Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 04:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cb4c38ad627683efc54176985288f1549230cd43996ca242cc939f3c50cfeb81.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
cb4c38ad627683efc54176985288f1549230cd43996ca242cc939f3c50cfeb81.exe
-
Size
273KB
-
MD5
d0bc02020ed683526a501310b5697eec
-
SHA1
9489b32ffe797fc1911126df56f812c56728d91b
-
SHA256
cb4c38ad627683efc54176985288f1549230cd43996ca242cc939f3c50cfeb81
-
SHA512
31775b7d9078c65ab08411c91f46a92bf59464c9558ddeb3ef11ff87cffa5c535964872f6d3a00b2782984ab246250c1d22b2e302ec54cca388ba367ac1aecd4
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFM:8cm7ImGddXmNt251UriZFM
Malware Config
Signatures
-
Detect Blackmoon payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/2400-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-12-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2524-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-323-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2812-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-858-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2400-1-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/3052-10-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2524-26-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2960-49-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2588-40-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2676-37-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2640-58-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2484-66-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2484-75-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1236-94-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2888-92-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1588-111-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1888-132-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1708-129-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1580-148-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1908-150-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1908-157-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/572-169-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1332-187-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1256-184-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2204-210-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2204-218-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1728-235-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2804-260-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2804-268-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/560-272-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2216-286-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2736-295-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2736-302-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1624-303-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/3020-310-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2812-330-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2464-343-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2600-350-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2432-358-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2508-365-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2508-372-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2316-385-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1444-392-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1444-399-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1864-406-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/316-419-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/316-426-0x0000000000220000-0x000000000024A000-memory.dmp UPX behavioral1/memory/1860-427-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2120-434-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1400-447-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2208-486-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1768-505-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/676-531-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2940-550-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2956-575-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/3028-588-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2632-613-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2168-651-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1544-664-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2644-677-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1336-691-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1532-710-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2120-717-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1400-730-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2792-755-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2336-793-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/872-800-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1468-807-0x0000000000400000-0x000000000042A000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
9xrrrlr.exerfrfrxf.exevjvvv.exefrfflff.exe3bhntt.exejpppv.exelxlflff.exedvjdj.exelxrflxf.exenhtbbb.exenhhhth.exe1flfxxx.exe9lrrlxf.exepdpvv.exevjpjj.exenhthhh.exedpvpv.exefrrxllr.exe3nbhhb.exevvvpp.exexrxxxxf.exenhntbb.exejdjpv.exelxlxfff.exehttthh.exe1pddd.exerrlffxx.exe5dvvp.exevpjvp.exelfrrrxf.exe5tbbbb.exe3flllrr.exehthnhh.exehthhnt.exepdppv.exexlxxffl.exexlrlrlr.exe9thhnt.exenbhtbh.exe9jddp.exevjppp.exefrrrrlr.exetnbntt.exedpddj.exe1pdpj.exerfxrllr.exerfrllrf.exehbhbnh.exehbnttt.exepdddp.exe7vvdd.exe3xlllrr.exehthnnn.exehbtttn.exejdpvd.exe3fllrlr.exexllflfl.exehthhhb.exetntnbb.exepjvvd.exepjjpd.exefrxrxxx.exelfxxllr.exe5nhntn.exepid process 3052 9xrrrlr.exe 2524 rfrfrxf.exe 2676 vjvvv.exe 2588 frfflff.exe 2960 3bhntt.exe 2640 jpppv.exe 2484 lxlflff.exe 2480 dvjdj.exe 2888 lxrflxf.exe 1236 nhtbbb.exe 1588 nhhhth.exe 2608 1flfxxx.exe 1708 9lrrlxf.exe 1888 pdpvv.exe 1580 vjpjj.exe 1908 nhthhh.exe 264 dpvpv.exe 572 frrxllr.exe 1256 3nbhhb.exe 1332 vvvpp.exe 2656 xrxxxxf.exe 2188 nhntbb.exe 2204 jdjpv.exe 2224 lxlxfff.exe 1728 httthh.exe 1776 1pddd.exe 292 rrlffxx.exe 2248 5dvvp.exe 2804 vpjvp.exe 560 lfrrrxf.exe 2216 5tbbbb.exe 1872 3flllrr.exe 2736 hthnhh.exe 1624 hthhnt.exe 3020 pdppv.exe 2668 xlxxffl.exe 2724 xlrlrlr.exe 2812 9thhnt.exe 2548 nbhtbh.exe 2464 9jddp.exe 2600 vjppp.exe 2432 frrrrlr.exe 2508 tnbntt.exe 2480 dpddj.exe 2316 1pdpj.exe 1540 rfxrllr.exe 1444 rfrllrf.exe 2652 hbhbnh.exe 1864 hbnttt.exe 1692 pdddp.exe 316 7vvdd.exe 1860 3xlllrr.exe 2120 hthnnn.exe 784 hbtttn.exe 1400 jdpvd.exe 1196 3fllrlr.exe 572 xllflfl.exe 1348 hthhhb.exe 2792 tntnbb.exe 2184 pjvvd.exe 2208 pjjpd.exe 2020 frxrxxx.exe 1768 lfxxllr.exe 2692 5nhntn.exe -
Processes:
resource yara_rule behavioral1/memory/2400-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-426-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1860-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-690-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/1336-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-793-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cb4c38ad627683efc54176985288f1549230cd43996ca242cc939f3c50cfeb81.exe9xrrrlr.exerfrfrxf.exevjvvv.exefrfflff.exe3bhntt.exejpppv.exelxlflff.exedvjdj.exelxrflxf.exenhtbbb.exenhhhth.exe1flfxxx.exe9lrrlxf.exepdpvv.exevjpjj.exedescription pid process target process PID 2400 wrote to memory of 3052 2400 cb4c38ad627683efc54176985288f1549230cd43996ca242cc939f3c50cfeb81.exe 9xrrrlr.exe PID 2400 wrote to memory of 3052 2400 cb4c38ad627683efc54176985288f1549230cd43996ca242cc939f3c50cfeb81.exe 9xrrrlr.exe PID 2400 wrote to memory of 3052 2400 cb4c38ad627683efc54176985288f1549230cd43996ca242cc939f3c50cfeb81.exe 9xrrrlr.exe PID 2400 wrote to memory of 3052 2400 cb4c38ad627683efc54176985288f1549230cd43996ca242cc939f3c50cfeb81.exe 9xrrrlr.exe PID 3052 wrote to memory of 2524 3052 9xrrrlr.exe rfrfrxf.exe PID 3052 wrote to memory of 2524 3052 9xrrrlr.exe rfrfrxf.exe PID 3052 wrote to memory of 2524 3052 9xrrrlr.exe rfrfrxf.exe PID 3052 wrote to memory of 2524 3052 9xrrrlr.exe rfrfrxf.exe PID 2524 wrote to memory of 2676 2524 rfrfrxf.exe vjvvv.exe PID 2524 wrote to memory of 2676 2524 rfrfrxf.exe vjvvv.exe PID 2524 wrote to memory of 2676 2524 rfrfrxf.exe vjvvv.exe PID 2524 wrote to memory of 2676 2524 rfrfrxf.exe vjvvv.exe PID 2676 wrote to memory of 2588 2676 vjvvv.exe frfflff.exe PID 2676 wrote to memory of 2588 2676 vjvvv.exe frfflff.exe PID 2676 wrote to memory of 2588 2676 vjvvv.exe frfflff.exe PID 2676 wrote to memory of 2588 2676 vjvvv.exe frfflff.exe PID 2588 wrote to memory of 2960 2588 frfflff.exe 3bhntt.exe PID 2588 wrote to memory of 2960 2588 frfflff.exe 3bhntt.exe PID 2588 wrote to memory of 2960 2588 frfflff.exe 3bhntt.exe PID 2588 wrote to memory of 2960 2588 frfflff.exe 3bhntt.exe PID 2960 wrote to memory of 2640 2960 3bhntt.exe jpppv.exe PID 2960 wrote to memory of 2640 2960 3bhntt.exe jpppv.exe PID 2960 wrote to memory of 2640 2960 3bhntt.exe jpppv.exe PID 2960 wrote to memory of 2640 2960 3bhntt.exe jpppv.exe PID 2640 wrote to memory of 2484 2640 jpppv.exe lxlflff.exe PID 2640 wrote to memory of 2484 2640 jpppv.exe lxlflff.exe PID 2640 wrote to memory of 2484 2640 jpppv.exe lxlflff.exe PID 2640 wrote to memory of 2484 2640 jpppv.exe lxlflff.exe PID 2484 wrote to memory of 2480 2484 lxlflff.exe dvjdj.exe PID 2484 wrote to memory of 2480 2484 lxlflff.exe dvjdj.exe PID 2484 wrote to memory of 2480 2484 lxlflff.exe dvjdj.exe PID 2484 wrote to memory of 2480 2484 lxlflff.exe dvjdj.exe PID 2480 wrote to memory of 2888 2480 dvjdj.exe lxrflxf.exe PID 2480 wrote to memory of 2888 2480 dvjdj.exe lxrflxf.exe PID 2480 wrote to memory of 2888 2480 dvjdj.exe lxrflxf.exe PID 2480 wrote to memory of 2888 2480 dvjdj.exe lxrflxf.exe PID 2888 wrote to memory of 1236 2888 lxrflxf.exe nhtbbb.exe PID 2888 wrote to memory of 1236 2888 lxrflxf.exe nhtbbb.exe PID 2888 wrote to memory of 1236 2888 lxrflxf.exe nhtbbb.exe PID 2888 wrote to memory of 1236 2888 lxrflxf.exe nhtbbb.exe PID 1236 wrote to memory of 1588 1236 nhtbbb.exe nhhhth.exe PID 1236 wrote to memory of 1588 1236 nhtbbb.exe nhhhth.exe PID 1236 wrote to memory of 1588 1236 nhtbbb.exe nhhhth.exe PID 1236 wrote to memory of 1588 1236 nhtbbb.exe nhhhth.exe PID 1588 wrote to memory of 2608 1588 nhhhth.exe 1flfxxx.exe PID 1588 wrote to memory of 2608 1588 nhhhth.exe 1flfxxx.exe PID 1588 wrote to memory of 2608 1588 nhhhth.exe 1flfxxx.exe PID 1588 wrote to memory of 2608 1588 nhhhth.exe 1flfxxx.exe PID 2608 wrote to memory of 1708 2608 1flfxxx.exe 9lrrlxf.exe PID 2608 wrote to memory of 1708 2608 1flfxxx.exe 9lrrlxf.exe PID 2608 wrote to memory of 1708 2608 1flfxxx.exe 9lrrlxf.exe PID 2608 wrote to memory of 1708 2608 1flfxxx.exe 9lrrlxf.exe PID 1708 wrote to memory of 1888 1708 9lrrlxf.exe pdpvv.exe PID 1708 wrote to memory of 1888 1708 9lrrlxf.exe pdpvv.exe PID 1708 wrote to memory of 1888 1708 9lrrlxf.exe pdpvv.exe PID 1708 wrote to memory of 1888 1708 9lrrlxf.exe pdpvv.exe PID 1888 wrote to memory of 1580 1888 pdpvv.exe vjpjj.exe PID 1888 wrote to memory of 1580 1888 pdpvv.exe vjpjj.exe PID 1888 wrote to memory of 1580 1888 pdpvv.exe vjpjj.exe PID 1888 wrote to memory of 1580 1888 pdpvv.exe vjpjj.exe PID 1580 wrote to memory of 1908 1580 vjpjj.exe nhthhh.exe PID 1580 wrote to memory of 1908 1580 vjpjj.exe nhthhh.exe PID 1580 wrote to memory of 1908 1580 vjpjj.exe nhthhh.exe PID 1580 wrote to memory of 1908 1580 vjpjj.exe nhthhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb4c38ad627683efc54176985288f1549230cd43996ca242cc939f3c50cfeb81.exe"C:\Users\Admin\AppData\Local\Temp\cb4c38ad627683efc54176985288f1549230cd43996ca242cc939f3c50cfeb81.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\9xrrrlr.exec:\9xrrrlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\rfrfrxf.exec:\rfrfrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\vjvvv.exec:\vjvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\frfflff.exec:\frfflff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\3bhntt.exec:\3bhntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\jpppv.exec:\jpppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\lxlflff.exec:\lxlflff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\dvjdj.exec:\dvjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\lxrflxf.exec:\lxrflxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\nhtbbb.exec:\nhtbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\nhhhth.exec:\nhhhth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\1flfxxx.exec:\1flfxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\9lrrlxf.exec:\9lrrlxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\pdpvv.exec:\pdpvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\vjpjj.exec:\vjpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\nhthhh.exec:\nhthhh.exe17⤵
- Executes dropped EXE
PID:1908 -
\??\c:\dpvpv.exec:\dpvpv.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\frrxllr.exec:\frrxllr.exe19⤵
- Executes dropped EXE
PID:572 -
\??\c:\3nbhhb.exec:\3nbhhb.exe20⤵
- Executes dropped EXE
PID:1256 -
\??\c:\vvvpp.exec:\vvvpp.exe21⤵
- Executes dropped EXE
PID:1332 -
\??\c:\xrxxxxf.exec:\xrxxxxf.exe22⤵
- Executes dropped EXE
PID:2656 -
\??\c:\nhntbb.exec:\nhntbb.exe23⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jdjpv.exec:\jdjpv.exe24⤵
- Executes dropped EXE
PID:2204 -
\??\c:\lxlxfff.exec:\lxlxfff.exe25⤵
- Executes dropped EXE
PID:2224 -
\??\c:\httthh.exec:\httthh.exe26⤵
- Executes dropped EXE
PID:1728 -
\??\c:\1pddd.exec:\1pddd.exe27⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rrlffxx.exec:\rrlffxx.exe28⤵
- Executes dropped EXE
PID:292 -
\??\c:\5dvvp.exec:\5dvvp.exe29⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vpjvp.exec:\vpjvp.exe30⤵
- Executes dropped EXE
PID:2804 -
\??\c:\lfrrrxf.exec:\lfrrrxf.exe31⤵
- Executes dropped EXE
PID:560 -
\??\c:\5tbbbb.exec:\5tbbbb.exe32⤵
- Executes dropped EXE
PID:2216 -
\??\c:\3flllrr.exec:\3flllrr.exe33⤵
- Executes dropped EXE
PID:1872 -
\??\c:\hthnhh.exec:\hthnhh.exe34⤵
- Executes dropped EXE
PID:2736 -
\??\c:\hthhnt.exec:\hthhnt.exe35⤵
- Executes dropped EXE
PID:1624 -
\??\c:\pdppv.exec:\pdppv.exe36⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xlxxffl.exec:\xlxxffl.exe37⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xlrlrlr.exec:\xlrlrlr.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\9thhnt.exec:\9thhnt.exe39⤵
- Executes dropped EXE
PID:2812 -
\??\c:\nbhtbh.exec:\nbhtbh.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\9jddp.exec:\9jddp.exe41⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vjppp.exec:\vjppp.exe42⤵
- Executes dropped EXE
PID:2600 -
\??\c:\frrrrlr.exec:\frrrrlr.exe43⤵
- Executes dropped EXE
PID:2432 -
\??\c:\tnbntt.exec:\tnbntt.exe44⤵
- Executes dropped EXE
PID:2508 -
\??\c:\dpddj.exec:\dpddj.exe45⤵
- Executes dropped EXE
PID:2480 -
\??\c:\1pdpj.exec:\1pdpj.exe46⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rfxrllr.exec:\rfxrllr.exe47⤵
- Executes dropped EXE
PID:1540 -
\??\c:\rfrllrf.exec:\rfrllrf.exe48⤵
- Executes dropped EXE
PID:1444 -
\??\c:\hbhbnh.exec:\hbhbnh.exe49⤵
- Executes dropped EXE
PID:2652 -
\??\c:\hbnttt.exec:\hbnttt.exe50⤵
- Executes dropped EXE
PID:1864 -
\??\c:\pdddp.exec:\pdddp.exe51⤵
- Executes dropped EXE
PID:1692 -
\??\c:\7vvdd.exec:\7vvdd.exe52⤵
- Executes dropped EXE
PID:316 -
\??\c:\3xlllrr.exec:\3xlllrr.exe53⤵
- Executes dropped EXE
PID:1860 -
\??\c:\hthnnn.exec:\hthnnn.exe54⤵
- Executes dropped EXE
PID:2120 -
\??\c:\hbtttn.exec:\hbtttn.exe55⤵
- Executes dropped EXE
PID:784 -
\??\c:\jdpvd.exec:\jdpvd.exe56⤵
- Executes dropped EXE
PID:1400 -
\??\c:\3fllrlr.exec:\3fllrlr.exe57⤵
- Executes dropped EXE
PID:1196 -
\??\c:\xllflfl.exec:\xllflfl.exe58⤵
- Executes dropped EXE
PID:572 -
\??\c:\hthhhb.exec:\hthhhb.exe59⤵
- Executes dropped EXE
PID:1348 -
\??\c:\tntnbb.exec:\tntnbb.exe60⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pjvvd.exec:\pjvvd.exe61⤵
- Executes dropped EXE
PID:2184 -
\??\c:\pjjpd.exec:\pjjpd.exe62⤵
- Executes dropped EXE
PID:2208 -
\??\c:\frxrxxx.exec:\frxrxxx.exe63⤵
- Executes dropped EXE
PID:2020 -
\??\c:\lfxxllr.exec:\lfxxllr.exe64⤵
- Executes dropped EXE
PID:1768 -
\??\c:\5nhntn.exec:\5nhntn.exe65⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nbnttt.exec:\nbnttt.exe66⤵PID:900
-
\??\c:\pdppj.exec:\pdppj.exe67⤵PID:2916
-
\??\c:\rfxxfxl.exec:\rfxxfxl.exe68⤵PID:1736
-
\??\c:\xllfrrf.exec:\xllfrrf.exe69⤵PID:676
-
\??\c:\nhthbh.exec:\nhthbh.exe70⤵PID:2876
-
\??\c:\dvjjp.exec:\dvjjp.exe71⤵PID:1652
-
\??\c:\9dvvd.exec:\9dvvd.exe72⤵PID:2940
-
\??\c:\frxrrrf.exec:\frxrrrf.exe73⤵PID:1420
-
\??\c:\1rflrrx.exec:\1rflrrx.exe74⤵PID:2124
-
\??\c:\httntn.exec:\httntn.exe75⤵PID:824
-
\??\c:\hbtbhb.exec:\hbtbhb.exe76⤵PID:2956
-
\??\c:\dpddd.exec:\dpddd.exe77⤵PID:1524
-
\??\c:\pjddj.exec:\pjddj.exe78⤵PID:3028
-
\??\c:\xlxxrll.exec:\xlxxrll.exe79⤵PID:3020
-
\??\c:\frxfllr.exec:\frxfllr.exe80⤵PID:2664
-
\??\c:\tnbbnh.exec:\tnbbnh.exe81⤵PID:2820
-
\??\c:\7nbbtn.exec:\7nbbtn.exe82⤵PID:2632
-
\??\c:\jvjpj.exec:\jvjpj.exe83⤵PID:2592
-
\??\c:\7ddvd.exec:\7ddvd.exe84⤵PID:2172
-
\??\c:\rfrrxfl.exec:\rfrrxfl.exe85⤵PID:2428
-
\??\c:\7rfxxxx.exec:\7rfxxxx.exe86⤵PID:2460
-
\??\c:\1nbttn.exec:\1nbttn.exe87⤵PID:2340
-
\??\c:\nbnhtt.exec:\nbnhtt.exe88⤵PID:2168
-
\??\c:\1djdd.exec:\1djdd.exe89⤵PID:1488
-
\??\c:\dvddj.exec:\dvddj.exe90⤵PID:1544
-
\??\c:\frxxfff.exec:\frxxfff.exe91⤵PID:2696
-
\??\c:\hbhhnt.exec:\hbhhnt.exe92⤵PID:2644
-
\??\c:\btnntn.exec:\btnntn.exe93⤵PID:2156
-
\??\c:\pdpjp.exec:\pdpjp.exe94⤵PID:1336
-
\??\c:\3jjpv.exec:\3jjpv.exe95⤵PID:336
-
\??\c:\9fxxxxl.exec:\9fxxxxl.exe96⤵PID:1876
-
\??\c:\xlffrxf.exec:\xlffrxf.exe97⤵PID:1532
-
\??\c:\hbttbb.exec:\hbttbb.exe98⤵PID:2120
-
\??\c:\jvppp.exec:\jvppp.exe99⤵PID:1068
-
\??\c:\5ppdp.exec:\5ppdp.exe100⤵PID:1400
-
\??\c:\xrffllr.exec:\xrffllr.exe101⤵PID:620
-
\??\c:\frflflx.exec:\frflflx.exe102⤵PID:1668
-
\??\c:\3bbhnh.exec:\3bbhnh.exe103⤵PID:1348
-
\??\c:\1hbthh.exec:\1hbthh.exe104⤵PID:2792
-
\??\c:\5dvdp.exec:\5dvdp.exe105⤵PID:2008
-
\??\c:\lfrrrxl.exec:\lfrrrxl.exe106⤵PID:2208
-
\??\c:\rlrrxrx.exec:\rlrrxrx.exe107⤵PID:2528
-
\??\c:\tnbnnt.exec:\tnbnnt.exe108⤵PID:1704
-
\??\c:\hbbbhh.exec:\hbbbhh.exe109⤵PID:1452
-
\??\c:\ddvdv.exec:\ddvdv.exe110⤵PID:2336
-
\??\c:\rlfffxf.exec:\rlfffxf.exe111⤵PID:872
-
\??\c:\9xrrrrx.exec:\9xrrrrx.exe112⤵PID:1468
-
\??\c:\9tthnn.exec:\9tthnn.exe113⤵PID:676
-
\??\c:\vpjdv.exec:\vpjdv.exe114⤵PID:2876
-
\??\c:\jpdjv.exec:\jpdjv.exe115⤵PID:2024
-
\??\c:\lrrlrff.exec:\lrrlrff.exe116⤵PID:1940
-
\??\c:\bthhtt.exec:\bthhtt.exe117⤵PID:1420
-
\??\c:\ttttnt.exec:\ttttnt.exe118⤵PID:1232
-
\??\c:\ddvvv.exec:\ddvvv.exe119⤵PID:1480
-
\??\c:\9pppp.exec:\9pppp.exe120⤵PID:2956
-
\??\c:\xllllrr.exec:\xllllrr.exe121⤵PID:2580
-
\??\c:\bbnnbh.exec:\bbnnbh.exe122⤵PID:2680
-
\??\c:\vpvdd.exec:\vpvdd.exe123⤵PID:1192
-
\??\c:\ppjpp.exec:\ppjpp.exe124⤵PID:2664
-
\??\c:\xxfrrrf.exec:\xxfrrrf.exe125⤵PID:2636
-
\??\c:\5xlfllr.exec:\5xlfllr.exe126⤵PID:2928
-
\??\c:\hbtbhn.exec:\hbtbhn.exe127⤵PID:2476
-
\??\c:\1dvjj.exec:\1dvjj.exe128⤵PID:2600
-
\??\c:\vvdjd.exec:\vvdjd.exe129⤵PID:2328
-
\??\c:\frlllrr.exec:\frlllrr.exe130⤵PID:1772
-
\??\c:\nnnbnt.exec:\nnnbnt.exe131⤵PID:2888
-
\??\c:\nhnnnn.exec:\nhnnnn.exe132⤵PID:2316
-
\??\c:\bnhbnn.exec:\bnhbnn.exe133⤵PID:1540
-
\??\c:\pjppj.exec:\pjppj.exe134⤵PID:1472
-
\??\c:\rfrlrrx.exec:\rfrlrrx.exe135⤵PID:540
-
\??\c:\xrxxllx.exec:\xrxxllx.exe136⤵PID:2532
-
\??\c:\tnhnnh.exec:\tnhnnh.exe137⤵PID:2684
-
\??\c:\5nhbhn.exec:\5nhbhn.exe138⤵PID:1572
-
\??\c:\vvpvd.exec:\vvpvd.exe139⤵PID:1616
-
\??\c:\1jppp.exec:\1jppp.exe140⤵PID:1460
-
\??\c:\rlfxxxf.exec:\rlfxxxf.exe141⤵PID:1020
-
\??\c:\7bbhtb.exec:\7bbhtb.exe142⤵PID:2120
-
\??\c:\nnhhtb.exec:\nnhhtb.exe143⤵PID:2744
-
\??\c:\pjddp.exec:\pjddp.exe144⤵PID:1400
-
\??\c:\ddpdp.exec:\ddpdp.exe145⤵PID:620
-
\??\c:\lfrrflr.exec:\lfrrflr.exe146⤵PID:832
-
\??\c:\fxxfxxx.exec:\fxxfxxx.exe147⤵PID:2392
-
\??\c:\bntbbh.exec:\bntbbh.exe148⤵PID:2788
-
\??\c:\vjvvd.exec:\vjvvd.exe149⤵PID:1384
-
\??\c:\pjddp.exec:\pjddp.exe150⤵PID:2208
-
\??\c:\3rflllr.exec:\3rflllr.exe151⤵PID:2528
-
\??\c:\rlfrffl.exec:\rlfrffl.exe152⤵PID:1008
-
\??\c:\7hnbtn.exec:\7hnbtn.exe153⤵PID:352
-
\??\c:\bnnhht.exec:\bnnhht.exe154⤵PID:1900
-
\??\c:\pdjdv.exec:\pdjdv.exe155⤵PID:872
-
\??\c:\7rfrxff.exec:\7rfrxff.exe156⤵PID:2052
-
\??\c:\fxffffx.exec:\fxffffx.exe157⤵PID:676
-
\??\c:\nhbnth.exec:\nhbnth.exe158⤵PID:560
-
\??\c:\ppjdd.exec:\ppjdd.exe159⤵PID:2024
-
\??\c:\7pjjd.exec:\7pjjd.exe160⤵PID:2032
-
\??\c:\lfrxfrf.exec:\lfrxfrf.exe161⤵PID:2124
-
\??\c:\7lflxlr.exec:\7lflxlr.exe162⤵PID:1516
-
\??\c:\dddpj.exec:\dddpj.exe163⤵PID:1252
-
\??\c:\lfrlxfl.exec:\lfrlxfl.exe164⤵PID:1524
-
\??\c:\7lxxflx.exec:\7lxxflx.exe165⤵PID:3028
-
\??\c:\hbhntb.exec:\hbhntb.exe166⤵PID:3020
-
\??\c:\5hhntt.exec:\5hhntt.exe167⤵PID:2704
-
\??\c:\vdvpj.exec:\vdvpj.exe168⤵PID:2620
-
\??\c:\fxflrrx.exec:\fxflrrx.exe169⤵PID:2808
-
\??\c:\lxrxxrx.exec:\lxrxxrx.exe170⤵PID:2548
-
\??\c:\1nbnbh.exec:\1nbnbh.exe171⤵PID:2928
-
\??\c:\ththnn.exec:\ththnn.exe172⤵PID:2428
-
\??\c:\1dpjj.exec:\1dpjj.exe173⤵PID:2552
-
\??\c:\dpddj.exec:\dpddj.exe174⤵PID:1612
-
\??\c:\3flrffr.exec:\3flrffr.exe175⤵PID:2932
-
\??\c:\hbttbh.exec:\hbttbh.exe176⤵PID:1688
-
\??\c:\9btnnt.exec:\9btnnt.exe177⤵PID:2500
-
\??\c:\pjvjp.exec:\pjvjp.exe178⤵PID:2696
-
\??\c:\3vppv.exec:\3vppv.exe179⤵PID:1012
-
\??\c:\1rxfxfl.exec:\1rxfxfl.exe180⤵PID:2156
-
\??\c:\rfllrrf.exec:\rfllrrf.exe181⤵PID:1560
-
\??\c:\9nbbnt.exec:\9nbbnt.exe182⤵PID:1716
-
\??\c:\thhntb.exec:\thhntb.exe183⤵PID:752
-
\??\c:\vjvvj.exec:\vjvvj.exe184⤵PID:1928
-
\??\c:\frflrrf.exec:\frflrrf.exe185⤵PID:1908
-
\??\c:\rlffrrx.exec:\rlffrrx.exe186⤵PID:760
-
\??\c:\ttthbh.exec:\ttthbh.exe187⤵PID:1128
-
\??\c:\7jvdp.exec:\7jvdp.exe188⤵PID:572
-
\??\c:\dvppj.exec:\dvppj.exe189⤵PID:1628
-
\??\c:\5lxffll.exec:\5lxffll.exe190⤵PID:2468
-
\??\c:\rfrfrrx.exec:\rfrfrrx.exe191⤵PID:2512
-
\??\c:\bnbnnh.exec:\bnbnnh.exe192⤵PID:2188
-
\??\c:\nbnnnt.exec:\nbnnnt.exe193⤵PID:2272
-
\??\c:\dvdjv.exec:\dvdjv.exe194⤵PID:932
-
\??\c:\vpjjv.exec:\vpjjv.exe195⤵PID:2692
-
\??\c:\lfxrffl.exec:\lfxrffl.exe196⤵PID:996
-
\??\c:\lxffrrr.exec:\lxffrrr.exe197⤵PID:896
-
\??\c:\hhhbhn.exec:\hhhbhn.exe198⤵PID:2832
-
\??\c:\ddpvv.exec:\ddpvv.exe199⤵PID:1956
-
\??\c:\jdjjj.exec:\jdjjj.exe200⤵PID:1980
-
\??\c:\rfxfrll.exec:\rfxfrll.exe201⤵PID:2180
-
\??\c:\1xrxfrx.exec:\1xrxfrx.exe202⤵PID:884
-
\??\c:\tntbtn.exec:\tntbtn.exe203⤵PID:1112
-
\??\c:\hhbhbb.exec:\hhbhbb.exe204⤵PID:1964
-
\??\c:\dpddd.exec:\dpddd.exe205⤵PID:1872
-
\??\c:\5pjpj.exec:\5pjpj.exe206⤵PID:2060
-
\??\c:\lfxffxr.exec:\lfxffxr.exe207⤵PID:1480
-
\??\c:\rrffrxf.exec:\rrffrxf.exe208⤵PID:2896
-
\??\c:\btbbhh.exec:\btbbhh.exe209⤵PID:2096
-
\??\c:\3hbhtb.exec:\3hbhtb.exe210⤵PID:2524
-
\??\c:\jdjjj.exec:\jdjjj.exe211⤵PID:3028
-
\??\c:\dvjpd.exec:\dvjpd.exe212⤵PID:2724
-
\??\c:\5frxfxf.exec:\5frxfxf.exe213⤵PID:2584
-
\??\c:\1bnthh.exec:\1bnthh.exe214⤵PID:2628
-
\??\c:\tnbnnb.exec:\tnbnnb.exe215⤵PID:2812
-
\??\c:\ppjpv.exec:\ppjpv.exe216⤵PID:2444
-
\??\c:\9ddpp.exec:\9ddpp.exe217⤵PID:2432
-
\??\c:\rlxxffl.exec:\rlxxffl.exe218⤵PID:2428
-
\??\c:\7lrxxff.exec:\7lrxxff.exe219⤵PID:2508
-
\??\c:\nhtthn.exec:\nhtthn.exe220⤵PID:792
-
\??\c:\5nhnnb.exec:\5nhnnb.exe221⤵PID:1772
-
\??\c:\9vddd.exec:\9vddd.exe222⤵PID:1588
-
\??\c:\xrfffxl.exec:\xrfffxl.exe223⤵PID:748
-
\??\c:\rlllxxl.exec:\rlllxxl.exe224⤵PID:2108
-
\??\c:\nhttbb.exec:\nhttbb.exe225⤵PID:1504
-
\??\c:\nnnnbh.exec:\nnnnbh.exe226⤵PID:1592
-
\??\c:\5vjpp.exec:\5vjpp.exe227⤵PID:1696
-
\??\c:\pjdvv.exec:\pjdvv.exe228⤵PID:1572
-
\??\c:\xlxxffr.exec:\xlxxffr.exe229⤵PID:2100
-
\??\c:\hthhnn.exec:\hthhnn.exe230⤵PID:1460
-
\??\c:\nbtbbh.exec:\nbtbbh.exe231⤵PID:564
-
\??\c:\3vvdd.exec:\3vvdd.exe232⤵PID:2120
-
\??\c:\jdjdp.exec:\jdjdp.exe233⤵PID:2744
-
\??\c:\xlxxxrf.exec:\xlxxxrf.exe234⤵PID:2784
-
\??\c:\llfrffr.exec:\llfrffr.exe235⤵PID:1332
-
\??\c:\nnbhnn.exec:\nnbhnn.exe236⤵PID:2880
-
\??\c:\7nhhtb.exec:\7nhhtb.exe237⤵PID:2392
-
\??\c:\pdvpv.exec:\pdvpv.exe238⤵PID:2792
-
\??\c:\vpddv.exec:\vpddv.exe239⤵PID:1384
-
\??\c:\xrrrflf.exec:\xrrrflf.exe240⤵PID:2020
-
\??\c:\flfflll.exec:\flfflll.exe241⤵PID:1768
-
\??\c:\thntbb.exec:\thntbb.exe242⤵PID:1452