Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 04:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe
-
Size
487KB
-
MD5
1343d523f630e275656f1cbbb2396c82
-
SHA1
17f10e0f77576f39a592d63a1bd013783d844626
-
SHA256
fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef
-
SHA512
3d5c8270120136d6cfcf5ea3988584a1c41537210409cfd0bef44aff859c8b99633582762800ed726022fd3f67b6df1d0a19494dfaf5926124bebdaf429cd6a2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwu1b26X1wjdgyPPBA:q7Tc2NYHUrAwqzQ7PPu
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1072-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-702-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-1076-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1072-1-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1120-6-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4304-13-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2796-18-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3260-31-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3404-25-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4972-37-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1892-46-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3680-54-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/380-61-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4748-66-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2144-77-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2076-80-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/864-90-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4808-102-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2000-100-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4576-113-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1964-118-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1964-122-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4256-127-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2968-134-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1560-139-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3568-148-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1548-161-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1544-172-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3796-175-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1040-189-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1232-191-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4368-200-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4072-202-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3100-206-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1652-215-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2740-229-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4816-244-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4140-248-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4672-255-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2412-257-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4808-261-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4364-264-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4364-268-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4576-273-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1228-279-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/216-287-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1380-305-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3968-312-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/920-325-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4428-329-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2816-345-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2716-352-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4132-350-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3532-369-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3344-377-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2476-386-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4872-396-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3292-400-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3564-401-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2288-420-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/536-469-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4864-500-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4712-513-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2472-514-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3864-518-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4672-522-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2356-529-0x0000000000400000-0x000000000042A000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
tthnbb.exebhnnnn.exehbtnhn.exe9jjjj.exerllllll.exehhhhbb.exelrffxxx.exe5htnhh.exexllfxxx.exe1ttnhh.exevdjvj.exe7xxlfrr.exehbnhhb.exethtnhh.exepjpjd.exevvpjj.exe7xxxffl.exethnhbh.exetttttb.exe3pdvv.exevpdvd.exenhnhbt.exedvjdd.exelllfxxx.exejdjdv.exe5lrlfff.exepjjdd.exexxxrrrl.exelffffff.exejjvvd.exelfllflr.exehthbbb.exeffrrrrx.exe9nhbbb.exebhttbh.exevvvvp.exellxrllf.exebbttnt.exehhnntt.exejddvp.exerlxxfff.exehnhhbb.exetbtnnn.exevvvvp.exeffrlfxr.exetntbtt.exe7btnhn.exejdddv.exe3xxxrrx.exexrxrrlf.exe9tbnnt.exedpvpp.exedjvpd.exerrfxrrl.exenhhbtt.exe3ppjv.exedjppj.exefxfxxxr.exetnnhbb.exe7vpjd.exe3ppjj.exe5xxrrrl.exe7bhbtt.exe9tbbhn.exepid process 1120 tthnbb.exe 4304 bhnnnn.exe 2796 hbtnhn.exe 3404 9jjjj.exe 3260 rllllll.exe 4972 hhhhbb.exe 1892 lrffxxx.exe 3680 5htnhh.exe 2328 xllfxxx.exe 380 1ttnhh.exe 4748 vdjvj.exe 2076 7xxlfrr.exe 2144 hbnhhb.exe 2416 thtnhh.exe 864 pjpjd.exe 2000 vvpjj.exe 4808 7xxxffl.exe 1904 thnhbh.exe 4576 tttttb.exe 1964 3pdvv.exe 4256 vpdvd.exe 2968 nhnhbt.exe 1560 dvjdd.exe 3988 lllfxxx.exe 3568 jdjdv.exe 1380 5lrlfff.exe 1548 pjjdd.exe 4896 xxxrrrl.exe 1544 lffffff.exe 3796 jjvvd.exe 3800 lfllflr.exe 1040 hthbbb.exe 1232 ffrrrrx.exe 2720 9nhbbb.exe 4368 bhttbh.exe 4072 vvvvp.exe 3100 llxrllf.exe 4656 bbttnt.exe 2944 hhnntt.exe 1652 jddvp.exe 852 rlxxfff.exe 2328 hnhhbb.exe 3620 tbtnnn.exe 2740 vvvvp.exe 4864 ffrlfxr.exe 2352 tntbtt.exe 2756 7btnhn.exe 4820 jdddv.exe 4816 3xxxrrx.exe 4140 xrxrrlf.exe 4672 9tbnnt.exe 2412 dpvpp.exe 4808 djvpd.exe 4364 rrfxrrl.exe 1904 nhhbtt.exe 4576 3ppjv.exe 4280 djppj.exe 1228 fxfxxxr.exe 2876 tnnhbb.exe 216 7vpjd.exe 1264 3ppjj.exe 660 5xxrrrl.exe 4892 7bhbtt.exe 4584 9tbbhn.exe -
Processes:
resource yara_rule behavioral2/memory/1072-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4140-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-529-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exetthnbb.exebhnnnn.exehbtnhn.exe9jjjj.exerllllll.exehhhhbb.exelrffxxx.exe5htnhh.exexllfxxx.exe1ttnhh.exevdjvj.exe7xxlfrr.exehbnhhb.exethtnhh.exepjpjd.exevvpjj.exe7xxxffl.exethnhbh.exetttttb.exe3pdvv.exevpdvd.exedescription pid process target process PID 1072 wrote to memory of 1120 1072 fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe tthnbb.exe PID 1072 wrote to memory of 1120 1072 fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe tthnbb.exe PID 1072 wrote to memory of 1120 1072 fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe tthnbb.exe PID 1120 wrote to memory of 4304 1120 tthnbb.exe bhnnnn.exe PID 1120 wrote to memory of 4304 1120 tthnbb.exe bhnnnn.exe PID 1120 wrote to memory of 4304 1120 tthnbb.exe bhnnnn.exe PID 4304 wrote to memory of 2796 4304 bhnnnn.exe hbtnhn.exe PID 4304 wrote to memory of 2796 4304 bhnnnn.exe hbtnhn.exe PID 4304 wrote to memory of 2796 4304 bhnnnn.exe hbtnhn.exe PID 2796 wrote to memory of 3404 2796 hbtnhn.exe 9jjjj.exe PID 2796 wrote to memory of 3404 2796 hbtnhn.exe 9jjjj.exe PID 2796 wrote to memory of 3404 2796 hbtnhn.exe 9jjjj.exe PID 3404 wrote to memory of 3260 3404 9jjjj.exe rllllll.exe PID 3404 wrote to memory of 3260 3404 9jjjj.exe rllllll.exe PID 3404 wrote to memory of 3260 3404 9jjjj.exe rllllll.exe PID 3260 wrote to memory of 4972 3260 rllllll.exe hhhhbb.exe PID 3260 wrote to memory of 4972 3260 rllllll.exe hhhhbb.exe PID 3260 wrote to memory of 4972 3260 rllllll.exe hhhhbb.exe PID 4972 wrote to memory of 1892 4972 hhhhbb.exe lrffxxx.exe PID 4972 wrote to memory of 1892 4972 hhhhbb.exe lrffxxx.exe PID 4972 wrote to memory of 1892 4972 hhhhbb.exe lrffxxx.exe PID 1892 wrote to memory of 3680 1892 lrffxxx.exe 5htnhh.exe PID 1892 wrote to memory of 3680 1892 lrffxxx.exe 5htnhh.exe PID 1892 wrote to memory of 3680 1892 lrffxxx.exe 5htnhh.exe PID 3680 wrote to memory of 2328 3680 5htnhh.exe xllfxxx.exe PID 3680 wrote to memory of 2328 3680 5htnhh.exe xllfxxx.exe PID 3680 wrote to memory of 2328 3680 5htnhh.exe xllfxxx.exe PID 2328 wrote to memory of 380 2328 xllfxxx.exe 1ttnhh.exe PID 2328 wrote to memory of 380 2328 xllfxxx.exe 1ttnhh.exe PID 2328 wrote to memory of 380 2328 xllfxxx.exe 1ttnhh.exe PID 380 wrote to memory of 4748 380 1ttnhh.exe vdjvj.exe PID 380 wrote to memory of 4748 380 1ttnhh.exe vdjvj.exe PID 380 wrote to memory of 4748 380 1ttnhh.exe vdjvj.exe PID 4748 wrote to memory of 2076 4748 vdjvj.exe 7xxlfrr.exe PID 4748 wrote to memory of 2076 4748 vdjvj.exe 7xxlfrr.exe PID 4748 wrote to memory of 2076 4748 vdjvj.exe 7xxlfrr.exe PID 2076 wrote to memory of 2144 2076 7xxlfrr.exe hbnhhb.exe PID 2076 wrote to memory of 2144 2076 7xxlfrr.exe hbnhhb.exe PID 2076 wrote to memory of 2144 2076 7xxlfrr.exe hbnhhb.exe PID 2144 wrote to memory of 2416 2144 hbnhhb.exe thtnhh.exe PID 2144 wrote to memory of 2416 2144 hbnhhb.exe thtnhh.exe PID 2144 wrote to memory of 2416 2144 hbnhhb.exe thtnhh.exe PID 2416 wrote to memory of 864 2416 thtnhh.exe pjpjd.exe PID 2416 wrote to memory of 864 2416 thtnhh.exe pjpjd.exe PID 2416 wrote to memory of 864 2416 thtnhh.exe pjpjd.exe PID 864 wrote to memory of 2000 864 pjpjd.exe vvpjj.exe PID 864 wrote to memory of 2000 864 pjpjd.exe vvpjj.exe PID 864 wrote to memory of 2000 864 pjpjd.exe vvpjj.exe PID 2000 wrote to memory of 4808 2000 vvpjj.exe 7xxxffl.exe PID 2000 wrote to memory of 4808 2000 vvpjj.exe 7xxxffl.exe PID 2000 wrote to memory of 4808 2000 vvpjj.exe 7xxxffl.exe PID 4808 wrote to memory of 1904 4808 7xxxffl.exe thnhbh.exe PID 4808 wrote to memory of 1904 4808 7xxxffl.exe thnhbh.exe PID 4808 wrote to memory of 1904 4808 7xxxffl.exe thnhbh.exe PID 1904 wrote to memory of 4576 1904 thnhbh.exe tttttb.exe PID 1904 wrote to memory of 4576 1904 thnhbh.exe tttttb.exe PID 1904 wrote to memory of 4576 1904 thnhbh.exe tttttb.exe PID 4576 wrote to memory of 1964 4576 tttttb.exe 3pdvv.exe PID 4576 wrote to memory of 1964 4576 tttttb.exe 3pdvv.exe PID 4576 wrote to memory of 1964 4576 tttttb.exe 3pdvv.exe PID 1964 wrote to memory of 4256 1964 3pdvv.exe vpdvd.exe PID 1964 wrote to memory of 4256 1964 3pdvv.exe vpdvd.exe PID 1964 wrote to memory of 4256 1964 3pdvv.exe vpdvd.exe PID 4256 wrote to memory of 2968 4256 vpdvd.exe nhnhbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe"C:\Users\Admin\AppData\Local\Temp\fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\tthnbb.exec:\tthnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhnnnn.exec:\bhnnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbtnhn.exec:\hbtnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9jjjj.exec:\9jjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rllllll.exec:\rllllll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhhbb.exec:\hhhhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrffxxx.exec:\lrffxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5htnhh.exec:\5htnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xllfxxx.exec:\xllfxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1ttnhh.exec:\1ttnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdjvj.exec:\vdjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7xxlfrr.exec:\7xxlfrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbnhhb.exec:\hbnhhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thtnhh.exec:\thtnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjpjd.exec:\pjpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvpjj.exec:\vvpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7xxxffl.exec:\7xxxffl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thnhbh.exec:\thnhbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tttttb.exec:\tttttb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3pdvv.exec:\3pdvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpdvd.exec:\vpdvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhnhbt.exec:\nhnhbt.exe23⤵
- Executes dropped EXE
-
\??\c:\dvjdd.exec:\dvjdd.exe24⤵
- Executes dropped EXE
-
\??\c:\lllfxxx.exec:\lllfxxx.exe25⤵
- Executes dropped EXE
-
\??\c:\jdjdv.exec:\jdjdv.exe26⤵
- Executes dropped EXE
-
\??\c:\5lrlfff.exec:\5lrlfff.exe27⤵
- Executes dropped EXE
-
\??\c:\pjjdd.exec:\pjjdd.exe28⤵
- Executes dropped EXE
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe29⤵
- Executes dropped EXE
-
\??\c:\lffffff.exec:\lffffff.exe30⤵
- Executes dropped EXE
-
\??\c:\jjvvd.exec:\jjvvd.exe31⤵
- Executes dropped EXE
-
\??\c:\lfllflr.exec:\lfllflr.exe32⤵
- Executes dropped EXE
-
\??\c:\hthbbb.exec:\hthbbb.exe33⤵
- Executes dropped EXE
-
\??\c:\ffrrrrx.exec:\ffrrrrx.exe34⤵
- Executes dropped EXE
-
\??\c:\9nhbbb.exec:\9nhbbb.exe35⤵
- Executes dropped EXE
-
\??\c:\bhttbh.exec:\bhttbh.exe36⤵
- Executes dropped EXE
-
\??\c:\vvvvp.exec:\vvvvp.exe37⤵
- Executes dropped EXE
-
\??\c:\llxrllf.exec:\llxrllf.exe38⤵
- Executes dropped EXE
-
\??\c:\bbttnt.exec:\bbttnt.exe39⤵
- Executes dropped EXE
-
\??\c:\hhnntt.exec:\hhnntt.exe40⤵
- Executes dropped EXE
-
\??\c:\jddvp.exec:\jddvp.exe41⤵
- Executes dropped EXE
-
\??\c:\rlxxfff.exec:\rlxxfff.exe42⤵
- Executes dropped EXE
-
\??\c:\hnhhbb.exec:\hnhhbb.exe43⤵
- Executes dropped EXE
-
\??\c:\tbtnnn.exec:\tbtnnn.exe44⤵
- Executes dropped EXE
-
\??\c:\vvvvp.exec:\vvvvp.exe45⤵
- Executes dropped EXE
-
\??\c:\ffrlfxr.exec:\ffrlfxr.exe46⤵
- Executes dropped EXE
-
\??\c:\tntbtt.exec:\tntbtt.exe47⤵
- Executes dropped EXE
-
\??\c:\7btnhn.exec:\7btnhn.exe48⤵
- Executes dropped EXE
-
\??\c:\jdddv.exec:\jdddv.exe49⤵
- Executes dropped EXE
-
\??\c:\3xxxrrx.exec:\3xxxrrx.exe50⤵
- Executes dropped EXE
-
\??\c:\xrxrrlf.exec:\xrxrrlf.exe51⤵
- Executes dropped EXE
-
\??\c:\9tbnnt.exec:\9tbnnt.exe52⤵
- Executes dropped EXE
-
\??\c:\dpvpp.exec:\dpvpp.exe53⤵
- Executes dropped EXE
-
\??\c:\djvpd.exec:\djvpd.exe54⤵
- Executes dropped EXE
-
\??\c:\rrfxrrl.exec:\rrfxrrl.exe55⤵
- Executes dropped EXE
-
\??\c:\nhhbtt.exec:\nhhbtt.exe56⤵
- Executes dropped EXE
-
\??\c:\3ppjv.exec:\3ppjv.exe57⤵
- Executes dropped EXE
-
\??\c:\djppj.exec:\djppj.exe58⤵
- Executes dropped EXE
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe59⤵
- Executes dropped EXE
-
\??\c:\tnnhbb.exec:\tnnhbb.exe60⤵
- Executes dropped EXE
-
\??\c:\7vpjd.exec:\7vpjd.exe61⤵
- Executes dropped EXE
-
\??\c:\3ppjj.exec:\3ppjj.exe62⤵
- Executes dropped EXE
-
\??\c:\5xxrrrl.exec:\5xxrrrl.exe63⤵
- Executes dropped EXE
-
\??\c:\7bhbtt.exec:\7bhbtt.exe64⤵
- Executes dropped EXE
-
\??\c:\9tbbhn.exec:\9tbbhn.exe65⤵
- Executes dropped EXE
-
\??\c:\jdjdj.exec:\jdjdj.exe66⤵
-
\??\c:\rfllffx.exec:\rfllffx.exe67⤵
-
\??\c:\xxlfffx.exec:\xxlfffx.exe68⤵
-
\??\c:\nhnhhb.exec:\nhnhhb.exe69⤵
-
\??\c:\3jvdd.exec:\3jvdd.exe70⤵
-
\??\c:\1vppp.exec:\1vppp.exe71⤵
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe72⤵
-
\??\c:\5btttt.exec:\5btttt.exe73⤵
-
\??\c:\5pvpp.exec:\5pvpp.exe74⤵
-
\??\c:\xxffllx.exec:\xxffllx.exe75⤵
-
\??\c:\tnnhbb.exec:\tnnhbb.exe76⤵
-
\??\c:\nthhnt.exec:\nthhnt.exe77⤵
-
\??\c:\jdvjd.exec:\jdvjd.exe78⤵
-
\??\c:\rffxxxr.exec:\rffxxxr.exe79⤵
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe80⤵
-
\??\c:\nhhbtn.exec:\nhhbtn.exe81⤵
-
\??\c:\ddvpj.exec:\ddvpj.exe82⤵
-
\??\c:\lllfxxr.exec:\lllfxxr.exe83⤵
-
\??\c:\nhthbt.exec:\nhthbt.exe84⤵
-
\??\c:\7nhbnn.exec:\7nhbnn.exe85⤵
-
\??\c:\vjvjd.exec:\vjvjd.exe86⤵
-
\??\c:\lflxrxr.exec:\lflxrxr.exe87⤵
-
\??\c:\thhtnt.exec:\thhtnt.exe88⤵
-
\??\c:\3bbnnb.exec:\3bbnnb.exe89⤵
-
\??\c:\ddddv.exec:\ddddv.exe90⤵
-
\??\c:\frrlxrl.exec:\frrlxrl.exe91⤵
-
\??\c:\btbhtn.exec:\btbhtn.exe92⤵
-
\??\c:\vjjdv.exec:\vjjdv.exe93⤵
-
\??\c:\lxxxlfx.exec:\lxxxlfx.exe94⤵
-
\??\c:\7thbnh.exec:\7thbnh.exe95⤵
-
\??\c:\5pjjd.exec:\5pjjd.exe96⤵
-
\??\c:\xrrrxxr.exec:\xrrrxxr.exe97⤵
-
\??\c:\9tttnn.exec:\9tttnn.exe98⤵
-
\??\c:\tnbthh.exec:\tnbthh.exe99⤵
-
\??\c:\1ddvp.exec:\1ddvp.exe100⤵
-
\??\c:\xxxlrfx.exec:\xxxlrfx.exe101⤵
-
\??\c:\htthbb.exec:\htthbb.exe102⤵
-
\??\c:\hhntnb.exec:\hhntnb.exe103⤵
-
\??\c:\9pjdv.exec:\9pjdv.exe104⤵
-
\??\c:\xllrfll.exec:\xllrfll.exe105⤵
-
\??\c:\hbnhtn.exec:\hbnhtn.exe106⤵
-
\??\c:\vpvvv.exec:\vpvvv.exe107⤵
-
\??\c:\1vpjd.exec:\1vpjd.exe108⤵
-
\??\c:\7xfrlll.exec:\7xfrlll.exe109⤵
-
\??\c:\hthnnt.exec:\hthnnt.exe110⤵
-
\??\c:\vdjvp.exec:\vdjvp.exe111⤵
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe112⤵
-
\??\c:\thnnhh.exec:\thnnhh.exe113⤵
-
\??\c:\tnnhtn.exec:\tnnhtn.exe114⤵
-
\??\c:\vjjvp.exec:\vjjvp.exe115⤵
-
\??\c:\xrlfxxl.exec:\xrlfxxl.exe116⤵
-
\??\c:\lxrfrll.exec:\lxrfrll.exe117⤵
-
\??\c:\hnhbtn.exec:\hnhbtn.exe118⤵
-
\??\c:\pjjpj.exec:\pjjpj.exe119⤵
-
\??\c:\vpddv.exec:\vpddv.exe120⤵
-
\??\c:\xlxlrlx.exec:\xlxlrlx.exe121⤵
-
\??\c:\tntbtt.exec:\tntbtt.exe122⤵
-
\??\c:\vpppd.exec:\vpppd.exe123⤵
-
\??\c:\rrlffxf.exec:\rrlffxf.exe124⤵
-
\??\c:\lxxrlrl.exec:\lxxrlrl.exe125⤵
-
\??\c:\nbhhbn.exec:\nbhhbn.exe126⤵
-
\??\c:\dpddp.exec:\dpddp.exe127⤵
-
\??\c:\1llfrrl.exec:\1llfrrl.exe128⤵
-
\??\c:\frfrrlf.exec:\frfrrlf.exe129⤵
-
\??\c:\9hbtnn.exec:\9hbtnn.exe130⤵
-
\??\c:\pvvvp.exec:\pvvvp.exe131⤵
-
\??\c:\frlxrrl.exec:\frlxrrl.exe132⤵
-
\??\c:\hhhhbn.exec:\hhhhbn.exe133⤵
-
\??\c:\vdddv.exec:\vdddv.exe134⤵
-
\??\c:\lflfxxr.exec:\lflfxxr.exe135⤵
-
\??\c:\rrrffrr.exec:\rrrffrr.exe136⤵
-
\??\c:\bttnhh.exec:\bttnhh.exe137⤵
-
\??\c:\5jjdd.exec:\5jjdd.exe138⤵
-
\??\c:\9rlfxxr.exec:\9rlfxxr.exe139⤵
-
\??\c:\rfrxrxf.exec:\rfrxrxf.exe140⤵
-
\??\c:\httnhh.exec:\httnhh.exe141⤵
-
\??\c:\jdjdv.exec:\jdjdv.exe142⤵
-
\??\c:\7xlfxrr.exec:\7xlfxrr.exe143⤵
-
\??\c:\rllllfx.exec:\rllllfx.exe144⤵
-
\??\c:\bthhnt.exec:\bthhnt.exe145⤵
-
\??\c:\pvdvp.exec:\pvdvp.exe146⤵
-
\??\c:\rflfxrr.exec:\rflfxrr.exe147⤵
-
\??\c:\bthnbn.exec:\bthnbn.exe148⤵
-
\??\c:\hhhhbt.exec:\hhhhbt.exe149⤵
-
\??\c:\jvjdd.exec:\jvjdd.exe150⤵
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe151⤵
-
\??\c:\9hhhtn.exec:\9hhhtn.exe152⤵
-
\??\c:\dppjd.exec:\dppjd.exe153⤵
-
\??\c:\3rfxlfx.exec:\3rfxlfx.exe154⤵
-
\??\c:\frxrlfx.exec:\frxrlfx.exe155⤵
-
\??\c:\1tthbt.exec:\1tthbt.exe156⤵
-
\??\c:\pjpjp.exec:\pjpjp.exe157⤵
-
\??\c:\xrlxlfx.exec:\xrlxlfx.exe158⤵
-
\??\c:\llrfllr.exec:\llrfllr.exe159⤵
-
\??\c:\7hhtnn.exec:\7hhtnn.exe160⤵
-
\??\c:\dvvjd.exec:\dvvjd.exe161⤵
-
\??\c:\ppvjv.exec:\ppvjv.exe162⤵
-
\??\c:\rlxllff.exec:\rlxllff.exe163⤵
-
\??\c:\5bbbnh.exec:\5bbbnh.exe164⤵
-
\??\c:\jpvjd.exec:\jpvjd.exe165⤵
-
\??\c:\rxxlxxl.exec:\rxxlxxl.exe166⤵
-
\??\c:\lxxlxlf.exec:\lxxlxlf.exe167⤵
-
\??\c:\nhbttn.exec:\nhbttn.exe168⤵
-
\??\c:\1vdvp.exec:\1vdvp.exe169⤵
-
\??\c:\lxxxlfx.exec:\lxxxlfx.exe170⤵
-
\??\c:\lffrlrl.exec:\lffrlrl.exe171⤵
-
\??\c:\5hbthb.exec:\5hbthb.exe172⤵
-
\??\c:\vppjd.exec:\vppjd.exe173⤵
-
\??\c:\7rxlrll.exec:\7rxlrll.exe174⤵
-
\??\c:\tttnnh.exec:\tttnnh.exe175⤵
-
\??\c:\hbhbbt.exec:\hbhbbt.exe176⤵
-
\??\c:\1ddpd.exec:\1ddpd.exe177⤵
-
\??\c:\lfrfxrl.exec:\lfrfxrl.exe178⤵
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe179⤵
-
\??\c:\hhtbbb.exec:\hhtbbb.exe180⤵
-
\??\c:\dvvpp.exec:\dvvpp.exe181⤵
-
\??\c:\fxfxlrf.exec:\fxfxlrf.exe182⤵
-
\??\c:\btbbnh.exec:\btbbnh.exe183⤵
-
\??\c:\bbhbnt.exec:\bbhbnt.exe184⤵
-
\??\c:\jjjvj.exec:\jjjvj.exe185⤵
-
\??\c:\vjdpd.exec:\vjdpd.exe186⤵
-
\??\c:\xflrlxx.exec:\xflrlxx.exe187⤵
-
\??\c:\hbntnb.exec:\hbntnb.exe188⤵
-
\??\c:\vppdp.exec:\vppdp.exe189⤵
-
\??\c:\vdpjp.exec:\vdpjp.exe190⤵
-
\??\c:\5lfxlfx.exec:\5lfxlfx.exe191⤵
-
\??\c:\hbhbnt.exec:\hbhbnt.exe192⤵
-
\??\c:\5thbnh.exec:\5thbnh.exe193⤵
-
\??\c:\3dvpj.exec:\3dvpj.exe194⤵
-
\??\c:\5xfxxxx.exec:\5xfxxxx.exe195⤵
-
\??\c:\hthhhb.exec:\hthhhb.exe196⤵
-
\??\c:\nbbbhb.exec:\nbbbhb.exe197⤵
-
\??\c:\3jjdd.exec:\3jjdd.exe198⤵
-
\??\c:\3rrlxrx.exec:\3rrlxrx.exe199⤵
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe200⤵
-
\??\c:\nhnhtb.exec:\nhnhtb.exe201⤵
-
\??\c:\jvvjv.exec:\jvvjv.exe202⤵
-
\??\c:\fllfxrl.exec:\fllfxrl.exe203⤵
-
\??\c:\7nhtbt.exec:\7nhtbt.exe204⤵
-
\??\c:\7ppdv.exec:\7ppdv.exe205⤵
-
\??\c:\jpvvj.exec:\jpvvj.exe206⤵
-
\??\c:\llrllxx.exec:\llrllxx.exe207⤵
-
\??\c:\btbthn.exec:\btbthn.exe208⤵
-
\??\c:\9djvd.exec:\9djvd.exe209⤵
-
\??\c:\jvjvp.exec:\jvjvp.exe210⤵
-
\??\c:\lfffrxl.exec:\lfffrxl.exe211⤵
-
\??\c:\nbbnbb.exec:\nbbnbb.exe212⤵
-
\??\c:\hnthtn.exec:\hnthtn.exe213⤵
-
\??\c:\pjpdp.exec:\pjpdp.exe214⤵
-
\??\c:\fllfrrl.exec:\fllfrrl.exe215⤵
-
\??\c:\1ththn.exec:\1ththn.exe216⤵
-
\??\c:\jpvjv.exec:\jpvjv.exe217⤵
-
\??\c:\5vpjv.exec:\5vpjv.exe218⤵
-
\??\c:\fxrffxx.exec:\fxrffxx.exe219⤵
-
\??\c:\bttnnh.exec:\bttnnh.exe220⤵
-
\??\c:\5vvpp.exec:\5vvpp.exe221⤵
-
\??\c:\9ffrllx.exec:\9ffrllx.exe222⤵
-
\??\c:\ntbnbt.exec:\ntbnbt.exe223⤵
-
\??\c:\vpppj.exec:\vpppj.exe224⤵
-
\??\c:\vjppp.exec:\vjppp.exe225⤵
-
\??\c:\frrrlff.exec:\frrrlff.exe226⤵
-
\??\c:\3xffflf.exec:\3xffflf.exe227⤵
-
\??\c:\nnttbb.exec:\nnttbb.exe228⤵
-
\??\c:\ppjjd.exec:\ppjjd.exe229⤵
-
\??\c:\xlrlxrf.exec:\xlrlxrf.exe230⤵
-
\??\c:\1tnhtn.exec:\1tnhtn.exe231⤵
-
\??\c:\9dvpd.exec:\9dvpd.exe232⤵
-
\??\c:\1fxxrff.exec:\1fxxrff.exe233⤵
-
\??\c:\rffxxff.exec:\rffxxff.exe234⤵
-
\??\c:\hntnnh.exec:\hntnnh.exe235⤵
-
\??\c:\3djdd.exec:\3djdd.exe236⤵
-
\??\c:\rfllffx.exec:\rfllffx.exe237⤵
-
\??\c:\frxrllf.exec:\frxrllf.exe238⤵
-
\??\c:\htbtnh.exec:\htbtnh.exe239⤵
-
\??\c:\5vdvv.exec:\5vdvv.exe240⤵
-
\??\c:\1lfxrrl.exec:\1lfxrrl.exe241⤵