Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 03:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d9448dc0e6303c0638d6d8e2b60f29003a2a420111ee49916bc2e302a91984f0.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
d9448dc0e6303c0638d6d8e2b60f29003a2a420111ee49916bc2e302a91984f0.exe
-
Size
214KB
-
MD5
6ab41c9b4b6f57757d95356a581343ca
-
SHA1
79127bdf8658cac329aeff048a9ce6b0c3224201
-
SHA256
d9448dc0e6303c0638d6d8e2b60f29003a2a420111ee49916bc2e302a91984f0
-
SHA512
fda8c42822a1d23d525cf09972a328cc8519a0d6ea4ff16eb537be3cb3e0dd9ebdd72d5be2a55289ded6bd24e821aebd18414cf5aeaaa24d245b259bf2ca2c93
-
SSDEEP
3072:ZhOm2sI93UufdC67ciEu0P5axvqdUmdznCvs7BuRoYFBg/gXVqPfSoi0yG24ePj:Zcm7ImGddXEu0ucju6/4kf724e
Malware Config
Signatures
-
Detect Blackmoon payload 46 IoCs
Processes:
resource yara_rule behavioral1/memory/2900-7-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/3016-17-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2920-28-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2604-30-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2604-38-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2500-48-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2592-56-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2396-59-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2568-79-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2404-77-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/280-94-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1644-105-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1364-114-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2280-133-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2312-154-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1636-163-0x00000000002B0000-0x00000000002DD000-memory.dmp family_blackmoon behavioral1/memory/1636-162-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2232-190-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/848-201-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1144-211-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1688-233-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/972-254-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2304-259-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/948-281-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2088-292-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2088-298-0x0000000000230000-0x000000000025D000-memory.dmp family_blackmoon behavioral1/memory/2088-299-0x0000000000230000-0x000000000025D000-memory.dmp family_blackmoon behavioral1/memory/2064-310-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1092-313-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/2900-318-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2536-360-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2604-359-0x0000000000260000-0x000000000028D000-memory.dmp family_blackmoon behavioral1/memory/2788-394-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/556-409-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1440-461-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2332-481-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/2972-489-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/1792-496-0x00000000001B0000-0x00000000001DD000-memory.dmp family_blackmoon behavioral1/memory/1752-530-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1544-545-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/1544-550-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2812-628-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/2836-692-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/1468-703-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/3020-745-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1960-758-0x00000000002A0000-0x00000000002CD000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 52 IoCs
Processes:
resource yara_rule behavioral1/memory/2900-7-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/3016-17-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2920-28-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2604-30-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2500-39-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2604-38-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2500-48-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2592-56-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2396-59-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2568-79-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2404-77-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/280-94-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1644-105-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1364-114-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2280-133-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2312-154-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1636-162-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1688-174-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2232-190-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/848-192-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1636-202-0x00000000002B0000-0x00000000002DD000-memory.dmp UPX behavioral1/memory/848-201-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1144-211-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/972-254-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/948-281-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2088-292-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2064-302-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2064-310-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2900-318-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/3016-332-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2536-360-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1696-374-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2392-381-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2788-394-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/556-402-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/556-409-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1864-410-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2392-417-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1440-461-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1752-530-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1544-545-0x0000000000220000-0x000000000024D000-memory.dmp UPX behavioral1/memory/1544-550-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/320-565-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1628-590-0x0000000000220000-0x000000000024D000-memory.dmp UPX behavioral1/memory/2712-666-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2396-680-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2404-695-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2836-692-0x0000000000220000-0x000000000024D000-memory.dmp UPX behavioral1/memory/1468-703-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/3020-745-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1952-759-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1960-758-0x00000000002A0000-0x00000000002CD000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
rrphxpn.exepjbpphl.exehhdfbjp.exedphljr.exedxprnn.exevpthxhj.exernvxf.exeblfrxpd.exebhpxdld.exevxjxt.exeftftt.exerjjrnv.exeplvdrh.exebtvvdth.exenjfxhlh.exeprxtflv.exejjdlv.exebnrhtrx.exenhffrnv.exerllbn.exerrjbbp.exetbvdh.exeldjjt.exenvxhhtv.exevxxnb.exebtnndrf.exervjrvp.exexntxvh.exervnxxd.exetbhddx.exebtbnprf.exehpplnhx.exeprntp.exerrjrd.exeldhhl.exerjvtx.exepxhbdpv.exeblvjv.exebrdpjf.exetbbhvp.exejlvjbt.exettfvrx.exebfdjpxl.exepjvfft.exetvffflv.exevvdjr.exenlpplv.exeftxvvx.exelxxrh.exepddhplr.exexnldtb.exepfbjbn.exefphppr.exebdfllx.exexhplx.exedxtpv.exebnrvr.exejxnbpp.exedtdlrh.exevtffxj.exerdbdx.exelfpphr.exelxvxrjd.exehpbjnhn.exepid process 3016 rrphxpn.exe 2920 pjbpphl.exe 2604 hhdfbjp.exe 2500 dphljr.exe 2592 dxprnn.exe 2396 vpthxhj.exe 2404 rnvxf.exe 2568 blfrxpd.exe 280 bhpxdld.exe 1644 vxjxt.exe 1364 ftftt.exe 2664 rjjrnv.exe 2280 plvdrh.exe 2308 btvvdth.exe 2312 njfxhlh.exe 1636 prxtflv.exe 1684 jjdlv.exe 1688 bnrhtrx.exe 2232 nhffrnv.exe 848 rllbn.exe 1144 rrjbbp.exe 3000 tbvdh.exe 1060 ldjjt.exe 432 nvxhhtv.exe 1844 vxxnb.exe 972 btnndrf.exe 2304 rvjrvp.exe 1092 xntxvh.exe 948 rvnxxd.exe 1212 tbhddx.exe 2088 btbnprf.exe 2064 hpplnhx.exe 2176 prntp.exe 2900 rrjrd.exe 2844 ldhhl.exe 3016 rjvtx.exe 2644 pxhbdpv.exe 2612 blvjv.exe 2604 brdpjf.exe 2536 tbbhvp.exe 2544 jlvjbt.exe 1696 ttfvrx.exe 2392 bfdjpxl.exe 2788 pjvfft.exe 2952 tvffflv.exe 556 vvdjr.exe 1864 nlpplv.exe 1976 ftxvvx.exe 1500 lxxrh.exe 3020 pddhplr.exe 2804 xnldtb.exe 3044 pfbjbn.exe 1972 fphppr.exe 1440 bdfllx.exe 1656 xhplx.exe 1576 dxtpv.exe 2332 bnrvr.exe 2972 jxnbpp.exe 1792 dtdlrh.exe 2056 vtffxj.exe 768 rdbdx.exe 2116 lfpphr.exe 524 lxvxrjd.exe 1752 hpbjnhn.exe -
Processes:
resource yara_rule behavioral1/memory/2900-7-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2920-18-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/3016-17-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2920-28-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2604-30-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2500-39-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2604-38-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2500-48-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2592-56-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2396-59-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2568-79-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2404-77-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/280-94-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1644-105-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1364-114-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2308-134-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2280-133-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2312-154-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1636-162-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1688-174-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2232-190-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/848-192-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1636-202-0x00000000002B0000-0x00000000002DD000-memory.dmp upx behavioral1/memory/848-201-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1144-211-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/972-254-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/948-281-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2088-292-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2064-302-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2064-310-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2900-318-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/3016-332-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2536-360-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1696-374-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2392-381-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2788-394-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/556-402-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/556-409-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1864-410-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2392-417-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1440-461-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1752-530-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1544-545-0x0000000000220000-0x000000000024D000-memory.dmp upx behavioral1/memory/1544-550-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/320-565-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1628-590-0x0000000000220000-0x000000000024D000-memory.dmp upx behavioral1/memory/2712-666-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2396-680-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2404-695-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2836-692-0x0000000000220000-0x000000000024D000-memory.dmp upx behavioral1/memory/1468-703-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/3020-745-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1952-759-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1960-758-0x00000000002A0000-0x00000000002CD000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d9448dc0e6303c0638d6d8e2b60f29003a2a420111ee49916bc2e302a91984f0.exerrphxpn.exepjbpphl.exehhdfbjp.exedphljr.exedxprnn.exevpthxhj.exernvxf.exeblfrxpd.exebhpxdld.exevxjxt.exeftftt.exerjjrnv.exeplvdrh.exebtvvdth.exenjfxhlh.exedescription pid process target process PID 2900 wrote to memory of 3016 2900 d9448dc0e6303c0638d6d8e2b60f29003a2a420111ee49916bc2e302a91984f0.exe rrphxpn.exe PID 2900 wrote to memory of 3016 2900 d9448dc0e6303c0638d6d8e2b60f29003a2a420111ee49916bc2e302a91984f0.exe rrphxpn.exe PID 2900 wrote to memory of 3016 2900 d9448dc0e6303c0638d6d8e2b60f29003a2a420111ee49916bc2e302a91984f0.exe rrphxpn.exe PID 2900 wrote to memory of 3016 2900 d9448dc0e6303c0638d6d8e2b60f29003a2a420111ee49916bc2e302a91984f0.exe rrphxpn.exe PID 3016 wrote to memory of 2920 3016 rrphxpn.exe pjbpphl.exe PID 3016 wrote to memory of 2920 3016 rrphxpn.exe pjbpphl.exe PID 3016 wrote to memory of 2920 3016 rrphxpn.exe pjbpphl.exe PID 3016 wrote to memory of 2920 3016 rrphxpn.exe pjbpphl.exe PID 2920 wrote to memory of 2604 2920 pjbpphl.exe hhdfbjp.exe PID 2920 wrote to memory of 2604 2920 pjbpphl.exe hhdfbjp.exe PID 2920 wrote to memory of 2604 2920 pjbpphl.exe hhdfbjp.exe PID 2920 wrote to memory of 2604 2920 pjbpphl.exe hhdfbjp.exe PID 2604 wrote to memory of 2500 2604 hhdfbjp.exe dphljr.exe PID 2604 wrote to memory of 2500 2604 hhdfbjp.exe dphljr.exe PID 2604 wrote to memory of 2500 2604 hhdfbjp.exe dphljr.exe PID 2604 wrote to memory of 2500 2604 hhdfbjp.exe dphljr.exe PID 2500 wrote to memory of 2592 2500 dphljr.exe dxprnn.exe PID 2500 wrote to memory of 2592 2500 dphljr.exe dxprnn.exe PID 2500 wrote to memory of 2592 2500 dphljr.exe dxprnn.exe PID 2500 wrote to memory of 2592 2500 dphljr.exe dxprnn.exe PID 2592 wrote to memory of 2396 2592 dxprnn.exe vpthxhj.exe PID 2592 wrote to memory of 2396 2592 dxprnn.exe vpthxhj.exe PID 2592 wrote to memory of 2396 2592 dxprnn.exe vpthxhj.exe PID 2592 wrote to memory of 2396 2592 dxprnn.exe vpthxhj.exe PID 2396 wrote to memory of 2404 2396 vpthxhj.exe rnvxf.exe PID 2396 wrote to memory of 2404 2396 vpthxhj.exe rnvxf.exe PID 2396 wrote to memory of 2404 2396 vpthxhj.exe rnvxf.exe PID 2396 wrote to memory of 2404 2396 vpthxhj.exe rnvxf.exe PID 2404 wrote to memory of 2568 2404 rnvxf.exe blfrxpd.exe PID 2404 wrote to memory of 2568 2404 rnvxf.exe blfrxpd.exe PID 2404 wrote to memory of 2568 2404 rnvxf.exe blfrxpd.exe PID 2404 wrote to memory of 2568 2404 rnvxf.exe blfrxpd.exe PID 2568 wrote to memory of 280 2568 blfrxpd.exe bhpxdld.exe PID 2568 wrote to memory of 280 2568 blfrxpd.exe bhpxdld.exe PID 2568 wrote to memory of 280 2568 blfrxpd.exe bhpxdld.exe PID 2568 wrote to memory of 280 2568 blfrxpd.exe bhpxdld.exe PID 280 wrote to memory of 1644 280 bhpxdld.exe vxjxt.exe PID 280 wrote to memory of 1644 280 bhpxdld.exe vxjxt.exe PID 280 wrote to memory of 1644 280 bhpxdld.exe vxjxt.exe PID 280 wrote to memory of 1644 280 bhpxdld.exe vxjxt.exe PID 1644 wrote to memory of 1364 1644 vxjxt.exe ftftt.exe PID 1644 wrote to memory of 1364 1644 vxjxt.exe ftftt.exe PID 1644 wrote to memory of 1364 1644 vxjxt.exe ftftt.exe PID 1644 wrote to memory of 1364 1644 vxjxt.exe ftftt.exe PID 1364 wrote to memory of 2664 1364 ftftt.exe rjjrnv.exe PID 1364 wrote to memory of 2664 1364 ftftt.exe rjjrnv.exe PID 1364 wrote to memory of 2664 1364 ftftt.exe rjjrnv.exe PID 1364 wrote to memory of 2664 1364 ftftt.exe rjjrnv.exe PID 2664 wrote to memory of 2280 2664 rjjrnv.exe plvdrh.exe PID 2664 wrote to memory of 2280 2664 rjjrnv.exe plvdrh.exe PID 2664 wrote to memory of 2280 2664 rjjrnv.exe plvdrh.exe PID 2664 wrote to memory of 2280 2664 rjjrnv.exe plvdrh.exe PID 2280 wrote to memory of 2308 2280 plvdrh.exe btvvdth.exe PID 2280 wrote to memory of 2308 2280 plvdrh.exe btvvdth.exe PID 2280 wrote to memory of 2308 2280 plvdrh.exe btvvdth.exe PID 2280 wrote to memory of 2308 2280 plvdrh.exe btvvdth.exe PID 2308 wrote to memory of 2312 2308 btvvdth.exe njfxhlh.exe PID 2308 wrote to memory of 2312 2308 btvvdth.exe njfxhlh.exe PID 2308 wrote to memory of 2312 2308 btvvdth.exe njfxhlh.exe PID 2308 wrote to memory of 2312 2308 btvvdth.exe njfxhlh.exe PID 2312 wrote to memory of 1636 2312 njfxhlh.exe prxtflv.exe PID 2312 wrote to memory of 1636 2312 njfxhlh.exe prxtflv.exe PID 2312 wrote to memory of 1636 2312 njfxhlh.exe prxtflv.exe PID 2312 wrote to memory of 1636 2312 njfxhlh.exe prxtflv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9448dc0e6303c0638d6d8e2b60f29003a2a420111ee49916bc2e302a91984f0.exe"C:\Users\Admin\AppData\Local\Temp\d9448dc0e6303c0638d6d8e2b60f29003a2a420111ee49916bc2e302a91984f0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\rrphxpn.exec:\rrphxpn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\pjbpphl.exec:\pjbpphl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\hhdfbjp.exec:\hhdfbjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\dphljr.exec:\dphljr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\dxprnn.exec:\dxprnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\vpthxhj.exec:\vpthxhj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\rnvxf.exec:\rnvxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\blfrxpd.exec:\blfrxpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\bhpxdld.exec:\bhpxdld.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:280 -
\??\c:\vxjxt.exec:\vxjxt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\ftftt.exec:\ftftt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\rjjrnv.exec:\rjjrnv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\plvdrh.exec:\plvdrh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\btvvdth.exec:\btvvdth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\njfxhlh.exec:\njfxhlh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\prxtflv.exec:\prxtflv.exe17⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jjdlv.exec:\jjdlv.exe18⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bnrhtrx.exec:\bnrhtrx.exe19⤵
- Executes dropped EXE
PID:1688 -
\??\c:\nhffrnv.exec:\nhffrnv.exe20⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rllbn.exec:\rllbn.exe21⤵
- Executes dropped EXE
PID:848 -
\??\c:\rrjbbp.exec:\rrjbbp.exe22⤵
- Executes dropped EXE
PID:1144 -
\??\c:\tbvdh.exec:\tbvdh.exe23⤵
- Executes dropped EXE
PID:3000 -
\??\c:\ldjjt.exec:\ldjjt.exe24⤵
- Executes dropped EXE
PID:1060 -
\??\c:\nvxhhtv.exec:\nvxhhtv.exe25⤵
- Executes dropped EXE
PID:432 -
\??\c:\vxxnb.exec:\vxxnb.exe26⤵
- Executes dropped EXE
PID:1844 -
\??\c:\btnndrf.exec:\btnndrf.exe27⤵
- Executes dropped EXE
PID:972 -
\??\c:\rvjrvp.exec:\rvjrvp.exe28⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xntxvh.exec:\xntxvh.exe29⤵
- Executes dropped EXE
PID:1092 -
\??\c:\rvnxxd.exec:\rvnxxd.exe30⤵
- Executes dropped EXE
PID:948 -
\??\c:\tbhddx.exec:\tbhddx.exe31⤵
- Executes dropped EXE
PID:1212 -
\??\c:\btbnprf.exec:\btbnprf.exe32⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hpplnhx.exec:\hpplnhx.exe33⤵
- Executes dropped EXE
PID:2064 -
\??\c:\prntp.exec:\prntp.exe34⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rrjrd.exec:\rrjrd.exe35⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ldhhl.exec:\ldhhl.exe36⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rjvtx.exec:\rjvtx.exe37⤵
- Executes dropped EXE
PID:3016 -
\??\c:\pxhbdpv.exec:\pxhbdpv.exe38⤵
- Executes dropped EXE
PID:2644 -
\??\c:\blvjv.exec:\blvjv.exe39⤵
- Executes dropped EXE
PID:2612 -
\??\c:\brdpjf.exec:\brdpjf.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\tbbhvp.exec:\tbbhvp.exe41⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jlvjbt.exec:\jlvjbt.exe42⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ttfvrx.exec:\ttfvrx.exe43⤵
- Executes dropped EXE
PID:1696 -
\??\c:\bfdjpxl.exec:\bfdjpxl.exe44⤵
- Executes dropped EXE
PID:2392 -
\??\c:\pjvfft.exec:\pjvfft.exe45⤵
- Executes dropped EXE
PID:2788 -
\??\c:\tvffflv.exec:\tvffflv.exe46⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vvdjr.exec:\vvdjr.exe47⤵
- Executes dropped EXE
PID:556 -
\??\c:\nlpplv.exec:\nlpplv.exe48⤵
- Executes dropped EXE
PID:1864 -
\??\c:\ftxvvx.exec:\ftxvvx.exe49⤵
- Executes dropped EXE
PID:1976 -
\??\c:\lxxrh.exec:\lxxrh.exe50⤵
- Executes dropped EXE
PID:1500 -
\??\c:\pddhplr.exec:\pddhplr.exe51⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xnldtb.exec:\xnldtb.exe52⤵
- Executes dropped EXE
PID:2804 -
\??\c:\pfbjbn.exec:\pfbjbn.exe53⤵
- Executes dropped EXE
PID:3044 -
\??\c:\fphppr.exec:\fphppr.exe54⤵
- Executes dropped EXE
PID:1972 -
\??\c:\bdfllx.exec:\bdfllx.exe55⤵
- Executes dropped EXE
PID:1440 -
\??\c:\xhplx.exec:\xhplx.exe56⤵
- Executes dropped EXE
PID:1656 -
\??\c:\dxtpv.exec:\dxtpv.exe57⤵
- Executes dropped EXE
PID:1576 -
\??\c:\bnrvr.exec:\bnrvr.exe58⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jxnbpp.exec:\jxnbpp.exe59⤵
- Executes dropped EXE
PID:2972 -
\??\c:\dtdlrh.exec:\dtdlrh.exe60⤵
- Executes dropped EXE
PID:1792 -
\??\c:\vtffxj.exec:\vtffxj.exe61⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rdbdx.exec:\rdbdx.exe62⤵
- Executes dropped EXE
PID:768 -
\??\c:\lfpphr.exec:\lfpphr.exe63⤵
- Executes dropped EXE
PID:2116 -
\??\c:\lxvxrjd.exec:\lxvxrjd.exe64⤵
- Executes dropped EXE
PID:524 -
\??\c:\hpbjnhn.exec:\hpbjnhn.exe65⤵
- Executes dropped EXE
PID:1752 -
\??\c:\pxbttp.exec:\pxbttp.exe66⤵PID:276
-
\??\c:\fbpjppd.exec:\fbpjppd.exe67⤵PID:2092
-
\??\c:\nfhxxhf.exec:\nfhxxhf.exe68⤵PID:1544
-
\??\c:\fprhxfv.exec:\fprhxfv.exe69⤵PID:1628
-
\??\c:\tbdvnh.exec:\tbdvnh.exe70⤵PID:2104
-
\??\c:\htddl.exec:\htddl.exe71⤵PID:320
-
\??\c:\dhrbn.exec:\dhrbn.exe72⤵PID:1096
-
\??\c:\nlthttn.exec:\nlthttn.exe73⤵PID:2024
-
\??\c:\vhvhh.exec:\vhvhh.exe74⤵PID:2220
-
\??\c:\bfpvp.exec:\bfpvp.exe75⤵PID:1732
-
\??\c:\thdnb.exec:\thdnb.exe76⤵PID:1812
-
\??\c:\jdlhfdn.exec:\jdlhfdn.exe77⤵PID:876
-
\??\c:\rnbbh.exec:\rnbbh.exe78⤵PID:1504
-
\??\c:\nbthnbv.exec:\nbthnbv.exe79⤵PID:2176
-
\??\c:\rxhrlrd.exec:\rxhrlrd.exe80⤵PID:2812
-
\??\c:\vxjpxtx.exec:\vxjpxtx.exe81⤵PID:3012
-
\??\c:\jrnhdx.exec:\jrnhdx.exe82⤵PID:3016
-
\??\c:\xdnrj.exec:\xdnrj.exe83⤵PID:2644
-
\??\c:\rhjddv.exec:\rhjddv.exe84⤵PID:2612
-
\??\c:\pxbvhhn.exec:\pxbvhhn.exe85⤵PID:2560
-
\??\c:\phhhh.exec:\phhhh.exe86⤵PID:2540
-
\??\c:\rhjhxx.exec:\rhjhxx.exe87⤵PID:2712
-
\??\c:\tfvxpbd.exec:\tfvxpbd.exe88⤵PID:1700
-
\??\c:\xhxrx.exec:\xhxrx.exe89⤵PID:2396
-
\??\c:\jblfdf.exec:\jblfdf.exe90⤵PID:2836
-
\??\c:\njbtbh.exec:\njbtbh.exe91⤵PID:2404
-
\??\c:\rdpfh.exec:\rdpfh.exe92⤵PID:1468
-
\??\c:\xbrbhpx.exec:\xbrbhpx.exe93⤵PID:556
-
\??\c:\hjlxlvj.exec:\hjlxlvj.exe94⤵PID:1796
-
\??\c:\lnbpt.exec:\lnbpt.exe95⤵PID:2608
-
\??\c:\xjxnx.exec:\xjxnx.exe96⤵PID:2676
-
\??\c:\hlhvdp.exec:\hlhvdp.exe97⤵PID:1940
-
\??\c:\vlbdn.exec:\vlbdn.exe98⤵PID:3020
-
\??\c:\fbprb.exec:\fbprb.exe99⤵PID:1804
-
\??\c:\vbhplp.exec:\vbhplp.exe100⤵PID:1960
-
\??\c:\nbxxlrx.exec:\nbxxlrx.exe101⤵PID:1952
-
\??\c:\rxhdx.exec:\rxhdx.exe102⤵PID:1636
-
\??\c:\jvdhd.exec:\jvdhd.exe103⤵PID:2292
-
\??\c:\lblnjp.exec:\lblnjp.exe104⤵PID:1524
-
\??\c:\pfvvndb.exec:\pfvvndb.exe105⤵PID:2016
-
\??\c:\rtjftbd.exec:\rtjftbd.exe106⤵PID:1396
-
\??\c:\dvvxh.exec:\dvvxh.exe107⤵PID:1408
-
\??\c:\tnbbvxt.exec:\tnbbvxt.exe108⤵PID:2056
-
\??\c:\jphnh.exec:\jphnh.exe109⤵PID:472
-
\??\c:\hjbjh.exec:\hjbjh.exe110⤵PID:2116
-
\??\c:\nfhdbx.exec:\nfhdbx.exe111⤵PID:2968
-
\??\c:\hldfxph.exec:\hldfxph.exe112⤵PID:2976
-
\??\c:\pfjfbhv.exec:\pfjfbhv.exe113⤵PID:432
-
\??\c:\lnlvvxd.exec:\lnlvvxd.exe114⤵PID:2092
-
\??\c:\jthdvr.exec:\jthdvr.exe115⤵PID:684
-
\??\c:\djxxpx.exec:\djxxpx.exe116⤵PID:2264
-
\??\c:\vntrtd.exec:\vntrtd.exe117⤵PID:1080
-
\??\c:\rnrffx.exec:\rnrffx.exe118⤵PID:2908
-
\??\c:\xfthxl.exec:\xfthxl.exe119⤵PID:1156
-
\??\c:\vjddnt.exec:\vjddnt.exe120⤵PID:1344
-
\??\c:\jpxnd.exec:\jpxnd.exe121⤵PID:1292
-
\??\c:\rvdjlb.exec:\rvdjlb.exe122⤵PID:1496
-
\??\c:\bdttnxf.exec:\bdttnxf.exe123⤵PID:2244
-
\??\c:\rbhbr.exec:\rbhbr.exe124⤵PID:2096
-
\??\c:\jltrt.exec:\jltrt.exe125⤵PID:1604
-
\??\c:\dtxpt.exec:\dtxpt.exe126⤵PID:1596
-
\??\c:\ftfrr.exec:\ftfrr.exe127⤵PID:3028
-
\??\c:\dbjvt.exec:\dbjvt.exe128⤵PID:2484
-
\??\c:\lpjld.exec:\lpjld.exe129⤵PID:2516
-
\??\c:\brrrp.exec:\brrrp.exe130⤵PID:3016
-
\??\c:\bbtpbt.exec:\bbtpbt.exe131⤵PID:2644
-
\??\c:\vdpjv.exec:\vdpjv.exe132⤵PID:2612
-
\??\c:\pbdbh.exec:\pbdbh.exe133⤵PID:2560
-
\??\c:\phfdh.exec:\phfdh.exe134⤵PID:1756
-
\??\c:\nbrtx.exec:\nbrtx.exe135⤵PID:1776
-
\??\c:\xvfdtnn.exec:\xvfdtnn.exe136⤵PID:2388
-
\??\c:\hjljrxb.exec:\hjljrxb.exe137⤵PID:2792
-
\??\c:\pvxhv.exec:\pvxhv.exe138⤵PID:2992
-
\??\c:\bhrldn.exec:\bhrldn.exe139⤵PID:1484
-
\??\c:\llntrhl.exec:\llntrhl.exe140⤵PID:1052
-
\??\c:\hxlnrhh.exec:\hxlnrhh.exe141⤵PID:2356
-
\??\c:\xprhnlh.exec:\xprhnlh.exe142⤵PID:2432
-
\??\c:\ltntn.exec:\ltntn.exe143⤵PID:2608
-
\??\c:\lxnjxx.exec:\lxnjxx.exe144⤵PID:2688
-
\??\c:\nhxtbr.exec:\nhxtbr.exe145⤵PID:1940
-
\??\c:\bxdnndr.exec:\bxdnndr.exe146⤵PID:1936
-
\??\c:\btvrntr.exec:\btvrntr.exe147⤵PID:1804
-
\??\c:\brpjxnd.exec:\brpjxnd.exe148⤵PID:2624
-
\??\c:\vtrltp.exec:\vtrltp.exe149⤵PID:924
-
\??\c:\txxlvj.exec:\txxlvj.exe150⤵PID:1352
-
\??\c:\rphvdl.exec:\rphvdl.exe151⤵PID:1492
-
\??\c:\hrtdvjx.exec:\hrtdvjx.exe152⤵PID:2972
-
\??\c:\dtrhfn.exec:\dtrhfn.exe153⤵PID:1216
-
\??\c:\vxthh.exec:\vxthh.exe154⤵PID:2984
-
\??\c:\hnltjrp.exec:\hnltjrp.exe155⤵PID:660
-
\??\c:\ltbrd.exec:\ltbrd.exe156⤵PID:1100
-
\??\c:\bpxlhvd.exec:\bpxlhvd.exe157⤵PID:2112
-
\??\c:\pphxrl.exec:\pphxrl.exe158⤵PID:3056
-
\??\c:\xdhhdvt.exec:\xdhhdvt.exe159⤵PID:2196
-
\??\c:\blxdphv.exec:\blxdphv.exe160⤵PID:1660
-
\??\c:\fjbjb.exec:\fjbjb.exe161⤵PID:1012
-
\??\c:\drxrxht.exec:\drxrxht.exe162⤵PID:932
-
\??\c:\xvbdtl.exec:\xvbdtl.exe163⤵PID:892
-
\??\c:\rjhlr.exec:\rjhlr.exe164⤵PID:544
-
\??\c:\hpxdp.exec:\hpxdp.exe165⤵PID:320
-
\??\c:\ftbpr.exec:\ftbpr.exe166⤵PID:1096
-
\??\c:\lfvvhf.exec:\lfvvhf.exe167⤵PID:1212
-
\??\c:\jrltxpf.exec:\jrltxpf.exe168⤵PID:2220
-
\??\c:\tnvrx.exec:\tnvrx.exe169⤵PID:868
-
\??\c:\rvdlp.exec:\rvdlp.exe170⤵PID:2828
-
\??\c:\hnnxdxt.exec:\hnnxdxt.exe171⤵PID:2068
-
\??\c:\vxdphx.exec:\vxdphx.exe172⤵PID:1504
-
\??\c:\hrrljnd.exec:\hrrljnd.exe173⤵PID:2176
-
\??\c:\tnhjlvf.exec:\tnhjlvf.exe174⤵PID:2812
-
\??\c:\fpdpbx.exec:\fpdpbx.exe175⤵PID:3012
-
\??\c:\rjrxnjv.exec:\rjrxnjv.exe176⤵PID:2588
-
\??\c:\fbbrbh.exec:\fbbrbh.exe177⤵PID:2508
-
\??\c:\vhnnnp.exec:\vhnnnp.exe178⤵PID:2616
-
\??\c:\vjdhhbx.exec:\vjdhhbx.exe179⤵PID:2716
-
\??\c:\xldxx.exec:\xldxx.exe180⤵PID:2592
-
\??\c:\fffrlpv.exec:\fffrlpv.exe181⤵PID:2712
-
\??\c:\prvxvd.exec:\prvxvd.exe182⤵PID:2556
-
\??\c:\frfnnh.exec:\frfnnh.exe183⤵PID:2392
-
\??\c:\tvrrn.exec:\tvrrn.exe184⤵PID:772
-
\??\c:\xbfjx.exec:\xbfjx.exe185⤵PID:800
-
\??\c:\blpdtlj.exec:\blpdtlj.exe186⤵PID:1648
-
\??\c:\ldlbf.exec:\ldlbf.exe187⤵PID:1340
-
\??\c:\tljjdtj.exec:\tljjdtj.exe188⤵PID:1196
-
\??\c:\xpvbpfn.exec:\xpvbpfn.exe189⤵PID:2692
-
\??\c:\pxttxpv.exec:\pxttxpv.exe190⤵PID:2136
-
\??\c:\hdlhl.exec:\hdlhl.exe191⤵PID:2280
-
\??\c:\rfvjv.exec:\rfvjv.exe192⤵PID:3020
-
\??\c:\lfrnjlx.exec:\lfrnjlx.exe193⤵PID:1948
-
\??\c:\vnjbh.exec:\vnjbh.exe194⤵PID:2300
-
\??\c:\hhhvf.exec:\hhhvf.exe195⤵PID:1440
-
\??\c:\thrtj.exec:\thrtj.exe196⤵PID:2624
-
\??\c:\tdjln.exec:\tdjln.exe197⤵PID:2292
-
\??\c:\hrdhld.exec:\hrdhld.exe198⤵PID:852
-
\??\c:\ndhftl.exec:\ndhftl.exe199⤵PID:2236
-
\??\c:\lnvnhdl.exec:\lnvnhdl.exe200⤵PID:2044
-
\??\c:\djprvfx.exec:\djprvfx.exe201⤵PID:1396
-
\??\c:\hhjnxj.exec:\hhjnxj.exe202⤵PID:2984
-
\??\c:\ppdhxll.exec:\ppdhxll.exe203⤵PID:660
-
\??\c:\jrfrrh.exec:\jrfrrh.exe204⤵PID:2960
-
\??\c:\xbrjnp.exec:\xbrjnp.exe205⤵PID:2040
-
\??\c:\jxpnhvr.exec:\jxpnhvr.exe206⤵PID:2980
-
\??\c:\bblxf.exec:\bblxf.exe207⤵PID:1060
-
\??\c:\pxfdj.exec:\pxfdj.exe208⤵PID:828
-
\??\c:\xnxhld.exec:\xnxhld.exe209⤵PID:1724
-
\??\c:\vpbtff.exec:\vpbtff.exe210⤵PID:1740
-
\??\c:\tjphx.exec:\tjphx.exe211⤵PID:932
-
\??\c:\dlxrfhb.exec:\dlxrfhb.exe212⤵PID:892
-
\??\c:\bndjhf.exec:\bndjhf.exe213⤵PID:624
-
\??\c:\xfrxh.exec:\xfrxh.exe214⤵PID:320
-
\??\c:\npxxb.exec:\npxxb.exe215⤵PID:1344
-
\??\c:\fvlxpl.exec:\fvlxpl.exe216⤵PID:2216
-
\??\c:\vjvbxnd.exec:\vjvbxnd.exe217⤵PID:2088
-
\??\c:\rbxfpr.exec:\rbxfpr.exe218⤵PID:2244
-
\??\c:\pdbnvv.exec:\pdbnvv.exe219⤵PID:1572
-
\??\c:\lnhbxj.exec:\lnhbxj.exe220⤵PID:3036
-
\??\c:\vhtpxf.exec:\vhtpxf.exe221⤵PID:1504
-
\??\c:\llrfx.exec:\llrfx.exe222⤵PID:2564
-
\??\c:\vdjtlhh.exec:\vdjtlhh.exe223⤵PID:2480
-
\??\c:\rpdpl.exec:\rpdpl.exe224⤵PID:2516
-
\??\c:\lbjlhjp.exec:\lbjlhjp.exe225⤵PID:2584
-
\??\c:\bppxh.exec:\bppxh.exe226⤵PID:2508
-
\??\c:\jjbttb.exec:\jjbttb.exe227⤵PID:2548
-
\??\c:\llvhbn.exec:\llvhbn.exe228⤵PID:2380
-
\??\c:\vvjhp.exec:\vvjhp.exe229⤵PID:1620
-
\??\c:\xvbth.exec:\xvbth.exe230⤵PID:2340
-
\??\c:\rrjllh.exec:\rrjllh.exe231⤵PID:1696
-
\??\c:\trjplv.exec:\trjplv.exe232⤵PID:2436
-
\??\c:\jffvp.exec:\jffvp.exe233⤵PID:1112
-
\??\c:\jnthjtr.exec:\jnthjtr.exe234⤵PID:2992
-
\??\c:\vndjvh.exec:\vndjvh.exe235⤵PID:940
-
\??\c:\nlllht.exec:\nlllht.exe236⤵PID:1864
-
\??\c:\xlnbntd.exec:\xlnbntd.exe237⤵PID:1796
-
\??\c:\nfttnjf.exec:\nfttnjf.exe238⤵PID:2664
-
\??\c:\nntlljt.exec:\nntlljt.exe239⤵PID:2692
-
\??\c:\hnbrlh.exec:\hnbrlh.exe240⤵PID:2320
-
\??\c:\vxxfr.exec:\vxxfr.exe241⤵PID:1652
-
\??\c:\xrbfv.exec:\xrbfv.exe242⤵PID:2284