Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 19:02
Behavioral task
behavioral1
Sample
15719b63f9bf3e3249d036e45101f0bf52b808745f54661b72fbb8157c65dca0.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
15719b63f9bf3e3249d036e45101f0bf52b808745f54661b72fbb8157c65dca0.exe
-
Size
456KB
-
MD5
0b3eca5c87d9f54f6573b036a0af4a5a
-
SHA1
8dd7a52f907cddce7a0912cd4f7b4d66ed4d4b1d
-
SHA256
15719b63f9bf3e3249d036e45101f0bf52b808745f54661b72fbb8157c65dca0
-
SHA512
63b21ef3116d80cce8f536aaf4f6b5086e1e29ddada77dd173d702b01cb596f2dcd69bfe3973fb2f5b81cb0a8dc07b23a1f1a00a8a863970d0c8f117b9ec990e
-
SSDEEP
12288:04wFHoSyd0V3eFp3IDvSbh5nPYERM8mXzplo4M1:rd0gFp3lz1/uzplo9
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/440-6-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1972-9-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4060-13-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4616-19-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2900-25-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/996-36-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2032-38-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3492-45-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3356-50-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2176-60-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1772-66-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4600-72-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3540-83-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2512-99-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4444-105-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4972-107-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4632-117-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4976-121-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3708-126-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1412-132-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4404-142-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1616-139-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4236-148-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2140-163-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/376-186-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1996-189-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4340-201-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3716-204-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1972-208-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3648-215-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1212-229-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2328-233-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4128-237-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2176-257-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/396-261-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3688-265-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/404-272-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/8-276-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4088-280-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1820-288-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3708-313-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4480-317-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4104-327-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1516-331-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4388-335-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4980-363-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/60-374-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2124-400-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3448-438-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1420-443-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3468-455-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2776-526-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1580-564-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2932-568-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4992-572-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4044-582-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4388-598-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4824-620-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3356-660-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3756-713-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2400-729-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4160-784-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3264-1391-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2032-1489-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/440-0-0x0000000000400000-0x0000000000438000-memory.dmp UPX C:\nbtbbb.exe UPX behavioral2/memory/440-6-0x0000000000400000-0x0000000000438000-memory.dmp UPX behavioral2/memory/1972-9-0x0000000000400000-0x0000000000438000-memory.dmp UPX C:\ppvpj.exe UPX behavioral2/memory/4060-13-0x0000000000400000-0x0000000000438000-memory.dmp UPX C:\dvdpv.exe UPX behavioral2/memory/4616-19-0x0000000000400000-0x0000000000438000-memory.dmp UPX C:\rrflffx.exe UPX behavioral2/memory/2900-25-0x0000000000400000-0x0000000000438000-memory.dmp UPX C:\tbnhnn.exe UPX \??\c:\3ddvd.exe UPX behavioral2/memory/996-36-0x0000000000400000-0x0000000000438000-memory.dmp UPX behavioral2/memory/2032-38-0x0000000000400000-0x0000000000438000-memory.dmp UPX C:\fxlflfl.exe UPX C:\ppvpd.exe UPX behavioral2/memory/3492-45-0x0000000000400000-0x0000000000438000-memory.dmp UPX behavioral2/memory/3356-50-0x0000000000400000-0x0000000000438000-memory.dmp UPX C:\llrllxx.exe UPX C:\ppddj.exe UPX behavioral2/memory/2176-60-0x0000000000400000-0x0000000000438000-memory.dmp UPX behavioral2/memory/1772-66-0x0000000000400000-0x0000000000438000-memory.dmp UPX \??\c:\5pvpp.exe UPX C:\frrrlrr.exe UPX behavioral2/memory/4600-72-0x0000000000400000-0x0000000000438000-memory.dmp UPX C:\jvpjd.exe UPX C:\lllxrrl.exe UPX behavioral2/memory/3540-83-0x0000000000400000-0x0000000000438000-memory.dmp UPX \??\c:\hnnhbb.exe UPX C:\lxllxfl.exe UPX C:\9ffxxxf.exe UPX behavioral2/memory/2512-99-0x0000000000400000-0x0000000000438000-memory.dmp UPX behavioral2/memory/4444-100-0x0000000000400000-0x0000000000438000-memory.dmp UPX \??\c:\xxfxffr.exe UPX behavioral2/memory/4444-105-0x0000000000400000-0x0000000000438000-memory.dmp UPX behavioral2/memory/4972-107-0x0000000000400000-0x0000000000438000-memory.dmp UPX C:\5ppjv.exe UPX C:\9ntthh.exe UPX behavioral2/memory/4632-117-0x0000000000400000-0x0000000000438000-memory.dmp UPX C:\9jpjd.exe UPX behavioral2/memory/4976-121-0x0000000000400000-0x0000000000438000-memory.dmp UPX C:\rfrlffx.exe UPX behavioral2/memory/3708-126-0x0000000000400000-0x0000000000438000-memory.dmp UPX behavioral2/memory/1412-132-0x0000000000400000-0x0000000000438000-memory.dmp UPX C:\vjjpd.exe UPX behavioral2/memory/4404-142-0x0000000000400000-0x0000000000438000-memory.dmp UPX behavioral2/memory/1616-139-0x0000000000400000-0x0000000000438000-memory.dmp UPX \??\c:\9nnbtn.exe UPX C:\3hbtnh.exe UPX behavioral2/memory/4236-148-0x0000000000400000-0x0000000000438000-memory.dmp UPX C:\rlffxxx.exe UPX C:\httttt.exe UPX behavioral2/memory/2140-163-0x0000000000400000-0x0000000000438000-memory.dmp UPX \??\c:\vjdvp.exe UPX \??\c:\5fxrlrl.exe UPX C:\nhhhbb.exe UPX C:\frxxrff.exe UPX C:\pdpdj.exe UPX behavioral2/memory/376-186-0x0000000000400000-0x0000000000438000-memory.dmp UPX behavioral2/memory/1996-189-0x0000000000400000-0x0000000000438000-memory.dmp UPX behavioral2/memory/2424-193-0x0000000000400000-0x0000000000438000-memory.dmp UPX behavioral2/memory/4340-201-0x0000000000400000-0x0000000000438000-memory.dmp UPX behavioral2/memory/3716-204-0x0000000000400000-0x0000000000438000-memory.dmp UPX behavioral2/memory/1972-208-0x0000000000400000-0x0000000000438000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
nbtbbb.exeppvpj.exedvdpv.exerrflffx.exetbnhnn.exe3ddvd.exefxlflfl.exeppvpd.exellrllxx.exeppddj.exe5pvpp.exefrrrlrr.exejvpjd.exelllxrrl.exehnnhbb.exelxllxfl.exe9ffxxxf.exexxfxffr.exe5ppjv.exe9ntthh.exe9jpjd.exerfrlffx.exe9nnbtn.exevjjpd.exe3hbtnh.exerlffxxx.exehttttt.exevjdvp.exe5fxrlrl.exenhhhbb.exefrxxrff.exepdpdj.exe7ppjd.exelxxrffx.exehhhbbb.exebthbhh.exejvvdp.exexrlllff.exelflfllr.exe5tbbbb.exepdjvj.exedjjdv.exeflrlxxx.exenbnhtt.exebttthh.exejpdpd.exerrrrlrr.exetnbthn.exebttnhb.exepppvp.exelrlxrrr.exe9tbttt.exevppjd.exexxrrxlf.exexllfxxr.exe9nnhbb.exetntttt.exejdppd.exefrrlxxf.exerxxrrrr.exe1tbtnn.exevdjjj.exerffxxxf.exelfrrffx.exepid process 1972 nbtbbb.exe 4060 ppvpj.exe 4616 dvdpv.exe 2900 rrflffx.exe 996 tbnhnn.exe 2032 3ddvd.exe 3492 fxlflfl.exe 3356 ppvpd.exe 2604 llrllxx.exe 2176 ppddj.exe 1772 5pvpp.exe 4600 frrrlrr.exe 4468 jvpjd.exe 3540 lllxrrl.exe 2584 hnnhbb.exe 2512 lxllxfl.exe 4444 9ffxxxf.exe 4972 xxfxffr.exe 4632 5ppjv.exe 4976 9ntthh.exe 3708 9jpjd.exe 1412 rfrlffx.exe 1616 9nnbtn.exe 4404 vjjpd.exe 4236 3hbtnh.exe 1560 rlffxxx.exe 3724 httttt.exe 2140 vjdvp.exe 624 5fxrlrl.exe 4816 nhhhbb.exe 1168 frxxrff.exe 376 pdpdj.exe 1996 7ppjd.exe 2424 lxxrffx.exe 3804 hhhbbb.exe 4340 bthbhh.exe 3716 jvvdp.exe 1972 xrlllff.exe 1532 lflfllr.exe 3648 5tbbbb.exe 3192 pdjvj.exe 1160 djjdv.exe 1212 flrlxxx.exe 2328 nbnhtt.exe 4128 bttthh.exe 2032 jpdpd.exe 856 rrrrlrr.exe 3356 tnbthn.exe 3316 bttnhb.exe 1156 pppvp.exe 2176 lrlxrrr.exe 396 9tbttt.exe 3688 vppjd.exe 4600 xxrrxlf.exe 404 xllfxxr.exe 8 9nnhbb.exe 3836 tntttt.exe 4088 jdppd.exe 436 frrlxxf.exe 1820 rxxrrrr.exe 1420 1tbtnn.exe 2700 vdjjj.exe 4080 rffxxxf.exe 1520 lfrrffx.exe -
Processes:
resource yara_rule behavioral2/memory/440-0-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\nbtbbb.exe upx behavioral2/memory/440-6-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/1972-9-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\ppvpj.exe upx behavioral2/memory/4060-13-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\dvdpv.exe upx behavioral2/memory/4616-19-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\rrflffx.exe upx behavioral2/memory/2900-25-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\tbnhnn.exe upx \??\c:\3ddvd.exe upx behavioral2/memory/996-36-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/2032-38-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\fxlflfl.exe upx C:\ppvpd.exe upx behavioral2/memory/3492-45-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/3356-50-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\llrllxx.exe upx C:\ppddj.exe upx behavioral2/memory/2176-60-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/1772-66-0x0000000000400000-0x0000000000438000-memory.dmp upx \??\c:\5pvpp.exe upx C:\frrrlrr.exe upx behavioral2/memory/4600-72-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\jvpjd.exe upx C:\lllxrrl.exe upx behavioral2/memory/3540-83-0x0000000000400000-0x0000000000438000-memory.dmp upx \??\c:\hnnhbb.exe upx C:\lxllxfl.exe upx C:\9ffxxxf.exe upx behavioral2/memory/2512-99-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/4444-100-0x0000000000400000-0x0000000000438000-memory.dmp upx \??\c:\xxfxffr.exe upx behavioral2/memory/4444-105-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/4972-107-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\5ppjv.exe upx C:\9ntthh.exe upx behavioral2/memory/4632-117-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\9jpjd.exe upx behavioral2/memory/4976-121-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\rfrlffx.exe upx behavioral2/memory/3708-126-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/1412-132-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\vjjpd.exe upx behavioral2/memory/4404-142-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/1616-139-0x0000000000400000-0x0000000000438000-memory.dmp upx \??\c:\9nnbtn.exe upx C:\3hbtnh.exe upx behavioral2/memory/4236-148-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\rlffxxx.exe upx C:\httttt.exe upx behavioral2/memory/2140-163-0x0000000000400000-0x0000000000438000-memory.dmp upx \??\c:\vjdvp.exe upx \??\c:\5fxrlrl.exe upx C:\nhhhbb.exe upx C:\frxxrff.exe upx C:\pdpdj.exe upx behavioral2/memory/376-186-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/1996-189-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/2424-193-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/4340-201-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/3716-204-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/1972-208-0x0000000000400000-0x0000000000438000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
15719b63f9bf3e3249d036e45101f0bf52b808745f54661b72fbb8157c65dca0.exenbtbbb.exeppvpj.exedvdpv.exerrflffx.exetbnhnn.exe3ddvd.exefxlflfl.exeppvpd.exellrllxx.exeppddj.exe5pvpp.exefrrrlrr.exejvpjd.exelllxrrl.exehnnhbb.exelxllxfl.exe9ffxxxf.exexxfxffr.exe5ppjv.exe9ntthh.exe9jpjd.exedescription pid process target process PID 440 wrote to memory of 1972 440 15719b63f9bf3e3249d036e45101f0bf52b808745f54661b72fbb8157c65dca0.exe nbtbbb.exe PID 440 wrote to memory of 1972 440 15719b63f9bf3e3249d036e45101f0bf52b808745f54661b72fbb8157c65dca0.exe nbtbbb.exe PID 440 wrote to memory of 1972 440 15719b63f9bf3e3249d036e45101f0bf52b808745f54661b72fbb8157c65dca0.exe nbtbbb.exe PID 1972 wrote to memory of 4060 1972 nbtbbb.exe ppvpj.exe PID 1972 wrote to memory of 4060 1972 nbtbbb.exe ppvpj.exe PID 1972 wrote to memory of 4060 1972 nbtbbb.exe ppvpj.exe PID 4060 wrote to memory of 4616 4060 ppvpj.exe dvdpv.exe PID 4060 wrote to memory of 4616 4060 ppvpj.exe dvdpv.exe PID 4060 wrote to memory of 4616 4060 ppvpj.exe dvdpv.exe PID 4616 wrote to memory of 2900 4616 dvdpv.exe rrflffx.exe PID 4616 wrote to memory of 2900 4616 dvdpv.exe rrflffx.exe PID 4616 wrote to memory of 2900 4616 dvdpv.exe rrflffx.exe PID 2900 wrote to memory of 996 2900 rrflffx.exe tbnhnn.exe PID 2900 wrote to memory of 996 2900 rrflffx.exe tbnhnn.exe PID 2900 wrote to memory of 996 2900 rrflffx.exe tbnhnn.exe PID 996 wrote to memory of 2032 996 tbnhnn.exe 3ddvd.exe PID 996 wrote to memory of 2032 996 tbnhnn.exe 3ddvd.exe PID 996 wrote to memory of 2032 996 tbnhnn.exe 3ddvd.exe PID 2032 wrote to memory of 3492 2032 3ddvd.exe fxlflfl.exe PID 2032 wrote to memory of 3492 2032 3ddvd.exe fxlflfl.exe PID 2032 wrote to memory of 3492 2032 3ddvd.exe fxlflfl.exe PID 3492 wrote to memory of 3356 3492 fxlflfl.exe ppvpd.exe PID 3492 wrote to memory of 3356 3492 fxlflfl.exe ppvpd.exe PID 3492 wrote to memory of 3356 3492 fxlflfl.exe ppvpd.exe PID 3356 wrote to memory of 2604 3356 ppvpd.exe llrllxx.exe PID 3356 wrote to memory of 2604 3356 ppvpd.exe llrllxx.exe PID 3356 wrote to memory of 2604 3356 ppvpd.exe llrllxx.exe PID 2604 wrote to memory of 2176 2604 llrllxx.exe ppddj.exe PID 2604 wrote to memory of 2176 2604 llrllxx.exe ppddj.exe PID 2604 wrote to memory of 2176 2604 llrllxx.exe ppddj.exe PID 2176 wrote to memory of 1772 2176 ppddj.exe 5pvpp.exe PID 2176 wrote to memory of 1772 2176 ppddj.exe 5pvpp.exe PID 2176 wrote to memory of 1772 2176 ppddj.exe 5pvpp.exe PID 1772 wrote to memory of 4600 1772 5pvpp.exe frrrlrr.exe PID 1772 wrote to memory of 4600 1772 5pvpp.exe frrrlrr.exe PID 1772 wrote to memory of 4600 1772 5pvpp.exe frrrlrr.exe PID 4600 wrote to memory of 4468 4600 frrrlrr.exe jvpjd.exe PID 4600 wrote to memory of 4468 4600 frrrlrr.exe jvpjd.exe PID 4600 wrote to memory of 4468 4600 frrrlrr.exe jvpjd.exe PID 4468 wrote to memory of 3540 4468 jvpjd.exe lllxrrl.exe PID 4468 wrote to memory of 3540 4468 jvpjd.exe lllxrrl.exe PID 4468 wrote to memory of 3540 4468 jvpjd.exe lllxrrl.exe PID 3540 wrote to memory of 2584 3540 lllxrrl.exe hnnhbb.exe PID 3540 wrote to memory of 2584 3540 lllxrrl.exe hnnhbb.exe PID 3540 wrote to memory of 2584 3540 lllxrrl.exe hnnhbb.exe PID 2584 wrote to memory of 2512 2584 hnnhbb.exe lxllxfl.exe PID 2584 wrote to memory of 2512 2584 hnnhbb.exe lxllxfl.exe PID 2584 wrote to memory of 2512 2584 hnnhbb.exe lxllxfl.exe PID 2512 wrote to memory of 4444 2512 lxllxfl.exe 9ffxxxf.exe PID 2512 wrote to memory of 4444 2512 lxllxfl.exe 9ffxxxf.exe PID 2512 wrote to memory of 4444 2512 lxllxfl.exe 9ffxxxf.exe PID 4444 wrote to memory of 4972 4444 9ffxxxf.exe xxfxffr.exe PID 4444 wrote to memory of 4972 4444 9ffxxxf.exe xxfxffr.exe PID 4444 wrote to memory of 4972 4444 9ffxxxf.exe xxfxffr.exe PID 4972 wrote to memory of 4632 4972 xxfxffr.exe 5ppjv.exe PID 4972 wrote to memory of 4632 4972 xxfxffr.exe 5ppjv.exe PID 4972 wrote to memory of 4632 4972 xxfxffr.exe 5ppjv.exe PID 4632 wrote to memory of 4976 4632 5ppjv.exe 9ntthh.exe PID 4632 wrote to memory of 4976 4632 5ppjv.exe 9ntthh.exe PID 4632 wrote to memory of 4976 4632 5ppjv.exe 9ntthh.exe PID 4976 wrote to memory of 3708 4976 9ntthh.exe 9jpjd.exe PID 4976 wrote to memory of 3708 4976 9ntthh.exe 9jpjd.exe PID 4976 wrote to memory of 3708 4976 9ntthh.exe 9jpjd.exe PID 3708 wrote to memory of 1412 3708 9jpjd.exe rfrlffx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15719b63f9bf3e3249d036e45101f0bf52b808745f54661b72fbb8157c65dca0.exe"C:\Users\Admin\AppData\Local\Temp\15719b63f9bf3e3249d036e45101f0bf52b808745f54661b72fbb8157c65dca0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\nbtbbb.exec:\nbtbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\ppvpj.exec:\ppvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\dvdpv.exec:\dvdpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\rrflffx.exec:\rrflffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\tbnhnn.exec:\tbnhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\3ddvd.exec:\3ddvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\fxlflfl.exec:\fxlflfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\ppvpd.exec:\ppvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\llrllxx.exec:\llrllxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\ppddj.exec:\ppddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\5pvpp.exec:\5pvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\frrrlrr.exec:\frrrlrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\jvpjd.exec:\jvpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\lllxrrl.exec:\lllxrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\hnnhbb.exec:\hnnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\lxllxfl.exec:\lxllxfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\9ffxxxf.exec:\9ffxxxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\xxfxffr.exec:\xxfxffr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\5ppjv.exec:\5ppjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\9ntthh.exec:\9ntthh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\9jpjd.exec:\9jpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\rfrlffx.exec:\rfrlffx.exe23⤵
- Executes dropped EXE
PID:1412 -
\??\c:\9nnbtn.exec:\9nnbtn.exe24⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vjjpd.exec:\vjjpd.exe25⤵
- Executes dropped EXE
PID:4404 -
\??\c:\3hbtnh.exec:\3hbtnh.exe26⤵
- Executes dropped EXE
PID:4236 -
\??\c:\rlffxxx.exec:\rlffxxx.exe27⤵
- Executes dropped EXE
PID:1560 -
\??\c:\httttt.exec:\httttt.exe28⤵
- Executes dropped EXE
PID:3724 -
\??\c:\vjdvp.exec:\vjdvp.exe29⤵
- Executes dropped EXE
PID:2140 -
\??\c:\5fxrlrl.exec:\5fxrlrl.exe30⤵
- Executes dropped EXE
PID:624 -
\??\c:\nhhhbb.exec:\nhhhbb.exe31⤵
- Executes dropped EXE
PID:4816 -
\??\c:\frxxrff.exec:\frxxrff.exe32⤵
- Executes dropped EXE
PID:1168 -
\??\c:\pdpdj.exec:\pdpdj.exe33⤵
- Executes dropped EXE
PID:376 -
\??\c:\7ppjd.exec:\7ppjd.exe34⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lxxrffx.exec:\lxxrffx.exe35⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hhhbbb.exec:\hhhbbb.exe36⤵
- Executes dropped EXE
PID:3804 -
\??\c:\bthbhh.exec:\bthbhh.exe37⤵
- Executes dropped EXE
PID:4340 -
\??\c:\jvvdp.exec:\jvvdp.exe38⤵
- Executes dropped EXE
PID:3716 -
\??\c:\xrlllff.exec:\xrlllff.exe39⤵
- Executes dropped EXE
PID:1972 -
\??\c:\lflfllr.exec:\lflfllr.exe40⤵
- Executes dropped EXE
PID:1532 -
\??\c:\5tbbbb.exec:\5tbbbb.exe41⤵
- Executes dropped EXE
PID:3648 -
\??\c:\pdjvj.exec:\pdjvj.exe42⤵
- Executes dropped EXE
PID:3192 -
\??\c:\djjdv.exec:\djjdv.exe43⤵
- Executes dropped EXE
PID:1160 -
\??\c:\flrlxxx.exec:\flrlxxx.exe44⤵
- Executes dropped EXE
PID:1212 -
\??\c:\nbnhtt.exec:\nbnhtt.exe45⤵
- Executes dropped EXE
PID:2328 -
\??\c:\bttthh.exec:\bttthh.exe46⤵
- Executes dropped EXE
PID:4128 -
\??\c:\jpdpd.exec:\jpdpd.exe47⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rrrrlrr.exec:\rrrrlrr.exe48⤵
- Executes dropped EXE
PID:856 -
\??\c:\tnbthn.exec:\tnbthn.exe49⤵
- Executes dropped EXE
PID:3356 -
\??\c:\bttnhb.exec:\bttnhb.exe50⤵
- Executes dropped EXE
PID:3316 -
\??\c:\pppvp.exec:\pppvp.exe51⤵
- Executes dropped EXE
PID:1156 -
\??\c:\lrlxrrr.exec:\lrlxrrr.exe52⤵
- Executes dropped EXE
PID:2176 -
\??\c:\9tbttt.exec:\9tbttt.exe53⤵
- Executes dropped EXE
PID:396 -
\??\c:\vppjd.exec:\vppjd.exe54⤵
- Executes dropped EXE
PID:3688 -
\??\c:\xxrrxlf.exec:\xxrrxlf.exe55⤵
- Executes dropped EXE
PID:4600 -
\??\c:\xllfxxr.exec:\xllfxxr.exe56⤵
- Executes dropped EXE
PID:404 -
\??\c:\9nnhbb.exec:\9nnhbb.exe57⤵
- Executes dropped EXE
PID:8 -
\??\c:\tntttt.exec:\tntttt.exe58⤵
- Executes dropped EXE
PID:3836 -
\??\c:\jdppd.exec:\jdppd.exe59⤵
- Executes dropped EXE
PID:4088 -
\??\c:\frrlxxf.exec:\frrlxxf.exe60⤵
- Executes dropped EXE
PID:436 -
\??\c:\rxxrrrr.exec:\rxxrrrr.exe61⤵
- Executes dropped EXE
PID:1820 -
\??\c:\1tbtnn.exec:\1tbtnn.exe62⤵
- Executes dropped EXE
PID:1420 -
\??\c:\vdjjj.exec:\vdjjj.exe63⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rffxxxf.exec:\rffxxxf.exe64⤵
- Executes dropped EXE
PID:4080 -
\??\c:\lfrrffx.exec:\lfrrffx.exe65⤵
- Executes dropped EXE
PID:1520 -
\??\c:\btbttn.exec:\btbttn.exe66⤵PID:2016
-
\??\c:\pdjdd.exec:\pdjdd.exe67⤵PID:4976
-
\??\c:\fxxfxxx.exec:\fxxfxxx.exe68⤵PID:3708
-
\??\c:\nbbnnh.exec:\nbbnnh.exe69⤵PID:3224
-
\??\c:\vvpjv.exec:\vvpjv.exe70⤵PID:4480
-
\??\c:\ffflxff.exec:\ffflxff.exe71⤵PID:2856
-
\??\c:\tbhhbb.exec:\tbhhbb.exe72⤵PID:4104
-
\??\c:\3hhtth.exec:\3hhtth.exe73⤵PID:1516
-
\??\c:\jdvjd.exec:\jdvjd.exe74⤵PID:4388
-
\??\c:\5xfxllf.exec:\5xfxllf.exe75⤵PID:3160
-
\??\c:\btnnhb.exec:\btnnhb.exe76⤵PID:1884
-
\??\c:\xffxlfx.exec:\xffxlfx.exe77⤵PID:624
-
\??\c:\bbbbhb.exec:\bbbbhb.exe78⤵PID:2248
-
\??\c:\9nhthb.exec:\9nhthb.exe79⤵PID:1176
-
\??\c:\ppjdd.exec:\ppjdd.exe80⤵PID:2348
-
\??\c:\vdvjd.exec:\vdvjd.exe81⤵PID:5076
-
\??\c:\xfrfrlx.exec:\xfrfrlx.exe82⤵PID:2332
-
\??\c:\hbhtht.exec:\hbhtht.exe83⤵PID:3772
-
\??\c:\9hbtbt.exec:\9hbtbt.exe84⤵PID:4980
-
\??\c:\3vpdp.exec:\3vpdp.exe85⤵PID:2784
-
\??\c:\xxlflfr.exec:\xxlflfr.exe86⤵PID:5108
-
\??\c:\llrflfr.exec:\llrflfr.exe87⤵PID:4092
-
\??\c:\5hbhth.exec:\5hbhth.exe88⤵PID:60
-
\??\c:\hhnhnh.exec:\hhnhnh.exe89⤵PID:1956
-
\??\c:\jvjjd.exec:\jvjjd.exe90⤵PID:2748
-
\??\c:\rfxlrlx.exec:\rfxlrlx.exe91⤵PID:3616
-
\??\c:\bbthtb.exec:\bbthtb.exe92⤵PID:4064
-
\??\c:\9nthht.exec:\9nthht.exe93⤵PID:4904
-
\??\c:\ppvpj.exec:\ppvpj.exe94⤵PID:3492
-
\??\c:\1djdv.exec:\1djdv.exe95⤵PID:2124
-
\??\c:\rfrlrfl.exec:\rfrlrfl.exe96⤵PID:2024
-
\??\c:\tttnnn.exec:\tttnnn.exe97⤵PID:4544
-
\??\c:\1bbtnt.exec:\1bbtnt.exe98⤵PID:1156
-
\??\c:\3jppj.exec:\3jppj.exe99⤵PID:1232
-
\??\c:\ffxrrll.exec:\ffxrrll.exe100⤵PID:1020
-
\??\c:\rlrrxrx.exec:\rlrrxrx.exe101⤵PID:4492
-
\??\c:\tnhbbb.exec:\tnhbbb.exe102⤵PID:5116
-
\??\c:\pdvjv.exec:\pdvjv.exe103⤵PID:3264
-
\??\c:\djdvj.exec:\djdvj.exe104⤵PID:1892
-
\??\c:\xlllffx.exec:\xlllffx.exe105⤵PID:3384
-
\??\c:\lflxllf.exec:\lflxllf.exe106⤵PID:3836
-
\??\c:\tntntt.exec:\tntntt.exe107⤵PID:3448
-
\??\c:\pdjdj.exec:\pdjdj.exe108⤵PID:2312
-
\??\c:\dddvp.exec:\dddvp.exe109⤵PID:1420
-
\??\c:\xlxlxfx.exec:\xlxlxfx.exe110⤵PID:3092
-
\??\c:\htnbtn.exec:\htnbtn.exe111⤵PID:728
-
\??\c:\nbbbtb.exec:\nbbbtb.exe112⤵PID:3468
-
\??\c:\jjpjj.exec:\jjpjj.exe113⤵PID:408
-
\??\c:\rllxfrr.exec:\rllxfrr.exe114⤵PID:4480
-
\??\c:\fxxxllf.exec:\fxxxllf.exe115⤵PID:4104
-
\??\c:\nttnhb.exec:\nttnhb.exe116⤵PID:1516
-
\??\c:\vjjjd.exec:\vjjjd.exe117⤵PID:3744
-
\??\c:\jppdp.exec:\jppdp.exe118⤵PID:3912
-
\??\c:\llrrlfx.exec:\llrrlfx.exe119⤵PID:944
-
\??\c:\hbnntt.exec:\hbnntt.exe120⤵PID:4400
-
\??\c:\pjppd.exec:\pjppd.exe121⤵PID:1176
-
\??\c:\lfrflxr.exec:\lfrflxr.exe122⤵PID:1132
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe123⤵PID:808
-
\??\c:\thnhbb.exec:\thnhbb.exe124⤵PID:4336
-
\??\c:\dpjjd.exec:\dpjjd.exe125⤵PID:4352
-
\??\c:\djjjd.exec:\djjjd.exe126⤵PID:4052
-
\??\c:\rllfflr.exec:\rllfflr.exe127⤵PID:3716
-
\??\c:\nbhbtt.exec:\nbhbtt.exe128⤵PID:1972
-
\??\c:\3pjdd.exec:\3pjdd.exe129⤵PID:3284
-
\??\c:\vdppj.exec:\vdppj.exe130⤵PID:3776
-
\??\c:\3hbtnn.exec:\3hbtnn.exe131⤵PID:3556
-
\??\c:\nhnhnn.exec:\nhnhnn.exe132⤵PID:4532
-
\??\c:\dvjdv.exec:\dvjdv.exe133⤵PID:2328
-
\??\c:\rflxrlf.exec:\rflxrlf.exe134⤵PID:2776
-
\??\c:\rxxlfxr.exec:\rxxlfxr.exe135⤵PID:4676
-
\??\c:\tbhhtt.exec:\tbhhtt.exe136⤵PID:1200
-
\??\c:\vvpjj.exec:\vvpjj.exe137⤵PID:2036
-
\??\c:\jpvvj.exec:\jpvvj.exe138⤵PID:4832
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe139⤵PID:1248
-
\??\c:\llrlrxx.exec:\llrlrxx.exe140⤵PID:2808
-
\??\c:\1bhhbb.exec:\1bhhbb.exe141⤵PID:3688
-
\??\c:\dpvvv.exec:\dpvvv.exe142⤵PID:4600
-
\??\c:\xxfrxrf.exec:\xxfrxrf.exe143⤵PID:3540
-
\??\c:\btbhtt.exec:\btbhtt.exe144⤵PID:4356
-
\??\c:\tntnhh.exec:\tntnhh.exe145⤵PID:5008
-
\??\c:\pjjdv.exec:\pjjdv.exe146⤵PID:1580
-
\??\c:\xllxllr.exec:\xllxllr.exe147⤵PID:2932
-
\??\c:\hbnnhn.exec:\hbnnhn.exe148⤵PID:4992
-
\??\c:\tnttth.exec:\tnttth.exe149⤵PID:1600
-
\??\c:\7djvj.exec:\7djvj.exe150⤵PID:2196
-
\??\c:\llxlrfr.exec:\llxlrfr.exe151⤵PID:884
-
\??\c:\7tnbnn.exec:\7tnbnn.exe152⤵PID:4044
-
\??\c:\btnnbh.exec:\btnnbh.exe153⤵PID:4896
-
\??\c:\pvjvj.exec:\pvjvj.exe154⤵PID:3396
-
\??\c:\xlrfxrf.exec:\xlrfxrf.exe155⤵PID:2372
-
\??\c:\fffrfrf.exec:\fffrfrf.exe156⤵PID:4388
-
\??\c:\ntnnnn.exec:\ntnnnn.exe157⤵PID:2104
-
\??\c:\5jdpv.exec:\5jdpv.exe158⤵PID:1884
-
\??\c:\rrlxrfx.exec:\rrlxrfx.exe159⤵PID:3604
-
\??\c:\lxfxlxl.exec:\lxfxlxl.exe160⤵PID:4032
-
\??\c:\5nhthb.exec:\5nhthb.exe161⤵PID:4376
-
\??\c:\jddpv.exec:\jddpv.exe162⤵PID:4588
-
\??\c:\djjvj.exec:\djjvj.exe163⤵PID:4824
-
\??\c:\rfxlrlx.exec:\rfxlrlx.exe164⤵PID:4344
-
\??\c:\5bhbbb.exec:\5bhbbb.exe165⤵PID:2144
-
\??\c:\jvpdj.exec:\jvpdj.exe166⤵PID:1868
-
\??\c:\rxlxlfx.exec:\rxlxlfx.exe167⤵PID:3712
-
\??\c:\lrlrxfl.exec:\lrlrxfl.exe168⤵PID:3696
-
\??\c:\1hhnbt.exec:\1hhnbt.exe169⤵PID:1532
-
\??\c:\vjjvj.exec:\vjjvj.exe170⤵PID:2120
-
\??\c:\1pjpv.exec:\1pjpv.exe171⤵PID:1956
-
\??\c:\9rfrxlx.exec:\9rfrxlx.exe172⤵PID:2748
-
\??\c:\nbhbnh.exec:\nbhbnh.exe173⤵PID:2316
-
\??\c:\3nbthb.exec:\3nbthb.exe174⤵PID:4128
-
\??\c:\vdddj.exec:\vdddj.exe175⤵PID:1836
-
\??\c:\xxxfrfr.exec:\xxxfrfr.exe176⤵PID:756
-
\??\c:\fffrfxl.exec:\fffrfxl.exe177⤵PID:3356
-
\??\c:\bbnbnh.exec:\bbnbnh.exe178⤵PID:4324
-
\??\c:\ttthnh.exec:\ttthnh.exe179⤵PID:1504
-
\??\c:\9pdpd.exec:\9pdpd.exe180⤵PID:2176
-
\??\c:\1xrlrlf.exec:\1xrlrlf.exe181⤵PID:3300
-
\??\c:\bnnhht.exec:\bnnhht.exe182⤵PID:3792
-
\??\c:\1nnbnn.exec:\1nnbnn.exe183⤵PID:4468
-
\??\c:\pdvjv.exec:\pdvjv.exe184⤵PID:3264
-
\??\c:\9dpdj.exec:\9dpdj.exe185⤵PID:1892
-
\??\c:\xlxlrlx.exec:\xlxlrlx.exe186⤵PID:3704
-
\??\c:\nnnntn.exec:\nnnntn.exe187⤵PID:1400
-
\??\c:\hhhttt.exec:\hhhttt.exe188⤵PID:436
-
\??\c:\pdvdp.exec:\pdvdp.exe189⤵PID:2312
-
\??\c:\jvjvd.exec:\jvjvd.exe190⤵PID:4992
-
\??\c:\fllfrfx.exec:\fllfrfx.exe191⤵PID:3972
-
\??\c:\tnthtn.exec:\tnthtn.exe192⤵PID:1788
-
\??\c:\nbbnbt.exec:\nbbnbt.exe193⤵PID:3756
-
\??\c:\pdvjd.exec:\pdvjd.exe194⤵PID:5088
-
\??\c:\lrxfrlx.exec:\lrxfrlx.exe195⤵PID:2384
-
\??\c:\nnnbnb.exec:\nnnbnb.exe196⤵PID:4236
-
\??\c:\nbthnh.exec:\nbthnh.exe197⤵PID:3272
-
\??\c:\jvdjp.exec:\jvdjp.exe198⤵PID:624
-
\??\c:\frrxxll.exec:\frrxxll.exe199⤵PID:2400
-
\??\c:\xlfxlxl.exec:\xlfxlxl.exe200⤵PID:1312
-
\??\c:\tnbthb.exec:\tnbthb.exe201⤵PID:3552
-
\??\c:\hbttbb.exec:\hbttbb.exe202⤵PID:4508
-
\??\c:\dddvd.exec:\dddvd.exe203⤵PID:4376
-
\??\c:\9vdjv.exec:\9vdjv.exe204⤵PID:5048
-
\??\c:\ffxfxrl.exec:\ffxfxrl.exe205⤵PID:4824
-
\??\c:\nttnbn.exec:\nttnbn.exe206⤵PID:4344
-
\??\c:\5nnbnh.exec:\5nnbnh.exe207⤵PID:4264
-
\??\c:\dpddp.exec:\dpddp.exe208⤵PID:852
-
\??\c:\5lfrxlx.exec:\5lfrxlx.exe209⤵PID:1972
-
\??\c:\nbbbth.exec:\nbbbth.exe210⤵PID:3284
-
\??\c:\tnbthb.exec:\tnbthb.exe211⤵PID:3776
-
\??\c:\5vvjv.exec:\5vvjv.exe212⤵PID:2684
-
\??\c:\lxrlflf.exec:\lxrlflf.exe213⤵PID:2032
-
\??\c:\xxxlfrl.exec:\xxxlfrl.exe214⤵PID:2776
-
\??\c:\5hbnbt.exec:\5hbnbt.exe215⤵PID:4420
-
\??\c:\jjjdp.exec:\jjjdp.exe216⤵PID:4160
-
\??\c:\djdpd.exec:\djdpd.exe217⤵PID:3028
-
\??\c:\lxfrfrf.exec:\lxfrfrf.exe218⤵PID:1156
-
\??\c:\ttthtn.exec:\ttthtn.exe219⤵PID:5056
-
\??\c:\hhtnbt.exec:\hhtnbt.exe220⤵PID:2804
-
\??\c:\5dvjv.exec:\5dvjv.exe221⤵PID:404
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe222⤵PID:1840
-
\??\c:\5xxfrlr.exec:\5xxfrlr.exe223⤵PID:960
-
\??\c:\bbttbh.exec:\bbttbh.exe224⤵PID:2440
-
\??\c:\djpdv.exec:\djpdv.exe225⤵PID:4584
-
\??\c:\3xllxxx.exec:\3xllxxx.exe226⤵PID:676
-
\??\c:\lfrffrx.exec:\lfrffrx.exe227⤵PID:4972
-
\??\c:\7hbtnn.exec:\7hbtnn.exe228⤵PID:3268
-
\??\c:\jvjvp.exec:\jvjvp.exe229⤵PID:4456
-
\??\c:\xxffxlf.exec:\xxffxlf.exe230⤵PID:4044
-
\??\c:\fflxlfl.exec:\fflxlfl.exe231⤵PID:2436
-
\??\c:\tthbnb.exec:\tthbnb.exe232⤵PID:4896
-
\??\c:\9tnbhh.exec:\9tnbhh.exe233⤵PID:3724
-
\??\c:\1ddpd.exec:\1ddpd.exe234⤵PID:4100
-
\??\c:\xfxlxxl.exec:\xfxlxxl.exe235⤵PID:4764
-
\??\c:\tttnhb.exec:\tttnhb.exe236⤵PID:1144
-
\??\c:\jdvvp.exec:\jdvvp.exe237⤵PID:944
-
\??\c:\7vjvp.exec:\7vjvp.exe238⤵PID:4788
-
\??\c:\rrllfrx.exec:\rrllfrx.exe239⤵PID:1176
-
\??\c:\thnbbt.exec:\thnbbt.exe240⤵PID:3760
-
\??\c:\thbnbt.exec:\thbnbt.exe241⤵PID:4416
-
\??\c:\jdjvd.exec:\jdjvd.exe242⤵PID:4276