Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 05:11
Behavioral task
behavioral1
Sample
f15191b752310f817552401dfa32e3f7f276b018e8f3f97e91d656b1bfa910e7.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
f15191b752310f817552401dfa32e3f7f276b018e8f3f97e91d656b1bfa910e7.exe
-
Size
106KB
-
MD5
205fc2c4dcaa6f0385823c6c7f3c295e
-
SHA1
84588e430ca74312c96f90b94970a8e31f9b3ee7
-
SHA256
f15191b752310f817552401dfa32e3f7f276b018e8f3f97e91d656b1bfa910e7
-
SHA512
9ed7da13ff72712f740fbccffad73f2c08fdf9cf293ee803f1e839424d03da929e9238e3b371bc7fac52c71f63ed234679a57c1dcd7509bdcbf0cfccd0b11787
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66krop7Bcgk:kcm4FmowdHoSphraHcp7yn
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3380-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1832-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/900-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3080-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3368-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4768-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4068-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3880-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3316-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3316-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4216-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2320-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1860-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1712-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4104-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1300-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1900-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/788-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4916-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2636-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2320-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1860-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2388-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3960-487-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4260-516-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3364-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4232-558-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1628-568-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1908-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-611-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-634-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3308-660-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-734-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-844-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-909-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-979-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-989-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3380-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3380-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1832-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\1rxxffl.exe UPX \??\c:\hnttnn.exe UPX C:\nbnnhh.exe UPX behavioral2/memory/900-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2764-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rfrlxxr.exe UPX behavioral2/memory/2764-24-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nbnbtt.exe UPX behavioral2/memory/3080-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1588-33-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\tttbhn.exe UPX behavioral2/memory/3368-39-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\pdjpp.exe UPX behavioral2/memory/4768-44-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4768-47-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xrrlffx.exe UPX behavioral2/memory/4068-50-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7nhhnn.exe UPX behavioral2/memory/4068-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3880-61-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\pjppj.exe UPX behavioral2/memory/3316-63-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xxffxxl.exe UPX behavioral2/memory/3316-69-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\frrlfxr.exe UPX behavioral2/memory/4564-74-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\htbntn.exe UPX behavioral2/memory/2796-81-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5024-83-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pjpdv.exe UPX C:\xffxffx.exe UPX behavioral2/memory/3940-92-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nbbnnh.exe UPX behavioral2/memory/4216-97-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pdvjd.exe UPX behavioral2/memory/2320-104-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2584-105-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jjdpd.exe UPX behavioral2/memory/2584-111-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rflrxxx.exe UPX behavioral2/memory/1860-116-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2844-121-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nnnbtn.exe UPX C:\dvpjp.exe UPX behavioral2/memory/2040-128-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rrrrxrf.exe UPX behavioral2/memory/1712-138-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rlfrxfx.exe UPX behavioral2/memory/3104-145-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nthbbb.exe UPX C:\dpvjd.exe UPX behavioral2/memory/4104-150-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rxrfffl.exe UPX C:\hnhtnh.exe UPX behavioral2/memory/1300-162-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1900-164-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nhhbnh.exe UPX C:\pdjdv.exe UPX behavioral2/memory/2792-175-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xxflxfr.exe UPX behavioral2/memory/3436-182-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
1rxxffl.exehnttnn.exenbnnhh.exerfrlxxr.exenbnbtt.exetttbhn.exepdjpp.exexrrlffx.exe7nhhnn.exepjppj.exexxffxxl.exefrrlfxr.exehtbntn.exepjpdv.exexffxffx.exenbbnnh.exepdvjd.exejjdpd.exerflrxxx.exennnbtn.exedvpjp.exerrrrxrf.exerlfrxfx.exenthbbb.exedpvjd.exerxrfffl.exehnhtnh.exenhhbnh.exepdjdv.exexxflxfr.exerllffxl.exehnhbnh.exe9jvjv.exelrxlfxf.exenhhbhh.exennbnbt.exeppdjv.exerlxrfxf.exelxrxrrf.exennhbtt.exenhhbtt.exe9pvpp.exe3ffrllf.exerllfrrl.exetnbtnn.exevjdvj.exevpdvp.exe3ffxlfl.exelrrfrrf.exennbthn.exebthbnn.exejdpjp.exexllxxrl.exellfxxxx.exethnhbb.exejjjjd.exejdjjj.exexfxrrlf.exebtnnhh.exebtthhb.exevpjvj.exejpddp.exerlfxllf.exebhnbnh.exepid process 1832 1rxxffl.exe 900 hnttnn.exe 2764 nbnnhh.exe 3080 rfrlxxr.exe 1588 nbnbtt.exe 3368 tttbhn.exe 4768 pdjpp.exe 4068 xrrlffx.exe 3880 7nhhnn.exe 3316 pjppj.exe 4564 xxffxxl.exe 2796 frrlfxr.exe 5024 htbntn.exe 3940 pjpdv.exe 4216 xffxffx.exe 2320 nbbnnh.exe 2584 pdvjd.exe 1860 jjdpd.exe 2844 rflrxxx.exe 2040 nnnbtn.exe 1760 dvpjp.exe 1712 rrrrxrf.exe 3104 rlfrxfx.exe 4104 nthbbb.exe 2992 dpvjd.exe 1300 rxrfffl.exe 1900 hnhtnh.exe 1120 nhhbnh.exe 2792 pdjdv.exe 3436 xxflxfr.exe 3312 rllffxl.exe 3484 hnhbnh.exe 4484 9jvjv.exe 4000 lrxlfxf.exe 788 nhhbhh.exe 2824 nnbnbt.exe 2272 ppdjv.exe 4916 rlxrfxf.exe 4396 lxrxrrf.exe 3380 nnhbtt.exe 1832 nhhbtt.exe 2184 9pvpp.exe 900 3ffrllf.exe 2764 rllfrrl.exe 1908 tnbtnn.exe 5092 vjdvj.exe 4932 vpdvp.exe 4976 3ffxlfl.exe 4992 lrrfrrf.exe 4068 nnbthn.exe 2636 bthbnn.exe 1800 jdpjp.exe 4792 xllxxrl.exe 4684 llfxxxx.exe 928 thnhbb.exe 5052 jjjjd.exe 368 jdjjj.exe 3468 xfxrrlf.exe 1456 btnnhh.exe 4868 btthhb.exe 5100 vpjvj.exe 2320 jpddp.exe 1152 rlfxllf.exe 1860 bhnbnh.exe -
Processes:
resource yara_rule behavioral2/memory/3380-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3380-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1832-8-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1rxxffl.exe upx \??\c:\hnttnn.exe upx C:\nbnnhh.exe upx behavioral2/memory/900-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2764-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfrlxxr.exe upx behavioral2/memory/2764-24-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbnbtt.exe upx behavioral2/memory/3080-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1588-33-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tttbhn.exe upx behavioral2/memory/3368-39-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pdjpp.exe upx behavioral2/memory/4768-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4768-47-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrrlffx.exe upx behavioral2/memory/4068-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7nhhnn.exe upx behavioral2/memory/4068-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3880-61-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjppj.exe upx behavioral2/memory/3316-63-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxffxxl.exe upx behavioral2/memory/3316-69-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frrlfxr.exe upx behavioral2/memory/4564-74-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htbntn.exe upx behavioral2/memory/2796-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5024-83-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjpdv.exe upx C:\xffxffx.exe upx behavioral2/memory/3940-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbbnnh.exe upx behavioral2/memory/4216-97-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdvjd.exe upx behavioral2/memory/2320-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2584-105-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjdpd.exe upx behavioral2/memory/2584-111-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rflrxxx.exe upx behavioral2/memory/1860-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2844-121-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnnbtn.exe upx C:\dvpjp.exe upx behavioral2/memory/2040-128-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrrrxrf.exe upx behavioral2/memory/1712-138-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlfrxfx.exe upx behavioral2/memory/3104-145-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nthbbb.exe upx C:\dpvjd.exe upx behavioral2/memory/4104-150-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxrfffl.exe upx C:\hnhtnh.exe upx behavioral2/memory/1300-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1900-164-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhhbnh.exe upx C:\pdjdv.exe upx behavioral2/memory/2792-175-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxflxfr.exe upx behavioral2/memory/3436-182-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f15191b752310f817552401dfa32e3f7f276b018e8f3f97e91d656b1bfa910e7.exe1rxxffl.exehnttnn.exenbnnhh.exerfrlxxr.exenbnbtt.exetttbhn.exepdjpp.exexrrlffx.exe7nhhnn.exepjppj.exexxffxxl.exefrrlfxr.exehtbntn.exepjpdv.exexffxffx.exenbbnnh.exepdvjd.exejjdpd.exerflrxxx.exennnbtn.exedvpjp.exedescription pid process target process PID 3380 wrote to memory of 1832 3380 f15191b752310f817552401dfa32e3f7f276b018e8f3f97e91d656b1bfa910e7.exe 1rxxffl.exe PID 3380 wrote to memory of 1832 3380 f15191b752310f817552401dfa32e3f7f276b018e8f3f97e91d656b1bfa910e7.exe 1rxxffl.exe PID 3380 wrote to memory of 1832 3380 f15191b752310f817552401dfa32e3f7f276b018e8f3f97e91d656b1bfa910e7.exe 1rxxffl.exe PID 1832 wrote to memory of 900 1832 1rxxffl.exe hnttnn.exe PID 1832 wrote to memory of 900 1832 1rxxffl.exe hnttnn.exe PID 1832 wrote to memory of 900 1832 1rxxffl.exe hnttnn.exe PID 900 wrote to memory of 2764 900 hnttnn.exe nbnnhh.exe PID 900 wrote to memory of 2764 900 hnttnn.exe nbnnhh.exe PID 900 wrote to memory of 2764 900 hnttnn.exe nbnnhh.exe PID 2764 wrote to memory of 3080 2764 nbnnhh.exe rfrlxxr.exe PID 2764 wrote to memory of 3080 2764 nbnnhh.exe rfrlxxr.exe PID 2764 wrote to memory of 3080 2764 nbnnhh.exe rfrlxxr.exe PID 3080 wrote to memory of 1588 3080 rfrlxxr.exe nbnbtt.exe PID 3080 wrote to memory of 1588 3080 rfrlxxr.exe nbnbtt.exe PID 3080 wrote to memory of 1588 3080 rfrlxxr.exe nbnbtt.exe PID 1588 wrote to memory of 3368 1588 nbnbtt.exe tttbhn.exe PID 1588 wrote to memory of 3368 1588 nbnbtt.exe tttbhn.exe PID 1588 wrote to memory of 3368 1588 nbnbtt.exe tttbhn.exe PID 3368 wrote to memory of 4768 3368 tttbhn.exe pdjpp.exe PID 3368 wrote to memory of 4768 3368 tttbhn.exe pdjpp.exe PID 3368 wrote to memory of 4768 3368 tttbhn.exe pdjpp.exe PID 4768 wrote to memory of 4068 4768 pdjpp.exe xrrlffx.exe PID 4768 wrote to memory of 4068 4768 pdjpp.exe xrrlffx.exe PID 4768 wrote to memory of 4068 4768 pdjpp.exe xrrlffx.exe PID 4068 wrote to memory of 3880 4068 xrrlffx.exe 7nhhnn.exe PID 4068 wrote to memory of 3880 4068 xrrlffx.exe 7nhhnn.exe PID 4068 wrote to memory of 3880 4068 xrrlffx.exe 7nhhnn.exe PID 3880 wrote to memory of 3316 3880 7nhhnn.exe pjppj.exe PID 3880 wrote to memory of 3316 3880 7nhhnn.exe pjppj.exe PID 3880 wrote to memory of 3316 3880 7nhhnn.exe pjppj.exe PID 3316 wrote to memory of 4564 3316 pjppj.exe xxffxxl.exe PID 3316 wrote to memory of 4564 3316 pjppj.exe xxffxxl.exe PID 3316 wrote to memory of 4564 3316 pjppj.exe xxffxxl.exe PID 4564 wrote to memory of 2796 4564 xxffxxl.exe frrlfxr.exe PID 4564 wrote to memory of 2796 4564 xxffxxl.exe frrlfxr.exe PID 4564 wrote to memory of 2796 4564 xxffxxl.exe frrlfxr.exe PID 2796 wrote to memory of 5024 2796 frrlfxr.exe htbntn.exe PID 2796 wrote to memory of 5024 2796 frrlfxr.exe htbntn.exe PID 2796 wrote to memory of 5024 2796 frrlfxr.exe htbntn.exe PID 5024 wrote to memory of 3940 5024 htbntn.exe pjpdv.exe PID 5024 wrote to memory of 3940 5024 htbntn.exe pjpdv.exe PID 5024 wrote to memory of 3940 5024 htbntn.exe pjpdv.exe PID 3940 wrote to memory of 4216 3940 pjpdv.exe xffxffx.exe PID 3940 wrote to memory of 4216 3940 pjpdv.exe xffxffx.exe PID 3940 wrote to memory of 4216 3940 pjpdv.exe xffxffx.exe PID 4216 wrote to memory of 2320 4216 xffxffx.exe nbbnnh.exe PID 4216 wrote to memory of 2320 4216 xffxffx.exe nbbnnh.exe PID 4216 wrote to memory of 2320 4216 xffxffx.exe nbbnnh.exe PID 2320 wrote to memory of 2584 2320 nbbnnh.exe pdvjd.exe PID 2320 wrote to memory of 2584 2320 nbbnnh.exe pdvjd.exe PID 2320 wrote to memory of 2584 2320 nbbnnh.exe pdvjd.exe PID 2584 wrote to memory of 1860 2584 pdvjd.exe jjdpd.exe PID 2584 wrote to memory of 1860 2584 pdvjd.exe jjdpd.exe PID 2584 wrote to memory of 1860 2584 pdvjd.exe jjdpd.exe PID 1860 wrote to memory of 2844 1860 jjdpd.exe rflrxxx.exe PID 1860 wrote to memory of 2844 1860 jjdpd.exe rflrxxx.exe PID 1860 wrote to memory of 2844 1860 jjdpd.exe rflrxxx.exe PID 2844 wrote to memory of 2040 2844 rflrxxx.exe nnnbtn.exe PID 2844 wrote to memory of 2040 2844 rflrxxx.exe nnnbtn.exe PID 2844 wrote to memory of 2040 2844 rflrxxx.exe nnnbtn.exe PID 2040 wrote to memory of 1760 2040 nnnbtn.exe dvpjp.exe PID 2040 wrote to memory of 1760 2040 nnnbtn.exe dvpjp.exe PID 2040 wrote to memory of 1760 2040 nnnbtn.exe dvpjp.exe PID 1760 wrote to memory of 1712 1760 dvpjp.exe rrrrxrf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f15191b752310f817552401dfa32e3f7f276b018e8f3f97e91d656b1bfa910e7.exe"C:\Users\Admin\AppData\Local\Temp\f15191b752310f817552401dfa32e3f7f276b018e8f3f97e91d656b1bfa910e7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\1rxxffl.exec:\1rxxffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\hnttnn.exec:\hnttnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\nbnnhh.exec:\nbnnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rfrlxxr.exec:\rfrlxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\nbnbtt.exec:\nbnbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\tttbhn.exec:\tttbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\pdjpp.exec:\pdjpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\xrrlffx.exec:\xrrlffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\7nhhnn.exec:\7nhhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\pjppj.exec:\pjppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\xxffxxl.exec:\xxffxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\frrlfxr.exec:\frrlfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\htbntn.exec:\htbntn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\pjpdv.exec:\pjpdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\xffxffx.exec:\xffxffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\nbbnnh.exec:\nbbnnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\pdvjd.exec:\pdvjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\jjdpd.exec:\jjdpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\rflrxxx.exec:\rflrxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\nnnbtn.exec:\nnnbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\dvpjp.exec:\dvpjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\rrrrxrf.exec:\rrrrxrf.exe23⤵
- Executes dropped EXE
PID:1712 -
\??\c:\rlfrxfx.exec:\rlfrxfx.exe24⤵
- Executes dropped EXE
PID:3104 -
\??\c:\nthbbb.exec:\nthbbb.exe25⤵
- Executes dropped EXE
PID:4104 -
\??\c:\dpvjd.exec:\dpvjd.exe26⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rxrfffl.exec:\rxrfffl.exe27⤵
- Executes dropped EXE
PID:1300 -
\??\c:\hnhtnh.exec:\hnhtnh.exe28⤵
- Executes dropped EXE
PID:1900 -
\??\c:\nhhbnh.exec:\nhhbnh.exe29⤵
- Executes dropped EXE
PID:1120 -
\??\c:\pdjdv.exec:\pdjdv.exe30⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xxflxfr.exec:\xxflxfr.exe31⤵
- Executes dropped EXE
PID:3436 -
\??\c:\rllffxl.exec:\rllffxl.exe32⤵
- Executes dropped EXE
PID:3312 -
\??\c:\hnhbnh.exec:\hnhbnh.exe33⤵
- Executes dropped EXE
PID:3484 -
\??\c:\9jvjv.exec:\9jvjv.exe34⤵
- Executes dropped EXE
PID:4484 -
\??\c:\lrxlfxf.exec:\lrxlfxf.exe35⤵
- Executes dropped EXE
PID:4000 -
\??\c:\nhhbhh.exec:\nhhbhh.exe36⤵
- Executes dropped EXE
PID:788 -
\??\c:\nnbnbt.exec:\nnbnbt.exe37⤵
- Executes dropped EXE
PID:2824 -
\??\c:\ppdjv.exec:\ppdjv.exe38⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rlxrfxf.exec:\rlxrfxf.exe39⤵
- Executes dropped EXE
PID:4916 -
\??\c:\lxrxrrf.exec:\lxrxrrf.exe40⤵
- Executes dropped EXE
PID:4396 -
\??\c:\nnhbtt.exec:\nnhbtt.exe41⤵
- Executes dropped EXE
PID:3380 -
\??\c:\nhhbtt.exec:\nhhbtt.exe42⤵
- Executes dropped EXE
PID:1832 -
\??\c:\9pvpp.exec:\9pvpp.exe43⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3ffrllf.exec:\3ffrllf.exe44⤵
- Executes dropped EXE
PID:900 -
\??\c:\rllfrrl.exec:\rllfrrl.exe45⤵
- Executes dropped EXE
PID:2764 -
\??\c:\tnbtnn.exec:\tnbtnn.exe46⤵
- Executes dropped EXE
PID:1908 -
\??\c:\vjdvj.exec:\vjdvj.exe47⤵
- Executes dropped EXE
PID:5092 -
\??\c:\vpdvp.exec:\vpdvp.exe48⤵
- Executes dropped EXE
PID:4932 -
\??\c:\3ffxlfl.exec:\3ffxlfl.exe49⤵
- Executes dropped EXE
PID:4976 -
\??\c:\lrrfrrf.exec:\lrrfrrf.exe50⤵
- Executes dropped EXE
PID:4992 -
\??\c:\nnbthn.exec:\nnbthn.exe51⤵
- Executes dropped EXE
PID:4068 -
\??\c:\bthbnn.exec:\bthbnn.exe52⤵
- Executes dropped EXE
PID:2636 -
\??\c:\jdpjp.exec:\jdpjp.exe53⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xllxxrl.exec:\xllxxrl.exe54⤵
- Executes dropped EXE
PID:4792 -
\??\c:\llfxxxx.exec:\llfxxxx.exe55⤵
- Executes dropped EXE
PID:4684 -
\??\c:\thnhbb.exec:\thnhbb.exe56⤵
- Executes dropped EXE
PID:928 -
\??\c:\jjjjd.exec:\jjjjd.exe57⤵
- Executes dropped EXE
PID:5052 -
\??\c:\jdjjj.exec:\jdjjj.exe58⤵
- Executes dropped EXE
PID:368 -
\??\c:\xfxrrlf.exec:\xfxrrlf.exe59⤵
- Executes dropped EXE
PID:3468 -
\??\c:\btnnhh.exec:\btnnhh.exe60⤵
- Executes dropped EXE
PID:1456 -
\??\c:\btthhb.exec:\btthhb.exe61⤵
- Executes dropped EXE
PID:4868 -
\??\c:\vpjvj.exec:\vpjvj.exe62⤵
- Executes dropped EXE
PID:5100 -
\??\c:\jpddp.exec:\jpddp.exe63⤵
- Executes dropped EXE
PID:2320 -
\??\c:\rlfxllf.exec:\rlfxllf.exe64⤵
- Executes dropped EXE
PID:1152 -
\??\c:\bhnbnh.exec:\bhnbnh.exe65⤵
- Executes dropped EXE
PID:1860 -
\??\c:\bnnhtn.exec:\bnnhtn.exe66⤵PID:4836
-
\??\c:\jdvpp.exec:\jdvpp.exe67⤵PID:1040
-
\??\c:\vddpd.exec:\vddpd.exe68⤵PID:3132
-
\??\c:\7rlfrfx.exec:\7rlfrfx.exe69⤵PID:2176
-
\??\c:\xxlrxfr.exec:\xxlrxfr.exe70⤵PID:2604
-
\??\c:\nhhnhb.exec:\nhhnhb.exe71⤵PID:5116
-
\??\c:\pvdvp.exec:\pvdvp.exe72⤵PID:3100
-
\??\c:\jvpdp.exec:\jvpdp.exe73⤵PID:432
-
\??\c:\xrfxxrr.exec:\xrfxxrr.exe74⤵PID:2532
-
\??\c:\fffxrrl.exec:\fffxrrl.exe75⤵PID:2384
-
\??\c:\ththbb.exec:\ththbb.exe76⤵PID:4160
-
\??\c:\bhnbtn.exec:\bhnbtn.exe77⤵PID:1840
-
\??\c:\jdvpd.exec:\jdvpd.exe78⤵PID:2508
-
\??\c:\jddvv.exec:\jddvv.exe79⤵PID:1084
-
\??\c:\rrllfxf.exec:\rrllfxf.exe80⤵PID:4872
-
\??\c:\3bbnnb.exec:\3bbnnb.exe81⤵PID:3596
-
\??\c:\bhhhtn.exec:\bhhhtn.exe82⤵PID:3488
-
\??\c:\pddpd.exec:\pddpd.exe83⤵PID:1428
-
\??\c:\xrxxllf.exec:\xrxxllf.exe84⤵PID:3304
-
\??\c:\bbbthn.exec:\bbbthn.exe85⤵PID:3632
-
\??\c:\ddpvv.exec:\ddpvv.exe86⤵PID:944
-
\??\c:\ppjvj.exec:\ppjvj.exe87⤵PID:3492
-
\??\c:\rffrffx.exec:\rffrffx.exe88⤵PID:4764
-
\??\c:\xrrfrlr.exec:\xrrfrlr.exe89⤵PID:3508
-
\??\c:\hhbtnn.exec:\hhbtnn.exe90⤵PID:4920
-
\??\c:\pjdpj.exec:\pjdpj.exe91⤵PID:4400
-
\??\c:\vjvpd.exec:\vjvpd.exe92⤵PID:4676
-
\??\c:\lrrlflf.exec:\lrrlflf.exe93⤵PID:3284
-
\??\c:\nbthtn.exec:\nbthtn.exe94⤵PID:3000
-
\??\c:\nttthb.exec:\nttthb.exe95⤵PID:3020
-
\??\c:\djpdp.exec:\djpdp.exe96⤵PID:1476
-
\??\c:\dppjd.exec:\dppjd.exe97⤵PID:2148
-
\??\c:\lfffrfl.exec:\lfffrfl.exe98⤵PID:2764
-
\??\c:\xxrxrlf.exec:\xxrxrlf.exe99⤵PID:1908
-
\??\c:\ttntnt.exec:\ttntnt.exe100⤵PID:3988
-
\??\c:\nnnhbb.exec:\nnnhbb.exe101⤵PID:4768
-
\??\c:\pddpd.exec:\pddpd.exe102⤵PID:2172
-
\??\c:\djjvv.exec:\djjvv.exe103⤵PID:4456
-
\??\c:\fxrlxrr.exec:\fxrlxrr.exe104⤵PID:1724
-
\??\c:\xffxrrl.exec:\xffxrrl.exe105⤵PID:60
-
\??\c:\tbbntt.exec:\tbbntt.exe106⤵PID:4368
-
\??\c:\htbnbh.exec:\htbnbh.exe107⤵PID:2044
-
\??\c:\5ppdv.exec:\5ppdv.exe108⤵PID:780
-
\??\c:\pdvjd.exec:\pdvjd.exe109⤵PID:2788
-
\??\c:\xlxlflf.exec:\xlxlflf.exe110⤵PID:3980
-
\??\c:\bthtnh.exec:\bthtnh.exe111⤵PID:4620
-
\??\c:\nbhhnh.exec:\nbhhnh.exe112⤵PID:3616
-
\??\c:\jppjv.exec:\jppjv.exe113⤵PID:2388
-
\??\c:\lxxlxxr.exec:\lxxlxxr.exe114⤵PID:4324
-
\??\c:\nhbthh.exec:\nhbthh.exe115⤵PID:2900
-
\??\c:\3tbthh.exec:\3tbthh.exe116⤵PID:2132
-
\??\c:\vdvvj.exec:\vdvvj.exe117⤵PID:3612
-
\??\c:\llxlxxl.exec:\llxlxxl.exe118⤵PID:2844
-
\??\c:\lllllxr.exec:\lllllxr.exe119⤵PID:4460
-
\??\c:\tnthtt.exec:\tnthtt.exe120⤵PID:2876
-
\??\c:\vvddp.exec:\vvddp.exe121⤵PID:3960
-
\??\c:\1jdpd.exec:\1jdpd.exe122⤵PID:1904
-
\??\c:\xfxllll.exec:\xfxllll.exe123⤵PID:1260
-
\??\c:\5xrlfrf.exec:\5xrlfrf.exe124⤵PID:560
-
\??\c:\hthbtt.exec:\hthbtt.exe125⤵PID:4952
-
\??\c:\jpjvp.exec:\jpjvp.exe126⤵PID:2288
-
\??\c:\pvvpj.exec:\pvvpj.exe127⤵PID:3252
-
\??\c:\rfxxxlx.exec:\rfxxxlx.exe128⤵PID:3576
-
\??\c:\vvppj.exec:\vvppj.exe129⤵PID:2112
-
\??\c:\rfxxrlf.exec:\rfxxrlf.exe130⤵PID:4260
-
\??\c:\nttnbt.exec:\nttnbt.exe131⤵PID:3364
-
\??\c:\btnbtn.exec:\btnbtn.exe132⤵PID:2672
-
\??\c:\dpddp.exec:\dpddp.exe133⤵PID:2884
-
\??\c:\frrxfrf.exec:\frrxfrf.exe134⤵PID:3040
-
\??\c:\lxlffxx.exec:\lxlffxx.exe135⤵PID:1960
-
\??\c:\3bbtbt.exec:\3bbtbt.exe136⤵PID:3484
-
\??\c:\ppvpj.exec:\ppvpj.exe137⤵PID:4484
-
\??\c:\ddddp.exec:\ddddp.exe138⤵PID:2108
-
\??\c:\rlfxlfx.exec:\rlfxlfx.exe139⤵PID:3128
-
\??\c:\nttnhb.exec:\nttnhb.exe140⤵PID:2272
-
\??\c:\hhbtnn.exec:\hhbtnn.exe141⤵PID:3892
-
\??\c:\dpjdp.exec:\dpjdp.exe142⤵PID:4528
-
\??\c:\frflxlr.exec:\frflxlr.exe143⤵PID:4232
-
\??\c:\llxlxlx.exec:\llxlxlx.exe144⤵PID:332
-
\??\c:\bhhnnb.exec:\bhhnnb.exe145⤵PID:2372
-
\??\c:\thtnbt.exec:\thtnbt.exe146⤵PID:1628
-
\??\c:\vjvpd.exec:\vjvpd.exe147⤵PID:1604
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe148⤵PID:2744
-
\??\c:\xlfllrl.exec:\xlfllrl.exe149⤵PID:1908
-
\??\c:\bthbbh.exec:\bthbbh.exe150⤵PID:216
-
\??\c:\hnnnbb.exec:\hnnnbb.exe151⤵PID:3668
-
\??\c:\pjddv.exec:\pjddv.exe152⤵PID:3880
-
\??\c:\lfffxxf.exec:\lfffxxf.exe153⤵PID:2168
-
\??\c:\frffxxr.exec:\frffxxr.exe154⤵PID:3888
-
\??\c:\nbbtnn.exec:\nbbtnn.exe155⤵PID:4984
-
\??\c:\nttbnh.exec:\nttbnh.exe156⤵PID:4524
-
\??\c:\jvpjd.exec:\jvpjd.exe157⤵PID:1376
-
\??\c:\lxxrlll.exec:\lxxrlll.exe158⤵PID:5000
-
\??\c:\rlflfll.exec:\rlflfll.exe159⤵PID:4940
-
\??\c:\hbtnhb.exec:\hbtnhb.exe160⤵PID:5012
-
\??\c:\dvvvp.exec:\dvvvp.exe161⤵PID:2056
-
\??\c:\1pdpj.exec:\1pdpj.exe162⤵PID:2584
-
\??\c:\xrflxxf.exec:\xrflxxf.exe163⤵PID:2960
-
\??\c:\lffxrlf.exec:\lffxrlf.exe164⤵PID:3372
-
\??\c:\htnhbt.exec:\htnhbt.exe165⤵PID:4212
-
\??\c:\ddjvp.exec:\ddjvp.exe166⤵PID:2580
-
\??\c:\jjvjd.exec:\jjvjd.exe167⤵PID:3068
-
\??\c:\hnbbbb.exec:\hnbbbb.exe168⤵PID:4876
-
\??\c:\bthbnh.exec:\bthbnh.exe169⤵PID:4480
-
\??\c:\jpdpj.exec:\jpdpj.exe170⤵PID:3088
-
\??\c:\pdjdv.exec:\pdjdv.exe171⤵PID:1056
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe172⤵PID:3644
-
\??\c:\xfxrffx.exec:\xfxrffx.exe173⤵PID:4960
-
\??\c:\htttnn.exec:\htttnn.exe174⤵PID:3308
-
\??\c:\pppdp.exec:\pppdp.exe175⤵PID:1816
-
\??\c:\vvjvp.exec:\vvjvp.exe176⤵PID:2524
-
\??\c:\lllflrf.exec:\lllflrf.exe177⤵PID:2792
-
\??\c:\fflflff.exec:\fflflff.exe178⤵PID:4260
-
\??\c:\hbhbtn.exec:\hbhbtn.exe179⤵PID:3200
-
\??\c:\httnhn.exec:\httnhn.exe180⤵PID:3216
-
\??\c:\pjjvv.exec:\pjjvv.exe181⤵PID:752
-
\??\c:\vpjdp.exec:\vpjdp.exe182⤵PID:2200
-
\??\c:\lfrrlff.exec:\lfrrlff.exe183⤵PID:5028
-
\??\c:\nhhhhh.exec:\nhhhhh.exe184⤵PID:4484
-
\??\c:\tnbhhh.exec:\tnbhhh.exe185⤵PID:2096
-
\??\c:\7pjjd.exec:\7pjjd.exe186⤵PID:4392
-
\??\c:\djjdv.exec:\djjdv.exe187⤵PID:3320
-
\??\c:\rflfffl.exec:\rflfffl.exe188⤵PID:4680
-
\??\c:\bnnhbt.exec:\bnnhbt.exe189⤵PID:4856
-
\??\c:\bntnnn.exec:\bntnnn.exe190⤵PID:4612
-
\??\c:\vpjdp.exec:\vpjdp.exe191⤵PID:5112
-
\??\c:\djjdp.exec:\djjdp.exe192⤵PID:2744
-
\??\c:\rlxrfxx.exec:\rlxrfxx.exe193⤵PID:4964
-
\??\c:\rrrlrrl.exec:\rrrlrrl.exe194⤵PID:3580
-
\??\c:\nbnhbt.exec:\nbnhbt.exe195⤵PID:1800
-
\??\c:\htnhbb.exec:\htnhbb.exe196⤵PID:376
-
\??\c:\nnhthh.exec:\nnhthh.exe197⤵PID:2044
-
\??\c:\vvvvj.exec:\vvvvj.exe198⤵PID:3868
-
\??\c:\rfxlxrl.exec:\rfxlxrl.exe199⤵PID:824
-
\??\c:\rxffxrl.exec:\rxffxrl.exe200⤵PID:3468
-
\??\c:\fxlfxrl.exec:\fxlfxrl.exe201⤵PID:3940
-
\??\c:\bhhhbn.exec:\bhhhbn.exe202⤵PID:2388
-
\??\c:\bhhbtt.exec:\bhhbtt.exe203⤵PID:4324
-
\??\c:\jpddv.exec:\jpddv.exe204⤵PID:1256
-
\??\c:\lxllxrx.exec:\lxllxrx.exe205⤵PID:1860
-
\??\c:\ppddp.exec:\ppddp.exe206⤵PID:4212
-
\??\c:\dpvvp.exec:\dpvvp.exe207⤵PID:2856
-
\??\c:\dvjdv.exec:\dvjdv.exe208⤵PID:3132
-
\??\c:\fxxrffx.exec:\fxxrffx.exe209⤵PID:4824
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe210⤵PID:2604
-
\??\c:\ttbnbt.exec:\ttbnbt.exe211⤵PID:3876
-
\??\c:\7hnhbb.exec:\7hnhbb.exe212⤵PID:3592
-
\??\c:\ddvpj.exec:\ddvpj.exe213⤵PID:1388
-
\??\c:\djdpj.exec:\djdpj.exe214⤵PID:3252
-
\??\c:\jdpdj.exec:\jdpdj.exe215⤵PID:4040
-
\??\c:\rlrlxrl.exec:\rlrlxrl.exe216⤵PID:1816
-
\??\c:\xlrrlff.exec:\xlrrlff.exe217⤵PID:2524
-
\??\c:\bthbhh.exec:\bthbhh.exe218⤵PID:2792
-
\??\c:\jjpdv.exec:\jjpdv.exe219⤵PID:4260
-
\??\c:\rfllrxf.exec:\rfllrxf.exe220⤵PID:3200
-
\??\c:\bbhbbt.exec:\bbhbbt.exe221⤵PID:408
-
\??\c:\thnnbh.exec:\thnnbh.exe222⤵PID:752
-
\??\c:\vvvvj.exec:\vvvvj.exe223⤵PID:2176
-
\??\c:\5dvdp.exec:\5dvdp.exe224⤵PID:400
-
\??\c:\rfxrfrf.exec:\rfxrfrf.exe225⤵PID:2824
-
\??\c:\rlrfxrx.exec:\rlrfxrx.exe226⤵PID:64
-
\??\c:\xxfflrx.exec:\xxfflrx.exe227⤵PID:4996
-
\??\c:\7bttht.exec:\7bttht.exe228⤵PID:1396
-
\??\c:\htbhbb.exec:\htbhbb.exe229⤵PID:3284
-
\??\c:\jddvp.exec:\jddvp.exe230⤵PID:1248
-
\??\c:\7jpdv.exec:\7jpdv.exe231⤵PID:3020
-
\??\c:\jdpvv.exec:\jdpvv.exe232⤵PID:1604
-
\??\c:\flrlrll.exec:\flrlrll.exe233⤵PID:3988
-
\??\c:\lflrlxr.exec:\lflrlxr.exe234⤵PID:2172
-
\??\c:\nhbtnn.exec:\nhbtnn.exe235⤵PID:3316
-
\??\c:\bnnnhh.exec:\bnnnhh.exe236⤵PID:1800
-
\??\c:\nnbthh.exec:\nnbthh.exe237⤵PID:4984
-
\??\c:\jddvp.exec:\jddvp.exe238⤵PID:4464
-
\??\c:\7dpjv.exec:\7dpjv.exe239⤵PID:828
-
\??\c:\frxrfxl.exec:\frxrfxl.exe240⤵PID:4620
-
\??\c:\lfxxrxr.exec:\lfxxrxr.exe241⤵PID:2408
-