤵
-
\??\c:\pjvvj.exec:\pjvvj.exe224⤵
-
\??\c:\5jpjj.exec:\5jpjj.exe225⤵
-
\??\c:\1rffxfl.exec:\1rffxfl.exe226⤵
-
\??\c:\fflllxx.exec:\fflllxx.exe227⤵
-
\??\c:\btbbbn.exec:\btbbbn.exe228⤵
-
\??\c:\ddjjj.exec:\ddjjj.exe229⤵
-
\??\c:\vvddd.exec:\vvddd.exe230⤵
-
\??\c:\1vppv.exec:\1vppv.exe231⤵
-
\??\c:\rrffrrf.exec:\rrffrrf.exe232⤵
-
\??\c:\llfflrf.exec:\llfflrf.exe233⤵
-
\??\c:\bntbhn.exec:\bntbhn.exe234⤵
-
\??\c:\hnttnt.exec:\hnttnt.exe235⤵
-
\??\c:\jvjpj.exec:\jvjpj.exe236⤵
-
\??\c:\vvjdd.exec:\vvjdd.exe237⤵
-
\??\c:\xxrxrfl.exec:\xxrxrfl.exe238⤵
-
\??\c:\5ttnnh.exec:\5ttnnh.exe239⤵
-
\??\c:\nthhtt.exec:\nthhtt.exe240⤵
-
\??\c:\dppjj.exec:\dppjj.exe241⤵