Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 18:47
Behavioral task
behavioral1
Sample
1055805d449c49438848ed104b32dee334e7037c32dc24fc6a8567bacd40ae9c.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
1055805d449c49438848ed104b32dee334e7037c32dc24fc6a8567bacd40ae9c.exe
-
Size
335KB
-
MD5
40221cd844397d2dba90336e703e866b
-
SHA1
243c3f5d010da1782901f62f6c0ac6cd0863b403
-
SHA256
1055805d449c49438848ed104b32dee334e7037c32dc24fc6a8567bacd40ae9c
-
SHA512
a39119e1fd894f4c6bf31067bc4bff339114dd672caf9e5f4ebd47e76bd370e5f918320c3e9379b6f4e19a73d314fbcc1459be72a026b683d9c5857dc001e203
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1ic:x4wFHoS3eFaKHpv/VycgE8f
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1848-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2588-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1108-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3772-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1972-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/744-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2072-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1708-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1732-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1228-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2096-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2536-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/940-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2708-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2640-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1964-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4220-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2960-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1316-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4156-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/952-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/656-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/980-527-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/940-534-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-547-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3504-558-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-559-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-645-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-667-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-678-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-735-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4708-746-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2588-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ddjvv.exe UPX behavioral2/memory/1848-9-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\jdjdd.exe UPX behavioral2/memory/5020-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2588-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\fllllrr.exe UPX behavioral2/memory/3108-19-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3108-25-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\jvpjv.exe UPX behavioral2/memory/4364-27-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xrxfffl.exe UPX C:\bbbtht.exe UPX behavioral2/memory/4928-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vppdd.exe UPX behavioral2/memory/876-46-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rllflrx.exe UPX C:\tnbhhb.exe UPX behavioral2/memory/1108-54-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lxfxfxl.exe UPX behavioral2/memory/1608-58-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hbntbh.exe UPX behavioral2/memory/2088-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\frllrrx.exe UPX C:\5nhbbn.exe UPX behavioral2/memory/4896-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rflxxxf.exe UPX behavioral2/memory/3772-84-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1972-82-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bnbbbh.exe UPX \??\c:\1bhhhn.exe UPX behavioral2/memory/744-94-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5000-96-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nbbbbh.exe UPX \??\c:\9lrxrxf.exe UPX behavioral2/memory/4368-106-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4764-107-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vjddd.exe UPX C:\bnbbbb.exe UPX behavioral2/memory/2072-114-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2552-120-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ddpvp.exe UPX C:\nntttb.exe UPX behavioral2/memory/3712-129-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jvdpd.exe UPX C:\hbhbbb.exe UPX behavioral2/memory/1708-140-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jpjjp.exe UPX C:\tbnnnn.exe UPX behavioral2/memory/1732-153-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nhtbbb.exe UPX C:\1lxflrx.exe UPX behavioral2/memory/1228-162-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2096-165-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nntnnn.exe UPX C:\vpdvp.exe UPX C:\rfffxxx.exe UPX behavioral2/memory/4796-180-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\httbbh.exe UPX behavioral2/memory/2536-186-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4524-190-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3668-194-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3460-195-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3460-199-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
ddjvv.exejdjdd.exefllllrr.exejvpjv.exexrxfffl.exebbbtht.exevppdd.exerllflrx.exetnbhhb.exelxfxfxl.exehbntbh.exefrllrrx.exe5nhbbn.exerflxxxf.exebnbbbh.exe1bhhhn.exenbbbbh.exe9lrxrxf.exevjddd.exebnbbbb.exeddpvp.exenntttb.exejvdpd.exehbhbbb.exejpjjp.exetbnnnn.exenhtbbb.exe1lxflrx.exenntnnn.exevpdvp.exerfffxxx.exehttbbh.exeddddv.exerlxfllr.exethnhnt.exeddvdd.exe7xllxxr.exebbbhhn.exetbbthn.exenntnnh.exebhnttb.exevvjjd.exeflxrrrr.exetthbnt.exelffrrxx.exe5hnhnh.exejjjjp.exerrrrlll.exentttbb.exejjddd.exepjjjd.exelflffff.exepdpjj.exe9dpjj.exelrllrlr.exehbbtnb.exedjjvv.exexxxrlrl.exenhnnnt.exevjdvj.exejdvjj.exe1rfffrf.exetnbbbb.exejjpvp.exepid process 1848 ddjvv.exe 5020 jdjdd.exe 3108 fllllrr.exe 4364 jvpjv.exe 1836 xrxfffl.exe 4928 bbbtht.exe 876 vppdd.exe 1108 rllflrx.exe 1608 tnbhhb.exe 2088 lxfxfxl.exe 3236 hbntbh.exe 4896 frllrrx.exe 1972 5nhbbn.exe 3772 rflxxxf.exe 744 bnbbbh.exe 5000 1bhhhn.exe 4368 nbbbbh.exe 4764 9lrxrxf.exe 2072 vjddd.exe 2552 bnbbbb.exe 3712 ddpvp.exe 1056 nntttb.exe 1708 jvdpd.exe 1904 hbhbbb.exe 3836 jpjjp.exe 1732 tbnnnn.exe 1228 nhtbbb.exe 2096 1lxflrx.exe 4064 nntnnn.exe 4796 vpdvp.exe 2536 rfffxxx.exe 4524 httbbh.exe 3668 ddddv.exe 3460 rlxfllr.exe 4304 thnhnt.exe 4548 ddvdd.exe 4188 7xllxxr.exe 3608 bbbhhn.exe 3224 tbbthn.exe 3164 nntnnh.exe 5004 bhnttb.exe 940 vvjjd.exe 2708 flxrrrr.exe 2640 tthbnt.exe 464 lffrrxx.exe 1964 5hnhnh.exe 4496 jjjjp.exe 2440 rrrrlll.exe 3080 ntttbb.exe 2728 jjddd.exe 2020 pjjjd.exe 2520 lflffff.exe 2604 pdpjj.exe 3816 9dpjj.exe 4608 lrllrlr.exe 1672 hbbtnb.exe 2304 djjvv.exe 1504 xxxrlrl.exe 4220 nhnnnt.exe 744 vjdvj.exe 4508 jdvjj.exe 4160 1rfffrf.exe 3000 tnbbbb.exe 1528 jjpvp.exe -
Processes:
resource yara_rule behavioral2/memory/2588-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddjvv.exe upx behavioral2/memory/1848-9-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdjdd.exe upx behavioral2/memory/5020-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2588-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fllllrr.exe upx behavioral2/memory/3108-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3108-25-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jvpjv.exe upx behavioral2/memory/4364-27-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrxfffl.exe upx C:\bbbtht.exe upx behavioral2/memory/4928-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vppdd.exe upx behavioral2/memory/876-46-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rllflrx.exe upx C:\tnbhhb.exe upx behavioral2/memory/1108-54-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxfxfxl.exe upx behavioral2/memory/1608-58-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbntbh.exe upx behavioral2/memory/2088-64-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frllrrx.exe upx C:\5nhbbn.exe upx behavioral2/memory/4896-75-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rflxxxf.exe upx behavioral2/memory/3772-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1972-82-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnbbbh.exe upx \??\c:\1bhhhn.exe upx behavioral2/memory/744-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5000-96-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbbbbh.exe upx \??\c:\9lrxrxf.exe upx behavioral2/memory/4368-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4764-107-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjddd.exe upx C:\bnbbbb.exe upx behavioral2/memory/2072-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2552-120-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddpvp.exe upx C:\nntttb.exe upx behavioral2/memory/3712-129-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvdpd.exe upx C:\hbhbbb.exe upx behavioral2/memory/1708-140-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpjjp.exe upx C:\tbnnnn.exe upx behavioral2/memory/1732-153-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhtbbb.exe upx C:\1lxflrx.exe upx behavioral2/memory/1228-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2096-165-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nntnnn.exe upx C:\vpdvp.exe upx C:\rfffxxx.exe upx behavioral2/memory/4796-180-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\httbbh.exe upx behavioral2/memory/2536-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4524-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3668-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3460-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3460-199-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1055805d449c49438848ed104b32dee334e7037c32dc24fc6a8567bacd40ae9c.exeddjvv.exejdjdd.exefllllrr.exejvpjv.exexrxfffl.exebbbtht.exevppdd.exerllflrx.exetnbhhb.exelxfxfxl.exehbntbh.exefrllrrx.exe5nhbbn.exerflxxxf.exebnbbbh.exe1bhhhn.exenbbbbh.exe9lrxrxf.exevjddd.exebnbbbb.exeddpvp.exedescription pid process target process PID 2588 wrote to memory of 1848 2588 1055805d449c49438848ed104b32dee334e7037c32dc24fc6a8567bacd40ae9c.exe ddjvv.exe PID 2588 wrote to memory of 1848 2588 1055805d449c49438848ed104b32dee334e7037c32dc24fc6a8567bacd40ae9c.exe ddjvv.exe PID 2588 wrote to memory of 1848 2588 1055805d449c49438848ed104b32dee334e7037c32dc24fc6a8567bacd40ae9c.exe ddjvv.exe PID 1848 wrote to memory of 5020 1848 ddjvv.exe jdjdd.exe PID 1848 wrote to memory of 5020 1848 ddjvv.exe jdjdd.exe PID 1848 wrote to memory of 5020 1848 ddjvv.exe jdjdd.exe PID 5020 wrote to memory of 3108 5020 jdjdd.exe fllllrr.exe PID 5020 wrote to memory of 3108 5020 jdjdd.exe fllllrr.exe PID 5020 wrote to memory of 3108 5020 jdjdd.exe fllllrr.exe PID 3108 wrote to memory of 4364 3108 fllllrr.exe jvpjv.exe PID 3108 wrote to memory of 4364 3108 fllllrr.exe jvpjv.exe PID 3108 wrote to memory of 4364 3108 fllllrr.exe jvpjv.exe PID 4364 wrote to memory of 1836 4364 jvpjv.exe xrxfffl.exe PID 4364 wrote to memory of 1836 4364 jvpjv.exe xrxfffl.exe PID 4364 wrote to memory of 1836 4364 jvpjv.exe xrxfffl.exe PID 1836 wrote to memory of 4928 1836 xrxfffl.exe bbbtht.exe PID 1836 wrote to memory of 4928 1836 xrxfffl.exe bbbtht.exe PID 1836 wrote to memory of 4928 1836 xrxfffl.exe bbbtht.exe PID 4928 wrote to memory of 876 4928 bbbtht.exe vppdd.exe PID 4928 wrote to memory of 876 4928 bbbtht.exe vppdd.exe PID 4928 wrote to memory of 876 4928 bbbtht.exe vppdd.exe PID 876 wrote to memory of 1108 876 vppdd.exe rllflrx.exe PID 876 wrote to memory of 1108 876 vppdd.exe rllflrx.exe PID 876 wrote to memory of 1108 876 vppdd.exe rllflrx.exe PID 1108 wrote to memory of 1608 1108 rllflrx.exe tnbhhb.exe PID 1108 wrote to memory of 1608 1108 rllflrx.exe tnbhhb.exe PID 1108 wrote to memory of 1608 1108 rllflrx.exe tnbhhb.exe PID 1608 wrote to memory of 2088 1608 tnbhhb.exe lxfxfxl.exe PID 1608 wrote to memory of 2088 1608 tnbhhb.exe lxfxfxl.exe PID 1608 wrote to memory of 2088 1608 tnbhhb.exe lxfxfxl.exe PID 2088 wrote to memory of 3236 2088 lxfxfxl.exe hbntbh.exe PID 2088 wrote to memory of 3236 2088 lxfxfxl.exe hbntbh.exe PID 2088 wrote to memory of 3236 2088 lxfxfxl.exe hbntbh.exe PID 3236 wrote to memory of 4896 3236 hbntbh.exe frllrrx.exe PID 3236 wrote to memory of 4896 3236 hbntbh.exe frllrrx.exe PID 3236 wrote to memory of 4896 3236 hbntbh.exe frllrrx.exe PID 4896 wrote to memory of 1972 4896 frllrrx.exe 5nhbbn.exe PID 4896 wrote to memory of 1972 4896 frllrrx.exe 5nhbbn.exe PID 4896 wrote to memory of 1972 4896 frllrrx.exe 5nhbbn.exe PID 1972 wrote to memory of 3772 1972 5nhbbn.exe rflxxxf.exe PID 1972 wrote to memory of 3772 1972 5nhbbn.exe rflxxxf.exe PID 1972 wrote to memory of 3772 1972 5nhbbn.exe rflxxxf.exe PID 3772 wrote to memory of 744 3772 rflxxxf.exe bnbbbh.exe PID 3772 wrote to memory of 744 3772 rflxxxf.exe bnbbbh.exe PID 3772 wrote to memory of 744 3772 rflxxxf.exe bnbbbh.exe PID 744 wrote to memory of 5000 744 bnbbbh.exe 1bhhhn.exe PID 744 wrote to memory of 5000 744 bnbbbh.exe 1bhhhn.exe PID 744 wrote to memory of 5000 744 bnbbbh.exe 1bhhhn.exe PID 5000 wrote to memory of 4368 5000 1bhhhn.exe nbbbbh.exe PID 5000 wrote to memory of 4368 5000 1bhhhn.exe nbbbbh.exe PID 5000 wrote to memory of 4368 5000 1bhhhn.exe nbbbbh.exe PID 4368 wrote to memory of 4764 4368 nbbbbh.exe 9lrxrxf.exe PID 4368 wrote to memory of 4764 4368 nbbbbh.exe 9lrxrxf.exe PID 4368 wrote to memory of 4764 4368 nbbbbh.exe 9lrxrxf.exe PID 4764 wrote to memory of 2072 4764 9lrxrxf.exe vjddd.exe PID 4764 wrote to memory of 2072 4764 9lrxrxf.exe vjddd.exe PID 4764 wrote to memory of 2072 4764 9lrxrxf.exe vjddd.exe PID 2072 wrote to memory of 2552 2072 vjddd.exe bnbbbb.exe PID 2072 wrote to memory of 2552 2072 vjddd.exe bnbbbb.exe PID 2072 wrote to memory of 2552 2072 vjddd.exe bnbbbb.exe PID 2552 wrote to memory of 3712 2552 bnbbbb.exe ddpvp.exe PID 2552 wrote to memory of 3712 2552 bnbbbb.exe ddpvp.exe PID 2552 wrote to memory of 3712 2552 bnbbbb.exe ddpvp.exe PID 3712 wrote to memory of 1056 3712 ddpvp.exe nntttb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1055805d449c49438848ed104b32dee334e7037c32dc24fc6a8567bacd40ae9c.exe"C:\Users\Admin\AppData\Local\Temp\1055805d449c49438848ed104b32dee334e7037c32dc24fc6a8567bacd40ae9c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\ddjvv.exec:\ddjvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\jdjdd.exec:\jdjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\fllllrr.exec:\fllllrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\jvpjv.exec:\jvpjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\xrxfffl.exec:\xrxfffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\bbbtht.exec:\bbbtht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\vppdd.exec:\vppdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\rllflrx.exec:\rllflrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\tnbhhb.exec:\tnbhhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\lxfxfxl.exec:\lxfxfxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\hbntbh.exec:\hbntbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\frllrrx.exec:\frllrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\5nhbbn.exec:\5nhbbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\rflxxxf.exec:\rflxxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\bnbbbh.exec:\bnbbbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\1bhhhn.exec:\1bhhhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\nbbbbh.exec:\nbbbbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\9lrxrxf.exec:\9lrxrxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\vjddd.exec:\vjddd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\bnbbbb.exec:\bnbbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\ddpvp.exec:\ddpvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\nntttb.exec:\nntttb.exe23⤵
- Executes dropped EXE
PID:1056 -
\??\c:\jvdpd.exec:\jvdpd.exe24⤵
- Executes dropped EXE
PID:1708 -
\??\c:\hbhbbb.exec:\hbhbbb.exe25⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jpjjp.exec:\jpjjp.exe26⤵
- Executes dropped EXE
PID:3836 -
\??\c:\tbnnnn.exec:\tbnnnn.exe27⤵
- Executes dropped EXE
PID:1732 -
\??\c:\nhtbbb.exec:\nhtbbb.exe28⤵
- Executes dropped EXE
PID:1228 -
\??\c:\1lxflrx.exec:\1lxflrx.exe29⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nntnnn.exec:\nntnnn.exe30⤵
- Executes dropped EXE
PID:4064 -
\??\c:\vpdvp.exec:\vpdvp.exe31⤵
- Executes dropped EXE
PID:4796 -
\??\c:\rfffxxx.exec:\rfffxxx.exe32⤵
- Executes dropped EXE
PID:2536 -
\??\c:\httbbh.exec:\httbbh.exe33⤵
- Executes dropped EXE
PID:4524 -
\??\c:\ddddv.exec:\ddddv.exe34⤵
- Executes dropped EXE
PID:3668 -
\??\c:\rlxfllr.exec:\rlxfllr.exe35⤵
- Executes dropped EXE
PID:3460 -
\??\c:\thnhnt.exec:\thnhnt.exe36⤵
- Executes dropped EXE
PID:4304 -
\??\c:\ddvdd.exec:\ddvdd.exe37⤵
- Executes dropped EXE
PID:4548 -
\??\c:\7xllxxr.exec:\7xllxxr.exe38⤵
- Executes dropped EXE
PID:4188 -
\??\c:\bbbhhn.exec:\bbbhhn.exe39⤵
- Executes dropped EXE
PID:3608 -
\??\c:\tbbthn.exec:\tbbthn.exe40⤵
- Executes dropped EXE
PID:3224 -
\??\c:\vdvdd.exec:\vdvdd.exe41⤵PID:4920
-
\??\c:\nntnnh.exec:\nntnnh.exe42⤵
- Executes dropped EXE
PID:3164 -
\??\c:\bhnttb.exec:\bhnttb.exe43⤵
- Executes dropped EXE
PID:5004 -
\??\c:\vvjjd.exec:\vvjjd.exe44⤵
- Executes dropped EXE
PID:940 -
\??\c:\flxrrrr.exec:\flxrrrr.exe45⤵
- Executes dropped EXE
PID:2708 -
\??\c:\tthbnt.exec:\tthbnt.exe46⤵
- Executes dropped EXE
PID:2640 -
\??\c:\lffrrxx.exec:\lffrrxx.exe47⤵
- Executes dropped EXE
PID:464 -
\??\c:\5hnhnh.exec:\5hnhnh.exe48⤵
- Executes dropped EXE
PID:1964 -
\??\c:\jjjjp.exec:\jjjjp.exe49⤵
- Executes dropped EXE
PID:4496 -
\??\c:\rrrrlll.exec:\rrrrlll.exe50⤵
- Executes dropped EXE
PID:2440 -
\??\c:\ntttbb.exec:\ntttbb.exe51⤵
- Executes dropped EXE
PID:3080 -
\??\c:\jjddd.exec:\jjddd.exe52⤵
- Executes dropped EXE
PID:2728 -
\??\c:\pjjjd.exec:\pjjjd.exe53⤵
- Executes dropped EXE
PID:2020 -
\??\c:\lflffff.exec:\lflffff.exe54⤵
- Executes dropped EXE
PID:2520 -
\??\c:\pdpjj.exec:\pdpjj.exe55⤵
- Executes dropped EXE
PID:2604 -
\??\c:\9dpjj.exec:\9dpjj.exe56⤵
- Executes dropped EXE
PID:3816 -
\??\c:\lrllrlr.exec:\lrllrlr.exe57⤵
- Executes dropped EXE
PID:4608 -
\??\c:\hbbtnb.exec:\hbbtnb.exe58⤵
- Executes dropped EXE
PID:1672 -
\??\c:\djjvv.exec:\djjvv.exe59⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xxxrlrl.exec:\xxxrlrl.exe60⤵
- Executes dropped EXE
PID:1504 -
\??\c:\nhnnnt.exec:\nhnnnt.exe61⤵
- Executes dropped EXE
PID:4220 -
\??\c:\vjdvj.exec:\vjdvj.exe62⤵
- Executes dropped EXE
PID:744 -
\??\c:\jdvjj.exec:\jdvjj.exe63⤵
- Executes dropped EXE
PID:4508 -
\??\c:\1rfffrf.exec:\1rfffrf.exe64⤵
- Executes dropped EXE
PID:4160 -
\??\c:\tnbbbb.exec:\tnbbbb.exe65⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jjpvp.exec:\jjpvp.exe66⤵
- Executes dropped EXE
PID:1528 -
\??\c:\xxlflrx.exec:\xxlflrx.exe67⤵PID:2072
-
\??\c:\tnthnt.exec:\tnthnt.exe68⤵PID:3320
-
\??\c:\ffffrxl.exec:\ffffrxl.exe69⤵PID:1488
-
\??\c:\3bhnhn.exec:\3bhnhn.exe70⤵PID:2960
-
\??\c:\pvjjj.exec:\pvjjj.exe71⤵PID:1316
-
\??\c:\rlrxrff.exec:\rlrxrff.exe72⤵PID:4628
-
\??\c:\nntttb.exec:\nntttb.exe73⤵PID:652
-
\??\c:\vvpdv.exec:\vvpdv.exe74⤵PID:1612
-
\??\c:\rrfrrfr.exec:\rrfrrfr.exe75⤵PID:4156
-
\??\c:\lflllrr.exec:\lflllrr.exe76⤵PID:1716
-
\??\c:\ttbbhn.exec:\ttbbhn.exe77⤵PID:952
-
\??\c:\pjvvd.exec:\pjvvd.exe78⤵PID:3676
-
\??\c:\xfrlfxx.exec:\xfrlfxx.exe79⤵PID:3764
-
\??\c:\fflllll.exec:\fflllll.exe80⤵PID:1532
-
\??\c:\hbbbnt.exec:\hbbbnt.exe81⤵PID:1860
-
\??\c:\djvjd.exec:\djvjd.exe82⤵PID:4084
-
\??\c:\pjdjp.exec:\pjdjp.exe83⤵PID:2800
-
\??\c:\ffllflf.exec:\ffllflf.exe84⤵PID:656
-
\??\c:\nhnnnh.exec:\nhnnnh.exe85⤵PID:436
-
\??\c:\jvpvv.exec:\jvpvv.exe86⤵PID:3616
-
\??\c:\flfffll.exec:\flfffll.exe87⤵PID:4304
-
\??\c:\1frlxxf.exec:\1frlxxf.exe88⤵PID:4960
-
\??\c:\nhnnhn.exec:\nhnnhn.exe89⤵PID:4604
-
\??\c:\ddpvd.exec:\ddpvd.exe90⤵PID:4492
-
\??\c:\pdpjj.exec:\pdpjj.exe91⤵PID:4952
-
\??\c:\9lxflrr.exec:\9lxflrr.exe92⤵PID:3744
-
\??\c:\btbttt.exec:\btbttt.exe93⤵PID:4144
-
\??\c:\jjpvv.exec:\jjpvv.exe94⤵PID:3332
-
\??\c:\jvddd.exec:\jvddd.exe95⤵PID:4876
-
\??\c:\7rrrlrr.exec:\7rrrlrr.exe96⤵PID:1896
-
\??\c:\7tnnnt.exec:\7tnnnt.exe97⤵PID:1964
-
\??\c:\ntnntn.exec:\ntnntn.exe98⤵PID:3956
-
\??\c:\dvdvv.exec:\dvdvv.exe99⤵PID:1108
-
\??\c:\3jjdd.exec:\3jjdd.exe100⤵PID:4072
-
\??\c:\9rrxxff.exec:\9rrxxff.exe101⤵PID:2728
-
\??\c:\hbnnhn.exec:\hbnnhn.exe102⤵PID:2260
-
\??\c:\bhhnhb.exec:\bhhnhb.exe103⤵PID:1040
-
\??\c:\vppvv.exec:\vppvv.exe104⤵PID:3400
-
\??\c:\xxxxxff.exec:\xxxxxff.exe105⤵PID:2184
-
\??\c:\bhnttt.exec:\bhnttt.exe106⤵PID:2304
-
\??\c:\nhhhhn.exec:\nhhhhn.exe107⤵PID:4612
-
\??\c:\7pjpv.exec:\7pjpv.exe108⤵PID:4616
-
\??\c:\xrxxrxf.exec:\xrxxrxf.exe109⤵PID:3328
-
\??\c:\flxlllr.exec:\flxlllr.exe110⤵PID:4252
-
\??\c:\1bbbhn.exec:\1bbbhn.exe111⤵PID:3652
-
\??\c:\vjvpp.exec:\vjvpp.exe112⤵PID:4180
-
\??\c:\vpvdd.exec:\vpvdd.exe113⤵PID:3776
-
\??\c:\rflrffx.exec:\rflrffx.exe114⤵PID:1056
-
\??\c:\nntthn.exec:\nntthn.exe115⤵PID:2024
-
\??\c:\9vdvd.exec:\9vdvd.exe116⤵PID:5056
-
\??\c:\xrrxxrr.exec:\xrrxxrr.exe117⤵PID:4628
-
\??\c:\bnhbhn.exec:\bnhbhn.exe118⤵PID:880
-
\??\c:\dvddd.exec:\dvddd.exe119⤵PID:1936
-
\??\c:\lfllllf.exec:\lfllllf.exe120⤵PID:1284
-
\??\c:\lxfxxxf.exec:\lxfxxxf.exe121⤵PID:772
-
\??\c:\7hbbtt.exec:\7hbbtt.exe122⤵PID:3884
-
\??\c:\vvvpj.exec:\vvvpj.exe123⤵PID:3104
-
\??\c:\djvvj.exec:\djvvj.exe124⤵PID:2468
-
\??\c:\rfrrlrr.exec:\rfrrlrr.exe125⤵PID:2784
-
\??\c:\bntttb.exec:\bntttb.exe126⤵PID:1036
-
\??\c:\vjjdv.exec:\vjjdv.exe127⤵PID:2800
-
\??\c:\5lrlrrl.exec:\5lrlrrl.exe128⤵PID:656
-
\??\c:\bnbthb.exec:\bnbthb.exe129⤵PID:1400
-
\??\c:\pvpvp.exec:\pvpvp.exe130⤵PID:2556
-
\??\c:\rfffxxx.exec:\rfffxxx.exe131⤵PID:4432
-
\??\c:\rllflfr.exec:\rllflfr.exe132⤵PID:2792
-
\??\c:\httnnt.exec:\httnnt.exe133⤵PID:4892
-
\??\c:\tbhbbb.exec:\tbhbbb.exe134⤵PID:2712
-
\??\c:\jddvd.exec:\jddvd.exe135⤵PID:980
-
\??\c:\lffrrxr.exec:\lffrrxr.exe136⤵PID:4600
-
\??\c:\tthhbh.exec:\tthhbh.exe137⤵PID:940
-
\??\c:\rlxrlfx.exec:\rlxrlfx.exe138⤵PID:4144
-
\??\c:\ttbbhh.exec:\ttbbhh.exe139⤵PID:4112
-
\??\c:\ppvpd.exec:\ppvpd.exe140⤵PID:4316
-
\??\c:\1rrrllf.exec:\1rrrllf.exe141⤵PID:876
-
\??\c:\hnnnhh.exec:\hnnnhh.exe142⤵PID:3624
-
\??\c:\djpjd.exec:\djpjd.exe143⤵PID:2440
-
\??\c:\flrrfll.exec:\flrrfll.exe144⤵PID:3504
-
\??\c:\ntbhbt.exec:\ntbhbt.exe145⤵PID:2088
-
\??\c:\3dpjj.exec:\3dpjj.exe146⤵PID:576
-
\??\c:\7xlffrr.exec:\7xlffrr.exe147⤵PID:60
-
\??\c:\thnnbh.exec:\thnnbh.exe148⤵PID:4920
-
\??\c:\3jvpp.exec:\3jvpp.exe149⤵PID:4700
-
\??\c:\jjjpd.exec:\jjjpd.exe150⤵PID:3188
-
\??\c:\rlfxflr.exec:\rlfxflr.exe151⤵PID:1064
-
\??\c:\nhntnh.exec:\nhntnh.exe152⤵PID:2672
-
\??\c:\jjppp.exec:\jjppp.exe153⤵PID:4788
-
\??\c:\xxxfrfr.exec:\xxxfrfr.exe154⤵PID:1528
-
\??\c:\tbbtbn.exec:\tbbtbn.exe155⤵PID:3940
-
\??\c:\hbntth.exec:\hbntth.exe156⤵PID:3652
-
\??\c:\jvjvj.exec:\jvjvj.exe157⤵PID:4312
-
\??\c:\rrxxrrl.exec:\rrxxrrl.exe158⤵PID:1488
-
\??\c:\rxlrxrf.exec:\rxlrxrf.exe159⤵PID:4148
-
\??\c:\hthbnh.exec:\hthbnh.exe160⤵PID:1316
-
\??\c:\jdppp.exec:\jdppp.exe161⤵PID:3444
-
\??\c:\rffxrrl.exec:\rffxrrl.exe162⤵PID:4176
-
\??\c:\bbnbhn.exec:\bbnbhn.exe163⤵PID:1872
-
\??\c:\hthhbb.exec:\hthhbb.exe164⤵PID:4452
-
\??\c:\vvjjp.exec:\vvjjp.exe165⤵PID:3040
-
\??\c:\rfxxrll.exec:\rfxxrll.exe166⤵PID:2096
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe167⤵PID:3884
-
\??\c:\nhhbtt.exec:\nhhbtt.exe168⤵PID:696
-
\??\c:\7dpjd.exec:\7dpjd.exe169⤵PID:2468
-
\??\c:\xxxxrlf.exec:\xxxxrlf.exe170⤵PID:2784
-
\??\c:\rffxrrl.exec:\rffxrrl.exe171⤵PID:1588
-
\??\c:\hbbnbb.exec:\hbbnbb.exe172⤵PID:3460
-
\??\c:\1ddjd.exec:\1ddjd.exe173⤵PID:4352
-
\??\c:\rrlrrlx.exec:\rrlrrlx.exe174⤵PID:3608
-
\??\c:\rxrllrx.exec:\rxrllrx.exe175⤵PID:924
-
\??\c:\bnnnnn.exec:\bnnnnn.exe176⤵PID:4440
-
\??\c:\3vvdp.exec:\3vvdp.exe177⤵PID:3804
-
\??\c:\vdvvv.exec:\vdvvv.exe178⤵PID:3164
-
\??\c:\lxllfll.exec:\lxllfll.exe179⤵PID:1980
-
\??\c:\ththtt.exec:\ththtt.exe180⤵PID:3108
-
\??\c:\1jpvj.exec:\1jpvj.exe181⤵PID:1124
-
\??\c:\frxrlfl.exec:\frxrlfl.exe182⤵PID:2640
-
\??\c:\llfxrrl.exec:\llfxrrl.exe183⤵PID:464
-
\??\c:\nbtnbb.exec:\nbtnbb.exe184⤵PID:2984
-
\??\c:\jdddv.exec:\jdddv.exe185⤵PID:4496
-
\??\c:\xflxrrl.exec:\xflxrrl.exe186⤵PID:4200
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe187⤵PID:2440
-
\??\c:\bhbbbb.exec:\bhbbbb.exe188⤵PID:4976
-
\??\c:\pjjjd.exec:\pjjjd.exe189⤵PID:4824
-
\??\c:\jjjjj.exec:\jjjjj.exe190⤵PID:5092
-
\??\c:\3rxlffx.exec:\3rxlffx.exe191⤵PID:3992
-
\??\c:\bbtnhh.exec:\bbtnhh.exe192⤵PID:4812
-
\??\c:\hhnhbt.exec:\hhnhbt.exe193⤵PID:4100
-
\??\c:\ppdvp.exec:\ppdvp.exe194⤵PID:4160
-
\??\c:\rlllffx.exec:\rlllffx.exe195⤵PID:4936
-
\??\c:\xrxrlll.exec:\xrxrlll.exe196⤵PID:500
-
\??\c:\5hhhbb.exec:\5hhhbb.exe197⤵PID:3576
-
\??\c:\9vvvp.exec:\9vvvp.exe198⤵PID:808
-
\??\c:\lxrlxfx.exec:\lxrlxfx.exe199⤵PID:4324
-
\??\c:\flrlfxr.exec:\flrlfxr.exe200⤵PID:4640
-
\??\c:\bbnbtb.exec:\bbnbtb.exe201⤵PID:2628
-
\??\c:\djpvd.exec:\djpvd.exe202⤵PID:1968
-
\??\c:\1lrlrrx.exec:\1lrlrrx.exe203⤵PID:2584
-
\??\c:\5lffxrr.exec:\5lffxrr.exe204⤵PID:4156
-
\??\c:\hbbhbb.exec:\hbbhbb.exe205⤵PID:4708
-
\??\c:\nbbttb.exec:\nbbttb.exe206⤵PID:1228
-
\??\c:\ddjdd.exec:\ddjdd.exe207⤵PID:1940
-
\??\c:\lfrlrrl.exec:\lfrlrrl.exe208⤵PID:1860
-
\??\c:\tnbnnt.exec:\tnbnnt.exe209⤵PID:1640
-
\??\c:\jvvvp.exec:\jvvvp.exe210⤵PID:3856
-
\??\c:\dvppd.exec:\dvppd.exe211⤵PID:3980
-
\??\c:\frlfxrr.exec:\frlfxrr.exe212⤵PID:4684
-
\??\c:\nbtttb.exec:\nbtttb.exe213⤵PID:2392
-
\??\c:\btttnn.exec:\btttnn.exe214⤵PID:448
-
\??\c:\3djvp.exec:\3djvp.exe215⤵PID:2800
-
\??\c:\rllffff.exec:\rllffff.exe216⤵PID:3144
-
\??\c:\rxfxlll.exec:\rxfxlll.exe217⤵PID:3112
-
\??\c:\1htbhh.exec:\1htbhh.exe218⤵PID:3224
-
\??\c:\pjvpp.exec:\pjvpp.exe219⤵PID:2168
-
\??\c:\xrxllrr.exec:\xrxllrr.exe220⤵PID:4892
-
\??\c:\tnnhbb.exec:\tnnhbb.exe221⤵PID:2148
-
\??\c:\tthbtn.exec:\tthbtn.exe222⤵PID:4568
-
\??\c:\pdvpj.exec:\pdvpj.exe223⤵PID:980
-
\??\c:\xrlfxxf.exec:\xrlfxxf.exe224⤵PID:4600
-
\??\c:\thtbbb.exec:\thtbbb.exe225⤵PID:1980
-
\??\c:\nbtnnn.exec:\nbtnnn.exe226⤵PID:4364
-
\??\c:\ppjdp.exec:\ppjdp.exe227⤵PID:452
-
\??\c:\9llfflr.exec:\9llfflr.exe228⤵PID:4928
-
\??\c:\lxxlxrl.exec:\lxxlxrl.exe229⤵PID:1548
-
\??\c:\ntbbbh.exec:\ntbbbh.exe230⤵PID:2004
-
\??\c:\jvjpp.exec:\jvjpp.exe231⤵PID:3048
-
\??\c:\lxrrlrr.exec:\lxrrlrr.exe232⤵PID:4200
-
\??\c:\7rfxfff.exec:\7rfxfff.exe233⤵PID:2440
-
\??\c:\btnhbb.exec:\btnhbb.exe234⤵PID:1420
-
\??\c:\jpjjj.exec:\jpjjj.exe235⤵PID:4824
-
\??\c:\lrlllfl.exec:\lrlllfl.exe236⤵PID:4608
-
\??\c:\lfrffff.exec:\lfrffff.exe237⤵PID:4184
-
\??\c:\nhtnhh.exec:\nhtnhh.exe238⤵PID:2516
-
\??\c:\dvddv.exec:\dvddv.exe239⤵PID:1616
-
\??\c:\frrlffx.exec:\frrlffx.exe240⤵PID:2768
-
\??\c:\bthhth.exec:\bthhth.exe241⤵PID:3328
-
\??\c:\5btttb.exec:\5btttb.exe242⤵PID:1200