Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 18:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0790dad2a679c008f966261fe4c66b4492d2b195126360ef626f70506a9e65b6.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
0790dad2a679c008f966261fe4c66b4492d2b195126360ef626f70506a9e65b6.exe
-
Size
149KB
-
MD5
2c22f19eabe55d6f93f6a356630d4cfe
-
SHA1
ba9897e336014b3d8491373a8b51a579041445ad
-
SHA256
0790dad2a679c008f966261fe4c66b4492d2b195126360ef626f70506a9e65b6
-
SHA512
08472155e9c9e2acb7a7a5cd248046c1e8a754c91c72962529c171ef24c6034fd2e8c70c2935ffcb1c8beeb4255acb4bb86786f091cfc50a993718e5d74e75b2
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LAIRUohDmRG08fKkZEU5hkVaqaK6qa50iKV+:n3C9BRo/AIuuOmfDZEU5OVFi5
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/704-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2112-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2120-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 23 IoCs
Processes:
resource yara_rule behavioral2/memory/704-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5056-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4168-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5104-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2480-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1208-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1640-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2112-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3964-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3712-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/368-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4268-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3252-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3952-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/396-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2120-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4208-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4176-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4040-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4180-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/964-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3020-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4904-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
tnttnn.exevdpdp.exe9xrlffx.exethnhbt.exepvjjv.exevvdvv.exerxrfrxf.exenbhbth.exetbnhbh.exepdvjd.exehntthb.exedvvpp.exe5xfxxxx.exehhhhbb.exejvdvp.exe1xffxxx.exenbbnbh.exe7djjj.exefllfxxr.exe7hnnhn.exenbhbtt.exe3rfrlfl.exehbbtbt.exehthbbt.exe5dddp.exe1lfxrrr.exelfxrffx.exetbhbtt.exevvpdd.exentttnb.exehbnnhh.exedvpdv.exelxrxlll.exebbhhhh.exedvdvv.exerxxxrrl.exerlffxrl.exebtnhnt.exetnhbnh.exejddvp.exerllfxll.exerrlfxxf.exehthnhh.exe5pjdv.exevpjvp.exeflxxlxl.exebtbttt.exebnhhbb.exedpjdv.exeflrllfx.exeffllxlr.exebhnnhh.exe3hhbbb.exe1vvpp.exedvpjd.exexlxrfxr.exelfxxrlf.exetnhnbn.exedjppj.exevjpjd.exeflrrllf.exexllfxfx.exehbbbbb.exebbtnhh.exepid process 5056 tnttnn.exe 844 vdpdp.exe 4168 9xrlffx.exe 5104 thnhbt.exe 2480 pvjjv.exe 1208 vvdvv.exe 1640 rxrfrxf.exe 2112 nbhbth.exe 3964 tbnhbh.exe 3712 pdvjd.exe 368 hntthb.exe 4268 dvvpp.exe 3252 5xfxxxx.exe 3488 hhhhbb.exe 2844 jvdvp.exe 3952 1xffxxx.exe 2280 nbbnbh.exe 396 7djjj.exe 2120 fllfxxr.exe 4208 7hnnhn.exe 4176 nbhbtt.exe 3728 3rfrlfl.exe 3024 hbbtbt.exe 4744 hthbbt.exe 4040 5dddp.exe 4180 1lfxrrr.exe 2552 lfxrffx.exe 964 tbhbtt.exe 3200 vvpdd.exe 3020 ntttnb.exe 4904 hbnnhh.exe 656 dvpdv.exe 1444 lxrxlll.exe 220 bbhhhh.exe 4424 dvdvv.exe 704 rxxxrrl.exe 4544 rlffxrl.exe 716 btnhnt.exe 3068 tnhbnh.exe 2368 jddvp.exe 5040 rllfxll.exe 2060 rrlfxxf.exe 2496 hthnhh.exe 4120 5pjdv.exe 3064 vpjvp.exe 668 flxxlxl.exe 2248 btbttt.exe 1744 bnhhbb.exe 2044 dpjdv.exe 4888 flrllfx.exe 1284 ffllxlr.exe 3576 bhnnhh.exe 3740 3hhbbb.exe 4480 1vvpp.exe 856 dvpjd.exe 1836 xlxrfxr.exe 2700 lfxxrlf.exe 4848 tnhnbn.exe 1520 djppj.exe 1596 vjpjd.exe 4324 flrrllf.exe 4584 xllfxfx.exe 1228 hbbbbb.exe 3780 bbtnhh.exe -
Processes:
resource yara_rule behavioral2/memory/704-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2112-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2120-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0790dad2a679c008f966261fe4c66b4492d2b195126360ef626f70506a9e65b6.exetnttnn.exevdpdp.exe9xrlffx.exethnhbt.exepvjjv.exevvdvv.exerxrfrxf.exenbhbth.exetbnhbh.exepdvjd.exehntthb.exedvvpp.exe5xfxxxx.exehhhhbb.exejvdvp.exe1xffxxx.exenbbnbh.exe7djjj.exefllfxxr.exe7hnnhn.exenbhbtt.exedescription pid process target process PID 704 wrote to memory of 5056 704 0790dad2a679c008f966261fe4c66b4492d2b195126360ef626f70506a9e65b6.exe tnttnn.exe PID 704 wrote to memory of 5056 704 0790dad2a679c008f966261fe4c66b4492d2b195126360ef626f70506a9e65b6.exe tnttnn.exe PID 704 wrote to memory of 5056 704 0790dad2a679c008f966261fe4c66b4492d2b195126360ef626f70506a9e65b6.exe tnttnn.exe PID 5056 wrote to memory of 844 5056 tnttnn.exe vdpdp.exe PID 5056 wrote to memory of 844 5056 tnttnn.exe vdpdp.exe PID 5056 wrote to memory of 844 5056 tnttnn.exe vdpdp.exe PID 844 wrote to memory of 4168 844 vdpdp.exe 9xrlffx.exe PID 844 wrote to memory of 4168 844 vdpdp.exe 9xrlffx.exe PID 844 wrote to memory of 4168 844 vdpdp.exe 9xrlffx.exe PID 4168 wrote to memory of 5104 4168 9xrlffx.exe thnhbt.exe PID 4168 wrote to memory of 5104 4168 9xrlffx.exe thnhbt.exe PID 4168 wrote to memory of 5104 4168 9xrlffx.exe thnhbt.exe PID 5104 wrote to memory of 2480 5104 thnhbt.exe pvjjv.exe PID 5104 wrote to memory of 2480 5104 thnhbt.exe pvjjv.exe PID 5104 wrote to memory of 2480 5104 thnhbt.exe pvjjv.exe PID 2480 wrote to memory of 1208 2480 pvjjv.exe vvdvv.exe PID 2480 wrote to memory of 1208 2480 pvjjv.exe vvdvv.exe PID 2480 wrote to memory of 1208 2480 pvjjv.exe vvdvv.exe PID 1208 wrote to memory of 1640 1208 vvdvv.exe rxrfrxf.exe PID 1208 wrote to memory of 1640 1208 vvdvv.exe rxrfrxf.exe PID 1208 wrote to memory of 1640 1208 vvdvv.exe rxrfrxf.exe PID 1640 wrote to memory of 2112 1640 rxrfrxf.exe nbhbth.exe PID 1640 wrote to memory of 2112 1640 rxrfrxf.exe nbhbth.exe PID 1640 wrote to memory of 2112 1640 rxrfrxf.exe nbhbth.exe PID 2112 wrote to memory of 3964 2112 nbhbth.exe tbnhbh.exe PID 2112 wrote to memory of 3964 2112 nbhbth.exe tbnhbh.exe PID 2112 wrote to memory of 3964 2112 nbhbth.exe tbnhbh.exe PID 3964 wrote to memory of 3712 3964 tbnhbh.exe pdvjd.exe PID 3964 wrote to memory of 3712 3964 tbnhbh.exe pdvjd.exe PID 3964 wrote to memory of 3712 3964 tbnhbh.exe pdvjd.exe PID 3712 wrote to memory of 368 3712 pdvjd.exe hntthb.exe PID 3712 wrote to memory of 368 3712 pdvjd.exe hntthb.exe PID 3712 wrote to memory of 368 3712 pdvjd.exe hntthb.exe PID 368 wrote to memory of 4268 368 hntthb.exe dvvpp.exe PID 368 wrote to memory of 4268 368 hntthb.exe dvvpp.exe PID 368 wrote to memory of 4268 368 hntthb.exe dvvpp.exe PID 4268 wrote to memory of 3252 4268 dvvpp.exe 5xfxxxx.exe PID 4268 wrote to memory of 3252 4268 dvvpp.exe 5xfxxxx.exe PID 4268 wrote to memory of 3252 4268 dvvpp.exe 5xfxxxx.exe PID 3252 wrote to memory of 3488 3252 5xfxxxx.exe hhhhbb.exe PID 3252 wrote to memory of 3488 3252 5xfxxxx.exe hhhhbb.exe PID 3252 wrote to memory of 3488 3252 5xfxxxx.exe hhhhbb.exe PID 3488 wrote to memory of 2844 3488 hhhhbb.exe jvdvp.exe PID 3488 wrote to memory of 2844 3488 hhhhbb.exe jvdvp.exe PID 3488 wrote to memory of 2844 3488 hhhhbb.exe jvdvp.exe PID 2844 wrote to memory of 3952 2844 jvdvp.exe 1xffxxx.exe PID 2844 wrote to memory of 3952 2844 jvdvp.exe 1xffxxx.exe PID 2844 wrote to memory of 3952 2844 jvdvp.exe 1xffxxx.exe PID 3952 wrote to memory of 2280 3952 1xffxxx.exe nbbnbh.exe PID 3952 wrote to memory of 2280 3952 1xffxxx.exe nbbnbh.exe PID 3952 wrote to memory of 2280 3952 1xffxxx.exe nbbnbh.exe PID 2280 wrote to memory of 396 2280 nbbnbh.exe 7djjj.exe PID 2280 wrote to memory of 396 2280 nbbnbh.exe 7djjj.exe PID 2280 wrote to memory of 396 2280 nbbnbh.exe 7djjj.exe PID 396 wrote to memory of 2120 396 7djjj.exe fllfxxr.exe PID 396 wrote to memory of 2120 396 7djjj.exe fllfxxr.exe PID 396 wrote to memory of 2120 396 7djjj.exe fllfxxr.exe PID 2120 wrote to memory of 4208 2120 fllfxxr.exe 7hnnhn.exe PID 2120 wrote to memory of 4208 2120 fllfxxr.exe 7hnnhn.exe PID 2120 wrote to memory of 4208 2120 fllfxxr.exe 7hnnhn.exe PID 4208 wrote to memory of 4176 4208 7hnnhn.exe nbhbtt.exe PID 4208 wrote to memory of 4176 4208 7hnnhn.exe nbhbtt.exe PID 4208 wrote to memory of 4176 4208 7hnnhn.exe nbhbtt.exe PID 4176 wrote to memory of 3728 4176 nbhbtt.exe 3rfrlfl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0790dad2a679c008f966261fe4c66b4492d2b195126360ef626f70506a9e65b6.exe"C:\Users\Admin\AppData\Local\Temp\0790dad2a679c008f966261fe4c66b4492d2b195126360ef626f70506a9e65b6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\tnttnn.exec:\tnttnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdpdp.exec:\vdpdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9xrlffx.exec:\9xrlffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thnhbt.exec:\thnhbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvjjv.exec:\pvjjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvdvv.exec:\vvdvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxrfrxf.exec:\rxrfrxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbhbth.exec:\nbhbth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbnhbh.exec:\tbnhbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdvjd.exec:\pdvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hntthb.exec:\hntthb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvvpp.exec:\dvvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5xfxxxx.exec:\5xfxxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhhbb.exec:\hhhhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvdvp.exec:\jvdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1xffxxx.exec:\1xffxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbbnbh.exec:\nbbnbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7djjj.exec:\7djjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fllfxxr.exec:\fllfxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7hnnhn.exec:\7hnnhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbhbtt.exec:\nbhbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3rfrlfl.exec:\3rfrlfl.exe23⤵
- Executes dropped EXE
-
\??\c:\hbbtbt.exec:\hbbtbt.exe24⤵
- Executes dropped EXE
-
\??\c:\hthbbt.exec:\hthbbt.exe25⤵
- Executes dropped EXE
-
\??\c:\5dddp.exec:\5dddp.exe26⤵
- Executes dropped EXE
-
\??\c:\1lfxrrr.exec:\1lfxrrr.exe27⤵
- Executes dropped EXE
-
\??\c:\lfxrffx.exec:\lfxrffx.exe28⤵
- Executes dropped EXE
-
\??\c:\tbhbtt.exec:\tbhbtt.exe29⤵
- Executes dropped EXE
-
\??\c:\vvpdd.exec:\vvpdd.exe30⤵
- Executes dropped EXE
-
\??\c:\ntttnb.exec:\ntttnb.exe31⤵
- Executes dropped EXE
-
\??\c:\hbnnhh.exec:\hbnnhh.exe32⤵
- Executes dropped EXE
-
\??\c:\dvpdv.exec:\dvpdv.exe33⤵
- Executes dropped EXE
-
\??\c:\lxrxlll.exec:\lxrxlll.exe34⤵
- Executes dropped EXE
-
\??\c:\bbhhhh.exec:\bbhhhh.exe35⤵
- Executes dropped EXE
-
\??\c:\dvdvv.exec:\dvdvv.exe36⤵
- Executes dropped EXE
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe37⤵
- Executes dropped EXE
-
\??\c:\rlffxrl.exec:\rlffxrl.exe38⤵
- Executes dropped EXE
-
\??\c:\btnhnt.exec:\btnhnt.exe39⤵
- Executes dropped EXE
-
\??\c:\tnhbnh.exec:\tnhbnh.exe40⤵
- Executes dropped EXE
-
\??\c:\jddvp.exec:\jddvp.exe41⤵
- Executes dropped EXE
-
\??\c:\rllfxll.exec:\rllfxll.exe42⤵
- Executes dropped EXE
-
\??\c:\rrlfxxf.exec:\rrlfxxf.exe43⤵
- Executes dropped EXE
-
\??\c:\hthnhh.exec:\hthnhh.exe44⤵
- Executes dropped EXE
-
\??\c:\5pjdv.exec:\5pjdv.exe45⤵
- Executes dropped EXE
-
\??\c:\vpjvp.exec:\vpjvp.exe46⤵
- Executes dropped EXE
-
\??\c:\flxxlxl.exec:\flxxlxl.exe47⤵
- Executes dropped EXE
-
\??\c:\btbttt.exec:\btbttt.exe48⤵
- Executes dropped EXE
-
\??\c:\bnhhbb.exec:\bnhhbb.exe49⤵
- Executes dropped EXE
-
\??\c:\dpjdv.exec:\dpjdv.exe50⤵
- Executes dropped EXE
-
\??\c:\flrllfx.exec:\flrllfx.exe51⤵
- Executes dropped EXE
-
\??\c:\ffllxlr.exec:\ffllxlr.exe52⤵
- Executes dropped EXE
-
\??\c:\bhnnhh.exec:\bhnnhh.exe53⤵
- Executes dropped EXE
-
\??\c:\3hhbbb.exec:\3hhbbb.exe54⤵
- Executes dropped EXE
-
\??\c:\1vvpp.exec:\1vvpp.exe55⤵
- Executes dropped EXE
-
\??\c:\dvpjd.exec:\dvpjd.exe56⤵
- Executes dropped EXE
-
\??\c:\xlxrfxr.exec:\xlxrfxr.exe57⤵
- Executes dropped EXE
-
\??\c:\lfxxrlf.exec:\lfxxrlf.exe58⤵
- Executes dropped EXE
-
\??\c:\tnhnbn.exec:\tnhnbn.exe59⤵
- Executes dropped EXE
-
\??\c:\djppj.exec:\djppj.exe60⤵
- Executes dropped EXE
-
\??\c:\vjpjd.exec:\vjpjd.exe61⤵
- Executes dropped EXE
-
\??\c:\flrrllf.exec:\flrrllf.exe62⤵
- Executes dropped EXE
-
\??\c:\xllfxfx.exec:\xllfxfx.exe63⤵
- Executes dropped EXE
-
\??\c:\hbbbbb.exec:\hbbbbb.exe64⤵
- Executes dropped EXE
-
\??\c:\bbtnhh.exec:\bbtnhh.exe65⤵
- Executes dropped EXE
-
\??\c:\1ppjj.exec:\1ppjj.exe66⤵
-
\??\c:\rffxxrr.exec:\rffxxrr.exe67⤵
-
\??\c:\1rlfxxr.exec:\1rlfxxr.exe68⤵
-
\??\c:\bhhtbt.exec:\bhhtbt.exe69⤵
-
\??\c:\bhhhhb.exec:\bhhhhb.exe70⤵
-
\??\c:\vjdjj.exec:\vjdjj.exe71⤵
-
\??\c:\vdvpp.exec:\vdvpp.exe72⤵
-
\??\c:\xxxfrfl.exec:\xxxfrfl.exe73⤵
-
\??\c:\rfrxfxf.exec:\rfrxfxf.exe74⤵
-
\??\c:\btbbtt.exec:\btbbtt.exe75⤵
-
\??\c:\pjvvj.exec:\pjvvj.exe76⤵
-
\??\c:\xxrlffx.exec:\xxrlffx.exe77⤵
-
\??\c:\xlxrrff.exec:\xlxrrff.exe78⤵
-
\??\c:\ntbttn.exec:\ntbttn.exe79⤵
-
\??\c:\hbhnhn.exec:\hbhnhn.exe80⤵
-
\??\c:\vdjdd.exec:\vdjdd.exe81⤵
-
\??\c:\pvvjv.exec:\pvvjv.exe82⤵
-
\??\c:\1rrlfxx.exec:\1rrlfxx.exe83⤵
-
\??\c:\ntnhbt.exec:\ntnhbt.exe84⤵
-
\??\c:\nttbnt.exec:\nttbnt.exe85⤵
-
\??\c:\vvvpp.exec:\vvvpp.exe86⤵
-
\??\c:\7rfxffl.exec:\7rfxffl.exe87⤵
-
\??\c:\rrlllll.exec:\rrlllll.exe88⤵
-
\??\c:\9nttbh.exec:\9nttbh.exe89⤵
-
\??\c:\jdddj.exec:\jdddj.exe90⤵
-
\??\c:\9pvpv.exec:\9pvpv.exe91⤵
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe92⤵
-
\??\c:\xrrrfrf.exec:\xrrrfrf.exe93⤵
-
\??\c:\1tbbth.exec:\1tbbth.exe94⤵
-
\??\c:\tntnhh.exec:\tntnhh.exe95⤵
-
\??\c:\9vjdd.exec:\9vjdd.exe96⤵
-
\??\c:\pjdvj.exec:\pjdvj.exe97⤵
-
\??\c:\5rfxlxx.exec:\5rfxlxx.exe98⤵
-
\??\c:\rxffllr.exec:\rxffllr.exe99⤵
-
\??\c:\thnbtb.exec:\thnbtb.exe100⤵
-
\??\c:\nnnhbb.exec:\nnnhbb.exe101⤵
-
\??\c:\7jpjd.exec:\7jpjd.exe102⤵
-
\??\c:\rlfxrll.exec:\rlfxrll.exe103⤵
-
\??\c:\rfrlllf.exec:\rfrlllf.exe104⤵
-
\??\c:\fllllll.exec:\fllllll.exe105⤵
-
\??\c:\nhnntt.exec:\nhnntt.exe106⤵
-
\??\c:\7btbtn.exec:\7btbtn.exe107⤵
-
\??\c:\djjdv.exec:\djjdv.exe108⤵
-
\??\c:\1lxlrrx.exec:\1lxlrrx.exe109⤵
-
\??\c:\rrrllll.exec:\rrrllll.exe110⤵
-
\??\c:\rrllfff.exec:\rrllfff.exe111⤵
-
\??\c:\btnntt.exec:\btnntt.exe112⤵
-
\??\c:\tnnnnt.exec:\tnnnnt.exe113⤵
-
\??\c:\vddvp.exec:\vddvp.exe114⤵
-
\??\c:\1ddvp.exec:\1ddvp.exe115⤵
-
\??\c:\flrxxrf.exec:\flrxxrf.exe116⤵
-
\??\c:\thhhhh.exec:\thhhhh.exe117⤵
-
\??\c:\1nnnbb.exec:\1nnnbb.exe118⤵
-
\??\c:\9nbthh.exec:\9nbthh.exe119⤵
-
\??\c:\jddvp.exec:\jddvp.exe120⤵
-
\??\c:\pjjdd.exec:\pjjdd.exe121⤵
-
\??\c:\lfxrllf.exec:\lfxrllf.exe122⤵
-
\??\c:\thtntt.exec:\thtntt.exe123⤵
-
\??\c:\hbhhtt.exec:\hbhhtt.exe124⤵
-
\??\c:\7pppd.exec:\7pppd.exe125⤵
-
\??\c:\pvjjj.exec:\pvjjj.exe126⤵
-
\??\c:\fxlfffr.exec:\fxlfffr.exe127⤵
-
\??\c:\xrxfllx.exec:\xrxfllx.exe128⤵
-
\??\c:\3nnntb.exec:\3nnntb.exe129⤵
-
\??\c:\hnhnnn.exec:\hnhnnn.exe130⤵
-
\??\c:\dvjdd.exec:\dvjdd.exe131⤵
-
\??\c:\9tbbhn.exec:\9tbbhn.exe132⤵
-
\??\c:\9vvpd.exec:\9vvpd.exe133⤵
-
\??\c:\jvppp.exec:\jvppp.exe134⤵
-
\??\c:\3rfrxxr.exec:\3rfrxxr.exe135⤵
-
\??\c:\hbnntt.exec:\hbnntt.exe136⤵
-
\??\c:\1ttbnn.exec:\1ttbnn.exe137⤵
-
\??\c:\tthhnn.exec:\tthhnn.exe138⤵
-
\??\c:\ppjvp.exec:\ppjvp.exe139⤵
-
\??\c:\djpdp.exec:\djpdp.exe140⤵
-
\??\c:\lfxrlll.exec:\lfxrlll.exe141⤵
-
\??\c:\7bttnn.exec:\7bttnn.exe142⤵
-
\??\c:\hbbtnt.exec:\hbbtnt.exe143⤵
-
\??\c:\3vdvp.exec:\3vdvp.exe144⤵
-
\??\c:\jdjdp.exec:\jdjdp.exe145⤵
-
\??\c:\9fxxrxr.exec:\9fxxrxr.exe146⤵
-
\??\c:\rlflrxf.exec:\rlflrxf.exe147⤵
-
\??\c:\nthbtt.exec:\nthbtt.exe148⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe149⤵
-
\??\c:\jjdvp.exec:\jjdvp.exe150⤵
-
\??\c:\5xlrrrr.exec:\5xlrrrr.exe151⤵
-
\??\c:\fxllffx.exec:\fxllffx.exe152⤵
-
\??\c:\nhnhhh.exec:\nhnhhh.exe153⤵
-
\??\c:\dpdvp.exec:\dpdvp.exe154⤵
-
\??\c:\3xlfrrr.exec:\3xlfrrr.exe155⤵
-
\??\c:\xrfxrrr.exec:\xrfxrrr.exe156⤵
-
\??\c:\tnnttb.exec:\tnnttb.exe157⤵
-
\??\c:\5ttnhh.exec:\5ttnhh.exe158⤵
-
\??\c:\dpppj.exec:\dpppj.exe159⤵
-
\??\c:\jpvvj.exec:\jpvvj.exe160⤵
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe161⤵
-
\??\c:\xflrllx.exec:\xflrllx.exe162⤵
-
\??\c:\hbhhbb.exec:\hbhhbb.exe163⤵
-
\??\c:\bbttnt.exec:\bbttnt.exe164⤵
-
\??\c:\vvdpd.exec:\vvdpd.exe165⤵
-
\??\c:\3vdvj.exec:\3vdvj.exe166⤵
-
\??\c:\fffxlll.exec:\fffxlll.exe167⤵
-
\??\c:\lffllfl.exec:\lffllfl.exe168⤵
-
\??\c:\bbtntt.exec:\bbtntt.exe169⤵
-
\??\c:\ttbbnn.exec:\ttbbnn.exe170⤵
-
\??\c:\9pvjd.exec:\9pvjd.exe171⤵
-
\??\c:\pddvp.exec:\pddvp.exe172⤵
-
\??\c:\lfffflf.exec:\lfffflf.exe173⤵
-
\??\c:\ffxrxxf.exec:\ffxrxxf.exe174⤵
-
\??\c:\7ttnhh.exec:\7ttnhh.exe175⤵
-
\??\c:\btnnhh.exec:\btnnhh.exe176⤵
-
\??\c:\rxrxrfr.exec:\rxrxrfr.exe177⤵
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe178⤵
-
\??\c:\1hbttt.exec:\1hbttt.exe179⤵
-
\??\c:\hnnnbb.exec:\hnnnbb.exe180⤵
-
\??\c:\vjdvp.exec:\vjdvp.exe181⤵
-
\??\c:\9vvpj.exec:\9vvpj.exe182⤵
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe183⤵
-
\??\c:\hthbhh.exec:\hthbhh.exe184⤵
-
\??\c:\nbhnbn.exec:\nbhnbn.exe185⤵
-
\??\c:\vjjjv.exec:\vjjjv.exe186⤵
-
\??\c:\dpvdj.exec:\dpvdj.exe187⤵
-
\??\c:\7xfxrlf.exec:\7xfxrlf.exe188⤵
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe189⤵
-
\??\c:\tnnnhh.exec:\tnnnhh.exe190⤵
-
\??\c:\3nnhbb.exec:\3nnhbb.exe191⤵
-
\??\c:\jddvp.exec:\jddvp.exe192⤵
-
\??\c:\vvjjd.exec:\vvjjd.exe193⤵
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe194⤵
-
\??\c:\9lrxrrr.exec:\9lrxrrr.exe195⤵
-
\??\c:\hbtttt.exec:\hbtttt.exe196⤵
-
\??\c:\tnbttt.exec:\tnbttt.exe197⤵
-
\??\c:\dvppp.exec:\dvppp.exe198⤵
-
\??\c:\1vdvp.exec:\1vdvp.exe199⤵
-
\??\c:\fffxlll.exec:\fffxlll.exe200⤵
-
\??\c:\lfffrrr.exec:\lfffrrr.exe201⤵
-
\??\c:\nbhbtb.exec:\nbhbtb.exe202⤵
-
\??\c:\bbhbhh.exec:\bbhbhh.exe203⤵
-
\??\c:\ddvpd.exec:\ddvpd.exe204⤵
-
\??\c:\jdpjv.exec:\jdpjv.exe205⤵
-
\??\c:\fxxrlfl.exec:\fxxrlfl.exe206⤵
-
\??\c:\bbhbbb.exec:\bbhbbb.exe207⤵
-
\??\c:\ttnhbb.exec:\ttnhbb.exe208⤵
-
\??\c:\vdjdp.exec:\vdjdp.exe209⤵
-
\??\c:\3vdvp.exec:\3vdvp.exe210⤵
-
\??\c:\xxrxrrl.exec:\xxrxrrl.exe211⤵
-
\??\c:\xxfrrrr.exec:\xxfrrrr.exe212⤵
-
\??\c:\9btttt.exec:\9btttt.exe213⤵
-
\??\c:\vjjdv.exec:\vjjdv.exe214⤵
-
\??\c:\jddjd.exec:\jddjd.exe215⤵
-
\??\c:\xxxrfxr.exec:\xxxrfxr.exe216⤵
-
\??\c:\hhntth.exec:\hhntth.exe217⤵
-
\??\c:\vjvjp.exec:\vjvjp.exe218⤵
-
\??\c:\jdjvd.exec:\jdjvd.exe219⤵
-
\??\c:\fxfxlxr.exec:\fxfxlxr.exe220⤵
-
\??\c:\bbnnnt.exec:\bbnnnt.exe221⤵
-
\??\c:\5vvdd.exec:\5vvdd.exe222⤵
-
\??\c:\pvdvv.exec:\pvdvv.exe223⤵
-
\??\c:\frrfxxr.exec:\frrfxxr.exe224⤵
-
\??\c:\thbtth.exec:\thbtth.exe225⤵
-
\??\c:\bttbtn.exec:\bttbtn.exe226⤵
-
\??\c:\9jvvv.exec:\9jvvv.exe227⤵
-
\??\c:\7dpvd.exec:\7dpvd.exe228⤵
-
\??\c:\3rxrffx.exec:\3rxrffx.exe229⤵
-
\??\c:\fxrlffx.exec:\fxrlffx.exe230⤵
-
\??\c:\tbbhht.exec:\tbbhht.exe231⤵
-
\??\c:\tnnbtt.exec:\tnnbtt.exe232⤵
-
\??\c:\vddjv.exec:\vddjv.exe233⤵
-
\??\c:\7vvdp.exec:\7vvdp.exe234⤵
-
\??\c:\ffxrfxr.exec:\ffxrfxr.exe235⤵
-
\??\c:\btnhnh.exec:\btnhnh.exe236⤵
-
\??\c:\tnnnnn.exec:\tnnnnn.exe237⤵
-
\??\c:\1pjvj.exec:\1pjvj.exe238⤵
-
\??\c:\9lfrfxr.exec:\9lfrfxr.exe239⤵
-
\??\c:\5bhthb.exec:\5bhthb.exe240⤵
-
\??\c:\ppvjv.exec:\ppvjv.exe241⤵