Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 18:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
012f5d1ea9c6c0ce4420d0f32c77c39b5a439a1764774647dbe1e6b25063fa87.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
012f5d1ea9c6c0ce4420d0f32c77c39b5a439a1764774647dbe1e6b25063fa87.exe
-
Size
88KB
-
MD5
68d00f8deaa53d3797d6a163b3a3d653
-
SHA1
9c39ec522d8c8854019805cc70cd97771ad19a18
-
SHA256
012f5d1ea9c6c0ce4420d0f32c77c39b5a439a1764774647dbe1e6b25063fa87
-
SHA512
9da78bbe39d1f7989ad8d766650b6bf41c5085497d5d48ae6964c8d9e4d7d99341f2b810665c6378d948d33f44aa15621c5d4517330377dcd7317aa4072bfe78
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73yqKH/Kjvet:ymb3NkkiQ3mdBjFo73yX+vq
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2220-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1452-42-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1452-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/308-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-86-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/896-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1280-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1452-1230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 27 IoCs
Processes:
resource yara_rule behavioral1/memory/308-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2220-16-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2220-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2220-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2364-28-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2736-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1452-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/308-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2768-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2768-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2768-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2768-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2584-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2576-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2380-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1924-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1672-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2264-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1964-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2840-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/896-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1280-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2100-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1048-268-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3004-303-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1452-1230-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
tntbtb.exevpjjv.exerlflflx.exe7lflxfr.exebttttb.exexxrfrrf.exe7rlxxfl.exetntnbh.exejdpdj.exefxffrll.exenbthnt.exennhbnn.exejvjpv.exelxrxffr.exetnbbhn.exebtbntb.exevpdjj.exefxlrflx.exe3hntnt.exehbtbnh.exe3pppd.exevpdjv.exeflxfrxr.exebbthnh.exeddjvp.exe7lffrxf.exe9xfrflx.exe9bthtt.exejjdvp.exelfrfrrx.exebtnthn.exebtntbh.exevpppd.exelflrfll.exefxrxlrf.exebbhnbb.exe1ddpd.exeppvpj.exerrfrlxl.exehbnbtt.exe3btbhh.exejvjpp.exe5djpd.exe7lrlrxf.exebtbbnh.exennnbhh.exevpvjv.exe1dvjp.exerrfrllr.exexrflxfl.exehbthth.exe7hhntb.exe5dvdd.exexffllrf.exe9xlrffr.exennbtht.exehbthth.exepjpvd.exe5vpjd.exexrrxfll.exeffrxffl.exetttbhn.exe1tntbb.exedvpvj.exepid process 2220 tntbtb.exe 2364 vpjjv.exe 1452 rlflflx.exe 2736 7lflxfr.exe 2768 bttttb.exe 2568 xxrfrrf.exe 2584 7rlxxfl.exe 2576 tntnbh.exe 2380 jdpdj.exe 1924 fxffrll.exe 1672 nbthnt.exe 2264 nnhbnn.exe 1964 jvjpv.exe 856 lxrxffr.exe 2840 tnbbhn.exe 896 btbntb.exe 1540 vpdjj.exe 2348 fxlrflx.exe 1280 3hntnt.exe 2100 hbtbnh.exe 1988 3pppd.exe 792 vpdjv.exe 588 flxfrxr.exe 576 bbthnh.exe 1444 ddjvp.exe 1308 7lffrxf.exe 1048 9xfrflx.exe 604 9bthtt.exe 2932 jjdvp.exe 2180 lfrfrrx.exe 3004 btnthn.exe 2384 btntbh.exe 2232 vpppd.exe 1712 lflrfll.exe 2364 fxrxlrf.exe 2816 bbhnbb.exe 2680 1ddpd.exe 2796 ppvpj.exe 2636 rrfrlxl.exe 2716 hbnbtt.exe 2780 3btbhh.exe 2700 jvjpp.exe 2568 5djpd.exe 2596 7lrlrxf.exe 2804 btbbnh.exe 1248 nnnbhh.exe 1608 vpvjv.exe 352 1dvjp.exe 2268 rrfrllr.exe 1960 xrflxfl.exe 1740 hbthth.exe 1800 7hhntb.exe 2448 5dvdd.exe 2248 xffllrf.exe 1620 9xlrffr.exe 624 nnbtht.exe 2316 hbthth.exe 2292 pjpvd.exe 1912 5vpjd.exe 2276 xrrxfll.exe 668 ffrxffl.exe 1004 tttbhn.exe 1808 1tntbb.exe 588 dvpvj.exe -
Processes:
resource yara_rule behavioral1/memory/308-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1452-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/308-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/896-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1280-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1452-1230-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
012f5d1ea9c6c0ce4420d0f32c77c39b5a439a1764774647dbe1e6b25063fa87.exetntbtb.exevpjjv.exerlflflx.exe7lflxfr.exebttttb.exexxrfrrf.exe7rlxxfl.exetntnbh.exejdpdj.exefxffrll.exenbthnt.exennhbnn.exejvjpv.exelxrxffr.exetnbbhn.exedescription pid process target process PID 308 wrote to memory of 2220 308 012f5d1ea9c6c0ce4420d0f32c77c39b5a439a1764774647dbe1e6b25063fa87.exe tntbtb.exe PID 308 wrote to memory of 2220 308 012f5d1ea9c6c0ce4420d0f32c77c39b5a439a1764774647dbe1e6b25063fa87.exe tntbtb.exe PID 308 wrote to memory of 2220 308 012f5d1ea9c6c0ce4420d0f32c77c39b5a439a1764774647dbe1e6b25063fa87.exe tntbtb.exe PID 308 wrote to memory of 2220 308 012f5d1ea9c6c0ce4420d0f32c77c39b5a439a1764774647dbe1e6b25063fa87.exe tntbtb.exe PID 2220 wrote to memory of 2364 2220 tntbtb.exe vpjjv.exe PID 2220 wrote to memory of 2364 2220 tntbtb.exe vpjjv.exe PID 2220 wrote to memory of 2364 2220 tntbtb.exe vpjjv.exe PID 2220 wrote to memory of 2364 2220 tntbtb.exe vpjjv.exe PID 2364 wrote to memory of 1452 2364 vpjjv.exe rlflflx.exe PID 2364 wrote to memory of 1452 2364 vpjjv.exe rlflflx.exe PID 2364 wrote to memory of 1452 2364 vpjjv.exe rlflflx.exe PID 2364 wrote to memory of 1452 2364 vpjjv.exe rlflflx.exe PID 1452 wrote to memory of 2736 1452 rlflflx.exe 7lflxfr.exe PID 1452 wrote to memory of 2736 1452 rlflflx.exe 7lflxfr.exe PID 1452 wrote to memory of 2736 1452 rlflflx.exe 7lflxfr.exe PID 1452 wrote to memory of 2736 1452 rlflflx.exe 7lflxfr.exe PID 2736 wrote to memory of 2768 2736 7lflxfr.exe bttttb.exe PID 2736 wrote to memory of 2768 2736 7lflxfr.exe bttttb.exe PID 2736 wrote to memory of 2768 2736 7lflxfr.exe bttttb.exe PID 2736 wrote to memory of 2768 2736 7lflxfr.exe bttttb.exe PID 2768 wrote to memory of 2568 2768 bttttb.exe xxrfrrf.exe PID 2768 wrote to memory of 2568 2768 bttttb.exe xxrfrrf.exe PID 2768 wrote to memory of 2568 2768 bttttb.exe xxrfrrf.exe PID 2768 wrote to memory of 2568 2768 bttttb.exe xxrfrrf.exe PID 2568 wrote to memory of 2584 2568 xxrfrrf.exe 7rlxxfl.exe PID 2568 wrote to memory of 2584 2568 xxrfrrf.exe 7rlxxfl.exe PID 2568 wrote to memory of 2584 2568 xxrfrrf.exe 7rlxxfl.exe PID 2568 wrote to memory of 2584 2568 xxrfrrf.exe 7rlxxfl.exe PID 2584 wrote to memory of 2576 2584 7rlxxfl.exe tntnbh.exe PID 2584 wrote to memory of 2576 2584 7rlxxfl.exe tntnbh.exe PID 2584 wrote to memory of 2576 2584 7rlxxfl.exe tntnbh.exe PID 2584 wrote to memory of 2576 2584 7rlxxfl.exe tntnbh.exe PID 2576 wrote to memory of 2380 2576 tntnbh.exe jdpdj.exe PID 2576 wrote to memory of 2380 2576 tntnbh.exe jdpdj.exe PID 2576 wrote to memory of 2380 2576 tntnbh.exe jdpdj.exe PID 2576 wrote to memory of 2380 2576 tntnbh.exe jdpdj.exe PID 2380 wrote to memory of 1924 2380 jdpdj.exe fxffrll.exe PID 2380 wrote to memory of 1924 2380 jdpdj.exe fxffrll.exe PID 2380 wrote to memory of 1924 2380 jdpdj.exe fxffrll.exe PID 2380 wrote to memory of 1924 2380 jdpdj.exe fxffrll.exe PID 1924 wrote to memory of 1672 1924 fxffrll.exe nbthnt.exe PID 1924 wrote to memory of 1672 1924 fxffrll.exe nbthnt.exe PID 1924 wrote to memory of 1672 1924 fxffrll.exe nbthnt.exe PID 1924 wrote to memory of 1672 1924 fxffrll.exe nbthnt.exe PID 1672 wrote to memory of 2264 1672 nbthnt.exe nnhbnn.exe PID 1672 wrote to memory of 2264 1672 nbthnt.exe nnhbnn.exe PID 1672 wrote to memory of 2264 1672 nbthnt.exe nnhbnn.exe PID 1672 wrote to memory of 2264 1672 nbthnt.exe nnhbnn.exe PID 2264 wrote to memory of 1964 2264 nnhbnn.exe jvjpv.exe PID 2264 wrote to memory of 1964 2264 nnhbnn.exe jvjpv.exe PID 2264 wrote to memory of 1964 2264 nnhbnn.exe jvjpv.exe PID 2264 wrote to memory of 1964 2264 nnhbnn.exe jvjpv.exe PID 1964 wrote to memory of 856 1964 jvjpv.exe lxrxffr.exe PID 1964 wrote to memory of 856 1964 jvjpv.exe lxrxffr.exe PID 1964 wrote to memory of 856 1964 jvjpv.exe lxrxffr.exe PID 1964 wrote to memory of 856 1964 jvjpv.exe lxrxffr.exe PID 856 wrote to memory of 2840 856 lxrxffr.exe tnbbhn.exe PID 856 wrote to memory of 2840 856 lxrxffr.exe tnbbhn.exe PID 856 wrote to memory of 2840 856 lxrxffr.exe tnbbhn.exe PID 856 wrote to memory of 2840 856 lxrxffr.exe tnbbhn.exe PID 2840 wrote to memory of 896 2840 tnbbhn.exe btbntb.exe PID 2840 wrote to memory of 896 2840 tnbbhn.exe btbntb.exe PID 2840 wrote to memory of 896 2840 tnbbhn.exe btbntb.exe PID 2840 wrote to memory of 896 2840 tnbbhn.exe btbntb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\012f5d1ea9c6c0ce4420d0f32c77c39b5a439a1764774647dbe1e6b25063fa87.exe"C:\Users\Admin\AppData\Local\Temp\012f5d1ea9c6c0ce4420d0f32c77c39b5a439a1764774647dbe1e6b25063fa87.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\tntbtb.exec:\tntbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjjv.exec:\vpjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlflflx.exec:\rlflflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7lflxfr.exec:\7lflxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bttttb.exec:\bttttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxrfrrf.exec:\xxrfrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7rlxxfl.exec:\7rlxxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tntnbh.exec:\tntnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdpdj.exec:\jdpdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxffrll.exec:\fxffrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbthnt.exec:\nbthnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhbnn.exec:\nnhbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvjpv.exec:\jvjpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxrxffr.exec:\lxrxffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbbhn.exec:\tnbbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btbntb.exec:\btbntb.exe17⤵
- Executes dropped EXE
-
\??\c:\vpdjj.exec:\vpdjj.exe18⤵
- Executes dropped EXE
-
\??\c:\fxlrflx.exec:\fxlrflx.exe19⤵
- Executes dropped EXE
-
\??\c:\3hntnt.exec:\3hntnt.exe20⤵
- Executes dropped EXE
-
\??\c:\hbtbnh.exec:\hbtbnh.exe21⤵
- Executes dropped EXE
-
\??\c:\3pppd.exec:\3pppd.exe22⤵
- Executes dropped EXE
-
\??\c:\vpdjv.exec:\vpdjv.exe23⤵
- Executes dropped EXE
-
\??\c:\flxfrxr.exec:\flxfrxr.exe24⤵
- Executes dropped EXE
-
\??\c:\bbthnh.exec:\bbthnh.exe25⤵
- Executes dropped EXE
-
\??\c:\ddjvp.exec:\ddjvp.exe26⤵
- Executes dropped EXE
-
\??\c:\7lffrxf.exec:\7lffrxf.exe27⤵
- Executes dropped EXE
-
\??\c:\9xfrflx.exec:\9xfrflx.exe28⤵
- Executes dropped EXE
-
\??\c:\9bthtt.exec:\9bthtt.exe29⤵
- Executes dropped EXE
-
\??\c:\jjdvp.exec:\jjdvp.exe30⤵
- Executes dropped EXE
-
\??\c:\lfrfrrx.exec:\lfrfrrx.exe31⤵
- Executes dropped EXE
-
\??\c:\btnthn.exec:\btnthn.exe32⤵
- Executes dropped EXE
-
\??\c:\btntbh.exec:\btntbh.exe33⤵
- Executes dropped EXE
-
\??\c:\vpppd.exec:\vpppd.exe34⤵
- Executes dropped EXE
-
\??\c:\lflrfll.exec:\lflrfll.exe35⤵
- Executes dropped EXE
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe36⤵
- Executes dropped EXE
-
\??\c:\bbhnbb.exec:\bbhnbb.exe37⤵
- Executes dropped EXE
-
\??\c:\1ddpd.exec:\1ddpd.exe38⤵
- Executes dropped EXE
-
\??\c:\ppvpj.exec:\ppvpj.exe39⤵
- Executes dropped EXE
-
\??\c:\rrfrlxl.exec:\rrfrlxl.exe40⤵
- Executes dropped EXE
-
\??\c:\hbnbtt.exec:\hbnbtt.exe41⤵
- Executes dropped EXE
-
\??\c:\3btbhh.exec:\3btbhh.exe42⤵
- Executes dropped EXE
-
\??\c:\jvjpp.exec:\jvjpp.exe43⤵
- Executes dropped EXE
-
\??\c:\5djpd.exec:\5djpd.exe44⤵
- Executes dropped EXE
-
\??\c:\7lrlrxf.exec:\7lrlrxf.exe45⤵
- Executes dropped EXE
-
\??\c:\btbbnh.exec:\btbbnh.exe46⤵
- Executes dropped EXE
-
\??\c:\nnnbhh.exec:\nnnbhh.exe47⤵
- Executes dropped EXE
-
\??\c:\vpvjv.exec:\vpvjv.exe48⤵
- Executes dropped EXE
-
\??\c:\1dvjp.exec:\1dvjp.exe49⤵
- Executes dropped EXE
-
\??\c:\rrfrllr.exec:\rrfrllr.exe50⤵
- Executes dropped EXE
-
\??\c:\xrflxfl.exec:\xrflxfl.exe51⤵
- Executes dropped EXE
-
\??\c:\hbthth.exec:\hbthth.exe52⤵
- Executes dropped EXE
-
\??\c:\7hhntb.exec:\7hhntb.exe53⤵
- Executes dropped EXE
-
\??\c:\5dvdd.exec:\5dvdd.exe54⤵
- Executes dropped EXE
-
\??\c:\xffllrf.exec:\xffllrf.exe55⤵
- Executes dropped EXE
-
\??\c:\9xlrffr.exec:\9xlrffr.exe56⤵
- Executes dropped EXE
-
\??\c:\nnbtht.exec:\nnbtht.exe57⤵
- Executes dropped EXE
-
\??\c:\hbthth.exec:\hbthth.exe58⤵
- Executes dropped EXE
-
\??\c:\pjpvd.exec:\pjpvd.exe59⤵
- Executes dropped EXE
-
\??\c:\5vpjd.exec:\5vpjd.exe60⤵
- Executes dropped EXE
-
\??\c:\xrrxfll.exec:\xrrxfll.exe61⤵
- Executes dropped EXE
-
\??\c:\ffrxffl.exec:\ffrxffl.exe62⤵
- Executes dropped EXE
-
\??\c:\tttbhn.exec:\tttbhn.exe63⤵
- Executes dropped EXE
-
\??\c:\1tntbb.exec:\1tntbb.exe64⤵
- Executes dropped EXE
-
\??\c:\dvpvj.exec:\dvpvj.exe65⤵
- Executes dropped EXE
-
\??\c:\ddjjd.exec:\ddjjd.exe66⤵
-
\??\c:\lxffrrf.exec:\lxffrrf.exe67⤵
-
\??\c:\ffrlrxf.exec:\ffrlrxf.exe68⤵
-
\??\c:\tnnbhh.exec:\tnnbhh.exe69⤵
-
\??\c:\7hbhbh.exec:\7hbhbh.exe70⤵
-
\??\c:\pvdpd.exec:\pvdpd.exe71⤵
-
\??\c:\pdjpd.exec:\pdjpd.exe72⤵
-
\??\c:\lrlxflf.exec:\lrlxflf.exe73⤵
-
\??\c:\lfrxrrf.exec:\lfrxrrf.exe74⤵
-
\??\c:\btthtt.exec:\btthtt.exe75⤵
-
\??\c:\nnbnnb.exec:\nnbnnb.exe76⤵
-
\??\c:\dddjp.exec:\dddjp.exe77⤵
-
\??\c:\fxrfrfl.exec:\fxrfrfl.exe78⤵
-
\??\c:\rllxrrr.exec:\rllxrrr.exe79⤵
-
\??\c:\htnbnh.exec:\htnbnh.exe80⤵
-
\??\c:\ttnhnb.exec:\ttnhnb.exe81⤵
-
\??\c:\thbthn.exec:\thbthn.exe82⤵
-
\??\c:\pvppv.exec:\pvppv.exe83⤵
-
\??\c:\3vpdp.exec:\3vpdp.exe84⤵
-
\??\c:\rrllxfx.exec:\rrllxfx.exe85⤵
-
\??\c:\ffllrrx.exec:\ffllrrx.exe86⤵
-
\??\c:\hbnnbh.exec:\hbnnbh.exe87⤵
-
\??\c:\tnhhnb.exec:\tnhhnb.exe88⤵
-
\??\c:\5vjjv.exec:\5vjjv.exe89⤵
-
\??\c:\jdpdj.exec:\jdpdj.exe90⤵
-
\??\c:\ffxxlrf.exec:\ffxxlrf.exe91⤵
-
\??\c:\llxflfr.exec:\llxflfr.exe92⤵
-
\??\c:\hbtttb.exec:\hbtttb.exe93⤵
-
\??\c:\bttbnt.exec:\bttbnt.exe94⤵
-
\??\c:\jjdpv.exec:\jjdpv.exe95⤵
-
\??\c:\jjjpd.exec:\jjjpd.exe96⤵
-
\??\c:\fxrfrrx.exec:\fxrfrrx.exe97⤵
-
\??\c:\lfrxxfr.exec:\lfrxxfr.exe98⤵
-
\??\c:\1tnthn.exec:\1tnthn.exe99⤵
-
\??\c:\httnbh.exec:\httnbh.exe100⤵
-
\??\c:\1pdjv.exec:\1pdjv.exe101⤵
-
\??\c:\dvjjp.exec:\dvjjp.exe102⤵
-
\??\c:\dvpvd.exec:\dvpvd.exe103⤵
-
\??\c:\fxrrffr.exec:\fxrrffr.exe104⤵
-
\??\c:\5xllrlf.exec:\5xllrlf.exe105⤵
-
\??\c:\nhhhtb.exec:\nhhhtb.exe106⤵
-
\??\c:\btnnbh.exec:\btnnbh.exe107⤵
-
\??\c:\1jvjp.exec:\1jvjp.exe108⤵
-
\??\c:\5ddjp.exec:\5ddjp.exe109⤵
-
\??\c:\5fflxxl.exec:\5fflxxl.exe110⤵
-
\??\c:\nbbbnt.exec:\nbbbnt.exe111⤵
-
\??\c:\bthhtb.exec:\bthhtb.exe112⤵
-
\??\c:\btntnt.exec:\btntnt.exe113⤵
-
\??\c:\dpdjp.exec:\dpdjp.exe114⤵
-
\??\c:\fxrxffl.exec:\fxrxffl.exe115⤵
-
\??\c:\xrxflfl.exec:\xrxflfl.exe116⤵
-
\??\c:\bnbbtt.exec:\bnbbtt.exe117⤵
-
\??\c:\btbnnb.exec:\btbnnb.exe118⤵
-
\??\c:\vvdvd.exec:\vvdvd.exe119⤵
-
\??\c:\9jddp.exec:\9jddp.exe120⤵
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe121⤵
-
\??\c:\bnbnbb.exec:\bnbnbb.exe122⤵
-
\??\c:\dvddj.exec:\dvddj.exe123⤵
-
\??\c:\ppjdj.exec:\ppjdj.exe124⤵
-
\??\c:\xrrxllf.exec:\xrrxllf.exe125⤵
-
\??\c:\3ffrxfr.exec:\3ffrxfr.exe126⤵
-
\??\c:\tthnbh.exec:\tthnbh.exe127⤵
-
\??\c:\vvjdd.exec:\vvjdd.exe128⤵
-
\??\c:\jvvpp.exec:\jvvpp.exe129⤵
-
\??\c:\dvppd.exec:\dvppd.exe130⤵
-
\??\c:\7xrfrxf.exec:\7xrfrxf.exe131⤵
-
\??\c:\7thhnn.exec:\7thhnn.exe132⤵
-
\??\c:\btbtbb.exec:\btbtbb.exe133⤵
-
\??\c:\1dvdv.exec:\1dvdv.exe134⤵
-
\??\c:\dvddd.exec:\dvddd.exe135⤵
-
\??\c:\rrfrrxf.exec:\rrfrrxf.exe136⤵
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe137⤵
-
\??\c:\bnttbb.exec:\bnttbb.exe138⤵
-
\??\c:\btbbbh.exec:\btbbbh.exe139⤵
-
\??\c:\vjppv.exec:\vjppv.exe140⤵
-
\??\c:\vvdjv.exec:\vvdjv.exe141⤵
-
\??\c:\rrlxxxl.exec:\rrlxxxl.exe142⤵
-
\??\c:\lflrflf.exec:\lflrflf.exe143⤵
-
\??\c:\thtbhn.exec:\thtbhn.exe144⤵
-
\??\c:\9tbbhh.exec:\9tbbhh.exe145⤵
-
\??\c:\vvpdd.exec:\vvpdd.exe146⤵
-
\??\c:\vvpdp.exec:\vvpdp.exe147⤵
-
\??\c:\fxrxlrl.exec:\fxrxlrl.exe148⤵
-
\??\c:\lffrflr.exec:\lffrflr.exe149⤵
-
\??\c:\bnbhhn.exec:\bnbhhn.exe150⤵
-
\??\c:\nnhnnt.exec:\nnhnnt.exe151⤵
-
\??\c:\pddjd.exec:\pddjd.exe152⤵
-
\??\c:\jjdjj.exec:\jjdjj.exe153⤵
-
\??\c:\9rrlrxl.exec:\9rrlrxl.exe154⤵
-
\??\c:\rrlrlrx.exec:\rrlrlrx.exe155⤵
-
\??\c:\bbhntb.exec:\bbhntb.exe156⤵
-
\??\c:\bbbnbn.exec:\bbbnbn.exe157⤵
-
\??\c:\9dpvp.exec:\9dpvp.exe158⤵
-
\??\c:\dvddp.exec:\dvddp.exe159⤵
-
\??\c:\rlxrlrf.exec:\rlxrlrf.exe160⤵
-
\??\c:\rfrfflr.exec:\rfrfflr.exe161⤵
-
\??\c:\hnbtbn.exec:\hnbtbn.exe162⤵
-
\??\c:\jpjjp.exec:\jpjjp.exe163⤵
-
\??\c:\7pjvj.exec:\7pjvj.exe164⤵
-
\??\c:\xxllrxf.exec:\xxllrxf.exe165⤵
-
\??\c:\hhtnnb.exec:\hhtnnb.exe166⤵
-
\??\c:\3btbhn.exec:\3btbhn.exe167⤵
-
\??\c:\jdppp.exec:\jdppp.exe168⤵
-
\??\c:\pjpdp.exec:\pjpdp.exe169⤵
-
\??\c:\lfrxrxf.exec:\lfrxrxf.exe170⤵
-
\??\c:\rrfrrrr.exec:\rrfrrrr.exe171⤵
-
\??\c:\tnthht.exec:\tnthht.exe172⤵
-
\??\c:\ttbnhb.exec:\ttbnhb.exe173⤵
-
\??\c:\vdpjj.exec:\vdpjj.exe174⤵
-
\??\c:\7vjpv.exec:\7vjpv.exe175⤵
-
\??\c:\9xfrxlx.exec:\9xfrxlx.exe176⤵
-
\??\c:\5nhtbt.exec:\5nhtbt.exe177⤵
-
\??\c:\tnhnbb.exec:\tnhnbb.exe178⤵
-
\??\c:\pdpdp.exec:\pdpdp.exe179⤵
-
\??\c:\vjddd.exec:\vjddd.exe180⤵
-
\??\c:\1fxrflr.exec:\1fxrflr.exe181⤵
-
\??\c:\5rrlllf.exec:\5rrlllf.exe182⤵
-
\??\c:\9tnbhn.exec:\9tnbhn.exe183⤵
-
\??\c:\3bnbtt.exec:\3bnbtt.exe184⤵
-
\??\c:\vpdjj.exec:\vpdjj.exe185⤵
-
\??\c:\9rrrxxf.exec:\9rrrxxf.exe186⤵
-
\??\c:\nnhnth.exec:\nnhnth.exe187⤵
-
\??\c:\5bhttt.exec:\5bhttt.exe188⤵
-
\??\c:\vjdjv.exec:\vjdjv.exe189⤵
-
\??\c:\1ffrxfl.exec:\1ffrxfl.exe190⤵
-
\??\c:\fxrflff.exec:\fxrflff.exe191⤵
-
\??\c:\bbnthn.exec:\bbnthn.exe192⤵
-
\??\c:\dvjdp.exec:\dvjdp.exe193⤵
-
\??\c:\vdvpd.exec:\vdvpd.exe194⤵
-
\??\c:\rrflxxr.exec:\rrflxxr.exe195⤵
-
\??\c:\nhtbbh.exec:\nhtbbh.exe196⤵
-
\??\c:\jdpvd.exec:\jdpvd.exe197⤵
-
\??\c:\vjvvv.exec:\vjvvv.exe198⤵
-
\??\c:\1rllrxf.exec:\1rllrxf.exe199⤵
-
\??\c:\rlflrrx.exec:\rlflrrx.exe200⤵
-
\??\c:\tnbhnh.exec:\tnbhnh.exe201⤵
-
\??\c:\dvppv.exec:\dvppv.exe202⤵
-
\??\c:\vpjpv.exec:\vpjpv.exe203⤵
-
\??\c:\lfxllrf.exec:\lfxllrf.exe204⤵
-
\??\c:\xrrxrfx.exec:\xrrxrfx.exe205⤵
-
\??\c:\nhbthh.exec:\nhbthh.exe206⤵
-
\??\c:\btttbh.exec:\btttbh.exe207⤵
-
\??\c:\3jvjv.exec:\3jvjv.exe208⤵
-
\??\c:\vdjdp.exec:\vdjdp.exe209⤵
-
\??\c:\fxrrxfr.exec:\fxrrxfr.exe210⤵
-
\??\c:\rlrxlrl.exec:\rlrxlrl.exe211⤵
-
\??\c:\1htbhb.exec:\1htbhb.exe212⤵
-
\??\c:\bhtnnh.exec:\bhtnnh.exe213⤵
-
\??\c:\vvpvp.exec:\vvpvp.exe214⤵
-
\??\c:\7vvjj.exec:\7vvjj.exe215⤵
-
\??\c:\rfxlrlr.exec:\rfxlrlr.exe216⤵
-
\??\c:\lfxxrrl.exec:\lfxxrrl.exe217⤵
-
\??\c:\5nbhnb.exec:\5nbhnb.exe218⤵
-
\??\c:\hbthnn.exec:\hbthnn.exe219⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe220⤵
-
\??\c:\dvjdj.exec:\dvjdj.exe221⤵
-
\??\c:\lxrlxxx.exec:\lxrlxxx.exe222⤵
-
\??\c:\fxfxxlx.exec:\fxfxxlx.exe223⤵
-
\??\c:\bhbhnb.exec:\bhbhnb.exe224⤵
-
\??\c:\9hbthh.exec:\9hbthh.exe225⤵
-
\??\c:\vpjpp.exec:\vpjpp.exe226⤵
-
\??\c:\7jpvj.exec:\7jpvj.exe227⤵
-
\??\c:\frflrxf.exec:\frflrxf.exe228⤵
-
\??\c:\xrrrffx.exec:\xrrrffx.exe229⤵
-
\??\c:\btbhtt.exec:\btbhtt.exe230⤵
-
\??\c:\jpdpj.exec:\jpdpj.exe231⤵
-
\??\c:\jvjpv.exec:\jvjpv.exe232⤵
-
\??\c:\lfxlrrx.exec:\lfxlrrx.exe233⤵
-
\??\c:\7rxlrlf.exec:\7rxlrlf.exe234⤵
-
\??\c:\btnthb.exec:\btnthb.exe235⤵
-
\??\c:\hthtbt.exec:\hthtbt.exe236⤵
-
\??\c:\jjjpj.exec:\jjjpj.exe237⤵
-
\??\c:\lxrrxff.exec:\lxrrxff.exe238⤵
-
\??\c:\xflfxxr.exec:\xflfxxr.exe239⤵
-
\??\c:\nnhhnt.exec:\nnhhnt.exe240⤵
-
\??\c:\btnttn.exec:\btnttn.exe241⤵