Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 10:00
Behavioral task
behavioral1
Sample
21297b1919c019db142df8452ad087f464f66a82a353cfea8b886eedb9fbb8f4.exe
Resource
win7-20240221-en
General
-
Target
21297b1919c019db142df8452ad087f464f66a82a353cfea8b886eedb9fbb8f4.exe
-
Size
312KB
-
MD5
39b1782b330b6d0d5d6aa4fc74499e27
-
SHA1
97ebbbc2e10c746fd36ecd8423c4e2444aa3aaac
-
SHA256
21297b1919c019db142df8452ad087f464f66a82a353cfea8b886eedb9fbb8f4
-
SHA512
58f2e999cc7a72f77a4e83001cd48a5bb014cef124bfd6dd85a5ed8a9a89153cc0af8317bf0cedba5dd7cf326eb5b71fe3f19086827bde3f1fa9c46e88b725d0
-
SSDEEP
6144:/cm4FmowdHoSyZuo3F2Y9iE9MAkOCOu0EajNVBZr6y2WfcE:N4wFHoSMu49P9micE
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/804-6-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3092-8-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4836-19-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2228-25-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/636-44-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2128-106-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3004-247-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2684-266-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4648-271-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/428-279-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4524-259-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5008-234-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4028-231-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/856-225-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4216-221-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4604-211-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4616-208-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4488-204-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1740-197-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4184-185-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3448-175-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5112-169-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/116-163-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3676-157-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2656-151-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4728-145-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1396-128-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3560-118-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1416-112-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2696-100-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5052-95-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2424-83-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3476-68-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4260-62-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3724-50-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1592-48-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2196-37-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4648-15-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1556-299-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1344-309-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1492-317-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3880-329-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2656-337-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2016-344-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2584-351-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4056-356-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4948-355-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1292-381-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3260-389-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4904-396-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5008-390-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4092-407-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/328-414-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3152-433-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3268-470-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1700-477-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3168-551-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/536-570-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1756-574-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4436-657-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4808-762-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4684-1212-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4272-1216-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/856-1355-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral2/memory/804-0-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/804-6-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/3092-8-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\fxfxrfx.exe family_berbew \??\c:\nbbhbb.exe family_berbew behavioral2/memory/4836-19-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\vjjjj.exe family_berbew behavioral2/memory/2228-25-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\9lrlllr.exe family_berbew behavioral2/memory/636-44-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\vvvvv.exe family_berbew \??\c:\jvddv.exe family_berbew C:\frxrlrl.exe family_berbew C:\bhtbbh.exe family_berbew C:\lfxxrrl.exe family_berbew \??\c:\hntnnn.exe family_berbew behavioral2/memory/2128-106-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\hnhhtt.exe family_berbew \??\c:\vdjjd.exe family_berbew \??\c:\xfrllfl.exe family_berbew \??\c:\dpjjj.exe family_berbew behavioral2/memory/3004-247-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/2684-266-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/4648-271-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/428-279-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/4524-259-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/4328-283-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/5008-234-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/4028-231-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/856-225-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/4216-221-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/4604-211-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/4616-208-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/4488-204-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/1740-197-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/4184-185-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\xxlrxff.exe family_berbew behavioral2/memory/3448-175-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\vpdvp.exe family_berbew behavioral2/memory/5112-169-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\btbbnh.exe family_berbew behavioral2/memory/116-163-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\llfrxlx.exe family_berbew behavioral2/memory/3676-157-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\rfllrxx.exe family_berbew behavioral2/memory/2656-151-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\vvvpp.exe family_berbew behavioral2/memory/4728-145-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\bbbbbb.exe family_berbew \??\c:\rxxffrr.exe family_berbew behavioral2/memory/1396-128-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\7nnhbh.exe family_berbew behavioral2/memory/3560-118-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/1416-112-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\rxxxffl.exe family_berbew \??\c:\flxfrrf.exe family_berbew behavioral2/memory/2696-100-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\7jdjd.exe family_berbew behavioral2/memory/5052-95-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\thbtnh.exe family_berbew behavioral2/memory/2424-83-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\llllrrr.exe family_berbew \??\c:\vvvpd.exe family_berbew behavioral2/memory/3476-68-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
xrrlllf.exefxfxrfx.exenbbhbb.exevjjjj.exerrrllrl.exe9lrlllr.exebnbtht.exevvvvv.exejvddv.exefrxrlrl.exebhtbbh.exevvvpd.exellllrrr.exelfxxrrl.exehntnnn.exethbtnh.exe7jdjd.exeflxfrrf.exerxxxffl.exehnhhtt.exe7nnhbh.exevdjjd.exexfrllfl.exerxxffrr.exebbbbbb.exevvvpp.exerfllrxx.exellfrxlx.exebtbbnh.exevpdvp.exedpjjj.exexxlrxff.exe5tbhhh.exenntnhh.exejpdpv.exerlflxxr.exennbnhb.exebnhhbb.exepjppj.exeflrfxrr.exelffrlrx.exettttbh.exedvjpj.exedvvdv.exeffxrlxx.exelxfrlxx.exetnnttb.exejdjdd.exefrfxxfx.exelrllfff.exehnhbtn.exedjppp.exerxffxfx.exefffxxxx.exenbbbtt.exejjvvd.exedvjdv.exerxffxxx.exehhbbtt.exejvvvp.exexxxxrxf.exebtbbtt.exedpjjd.exexrfxrfx.exepid process 3092 xrrlllf.exe 4648 fxfxrfx.exe 4836 nbbhbb.exe 2228 vjjjj.exe 2196 rrrllrl.exe 636 9lrlllr.exe 1592 bnbtht.exe 3724 vvvvv.exe 4260 jvddv.exe 3476 frxrlrl.exe 4132 bhtbbh.exe 4956 vvvpd.exe 2424 llllrrr.exe 4872 lfxxrrl.exe 5052 hntnnn.exe 2696 thbtnh.exe 2128 7jdjd.exe 1416 flxfrrf.exe 3560 rxxxffl.exe 1396 hnhhtt.exe 2740 7nnhbh.exe 3520 vdjjd.exe 3696 xfrllfl.exe 4728 rxxffrr.exe 2656 bbbbbb.exe 3676 vvvpp.exe 116 rfllrxx.exe 5112 llfrxlx.exe 3448 btbbnh.exe 3112 vpdvp.exe 4184 dpjjj.exe 3096 xxlrxff.exe 1308 5tbhhh.exe 1740 nntnhh.exe 4456 jpdpv.exe 4488 rlflxxr.exe 4616 nnbnhb.exe 4604 bnhhbb.exe 644 pjppj.exe 3280 flrfxrr.exe 4216 lffrlrx.exe 856 ttttbh.exe 4028 dvjpj.exe 5008 dvvdv.exe 5056 ffxrlxx.exe 4892 lxfrlxx.exe 1572 tnnttb.exe 3004 jdjdd.exe 3164 frfxxfx.exe 4844 lrllfff.exe 3484 hnhbtn.exe 4524 djppp.exe 4296 rxffxfx.exe 2684 fffxxxx.exe 4648 nbbbtt.exe 4836 jjvvd.exe 368 dvjdv.exe 1212 rxffxxx.exe 428 hhbbtt.exe 4328 jvvvp.exe 3556 xxxxrxf.exe 3032 btbbtt.exe 3544 dpjjd.exe 1556 xrfxrfx.exe -
Processes:
resource yara_rule behavioral2/memory/804-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/804-6-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3092-8-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fxfxrfx.exe upx \??\c:\nbbhbb.exe upx behavioral2/memory/4836-19-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\vjjjj.exe upx behavioral2/memory/2228-25-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\9lrlllr.exe upx behavioral2/memory/636-44-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\vvvvv.exe upx \??\c:\jvddv.exe upx C:\frxrlrl.exe upx C:\bhtbbh.exe upx C:\lfxxrrl.exe upx \??\c:\hntnnn.exe upx behavioral2/memory/2128-106-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\hnhhtt.exe upx \??\c:\vdjjd.exe upx \??\c:\xfrllfl.exe upx \??\c:\dpjjj.exe upx behavioral2/memory/3004-247-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2684-266-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4648-271-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/428-279-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4524-259-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4328-283-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/5008-234-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4028-231-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/856-225-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4216-221-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4604-211-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4616-208-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4488-204-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1740-197-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4184-185-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\xxlrxff.exe upx behavioral2/memory/3448-175-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\vpdvp.exe upx behavioral2/memory/5112-169-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\btbbnh.exe upx behavioral2/memory/116-163-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\llfrxlx.exe upx behavioral2/memory/3676-157-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\rfllrxx.exe upx behavioral2/memory/2656-151-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\vvvpp.exe upx behavioral2/memory/4728-145-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\bbbbbb.exe upx \??\c:\rxxffrr.exe upx behavioral2/memory/1396-128-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\7nnhbh.exe upx behavioral2/memory/3560-118-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1416-112-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\rxxxffl.exe upx \??\c:\flxfrrf.exe upx behavioral2/memory/2696-100-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\7jdjd.exe upx behavioral2/memory/5052-95-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\thbtnh.exe upx behavioral2/memory/2424-83-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\llllrrr.exe upx \??\c:\vvvpd.exe upx behavioral2/memory/3476-68-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
21297b1919c019db142df8452ad087f464f66a82a353cfea8b886eedb9fbb8f4.exexrrlllf.exefxfxrfx.exenbbhbb.exevjjjj.exerrrllrl.exe9lrlllr.exebnbtht.exevvvvv.exejvddv.exefrxrlrl.exebhtbbh.exevvvpd.exellllrrr.exelfxxrrl.exehntnnn.exethbtnh.exe7jdjd.exeflxfrrf.exerxxxffl.exehnhhtt.exe7nnhbh.exedescription pid process target process PID 804 wrote to memory of 3092 804 21297b1919c019db142df8452ad087f464f66a82a353cfea8b886eedb9fbb8f4.exe xrrlllf.exe PID 804 wrote to memory of 3092 804 21297b1919c019db142df8452ad087f464f66a82a353cfea8b886eedb9fbb8f4.exe xrrlllf.exe PID 804 wrote to memory of 3092 804 21297b1919c019db142df8452ad087f464f66a82a353cfea8b886eedb9fbb8f4.exe xrrlllf.exe PID 3092 wrote to memory of 4648 3092 xrrlllf.exe nbbbtt.exe PID 3092 wrote to memory of 4648 3092 xrrlllf.exe nbbbtt.exe PID 3092 wrote to memory of 4648 3092 xrrlllf.exe nbbbtt.exe PID 4648 wrote to memory of 4836 4648 fxfxrfx.exe nbbhbb.exe PID 4648 wrote to memory of 4836 4648 fxfxrfx.exe nbbhbb.exe PID 4648 wrote to memory of 4836 4648 fxfxrfx.exe nbbhbb.exe PID 4836 wrote to memory of 2228 4836 nbbhbb.exe vjjjj.exe PID 4836 wrote to memory of 2228 4836 nbbhbb.exe vjjjj.exe PID 4836 wrote to memory of 2228 4836 nbbhbb.exe vjjjj.exe PID 2228 wrote to memory of 2196 2228 vjjjj.exe rrrllrl.exe PID 2228 wrote to memory of 2196 2228 vjjjj.exe rrrllrl.exe PID 2228 wrote to memory of 2196 2228 vjjjj.exe rrrllrl.exe PID 2196 wrote to memory of 636 2196 rrrllrl.exe 9lrlllr.exe PID 2196 wrote to memory of 636 2196 rrrllrl.exe 9lrlllr.exe PID 2196 wrote to memory of 636 2196 rrrllrl.exe 9lrlllr.exe PID 636 wrote to memory of 1592 636 9lrlllr.exe bnbtht.exe PID 636 wrote to memory of 1592 636 9lrlllr.exe bnbtht.exe PID 636 wrote to memory of 1592 636 9lrlllr.exe bnbtht.exe PID 1592 wrote to memory of 3724 1592 bnbtht.exe vvvvv.exe PID 1592 wrote to memory of 3724 1592 bnbtht.exe vvvvv.exe PID 1592 wrote to memory of 3724 1592 bnbtht.exe vvvvv.exe PID 3724 wrote to memory of 4260 3724 vvvvv.exe jvddv.exe PID 3724 wrote to memory of 4260 3724 vvvvv.exe jvddv.exe PID 3724 wrote to memory of 4260 3724 vvvvv.exe jvddv.exe PID 4260 wrote to memory of 3476 4260 jvddv.exe frxrlrl.exe PID 4260 wrote to memory of 3476 4260 jvddv.exe frxrlrl.exe PID 4260 wrote to memory of 3476 4260 jvddv.exe frxrlrl.exe PID 3476 wrote to memory of 4132 3476 frxrlrl.exe bhtbbh.exe PID 3476 wrote to memory of 4132 3476 frxrlrl.exe bhtbbh.exe PID 3476 wrote to memory of 4132 3476 frxrlrl.exe bhtbbh.exe PID 4132 wrote to memory of 4956 4132 bhtbbh.exe vvvpd.exe PID 4132 wrote to memory of 4956 4132 bhtbbh.exe vvvpd.exe PID 4132 wrote to memory of 4956 4132 bhtbbh.exe vvvpd.exe PID 4956 wrote to memory of 2424 4956 vvvpd.exe llllrrr.exe PID 4956 wrote to memory of 2424 4956 vvvpd.exe llllrrr.exe PID 4956 wrote to memory of 2424 4956 vvvpd.exe llllrrr.exe PID 2424 wrote to memory of 4872 2424 llllrrr.exe lfxxrrl.exe PID 2424 wrote to memory of 4872 2424 llllrrr.exe lfxxrrl.exe PID 2424 wrote to memory of 4872 2424 llllrrr.exe lfxxrrl.exe PID 4872 wrote to memory of 5052 4872 lfxxrrl.exe hntnnn.exe PID 4872 wrote to memory of 5052 4872 lfxxrrl.exe hntnnn.exe PID 4872 wrote to memory of 5052 4872 lfxxrrl.exe hntnnn.exe PID 5052 wrote to memory of 2696 5052 hntnnn.exe thbtnh.exe PID 5052 wrote to memory of 2696 5052 hntnnn.exe thbtnh.exe PID 5052 wrote to memory of 2696 5052 hntnnn.exe thbtnh.exe PID 2696 wrote to memory of 2128 2696 thbtnh.exe ththhn.exe PID 2696 wrote to memory of 2128 2696 thbtnh.exe ththhn.exe PID 2696 wrote to memory of 2128 2696 thbtnh.exe ththhn.exe PID 2128 wrote to memory of 1416 2128 7jdjd.exe flxfrrf.exe PID 2128 wrote to memory of 1416 2128 7jdjd.exe flxfrrf.exe PID 2128 wrote to memory of 1416 2128 7jdjd.exe flxfrrf.exe PID 1416 wrote to memory of 3560 1416 flxfrrf.exe rxxxffl.exe PID 1416 wrote to memory of 3560 1416 flxfrrf.exe rxxxffl.exe PID 1416 wrote to memory of 3560 1416 flxfrrf.exe rxxxffl.exe PID 3560 wrote to memory of 1396 3560 rxxxffl.exe hnhhtt.exe PID 3560 wrote to memory of 1396 3560 rxxxffl.exe hnhhtt.exe PID 3560 wrote to memory of 1396 3560 rxxxffl.exe hnhhtt.exe PID 1396 wrote to memory of 2740 1396 hnhhtt.exe 7nnhbh.exe PID 1396 wrote to memory of 2740 1396 hnhhtt.exe 7nnhbh.exe PID 1396 wrote to memory of 2740 1396 hnhhtt.exe 7nnhbh.exe PID 2740 wrote to memory of 3520 2740 7nnhbh.exe vdjjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21297b1919c019db142df8452ad087f464f66a82a353cfea8b886eedb9fbb8f4.exe"C:\Users\Admin\AppData\Local\Temp\21297b1919c019db142df8452ad087f464f66a82a353cfea8b886eedb9fbb8f4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\xrrlllf.exec:\xrrlllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\fxfxrfx.exec:\fxfxrfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\nbbhbb.exec:\nbbhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\vjjjj.exec:\vjjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\rrrllrl.exec:\rrrllrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\9lrlllr.exec:\9lrlllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\bnbtht.exec:\bnbtht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\vvvvv.exec:\vvvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\jvddv.exec:\jvddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\frxrlrl.exec:\frxrlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\bhtbbh.exec:\bhtbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\vvvpd.exec:\vvvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\llllrrr.exec:\llllrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\lfxxrrl.exec:\lfxxrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\hntnnn.exec:\hntnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\thbtnh.exec:\thbtnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\7jdjd.exec:\7jdjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\flxfrrf.exec:\flxfrrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\rxxxffl.exec:\rxxxffl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\hnhhtt.exec:\hnhhtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\7nnhbh.exec:\7nnhbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\vdjjd.exec:\vdjjd.exe23⤵
- Executes dropped EXE
PID:3520 -
\??\c:\xfrllfl.exec:\xfrllfl.exe24⤵
- Executes dropped EXE
PID:3696 -
\??\c:\rxxffrr.exec:\rxxffrr.exe25⤵
- Executes dropped EXE
PID:4728 -
\??\c:\bbbbbb.exec:\bbbbbb.exe26⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vvvpp.exec:\vvvpp.exe27⤵
- Executes dropped EXE
PID:3676 -
\??\c:\rfllrxx.exec:\rfllrxx.exe28⤵
- Executes dropped EXE
PID:116 -
\??\c:\llfrxlx.exec:\llfrxlx.exe29⤵
- Executes dropped EXE
PID:5112 -
\??\c:\btbbnh.exec:\btbbnh.exe30⤵
- Executes dropped EXE
PID:3448 -
\??\c:\vpdvp.exec:\vpdvp.exe31⤵
- Executes dropped EXE
PID:3112 -
\??\c:\dpjjj.exec:\dpjjj.exe32⤵
- Executes dropped EXE
PID:4184 -
\??\c:\xxlrxff.exec:\xxlrxff.exe33⤵
- Executes dropped EXE
PID:3096 -
\??\c:\5tbhhh.exec:\5tbhhh.exe34⤵
- Executes dropped EXE
PID:1308 -
\??\c:\nntnhh.exec:\nntnhh.exe35⤵
- Executes dropped EXE
PID:1740 -
\??\c:\jpdpv.exec:\jpdpv.exe36⤵
- Executes dropped EXE
PID:4456 -
\??\c:\rlflxxr.exec:\rlflxxr.exe37⤵
- Executes dropped EXE
PID:4488 -
\??\c:\nnbnhb.exec:\nnbnhb.exe38⤵
- Executes dropped EXE
PID:4616 -
\??\c:\bnhhbb.exec:\bnhhbb.exe39⤵
- Executes dropped EXE
PID:4604 -
\??\c:\pjppj.exec:\pjppj.exe40⤵
- Executes dropped EXE
PID:644 -
\??\c:\flrfxrr.exec:\flrfxrr.exe41⤵
- Executes dropped EXE
PID:3280 -
\??\c:\lffrlrx.exec:\lffrlrx.exe42⤵
- Executes dropped EXE
PID:4216 -
\??\c:\ttttbh.exec:\ttttbh.exe43⤵
- Executes dropped EXE
PID:856 -
\??\c:\dvjpj.exec:\dvjpj.exe44⤵
- Executes dropped EXE
PID:4028 -
\??\c:\dvvdv.exec:\dvvdv.exe45⤵
- Executes dropped EXE
PID:5008 -
\??\c:\ffxrlxx.exec:\ffxrlxx.exe46⤵
- Executes dropped EXE
PID:5056 -
\??\c:\lxfrlxx.exec:\lxfrlxx.exe47⤵
- Executes dropped EXE
PID:4892 -
\??\c:\tnnttb.exec:\tnnttb.exe48⤵
- Executes dropped EXE
PID:1572 -
\??\c:\jdjdd.exec:\jdjdd.exe49⤵
- Executes dropped EXE
PID:3004 -
\??\c:\frfxxfx.exec:\frfxxfx.exe50⤵
- Executes dropped EXE
PID:3164 -
\??\c:\lrllfff.exec:\lrllfff.exe51⤵
- Executes dropped EXE
PID:4844 -
\??\c:\hnhbtn.exec:\hnhbtn.exe52⤵
- Executes dropped EXE
PID:3484 -
\??\c:\djppp.exec:\djppp.exe53⤵
- Executes dropped EXE
PID:4524 -
\??\c:\rxffxfx.exec:\rxffxfx.exe54⤵
- Executes dropped EXE
PID:4296 -
\??\c:\fffxxxx.exec:\fffxxxx.exe55⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nbbbtt.exec:\nbbbtt.exe56⤵
- Executes dropped EXE
PID:4648 -
\??\c:\jjvvd.exec:\jjvvd.exe57⤵
- Executes dropped EXE
PID:4836 -
\??\c:\dvjdv.exec:\dvjdv.exe58⤵
- Executes dropped EXE
PID:368 -
\??\c:\rxffxxx.exec:\rxffxxx.exe59⤵
- Executes dropped EXE
PID:1212 -
\??\c:\hhbbtt.exec:\hhbbtt.exe60⤵
- Executes dropped EXE
PID:428 -
\??\c:\jvvvp.exec:\jvvvp.exe61⤵
- Executes dropped EXE
PID:4328 -
\??\c:\xxxxrxf.exec:\xxxxrxf.exe62⤵
- Executes dropped EXE
PID:3556 -
\??\c:\btbbtt.exec:\btbbtt.exe63⤵
- Executes dropped EXE
PID:3032 -
\??\c:\dpjjd.exec:\dpjjd.exe64⤵
- Executes dropped EXE
PID:3544 -
\??\c:\xrfxrfx.exec:\xrfxrfx.exe65⤵
- Executes dropped EXE
PID:1556 -
\??\c:\hbbttt.exec:\hbbttt.exe66⤵PID:2148
-
\??\c:\vjjjj.exec:\vjjjj.exe67⤵PID:3276
-
\??\c:\lfxxxxf.exec:\lfxxxxf.exe68⤵PID:1344
-
\??\c:\ththhn.exec:\ththhn.exe69⤵PID:2128
-
\??\c:\pjddv.exec:\pjddv.exe70⤵PID:1492
-
\??\c:\hbhnnt.exec:\hbhnnt.exe71⤵PID:3412
-
\??\c:\htbtnn.exec:\htbtnn.exe72⤵PID:8
-
\??\c:\jjvpd.exec:\jjvpd.exe73⤵PID:1856
-
\??\c:\fxllffx.exec:\fxllffx.exe74⤵PID:3880
-
\??\c:\hntnnn.exec:\hntnnn.exe75⤵PID:2644
-
\??\c:\pjppp.exec:\pjppp.exe76⤵PID:2656
-
\??\c:\fxlffxl.exec:\fxlffxl.exe77⤵PID:2332
-
\??\c:\frlfxrr.exec:\frlfxrr.exe78⤵PID:2016
-
\??\c:\tbtnhh.exec:\tbtnhh.exe79⤵PID:3184
-
\??\c:\vvppd.exec:\vvppd.exe80⤵PID:2584
-
\??\c:\xrxxlrr.exec:\xrxxlrr.exe81⤵PID:4948
-
\??\c:\bnhhhh.exec:\bnhhhh.exe82⤵PID:4056
-
\??\c:\dvjjp.exec:\dvjjp.exe83⤵PID:3452
-
\??\c:\7vjdd.exec:\7vjdd.exe84⤵PID:5004
-
\??\c:\llxrlfl.exec:\llxrlfl.exe85⤵PID:3756
-
\??\c:\3bhbnn.exec:\3bhbnn.exe86⤵PID:4644
-
\??\c:\9djdd.exec:\9djdd.exe87⤵PID:3604
-
\??\c:\pdppp.exec:\pdppp.exe88⤵PID:4128
-
\??\c:\llfrfxx.exec:\llfrfxx.exe89⤵PID:1292
-
\??\c:\ttbbbb.exec:\ttbbbb.exe90⤵PID:856
-
\??\c:\1jppp.exec:\1jppp.exe91⤵PID:3260
-
\??\c:\rlffxxx.exec:\rlffxxx.exe92⤵PID:5008
-
\??\c:\xxfrfrl.exec:\xxfrfrl.exe93⤵PID:4904
-
\??\c:\htnnbn.exec:\htnnbn.exe94⤵PID:4516
-
\??\c:\pdvpd.exec:\pdvpd.exe95⤵PID:2652
-
\??\c:\lflllrx.exec:\lflllrx.exe96⤵PID:4092
-
\??\c:\hhnbhh.exec:\hhnbhh.exe97⤵PID:4708
-
\??\c:\vvdpp.exec:\vvdpp.exe98⤵PID:2704
-
\??\c:\dpvpp.exec:\dpvpp.exe99⤵PID:328
-
\??\c:\flrrlrr.exec:\flrrlrr.exe100⤵PID:4496
-
\??\c:\bthhnn.exec:\bthhnn.exe101⤵PID:4724
-
\??\c:\jvvvp.exec:\jvvvp.exe102⤵PID:4520
-
\??\c:\dvdvp.exec:\dvdvp.exe103⤵PID:1272
-
\??\c:\frrrrll.exec:\frrrrll.exe104⤵PID:5068
-
\??\c:\5lxrflf.exec:\5lxrflf.exe105⤵PID:3152
-
\??\c:\hthbhb.exec:\hthbhb.exe106⤵PID:2688
-
\??\c:\rllxxfx.exec:\rllxxfx.exe107⤵PID:4632
-
\??\c:\btnnhh.exec:\btnnhh.exe108⤵PID:2560
-
\??\c:\tbhhbn.exec:\tbhhbn.exe109⤵PID:4836
-
\??\c:\5vppj.exec:\5vppj.exe110⤵PID:2736
-
\??\c:\7rlfxxf.exec:\7rlfxxf.exe111⤵PID:1928
-
\??\c:\1xfxrrl.exec:\1xfxrrl.exe112⤵PID:5104
-
\??\c:\htbttt.exec:\htbttt.exe113⤵PID:2280
-
\??\c:\jdjdv.exec:\jdjdv.exe114⤵PID:4356
-
\??\c:\rxlfrrr.exec:\rxlfrrr.exe115⤵PID:3556
-
\??\c:\9xxxxff.exec:\9xxxxff.exe116⤵PID:3032
-
\??\c:\nbbbtt.exec:\nbbbtt.exe117⤵PID:3268
-
\??\c:\ppdvj.exec:\ppdvj.exe118⤵PID:1700
-
\??\c:\lrrrlrl.exec:\lrrrlrl.exe119⤵PID:2696
-
\??\c:\5tbthh.exec:\5tbthh.exe120⤵PID:3744
-
\??\c:\vpdvv.exec:\vpdvv.exe121⤵PID:3172
-
\??\c:\vdjvj.exec:\vdjvj.exe122⤵PID:4468
-
\??\c:\xrlllff.exec:\xrlllff.exe123⤵PID:3840
-
\??\c:\bbntnn.exec:\bbntnn.exe124⤵PID:728
-
\??\c:\nhhhhb.exec:\nhhhhb.exe125⤵PID:1648
-
\??\c:\5jddv.exec:\5jddv.exe126⤵PID:3740
-
\??\c:\xxxrrll.exec:\xxxrrll.exe127⤵PID:4252
-
\??\c:\tntnhh.exec:\tntnhh.exe128⤵PID:4052
-
\??\c:\nbnhbh.exec:\nbnhbh.exe129⤵PID:3676
-
\??\c:\pdjjv.exec:\pdjjv.exe130⤵PID:448
-
\??\c:\rlffrrx.exec:\rlffrrx.exe131⤵PID:4048
-
\??\c:\ttnhtn.exec:\ttnhtn.exe132⤵PID:2900
-
\??\c:\thhthh.exec:\thhthh.exe133⤵PID:4184
-
\??\c:\dvvdv.exec:\dvvdv.exe134⤵PID:3096
-
\??\c:\lrlfxrr.exec:\lrlfxrr.exe135⤵PID:1064
-
\??\c:\nbttbt.exec:\nbttbt.exe136⤵PID:2100
-
\??\c:\3bhnnh.exec:\3bhnnh.exe137⤵PID:4272
-
\??\c:\jddjj.exec:\jddjj.exe138⤵PID:1032
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe139⤵PID:1568
-
\??\c:\bhnhbb.exec:\bhnhbb.exe140⤵PID:3800
-
\??\c:\tntntt.exec:\tntntt.exe141⤵PID:3224
-
\??\c:\9hhbbb.exec:\9hhbbb.exe142⤵PID:3748
-
\??\c:\bhhtnh.exec:\bhhtnh.exe143⤵PID:3168
-
\??\c:\vvpjv.exec:\vvpjv.exe144⤵PID:2268
-
\??\c:\xfffxxr.exec:\xfffxxr.exe145⤵PID:2256
-
\??\c:\7fffxfx.exec:\7fffxfx.exe146⤵PID:4904
-
\??\c:\5dpjp.exec:\5dpjp.exe147⤵PID:4944
-
\??\c:\1dppd.exec:\1dppd.exe148⤵PID:536
-
\??\c:\5lxfxlf.exec:\5lxfxlf.exe149⤵PID:1756
-
\??\c:\hhnnnn.exec:\hhnnnn.exe150⤵PID:3720
-
\??\c:\vjjdv.exec:\vjjdv.exe151⤵PID:3484
-
\??\c:\fxxfffx.exec:\fxxfffx.exe152⤵PID:4612
-
\??\c:\btbnhh.exec:\btbnhh.exe153⤵PID:4724
-
\??\c:\9vvpp.exec:\9vvpp.exe154⤵PID:2028
-
\??\c:\lflrrrf.exec:\lflrrrf.exe155⤵PID:4300
-
\??\c:\ffxlfrl.exec:\ffxlfrl.exe156⤵PID:1704
-
\??\c:\jjpdd.exec:\jjpdd.exe157⤵PID:4552
-
\??\c:\jpppj.exec:\jpppj.exe158⤵PID:1548
-
\??\c:\1flrrrr.exec:\1flrrrr.exe159⤵PID:1836
-
\??\c:\3vddd.exec:\3vddd.exe160⤵PID:3408
-
\??\c:\dvddd.exec:\dvddd.exe161⤵PID:1140
-
\??\c:\5fxxxrr.exec:\5fxxxrr.exe162⤵PID:3916
-
\??\c:\btthnt.exec:\btthnt.exe163⤵PID:4740
-
\??\c:\vpppj.exec:\vpppj.exe164⤵PID:1912
-
\??\c:\lrlllrr.exec:\lrlllrr.exe165⤵PID:456
-
\??\c:\hbbnth.exec:\hbbnth.exe166⤵PID:3204
-
\??\c:\hnbhtt.exec:\hnbhtt.exe167⤵PID:2004
-
\??\c:\djdvd.exec:\djdvd.exe168⤵PID:3556
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe169⤵PID:2492
-
\??\c:\xlrlllf.exec:\xlrlllf.exe170⤵PID:2068
-
\??\c:\bnbttt.exec:\bnbttt.exe171⤵PID:3972
-
\??\c:\jdvdp.exec:\jdvdp.exe172⤵PID:2920
-
\??\c:\xrxxxff.exec:\xrxxxff.exe173⤵PID:2036
-
\??\c:\xxffxxx.exec:\xxffxxx.exe174⤵PID:4380
-
\??\c:\nhbbnn.exec:\nhbbnn.exe175⤵PID:1540
-
\??\c:\vjvpj.exec:\vjvpj.exe176⤵PID:4436
-
\??\c:\dpdvv.exec:\dpdvv.exe177⤵PID:2880
-
\??\c:\xrxxxff.exec:\xrxxxff.exe178⤵PID:2332
-
\??\c:\xffxrrr.exec:\xffxrrr.exe179⤵PID:3448
-
\??\c:\3thhtb.exec:\3thhtb.exe180⤵PID:2904
-
\??\c:\5htnbb.exec:\5htnbb.exe181⤵PID:4184
-
\??\c:\pjjdd.exec:\pjjdd.exe182⤵PID:2876
-
\??\c:\lllfffx.exec:\lllfffx.exe183⤵PID:3796
-
\??\c:\llrrxxf.exec:\llrrxxf.exe184⤵PID:4992
-
\??\c:\3pjpp.exec:\3pjpp.exe185⤵PID:4420
-
\??\c:\vpddd.exec:\vpddd.exe186⤵PID:4488
-
\??\c:\xlxrfll.exec:\xlxrfll.exe187⤵PID:3604
-
\??\c:\hbnhbb.exec:\hbnhbb.exe188⤵PID:2024
-
\??\c:\thtnbb.exec:\thtnbb.exe189⤵PID:4148
-
\??\c:\vppdv.exec:\vppdv.exe190⤵PID:3376
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe191⤵PID:4964
-
\??\c:\tnnhbb.exec:\tnnhbb.exe192⤵PID:3216
-
\??\c:\pdvdd.exec:\pdvdd.exe193⤵PID:2256
-
\??\c:\rfllrrf.exec:\rfllrrf.exe194⤵PID:3532
-
\??\c:\bbtnnn.exec:\bbtnnn.exe195⤵PID:1984
-
\??\c:\ttnbhb.exec:\ttnbhb.exe196⤵PID:4308
-
\??\c:\5ddpj.exec:\5ddpj.exe197⤵PID:3484
-
\??\c:\ffrrrff.exec:\ffrrrff.exe198⤵PID:4612
-
\??\c:\bthbbb.exec:\bthbbb.exe199⤵PID:4724
-
\??\c:\pvdvv.exec:\pvdvv.exe200⤵PID:4168
-
\??\c:\vjjjv.exec:\vjjjv.exe201⤵PID:4300
-
\??\c:\xlllllf.exec:\xlllllf.exe202⤵PID:2076
-
\??\c:\nbnntt.exec:\nbnntt.exe203⤵PID:3368
-
\??\c:\7jjjp.exec:\7jjjp.exe204⤵PID:4924
-
\??\c:\xlrrfff.exec:\xlrrfff.exe205⤵PID:3684
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe206⤵PID:1716
-
\??\c:\bthhnh.exec:\bthhnh.exe207⤵PID:3792
-
\??\c:\pjppp.exec:\pjppp.exe208⤵PID:4192
-
\??\c:\vjpjj.exec:\vjpjj.exe209⤵PID:4808
-
\??\c:\xxffllx.exec:\xxffllx.exe210⤵PID:3784
-
\??\c:\7nnhbb.exec:\7nnhbb.exe211⤵PID:660
-
\??\c:\7pjjp.exec:\7pjjp.exe212⤵PID:4356
-
\??\c:\rxffxxf.exec:\rxffxxf.exe213⤵PID:4368
-
\??\c:\lfxfllf.exec:\lfxfllf.exe214⤵PID:3472
-
\??\c:\tbnthb.exec:\tbnthb.exe215⤵PID:2800
-
\??\c:\pjpjp.exec:\pjpjp.exe216⤵PID:2696
-
\??\c:\3ppjd.exec:\3ppjd.exe217⤵PID:4324
-
\??\c:\lxrrfrr.exec:\lxrrfrr.exe218⤵PID:2536
-
\??\c:\1tbhbb.exec:\1tbhbb.exe219⤵PID:2792
-
\??\c:\rlrrllf.exec:\rlrrllf.exe220⤵PID:1648
-
\??\c:\tnhttt.exec:\tnhttt.exe221⤵PID:4252
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe222⤵PID:3428
-
\??\c:\ntnnhn.exec:\ntnnhn.exe223⤵PID:4048
-
\??\c:\ddjvd.exec:\ddjvd.exe224⤵PID:4840
-
\??\c:\1rxlxrx.exec:\1rxlxrx.exe225⤵PID:2872
-
\??\c:\1lrlfff.exec:\1lrlfff.exe226⤵PID:1348
-
\??\c:\ntbtnh.exec:\ntbtnh.exe227⤵PID:3452
-
\??\c:\jdjpp.exec:\jdjpp.exe228⤵PID:4272
-
\??\c:\3vddj.exec:\3vddj.exe229⤵PID:2144
-
\??\c:\fxfflrx.exec:\fxfflrx.exe230⤵PID:4420
-
\??\c:\thbtnt.exec:\thbtnt.exe231⤵PID:3968
-
\??\c:\1pjjd.exec:\1pjjd.exe232⤵PID:4700
-
\??\c:\7ppjd.exec:\7ppjd.exe233⤵PID:3224
-
\??\c:\rfrfrxx.exec:\rfrfrxx.exe234⤵PID:4080
-
\??\c:\bbbhnn.exec:\bbbhnn.exe235⤵PID:4172
-
\??\c:\tnbtbh.exec:\tnbtbh.exe236⤵PID:2948
-
\??\c:\vpjdv.exec:\vpjdv.exe237⤵PID:876
-
\??\c:\llllfff.exec:\llllfff.exe238⤵PID:4904
-
\??\c:\rrlrlrr.exec:\rrlrlrr.exe239⤵PID:4668
-
\??\c:\bbnntt.exec:\bbnntt.exe240⤵PID:2464
-
\??\c:\5jvpp.exec:\5jvpp.exe241⤵PID:3720
-
\??\c:\djvpp.exec:\djvpp.exe242⤵PID:4472