Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 04:45
Behavioral task
behavioral1
Sample
f9a07b5820823118d27c2673715c773a861bf9826354da6e4e77fa80cb78dc33.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
f9a07b5820823118d27c2673715c773a861bf9826354da6e4e77fa80cb78dc33.exe
-
Size
367KB
-
MD5
c0775051313ca9feeade793c7ca32f6a
-
SHA1
a3c00259faca2e487d1d8630738e757661d86d5b
-
SHA256
f9a07b5820823118d27c2673715c773a861bf9826354da6e4e77fa80cb78dc33
-
SHA512
0f2ebb1317a87489102332a20ec4da4c688df57e32c7638dc961c14fec626cad95b2f5235f310a4d48f64750287c704f4e46e8089f98243b8d4132ffe1bf81e7
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOFltH4tiAlSpgFZAzwdjcIlSpgFZZr3GSM/xG:y4wFHoS3eFplAlSpgFZAKjcIlSpgFZZD
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1160-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/856-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2212-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/660-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2576-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4748-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3004-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2512-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1092-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2720-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4500-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/908-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4452-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4248-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1848-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3300-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4236-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1208-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/824-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1036-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1244-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1512-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/908-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1828-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-477-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4752-515-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/712-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-536-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/364-624-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-643-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-668-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-679-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-706-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-823-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-827-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1160-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\dvdvd.exe UPX behavioral2/memory/1160-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/856-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rrrrxxf.exe UPX behavioral2/memory/2212-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\btbbtt.exe UPX \??\c:\fffxrrl.exe UPX behavioral2/memory/4328-28-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pdjdv.exe UPX behavioral2/memory/660-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\1flrxlx.exe UPX C:\nhbbhh.exe UPX behavioral2/memory/3352-42-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2308-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\tnnhbb.exe UPX behavioral2/memory/2576-26-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lrfrflx.exe UPX behavioral2/memory/3432-52-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jpddv.exe UPX behavioral2/memory/4496-59-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rrxlllf.exe UPX behavioral2/memory/2064-66-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bbtntb.exe UPX behavioral2/memory/2008-74-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\vvpdv.exe UPX behavioral2/memory/4804-88-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\ntbbth.exe UPX \??\c:\xxrxrrx.exe UPX behavioral2/memory/4748-72-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2008-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pvdvp.exe UPX C:\ntbbnn.exe UPX behavioral2/memory/3004-98-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5hntth.exe UPX behavioral2/memory/2376-104-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jddvp.exe UPX C:\lllxrff.exe UPX behavioral2/memory/4396-115-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2512-119-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9hhbbb.exe UPX behavioral2/memory/1492-109-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3djdv.exe UPX C:\frfxfxr.exe UPX behavioral2/memory/1092-133-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\vjpvv.exe UPX behavioral2/memory/2720-140-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\rllrllr.exe UPX behavioral2/memory/2220-147-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hhhnhn.exe UPX C:\3dppp.exe UPX C:\xffxxrr.exe UPX behavioral2/memory/2312-164-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4500-159-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2416-157-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\dvjdd.exe UPX C:\5hbbnn.exe UPX behavioral2/memory/908-174-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3rrxlfx.exe UPX behavioral2/memory/3304-180-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\1tnbtb.exe UPX behavioral2/memory/4996-188-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4032-191-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4480-198-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
dvdvd.exerrrrxxf.exebtbbtt.exefffxrrl.exetnnhbb.exepdjdv.exe1flrxlx.exenhbbhh.exelrfrflx.exejpddv.exerrxlllf.exebbtntb.exevvpdv.exexxrxrrx.exentbbth.exepvdvp.exentbbnn.exe5hntth.exejddvp.exelllxrff.exe9hhbbb.exe3djdv.exefrfxfxr.exevjpvv.exerllrllr.exehhhnhn.exe3dppp.exexffxxrr.exedvjdd.exe5hbbnn.exe3rrxlfx.exe1tnbtb.exepvpjd.exelrxrffx.exelffxrll.exe1nnbtn.exepvvvp.exeffxrxrx.exerfffflf.exebttnbn.exevdpdp.exelfrfxlx.exetbbthb.exeddpvj.exe5llfxrf.exe9llfrrf.exebnhbnn.exevpvpp.exe3dvjd.exefxrlxrf.exebtbnnb.exepppvd.exelrlfrlf.exexllxlfx.exehhhbnn.exevdjdj.exe3xxrffr.exehhthnt.exejjjvj.exeppdvj.exerllffrf.exefxllrfl.exehbnhbb.exe7jvjv.exepid process 856 dvdvd.exe 2212 rrrrxxf.exe 2576 btbbtt.exe 4328 fffxrrl.exe 2308 tnnhbb.exe 660 pdjdv.exe 3352 1flrxlx.exe 3432 nhbbhh.exe 4496 lrfrflx.exe 2064 jpddv.exe 2008 rrxlllf.exe 4748 bbtntb.exe 752 vvpdv.exe 4804 xxrxrrx.exe 2876 ntbbth.exe 3004 pvdvp.exe 2376 ntbbnn.exe 1492 5hntth.exe 4396 jddvp.exe 2512 lllxrff.exe 3692 9hhbbb.exe 1092 3djdv.exe 2720 frfxfxr.exe 4196 vjpvv.exe 2220 rllrllr.exe 2416 hhhnhn.exe 4500 3dppp.exe 2312 xffxxrr.exe 908 dvjdd.exe 3304 5hbbnn.exe 1752 3rrxlfx.exe 4996 1tnbtb.exe 4032 pvpjd.exe 4480 lrxrffx.exe 4452 lffxrll.exe 1380 1nnbtn.exe 5076 pvvvp.exe 1160 ffxrxrx.exe 856 rfffflf.exe 4188 bttnbn.exe 4248 vdpdp.exe 4328 lfrfxlx.exe 1848 tbbthb.exe 2044 ddpvj.exe 5088 5llfxrf.exe 4468 9llfrrf.exe 4840 bnhbnn.exe 4056 vpvpp.exe 1216 3dvjd.exe 4568 fxrlxrf.exe 3300 btbnnb.exe 4236 pppvd.exe 4344 lrlfrlf.exe 636 xllxlfx.exe 3112 hhhbnn.exe 2644 vdjdj.exe 5056 3xxrffr.exe 2876 hhthnt.exe 1208 jjjvj.exe 5092 ppdvj.exe 824 rllffrf.exe 3208 fxllrfl.exe 1036 hbnhbb.exe 2512 7jvjv.exe -
Processes:
resource yara_rule behavioral2/memory/1160-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvdvd.exe upx behavioral2/memory/1160-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/856-8-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrrrxxf.exe upx behavioral2/memory/2212-13-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btbbtt.exe upx \??\c:\fffxrrl.exe upx behavioral2/memory/4328-28-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdjdv.exe upx behavioral2/memory/660-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1flrxlx.exe upx C:\nhbbhh.exe upx behavioral2/memory/3352-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2308-31-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tnnhbb.exe upx behavioral2/memory/2576-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrfrflx.exe upx behavioral2/memory/3432-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpddv.exe upx behavioral2/memory/4496-59-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrxlllf.exe upx behavioral2/memory/2064-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbtntb.exe upx behavioral2/memory/2008-74-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vvpdv.exe upx behavioral2/memory/4804-88-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ntbbth.exe upx \??\c:\xxrxrrx.exe upx behavioral2/memory/4748-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2008-64-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvdvp.exe upx C:\ntbbnn.exe upx behavioral2/memory/3004-98-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5hntth.exe upx behavioral2/memory/2376-104-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jddvp.exe upx C:\lllxrff.exe upx behavioral2/memory/4396-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2512-119-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9hhbbb.exe upx behavioral2/memory/1492-109-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3djdv.exe upx C:\frfxfxr.exe upx behavioral2/memory/1092-133-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vjpvv.exe upx behavioral2/memory/2720-140-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rllrllr.exe upx behavioral2/memory/2220-147-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhhnhn.exe upx C:\3dppp.exe upx C:\xffxxrr.exe upx behavioral2/memory/2312-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4500-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2416-157-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvjdd.exe upx C:\5hbbnn.exe upx behavioral2/memory/908-174-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3rrxlfx.exe upx behavioral2/memory/3304-180-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1tnbtb.exe upx behavioral2/memory/4996-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4032-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4480-198-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f9a07b5820823118d27c2673715c773a861bf9826354da6e4e77fa80cb78dc33.exedvdvd.exerrrrxxf.exebtbbtt.exefffxrrl.exetnnhbb.exepdjdv.exe1flrxlx.exenhbbhh.exelrfrflx.exejpddv.exerrxlllf.exebbtntb.exevvpdv.exexxrxrrx.exentbbth.exepvdvp.exentbbnn.exe5hntth.exejddvp.exelllxrff.exe9hhbbb.exedescription pid process target process PID 1160 wrote to memory of 856 1160 f9a07b5820823118d27c2673715c773a861bf9826354da6e4e77fa80cb78dc33.exe dvdvd.exe PID 1160 wrote to memory of 856 1160 f9a07b5820823118d27c2673715c773a861bf9826354da6e4e77fa80cb78dc33.exe dvdvd.exe PID 1160 wrote to memory of 856 1160 f9a07b5820823118d27c2673715c773a861bf9826354da6e4e77fa80cb78dc33.exe dvdvd.exe PID 856 wrote to memory of 2212 856 dvdvd.exe rrrrxxf.exe PID 856 wrote to memory of 2212 856 dvdvd.exe rrrrxxf.exe PID 856 wrote to memory of 2212 856 dvdvd.exe rrrrxxf.exe PID 2212 wrote to memory of 2576 2212 rrrrxxf.exe btbbtt.exe PID 2212 wrote to memory of 2576 2212 rrrrxxf.exe btbbtt.exe PID 2212 wrote to memory of 2576 2212 rrrrxxf.exe btbbtt.exe PID 2576 wrote to memory of 4328 2576 btbbtt.exe fffxrrl.exe PID 2576 wrote to memory of 4328 2576 btbbtt.exe fffxrrl.exe PID 2576 wrote to memory of 4328 2576 btbbtt.exe fffxrrl.exe PID 4328 wrote to memory of 2308 4328 fffxrrl.exe tnnhbb.exe PID 4328 wrote to memory of 2308 4328 fffxrrl.exe tnnhbb.exe PID 4328 wrote to memory of 2308 4328 fffxrrl.exe tnnhbb.exe PID 2308 wrote to memory of 660 2308 tnnhbb.exe pdjdv.exe PID 2308 wrote to memory of 660 2308 tnnhbb.exe pdjdv.exe PID 2308 wrote to memory of 660 2308 tnnhbb.exe pdjdv.exe PID 660 wrote to memory of 3352 660 pdjdv.exe 1flrxlx.exe PID 660 wrote to memory of 3352 660 pdjdv.exe 1flrxlx.exe PID 660 wrote to memory of 3352 660 pdjdv.exe 1flrxlx.exe PID 3352 wrote to memory of 3432 3352 1flrxlx.exe nhbbhh.exe PID 3352 wrote to memory of 3432 3352 1flrxlx.exe nhbbhh.exe PID 3352 wrote to memory of 3432 3352 1flrxlx.exe nhbbhh.exe PID 3432 wrote to memory of 4496 3432 nhbbhh.exe lrfrflx.exe PID 3432 wrote to memory of 4496 3432 nhbbhh.exe lrfrflx.exe PID 3432 wrote to memory of 4496 3432 nhbbhh.exe lrfrflx.exe PID 4496 wrote to memory of 2064 4496 lrfrflx.exe jpddv.exe PID 4496 wrote to memory of 2064 4496 lrfrflx.exe jpddv.exe PID 4496 wrote to memory of 2064 4496 lrfrflx.exe jpddv.exe PID 2064 wrote to memory of 2008 2064 jpddv.exe rrxlllf.exe PID 2064 wrote to memory of 2008 2064 jpddv.exe rrxlllf.exe PID 2064 wrote to memory of 2008 2064 jpddv.exe rrxlllf.exe PID 2008 wrote to memory of 4748 2008 rrxlllf.exe bbtntb.exe PID 2008 wrote to memory of 4748 2008 rrxlllf.exe bbtntb.exe PID 2008 wrote to memory of 4748 2008 rrxlllf.exe bbtntb.exe PID 4748 wrote to memory of 752 4748 bbtntb.exe vvpdv.exe PID 4748 wrote to memory of 752 4748 bbtntb.exe vvpdv.exe PID 4748 wrote to memory of 752 4748 bbtntb.exe vvpdv.exe PID 752 wrote to memory of 4804 752 vvpdv.exe xxrxrrx.exe PID 752 wrote to memory of 4804 752 vvpdv.exe xxrxrrx.exe PID 752 wrote to memory of 4804 752 vvpdv.exe xxrxrrx.exe PID 4804 wrote to memory of 2876 4804 xxrxrrx.exe ntbbth.exe PID 4804 wrote to memory of 2876 4804 xxrxrrx.exe ntbbth.exe PID 4804 wrote to memory of 2876 4804 xxrxrrx.exe ntbbth.exe PID 2876 wrote to memory of 3004 2876 ntbbth.exe pvdvp.exe PID 2876 wrote to memory of 3004 2876 ntbbth.exe pvdvp.exe PID 2876 wrote to memory of 3004 2876 ntbbth.exe pvdvp.exe PID 3004 wrote to memory of 2376 3004 pvdvp.exe ntbbnn.exe PID 3004 wrote to memory of 2376 3004 pvdvp.exe ntbbnn.exe PID 3004 wrote to memory of 2376 3004 pvdvp.exe ntbbnn.exe PID 2376 wrote to memory of 1492 2376 ntbbnn.exe 5hntth.exe PID 2376 wrote to memory of 1492 2376 ntbbnn.exe 5hntth.exe PID 2376 wrote to memory of 1492 2376 ntbbnn.exe 5hntth.exe PID 1492 wrote to memory of 4396 1492 5hntth.exe jddvp.exe PID 1492 wrote to memory of 4396 1492 5hntth.exe jddvp.exe PID 1492 wrote to memory of 4396 1492 5hntth.exe jddvp.exe PID 4396 wrote to memory of 2512 4396 jddvp.exe lllxrff.exe PID 4396 wrote to memory of 2512 4396 jddvp.exe lllxrff.exe PID 4396 wrote to memory of 2512 4396 jddvp.exe lllxrff.exe PID 2512 wrote to memory of 3692 2512 lllxrff.exe 9hhbbb.exe PID 2512 wrote to memory of 3692 2512 lllxrff.exe 9hhbbb.exe PID 2512 wrote to memory of 3692 2512 lllxrff.exe 9hhbbb.exe PID 3692 wrote to memory of 1092 3692 9hhbbb.exe 3djdv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9a07b5820823118d27c2673715c773a861bf9826354da6e4e77fa80cb78dc33.exe"C:\Users\Admin\AppData\Local\Temp\f9a07b5820823118d27c2673715c773a861bf9826354da6e4e77fa80cb78dc33.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\dvdvd.exec:\dvdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\rrrrxxf.exec:\rrrrxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\btbbtt.exec:\btbbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\fffxrrl.exec:\fffxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\tnnhbb.exec:\tnnhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\pdjdv.exec:\pdjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\1flrxlx.exec:\1flrxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\nhbbhh.exec:\nhbbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\lrfrflx.exec:\lrfrflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\jpddv.exec:\jpddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\rrxlllf.exec:\rrxlllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\bbtntb.exec:\bbtntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\vvpdv.exec:\vvpdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\xxrxrrx.exec:\xxrxrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\ntbbth.exec:\ntbbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\pvdvp.exec:\pvdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\ntbbnn.exec:\ntbbnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\5hntth.exec:\5hntth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\jddvp.exec:\jddvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\lllxrff.exec:\lllxrff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\9hhbbb.exec:\9hhbbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\3djdv.exec:\3djdv.exe23⤵
- Executes dropped EXE
PID:1092 -
\??\c:\frfxfxr.exec:\frfxfxr.exe24⤵
- Executes dropped EXE
PID:2720 -
\??\c:\vjpvv.exec:\vjpvv.exe25⤵
- Executes dropped EXE
PID:4196 -
\??\c:\rllrllr.exec:\rllrllr.exe26⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hhhnhn.exec:\hhhnhn.exe27⤵
- Executes dropped EXE
PID:2416 -
\??\c:\3dppp.exec:\3dppp.exe28⤵
- Executes dropped EXE
PID:4500 -
\??\c:\xffxxrr.exec:\xffxxrr.exe29⤵
- Executes dropped EXE
PID:2312 -
\??\c:\dvjdd.exec:\dvjdd.exe30⤵
- Executes dropped EXE
PID:908 -
\??\c:\5hbbnn.exec:\5hbbnn.exe31⤵
- Executes dropped EXE
PID:3304 -
\??\c:\3rrxlfx.exec:\3rrxlfx.exe32⤵
- Executes dropped EXE
PID:1752 -
\??\c:\1tnbtb.exec:\1tnbtb.exe33⤵
- Executes dropped EXE
PID:4996 -
\??\c:\pvpjd.exec:\pvpjd.exe34⤵
- Executes dropped EXE
PID:4032 -
\??\c:\lrxrffx.exec:\lrxrffx.exe35⤵
- Executes dropped EXE
PID:4480 -
\??\c:\lffxrll.exec:\lffxrll.exe36⤵
- Executes dropped EXE
PID:4452 -
\??\c:\1nnbtn.exec:\1nnbtn.exe37⤵
- Executes dropped EXE
PID:1380 -
\??\c:\pvvvp.exec:\pvvvp.exe38⤵
- Executes dropped EXE
PID:5076 -
\??\c:\ffxrxrx.exec:\ffxrxrx.exe39⤵
- Executes dropped EXE
PID:1160 -
\??\c:\rfffflf.exec:\rfffflf.exe40⤵
- Executes dropped EXE
PID:856 -
\??\c:\bttnbn.exec:\bttnbn.exe41⤵
- Executes dropped EXE
PID:4188 -
\??\c:\vdpdp.exec:\vdpdp.exe42⤵
- Executes dropped EXE
PID:4248 -
\??\c:\lfrfxlx.exec:\lfrfxlx.exe43⤵
- Executes dropped EXE
PID:4328 -
\??\c:\tbbthb.exec:\tbbthb.exe44⤵
- Executes dropped EXE
PID:1848 -
\??\c:\ddpvj.exec:\ddpvj.exe45⤵
- Executes dropped EXE
PID:2044 -
\??\c:\5llfxrf.exec:\5llfxrf.exe46⤵
- Executes dropped EXE
PID:5088 -
\??\c:\9llfrrf.exec:\9llfrrf.exe47⤵
- Executes dropped EXE
PID:4468 -
\??\c:\bnhbnn.exec:\bnhbnn.exe48⤵
- Executes dropped EXE
PID:4840 -
\??\c:\vpvpp.exec:\vpvpp.exe49⤵
- Executes dropped EXE
PID:4056 -
\??\c:\3dvjd.exec:\3dvjd.exe50⤵
- Executes dropped EXE
PID:1216 -
\??\c:\fxrlxrf.exec:\fxrlxrf.exe51⤵
- Executes dropped EXE
PID:4568 -
\??\c:\btbnnb.exec:\btbnnb.exe52⤵
- Executes dropped EXE
PID:3300 -
\??\c:\pppvd.exec:\pppvd.exe53⤵
- Executes dropped EXE
PID:4236 -
\??\c:\lrlfrlf.exec:\lrlfrlf.exe54⤵
- Executes dropped EXE
PID:4344 -
\??\c:\xllxlfx.exec:\xllxlfx.exe55⤵
- Executes dropped EXE
PID:636 -
\??\c:\hhhbnn.exec:\hhhbnn.exe56⤵
- Executes dropped EXE
PID:3112 -
\??\c:\vdjdj.exec:\vdjdj.exe57⤵
- Executes dropped EXE
PID:2644 -
\??\c:\3xxrffr.exec:\3xxrffr.exe58⤵
- Executes dropped EXE
PID:5056 -
\??\c:\hhthnt.exec:\hhthnt.exe59⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jjjvj.exec:\jjjvj.exe60⤵
- Executes dropped EXE
PID:1208 -
\??\c:\ppdvj.exec:\ppdvj.exe61⤵
- Executes dropped EXE
PID:5092 -
\??\c:\rllffrf.exec:\rllffrf.exe62⤵
- Executes dropped EXE
PID:824 -
\??\c:\fxllrfl.exec:\fxllrfl.exe63⤵
- Executes dropped EXE
PID:3208 -
\??\c:\hbnhbb.exec:\hbnhbb.exe64⤵
- Executes dropped EXE
PID:1036 -
\??\c:\7jvjv.exec:\7jvjv.exe65⤵
- Executes dropped EXE
PID:2512 -
\??\c:\lllfllf.exec:\lllfllf.exe66⤵PID:3012
-
\??\c:\thhtnn.exec:\thhtnn.exe67⤵PID:972
-
\??\c:\nnnhhn.exec:\nnnhhn.exe68⤵PID:1244
-
\??\c:\jpvvv.exec:\jpvvv.exe69⤵PID:3248
-
\??\c:\xllfrrl.exec:\xllfrrl.exe70⤵PID:1512
-
\??\c:\1bbttn.exec:\1bbttn.exe71⤵PID:1644
-
\??\c:\3bbbtt.exec:\3bbbtt.exe72⤵PID:3296
-
\??\c:\7pdvv.exec:\7pdvv.exe73⤵PID:2416
-
\??\c:\lffxrfx.exec:\lffxrfx.exe74⤵PID:2364
-
\??\c:\tbhtnh.exec:\tbhtnh.exe75⤵PID:4572
-
\??\c:\7pjvd.exec:\7pjvd.exe76⤵PID:3696
-
\??\c:\7ppdp.exec:\7ppdp.exe77⤵PID:2312
-
\??\c:\tttttt.exec:\tttttt.exe78⤵PID:2500
-
\??\c:\pppdp.exec:\pppdp.exe79⤵PID:908
-
\??\c:\rxrllrl.exec:\rxrllrl.exe80⤵PID:4912
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe81⤵PID:4540
-
\??\c:\1bnnhh.exec:\1bnnhh.exe82⤵PID:3888
-
\??\c:\7xrllff.exec:\7xrllff.exe83⤵PID:4360
-
\??\c:\rllfflr.exec:\rllfflr.exe84⤵PID:4480
-
\??\c:\tnnhhb.exec:\tnnhhb.exe85⤵PID:3936
-
\??\c:\vdvjd.exec:\vdvjd.exe86⤵PID:4784
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe87⤵PID:1444
-
\??\c:\hbntht.exec:\hbntht.exe88⤵PID:1828
-
\??\c:\nnbnnh.exec:\nnbnnh.exe89⤵PID:4004
-
\??\c:\jjjdp.exec:\jjjdp.exe90⤵PID:712
-
\??\c:\3pjdv.exec:\3pjdv.exe91⤵PID:4948
-
\??\c:\frfllxf.exec:\frfllxf.exe92⤵PID:3368
-
\??\c:\thnhbt.exec:\thnhbt.exe93⤵PID:1920
-
\??\c:\3ddjv.exec:\3ddjv.exe94⤵PID:4476
-
\??\c:\pjjvp.exec:\pjjvp.exe95⤵PID:3468
-
\??\c:\ffxrfrl.exec:\ffxrfrl.exe96⤵PID:4324
-
\??\c:\thnhnh.exec:\thnhnh.exe97⤵PID:4848
-
\??\c:\nhthht.exec:\nhthht.exe98⤵PID:4080
-
\??\c:\dppjj.exec:\dppjj.exe99⤵PID:3868
-
\??\c:\lrrrlfx.exec:\lrrrlfx.exe100⤵PID:4568
-
\??\c:\htnhnh.exec:\htnhnh.exe101⤵PID:2860
-
\??\c:\5vppd.exec:\5vppd.exe102⤵PID:4768
-
\??\c:\7dvjd.exec:\7dvjd.exe103⤵PID:4344
-
\??\c:\ffrfrrf.exec:\ffrfrrf.exe104⤵PID:636
-
\??\c:\nbbtnh.exec:\nbbtnh.exe105⤵PID:3112
-
\??\c:\tnnhbt.exec:\tnnhbt.exe106⤵PID:3732
-
\??\c:\vjpdp.exec:\vjpdp.exe107⤵PID:5056
-
\??\c:\xllxlfx.exec:\xllxlfx.exe108⤵PID:2236
-
\??\c:\lllxrfr.exec:\lllxrfr.exe109⤵PID:1208
-
\??\c:\bbthbt.exec:\bbthbt.exe110⤵PID:4580
-
\??\c:\thnhtt.exec:\thnhtt.exe111⤵PID:3720
-
\??\c:\vppdp.exec:\vppdp.exe112⤵PID:4012
-
\??\c:\llrffxl.exec:\llrffxl.exe113⤵PID:1092
-
\??\c:\3lxlrrr.exec:\3lxlrrr.exe114⤵PID:1344
-
\??\c:\tthbtn.exec:\tthbtn.exe115⤵PID:432
-
\??\c:\5ddvp.exec:\5ddvp.exe116⤵PID:5036
-
\??\c:\jpjdd.exec:\jpjdd.exe117⤵PID:5020
-
\??\c:\rxrxrlx.exec:\rxrxrlx.exe118⤵PID:3484
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe119⤵PID:2360
-
\??\c:\hbnnnh.exec:\hbnnnh.exe120⤵PID:3572
-
\??\c:\dvjjp.exec:\dvjjp.exe121⤵PID:1228
-
\??\c:\3fllflf.exec:\3fllflf.exe122⤵PID:1548
-
\??\c:\rlffxrl.exec:\rlffxrl.exe123⤵PID:220
-
\??\c:\tnnbtt.exec:\tnnbtt.exe124⤵PID:4956
-
\??\c:\dpvpd.exec:\dpvpd.exe125⤵PID:4032
-
\??\c:\vpjvd.exec:\vpjvd.exe126⤵PID:3436
-
\??\c:\lrlfxfr.exec:\lrlfxfr.exe127⤵PID:4284
-
\??\c:\bntnhb.exec:\bntnhb.exe128⤵PID:4312
-
\??\c:\ddvpj.exec:\ddvpj.exe129⤵PID:3740
-
\??\c:\jvvpd.exec:\jvvpd.exe130⤵PID:4752
-
\??\c:\lfxxllr.exec:\lfxxllr.exe131⤵PID:3972
-
\??\c:\bnthbt.exec:\bnthbt.exe132⤵PID:3744
-
\??\c:\jdjdd.exec:\jdjdd.exe133⤵PID:712
-
\??\c:\dpvdp.exec:\dpvdp.exe134⤵PID:1060
-
\??\c:\fflfrll.exec:\fflfrll.exe135⤵PID:1104
-
\??\c:\nntnhn.exec:\nntnhn.exe136⤵PID:4800
-
\??\c:\nhhhbt.exec:\nhhhbt.exe137⤵PID:208
-
\??\c:\djdjd.exec:\djdjd.exe138⤵PID:4468
-
\??\c:\lllfrlx.exec:\lllfrlx.exe139⤵PID:3040
-
\??\c:\flxrxxf.exec:\flxrxxf.exe140⤵PID:3232
-
\??\c:\btbhnn.exec:\btbhnn.exe141⤵PID:4080
-
\??\c:\ppjvp.exec:\ppjvp.exe142⤵PID:3300
-
\??\c:\jdjvd.exec:\jdjvd.exe143⤵PID:4236
-
\??\c:\5ffxlfx.exec:\5ffxlfx.exe144⤵PID:3672
-
\??\c:\thbhtn.exec:\thbhtn.exe145⤵PID:4768
-
\??\c:\tttthb.exec:\tttthb.exe146⤵PID:4344
-
\??\c:\3jpdp.exec:\3jpdp.exe147⤵PID:3516
-
\??\c:\llfrrlr.exec:\llfrrlr.exe148⤵PID:396
-
\??\c:\bbtnhb.exec:\bbtnhb.exe149⤵PID:4888
-
\??\c:\thbbhn.exec:\thbbhn.exe150⤵PID:2076
-
\??\c:\vpdvj.exec:\vpdvj.exe151⤵PID:5092
-
\??\c:\xxxrlff.exec:\xxxrlff.exe152⤵PID:824
-
\??\c:\rxllrlf.exec:\rxllrlf.exe153⤵PID:3692
-
\??\c:\bnbtht.exec:\bnbtht.exe154⤵PID:3348
-
\??\c:\dvvpv.exec:\dvvpv.exe155⤵PID:3496
-
\??\c:\jppdp.exec:\jppdp.exe156⤵PID:1536
-
\??\c:\1rrxlfr.exec:\1rrxlfr.exe157⤵PID:2304
-
\??\c:\htnhbb.exec:\htnhbb.exe158⤵PID:5036
-
\??\c:\httnhn.exec:\httnhn.exe159⤵PID:2364
-
\??\c:\jjvpv.exec:\jjvpv.exe160⤵PID:3484
-
\??\c:\frrfxfr.exec:\frrfxfr.exe161⤵PID:2360
-
\??\c:\hnnbnn.exec:\hnnbnn.exe162⤵PID:3140
-
\??\c:\3hbtnn.exec:\3hbtnn.exe163⤵PID:1228
-
\??\c:\vvpvv.exec:\vvpvv.exe164⤵PID:364
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe165⤵PID:4996
-
\??\c:\xrrrllf.exec:\xrrrllf.exe166⤵PID:4956
-
\??\c:\hbhbtn.exec:\hbhbtn.exe167⤵PID:2448
-
\??\c:\ppppp.exec:\ppppp.exe168⤵PID:4360
-
\??\c:\ddvpd.exec:\ddvpd.exe169⤵PID:3360
-
\??\c:\xxlxxrx.exec:\xxlxxrx.exe170⤵PID:4784
-
\??\c:\tbbnhb.exec:\tbbnhb.exe171⤵PID:4440
-
\??\c:\vdvpj.exec:\vdvpj.exe172⤵PID:852
-
\??\c:\vjdvp.exec:\vjdvp.exe173⤵PID:4188
-
\??\c:\3llfrrl.exec:\3llfrrl.exe174⤵PID:4004
-
\??\c:\thtbtn.exec:\thtbtn.exe175⤵PID:4616
-
\??\c:\ppppj.exec:\ppppj.exe176⤵PID:4916
-
\??\c:\1xrfxrl.exec:\1xrfxrl.exe177⤵PID:2096
-
\??\c:\bbbbbb.exec:\bbbbbb.exe178⤵PID:4476
-
\??\c:\thtthh.exec:\thtthh.exe179⤵PID:4424
-
\??\c:\9pjjp.exec:\9pjjp.exe180⤵PID:208
-
\??\c:\lxlfllf.exec:\lxlfllf.exe181⤵PID:4468
-
\??\c:\bhhbtt.exec:\bhhbtt.exe182⤵PID:624
-
\??\c:\vpppj.exec:\vpppj.exe183⤵PID:3868
-
\??\c:\7vpdv.exec:\7vpdv.exe184⤵PID:4080
-
\??\c:\xlxxrfx.exec:\xlxxrfx.exe185⤵PID:3300
-
\??\c:\ntbtbn.exec:\ntbtbn.exe186⤵PID:4772
-
\??\c:\jpjdj.exec:\jpjdj.exe187⤵PID:5044
-
\??\c:\rxfrrlr.exec:\rxfrrlr.exe188⤵PID:3444
-
\??\c:\rrrlflf.exec:\rrrlflf.exe189⤵PID:1872
-
\??\c:\btnbnh.exec:\btnbnh.exe190⤵PID:3732
-
\??\c:\dpjvj.exec:\dpjvj.exe191⤵PID:3524
-
\??\c:\lrxxlrr.exec:\lrxxlrr.exe192⤵PID:4488
-
\??\c:\bbnbtn.exec:\bbnbtn.exe193⤵PID:824
-
\??\c:\hhhtnb.exec:\hhhtnb.exe194⤵PID:1932
-
\??\c:\dppjd.exec:\dppjd.exe195⤵PID:1780
-
\??\c:\lflrfxf.exec:\lflrfxf.exe196⤵PID:3496
-
\??\c:\7rfxxfx.exec:\7rfxxfx.exe197⤵PID:964
-
\??\c:\hhnbbt.exec:\hhnbbt.exe198⤵PID:5020
-
\??\c:\7bbbtn.exec:\7bbbtn.exe199⤵PID:3188
-
\??\c:\pddvv.exec:\pddvv.exe200⤵PID:4604
-
\??\c:\flrfffx.exec:\flrfffx.exe201⤵PID:4372
-
\??\c:\xfllffx.exec:\xfllffx.exe202⤵PID:3572
-
\??\c:\tttnnb.exec:\tttnnb.exe203⤵PID:1540
-
\??\c:\pjjvp.exec:\pjjvp.exe204⤵PID:908
-
\??\c:\dvvjv.exec:\dvvjv.exe205⤵PID:220
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe206⤵PID:212
-
\??\c:\nhtttt.exec:\nhtttt.exe207⤵PID:816
-
\??\c:\dvddd.exec:\dvddd.exe208⤵PID:400
-
\??\c:\vpjdp.exec:\vpjdp.exe209⤵PID:1160
-
\??\c:\flxlfxr.exec:\flxlfxr.exe210⤵PID:2352
-
\??\c:\bbbbnt.exec:\bbbbnt.exe211⤵PID:1448
-
\??\c:\pvpvv.exec:\pvpvv.exe212⤵PID:3244
-
\??\c:\7jpjv.exec:\7jpjv.exe213⤵PID:4036
-
\??\c:\xrllfff.exec:\xrllfff.exe214⤵PID:2688
-
\??\c:\btnbnt.exec:\btnbnt.exe215⤵PID:5088
-
\??\c:\vdjdv.exec:\vdjdv.exe216⤵PID:2096
-
\??\c:\xrrllrx.exec:\xrrllrx.exe217⤵PID:3352
-
\??\c:\5flxrlx.exec:\5flxrlx.exe218⤵PID:4492
-
\??\c:\7bbbbh.exec:\7bbbbh.exe219⤵PID:208
-
\??\c:\bnnhhh.exec:\bnnhhh.exe220⤵PID:4468
-
\??\c:\djjdv.exec:\djjdv.exe221⤵PID:624
-
\??\c:\fffrlfx.exec:\fffrlfx.exe222⤵PID:5032
-
\??\c:\rlflrlf.exec:\rlflrlf.exe223⤵PID:3452
-
\??\c:\tbhhbb.exec:\tbhhbb.exe224⤵PID:3300
-
\??\c:\9ppjd.exec:\9ppjd.exe225⤵PID:752
-
\??\c:\3frlffr.exec:\3frlffr.exe226⤵PID:5044
-
\??\c:\lrlxffr.exec:\lrlxffr.exe227⤵PID:3112
-
\??\c:\nhnhbb.exec:\nhnhbb.exe228⤵PID:2616
-
\??\c:\pjppp.exec:\pjppp.exe229⤵PID:2076
-
\??\c:\xrllxlf.exec:\xrllxlf.exe230⤵PID:4580
-
\??\c:\xrfrffx.exec:\xrfrffx.exe231⤵PID:2512
-
\??\c:\bnbtth.exec:\bnbtth.exe232⤵PID:4012
-
\??\c:\jdjjj.exec:\jdjjj.exe233⤵PID:3348
-
\??\c:\jpppd.exec:\jpppd.exe234⤵PID:2152
-
\??\c:\rrrlfff.exec:\rrrlfff.exe235⤵PID:5036
-
\??\c:\hhnhbh.exec:\hhnhbh.exe236⤵PID:1504
-
\??\c:\3vjdj.exec:\3vjdj.exe237⤵PID:4408
-
\??\c:\rrrrlll.exec:\rrrrlll.exe238⤵PID:4868
-
\??\c:\htnbth.exec:\htnbth.exe239⤵PID:2320
-
\??\c:\5nthbt.exec:\5nthbt.exe240⤵PID:3108
-
\??\c:\3pppp.exec:\3pppp.exe241⤵PID:784
-
\??\c:\fxlxrlx.exec:\fxlxrlx.exe242⤵PID:2800