Analysis
-
max time kernel
144s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 23:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7841a55a6c57d73c6e397b2821320acd39c931ae0a1d9b236f050067e95568db.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
General
-
Target
7841a55a6c57d73c6e397b2821320acd39c931ae0a1d9b236f050067e95568db.exe
-
Size
66KB
-
MD5
bc20ccd3ddcc1097db9d343a67b515a2
-
SHA1
0ed130d12abb8668327192de2a18a4fbbd44e8ea
-
SHA256
7841a55a6c57d73c6e397b2821320acd39c931ae0a1d9b236f050067e95568db
-
SHA512
852be22fe07bb59429d4ace9dbdfae501af219c355ee8710ac0b8354146f06882936b93b15f95b0adca0928e03f8597760b6f3f8b9f58d681ae52fc6df397b3f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIGG:ymb3NkkiQ3mdBjFIFdJ8bB
Malware Config
Signatures
-
Detect Blackmoon payload 46 IoCs
Processes:
resource yara_rule behavioral2/memory/3804-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/676-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1592-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-359-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-391-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-398-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-417-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-424-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-430-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 61 IoCs
Processes:
resource yara_rule behavioral2/memory/3804-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3804-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3804-7-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4836-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2936-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3316-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5060-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2008-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2008-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3564-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3564-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3160-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2124-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2948-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4360-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4456-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/676-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1536-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4676-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1224-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3296-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1592-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1592-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1732-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2924-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2924-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4168-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4124-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2376-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4056-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/376-197-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3196-209-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4960-218-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1628-230-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2796-233-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2796-231-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5032-237-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5032-242-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4228-244-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4716-269-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1112-282-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1016-286-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3952-290-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1216-293-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/736-300-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3940-309-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1736-314-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1736-317-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2360-321-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2924-338-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2924-341-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3456-359-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3212-362-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4424-371-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2936-391-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3764-398-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/960-399-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3768-417-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1916-424-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3976-430-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5100-432-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
thttnb.exevvpdv.exebhbbhn.exe9pjpd.exellrrrxx.exejdpdj.exenhtnnt.exevjdvj.exetnhbtn.exepjpjj.exerxxlrlf.exe5vpjd.exebttnnn.exe3ppvd.exehbnbnh.exejddpj.exenhbnnh.exe1jjjp.exettnbnh.exe9jvjv.exeflrflfr.exe1jvpp.exelrlfrfr.exe5xxlfrf.exettnbnt.exelrrrffr.exehhhthb.exefxrfrfr.exehbbbbb.exepdpdp.exe3rrffxx.exenhhbtn.exerxlfrlx.exennnbnh.exejppdp.exebtbhth.exejddpv.exerlfrxrf.exebnbnht.exedpjvv.exefrxlfrr.exetbbthh.exe7fflxlx.exeflfrlfr.exe5ppdp.exenbbttn.exepdjpd.exerlrflfr.exebnhbhn.exe1lfrrlf.exehtnhbb.exevddpd.exe7nbtth.exejjdpd.exebnbbhn.exepvpjd.exerfrfrfx.exetnnbbt.exelffrfxr.exerlrrrlx.exejppdj.exehbbnhb.exejpjdj.exehttnhh.exepid process 4836 thttnb.exe 2936 vvpdv.exe 3316 bhbbhn.exe 5060 9pjpd.exe 2008 llrrrxx.exe 3564 jdpdj.exe 3160 nhtnnt.exe 2124 vjdvj.exe 2948 tnhbtn.exe 4360 pjpjj.exe 1744 rxxlrlf.exe 4456 5vpjd.exe 676 bttnnn.exe 1984 3ppvd.exe 1536 hbnbnh.exe 4648 jddpj.exe 4676 nhbnnh.exe 1224 1jjjp.exe 3296 ttnbnh.exe 1592 9jvjv.exe 1732 flrflfr.exe 2924 1jvpp.exe 4168 lrlfrfr.exe 4124 5xxlfrf.exe 3924 ttnbnt.exe 2376 lrrrffr.exe 4056 hhhthb.exe 376 fxrfrfr.exe 3420 hbbbbb.exe 3196 pdpdp.exe 4960 3rrffxx.exe 4896 nhhbtn.exe 1628 rxlfrlx.exe 2796 nnnbnh.exe 5032 jppdp.exe 4228 btbhth.exe 4520 jddpv.exe 3912 rlfrxrf.exe 556 bnbnht.exe 3692 dpjvv.exe 4716 frxlfrr.exe 2340 tbbthh.exe 412 7fflxlx.exe 1112 flfrlfr.exe 1016 5ppdp.exe 3952 nbbttn.exe 1216 pdjpd.exe 736 rlrflfr.exe 3940 bnhbhn.exe 3644 1lfrrlf.exe 1736 htnhbb.exe 2360 vddpd.exe 3504 7nbtth.exe 1424 jjdpd.exe 4140 bnbbhn.exe 2924 pvpjd.exe 5028 rfrfrfx.exe 1792 tnnbbt.exe 452 lffrfxr.exe 3456 rlrrrlx.exe 3212 jppdj.exe 4484 hbbnhb.exe 4424 jpjdj.exe 4832 httnhh.exe -
Processes:
resource yara_rule behavioral2/memory/3804-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/676-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-314-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2360-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-359-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-362-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-371-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-391-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-398-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-399-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-417-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-424-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-430-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-432-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7841a55a6c57d73c6e397b2821320acd39c931ae0a1d9b236f050067e95568db.exethttnb.exevvpdv.exebhbbhn.exe9pjpd.exellrrrxx.exejdpdj.exenhtnnt.exevjdvj.exetnhbtn.exepjpjj.exerxxlrlf.exe5vpjd.exebttnnn.exe3ppvd.exehbnbnh.exejddpj.exenhbnnh.exe1jjjp.exettnbnh.exe9jvjv.exeflrflfr.exedescription pid process target process PID 3804 wrote to memory of 4836 3804 7841a55a6c57d73c6e397b2821320acd39c931ae0a1d9b236f050067e95568db.exe thttnb.exe PID 3804 wrote to memory of 4836 3804 7841a55a6c57d73c6e397b2821320acd39c931ae0a1d9b236f050067e95568db.exe thttnb.exe PID 3804 wrote to memory of 4836 3804 7841a55a6c57d73c6e397b2821320acd39c931ae0a1d9b236f050067e95568db.exe thttnb.exe PID 4836 wrote to memory of 2936 4836 thttnb.exe vvpdv.exe PID 4836 wrote to memory of 2936 4836 thttnb.exe vvpdv.exe PID 4836 wrote to memory of 2936 4836 thttnb.exe vvpdv.exe PID 2936 wrote to memory of 3316 2936 vvpdv.exe bhbbhn.exe PID 2936 wrote to memory of 3316 2936 vvpdv.exe bhbbhn.exe PID 2936 wrote to memory of 3316 2936 vvpdv.exe bhbbhn.exe PID 3316 wrote to memory of 5060 3316 bhbbhn.exe 9pjpd.exe PID 3316 wrote to memory of 5060 3316 bhbbhn.exe 9pjpd.exe PID 3316 wrote to memory of 5060 3316 bhbbhn.exe 9pjpd.exe PID 5060 wrote to memory of 2008 5060 9pjpd.exe llrrrxx.exe PID 5060 wrote to memory of 2008 5060 9pjpd.exe llrrrxx.exe PID 5060 wrote to memory of 2008 5060 9pjpd.exe llrrrxx.exe PID 2008 wrote to memory of 3564 2008 llrrrxx.exe jdpdj.exe PID 2008 wrote to memory of 3564 2008 llrrrxx.exe jdpdj.exe PID 2008 wrote to memory of 3564 2008 llrrrxx.exe jdpdj.exe PID 3564 wrote to memory of 3160 3564 jdpdj.exe nhtnnt.exe PID 3564 wrote to memory of 3160 3564 jdpdj.exe nhtnnt.exe PID 3564 wrote to memory of 3160 3564 jdpdj.exe nhtnnt.exe PID 3160 wrote to memory of 2124 3160 nhtnnt.exe vjdvj.exe PID 3160 wrote to memory of 2124 3160 nhtnnt.exe vjdvj.exe PID 3160 wrote to memory of 2124 3160 nhtnnt.exe vjdvj.exe PID 2124 wrote to memory of 2948 2124 vjdvj.exe tnhbtn.exe PID 2124 wrote to memory of 2948 2124 vjdvj.exe tnhbtn.exe PID 2124 wrote to memory of 2948 2124 vjdvj.exe tnhbtn.exe PID 2948 wrote to memory of 4360 2948 tnhbtn.exe pjpjj.exe PID 2948 wrote to memory of 4360 2948 tnhbtn.exe pjpjj.exe PID 2948 wrote to memory of 4360 2948 tnhbtn.exe pjpjj.exe PID 4360 wrote to memory of 1744 4360 pjpjj.exe rxxlrlf.exe PID 4360 wrote to memory of 1744 4360 pjpjj.exe rxxlrlf.exe PID 4360 wrote to memory of 1744 4360 pjpjj.exe rxxlrlf.exe PID 1744 wrote to memory of 4456 1744 rxxlrlf.exe 5vpjd.exe PID 1744 wrote to memory of 4456 1744 rxxlrlf.exe 5vpjd.exe PID 1744 wrote to memory of 4456 1744 rxxlrlf.exe 5vpjd.exe PID 4456 wrote to memory of 676 4456 5vpjd.exe bttnnn.exe PID 4456 wrote to memory of 676 4456 5vpjd.exe bttnnn.exe PID 4456 wrote to memory of 676 4456 5vpjd.exe bttnnn.exe PID 676 wrote to memory of 1984 676 bttnnn.exe 3ppvd.exe PID 676 wrote to memory of 1984 676 bttnnn.exe 3ppvd.exe PID 676 wrote to memory of 1984 676 bttnnn.exe 3ppvd.exe PID 1984 wrote to memory of 1536 1984 3ppvd.exe hbnbnh.exe PID 1984 wrote to memory of 1536 1984 3ppvd.exe hbnbnh.exe PID 1984 wrote to memory of 1536 1984 3ppvd.exe hbnbnh.exe PID 1536 wrote to memory of 4648 1536 hbnbnh.exe jddpj.exe PID 1536 wrote to memory of 4648 1536 hbnbnh.exe jddpj.exe PID 1536 wrote to memory of 4648 1536 hbnbnh.exe jddpj.exe PID 4648 wrote to memory of 4676 4648 jddpj.exe nhbnnh.exe PID 4648 wrote to memory of 4676 4648 jddpj.exe nhbnnh.exe PID 4648 wrote to memory of 4676 4648 jddpj.exe nhbnnh.exe PID 4676 wrote to memory of 1224 4676 nhbnnh.exe 1jjjp.exe PID 4676 wrote to memory of 1224 4676 nhbnnh.exe 1jjjp.exe PID 4676 wrote to memory of 1224 4676 nhbnnh.exe 1jjjp.exe PID 1224 wrote to memory of 3296 1224 1jjjp.exe ttnbnh.exe PID 1224 wrote to memory of 3296 1224 1jjjp.exe ttnbnh.exe PID 1224 wrote to memory of 3296 1224 1jjjp.exe ttnbnh.exe PID 3296 wrote to memory of 1592 3296 ttnbnh.exe 9jvjv.exe PID 3296 wrote to memory of 1592 3296 ttnbnh.exe 9jvjv.exe PID 3296 wrote to memory of 1592 3296 ttnbnh.exe 9jvjv.exe PID 1592 wrote to memory of 1732 1592 9jvjv.exe flrflfr.exe PID 1592 wrote to memory of 1732 1592 9jvjv.exe flrflfr.exe PID 1592 wrote to memory of 1732 1592 9jvjv.exe flrflfr.exe PID 1732 wrote to memory of 2924 1732 flrflfr.exe 1jvpp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7841a55a6c57d73c6e397b2821320acd39c931ae0a1d9b236f050067e95568db.exe"C:\Users\Admin\AppData\Local\Temp\7841a55a6c57d73c6e397b2821320acd39c931ae0a1d9b236f050067e95568db.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\thttnb.exec:\thttnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvpdv.exec:\vvpdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhbbhn.exec:\bhbbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9pjpd.exec:\9pjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llrrrxx.exec:\llrrrxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdpdj.exec:\jdpdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhtnnt.exec:\nhtnnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjdvj.exec:\vjdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnhbtn.exec:\tnhbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjpjj.exec:\pjpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxxlrlf.exec:\rxxlrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5vpjd.exec:\5vpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bttnnn.exec:\bttnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3ppvd.exec:\3ppvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbnbnh.exec:\hbnbnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jddpj.exec:\jddpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbnnh.exec:\nhbnnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1jjjp.exec:\1jjjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttnbnh.exec:\ttnbnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9jvjv.exec:\9jvjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flrflfr.exec:\flrflfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1jvpp.exec:\1jvpp.exe23⤵
- Executes dropped EXE
-
\??\c:\lrlfrfr.exec:\lrlfrfr.exe24⤵
- Executes dropped EXE
-
\??\c:\5xxlfrf.exec:\5xxlfrf.exe25⤵
- Executes dropped EXE
-
\??\c:\ttnbnt.exec:\ttnbnt.exe26⤵
- Executes dropped EXE
-
\??\c:\lrrrffr.exec:\lrrrffr.exe27⤵
- Executes dropped EXE
-
\??\c:\hhhthb.exec:\hhhthb.exe28⤵
- Executes dropped EXE
-
\??\c:\fxrfrfr.exec:\fxrfrfr.exe29⤵
- Executes dropped EXE
-
\??\c:\hbbbbb.exec:\hbbbbb.exe30⤵
- Executes dropped EXE
-
\??\c:\pdpdp.exec:\pdpdp.exe31⤵
- Executes dropped EXE
-
\??\c:\3rrffxx.exec:\3rrffxx.exe32⤵
- Executes dropped EXE
-
\??\c:\nhhbtn.exec:\nhhbtn.exe33⤵
- Executes dropped EXE
-
\??\c:\rxlfrlx.exec:\rxlfrlx.exe34⤵
- Executes dropped EXE
-
\??\c:\nnnbnh.exec:\nnnbnh.exe35⤵
- Executes dropped EXE
-
\??\c:\jppdp.exec:\jppdp.exe36⤵
- Executes dropped EXE
-
\??\c:\btbhth.exec:\btbhth.exe37⤵
- Executes dropped EXE
-
\??\c:\jddpv.exec:\jddpv.exe38⤵
- Executes dropped EXE
-
\??\c:\rlfrxrf.exec:\rlfrxrf.exe39⤵
- Executes dropped EXE
-
\??\c:\bnbnht.exec:\bnbnht.exe40⤵
- Executes dropped EXE
-
\??\c:\dpjvv.exec:\dpjvv.exe41⤵
- Executes dropped EXE
-
\??\c:\frxlfrr.exec:\frxlfrr.exe42⤵
- Executes dropped EXE
-
\??\c:\tbbthh.exec:\tbbthh.exe43⤵
- Executes dropped EXE
-
\??\c:\7fflxlx.exec:\7fflxlx.exe44⤵
- Executes dropped EXE
-
\??\c:\flfrlfr.exec:\flfrlfr.exe45⤵
- Executes dropped EXE
-
\??\c:\5ppdp.exec:\5ppdp.exe46⤵
- Executes dropped EXE
-
\??\c:\nbbttn.exec:\nbbttn.exe47⤵
- Executes dropped EXE
-
\??\c:\pdjpd.exec:\pdjpd.exe48⤵
- Executes dropped EXE
-
\??\c:\rlrflfr.exec:\rlrflfr.exe49⤵
- Executes dropped EXE
-
\??\c:\bnhbhn.exec:\bnhbhn.exe50⤵
- Executes dropped EXE
-
\??\c:\1lfrrlf.exec:\1lfrrlf.exe51⤵
- Executes dropped EXE
-
\??\c:\htnhbb.exec:\htnhbb.exe52⤵
- Executes dropped EXE
-
\??\c:\vddpd.exec:\vddpd.exe53⤵
- Executes dropped EXE
-
\??\c:\7nbtth.exec:\7nbtth.exe54⤵
- Executes dropped EXE
-
\??\c:\jjdpd.exec:\jjdpd.exe55⤵
- Executes dropped EXE
-
\??\c:\bnbbhn.exec:\bnbbhn.exe56⤵
- Executes dropped EXE
-
\??\c:\pvpjd.exec:\pvpjd.exe57⤵
- Executes dropped EXE
-
\??\c:\rfrfrfx.exec:\rfrfrfx.exe58⤵
- Executes dropped EXE
-
\??\c:\tnnbbt.exec:\tnnbbt.exe59⤵
- Executes dropped EXE
-
\??\c:\lffrfxr.exec:\lffrfxr.exe60⤵
- Executes dropped EXE
-
\??\c:\rlrrrlx.exec:\rlrrrlx.exe61⤵
- Executes dropped EXE
-
\??\c:\jppdj.exec:\jppdj.exe62⤵
- Executes dropped EXE
-
\??\c:\hbbnhb.exec:\hbbnhb.exe63⤵
- Executes dropped EXE
-
\??\c:\jpjdj.exec:\jpjdj.exe64⤵
- Executes dropped EXE
-
\??\c:\httnhh.exec:\httnhh.exe65⤵
- Executes dropped EXE
-
\??\c:\nttnbb.exec:\nttnbb.exe66⤵
-
\??\c:\pdvvj.exec:\pdvvj.exe67⤵
-
\??\c:\rxlflfr.exec:\rxlflfr.exe68⤵
-
\??\c:\tbtbht.exec:\tbtbht.exe69⤵
-
\??\c:\flxflrx.exec:\flxflrx.exe70⤵
-
\??\c:\jddjd.exec:\jddjd.exe71⤵
-
\??\c:\xrxlfxf.exec:\xrxlfxf.exe72⤵
-
\??\c:\tnhhbb.exec:\tnhhbb.exe73⤵
-
\??\c:\lxlxlfr.exec:\lxlxlfr.exe74⤵
-
\??\c:\nbthbt.exec:\nbthbt.exe75⤵
-
\??\c:\jvvpd.exec:\jvvpd.exe76⤵
-
\??\c:\thhbth.exec:\thhbth.exe77⤵
-
\??\c:\5ddpd.exec:\5ddpd.exe78⤵
-
\??\c:\5fxrxxr.exec:\5fxrxxr.exe79⤵
-
\??\c:\hbnbnh.exec:\hbnbnh.exe80⤵
-
\??\c:\lffxlfl.exec:\lffxlfl.exe81⤵
-
\??\c:\nhbbtt.exec:\nhbbtt.exe82⤵
-
\??\c:\vvjjj.exec:\vvjjj.exe83⤵
-
\??\c:\hhhhnh.exec:\hhhhnh.exe84⤵
-
\??\c:\jdvpp.exec:\jdvpp.exe85⤵
-
\??\c:\vppjd.exec:\vppjd.exe86⤵
-
\??\c:\1hnhtb.exec:\1hnhtb.exe87⤵
-
\??\c:\9hbthh.exec:\9hbthh.exe88⤵
-
\??\c:\rlrrffx.exec:\rlrrffx.exe89⤵
-
\??\c:\xxlxrlx.exec:\xxlxrlx.exe90⤵
-
\??\c:\vpdvd.exec:\vpdvd.exe91⤵
-
\??\c:\fxlxrrl.exec:\fxlxrrl.exe92⤵
-
\??\c:\tnbtbb.exec:\tnbtbb.exe93⤵
-
\??\c:\lfxxxrf.exec:\lfxxxrf.exe94⤵
-
\??\c:\thbhhh.exec:\thbhhh.exe95⤵
-
\??\c:\pvddv.exec:\pvddv.exe96⤵
-
\??\c:\fxxrffx.exec:\fxxrffx.exe97⤵
-
\??\c:\bthhnn.exec:\bthhnn.exe98⤵
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe99⤵
-
\??\c:\thnttt.exec:\thnttt.exe100⤵
-
\??\c:\vjdjv.exec:\vjdjv.exe101⤵
-
\??\c:\dvjdp.exec:\dvjdp.exe102⤵
-
\??\c:\5rxfrrr.exec:\5rxfrrr.exe103⤵
-
\??\c:\5hnnhh.exec:\5hnnhh.exe104⤵
-
\??\c:\lffrllf.exec:\lffrllf.exe105⤵
-
\??\c:\hhtttt.exec:\hhtttt.exe106⤵
-
\??\c:\fxllffx.exec:\fxllffx.exe107⤵
-
\??\c:\tbhbtt.exec:\tbhbtt.exe108⤵
-
\??\c:\7ppjd.exec:\7ppjd.exe109⤵
-
\??\c:\bhnhbb.exec:\bhnhbb.exe110⤵
-
\??\c:\rxrrllf.exec:\rxrrllf.exe111⤵
-
\??\c:\nnhhhh.exec:\nnhhhh.exe112⤵
-
\??\c:\vvvdv.exec:\vvvdv.exe113⤵
-
\??\c:\rfxxllf.exec:\rfxxllf.exe114⤵
-
\??\c:\1nbbtt.exec:\1nbbtt.exe115⤵
-
\??\c:\jjjdv.exec:\jjjdv.exe116⤵
-
\??\c:\nhhtnn.exec:\nhhtnn.exe117⤵
-
\??\c:\pjpjv.exec:\pjpjv.exe118⤵
-
\??\c:\7frfllr.exec:\7frfllr.exe119⤵
-
\??\c:\9tnnhh.exec:\9tnnhh.exe120⤵
-
\??\c:\1dvpp.exec:\1dvpp.exe121⤵
-
\??\c:\fffflrf.exec:\fffflrf.exe122⤵
-
\??\c:\bhhbhn.exec:\bhhbhn.exe123⤵
-
\??\c:\pjddv.exec:\pjddv.exe124⤵
-
\??\c:\hbtnbn.exec:\hbtnbn.exe125⤵
-
\??\c:\ddvpj.exec:\ddvpj.exe126⤵
-
\??\c:\lxxrllf.exec:\lxxrllf.exe127⤵
-
\??\c:\nbbbtn.exec:\nbbbtn.exe128⤵
-
\??\c:\jvdvv.exec:\jvdvv.exe129⤵
-
\??\c:\rxllxrl.exec:\rxllxrl.exe130⤵
-
\??\c:\dvjjd.exec:\dvjjd.exe131⤵
-
\??\c:\vjjdp.exec:\vjjdp.exe132⤵
-
\??\c:\5btnbb.exec:\5btnbb.exe133⤵
-
\??\c:\nttbtn.exec:\nttbtn.exe134⤵
-
\??\c:\flflxrr.exec:\flflxrr.exe135⤵
-
\??\c:\hnbntb.exec:\hnbntb.exe136⤵
-
\??\c:\hhhbbb.exec:\hhhbbb.exe137⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe138⤵
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe139⤵
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe140⤵
-
\??\c:\vpvdv.exec:\vpvdv.exe141⤵
-
\??\c:\fxxrlll.exec:\fxxrlll.exe142⤵
-
\??\c:\5nnnhh.exec:\5nnnhh.exe143⤵
-
\??\c:\ddvpp.exec:\ddvpp.exe144⤵
-
\??\c:\9xrfrlx.exec:\9xrfrlx.exe145⤵
-
\??\c:\bhhhbb.exec:\bhhhbb.exe146⤵
-
\??\c:\jddpd.exec:\jddpd.exe147⤵
-
\??\c:\rxlfrxr.exec:\rxlfrxr.exe148⤵
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe149⤵
-
\??\c:\7vppj.exec:\7vppj.exe150⤵
-
\??\c:\jddvp.exec:\jddvp.exe151⤵
-
\??\c:\rlrfllr.exec:\rlrfllr.exe152⤵
-
\??\c:\bnhhbb.exec:\bnhhbb.exe153⤵
-
\??\c:\ddvpj.exec:\ddvpj.exe154⤵
-
\??\c:\rllffxl.exec:\rllffxl.exe155⤵
-
\??\c:\jddvp.exec:\jddvp.exe156⤵
-
\??\c:\fxxrfrl.exec:\fxxrfrl.exe157⤵
-
\??\c:\nnnnhh.exec:\nnnnhh.exe158⤵
-
\??\c:\pjvvd.exec:\pjvvd.exe159⤵
-
\??\c:\9rrrlxr.exec:\9rrrlxr.exe160⤵
-
\??\c:\jvvvj.exec:\jvvvj.exe161⤵
-
\??\c:\lllxrrl.exec:\lllxrrl.exe162⤵
-
\??\c:\9bhhtt.exec:\9bhhtt.exe163⤵
-
\??\c:\jpppj.exec:\jpppj.exe164⤵
-
\??\c:\rffxrrr.exec:\rffxrrr.exe165⤵
-
\??\c:\xfrfrfl.exec:\xfrfrfl.exe166⤵
-
\??\c:\thnnnn.exec:\thnnnn.exe167⤵
-
\??\c:\jjjjd.exec:\jjjjd.exe168⤵
-
\??\c:\hbtnht.exec:\hbtnht.exe169⤵
-
\??\c:\hnnnhh.exec:\hnnnhh.exe170⤵
-
\??\c:\xrxrlll.exec:\xrxrlll.exe171⤵
-
\??\c:\nnbhbh.exec:\nnbhbh.exe172⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe173⤵
-
\??\c:\lllxlxr.exec:\lllxlxr.exe174⤵
-
\??\c:\9lllflr.exec:\9lllflr.exe175⤵
-
\??\c:\htntnn.exec:\htntnn.exe176⤵
-
\??\c:\3ddvp.exec:\3ddvp.exe177⤵
-
\??\c:\lxxlrfl.exec:\lxxlrfl.exe178⤵
-
\??\c:\bnbhnt.exec:\bnbhnt.exe179⤵
-
\??\c:\7jvpd.exec:\7jvpd.exe180⤵
-
\??\c:\xrrlxfx.exec:\xrrlxfx.exe181⤵
-
\??\c:\7ntnhh.exec:\7ntnhh.exe182⤵
-
\??\c:\jvddp.exec:\jvddp.exe183⤵
-
\??\c:\rxfxlll.exec:\rxfxlll.exe184⤵
-
\??\c:\thnhbb.exec:\thnhbb.exe185⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe186⤵
-
\??\c:\rlrlfll.exec:\rlrlfll.exe187⤵
-
\??\c:\5nthbn.exec:\5nthbn.exe188⤵
-
\??\c:\jvvpp.exec:\jvvpp.exe189⤵
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe190⤵
-
\??\c:\9hnntt.exec:\9hnntt.exe191⤵
-
\??\c:\llfrlll.exec:\llfrlll.exe192⤵
-
\??\c:\1hbbtt.exec:\1hbbtt.exe193⤵
-
\??\c:\hnnhbb.exec:\hnnhbb.exe194⤵
-
\??\c:\djjvp.exec:\djjvp.exe195⤵
-
\??\c:\7hbntn.exec:\7hbntn.exe196⤵
-
\??\c:\9jdpj.exec:\9jdpj.exe197⤵
-
\??\c:\djvdv.exec:\djvdv.exe198⤵
-
\??\c:\tbbtnn.exec:\tbbtnn.exe199⤵
-
\??\c:\9jdvj.exec:\9jdvj.exe200⤵
-
\??\c:\rlrllll.exec:\rlrllll.exe201⤵
-
\??\c:\hnttnn.exec:\hnttnn.exe202⤵
-
\??\c:\xflxrrr.exec:\xflxrrr.exe203⤵
-
\??\c:\bbtnhb.exec:\bbtnhb.exe204⤵
-
\??\c:\xrrlffx.exec:\xrrlffx.exe205⤵
-
\??\c:\7bbbtt.exec:\7bbbtt.exe206⤵
-
\??\c:\vvpjj.exec:\vvpjj.exe207⤵
-
\??\c:\bntnbh.exec:\bntnbh.exe208⤵
-
\??\c:\hbhthb.exec:\hbhthb.exe209⤵
-
\??\c:\lflfxxx.exec:\lflfxxx.exe210⤵
-
\??\c:\bhhhbt.exec:\bhhhbt.exe211⤵
-
\??\c:\3dvjv.exec:\3dvjv.exe212⤵
-
\??\c:\5rrflfx.exec:\5rrflfx.exe213⤵
-
\??\c:\lxrfrxl.exec:\lxrfrxl.exe214⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe215⤵
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe216⤵
-
\??\c:\nhbbtt.exec:\nhbbtt.exe217⤵
-
\??\c:\5xffflr.exec:\5xffflr.exe218⤵
-
\??\c:\nhnbbn.exec:\nhnbbn.exe219⤵
-
\??\c:\xrxlffx.exec:\xrxlffx.exe220⤵
-
\??\c:\5nhtnh.exec:\5nhtnh.exe221⤵
-
\??\c:\7jjvj.exec:\7jjvj.exe222⤵
-
\??\c:\1bbbhb.exec:\1bbbhb.exe223⤵
-
\??\c:\dvvpd.exec:\dvvpd.exe224⤵
-
\??\c:\xrrlxxx.exec:\xrrlxxx.exe225⤵
-
\??\c:\dvjdp.exec:\dvjdp.exe226⤵
-
\??\c:\1vpjp.exec:\1vpjp.exe227⤵
-
\??\c:\lrxxrxx.exec:\lrxxrxx.exe228⤵
-
\??\c:\7djjj.exec:\7djjj.exe229⤵
-
\??\c:\flrrflf.exec:\flrrflf.exe230⤵
-
\??\c:\tnbbnh.exec:\tnbbnh.exe231⤵
-
\??\c:\3pdpd.exec:\3pdpd.exe232⤵
-
\??\c:\lxrfffr.exec:\lxrfffr.exe233⤵
-
\??\c:\ntnbnh.exec:\ntnbnh.exe234⤵
-
\??\c:\xrlrfxr.exec:\xrlrfxr.exe235⤵
-
\??\c:\btttbt.exec:\btttbt.exe236⤵
-
\??\c:\vddpj.exec:\vddpj.exe237⤵
-
\??\c:\xrxfffl.exec:\xrxfffl.exe238⤵
-
\??\c:\bnhhtn.exec:\bnhhtn.exe239⤵
-
\??\c:\bnhtbt.exec:\bnhtbt.exe240⤵
-
\??\c:\rrflxrr.exec:\rrflxrr.exe241⤵