Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 01:47
Behavioral task
behavioral1
Sample
b2d7e73dd357755604ad434784fa1cce11d24cf927cc785e8b9b69a6f449eceb.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
b2d7e73dd357755604ad434784fa1cce11d24cf927cc785e8b9b69a6f449eceb.exe
-
Size
65KB
-
MD5
37a74ae49ca41f8aa52921951e233803
-
SHA1
8c3f7cb8c88818084f943a50ed2d6b8cae4539a3
-
SHA256
b2d7e73dd357755604ad434784fa1cce11d24cf927cc785e8b9b69a6f449eceb
-
SHA512
69eb83099700b8ff5d10a830a52e61761a6740f5d6c81ee636a448e8c96f6733c58f426542e0d15016980bac4bae97f6fbe1ee20e6f1fe789698d16ac01429d9
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXN8dI4I9c1CLcxdw/G:khOmTsF93UYfwC6GIoutpYHrgow/G
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1604-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/868-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1260-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3812-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1780-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4532-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2676-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4052-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/556-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1100-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/816-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1816-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1384-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/908-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-523-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1128-573-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-670-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-756-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2252-844-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-1008-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-1028-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-1112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1604-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lflrxll.exe UPX behavioral2/memory/1604-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/868-10-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\bntbnn.exe UPX C:\rffxrll.exe UPX behavioral2/memory/1524-21-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xrxfrlx.exe UPX behavioral2/memory/2700-19-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pddjj.exe UPX behavioral2/memory/1260-29-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4148-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lxfxlrx.exe UPX behavioral2/memory/4148-36-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3196-41-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hhnbbt.exe UPX C:\1jddd.exe UPX behavioral2/memory/4376-48-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3lfrffr.exe UPX behavioral2/memory/5004-54-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2008-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rlxxxff.exe UPX behavioral2/memory/2008-61-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3780-67-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\9pvjj.exe UPX C:\xflllrx.exe UPX behavioral2/memory/3020-72-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tbnbnh.exe UPX \??\c:\vvvvv.exe UPX behavioral2/memory/3812-85-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\xlffflf.exe UPX C:\nntnhn.exe UPX behavioral2/memory/1780-94-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5jvvp.exe UPX behavioral2/memory/4112-99-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\xxfxffx.exe UPX C:\xxxrfrl.exe UPX behavioral2/memory/4532-112-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nnnhtn.exe UPX C:\jjddj.exe UPX C:\1lrrlrr.exe UPX behavioral2/memory/3736-126-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xxfxxfx.exe UPX behavioral2/memory/2676-139-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ppdvj.exe UPX \??\c:\nnbbbb.exe UPX C:\jdpdp.exe UPX C:\rlffflx.exe UPX behavioral2/memory/4188-159-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\hbbtnt.exe UPX behavioral2/memory/4052-161-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\thhbhh.exe UPX C:\llfxxrr.exe UPX \??\c:\lrffxxx.exe UPX C:\7hnttt.exe UPX behavioral2/memory/4764-178-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2948-183-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/556-192-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2012-202-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1100-206-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/816-213-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2416-215-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1816-221-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4912-223-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
lflrxll.exebntbnn.exerffxrll.exexrxfrlx.exepddjj.exelxfxlrx.exehhnbbt.exe1jddd.exe3lfrffr.exerlxxxff.exe9pvjj.exexflllrx.exetbnbnh.exevvvvv.exexlffflf.exenntnhn.exe5jvvp.exexxfxffx.exexxxrfrl.exennnhtn.exejjddj.exe1lrrlrr.exexxfxxfx.exennbbbb.exeppdvj.exejdpdp.exerlffflx.exehbbtnt.exethhbhh.exellfxxrr.exelrffxxx.exe7hnttt.exepdppj.exefxxrlll.exelxflllr.exebthhnh.exejvpdv.exexxffrlr.exexlrrlfr.exehbtntt.exedjjvp.exexxfrflf.exetbhnth.exe5hnhbh.exe9flfxxx.exeffxxxxx.exennnhhh.exe7ttnbb.exejjjdd.exelllffll.exexflfffl.exe9btbtb.exevdvpj.exe1pvdj.exefrrrffr.exebtbbtt.exenbnhtb.exedpvvv.exefxlrrlr.exentbntn.exebtnttt.exedjjpp.exe9flrrll.exeflxxrxr.exepid process 868 lflrxll.exe 2700 bntbnn.exe 1524 rffxrll.exe 1260 xrxfrlx.exe 4148 pddjj.exe 3196 lxfxlrx.exe 4376 hhnbbt.exe 5004 1jddd.exe 2008 3lfrffr.exe 3780 rlxxxff.exe 3020 9pvjj.exe 4068 xflllrx.exe 5108 tbnbnh.exe 3812 vvvvv.exe 1780 xlffflf.exe 4112 nntnhn.exe 3684 5jvvp.exe 4272 xxfxffx.exe 4532 xxxrfrl.exe 4896 nnnhtn.exe 3736 jjddj.exe 2156 1lrrlrr.exe 3960 xxfxxfx.exe 2676 nnbbbb.exe 2308 ppdvj.exe 2444 jdpdp.exe 4188 rlffflx.exe 4052 hbbtnt.exe 4076 thhbhh.exe 2936 llfxxrr.exe 4764 lrffxxx.exe 2948 7hnttt.exe 3464 pdppj.exe 556 fxxrlll.exe 3248 lxflllr.exe 1492 bthhnh.exe 2012 jvpdv.exe 1100 xxffrlr.exe 3932 xlrrlfr.exe 816 hbtntt.exe 2416 djjvp.exe 1816 xxfrflf.exe 4912 tbhnth.exe 4120 5hnhbh.exe 2700 9flfxxx.exe 1260 ffxxxxx.exe 2608 nnnhhh.exe 4576 7ttnbb.exe 3196 jjjdd.exe 2224 lllffll.exe 4724 xflfffl.exe 5088 9btbtb.exe 1432 vdvpj.exe 2096 1pvdj.exe 1660 frrrffr.exe 4012 btbbtt.exe 2760 nbnhtb.exe 3252 dpvvv.exe 4832 fxlrrlr.exe 4508 ntbntn.exe 4380 btnttt.exe 4816 djjpp.exe 5116 9flrrll.exe 2748 flxxrxr.exe -
Processes:
resource yara_rule behavioral2/memory/1604-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lflrxll.exe upx behavioral2/memory/1604-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/868-10-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bntbnn.exe upx C:\rffxrll.exe upx behavioral2/memory/1524-21-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrxfrlx.exe upx behavioral2/memory/2700-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pddjj.exe upx behavioral2/memory/1260-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4148-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxfxlrx.exe upx behavioral2/memory/4148-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3196-41-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhnbbt.exe upx C:\1jddd.exe upx behavioral2/memory/4376-48-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3lfrffr.exe upx behavioral2/memory/5004-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2008-55-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlxxxff.exe upx behavioral2/memory/2008-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3780-67-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9pvjj.exe upx C:\xflllrx.exe upx behavioral2/memory/3020-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbnbnh.exe upx \??\c:\vvvvv.exe upx behavioral2/memory/3812-85-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xlffflf.exe upx C:\nntnhn.exe upx behavioral2/memory/1780-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5jvvp.exe upx behavioral2/memory/4112-99-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xxfxffx.exe upx C:\xxxrfrl.exe upx behavioral2/memory/4532-112-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnnhtn.exe upx C:\jjddj.exe upx C:\1lrrlrr.exe upx behavioral2/memory/3736-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxfxxfx.exe upx behavioral2/memory/2676-139-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppdvj.exe upx \??\c:\nnbbbb.exe upx C:\jdpdp.exe upx C:\rlffflx.exe upx behavioral2/memory/4188-159-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hbbtnt.exe upx behavioral2/memory/4052-161-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\thhbhh.exe upx C:\llfxxrr.exe upx \??\c:\lrffxxx.exe upx C:\7hnttt.exe upx behavioral2/memory/4764-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2948-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/556-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2012-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1100-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/816-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2416-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1816-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4912-223-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b2d7e73dd357755604ad434784fa1cce11d24cf927cc785e8b9b69a6f449eceb.exelflrxll.exebntbnn.exerffxrll.exexrxfrlx.exepddjj.exelxfxlrx.exehhnbbt.exe1jddd.exe3lfrffr.exerlxxxff.exe9pvjj.exexflllrx.exetbnbnh.exevvvvv.exexlffflf.exenntnhn.exe5jvvp.exexxfxffx.exexxxrfrl.exennnhtn.exejjddj.exedescription pid process target process PID 1604 wrote to memory of 868 1604 b2d7e73dd357755604ad434784fa1cce11d24cf927cc785e8b9b69a6f449eceb.exe lflrxll.exe PID 1604 wrote to memory of 868 1604 b2d7e73dd357755604ad434784fa1cce11d24cf927cc785e8b9b69a6f449eceb.exe lflrxll.exe PID 1604 wrote to memory of 868 1604 b2d7e73dd357755604ad434784fa1cce11d24cf927cc785e8b9b69a6f449eceb.exe lflrxll.exe PID 868 wrote to memory of 2700 868 lflrxll.exe bntbnn.exe PID 868 wrote to memory of 2700 868 lflrxll.exe bntbnn.exe PID 868 wrote to memory of 2700 868 lflrxll.exe bntbnn.exe PID 2700 wrote to memory of 1524 2700 bntbnn.exe rffxrll.exe PID 2700 wrote to memory of 1524 2700 bntbnn.exe rffxrll.exe PID 2700 wrote to memory of 1524 2700 bntbnn.exe rffxrll.exe PID 1524 wrote to memory of 1260 1524 rffxrll.exe xrxfrlx.exe PID 1524 wrote to memory of 1260 1524 rffxrll.exe xrxfrlx.exe PID 1524 wrote to memory of 1260 1524 rffxrll.exe xrxfrlx.exe PID 1260 wrote to memory of 4148 1260 xrxfrlx.exe pddjj.exe PID 1260 wrote to memory of 4148 1260 xrxfrlx.exe pddjj.exe PID 1260 wrote to memory of 4148 1260 xrxfrlx.exe pddjj.exe PID 4148 wrote to memory of 3196 4148 pddjj.exe lxfxlrx.exe PID 4148 wrote to memory of 3196 4148 pddjj.exe lxfxlrx.exe PID 4148 wrote to memory of 3196 4148 pddjj.exe lxfxlrx.exe PID 3196 wrote to memory of 4376 3196 lxfxlrx.exe hhnbbt.exe PID 3196 wrote to memory of 4376 3196 lxfxlrx.exe hhnbbt.exe PID 3196 wrote to memory of 4376 3196 lxfxlrx.exe hhnbbt.exe PID 4376 wrote to memory of 5004 4376 hhnbbt.exe 1jddd.exe PID 4376 wrote to memory of 5004 4376 hhnbbt.exe 1jddd.exe PID 4376 wrote to memory of 5004 4376 hhnbbt.exe 1jddd.exe PID 5004 wrote to memory of 2008 5004 1jddd.exe 3lfrffr.exe PID 5004 wrote to memory of 2008 5004 1jddd.exe 3lfrffr.exe PID 5004 wrote to memory of 2008 5004 1jddd.exe 3lfrffr.exe PID 2008 wrote to memory of 3780 2008 3lfrffr.exe rlxxxff.exe PID 2008 wrote to memory of 3780 2008 3lfrffr.exe rlxxxff.exe PID 2008 wrote to memory of 3780 2008 3lfrffr.exe rlxxxff.exe PID 3780 wrote to memory of 3020 3780 rlxxxff.exe 9pvjj.exe PID 3780 wrote to memory of 3020 3780 rlxxxff.exe 9pvjj.exe PID 3780 wrote to memory of 3020 3780 rlxxxff.exe 9pvjj.exe PID 3020 wrote to memory of 4068 3020 9pvjj.exe xflllrx.exe PID 3020 wrote to memory of 4068 3020 9pvjj.exe xflllrx.exe PID 3020 wrote to memory of 4068 3020 9pvjj.exe xflllrx.exe PID 4068 wrote to memory of 5108 4068 xflllrx.exe tbnbnh.exe PID 4068 wrote to memory of 5108 4068 xflllrx.exe tbnbnh.exe PID 4068 wrote to memory of 5108 4068 xflllrx.exe tbnbnh.exe PID 5108 wrote to memory of 3812 5108 tbnbnh.exe vvvvv.exe PID 5108 wrote to memory of 3812 5108 tbnbnh.exe vvvvv.exe PID 5108 wrote to memory of 3812 5108 tbnbnh.exe vvvvv.exe PID 3812 wrote to memory of 1780 3812 vvvvv.exe xlffflf.exe PID 3812 wrote to memory of 1780 3812 vvvvv.exe xlffflf.exe PID 3812 wrote to memory of 1780 3812 vvvvv.exe xlffflf.exe PID 1780 wrote to memory of 4112 1780 xlffflf.exe nntnhn.exe PID 1780 wrote to memory of 4112 1780 xlffflf.exe nntnhn.exe PID 1780 wrote to memory of 4112 1780 xlffflf.exe nntnhn.exe PID 4112 wrote to memory of 3684 4112 nntnhn.exe 5jvvp.exe PID 4112 wrote to memory of 3684 4112 nntnhn.exe 5jvvp.exe PID 4112 wrote to memory of 3684 4112 nntnhn.exe 5jvvp.exe PID 3684 wrote to memory of 4272 3684 5jvvp.exe xxfxffx.exe PID 3684 wrote to memory of 4272 3684 5jvvp.exe xxfxffx.exe PID 3684 wrote to memory of 4272 3684 5jvvp.exe xxfxffx.exe PID 4272 wrote to memory of 4532 4272 xxfxffx.exe xxxrfrl.exe PID 4272 wrote to memory of 4532 4272 xxfxffx.exe xxxrfrl.exe PID 4272 wrote to memory of 4532 4272 xxfxffx.exe xxxrfrl.exe PID 4532 wrote to memory of 4896 4532 xxxrfrl.exe nnnhtn.exe PID 4532 wrote to memory of 4896 4532 xxxrfrl.exe nnnhtn.exe PID 4532 wrote to memory of 4896 4532 xxxrfrl.exe nnnhtn.exe PID 4896 wrote to memory of 3736 4896 nnnhtn.exe jjddj.exe PID 4896 wrote to memory of 3736 4896 nnnhtn.exe jjddj.exe PID 4896 wrote to memory of 3736 4896 nnnhtn.exe jjddj.exe PID 3736 wrote to memory of 2156 3736 jjddj.exe 1lrrlrr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2d7e73dd357755604ad434784fa1cce11d24cf927cc785e8b9b69a6f449eceb.exe"C:\Users\Admin\AppData\Local\Temp\b2d7e73dd357755604ad434784fa1cce11d24cf927cc785e8b9b69a6f449eceb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\lflrxll.exec:\lflrxll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\bntbnn.exec:\bntbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rffxrll.exec:\rffxrll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\xrxfrlx.exec:\xrxfrlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\pddjj.exec:\pddjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\lxfxlrx.exec:\lxfxlrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\hhnbbt.exec:\hhnbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\1jddd.exec:\1jddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\3lfrffr.exec:\3lfrffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\rlxxxff.exec:\rlxxxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\9pvjj.exec:\9pvjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\xflllrx.exec:\xflllrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\tbnbnh.exec:\tbnbnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\vvvvv.exec:\vvvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\xlffflf.exec:\xlffflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\nntnhn.exec:\nntnhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\5jvvp.exec:\5jvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\xxfxffx.exec:\xxfxffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\xxxrfrl.exec:\xxxrfrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\nnnhtn.exec:\nnnhtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\jjddj.exec:\jjddj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\1lrrlrr.exec:\1lrrlrr.exe23⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xxfxxfx.exec:\xxfxxfx.exe24⤵
- Executes dropped EXE
PID:3960 -
\??\c:\nnbbbb.exec:\nnbbbb.exe25⤵
- Executes dropped EXE
PID:2676 -
\??\c:\ppdvj.exec:\ppdvj.exe26⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jdpdp.exec:\jdpdp.exe27⤵
- Executes dropped EXE
PID:2444 -
\??\c:\rlffflx.exec:\rlffflx.exe28⤵
- Executes dropped EXE
PID:4188 -
\??\c:\hbbtnt.exec:\hbbtnt.exe29⤵
- Executes dropped EXE
PID:4052 -
\??\c:\thhbhh.exec:\thhbhh.exe30⤵
- Executes dropped EXE
PID:4076 -
\??\c:\llfxxrr.exec:\llfxxrr.exe31⤵
- Executes dropped EXE
PID:2936 -
\??\c:\lrffxxx.exec:\lrffxxx.exe32⤵
- Executes dropped EXE
PID:4764 -
\??\c:\7hnttt.exec:\7hnttt.exe33⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pdppj.exec:\pdppj.exe34⤵
- Executes dropped EXE
PID:3464 -
\??\c:\fxxrlll.exec:\fxxrlll.exe35⤵
- Executes dropped EXE
PID:556 -
\??\c:\lxflllr.exec:\lxflllr.exe36⤵
- Executes dropped EXE
PID:3248 -
\??\c:\bthhnh.exec:\bthhnh.exe37⤵
- Executes dropped EXE
PID:1492 -
\??\c:\jvpdv.exec:\jvpdv.exe38⤵
- Executes dropped EXE
PID:2012 -
\??\c:\xxffrlr.exec:\xxffrlr.exe39⤵
- Executes dropped EXE
PID:1100 -
\??\c:\xlrrlfr.exec:\xlrrlfr.exe40⤵
- Executes dropped EXE
PID:3932 -
\??\c:\hbtntt.exec:\hbtntt.exe41⤵
- Executes dropped EXE
PID:816 -
\??\c:\djjvp.exec:\djjvp.exe42⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xxfrflf.exec:\xxfrflf.exe43⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tbhnth.exec:\tbhnth.exe44⤵
- Executes dropped EXE
PID:4912 -
\??\c:\5hnhbh.exec:\5hnhbh.exe45⤵
- Executes dropped EXE
PID:4120 -
\??\c:\9flfxxx.exec:\9flfxxx.exe46⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ffxxxxx.exec:\ffxxxxx.exe47⤵
- Executes dropped EXE
PID:1260 -
\??\c:\nnnhhh.exec:\nnnhhh.exe48⤵
- Executes dropped EXE
PID:2608 -
\??\c:\7ttnbb.exec:\7ttnbb.exe49⤵
- Executes dropped EXE
PID:4576 -
\??\c:\jjjdd.exec:\jjjdd.exe50⤵
- Executes dropped EXE
PID:3196 -
\??\c:\lllffll.exec:\lllffll.exe51⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xflfffl.exec:\xflfffl.exe52⤵
- Executes dropped EXE
PID:4724 -
\??\c:\9btbtb.exec:\9btbtb.exe53⤵
- Executes dropped EXE
PID:5088 -
\??\c:\vdvpj.exec:\vdvpj.exe54⤵
- Executes dropped EXE
PID:1432 -
\??\c:\1pvdj.exec:\1pvdj.exe55⤵
- Executes dropped EXE
PID:2096 -
\??\c:\frrrffr.exec:\frrrffr.exe56⤵
- Executes dropped EXE
PID:1660 -
\??\c:\btbbtt.exec:\btbbtt.exe57⤵
- Executes dropped EXE
PID:4012 -
\??\c:\nbnhtb.exec:\nbnhtb.exe58⤵
- Executes dropped EXE
PID:2760 -
\??\c:\dpvvv.exec:\dpvvv.exe59⤵
- Executes dropped EXE
PID:3252 -
\??\c:\fxlrrlr.exec:\fxlrrlr.exe60⤵
- Executes dropped EXE
PID:4832 -
\??\c:\ntbntn.exec:\ntbntn.exe61⤵
- Executes dropped EXE
PID:4508 -
\??\c:\btnttt.exec:\btnttt.exe62⤵
- Executes dropped EXE
PID:4380 -
\??\c:\djjpp.exec:\djjpp.exe63⤵
- Executes dropped EXE
PID:4816 -
\??\c:\9flrrll.exec:\9flrrll.exe64⤵
- Executes dropped EXE
PID:5116 -
\??\c:\flxxrxr.exec:\flxxrxr.exe65⤵
- Executes dropped EXE
PID:2748 -
\??\c:\thnhnn.exec:\thnhnn.exe66⤵PID:3964
-
\??\c:\vpppd.exec:\vpppd.exe67⤵PID:3632
-
\??\c:\5jvpj.exec:\5jvpj.exe68⤵PID:1880
-
\??\c:\7hbtnn.exec:\7hbtnn.exe69⤵PID:3692
-
\??\c:\5ddvv.exec:\5ddvv.exe70⤵PID:2384
-
\??\c:\xrlflrx.exec:\xrlflrx.exe71⤵PID:4584
-
\??\c:\btnhnb.exec:\btnhnb.exe72⤵PID:612
-
\??\c:\vpjpd.exec:\vpjpd.exe73⤵PID:2676
-
\??\c:\ppppj.exec:\ppppj.exe74⤵PID:4644
-
\??\c:\xlxlfrf.exec:\xlxlfrf.exe75⤵PID:4844
-
\??\c:\bhhbbt.exec:\bhhbbt.exe76⤵PID:4480
-
\??\c:\jddvv.exec:\jddvv.exe77⤵PID:1872
-
\??\c:\pddvd.exec:\pddvd.exe78⤵PID:2472
-
\??\c:\hnhbhn.exec:\hnhbhn.exe79⤵PID:2488
-
\??\c:\bnttnh.exec:\bnttnh.exe80⤵PID:1584
-
\??\c:\ddpdd.exec:\ddpdd.exe81⤵PID:3936
-
\??\c:\jppjd.exec:\jppjd.exe82⤵PID:2808
-
\??\c:\rfxfrfr.exec:\rfxfrfr.exe83⤵PID:3596
-
\??\c:\bntnnn.exec:\bntnnn.exe84⤵PID:1080
-
\??\c:\bttbbn.exec:\bttbbn.exe85⤵PID:3048
-
\??\c:\pjdvv.exec:\pjdvv.exe86⤵PID:1416
-
\??\c:\llflllr.exec:\llflllr.exe87⤵PID:4596
-
\??\c:\rrlrlxl.exec:\rrlrlxl.exe88⤵PID:4560
-
\??\c:\rlxrllf.exec:\rlxrllf.exe89⤵PID:4920
-
\??\c:\bbhhht.exec:\bbhhht.exe90⤵PID:2616
-
\??\c:\vvvvp.exec:\vvvvp.exe91⤵PID:816
-
\??\c:\vpjdd.exec:\vpjdd.exe92⤵PID:1604
-
\??\c:\xxxffff.exec:\xxxffff.exe93⤵PID:3560
-
\??\c:\btnhbb.exec:\btnhbb.exe94⤵PID:2932
-
\??\c:\pjddd.exec:\pjddd.exe95⤵PID:1848
-
\??\c:\pddvp.exec:\pddvp.exe96⤵PID:396
-
\??\c:\lffffff.exec:\lffffff.exe97⤵PID:64
-
\??\c:\flrfxrr.exec:\flrfxrr.exe98⤵PID:4556
-
\??\c:\nbnnhh.exec:\nbnnhh.exe99⤵PID:1260
-
\??\c:\ddvdd.exec:\ddvdd.exe100⤵PID:2780
-
\??\c:\djvdj.exec:\djvdj.exe101⤵PID:3112
-
\??\c:\hntbnn.exec:\hntbnn.exe102⤵PID:2924
-
\??\c:\pjpvd.exec:\pjpvd.exe103⤵PID:5004
-
\??\c:\vpppv.exec:\vpppv.exe104⤵PID:4028
-
\??\c:\lrrlffx.exec:\lrrlffx.exe105⤵PID:4812
-
\??\c:\xfxxrfl.exec:\xfxxrfl.exe106⤵PID:2008
-
\??\c:\ntbbtt.exec:\ntbbtt.exe107⤵PID:2612
-
\??\c:\lxxrllf.exec:\lxxrllf.exe108⤵PID:3280
-
\??\c:\htbtnn.exec:\htbtnn.exe109⤵PID:4840
-
\??\c:\vpvjv.exec:\vpvjv.exe110⤵PID:3500
-
\??\c:\vjdvj.exec:\vjdvj.exe111⤵PID:920
-
\??\c:\xrflflf.exec:\xrflflf.exe112⤵PID:5108
-
\??\c:\htnbbb.exec:\htnbbb.exe113⤵PID:2572
-
\??\c:\nnhhbb.exec:\nnhhbb.exe114⤵PID:1084
-
\??\c:\vdjdd.exec:\vdjdd.exe115⤵PID:412
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe116⤵PID:4688
-
\??\c:\ttttbb.exec:\ttttbb.exe117⤵PID:3684
-
\??\c:\5tnhtt.exec:\5tnhtt.exe118⤵PID:4432
-
\??\c:\3jdjj.exec:\3jdjj.exe119⤵PID:4896
-
\??\c:\ppddj.exec:\ppddj.exe120⤵PID:1384
-
\??\c:\frxrllf.exec:\frxrllf.exe121⤵PID:1464
-
\??\c:\hhnhbh.exec:\hhnhbh.exe122⤵PID:4340
-
\??\c:\hbbttt.exec:\hbbttt.exe123⤵PID:3188
-
\??\c:\pdpjd.exec:\pdpjd.exe124⤵PID:1684
-
\??\c:\jddpp.exec:\jddpp.exe125⤵PID:4592
-
\??\c:\rrffxff.exec:\rrffxff.exe126⤵PID:3136
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe127⤵PID:1852
-
\??\c:\1hnbth.exec:\1hnbth.exe128⤵PID:2536
-
\??\c:\btbbbh.exec:\btbbbh.exe129⤵PID:908
-
\??\c:\tbnhbb.exec:\tbnhbb.exe130⤵PID:2808
-
\??\c:\dvvdv.exec:\dvvdv.exe131⤵PID:4760
-
\??\c:\rlfxxll.exec:\rlfxxll.exe132⤵PID:2340
-
\??\c:\fffxxxf.exec:\fffxxxf.exe133⤵PID:5072
-
\??\c:\fxxrllf.exec:\fxxrllf.exe134⤵PID:2012
-
\??\c:\ddvvv.exec:\ddvvv.exe135⤵PID:708
-
\??\c:\rfrlfrx.exec:\rfrlfrx.exe136⤵PID:2452
-
\??\c:\tbthhn.exec:\tbthhn.exe137⤵PID:1504
-
\??\c:\ppdpj.exec:\ppdpj.exe138⤵PID:1900
-
\??\c:\frxlllf.exec:\frxlllf.exe139⤵PID:2976
-
\??\c:\vvddv.exec:\vvddv.exe140⤵PID:1816
-
\??\c:\jjjdv.exec:\jjjdv.exe141⤵PID:4912
-
\??\c:\xrrlfxl.exec:\xrrlfxl.exe142⤵PID:668
-
\??\c:\bbhthh.exec:\bbhthh.exe143⤵PID:392
-
\??\c:\djpjv.exec:\djpjv.exe144⤵PID:4492
-
\??\c:\bnhnhn.exec:\bnhnhn.exe145⤵PID:2836
-
\??\c:\1rxrffx.exec:\1rxrffx.exe146⤵PID:4796
-
\??\c:\nhtnbt.exec:\nhtnbt.exe147⤵PID:2908
-
\??\c:\hhhhtt.exec:\hhhhtt.exe148⤵PID:5028
-
\??\c:\jvjdv.exec:\jvjdv.exe149⤵PID:4388
-
\??\c:\dvvpd.exec:\dvvpd.exe150⤵PID:2224
-
\??\c:\xlxrfll.exec:\xlxrfll.exe151⤵PID:1128
-
\??\c:\bbttnb.exec:\bbttnb.exe152⤵PID:5088
-
\??\c:\1vvdd.exec:\1vvdd.exe153⤵PID:1432
-
\??\c:\jpvdv.exec:\jpvdv.exe154⤵PID:2096
-
\??\c:\xxlflfx.exec:\xxlflfx.exe155⤵PID:2468
-
\??\c:\tnhttt.exec:\tnhttt.exe156⤵PID:4056
-
\??\c:\bbtnnh.exec:\bbtnnh.exe157⤵PID:1868
-
\??\c:\9jjvd.exec:\9jjvd.exe158⤵PID:4700
-
\??\c:\pvdpd.exec:\pvdpd.exe159⤵PID:2364
-
\??\c:\xrxxffr.exec:\xrxxffr.exe160⤵PID:3788
-
\??\c:\hhtnnn.exec:\hhtnnn.exe161⤵PID:4112
-
\??\c:\jpddp.exec:\jpddp.exe162⤵PID:2068
-
\??\c:\vpddv.exec:\vpddv.exe163⤵PID:3784
-
\??\c:\xfrrffx.exec:\xfrrffx.exe164⤵PID:2328
-
\??\c:\hnhhhn.exec:\hnhhhn.exe165⤵PID:412
-
\??\c:\9tttnn.exec:\9tttnn.exe166⤵PID:4688
-
\??\c:\djddv.exec:\djddv.exe167⤵PID:3964
-
\??\c:\lrxxrrr.exec:\lrxxrrr.exe168⤵PID:4640
-
\??\c:\5ntntt.exec:\5ntntt.exe169⤵PID:4896
-
\??\c:\bhbbbh.exec:\bhbbbh.exe170⤵PID:3264
-
\??\c:\jjpvv.exec:\jjpvv.exe171⤵PID:100
-
\??\c:\fxxrffx.exec:\fxxrffx.exe172⤵PID:4340
-
\??\c:\tttnhh.exec:\tttnhh.exe173⤵PID:3188
-
\??\c:\nhbbbb.exec:\nhbbbb.exe174⤵PID:1076
-
\??\c:\1vppj.exec:\1vppj.exe175⤵PID:1096
-
\??\c:\lrllfll.exec:\lrllfll.exe176⤵PID:3696
-
\??\c:\lfffxrf.exec:\lfffxrf.exe177⤵PID:2292
-
\??\c:\1bbbtt.exec:\1bbbtt.exe178⤵PID:4360
-
\??\c:\vppjp.exec:\vppjp.exe179⤵PID:1592
-
\??\c:\5dpjv.exec:\5dpjv.exe180⤵PID:3596
-
\??\c:\fxlxflf.exec:\fxlxflf.exe181⤵PID:1080
-
\??\c:\nnnnhh.exec:\nnnnhh.exe182⤵PID:4720
-
\??\c:\vddpp.exec:\vddpp.exe183⤵PID:2744
-
\??\c:\vjddv.exec:\vjddv.exe184⤵PID:3932
-
\??\c:\xrffffl.exec:\xrffffl.exe185⤵PID:1100
-
\??\c:\1hbhhh.exec:\1hbhhh.exe186⤵PID:1056
-
\??\c:\1hhbtt.exec:\1hhbtt.exe187⤵PID:968
-
\??\c:\dppvp.exec:\dppvp.exe188⤵PID:4268
-
\??\c:\jjjvd.exec:\jjjvd.exe189⤵PID:3304
-
\??\c:\7fffrrl.exec:\7fffrrl.exe190⤵PID:1248
-
\??\c:\hbbnnn.exec:\hbbnnn.exe191⤵PID:3808
-
\??\c:\tbbbbn.exec:\tbbbbn.exe192⤵PID:3568
-
\??\c:\dvppp.exec:\dvppp.exe193⤵PID:2864
-
\??\c:\xrxllrx.exec:\xrxllrx.exe194⤵PID:528
-
\??\c:\bthhhh.exec:\bthhhh.exe195⤵PID:4828
-
\??\c:\hbhbbh.exec:\hbhbbh.exe196⤵PID:4576
-
\??\c:\ddpjj.exec:\ddpjj.exe197⤵PID:1912
-
\??\c:\ffrlfrr.exec:\ffrlfrr.exe198⤵PID:3196
-
\??\c:\rlfllxl.exec:\rlfllxl.exe199⤵PID:2972
-
\??\c:\tttnhb.exec:\tttnhb.exe200⤵PID:1336
-
\??\c:\pdvvp.exec:\pdvvp.exe201⤵PID:4028
-
\??\c:\ppvpp.exec:\ppvpp.exe202⤵PID:640
-
\??\c:\xrxxfll.exec:\xrxxfll.exe203⤵PID:3780
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe204⤵PID:2612
-
\??\c:\bttnbb.exec:\bttnbb.exe205⤵PID:5060
-
\??\c:\ddjpj.exec:\ddjpj.exe206⤵PID:3500
-
\??\c:\3rrrllx.exec:\3rrrllx.exe207⤵PID:4980
-
\??\c:\fxrlfrl.exec:\fxrlfrl.exe208⤵PID:5108
-
\??\c:\nhhhbb.exec:\nhhhbb.exe209⤵PID:3124
-
\??\c:\hhbthb.exec:\hhbthb.exe210⤵PID:2956
-
\??\c:\pjvpj.exec:\pjvpj.exe211⤵PID:4196
-
\??\c:\llxxffl.exec:\llxxffl.exe212⤵PID:4768
-
\??\c:\1bttnt.exec:\1bttnt.exe213⤵PID:232
-
\??\c:\htbbnn.exec:\htbbnn.exe214⤵PID:3344
-
\??\c:\vvvpp.exec:\vvvpp.exe215⤵PID:3700
-
\??\c:\xrxfxxf.exec:\xrxfxxf.exe216⤵PID:2024
-
\??\c:\llllxfr.exec:\llllxfr.exe217⤵PID:3692
-
\??\c:\ntnnnt.exec:\ntnnnt.exe218⤵PID:1368
-
\??\c:\jvjvj.exec:\jvjvj.exe219⤵PID:4932
-
\??\c:\frfxlfl.exec:\frfxlfl.exe220⤵PID:1000
-
\??\c:\rrllffr.exec:\rrllffr.exe221⤵PID:2240
-
\??\c:\tbbbtn.exec:\tbbbtn.exe222⤵PID:2152
-
\??\c:\htnhbb.exec:\htnhbb.exe223⤵PID:1872
-
\??\c:\ddpjp.exec:\ddpjp.exe224⤵PID:4764
-
\??\c:\frxrlll.exec:\frxrlll.exe225⤵PID:1584
-
\??\c:\llfrfxl.exec:\llfrfxl.exe226⤵PID:2936
-
\??\c:\dpvvv.exec:\dpvvv.exe227⤵PID:2100
-
\??\c:\frrrlfx.exec:\frrrlfx.exe228⤵PID:2808
-
\??\c:\xxllfxr.exec:\xxllfxr.exe229⤵PID:4760
-
\??\c:\jdvvp.exec:\jdvvp.exe230⤵PID:820
-
\??\c:\ppppd.exec:\ppppd.exe231⤵PID:2172
-
\??\c:\xllrrrr.exec:\xllrrrr.exe232⤵PID:4596
-
\??\c:\bhhnnn.exec:\bhhnnn.exe233⤵PID:1216
-
\??\c:\bnttnb.exec:\bnttnb.exe234⤵PID:1908
-
\??\c:\jjjjd.exec:\jjjjd.exe235⤵PID:3544
-
\??\c:\xlrrffl.exec:\xlrrffl.exe236⤵PID:2728
-
\??\c:\xlllffx.exec:\xlllffx.exe237⤵PID:1900
-
\??\c:\3hnnhn.exec:\3hnnhn.exe238⤵PID:2976
-
\??\c:\pvvvv.exec:\pvvvv.exe239⤵PID:1816
-
\??\c:\5pvpj.exec:\5pvpj.exe240⤵PID:2252
-
\??\c:\lffxrrx.exec:\lffxrrx.exe241⤵PID:668
-
\??\c:\3hhbtt.exec:\3hhbtt.exe242⤵PID:392