Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 05:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f2791231e18d7b8a6f14e37f84809fa6a1551faacf13aa69be1df33b6e77d7cc.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
f2791231e18d7b8a6f14e37f84809fa6a1551faacf13aa69be1df33b6e77d7cc.exe
-
Size
274KB
-
MD5
014195da2861f1a230f9c43190481bec
-
SHA1
4fa31ccda65766cc95fa62fd625c764df7e33838
-
SHA256
f2791231e18d7b8a6f14e37f84809fa6a1551faacf13aa69be1df33b6e77d7cc
-
SHA512
dbab4603bd842c9046575aeec529d5af6631d0c537b1bdcaaf63a89ad7279ccb8794f6c9f00312e3fd8a54d4efa03ff44d8f05f279e84711025987160c0afd83
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFl:8cm7ImGddXmNt251UriZFl
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/1924-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-58-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2284-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-355-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2404-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-588-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1096-820-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-971-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-1030-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/528-1043-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-1184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/1924-1-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2516-26-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2484-25-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2516-34-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2540-36-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2540-45-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2480-65-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2284-66-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2284-75-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2464-76-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2464-85-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1700-94-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2764-112-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2764-121-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1784-130-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1784-139-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2304-159-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2452-157-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1964-191-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2088-201-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/536-210-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1704-220-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2316-269-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1416-297-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1652-304-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2512-329-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2504-342-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1468-281-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2088-192-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1544-140-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2744-110-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2392-356-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2404-387-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1348-405-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1840-412-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1440-425-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2368-432-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1348-439-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2008-452-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1560-486-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2316-542-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2316-549-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1936-556-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/3024-581-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1528-589-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2428-614-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2412-664-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2488-732-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1964-757-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/652-782-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1096-813-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1096-820-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1416-846-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1652-871-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2544-890-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2828-897-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1520-904-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2284-923-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1884-964-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1884-971-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2460-972-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2024-997-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/528-1043-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1128-1075-0x0000000000400000-0x000000000042A000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
jvjjp.exexxlxflr.exe1hbbbb.exennhnbn.exeppjpv.exelfxxffl.exenhhnnn.exeddvjp.exefxrrxfr.exebbhtbh.exedvjjv.exe9vvvp.exefxfffxf.exeffxxlrf.exepjddj.exepdvpp.exe7frrrxf.exerfxxlxf.exe3hhnnn.exevjjpd.exelfxlxrl.exebtbtbb.exe3pdjj.exe1fxfrxl.exexrfrxfl.exenbtbth.exedpdpd.exevpddv.exefxllxxf.exenhhhnn.exepjdjv.exerlxxxff.exebnhhtt.exejddvd.exe3ppjj.exexlrrxrr.exetntnnh.exehbthnt.exepjjjj.exepjvdj.exelxrffff.exe7nbbbh.exe5djvv.exe9frxffl.exetnhbbh.exe1dppv.exerrfxflx.exetnhthn.exe7frxxxr.exefxlxrxr.exenhtthh.exe1pjjd.exe5llrfrf.exenbhhnn.exeffxfrfr.exe1frrfxf.exetnbbnh.exe5jdpp.exedvjpp.exefxxfffl.exenhbhnn.exebtnbnn.exevpjpp.exerrlrrrl.exepid process 1952 jvjjp.exe 2484 xxlxflr.exe 2516 1hbbbb.exe 2540 nnhnbn.exe 1992 ppjpv.exe 2480 lfxxffl.exe 2284 nhhnnn.exe 2464 ddvjp.exe 1700 fxrrxfr.exe 2656 bbhtbh.exe 2744 dvjjv.exe 2764 9vvvp.exe 1840 fxfffxf.exe 1784 ffxxlrf.exe 1544 pjddj.exe 2452 pdvpp.exe 2304 7frrrxf.exe 2008 rfxxlxf.exe 1340 3hhnnn.exe 1964 vjjpd.exe 2088 lfxlxrl.exe 536 btbtbb.exe 1400 3pdjj.exe 1704 1fxfrxl.exe 1128 xrfrxfl.exe 1872 nbtbth.exe 376 dpdpd.exe 908 vpddv.exe 2316 fxllxxf.exe 1468 nhhhnn.exe 1864 pjdjv.exe 1416 rlxxxff.exe 996 bnhhtt.exe 1652 jddvd.exe 1628 3ppjj.exe 2532 xlrrxrr.exe 2608 tntnnh.exe 2512 hbthnt.exe 2504 pjjjj.exe 2772 pjvdj.exe 2688 lxrffff.exe 2392 7nbbbh.exe 2904 5djvv.exe 2144 9frxffl.exe 2408 tnhbbh.exe 2404 1dppv.exe 2724 rrfxflx.exe 2568 tnhthn.exe 1348 7frxxxr.exe 2764 fxlxrxr.exe 1840 nhtthh.exe 1784 1pjjd.exe 1440 5llrfrf.exe 2368 nbhhnn.exe 2796 ffxfrfr.exe 2240 1frrfxf.exe 2008 tnbbnh.exe 2184 5jdpp.exe 2280 dvjpp.exe 1972 fxxfffl.exe 676 nhbhnn.exe 1560 btnbnn.exe 1564 vpjpp.exe 1904 rrlrrrl.exe -
Processes:
resource yara_rule behavioral1/memory/1924-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-617-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2412-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-757-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-813-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-820-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-846-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-871-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-890-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-897-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-904-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-923-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-964-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-972-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-997-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/528-1043-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-1075-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-1094-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f2791231e18d7b8a6f14e37f84809fa6a1551faacf13aa69be1df33b6e77d7cc.exejvjjp.exexxlxflr.exe1hbbbb.exennhnbn.exeppjpv.exelfxxffl.exenhhnnn.exeddvjp.exefxrrxfr.exebbhtbh.exedvjjv.exe9vvvp.exefxfffxf.exeffxxlrf.exepjddj.exedescription pid process target process PID 1924 wrote to memory of 1952 1924 f2791231e18d7b8a6f14e37f84809fa6a1551faacf13aa69be1df33b6e77d7cc.exe jvjjp.exe PID 1924 wrote to memory of 1952 1924 f2791231e18d7b8a6f14e37f84809fa6a1551faacf13aa69be1df33b6e77d7cc.exe jvjjp.exe PID 1924 wrote to memory of 1952 1924 f2791231e18d7b8a6f14e37f84809fa6a1551faacf13aa69be1df33b6e77d7cc.exe jvjjp.exe PID 1924 wrote to memory of 1952 1924 f2791231e18d7b8a6f14e37f84809fa6a1551faacf13aa69be1df33b6e77d7cc.exe jvjjp.exe PID 1952 wrote to memory of 2484 1952 jvjjp.exe xxlxflr.exe PID 1952 wrote to memory of 2484 1952 jvjjp.exe xxlxflr.exe PID 1952 wrote to memory of 2484 1952 jvjjp.exe xxlxflr.exe PID 1952 wrote to memory of 2484 1952 jvjjp.exe xxlxflr.exe PID 2484 wrote to memory of 2516 2484 xxlxflr.exe 1hbbbb.exe PID 2484 wrote to memory of 2516 2484 xxlxflr.exe 1hbbbb.exe PID 2484 wrote to memory of 2516 2484 xxlxflr.exe 1hbbbb.exe PID 2484 wrote to memory of 2516 2484 xxlxflr.exe 1hbbbb.exe PID 2516 wrote to memory of 2540 2516 1hbbbb.exe nnhnbn.exe PID 2516 wrote to memory of 2540 2516 1hbbbb.exe nnhnbn.exe PID 2516 wrote to memory of 2540 2516 1hbbbb.exe nnhnbn.exe PID 2516 wrote to memory of 2540 2516 1hbbbb.exe nnhnbn.exe PID 2540 wrote to memory of 1992 2540 nnhnbn.exe ppjpv.exe PID 2540 wrote to memory of 1992 2540 nnhnbn.exe ppjpv.exe PID 2540 wrote to memory of 1992 2540 nnhnbn.exe ppjpv.exe PID 2540 wrote to memory of 1992 2540 nnhnbn.exe ppjpv.exe PID 1992 wrote to memory of 2480 1992 ppjpv.exe lfxxffl.exe PID 1992 wrote to memory of 2480 1992 ppjpv.exe lfxxffl.exe PID 1992 wrote to memory of 2480 1992 ppjpv.exe lfxxffl.exe PID 1992 wrote to memory of 2480 1992 ppjpv.exe lfxxffl.exe PID 2480 wrote to memory of 2284 2480 lfxxffl.exe nhhnnn.exe PID 2480 wrote to memory of 2284 2480 lfxxffl.exe nhhnnn.exe PID 2480 wrote to memory of 2284 2480 lfxxffl.exe nhhnnn.exe PID 2480 wrote to memory of 2284 2480 lfxxffl.exe nhhnnn.exe PID 2284 wrote to memory of 2464 2284 nhhnnn.exe ddvjp.exe PID 2284 wrote to memory of 2464 2284 nhhnnn.exe ddvjp.exe PID 2284 wrote to memory of 2464 2284 nhhnnn.exe ddvjp.exe PID 2284 wrote to memory of 2464 2284 nhhnnn.exe ddvjp.exe PID 2464 wrote to memory of 1700 2464 ddvjp.exe fxrrxfr.exe PID 2464 wrote to memory of 1700 2464 ddvjp.exe fxrrxfr.exe PID 2464 wrote to memory of 1700 2464 ddvjp.exe fxrrxfr.exe PID 2464 wrote to memory of 1700 2464 ddvjp.exe fxrrxfr.exe PID 1700 wrote to memory of 2656 1700 fxrrxfr.exe bbhtbh.exe PID 1700 wrote to memory of 2656 1700 fxrrxfr.exe bbhtbh.exe PID 1700 wrote to memory of 2656 1700 fxrrxfr.exe bbhtbh.exe PID 1700 wrote to memory of 2656 1700 fxrrxfr.exe bbhtbh.exe PID 2656 wrote to memory of 2744 2656 bbhtbh.exe dvjjv.exe PID 2656 wrote to memory of 2744 2656 bbhtbh.exe dvjjv.exe PID 2656 wrote to memory of 2744 2656 bbhtbh.exe dvjjv.exe PID 2656 wrote to memory of 2744 2656 bbhtbh.exe dvjjv.exe PID 2744 wrote to memory of 2764 2744 dvjjv.exe 9vvvp.exe PID 2744 wrote to memory of 2764 2744 dvjjv.exe 9vvvp.exe PID 2744 wrote to memory of 2764 2744 dvjjv.exe 9vvvp.exe PID 2744 wrote to memory of 2764 2744 dvjjv.exe 9vvvp.exe PID 2764 wrote to memory of 1840 2764 9vvvp.exe fxfffxf.exe PID 2764 wrote to memory of 1840 2764 9vvvp.exe fxfffxf.exe PID 2764 wrote to memory of 1840 2764 9vvvp.exe fxfffxf.exe PID 2764 wrote to memory of 1840 2764 9vvvp.exe fxfffxf.exe PID 1840 wrote to memory of 1784 1840 fxfffxf.exe ffxxlrf.exe PID 1840 wrote to memory of 1784 1840 fxfffxf.exe ffxxlrf.exe PID 1840 wrote to memory of 1784 1840 fxfffxf.exe ffxxlrf.exe PID 1840 wrote to memory of 1784 1840 fxfffxf.exe ffxxlrf.exe PID 1784 wrote to memory of 1544 1784 ffxxlrf.exe pjddj.exe PID 1784 wrote to memory of 1544 1784 ffxxlrf.exe pjddj.exe PID 1784 wrote to memory of 1544 1784 ffxxlrf.exe pjddj.exe PID 1784 wrote to memory of 1544 1784 ffxxlrf.exe pjddj.exe PID 1544 wrote to memory of 2452 1544 pjddj.exe pdvpp.exe PID 1544 wrote to memory of 2452 1544 pjddj.exe pdvpp.exe PID 1544 wrote to memory of 2452 1544 pjddj.exe pdvpp.exe PID 1544 wrote to memory of 2452 1544 pjddj.exe pdvpp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2791231e18d7b8a6f14e37f84809fa6a1551faacf13aa69be1df33b6e77d7cc.exe"C:\Users\Admin\AppData\Local\Temp\f2791231e18d7b8a6f14e37f84809fa6a1551faacf13aa69be1df33b6e77d7cc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\jvjjp.exec:\jvjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\xxlxflr.exec:\xxlxflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\1hbbbb.exec:\1hbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\nnhnbn.exec:\nnhnbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\ppjpv.exec:\ppjpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\lfxxffl.exec:\lfxxffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\nhhnnn.exec:\nhhnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\ddvjp.exec:\ddvjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\bbhtbh.exec:\bbhtbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\dvjjv.exec:\dvjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\9vvvp.exec:\9vvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\fxfffxf.exec:\fxfffxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\ffxxlrf.exec:\ffxxlrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\pjddj.exec:\pjddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\pdvpp.exec:\pdvpp.exe17⤵
- Executes dropped EXE
PID:2452 -
\??\c:\7frrrxf.exec:\7frrrxf.exe18⤵
- Executes dropped EXE
PID:2304 -
\??\c:\rfxxlxf.exec:\rfxxlxf.exe19⤵
- Executes dropped EXE
PID:2008 -
\??\c:\3hhnnn.exec:\3hhnnn.exe20⤵
- Executes dropped EXE
PID:1340 -
\??\c:\vjjpd.exec:\vjjpd.exe21⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lfxlxrl.exec:\lfxlxrl.exe22⤵
- Executes dropped EXE
PID:2088 -
\??\c:\btbtbb.exec:\btbtbb.exe23⤵
- Executes dropped EXE
PID:536 -
\??\c:\3pdjj.exec:\3pdjj.exe24⤵
- Executes dropped EXE
PID:1400 -
\??\c:\1fxfrxl.exec:\1fxfrxl.exe25⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xrfrxfl.exec:\xrfrxfl.exe26⤵
- Executes dropped EXE
PID:1128 -
\??\c:\nbtbth.exec:\nbtbth.exe27⤵
- Executes dropped EXE
PID:1872 -
\??\c:\dpdpd.exec:\dpdpd.exe28⤵
- Executes dropped EXE
PID:376 -
\??\c:\vpddv.exec:\vpddv.exe29⤵
- Executes dropped EXE
PID:908 -
\??\c:\fxllxxf.exec:\fxllxxf.exe30⤵
- Executes dropped EXE
PID:2316 -
\??\c:\nhhhnn.exec:\nhhhnn.exe31⤵
- Executes dropped EXE
PID:1468 -
\??\c:\pjdjv.exec:\pjdjv.exe32⤵
- Executes dropped EXE
PID:1864 -
\??\c:\rlxxxff.exec:\rlxxxff.exe33⤵
- Executes dropped EXE
PID:1416 -
\??\c:\bnhhtt.exec:\bnhhtt.exe34⤵
- Executes dropped EXE
PID:996 -
\??\c:\jddvd.exec:\jddvd.exe35⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3ppjj.exec:\3ppjj.exe36⤵
- Executes dropped EXE
PID:1628 -
\??\c:\xlrrxrr.exec:\xlrrxrr.exe37⤵
- Executes dropped EXE
PID:2532 -
\??\c:\tntnnh.exec:\tntnnh.exe38⤵
- Executes dropped EXE
PID:2608 -
\??\c:\hbthnt.exec:\hbthnt.exe39⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pjjjj.exec:\pjjjj.exe40⤵
- Executes dropped EXE
PID:2504 -
\??\c:\pjvdj.exec:\pjvdj.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lxrffff.exec:\lxrffff.exe42⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7nbbbh.exec:\7nbbbh.exe43⤵
- Executes dropped EXE
PID:2392 -
\??\c:\5djvv.exec:\5djvv.exe44⤵
- Executes dropped EXE
PID:2904 -
\??\c:\9frxffl.exec:\9frxffl.exe45⤵
- Executes dropped EXE
PID:2144 -
\??\c:\tnhbbh.exec:\tnhbbh.exe46⤵
- Executes dropped EXE
PID:2408 -
\??\c:\1dppv.exec:\1dppv.exe47⤵
- Executes dropped EXE
PID:2404 -
\??\c:\rrfxflx.exec:\rrfxflx.exe48⤵
- Executes dropped EXE
PID:2724 -
\??\c:\tnhthn.exec:\tnhthn.exe49⤵
- Executes dropped EXE
PID:2568 -
\??\c:\7frxxxr.exec:\7frxxxr.exe50⤵
- Executes dropped EXE
PID:1348 -
\??\c:\fxlxrxr.exec:\fxlxrxr.exe51⤵
- Executes dropped EXE
PID:2764 -
\??\c:\nhtthh.exec:\nhtthh.exe52⤵
- Executes dropped EXE
PID:1840 -
\??\c:\1pjjd.exec:\1pjjd.exe53⤵
- Executes dropped EXE
PID:1784 -
\??\c:\5llrfrf.exec:\5llrfrf.exe54⤵
- Executes dropped EXE
PID:1440 -
\??\c:\nbhhnn.exec:\nbhhnn.exe55⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ffxfrfr.exec:\ffxfrfr.exe56⤵
- Executes dropped EXE
PID:2796 -
\??\c:\1frrfxf.exec:\1frrfxf.exe57⤵
- Executes dropped EXE
PID:2240 -
\??\c:\tnbbnh.exec:\tnbbnh.exe58⤵
- Executes dropped EXE
PID:2008 -
\??\c:\5jdpp.exec:\5jdpp.exe59⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dvjpp.exec:\dvjpp.exe60⤵
- Executes dropped EXE
PID:2280 -
\??\c:\fxxfffl.exec:\fxxfffl.exe61⤵
- Executes dropped EXE
PID:1972 -
\??\c:\nhbhnn.exec:\nhbhnn.exe62⤵
- Executes dropped EXE
PID:676 -
\??\c:\btnbnn.exec:\btnbnn.exe63⤵
- Executes dropped EXE
PID:1560 -
\??\c:\vpjpp.exec:\vpjpp.exe64⤵
- Executes dropped EXE
PID:1564 -
\??\c:\rrlrrrl.exec:\rrlrrrl.exe65⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rrlllrr.exec:\rrlllrr.exe66⤵PID:920
-
\??\c:\bthnnn.exec:\bthnnn.exe67⤵PID:1128
-
\??\c:\dvddd.exec:\dvddd.exe68⤵PID:804
-
\??\c:\pjvdj.exec:\pjvdj.exe69⤵PID:1052
-
\??\c:\ffflfll.exec:\ffflfll.exe70⤵PID:2096
-
\??\c:\nhbhhn.exec:\nhbhhn.exe71⤵PID:1636
-
\??\c:\bnbnbh.exec:\bnbnbh.exe72⤵PID:2316
-
\??\c:\pjddj.exec:\pjddj.exe73⤵PID:1936
-
\??\c:\lxrfflf.exec:\lxrfflf.exe74⤵PID:1736
-
\??\c:\ttntnb.exec:\ttntnb.exe75⤵PID:1920
-
\??\c:\hbntbn.exec:\hbntbn.exe76⤵PID:2712
-
\??\c:\dvjpv.exec:\dvjpv.exe77⤵PID:2300
-
\??\c:\jdpdv.exec:\jdpdv.exe78⤵PID:3024
-
\??\c:\lffxxxx.exec:\lffxxxx.exe79⤵PID:1528
-
\??\c:\hhbnbb.exec:\hhbnbb.exe80⤵PID:2484
-
\??\c:\pdjdj.exec:\pdjdj.exe81⤵PID:2536
-
\??\c:\9vjjv.exec:\9vjjv.exe82⤵PID:2608
-
\??\c:\rfffffl.exec:\rfffffl.exe83⤵PID:2428
-
\??\c:\tnnnnn.exec:\tnnnnn.exe84⤵PID:2548
-
\??\c:\7hntbh.exec:\7hntbh.exe85⤵PID:2692
-
\??\c:\pjdjv.exec:\pjdjv.exe86⤵PID:2396
-
\??\c:\jdvdj.exec:\jdvdj.exe87⤵PID:2156
-
\??\c:\flflxlr.exec:\flflxlr.exe88⤵PID:2944
-
\??\c:\5nnbhn.exec:\5nnbhn.exe89⤵PID:760
-
\??\c:\btbnbh.exec:\btbnbh.exe90⤵PID:1984
-
\??\c:\5pjpv.exec:\5pjpv.exe91⤵PID:2412
-
\??\c:\xxlxlrf.exec:\xxlxlrf.exe92⤵PID:2624
-
\??\c:\bthnbb.exec:\bthnbb.exe93⤵PID:2792
-
\??\c:\nnntht.exec:\nnntht.exe94⤵PID:2460
-
\??\c:\jdvvd.exec:\jdvvd.exe95⤵PID:1832
-
\??\c:\ppjjd.exec:\ppjjd.exe96⤵PID:2760
-
\??\c:\fxlrffr.exec:\fxlrffr.exe97⤵PID:2652
-
\??\c:\7rfflrx.exec:\7rfflrx.exe98⤵PID:2640
-
\??\c:\bthntt.exec:\bthntt.exe99⤵PID:2016
-
\??\c:\5jdpp.exec:\5jdpp.exe100⤵PID:2368
-
\??\c:\jpddp.exec:\jpddp.exe101⤵PID:2164
-
\??\c:\llfrxlx.exec:\llfrxlx.exe102⤵PID:2488
-
\??\c:\xxxrxfl.exec:\xxxrxfl.exe103⤵PID:2092
-
\??\c:\nhnnbn.exec:\nhnnbn.exe104⤵PID:2184
-
\??\c:\7vddj.exec:\7vddj.exe105⤵PID:1644
-
\??\c:\ddjvd.exec:\ddjvd.exe106⤵PID:1964
-
\??\c:\jpjjv.exec:\jpjjv.exe107⤵PID:2068
-
\??\c:\lfrxlxl.exec:\lfrxlxl.exe108⤵PID:1388
-
\??\c:\btbntt.exec:\btbntt.exe109⤵PID:2756
-
\??\c:\nnbnbh.exec:\nnbnbh.exe110⤵PID:652
-
\??\c:\ddjpp.exec:\ddjpp.exe111⤵PID:404
-
\??\c:\5vjjp.exec:\5vjjp.exe112⤵PID:2180
-
\??\c:\fffrrff.exec:\fffrrff.exe113⤵PID:1664
-
\??\c:\3nbbhn.exec:\3nbbhn.exe114⤵PID:808
-
\??\c:\nhthnt.exec:\nhthnt.exe115⤵PID:1096
-
\??\c:\5jjjd.exec:\5jjjd.exe116⤵PID:2256
-
\??\c:\ppvpd.exec:\ppvpd.exe117⤵PID:1616
-
\??\c:\rrlflll.exec:\rrlflll.exe118⤵PID:352
-
\??\c:\rrffxlx.exec:\rrffxlx.exe119⤵PID:276
-
\??\c:\nnbntt.exec:\nnbntt.exe120⤵PID:1416
-
\??\c:\dddjd.exec:\dddjd.exe121⤵PID:1624
-
\??\c:\pdppp.exec:\pdppp.exe122⤵PID:2964
-
\??\c:\5lfxfxf.exec:\5lfxfxf.exe123⤵PID:2496
-
\??\c:\nhbhtt.exec:\nhbhtt.exe124⤵PID:1652
-
\??\c:\bbbhnt.exec:\bbbhnt.exe125⤵PID:1628
-
\??\c:\9dvdd.exec:\9dvdd.exe126⤵PID:2492
-
\??\c:\ffxxxxf.exec:\ffxxxxf.exe127⤵PID:2544
-
\??\c:\rlxlrrf.exec:\rlxlrrf.exe128⤵PID:2828
-
\??\c:\bhnbht.exec:\bhnbht.exe129⤵PID:1520
-
\??\c:\djpjj.exec:\djpjj.exe130⤵PID:2416
-
\??\c:\1jvvd.exec:\1jvvd.exe131⤵PID:2552
-
\??\c:\xfrrflr.exec:\xfrrflr.exe132⤵PID:2284
-
\??\c:\9htntt.exec:\9htntt.exe133⤵PID:2912
-
\??\c:\ntbbtn.exec:\ntbbtn.exe134⤵PID:356
-
\??\c:\9vpdv.exec:\9vpdv.exe135⤵PID:2564
-
\??\c:\9pjpd.exec:\9pjpd.exe136⤵PID:2680
-
\??\c:\rflllll.exec:\rflllll.exe137⤵PID:2908
-
\??\c:\nhthnn.exec:\nhthnn.exe138⤵PID:1884
-
\??\c:\jpjpd.exec:\jpjpd.exe139⤵PID:2460
-
\??\c:\9rfrlrx.exec:\9rfrlrx.exe140⤵PID:1220
-
\??\c:\xlxrxll.exec:\xlxrxll.exe141⤵PID:2788
-
\??\c:\nhhbbh.exec:\nhhbbh.exe142⤵PID:1440
-
\??\c:\tbtbbb.exec:\tbtbbb.exe143⤵PID:2024
-
\??\c:\rlfrxxl.exec:\rlfrxxl.exe144⤵PID:2000
-
\??\c:\bbbbnt.exec:\bbbbnt.exe145⤵PID:2028
-
\??\c:\tntbhh.exec:\tntbhh.exe146⤵PID:2140
-
\??\c:\dvppj.exec:\dvppj.exe147⤵PID:1108
-
\??\c:\dvjpv.exec:\dvjpv.exe148⤵PID:1608
-
\??\c:\5fllrll.exec:\5fllrll.exe149⤵PID:1896
-
\??\c:\nhnhnn.exec:\nhnhnn.exe150⤵PID:528
-
\??\c:\vpddj.exec:\vpddj.exe151⤵PID:788
-
\??\c:\7djjj.exec:\7djjj.exe152⤵PID:1392
-
\??\c:\tnhnnt.exec:\tnhnnt.exe153⤵PID:2244
-
\??\c:\7djjj.exec:\7djjj.exe154⤵PID:1476
-
\??\c:\lfflxxl.exec:\lfflxxl.exe155⤵PID:1128
-
\??\c:\xrlrxfl.exec:\xrlrxfl.exe156⤵PID:1452
-
\??\c:\tbnhbn.exec:\tbnhbn.exe157⤵PID:1596
-
\??\c:\jddpd.exec:\jddpd.exe158⤵PID:2124
-
\??\c:\dvjpp.exec:\dvjpp.exe159⤵PID:1096
-
\??\c:\lxxrrxl.exec:\lxxrrxl.exe160⤵PID:2204
-
\??\c:\7lxfxrx.exec:\7lxfxrx.exe161⤵PID:1224
-
\??\c:\3nntnh.exec:\3nntnh.exe162⤵PID:2052
-
\??\c:\dvpvj.exec:\dvpvj.exe163⤵PID:2176
-
\??\c:\djdvv.exec:\djdvv.exe164⤵PID:2808
-
\??\c:\lllxxfl.exec:\lllxxfl.exe165⤵PID:2476
-
\??\c:\1lfxlrx.exec:\1lfxlrx.exe166⤵PID:2600
-
\??\c:\thnnbb.exec:\thnnbb.exe167⤵PID:3024
-
\??\c:\pjddd.exec:\pjddd.exe168⤵PID:2532
-
\??\c:\jjvdv.exec:\jjvdv.exe169⤵PID:2572
-
\??\c:\xflffll.exec:\xflffll.exe170⤵PID:2528
-
\??\c:\ffxrxxf.exec:\ffxrxxf.exe171⤵PID:2596
-
\??\c:\nhbhtb.exec:\nhbhtb.exe172⤵PID:1992
-
\??\c:\9dppv.exec:\9dppv.exe173⤵PID:2524
-
\??\c:\vpdpp.exec:\vpdpp.exe174⤵PID:2416
-
\??\c:\lrrrfxf.exec:\lrrrfxf.exe175⤵PID:1940
-
\??\c:\xxrrxfl.exec:\xxrrxfl.exe176⤵PID:2896
-
\??\c:\3btbtt.exec:\3btbtt.exe177⤵PID:2676
-
\??\c:\btbhnn.exec:\btbhnn.exe178⤵PID:2656
-
\??\c:\3jddv.exec:\3jddv.exe179⤵PID:2628
-
\??\c:\jddjp.exec:\jddjp.exe180⤵PID:1548
-
\??\c:\llxlxxl.exec:\llxlxxl.exe181⤵PID:1508
-
\??\c:\nhtnhh.exec:\nhtnhh.exe182⤵PID:1760
-
\??\c:\tnhthb.exec:\tnhthb.exe183⤵PID:1348
-
\??\c:\vvdjv.exec:\vvdjv.exe184⤵PID:2760
-
\??\c:\9ddjv.exec:\9ddjv.exe185⤵PID:1220
-
\??\c:\xxrrxfl.exec:\xxrrxfl.exe186⤵PID:852
-
\??\c:\7fxxlxf.exec:\7fxxlxf.exe187⤵PID:1672
-
\??\c:\nhtthh.exec:\nhtthh.exe188⤵PID:2992
-
\??\c:\vvvdp.exec:\vvvdp.exe189⤵PID:2164
-
\??\c:\7vpjp.exec:\7vpjp.exe190⤵PID:628
-
\??\c:\xllrxxf.exec:\xllrxxf.exe191⤵PID:2040
-
\??\c:\7rrrlrr.exec:\7rrrlrr.exe192⤵PID:2280
-
\??\c:\hbtbhh.exec:\hbtbhh.exe193⤵PID:1644
-
\??\c:\nhnnnh.exec:\nhnnnh.exe194⤵PID:676
-
\??\c:\1jvjp.exec:\1jvjp.exe195⤵PID:2068
-
\??\c:\5dvpp.exec:\5dvpp.exe196⤵PID:788
-
\??\c:\flfllrf.exec:\flfllrf.exe197⤵PID:2188
-
\??\c:\rxffrlr.exec:\rxffrlr.exe198⤵PID:1772
-
\??\c:\nntnnn.exec:\nntnnn.exe199⤵PID:1568
-
\??\c:\htnnbh.exec:\htnnbh.exe200⤵PID:404
-
\??\c:\vjddj.exec:\vjddj.exe201⤵PID:376
-
\??\c:\dvjjv.exec:\dvjjv.exe202⤵PID:1872
-
\??\c:\fxffrlx.exec:\fxffrlx.exe203⤵PID:1444
-
\??\c:\nbttbn.exec:\nbttbn.exe204⤵PID:2252
-
\??\c:\hhttnn.exec:\hhttnn.exe205⤵PID:1640
-
\??\c:\pvjvj.exec:\pvjvj.exe206⤵PID:2204
-
\??\c:\dvpvp.exec:\dvpvp.exe207⤵PID:352
-
\??\c:\xrlrllf.exec:\xrlrllf.exe208⤵PID:1864
-
\??\c:\5nhntb.exec:\5nhntb.exe209⤵PID:2712
-
\??\c:\tnhhnb.exec:\tnhhnb.exe210⤵PID:996
-
\??\c:\vjjjp.exec:\vjjjp.exe211⤵PID:2084
-
\??\c:\xrxrflr.exec:\xrxrflr.exe212⤵PID:888
-
\??\c:\ffxxxxl.exec:\ffxxxxl.exe213⤵PID:2592
-
\??\c:\thttbt.exec:\thttbt.exe214⤵PID:2064
-
\??\c:\hbnntb.exec:\hbnntb.exe215⤵PID:2536
-
\??\c:\3jjjd.exec:\3jjjd.exe216⤵PID:2604
-
\??\c:\djppd.exec:\djppd.exe217⤵PID:2608
-
\??\c:\lfrxffr.exec:\lfrxffr.exe218⤵PID:2548
-
\??\c:\lrflxfl.exec:\lrflxfl.exe219⤵PID:2432
-
\??\c:\bbttnb.exec:\bbttnb.exe220⤵PID:2448
-
\??\c:\9jvvv.exec:\9jvvv.exe221⤵PID:2416
-
\??\c:\1vppd.exec:\1vppd.exe222⤵PID:2552
-
\??\c:\xlrfrrl.exec:\xlrfrrl.exe223⤵PID:2284
-
\??\c:\1rrxffl.exec:\1rrxffl.exe224⤵PID:1700
-
\??\c:\hbbhnn.exec:\hbbhnn.exe225⤵PID:1984
-
\??\c:\1nntbh.exec:\1nntbh.exe226⤵PID:2732
-
\??\c:\5pvvd.exec:\5pvvd.exe227⤵PID:2720
-
\??\c:\xxflxlf.exec:\xxflxlf.exe228⤵PID:1260
-
\??\c:\5rfrxxf.exec:\5rfrxxf.exe229⤵PID:1604
-
\??\c:\nbntbh.exec:\nbntbh.exe230⤵PID:1240
-
\??\c:\1tbhhn.exec:\1tbhhn.exe231⤵PID:1460
-
\??\c:\vppdj.exec:\vppdj.exe232⤵PID:1592
-
\??\c:\ddjvd.exec:\ddjvd.exe233⤵PID:1440
-
\??\c:\rlxflrx.exec:\rlxflrx.exe234⤵PID:2024
-
\??\c:\3rxfflr.exec:\3rxfflr.exe235⤵PID:2380
-
\??\c:\bthntb.exec:\bthntb.exe236⤵PID:2240
-
\??\c:\9dppd.exec:\9dppd.exe237⤵PID:1932
-
\??\c:\pjjjv.exec:\pjjjv.exe238⤵PID:1108
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe239⤵PID:2224
-
\??\c:\7flflll.exec:\7flflll.exe240⤵PID:2088
-
\??\c:\thttbn.exec:\thttbn.exe241⤵PID:528
-
\??\c:\jvvjv.exec:\jvvjv.exe242⤵PID:1420