Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 02:24
Behavioral task
behavioral1
Sample
c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3.exe
-
Size
204KB
-
MD5
d49b6025468f9de2be613ac205266e0d
-
SHA1
3c89a48f9862be9b82d160b6aa6d3329e9873629
-
SHA256
c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3
-
SHA512
be63e7ebeecac1e89c4decad46e14065ab70e9302797d60e7f09fc0ead7565dad8a700cdea43adbf38796684cbe6d9bf4ee6a01cd0ead4a87e4ea1b76b78e64d
-
SSDEEP
6144:rcm4FmowdHoStBuhW246lCXb7YpdnSj6Ksan:x4wFHoSLjr0+Hsan
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1140-7-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4904-8-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/372-13-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3340-20-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3356-32-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4516-28-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2936-44-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2640-54-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4588-66-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4372-71-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3288-82-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4188-87-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2280-95-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1932-100-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5056-116-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4056-122-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1100-129-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2212-139-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2288-145-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4612-154-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3736-153-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1728-170-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/888-164-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4168-190-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2652-200-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4084-204-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4388-211-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4128-215-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2364-222-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1000-226-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3732-230-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3040-234-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4456-238-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4980-251-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3180-255-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/612-259-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1648-260-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1680-270-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4704-277-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3272-291-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1040-298-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3952-311-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2200-317-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2292-324-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2576-338-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1468-351-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/788-370-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4416-377-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4336-387-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4068-403-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/764-413-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2008-417-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3664-419-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/452-428-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1556-433-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1232-437-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3636-499-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3636-503-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4312-519-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2032-547-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/612-573-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1300-616-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1244-623-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1708-642-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1140-0-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\hhtbbh.exe UPX behavioral2/memory/1140-7-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4904-8-0x0000000000400000-0x0000000000436000-memory.dmp UPX \??\c:\vvppv.exe UPX behavioral2/memory/372-13-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\pjddp.exe UPX behavioral2/memory/3340-20-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\1hbttt.exe UPX C:\vjpjd.exe UPX C:\fxlxrrl.exe UPX behavioral2/memory/2936-36-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/3356-32-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4516-28-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\vjvdv.exe UPX behavioral2/memory/2936-44-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\rrlfxfx.exe UPX C:\hhhhhh.exe UPX behavioral2/memory/2640-54-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\pddjd.exe UPX C:\flxrrrr.exe UPX behavioral2/memory/4588-66-0x0000000000400000-0x0000000000436000-memory.dmp UPX \??\c:\hhhnhh.exe UPX behavioral2/memory/4372-71-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\dpppj.exe UPX \??\c:\5btnhb.exe UPX behavioral2/memory/3288-82-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\ttnnnb.exe UPX behavioral2/memory/4188-87-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\rflffxx.exe UPX behavioral2/memory/2280-95-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/1932-100-0x0000000000400000-0x0000000000436000-memory.dmp UPX \??\c:\frxxflx.exe UPX C:\rlfflrf.exe UPX behavioral2/memory/2948-106-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\nhbtbb.exe UPX behavioral2/memory/5056-116-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\vpvvj.exe UPX behavioral2/memory/4056-122-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\tntttb.exe UPX behavioral2/memory/1100-129-0x0000000000400000-0x0000000000436000-memory.dmp UPX \??\c:\ffrrlrr.exe UPX C:\1lxxflf.exe UPX behavioral2/memory/2212-139-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\tthnnn.exe UPX C:\dpjjj.exe UPX behavioral2/memory/2288-145-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\lllrlrl.exe UPX behavioral2/memory/4612-154-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/3736-153-0x0000000000400000-0x0000000000436000-memory.dmp UPX \??\c:\hbnhhh.exe UPX C:\ffllllf.exe UPX C:\lfrfffr.exe UPX behavioral2/memory/1728-170-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4832-171-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\tthhhh.exe UPX behavioral2/memory/888-164-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\ffrrrxx.exe UPX \??\c:\tnnttt.exe UPX behavioral2/memory/4168-190-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/2652-200-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4084-204-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4388-211-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4128-215-0x0000000000400000-0x0000000000436000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
hhtbbh.exevvppv.exepjddp.exe1hbttt.exevjpjd.exefxlxrrl.exevjvdv.exerrlfxfx.exehhhhhh.exepddjd.exeflxrrrr.exehhhnhh.exedpppj.exe5btnhb.exettnnnb.exerflffxx.exefrxxflx.exerlfflrf.exenhbtbb.exevpvvj.exeffrrlrr.exetntttb.exe1lxxflf.exetthnnn.exedpjjj.exelllrlrl.exehbnhhh.exeffllllf.exelfrfffr.exetthhhh.exeffrrrxx.exetnnttt.exevppjp.exelrfffxx.exenbnhhh.exeppdjv.exefxxrllx.exebtttnt.exebthbnt.exejjpjd.exelfrrxxl.exebhhhnh.exedvdjj.exexffxxrr.exe9bhhhn.exedvddv.exeffflfff.exe3xfllll.exennnnbh.exepdddd.exelrffxff.exetbtbhn.exejvjvd.exelffxrrr.exebtbtnn.exehhhhbb.exepppdd.exeppjjd.exe3rrlxxr.exebnnhbb.exebnbhnb.exepdjdp.exerllfffx.exelxxxrlr.exepid process 4904 hhtbbh.exe 372 vvppv.exe 3340 pjddp.exe 4516 1hbttt.exe 3356 vjpjd.exe 2936 fxlxrrl.exe 2392 vjvdv.exe 2644 rrlfxfx.exe 2640 hhhhhh.exe 3372 pddjd.exe 4588 flxrrrr.exe 4372 hhhnhh.exe 3288 dpppj.exe 4188 5btnhb.exe 2280 ttnnnb.exe 1932 rflffxx.exe 1440 frxxflx.exe 2948 rlfflrf.exe 5056 nhbtbb.exe 4056 vpvvj.exe 1100 ffrrlrr.exe 2344 tntttb.exe 2212 1lxxflf.exe 2288 tthnnn.exe 4612 dpjjj.exe 3736 lllrlrl.exe 888 hbnhhh.exe 1728 ffllllf.exe 4832 lfrfffr.exe 516 tthhhh.exe 4924 ffrrrxx.exe 4112 tnnttt.exe 4168 vppjp.exe 3656 lrfffxx.exe 2652 nbnhhh.exe 4084 ppdjv.exe 4992 fxxrllx.exe 4388 btttnt.exe 4128 bthbnt.exe 4520 jjpjd.exe 2364 lfrrxxl.exe 1000 bhhhnh.exe 3732 dvdjj.exe 3040 xffxxrr.exe 4456 9bhhhn.exe 4892 dvddv.exe 1200 ffflfff.exe 2184 3xfllll.exe 4980 nnnnbh.exe 3180 pdddd.exe 612 lrffxff.exe 1648 tbtbhn.exe 3572 jvjvd.exe 1680 lffxrrr.exe 4372 btbtnn.exe 4704 hhhhbb.exe 4188 pppdd.exe 3400 ppjjd.exe 1496 3rrlxxr.exe 3608 bnnhbb.exe 3272 bnbhnb.exe 4472 pdjdp.exe 1040 rllfffx.exe 4056 lxxxrlr.exe -
Processes:
resource yara_rule behavioral2/memory/1140-0-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hhtbbh.exe upx behavioral2/memory/1140-7-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4904-8-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\vvppv.exe upx behavioral2/memory/372-13-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pjddp.exe upx behavioral2/memory/3340-20-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\1hbttt.exe upx C:\vjpjd.exe upx C:\fxlxrrl.exe upx behavioral2/memory/2936-36-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3356-32-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4516-28-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vjvdv.exe upx behavioral2/memory/2936-44-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rrlfxfx.exe upx C:\hhhhhh.exe upx behavioral2/memory/2640-54-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pddjd.exe upx C:\flxrrrr.exe upx behavioral2/memory/4588-66-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\hhhnhh.exe upx behavioral2/memory/4372-71-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dpppj.exe upx \??\c:\5btnhb.exe upx behavioral2/memory/3288-82-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ttnnnb.exe upx behavioral2/memory/4188-87-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rflffxx.exe upx behavioral2/memory/2280-95-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1932-100-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\frxxflx.exe upx C:\rlfflrf.exe upx behavioral2/memory/2948-106-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nhbtbb.exe upx behavioral2/memory/5056-116-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vpvvj.exe upx behavioral2/memory/4056-122-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\tntttb.exe upx behavioral2/memory/1100-129-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\ffrrlrr.exe upx C:\1lxxflf.exe upx behavioral2/memory/2212-139-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\tthnnn.exe upx C:\dpjjj.exe upx behavioral2/memory/2288-145-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\lllrlrl.exe upx behavioral2/memory/4612-154-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3736-153-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\hbnhhh.exe upx C:\ffllllf.exe upx C:\lfrfffr.exe upx behavioral2/memory/1728-170-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4832-171-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\tthhhh.exe upx behavioral2/memory/888-164-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ffrrrxx.exe upx \??\c:\tnnttt.exe upx behavioral2/memory/4168-190-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2652-200-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4084-204-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4388-211-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4128-215-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3.exehhtbbh.exevvppv.exepjddp.exe1hbttt.exevjpjd.exefxlxrrl.exevjvdv.exerrlfxfx.exehhhhhh.exepddjd.exeflxrrrr.exehhhnhh.exedpppj.exe5btnhb.exettnnnb.exerflffxx.exefrxxflx.exerlfflrf.exenhbtbb.exevpvvj.exeffrrlrr.exedescription pid process target process PID 1140 wrote to memory of 4904 1140 c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3.exe hhtbbh.exe PID 1140 wrote to memory of 4904 1140 c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3.exe hhtbbh.exe PID 1140 wrote to memory of 4904 1140 c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3.exe hhtbbh.exe PID 4904 wrote to memory of 372 4904 hhtbbh.exe vvppv.exe PID 4904 wrote to memory of 372 4904 hhtbbh.exe vvppv.exe PID 4904 wrote to memory of 372 4904 hhtbbh.exe vvppv.exe PID 372 wrote to memory of 3340 372 vvppv.exe pjddp.exe PID 372 wrote to memory of 3340 372 vvppv.exe pjddp.exe PID 372 wrote to memory of 3340 372 vvppv.exe pjddp.exe PID 3340 wrote to memory of 4516 3340 pjddp.exe 1hbttt.exe PID 3340 wrote to memory of 4516 3340 pjddp.exe 1hbttt.exe PID 3340 wrote to memory of 4516 3340 pjddp.exe 1hbttt.exe PID 4516 wrote to memory of 3356 4516 1hbttt.exe vjpjd.exe PID 4516 wrote to memory of 3356 4516 1hbttt.exe vjpjd.exe PID 4516 wrote to memory of 3356 4516 1hbttt.exe vjpjd.exe PID 3356 wrote to memory of 2936 3356 vjpjd.exe fxlxrrl.exe PID 3356 wrote to memory of 2936 3356 vjpjd.exe fxlxrrl.exe PID 3356 wrote to memory of 2936 3356 vjpjd.exe fxlxrrl.exe PID 2936 wrote to memory of 2392 2936 fxlxrrl.exe vjvdv.exe PID 2936 wrote to memory of 2392 2936 fxlxrrl.exe vjvdv.exe PID 2936 wrote to memory of 2392 2936 fxlxrrl.exe vjvdv.exe PID 2392 wrote to memory of 2644 2392 vjvdv.exe rrlfxfx.exe PID 2392 wrote to memory of 2644 2392 vjvdv.exe rrlfxfx.exe PID 2392 wrote to memory of 2644 2392 vjvdv.exe rrlfxfx.exe PID 2644 wrote to memory of 2640 2644 rrlfxfx.exe hhhhhh.exe PID 2644 wrote to memory of 2640 2644 rrlfxfx.exe hhhhhh.exe PID 2644 wrote to memory of 2640 2644 rrlfxfx.exe hhhhhh.exe PID 2640 wrote to memory of 3372 2640 hhhhhh.exe pddjd.exe PID 2640 wrote to memory of 3372 2640 hhhhhh.exe pddjd.exe PID 2640 wrote to memory of 3372 2640 hhhhhh.exe pddjd.exe PID 3372 wrote to memory of 4588 3372 pddjd.exe flxrrrr.exe PID 3372 wrote to memory of 4588 3372 pddjd.exe flxrrrr.exe PID 3372 wrote to memory of 4588 3372 pddjd.exe flxrrrr.exe PID 4588 wrote to memory of 4372 4588 flxrrrr.exe hhhnhh.exe PID 4588 wrote to memory of 4372 4588 flxrrrr.exe hhhnhh.exe PID 4588 wrote to memory of 4372 4588 flxrrrr.exe hhhnhh.exe PID 4372 wrote to memory of 3288 4372 hhhnhh.exe dpppj.exe PID 4372 wrote to memory of 3288 4372 hhhnhh.exe dpppj.exe PID 4372 wrote to memory of 3288 4372 hhhnhh.exe dpppj.exe PID 3288 wrote to memory of 4188 3288 dpppj.exe 5btnhb.exe PID 3288 wrote to memory of 4188 3288 dpppj.exe 5btnhb.exe PID 3288 wrote to memory of 4188 3288 dpppj.exe 5btnhb.exe PID 4188 wrote to memory of 2280 4188 5btnhb.exe ttnnnb.exe PID 4188 wrote to memory of 2280 4188 5btnhb.exe ttnnnb.exe PID 4188 wrote to memory of 2280 4188 5btnhb.exe ttnnnb.exe PID 2280 wrote to memory of 1932 2280 ttnnnb.exe rflffxx.exe PID 2280 wrote to memory of 1932 2280 ttnnnb.exe rflffxx.exe PID 2280 wrote to memory of 1932 2280 ttnnnb.exe rflffxx.exe PID 1932 wrote to memory of 1440 1932 rflffxx.exe frxxflx.exe PID 1932 wrote to memory of 1440 1932 rflffxx.exe frxxflx.exe PID 1932 wrote to memory of 1440 1932 rflffxx.exe frxxflx.exe PID 1440 wrote to memory of 2948 1440 frxxflx.exe rlfflrf.exe PID 1440 wrote to memory of 2948 1440 frxxflx.exe rlfflrf.exe PID 1440 wrote to memory of 2948 1440 frxxflx.exe rlfflrf.exe PID 2948 wrote to memory of 5056 2948 rlfflrf.exe nhbtbb.exe PID 2948 wrote to memory of 5056 2948 rlfflrf.exe nhbtbb.exe PID 2948 wrote to memory of 5056 2948 rlfflrf.exe nhbtbb.exe PID 5056 wrote to memory of 4056 5056 nhbtbb.exe vpvvj.exe PID 5056 wrote to memory of 4056 5056 nhbtbb.exe vpvvj.exe PID 5056 wrote to memory of 4056 5056 nhbtbb.exe vpvvj.exe PID 4056 wrote to memory of 1100 4056 vpvvj.exe ffrrlrr.exe PID 4056 wrote to memory of 1100 4056 vpvvj.exe ffrrlrr.exe PID 4056 wrote to memory of 1100 4056 vpvvj.exe ffrrlrr.exe PID 1100 wrote to memory of 2344 1100 ffrrlrr.exe tntttb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3.exe"C:\Users\Admin\AppData\Local\Temp\c80cca9970613056bcfe795861817e5190f0e792593319b919a626e1406218a3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\hhtbbh.exec:\hhtbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\vvppv.exec:\vvppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\pjddp.exec:\pjddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\1hbttt.exec:\1hbttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\vjpjd.exec:\vjpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\fxlxrrl.exec:\fxlxrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\vjvdv.exec:\vjvdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\rrlfxfx.exec:\rrlfxfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\hhhhhh.exec:\hhhhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\pddjd.exec:\pddjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\flxrrrr.exec:\flxrrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\hhhnhh.exec:\hhhnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\dpppj.exec:\dpppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\5btnhb.exec:\5btnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\ttnnnb.exec:\ttnnnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\rflffxx.exec:\rflffxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\frxxflx.exec:\frxxflx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\rlfflrf.exec:\rlfflrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\nhbtbb.exec:\nhbtbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\vpvvj.exec:\vpvvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\ffrrlrr.exec:\ffrrlrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\tntttb.exec:\tntttb.exe23⤵
- Executes dropped EXE
PID:2344 -
\??\c:\1lxxflf.exec:\1lxxflf.exe24⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tthnnn.exec:\tthnnn.exe25⤵
- Executes dropped EXE
PID:2288 -
\??\c:\dpjjj.exec:\dpjjj.exe26⤵
- Executes dropped EXE
PID:4612 -
\??\c:\lllrlrl.exec:\lllrlrl.exe27⤵
- Executes dropped EXE
PID:3736 -
\??\c:\hbnhhh.exec:\hbnhhh.exe28⤵
- Executes dropped EXE
PID:888 -
\??\c:\ffllllf.exec:\ffllllf.exe29⤵
- Executes dropped EXE
PID:1728 -
\??\c:\lfrfffr.exec:\lfrfffr.exe30⤵
- Executes dropped EXE
PID:4832 -
\??\c:\tthhhh.exec:\tthhhh.exe31⤵
- Executes dropped EXE
PID:516 -
\??\c:\ffrrrxx.exec:\ffrrrxx.exe32⤵
- Executes dropped EXE
PID:4924 -
\??\c:\tnnttt.exec:\tnnttt.exe33⤵
- Executes dropped EXE
PID:4112 -
\??\c:\vppjp.exec:\vppjp.exe34⤵
- Executes dropped EXE
PID:4168 -
\??\c:\lrfffxx.exec:\lrfffxx.exe35⤵
- Executes dropped EXE
PID:3656 -
\??\c:\nbnhhh.exec:\nbnhhh.exe36⤵
- Executes dropped EXE
PID:2652 -
\??\c:\ppdjv.exec:\ppdjv.exe37⤵
- Executes dropped EXE
PID:4084 -
\??\c:\fxxrllx.exec:\fxxrllx.exe38⤵
- Executes dropped EXE
PID:4992 -
\??\c:\btttnt.exec:\btttnt.exe39⤵
- Executes dropped EXE
PID:4388 -
\??\c:\bthbnt.exec:\bthbnt.exe40⤵
- Executes dropped EXE
PID:4128 -
\??\c:\jjpjd.exec:\jjpjd.exe41⤵
- Executes dropped EXE
PID:4520 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe42⤵
- Executes dropped EXE
PID:2364 -
\??\c:\bhhhnh.exec:\bhhhnh.exe43⤵
- Executes dropped EXE
PID:1000 -
\??\c:\dvdjj.exec:\dvdjj.exe44⤵
- Executes dropped EXE
PID:3732 -
\??\c:\xffxxrr.exec:\xffxxrr.exe45⤵
- Executes dropped EXE
PID:3040 -
\??\c:\9bhhhn.exec:\9bhhhn.exe46⤵
- Executes dropped EXE
PID:4456 -
\??\c:\dvddv.exec:\dvddv.exe47⤵
- Executes dropped EXE
PID:4892 -
\??\c:\ffflfff.exec:\ffflfff.exe48⤵
- Executes dropped EXE
PID:1200 -
\??\c:\3xfllll.exec:\3xfllll.exe49⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nnnnbh.exec:\nnnnbh.exe50⤵
- Executes dropped EXE
PID:4980 -
\??\c:\pdddd.exec:\pdddd.exe51⤵
- Executes dropped EXE
PID:3180 -
\??\c:\lrffxff.exec:\lrffxff.exe52⤵
- Executes dropped EXE
PID:612 -
\??\c:\tbtbhn.exec:\tbtbhn.exe53⤵
- Executes dropped EXE
PID:1648 -
\??\c:\jvjvd.exec:\jvjvd.exe54⤵
- Executes dropped EXE
PID:3572 -
\??\c:\lffxrrr.exec:\lffxrrr.exe55⤵
- Executes dropped EXE
PID:1680 -
\??\c:\btbtnn.exec:\btbtnn.exe56⤵
- Executes dropped EXE
PID:4372 -
\??\c:\hhhhbb.exec:\hhhhbb.exe57⤵
- Executes dropped EXE
PID:4704 -
\??\c:\pppdd.exec:\pppdd.exe58⤵
- Executes dropped EXE
PID:4188 -
\??\c:\ppjjd.exec:\ppjjd.exe59⤵
- Executes dropped EXE
PID:3400 -
\??\c:\3rrlxxr.exec:\3rrlxxr.exe60⤵
- Executes dropped EXE
PID:1496 -
\??\c:\bnnhbb.exec:\bnnhbb.exe61⤵
- Executes dropped EXE
PID:3608 -
\??\c:\bnbhnb.exec:\bnbhnb.exe62⤵
- Executes dropped EXE
PID:3272 -
\??\c:\pdjdp.exec:\pdjdp.exe63⤵
- Executes dropped EXE
PID:4472 -
\??\c:\rllfffx.exec:\rllfffx.exe64⤵
- Executes dropped EXE
PID:1040 -
\??\c:\lxxxrlr.exec:\lxxxrlr.exe65⤵
- Executes dropped EXE
PID:4056 -
\??\c:\tnnhbt.exec:\tnnhbt.exe66⤵PID:1100
-
\??\c:\nhbtbb.exec:\nhbtbb.exe67⤵PID:1636
-
\??\c:\dpddv.exec:\dpddv.exe68⤵PID:3952
-
\??\c:\dvvpv.exec:\dvvpv.exe69⤵PID:2212
-
\??\c:\xrxxrxr.exec:\xrxxrxr.exe70⤵PID:2200
-
\??\c:\thtnhh.exec:\thtnhh.exe71⤵PID:2292
-
\??\c:\dpdvv.exec:\dpdvv.exe72⤵PID:836
-
\??\c:\1vjjp.exec:\1vjjp.exe73⤵PID:456
-
\??\c:\fffllxl.exec:\fffllxl.exe74⤵PID:3820
-
\??\c:\bhtnnn.exec:\bhtnnn.exe75⤵PID:2576
-
\??\c:\nnbbnn.exec:\nnbbnn.exe76⤵PID:4440
-
\??\c:\dvjdd.exec:\dvjdd.exe77⤵PID:1180
-
\??\c:\rrxfrrl.exec:\rrxfrrl.exe78⤵PID:3616
-
\??\c:\ffffxxx.exec:\ffffxxx.exe79⤵PID:4448
-
\??\c:\bnbttt.exec:\bnbttt.exe80⤵PID:1468
-
\??\c:\ddddv.exec:\ddddv.exe81⤵PID:4916
-
\??\c:\vdpdd.exec:\vdpdd.exe82⤵PID:1952
-
\??\c:\lrlxlxl.exec:\lrlxlxl.exe83⤵PID:3768
-
\??\c:\tnnhtt.exec:\tnnhtt.exe84⤵PID:4428
-
\??\c:\vdppj.exec:\vdppj.exe85⤵PID:4084
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe86⤵PID:788
-
\??\c:\hbhtnt.exec:\hbhtnt.exe87⤵PID:4416
-
\??\c:\ttbhhh.exec:\ttbhhh.exe88⤵PID:3128
-
\??\c:\vpjdj.exec:\vpjdj.exe89⤵PID:1332
-
\??\c:\rxrlffx.exec:\rxrlffx.exe90⤵PID:4500
-
\??\c:\flffflr.exec:\flffflr.exe91⤵PID:4336
-
\??\c:\bbnntn.exec:\bbnntn.exe92⤵PID:3504
-
\??\c:\btbnnt.exec:\btbnnt.exe93⤵PID:1592
-
\??\c:\vpjdd.exec:\vpjdd.exe94⤵PID:4672
-
\??\c:\5ttttb.exec:\5ttttb.exe95⤵PID:4068
-
\??\c:\jvddv.exec:\jvddv.exe96⤵PID:2684
-
\??\c:\lxlllrr.exec:\lxlllrr.exe97⤵PID:4972
-
\??\c:\hhttbb.exec:\hhttbb.exe98⤵PID:764
-
\??\c:\jvddd.exec:\jvddd.exe99⤵PID:2008
-
\??\c:\llfxrxl.exec:\llfxrxl.exe100⤵PID:3664
-
\??\c:\btbhth.exec:\btbhth.exe101⤵PID:3800
-
\??\c:\bttnnn.exec:\bttnnn.exe102⤵PID:452
-
\??\c:\fffffff.exec:\fffffff.exe103⤵PID:4076
-
\??\c:\rrrrlll.exec:\rrrrlll.exe104⤵PID:1556
-
\??\c:\bhnbbb.exec:\bhnbbb.exe105⤵PID:1232
-
\??\c:\pjjvd.exec:\pjjvd.exe106⤵PID:2332
-
\??\c:\frrfrxx.exec:\frrfrxx.exe107⤵PID:4748
-
\??\c:\hnnbbh.exec:\hnnbbh.exe108⤵PID:4620
-
\??\c:\jvpdd.exec:\jvpdd.exe109⤵PID:4956
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe110⤵PID:4432
-
\??\c:\tnbtbt.exec:\tnbtbt.exe111⤵PID:644
-
\??\c:\jdjjj.exec:\jdjjj.exe112⤵PID:756
-
\??\c:\jpvpv.exec:\jpvpv.exe113⤵PID:3208
-
\??\c:\rrxrxxf.exec:\rrxrxxf.exe114⤵PID:3508
-
\??\c:\frlfxxr.exec:\frlfxxr.exe115⤵PID:2344
-
\??\c:\bbhhbb.exec:\bbhhbb.exe116⤵PID:1972
-
\??\c:\bhhbnn.exec:\bhhbnn.exe117⤵PID:4652
-
\??\c:\dpvvv.exec:\dpvvv.exe118⤵PID:640
-
\??\c:\pjpjd.exec:\pjpjd.exe119⤵PID:3352
-
\??\c:\fxffxxx.exec:\fxffxxx.exe120⤵PID:2292
-
\??\c:\lxfffff.exec:\lxfffff.exe121⤵PID:456
-
\??\c:\nhnnnn.exec:\nhnnnn.exe122⤵PID:2572
-
\??\c:\thttnh.exec:\thttnh.exe123⤵PID:3688
-
\??\c:\jjvvv.exec:\jjvvv.exe124⤵PID:1180
-
\??\c:\vddvv.exec:\vddvv.exe125⤵PID:3636
-
\??\c:\rrrlffx.exec:\rrrlffx.exe126⤵PID:8
-
\??\c:\ddpjj.exec:\ddpjj.exe127⤵PID:4168
-
\??\c:\rllllll.exec:\rllllll.exe128⤵PID:1952
-
\??\c:\rlxrlrr.exec:\rlxrlrr.exe129⤵PID:5052
-
\??\c:\jdddv.exec:\jdddv.exe130⤵PID:4312
-
\??\c:\jvdpv.exec:\jvdpv.exe131⤵PID:464
-
\??\c:\nbtthb.exec:\nbtthb.exe132⤵PID:4292
-
\??\c:\dvppj.exec:\dvppj.exe133⤵PID:4416
-
\??\c:\hbbntn.exec:\hbbntn.exe134⤵PID:2296
-
\??\c:\rfrrlrr.exec:\rfrrlrr.exe135⤵PID:1140
-
\??\c:\tttntb.exec:\tttntb.exe136⤵PID:2708
-
\??\c:\tttnbb.exec:\tttnbb.exe137⤵PID:1000
-
\??\c:\vpjjd.exec:\vpjjd.exe138⤵PID:372
-
\??\c:\xxllfll.exec:\xxllfll.exe139⤵PID:2032
-
\??\c:\vvpjd.exec:\vvpjd.exe140⤵PID:1220
-
\??\c:\fxrlrfx.exec:\fxrlrfx.exe141⤵PID:4456
-
\??\c:\nnhhbb.exec:\nnhhbb.exe142⤵PID:4816
-
\??\c:\htbnnh.exec:\htbnnh.exe143⤵PID:1800
-
\??\c:\vvddj.exec:\vvddj.exe144⤵PID:2616
-
\??\c:\vvpjj.exec:\vvpjj.exe145⤵PID:3660
-
\??\c:\xflflrx.exec:\xflflrx.exe146⤵PID:3316
-
\??\c:\tnntth.exec:\tnntth.exe147⤵PID:612
-
\??\c:\vpjdv.exec:\vpjdv.exe148⤵PID:3192
-
\??\c:\pvpdj.exec:\pvpdj.exe149⤵PID:2316
-
\??\c:\xxlfxxx.exec:\xxlfxxx.exe150⤵PID:2472
-
\??\c:\hbttnb.exec:\hbttnb.exe151⤵PID:4372
-
\??\c:\1bhnbb.exec:\1bhnbb.exe152⤵PID:3368
-
\??\c:\ppvpj.exec:\ppvpj.exe153⤵PID:2332
-
\??\c:\fxfxfrf.exec:\fxfxfrf.exe154⤵PID:4748
-
\??\c:\llxrxxr.exec:\llxrxxr.exe155⤵PID:4620
-
\??\c:\nhhhtt.exec:\nhhhtt.exe156⤵PID:4956
-
\??\c:\vvpjd.exec:\vvpjd.exe157⤵PID:4708
-
\??\c:\xxfxrxx.exec:\xxfxrxx.exe158⤵PID:5056
-
\??\c:\ttnbbb.exec:\ttnbbb.exe159⤵PID:3468
-
\??\c:\9pjdv.exec:\9pjdv.exe160⤵PID:3568
-
\??\c:\xffxllf.exec:\xffxllf.exe161⤵PID:1300
-
\??\c:\fflrllf.exec:\fflrllf.exe162⤵PID:2212
-
\??\c:\tntnnn.exec:\tntnnn.exe163⤵PID:1244
-
\??\c:\jdvvv.exec:\jdvvv.exe164⤵PID:2284
-
\??\c:\jvddv.exec:\jvddv.exe165⤵PID:2732
-
\??\c:\rfllfff.exec:\rfllfff.exe166⤵PID:736
-
\??\c:\nttnhb.exec:\nttnhb.exe167⤵PID:1836
-
\??\c:\ddvpj.exec:\ddvpj.exe168⤵PID:2548
-
\??\c:\pjpjd.exec:\pjpjd.exe169⤵PID:1708
-
\??\c:\llfxffx.exec:\llfxffx.exe170⤵PID:916
-
\??\c:\frrllll.exec:\frrllll.exe171⤵PID:516
-
\??\c:\tbhhhb.exec:\tbhhhb.exe172⤵PID:4916
-
\??\c:\dvvpj.exec:\dvvpj.exe173⤵PID:3656
-
\??\c:\lxlfllf.exec:\lxlfllf.exe174⤵PID:3768
-
\??\c:\tntnht.exec:\tntnht.exe175⤵PID:4856
-
\??\c:\thhhbb.exec:\thhhbb.exe176⤵PID:2424
-
\??\c:\pvvjv.exec:\pvvjv.exe177⤵PID:1584
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe178⤵PID:464
-
\??\c:\3fllffx.exec:\3fllffx.exe179⤵PID:4292
-
\??\c:\hhtnhb.exec:\hhtnhb.exe180⤵PID:4600
-
\??\c:\pjdvp.exec:\pjdvp.exe181⤵PID:4400
-
\??\c:\jpvdp.exec:\jpvdp.exe182⤵PID:3548
-
\??\c:\xffxllf.exec:\xffxllf.exe183⤵PID:2708
-
\??\c:\rlllflr.exec:\rlllflr.exe184⤵PID:4556
-
\??\c:\bhbhbb.exec:\bhbhbb.exe185⤵PID:1392
-
\??\c:\pdjdd.exec:\pdjdd.exe186⤵PID:4672
-
\??\c:\lflfxlx.exec:\lflfxlx.exe187⤵PID:876
-
\??\c:\rrflrrf.exec:\rrflrrf.exe188⤵PID:4456
-
\??\c:\tnnbth.exec:\tnnbth.exe189⤵PID:4816
-
\??\c:\nhtnnn.exec:\nhtnnn.exe190⤵PID:764
-
\??\c:\djpjd.exec:\djpjd.exe191⤵PID:2616
-
\??\c:\jpvpj.exec:\jpvpj.exe192⤵PID:3180
-
\??\c:\xxxrffx.exec:\xxxrffx.exe193⤵PID:4588
-
\??\c:\thnnhn.exec:\thnnhn.exe194⤵PID:612
-
\??\c:\btnhhh.exec:\btnhhh.exe195⤵PID:2748
-
\??\c:\dddvj.exec:\dddvj.exe196⤵PID:1108
-
\??\c:\fxxrrxr.exec:\fxxrrxr.exe197⤵PID:5084
-
\??\c:\frffxxl.exec:\frffxxl.exe198⤵PID:3244
-
\??\c:\bthbbb.exec:\bthbbb.exe199⤵PID:336
-
\??\c:\ppjjp.exec:\ppjjp.exe200⤵PID:3772
-
\??\c:\pjdvp.exec:\pjdvp.exe201⤵PID:2280
-
\??\c:\5xflrlx.exec:\5xflrlx.exe202⤵PID:2568
-
\??\c:\ntbhhh.exec:\ntbhhh.exe203⤵PID:3756
-
\??\c:\jvvpj.exec:\jvvpj.exe204⤵PID:5064
-
\??\c:\pjpjj.exec:\pjpjj.exe205⤵PID:2392
-
\??\c:\fxflxxx.exec:\fxflxxx.exe206⤵PID:512
-
\??\c:\bthbnh.exec:\bthbnh.exe207⤵PID:3208
-
\??\c:\dddvp.exec:\dddvp.exe208⤵PID:3468
-
\??\c:\pjjdp.exec:\pjjdp.exe209⤵PID:3568
-
\??\c:\rlxrllf.exec:\rlxrllf.exe210⤵PID:1300
-
\??\c:\hhntnt.exec:\hhntnt.exe211⤵PID:2212
-
\??\c:\ttnnnb.exec:\ttnnnb.exe212⤵PID:5060
-
\??\c:\jdjjj.exec:\jdjjj.exe213⤵PID:2112
-
\??\c:\flrfxlx.exec:\flrfxlx.exe214⤵PID:2732
-
\??\c:\xrffxlr.exec:\xrffxlr.exe215⤵PID:5024
-
\??\c:\btthtt.exec:\btthtt.exe216⤵PID:4860
-
\??\c:\7pvpp.exec:\7pvpp.exe217⤵PID:1188
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe218⤵PID:940
-
\??\c:\thnnnn.exec:\thnnnn.exe219⤵PID:916
-
\??\c:\vvvpp.exec:\vvvpp.exe220⤵PID:8
-
\??\c:\pjpjj.exec:\pjpjj.exe221⤵PID:4916
-
\??\c:\xrffxff.exec:\xrffxff.exe222⤵PID:1952
-
\??\c:\hnhbbh.exec:\hnhbbh.exe223⤵PID:3768
-
\??\c:\pjdjd.exec:\pjdjd.exe224⤵PID:4856
-
\??\c:\pddpv.exec:\pddpv.exe225⤵PID:4220
-
\??\c:\rflfrrr.exec:\rflfrrr.exe226⤵PID:4128
-
\??\c:\rflxxrl.exec:\rflxxrl.exe227⤵PID:3168
-
\??\c:\hbbbbh.exec:\hbbbbh.exe228⤵PID:2928
-
\??\c:\9djvp.exec:\9djvp.exe229⤵PID:4500
-
\??\c:\ppjjj.exec:\ppjjj.exe230⤵PID:4964
-
\??\c:\rlfffff.exec:\rlfffff.exe231⤵PID:2440
-
\??\c:\hbbbtb.exec:\hbbbtb.exe232⤵PID:2708
-
\??\c:\dvvjv.exec:\dvvjv.exe233⤵PID:4556
-
\??\c:\jjpjd.exec:\jjpjd.exe234⤵PID:1220
-
\??\c:\lffxxff.exec:\lffxxff.exe235⤵PID:4672
-
\??\c:\frffxxr.exec:\frffxxr.exe236⤵PID:876
-
\??\c:\nhnnhh.exec:\nhnnhh.exe237⤵PID:4456
-
\??\c:\htbbbb.exec:\htbbbb.exe238⤵PID:4980
-
\??\c:\jjpjd.exec:\jjpjd.exe239⤵PID:764
-
\??\c:\flrlrll.exec:\flrlrll.exe240⤵PID:4636
-
\??\c:\ttbbbn.exec:\ttbbbn.exe241⤵PID:3180
-
\??\c:\thhbnh.exec:\thhbnh.exe242⤵PID:4864