Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 09:00
Behavioral task
behavioral1
Sample
b1e79a7f79514e48516a1d619d74a010N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
b1e79a7f79514e48516a1d619d74a010N.exe
-
Size
272KB
-
MD5
b1e79a7f79514e48516a1d619d74a010
-
SHA1
cdbdcf4d32a309665d298e63137b50063d9f9dd4
-
SHA256
a8e2340c42091c8190e126fc0bd8bde2715bac7000eecb77b3a8a6866f842746
-
SHA512
a4cf18ce6a4fc695db9009612b9aa7ce786c47b463ffd05a1caf6402c410fc55a05d027c6db1ea3a1fdf0b5fb19b9fdb5aaa95d52e2efc4fcb5b4c316b88f83d
-
SSDEEP
3072:LhOmTsF93UYfwC6GIoutVwT0JOfZKldUIbvpynrSPBPOY4W5oo:Lcm4FmowdHoSVwT+aZKlumArSPBPJH
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
Processes:
resource yara_rule behavioral1/memory/1336-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-34-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2084-33-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2788-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-191-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1532-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-584-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-591-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-639-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2076-693-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2372-727-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2244-798-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-1137-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2352-1174-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/924-6548-0x00000000770D0000-0x00000000771EF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
3rflrxl.exedjvvp.exexxxfflx.exevddpj.exetnhtbh.exebtnhtb.exerrrrffr.exehbbtbb.exepjddp.exe1rfrfrx.exe9jvdp.exefrrxllf.exe7htthh.exedvddj.exe7frlrlr.exeddvdp.exefxrfrxl.exettbnnt.exepjpvj.exebbnhtt.exe9pjpv.exevddpd.exebthtbn.exejdvvj.exe5xlrxfr.exe9fxrllx.exevvdjp.exefxflrxf.exe1bntht.exevdpdp.exehbtbnt.exehbnntt.exepdpjj.exellllxlf.exebtnbnb.exe1vjjp.exerlllxxf.exefllfxrr.exenhtttt.exedvjjp.exepjddj.exexflflxx.exenhbhnb.exejdddj.exe1xrfrxx.exerfrrxlr.exethhhbn.exe3pjvj.exelllrflx.exe7ffrrxx.exetthbnb.exe9hbhnn.exe9ddjv.exerllrxfr.exe7nnhnn.exehnnttn.exeppjvp.exerllffll.exelxlrffr.exennbhtn.exevpjjj.exeflrlfff.exefxlrxxr.exebtnttn.exepid process 2996 3rflrxl.exe 2624 djvvp.exe 2084 xxxfflx.exe 2268 vddpj.exe 2788 tnhtbh.exe 2704 btnhtb.exe 2660 rrrrffr.exe 2564 hbbtbb.exe 2584 pjddp.exe 2556 1rfrfrx.exe 3024 9jvdp.exe 3036 frrxllf.exe 1920 7htthh.exe 2756 dvddj.exe 2000 7frlrlr.exe 2728 ddvdp.exe 1244 fxrfrxl.exe 1064 ttbnnt.exe 1600 pjpvj.exe 2932 bbnhtt.exe 2880 9pjpv.exe 2172 vddpd.exe 2180 bthtbn.exe 2004 jdvvj.exe 280 5xlrxfr.exe 1532 9fxrllx.exe 1660 vvdjp.exe 2232 fxflrxf.exe 1612 1bntht.exe 1972 vdpdp.exe 2272 hbtbnt.exe 1760 hbnntt.exe 2316 pdpjj.exe 1664 llllxlf.exe 1564 btnbnb.exe 3004 1vjjp.exe 1948 rlllxxf.exe 2944 fllfxrr.exe 2416 nhtttt.exe 2636 dvjjp.exe 2800 pjddj.exe 2668 xflflxx.exe 2836 nhbhnb.exe 2708 jdddj.exe 2660 1xrfrxx.exe 2656 rfrrxlr.exe 2584 thhhbn.exe 2552 3pjvj.exe 2556 lllrflx.exe 2580 7ffrrxx.exe 2716 tthbnb.exe 3040 9hbhnn.exe 2356 9ddjv.exe 1980 rllrxfr.exe 2632 7nnhnn.exe 2600 hnnttn.exe 2728 ppjvp.exe 1704 rllffll.exe 2076 lxlrffr.exe 2888 nnbhtn.exe 2916 vpjjj.exe 2148 flrlfff.exe 2432 fxlrxxr.exe 2136 btnttn.exe -
Processes:
resource yara_rule behavioral1/memory/1336-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3rflrxl.exe upx behavioral1/memory/1336-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2996-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2996-18-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djvvp.exe upx behavioral1/memory/2624-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxxfflx.exe upx behavioral1/memory/2084-36-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vddpj.exe upx C:\tnhtbh.exe upx behavioral1/memory/2788-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2268-44-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btnhtb.exe upx behavioral1/memory/2704-61-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrrrffr.exe upx C:\hbbtbb.exe upx C:\pjddp.exe upx behavioral1/memory/2584-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2564-76-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1rfrfrx.exe upx behavioral1/memory/2556-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9jvdp.exe upx behavioral1/memory/3024-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3024-101-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frrxllf.exe upx C:\7htthh.exe upx behavioral1/memory/3036-109-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvddj.exe upx C:\7frlrlr.exe upx behavioral1/memory/2756-124-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddvdp.exe upx behavioral1/memory/2728-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-140-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxrfrxl.exe upx C:\ttbnnt.exe upx C:\pjpvj.exe upx C:\bbnhtt.exe upx C:\9pjpv.exe upx behavioral1/memory/2932-169-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vddpd.exe upx C:\bthtbn.exe upx behavioral1/memory/2180-185-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdvvj.exe upx C:\5xlrxfr.exe upx C:\9fxrllx.exe upx behavioral1/memory/1532-213-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvdjp.exe upx C:\fxflrxf.exe upx behavioral1/memory/2232-229-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1bntht.exe upx C:\vdpdp.exe upx C:\hbtbnt.exe upx behavioral1/memory/1972-243-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbnntt.exe upx behavioral1/memory/2316-258-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1664-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1664-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2944-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2668-311-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2708-322-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2708-328-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2660-334-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ppddd.exefrrxflx.exeddvjp.exeffxxflr.exexrrflfr.exefrfflxl.exethtttt.exe3vpjp.exerxfrfrl.exedvddj.exettnbht.exevjpjp.exe1nhbnh.exetthttt.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b1e79a7f79514e48516a1d619d74a010N.exe3rflrxl.exedjvvp.exexxxfflx.exevddpj.exetnhtbh.exebtnhtb.exerrrrffr.exehbbtbb.exepjddp.exe1rfrfrx.exe9jvdp.exefrrxllf.exe7htthh.exedvddj.exe7frlrlr.exedescription pid process target process PID 1336 wrote to memory of 2996 1336 b1e79a7f79514e48516a1d619d74a010N.exe 3rflrxl.exe PID 1336 wrote to memory of 2996 1336 b1e79a7f79514e48516a1d619d74a010N.exe 3rflrxl.exe PID 1336 wrote to memory of 2996 1336 b1e79a7f79514e48516a1d619d74a010N.exe 3rflrxl.exe PID 1336 wrote to memory of 2996 1336 b1e79a7f79514e48516a1d619d74a010N.exe 3rflrxl.exe PID 2996 wrote to memory of 2624 2996 3rflrxl.exe djvvp.exe PID 2996 wrote to memory of 2624 2996 3rflrxl.exe djvvp.exe PID 2996 wrote to memory of 2624 2996 3rflrxl.exe djvvp.exe PID 2996 wrote to memory of 2624 2996 3rflrxl.exe djvvp.exe PID 2624 wrote to memory of 2084 2624 djvvp.exe xxxfflx.exe PID 2624 wrote to memory of 2084 2624 djvvp.exe xxxfflx.exe PID 2624 wrote to memory of 2084 2624 djvvp.exe xxxfflx.exe PID 2624 wrote to memory of 2084 2624 djvvp.exe xxxfflx.exe PID 2084 wrote to memory of 2268 2084 xxxfflx.exe vddpj.exe PID 2084 wrote to memory of 2268 2084 xxxfflx.exe vddpj.exe PID 2084 wrote to memory of 2268 2084 xxxfflx.exe vddpj.exe PID 2084 wrote to memory of 2268 2084 xxxfflx.exe vddpj.exe PID 2268 wrote to memory of 2788 2268 vddpj.exe tnhtbh.exe PID 2268 wrote to memory of 2788 2268 vddpj.exe tnhtbh.exe PID 2268 wrote to memory of 2788 2268 vddpj.exe tnhtbh.exe PID 2268 wrote to memory of 2788 2268 vddpj.exe tnhtbh.exe PID 2788 wrote to memory of 2704 2788 tnhtbh.exe btnhtb.exe PID 2788 wrote to memory of 2704 2788 tnhtbh.exe btnhtb.exe PID 2788 wrote to memory of 2704 2788 tnhtbh.exe btnhtb.exe PID 2788 wrote to memory of 2704 2788 tnhtbh.exe btnhtb.exe PID 2704 wrote to memory of 2660 2704 btnhtb.exe rrrrffr.exe PID 2704 wrote to memory of 2660 2704 btnhtb.exe rrrrffr.exe PID 2704 wrote to memory of 2660 2704 btnhtb.exe rrrrffr.exe PID 2704 wrote to memory of 2660 2704 btnhtb.exe rrrrffr.exe PID 2660 wrote to memory of 2564 2660 rrrrffr.exe hbbtbb.exe PID 2660 wrote to memory of 2564 2660 rrrrffr.exe hbbtbb.exe PID 2660 wrote to memory of 2564 2660 rrrrffr.exe hbbtbb.exe PID 2660 wrote to memory of 2564 2660 rrrrffr.exe hbbtbb.exe PID 2564 wrote to memory of 2584 2564 hbbtbb.exe pjddp.exe PID 2564 wrote to memory of 2584 2564 hbbtbb.exe pjddp.exe PID 2564 wrote to memory of 2584 2564 hbbtbb.exe pjddp.exe PID 2564 wrote to memory of 2584 2564 hbbtbb.exe pjddp.exe PID 2584 wrote to memory of 2556 2584 pjddp.exe 1rfrfrx.exe PID 2584 wrote to memory of 2556 2584 pjddp.exe 1rfrfrx.exe PID 2584 wrote to memory of 2556 2584 pjddp.exe 1rfrfrx.exe PID 2584 wrote to memory of 2556 2584 pjddp.exe 1rfrfrx.exe PID 2556 wrote to memory of 3024 2556 1rfrfrx.exe 9jvdp.exe PID 2556 wrote to memory of 3024 2556 1rfrfrx.exe 9jvdp.exe PID 2556 wrote to memory of 3024 2556 1rfrfrx.exe 9jvdp.exe PID 2556 wrote to memory of 3024 2556 1rfrfrx.exe 9jvdp.exe PID 3024 wrote to memory of 3036 3024 9jvdp.exe frrxllf.exe PID 3024 wrote to memory of 3036 3024 9jvdp.exe frrxllf.exe PID 3024 wrote to memory of 3036 3024 9jvdp.exe frrxllf.exe PID 3024 wrote to memory of 3036 3024 9jvdp.exe frrxllf.exe PID 3036 wrote to memory of 1920 3036 frrxllf.exe 7htthh.exe PID 3036 wrote to memory of 1920 3036 frrxllf.exe 7htthh.exe PID 3036 wrote to memory of 1920 3036 frrxllf.exe 7htthh.exe PID 3036 wrote to memory of 1920 3036 frrxllf.exe 7htthh.exe PID 1920 wrote to memory of 2756 1920 7htthh.exe dvddj.exe PID 1920 wrote to memory of 2756 1920 7htthh.exe dvddj.exe PID 1920 wrote to memory of 2756 1920 7htthh.exe dvddj.exe PID 1920 wrote to memory of 2756 1920 7htthh.exe dvddj.exe PID 2756 wrote to memory of 2000 2756 dvddj.exe 7frlrlr.exe PID 2756 wrote to memory of 2000 2756 dvddj.exe 7frlrlr.exe PID 2756 wrote to memory of 2000 2756 dvddj.exe 7frlrlr.exe PID 2756 wrote to memory of 2000 2756 dvddj.exe 7frlrlr.exe PID 2000 wrote to memory of 2728 2000 7frlrlr.exe ddvdp.exe PID 2000 wrote to memory of 2728 2000 7frlrlr.exe ddvdp.exe PID 2000 wrote to memory of 2728 2000 7frlrlr.exe ddvdp.exe PID 2000 wrote to memory of 2728 2000 7frlrlr.exe ddvdp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1e79a7f79514e48516a1d619d74a010N.exe"C:\Users\Admin\AppData\Local\Temp\b1e79a7f79514e48516a1d619d74a010N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\3rflrxl.exec:\3rflrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\djvvp.exec:\djvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\xxxfflx.exec:\xxxfflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\vddpj.exec:\vddpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\tnhtbh.exec:\tnhtbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\btnhtb.exec:\btnhtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\rrrrffr.exec:\rrrrffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\hbbtbb.exec:\hbbtbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\pjddp.exec:\pjddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\1rfrfrx.exec:\1rfrfrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\9jvdp.exec:\9jvdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\frrxllf.exec:\frrxllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\7htthh.exec:\7htthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\dvddj.exec:\dvddj.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\7frlrlr.exec:\7frlrlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\ddvdp.exec:\ddvdp.exe17⤵
- Executes dropped EXE
PID:2728 -
\??\c:\fxrfrxl.exec:\fxrfrxl.exe18⤵
- Executes dropped EXE
PID:1244 -
\??\c:\ttbnnt.exec:\ttbnnt.exe19⤵
- Executes dropped EXE
PID:1064 -
\??\c:\pjpvj.exec:\pjpvj.exe20⤵
- Executes dropped EXE
PID:1600 -
\??\c:\bbnhtt.exec:\bbnhtt.exe21⤵
- Executes dropped EXE
PID:2932 -
\??\c:\9pjpv.exec:\9pjpv.exe22⤵
- Executes dropped EXE
PID:2880 -
\??\c:\vddpd.exec:\vddpd.exe23⤵
- Executes dropped EXE
PID:2172 -
\??\c:\bthtbn.exec:\bthtbn.exe24⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jdvvj.exec:\jdvvj.exe25⤵
- Executes dropped EXE
PID:2004 -
\??\c:\5xlrxfr.exec:\5xlrxfr.exe26⤵
- Executes dropped EXE
PID:280 -
\??\c:\9fxrllx.exec:\9fxrllx.exe27⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vvdjp.exec:\vvdjp.exe28⤵
- Executes dropped EXE
PID:1660 -
\??\c:\fxflrxf.exec:\fxflrxf.exe29⤵
- Executes dropped EXE
PID:2232 -
\??\c:\1bntht.exec:\1bntht.exe30⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vdpdp.exec:\vdpdp.exe31⤵
- Executes dropped EXE
PID:1972 -
\??\c:\hbtbnt.exec:\hbtbnt.exe32⤵
- Executes dropped EXE
PID:2272 -
\??\c:\hbnntt.exec:\hbnntt.exe33⤵
- Executes dropped EXE
PID:1760 -
\??\c:\pdpjj.exec:\pdpjj.exe34⤵
- Executes dropped EXE
PID:2316 -
\??\c:\llllxlf.exec:\llllxlf.exe35⤵
- Executes dropped EXE
PID:1664 -
\??\c:\btnbnb.exec:\btnbnb.exe36⤵
- Executes dropped EXE
PID:1564 -
\??\c:\1vjjp.exec:\1vjjp.exe37⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rlllxxf.exec:\rlllxxf.exe38⤵
- Executes dropped EXE
PID:1948 -
\??\c:\fllfxrr.exec:\fllfxrr.exe39⤵
- Executes dropped EXE
PID:2944 -
\??\c:\nhtttt.exec:\nhtttt.exe40⤵
- Executes dropped EXE
PID:2416 -
\??\c:\dvjjp.exec:\dvjjp.exe41⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pjddj.exec:\pjddj.exe42⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xflflxx.exec:\xflflxx.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\nhbhnb.exec:\nhbhnb.exe44⤵
- Executes dropped EXE
PID:2836 -
\??\c:\jdddj.exec:\jdddj.exe45⤵
- Executes dropped EXE
PID:2708 -
\??\c:\1xrfrxx.exec:\1xrfrxx.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rfrrxlr.exec:\rfrrxlr.exe47⤵
- Executes dropped EXE
PID:2656 -
\??\c:\thhhbn.exec:\thhhbn.exe48⤵
- Executes dropped EXE
PID:2584 -
\??\c:\3pjvj.exec:\3pjvj.exe49⤵
- Executes dropped EXE
PID:2552 -
\??\c:\lllrflx.exec:\lllrflx.exe50⤵
- Executes dropped EXE
PID:2556 -
\??\c:\7ffrrxx.exec:\7ffrrxx.exe51⤵
- Executes dropped EXE
PID:2580 -
\??\c:\tthbnb.exec:\tthbnb.exe52⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9hbhnn.exec:\9hbhnn.exe53⤵
- Executes dropped EXE
PID:3040 -
\??\c:\9ddjv.exec:\9ddjv.exe54⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rllrxfr.exec:\rllrxfr.exe55⤵
- Executes dropped EXE
PID:1980 -
\??\c:\7nnhnn.exec:\7nnhnn.exe56⤵
- Executes dropped EXE
PID:2632 -
\??\c:\hnnttn.exec:\hnnttn.exe57⤵
- Executes dropped EXE
PID:2600 -
\??\c:\ppjvp.exec:\ppjvp.exe58⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rllffll.exec:\rllffll.exe59⤵
- Executes dropped EXE
PID:1704 -
\??\c:\lxlrffr.exec:\lxlrffr.exe60⤵
- Executes dropped EXE
PID:2076 -
\??\c:\nnbhtn.exec:\nnbhtn.exe61⤵
- Executes dropped EXE
PID:2888 -
\??\c:\vpjjj.exec:\vpjjj.exe62⤵
- Executes dropped EXE
PID:2916 -
\??\c:\flrlfff.exec:\flrlfff.exe63⤵
- Executes dropped EXE
PID:2148 -
\??\c:\fxlrxxr.exec:\fxlrxxr.exe64⤵
- Executes dropped EXE
PID:2432 -
\??\c:\btnttn.exec:\btnttn.exe65⤵
- Executes dropped EXE
PID:2136 -
\??\c:\1pdjp.exec:\1pdjp.exe66⤵PID:2392
-
\??\c:\jvppv.exec:\jvppv.exe67⤵PID:760
-
\??\c:\3rlxlxl.exec:\3rlxlxl.exe68⤵PID:1128
-
\??\c:\hbthnt.exec:\hbthnt.exe69⤵PID:1720
-
\??\c:\nnhtnb.exec:\nnhtnb.exe70⤵PID:2192
-
\??\c:\5dddp.exec:\5dddp.exe71⤵PID:1932
-
\??\c:\lllxxll.exec:\lllxxll.exe72⤵PID:2012
-
\??\c:\ffrxllx.exec:\ffrxllx.exe73⤵PID:2480
-
\??\c:\tnhtbn.exec:\tnhtbn.exe74⤵PID:1776
-
\??\c:\1htnbh.exec:\1htnbh.exe75⤵PID:1508
-
\??\c:\vpvjv.exec:\vpvjv.exe76⤵PID:1852
-
\??\c:\ffrxllr.exec:\ffrxllr.exe77⤵PID:1072
-
\??\c:\xxrrxfx.exec:\xxrrxfx.exe78⤵PID:2088
-
\??\c:\thtttt.exec:\thtttt.exe79⤵
- System Location Discovery: System Language Discovery
PID:1628 -
\??\c:\5nntht.exec:\5nntht.exe80⤵PID:2316
-
\??\c:\vpjpv.exec:\vpjpv.exe81⤵PID:3000
-
\??\c:\1llxrlf.exec:\1llxrlf.exe82⤵PID:3064
-
\??\c:\llxfllx.exec:\llxfllx.exe83⤵PID:1572
-
\??\c:\htttbh.exec:\htttbh.exe84⤵PID:2016
-
\??\c:\tbhhnh.exec:\tbhhnh.exe85⤵PID:1632
-
\??\c:\jjdjv.exec:\jjdjv.exe86⤵PID:2412
-
\??\c:\rlxfrfr.exec:\rlxfrfr.exe87⤵PID:2780
-
\??\c:\nhbhtb.exec:\nhbhtb.exe88⤵PID:2844
-
\??\c:\bthhnn.exec:\bthhnn.exe89⤵PID:2368
-
\??\c:\5pjdj.exec:\5pjdj.exe90⤵PID:2672
-
\??\c:\vppvj.exec:\vppvj.exe91⤵PID:2572
-
\??\c:\lfxfxfr.exec:\lfxfxfr.exe92⤵PID:2876
-
\??\c:\bntnbh.exec:\bntnbh.exe93⤵PID:2824
-
\??\c:\nnnbtn.exec:\nnnbtn.exe94⤵PID:2812
-
\??\c:\jddpv.exec:\jddpv.exe95⤵PID:2584
-
\??\c:\lfxxrfr.exec:\lfxxrfr.exe96⤵PID:2552
-
\??\c:\ffxrxlf.exec:\ffxrxlf.exe97⤵PID:1624
-
\??\c:\tthtbh.exec:\tthtbh.exe98⤵PID:2300
-
\??\c:\djjvv.exec:\djjvv.exe99⤵PID:2496
-
\??\c:\pjdjv.exec:\pjdjv.exe100⤵PID:3040
-
\??\c:\rlxlrfr.exec:\rlxlrfr.exe101⤵PID:1916
-
\??\c:\tbbbht.exec:\tbbbht.exe102⤵PID:1980
-
\??\c:\5ddvp.exec:\5ddvp.exe103⤵PID:1800
-
\??\c:\dvdpv.exec:\dvdpv.exe104⤵PID:2644
-
\??\c:\rrxffrx.exec:\rrxffrx.exe105⤵PID:2760
-
\??\c:\bbnhhh.exec:\bbnhhh.exe106⤵PID:892
-
\??\c:\bbnthn.exec:\bbnthn.exe107⤵PID:2076
-
\??\c:\pvvvd.exec:\pvvvd.exe108⤵PID:2908
-
\??\c:\7lxxffx.exec:\7lxxffx.exe109⤵PID:2932
-
\??\c:\5nbtnn.exec:\5nbtnn.exe110⤵PID:1952
-
\??\c:\bbtnnn.exec:\bbtnnn.exe111⤵PID:2212
-
\??\c:\jdpvj.exec:\jdpvj.exe112⤵PID:2056
-
\??\c:\xxxrflf.exec:\xxxrflf.exe113⤵PID:1516
-
\??\c:\bnbnnt.exec:\bnbnnt.exe114⤵PID:760
-
\??\c:\hnbthb.exec:\hnbthb.exe115⤵PID:1088
-
\??\c:\1vjvd.exec:\1vjvd.exe116⤵PID:1720
-
\??\c:\fxfxrxr.exec:\fxfxrxr.exe117⤵PID:2236
-
\??\c:\tnbbtb.exec:\tnbbtb.exe118⤵PID:1932
-
\??\c:\tthntt.exec:\tthntt.exe119⤵PID:2372
-
\??\c:\9rxxxff.exec:\9rxxxff.exe120⤵PID:2256
-
\??\c:\xrrrrxf.exec:\xrrrrxf.exe121⤵PID:2156
-
\??\c:\hbbbnn.exec:\hbbbnn.exe122⤵PID:2420
-
\??\c:\jppjj.exec:\jppjj.exe123⤵PID:988
-
\??\c:\xrlfrfr.exec:\xrlfrfr.exe124⤵PID:2464
-
\??\c:\3rllxxx.exec:\3rllxxx.exe125⤵PID:1336
-
\??\c:\htnbnb.exec:\htnbnb.exe126⤵PID:1588
-
\??\c:\dpppv.exec:\dpppv.exe127⤵PID:3044
-
\??\c:\rrlrxlr.exec:\rrlrxlr.exe128⤵PID:2992
-
\??\c:\frllflr.exec:\frllflr.exe129⤵PID:1256
-
\??\c:\jjddp.exec:\jjddp.exe130⤵PID:2732
-
\??\c:\rxxflxl.exec:\rxxflxl.exe131⤵PID:2944
-
\??\c:\bhtthn.exec:\bhtthn.exe132⤵PID:2244
-
\??\c:\9ppvp.exec:\9ppvp.exe133⤵PID:2268
-
\??\c:\bbhbnb.exec:\bbhbnb.exe134⤵PID:2800
-
\??\c:\tbbhbn.exec:\tbbhbn.exe135⤵PID:2852
-
\??\c:\jjpdd.exec:\jjpdd.exe136⤵PID:2672
-
\??\c:\frflxrx.exec:\frflxrx.exe137⤵PID:2952
-
\??\c:\1rrxllx.exec:\1rrxllx.exe138⤵PID:2804
-
\??\c:\bhbhth.exec:\bhbhth.exe139⤵PID:2660
-
\??\c:\3jvvd.exec:\3jvvd.exe140⤵PID:2812
-
\??\c:\1pppd.exec:\1pppd.exe141⤵PID:2532
-
\??\c:\fllffxx.exec:\fllffxx.exe142⤵PID:2200
-
\??\c:\tbhtnh.exec:\tbhtnh.exe143⤵PID:1616
-
\??\c:\ttnbht.exec:\ttnbht.exe144⤵
- System Location Discovery: System Language Discovery
PID:2776 -
\??\c:\jjddp.exec:\jjddp.exe145⤵PID:1920
-
\??\c:\lllfllr.exec:\lllfllr.exe146⤵PID:1816
-
\??\c:\lrffrxr.exec:\lrffrxr.exe147⤵PID:1964
-
\??\c:\1tbtbn.exec:\1tbtbn.exe148⤵PID:1432
-
\??\c:\9ddjp.exec:\9ddjp.exe149⤵PID:1752
-
\??\c:\fxrlrxf.exec:\fxrlrxf.exe150⤵PID:1940
-
\??\c:\tnntbh.exec:\tnntbh.exe151⤵PID:1064
-
\??\c:\btthtt.exec:\btthtt.exe152⤵PID:1768
-
\??\c:\ppjpj.exec:\ppjpj.exe153⤵PID:2888
-
\??\c:\frflrfl.exec:\frflrfl.exe154⤵PID:2916
-
\??\c:\lfxxllx.exec:\lfxxllx.exe155⤵PID:2932
-
\??\c:\nnntht.exec:\nnntht.exe156⤵PID:2504
-
\??\c:\hbnhbb.exec:\hbnhbb.exe157⤵PID:2168
-
\??\c:\5pjpj.exec:\5pjpj.exe158⤵PID:2196
-
\??\c:\lfxflxr.exec:\lfxflxr.exe159⤵PID:908
-
\??\c:\rlxxflx.exec:\rlxxflx.exe160⤵PID:1808
-
\??\c:\3tbbnt.exec:\3tbbnt.exe161⤵PID:2104
-
\??\c:\ppddd.exec:\ppddd.exe162⤵
- System Location Discovery: System Language Discovery
PID:2240 -
\??\c:\pjjdv.exec:\pjjdv.exe163⤵PID:2248
-
\??\c:\frfffll.exec:\frfffll.exe164⤵PID:2348
-
\??\c:\bbbbnh.exec:\bbbbnh.exe165⤵PID:2080
-
\??\c:\vvpjp.exec:\vvpjp.exe166⤵PID:1868
-
\??\c:\vvvdj.exec:\vvvdj.exe167⤵PID:1960
-
\??\c:\xxfrxxf.exec:\xxfrxxf.exe168⤵PID:1640
-
\??\c:\tnntnb.exec:\tnntnb.exe169⤵PID:2420
-
\??\c:\nhnhbn.exec:\nhnhbn.exe170⤵PID:2472
-
\??\c:\7jdjd.exec:\7jdjd.exe171⤵PID:2312
-
\??\c:\1frffxr.exec:\1frffxr.exe172⤵PID:1696
-
\??\c:\9lrfrrf.exec:\9lrfrrf.exe173⤵PID:3000
-
\??\c:\nhbhnn.exec:\nhbhnn.exe174⤵PID:3060
-
\??\c:\dvjjp.exec:\dvjjp.exe175⤵PID:1572
-
\??\c:\dddjv.exec:\dddjv.exe176⤵PID:2940
-
\??\c:\7rlxrrl.exec:\7rlxrrl.exe177⤵PID:2380
-
\??\c:\hbnbnn.exec:\hbnbnn.exe178⤵PID:2052
-
\??\c:\hbtbht.exec:\hbtbht.exe179⤵PID:2796
-
\??\c:\9dvpd.exec:\9dvpd.exe180⤵PID:2276
-
\??\c:\rxlxllr.exec:\rxlxllr.exe181⤵PID:2704
-
\??\c:\rlfxrxr.exec:\rlfxrxr.exe182⤵PID:2968
-
\??\c:\tnbhtb.exec:\tnbhtb.exe183⤵PID:2672
-
\??\c:\jdpvj.exec:\jdpvj.exe184⤵PID:2572
-
\??\c:\dvpvd.exec:\dvpvd.exe185⤵PID:2804
-
\??\c:\frlflrf.exec:\frlflrf.exe186⤵PID:2824
-
\??\c:\nhtthn.exec:\nhtthn.exe187⤵PID:1728
-
\??\c:\nhhtht.exec:\nhhtht.exe188⤵PID:3032
-
\??\c:\pjdjp.exec:\pjdjp.exe189⤵PID:332
-
\??\c:\5lrxrfr.exec:\5lrxrfr.exe190⤵PID:1616
-
\??\c:\lxxflxf.exec:\lxxflxf.exe191⤵PID:2524
-
\??\c:\bbtbht.exec:\bbtbht.exe192⤵PID:1920
-
\??\c:\bbthtn.exec:\bbthtn.exe193⤵PID:1816
-
\??\c:\9vvdp.exec:\9vvdp.exe194⤵PID:2356
-
\??\c:\7ffxfrx.exec:\7ffxfrx.exe195⤵PID:1432
-
\??\c:\xrlxrfx.exec:\xrlxrfx.exe196⤵PID:2644
-
\??\c:\nnnnbb.exec:\nnnnbb.exe197⤵PID:1668
-
\??\c:\ddpvd.exec:\ddpvd.exe198⤵PID:2764
-
\??\c:\dppvd.exec:\dppvd.exe199⤵PID:2900
-
\??\c:\9xrlffr.exec:\9xrlffr.exe200⤵PID:3012
-
\??\c:\hbtbtb.exec:\hbtbtb.exe201⤵PID:2936
-
\??\c:\bnhhnh.exec:\bnhhnh.exe202⤵PID:2028
-
\??\c:\dvpdj.exec:\dvpdj.exe203⤵PID:2352
-
\??\c:\lxxlllx.exec:\lxxlllx.exe204⤵PID:2384
-
\??\c:\llxlxfr.exec:\llxlxfr.exe205⤵PID:2196
-
\??\c:\ththht.exec:\ththht.exe206⤵PID:760
-
\??\c:\jvpvv.exec:\jvpvv.exe207⤵PID:2920
-
\??\c:\jpvdj.exec:\jpvdj.exe208⤵PID:1720
-
\??\c:\3xffrxl.exec:\3xffrxl.exe209⤵PID:1532
-
\??\c:\ffxrrrl.exec:\ffxrrrl.exe210⤵PID:2012
-
\??\c:\tthttt.exec:\tthttt.exe211⤵
- System Location Discovery: System Language Discovery
PID:1612 -
\??\c:\vpvvd.exec:\vpvvd.exe212⤵PID:1776
-
\??\c:\jjddv.exec:\jjddv.exe213⤵PID:716
-
\??\c:\xrrffrx.exec:\xrrffrx.exe214⤵PID:2340
-
\??\c:\hhbtbh.exec:\hhbtbh.exe215⤵PID:884
-
\??\c:\1hnnbb.exec:\1hnnbb.exe216⤵PID:1876
-
\??\c:\vvjpd.exec:\vvjpd.exe217⤵PID:2472
-
\??\c:\9dppp.exec:\9dppp.exe218⤵PID:2272
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe219⤵PID:1696
-
\??\c:\tttthb.exec:\tttthb.exe220⤵PID:3000
-
\??\c:\nhhtnh.exec:\nhhtnh.exe221⤵PID:2860
-
\??\c:\vjjjj.exec:\vjjjj.exe222⤵PID:3052
-
\??\c:\rrrxflx.exec:\rrrxflx.exe223⤵PID:2940
-
\??\c:\btbhnb.exec:\btbhnb.exe224⤵PID:2732
-
\??\c:\jjjpd.exec:\jjjpd.exe225⤵PID:2244
-
\??\c:\pjvjp.exec:\pjvjp.exe226⤵PID:2416
-
\??\c:\xrlxflx.exec:\xrlxflx.exe227⤵PID:2800
-
\??\c:\7nbbhh.exec:\7nbbhh.exe228⤵PID:2828
-
\??\c:\9bbtbn.exec:\9bbtbn.exe229⤵PID:2836
-
\??\c:\pjvvj.exec:\pjvvj.exe230⤵PID:2008
-
\??\c:\jdvvd.exec:\jdvvd.exe231⤵PID:2656
-
\??\c:\7rflxxf.exec:\7rflxxf.exe232⤵PID:2724
-
\??\c:\bthnnb.exec:\bthnnb.exe233⤵PID:2616
-
\??\c:\nthtnh.exec:\nthtnh.exe234⤵PID:1084
-
\??\c:\jddpd.exec:\jddpd.exe235⤵PID:1608
-
\??\c:\3frrxfl.exec:\3frrxfl.exe236⤵PID:1300
-
\??\c:\xxfrfxr.exec:\xxfrfxr.exe237⤵PID:2436
-
\??\c:\tnbntb.exec:\tnbntb.exe238⤵PID:3040
-
\??\c:\ppjpp.exec:\ppjpp.exe239⤵PID:1204
-
\??\c:\vpvjd.exec:\vpvjd.exe240⤵PID:1920
-
\??\c:\lflxfrx.exec:\lflxfrx.exe241⤵PID:1804
-
\??\c:\fxxlxxr.exec:\fxxlxxr.exe242⤵PID:1800