Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 10:02
Behavioral task
behavioral1
Sample
bdbff28d72bd1609e2ee58de7276b650N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
bdbff28d72bd1609e2ee58de7276b650N.exe
-
Size
369KB
-
MD5
bdbff28d72bd1609e2ee58de7276b650
-
SHA1
05fee06bd6600499f1dd2f9f0ace85e4efa77edd
-
SHA256
7e9169d97366482f060f562196ffe7856218047a1c06546556fd67e7f74f8a5e
-
SHA512
569acd3343bfe25c742bf955c4b718135163409566954a1d477958ec644f6412260cb264c6ddc37c6165bb35984c0e0fdd18b9135152baa659f9d7e782667a69
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpSwp9OD0Ibsc:y4wFHoS3eFaKHpNKbbsc
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4728-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1504-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4868-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4868-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2920-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/68-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4744-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3364-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3680-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/448-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1452-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2856-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2500-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1200-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/748-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3768-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3908-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2056-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2056-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2544-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3044-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3096-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2856-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3900-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/68-546-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-560-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-573-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3372-586-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-665-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-856-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4268-915-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1700-1022-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2544-1134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-1156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jpppv.exevvjvp.exe5xlxxxf.exebtbtnh.exexflfxrl.exehthbtt.exe5djdv.exetnhbbh.exerlfxllx.exettnntb.exeppjdv.exeffxrlll.exetnbtnn.exepjjdv.exe7xfxrfx.exepvvjd.exeppjvp.exetbtnhh.exevjjdv.exe5rrlffx.exelxxlfxl.exevpvjd.exefrlxlfr.exetttnhb.exevdjvj.exerrrffxx.exefflfxxr.exebhhbbt.exeddjdj.exe5rrfxrl.exe5ffrfrx.exevjpdv.exefrrffrl.exevvjdj.exexrrfxxr.exettnhbt.exejdvpp.exellrfxrl.exebtbhhn.exe5tthbt.exe5jjdp.exe1xfllfx.exenntnht.exebhhtnn.exepdpdp.exe5frfxrf.exefrrlxrf.exebbtnhb.exe7jjdp.exe5rrlrrf.exefllrlrf.exe5jjpv.exe9ddpd.exerfrrffr.exebhhtht.exepjvpp.exedppvj.exerrxxxxl.exe5nttnn.exebtbbtb.exejvjvv.exexfrrrrl.exebthhhb.exepppjd.exepid process 1504 jpppv.exe 4868 vvjvp.exe 2920 5xlxxxf.exe 3064 btbtnh.exe 3712 xflfxrl.exe 3116 hthbtt.exe 68 5djdv.exe 3596 tnhbbh.exe 4796 rlfxllx.exe 4744 ttnntb.exe 3364 ppjdv.exe 3196 ffxrlll.exe 3680 tnbtnn.exe 5096 pjjdv.exe 448 7xfxrfx.exe 4524 pvvjd.exe 216 ppjvp.exe 4844 tbtnhh.exe 4032 vjjdv.exe 848 5rrlffx.exe 3988 lxxlfxl.exe 1452 vpvjd.exe 8 frlxlfr.exe 1448 tttnhb.exe 4764 vdjvj.exe 3716 rrrffxx.exe 2856 fflfxxr.exe 4136 bhhbbt.exe 2680 ddjdj.exe 5032 5rrfxrl.exe 4808 5ffrfrx.exe 3948 vjpdv.exe 2500 frrffrl.exe 4892 vvjdj.exe 4460 xrrfxxr.exe 4580 ttnhbt.exe 1200 jdvpp.exe 4876 llrfxrl.exe 2516 btbhhn.exe 748 5tthbt.exe 4548 5jjdp.exe 3480 1xfllfx.exe 3768 nntnht.exe 2568 bhhtnn.exe 1844 pdpdp.exe 3908 5frfxrf.exe 5112 frrlxrf.exe 3048 bbtnhb.exe 408 7jjdp.exe 2056 5rrlrrf.exe 4108 fllrlrf.exe 2544 5jjpv.exe 924 9ddpd.exe 3044 rfrrffr.exe 5096 bhhtht.exe 4576 pjvpp.exe 2992 dppvj.exe 5008 rrxxxxl.exe 4436 5nttnn.exe 464 btbbtb.exe 4420 jvjvv.exe 852 xfrrrrl.exe 544 bthhhb.exe 844 pppjd.exe -
Processes:
resource yara_rule behavioral2/memory/4728-0-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jpppv.exe upx behavioral2/memory/4728-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1504-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvjvp.exe upx behavioral2/memory/1504-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5xlxxxf.exe upx behavioral2/memory/4868-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4868-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2920-22-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btbtnh.exe upx C:\xflfxrl.exe upx behavioral2/memory/3064-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3712-33-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hthbtt.exe upx behavioral2/memory/3712-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3116-40-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5djdv.exe upx C:\tnhbbh.exe upx behavioral2/memory/68-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlfxllx.exe upx behavioral2/memory/3596-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttnntb.exe upx behavioral2/memory/4796-62-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppjdv.exe upx behavioral2/memory/4744-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3364-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffxrlll.exe upx \??\c:\tnbtnn.exe upx behavioral2/memory/3680-80-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjjdv.exe upx C:\7xfxrfx.exe upx behavioral2/memory/5096-88-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvvjd.exe upx behavioral2/memory/4524-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/448-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppjvp.exe upx behavioral2/memory/216-105-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbtnhh.exe upx C:\vjjdv.exe upx behavioral2/memory/4032-114-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5rrlffx.exe upx C:\lxxlfxl.exe upx \??\c:\vpvjd.exe upx behavioral2/memory/1452-130-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frlxlfr.exe upx C:\tttnhb.exe upx behavioral2/memory/8-140-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vdjvj.exe upx \??\c:\rrrffxx.exe upx C:\fflfxxr.exe upx C:\bhhbbt.exe upx behavioral2/memory/2856-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4136-161-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddjdj.exe upx behavioral2/memory/2680-167-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5rrfxrl.exe upx C:\5ffrfrx.exe upx behavioral2/memory/4808-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4808-183-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjpdv.exe upx behavioral2/memory/3948-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2500-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4892-196-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
lfrrllx.exe3hnnnn.exerffxrlf.exellrrlfl.exe7bnhbb.exetnnhhb.exe1xfffxr.exeppppv.exejvvvv.exetttnnh.exelrxlfxx.exejpjpd.exexrflrll.exenbhbbb.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xfffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bdbff28d72bd1609e2ee58de7276b650N.exejpppv.exevvjvp.exe5xlxxxf.exebtbtnh.exexflfxrl.exehthbtt.exe5djdv.exetnhbbh.exerlfxllx.exettnntb.exeppjdv.exeffxrlll.exetnbtnn.exepjjdv.exe7xfxrfx.exepvvjd.exeppjvp.exetbtnhh.exevjjdv.exe5rrlffx.exelxxlfxl.exedescription pid process target process PID 4728 wrote to memory of 1504 4728 bdbff28d72bd1609e2ee58de7276b650N.exe jpppv.exe PID 4728 wrote to memory of 1504 4728 bdbff28d72bd1609e2ee58de7276b650N.exe jpppv.exe PID 4728 wrote to memory of 1504 4728 bdbff28d72bd1609e2ee58de7276b650N.exe jpppv.exe PID 1504 wrote to memory of 4868 1504 jpppv.exe vvjvp.exe PID 1504 wrote to memory of 4868 1504 jpppv.exe vvjvp.exe PID 1504 wrote to memory of 4868 1504 jpppv.exe vvjvp.exe PID 4868 wrote to memory of 2920 4868 vvjvp.exe 5xlxxxf.exe PID 4868 wrote to memory of 2920 4868 vvjvp.exe 5xlxxxf.exe PID 4868 wrote to memory of 2920 4868 vvjvp.exe 5xlxxxf.exe PID 2920 wrote to memory of 3064 2920 5xlxxxf.exe btbtnh.exe PID 2920 wrote to memory of 3064 2920 5xlxxxf.exe btbtnh.exe PID 2920 wrote to memory of 3064 2920 5xlxxxf.exe btbtnh.exe PID 3064 wrote to memory of 3712 3064 btbtnh.exe xflfxrl.exe PID 3064 wrote to memory of 3712 3064 btbtnh.exe xflfxrl.exe PID 3064 wrote to memory of 3712 3064 btbtnh.exe xflfxrl.exe PID 3712 wrote to memory of 3116 3712 xflfxrl.exe hthbtt.exe PID 3712 wrote to memory of 3116 3712 xflfxrl.exe hthbtt.exe PID 3712 wrote to memory of 3116 3712 xflfxrl.exe hthbtt.exe PID 3116 wrote to memory of 68 3116 hthbtt.exe 5djdv.exe PID 3116 wrote to memory of 68 3116 hthbtt.exe 5djdv.exe PID 3116 wrote to memory of 68 3116 hthbtt.exe 5djdv.exe PID 68 wrote to memory of 3596 68 5djdv.exe tnhbbh.exe PID 68 wrote to memory of 3596 68 5djdv.exe tnhbbh.exe PID 68 wrote to memory of 3596 68 5djdv.exe tnhbbh.exe PID 3596 wrote to memory of 4796 3596 tnhbbh.exe rlfxllx.exe PID 3596 wrote to memory of 4796 3596 tnhbbh.exe rlfxllx.exe PID 3596 wrote to memory of 4796 3596 tnhbbh.exe rlfxllx.exe PID 4796 wrote to memory of 4744 4796 rlfxllx.exe ttnntb.exe PID 4796 wrote to memory of 4744 4796 rlfxllx.exe ttnntb.exe PID 4796 wrote to memory of 4744 4796 rlfxllx.exe ttnntb.exe PID 4744 wrote to memory of 3364 4744 ttnntb.exe ppjdv.exe PID 4744 wrote to memory of 3364 4744 ttnntb.exe ppjdv.exe PID 4744 wrote to memory of 3364 4744 ttnntb.exe ppjdv.exe PID 3364 wrote to memory of 3196 3364 ppjdv.exe ffxrlll.exe PID 3364 wrote to memory of 3196 3364 ppjdv.exe ffxrlll.exe PID 3364 wrote to memory of 3196 3364 ppjdv.exe ffxrlll.exe PID 3196 wrote to memory of 3680 3196 ffxrlll.exe tnbtnn.exe PID 3196 wrote to memory of 3680 3196 ffxrlll.exe tnbtnn.exe PID 3196 wrote to memory of 3680 3196 ffxrlll.exe tnbtnn.exe PID 3680 wrote to memory of 5096 3680 tnbtnn.exe pjjdv.exe PID 3680 wrote to memory of 5096 3680 tnbtnn.exe pjjdv.exe PID 3680 wrote to memory of 5096 3680 tnbtnn.exe pjjdv.exe PID 5096 wrote to memory of 448 5096 pjjdv.exe 7xfxrfx.exe PID 5096 wrote to memory of 448 5096 pjjdv.exe 7xfxrfx.exe PID 5096 wrote to memory of 448 5096 pjjdv.exe 7xfxrfx.exe PID 448 wrote to memory of 4524 448 7xfxrfx.exe pvvjd.exe PID 448 wrote to memory of 4524 448 7xfxrfx.exe pvvjd.exe PID 448 wrote to memory of 4524 448 7xfxrfx.exe pvvjd.exe PID 4524 wrote to memory of 216 4524 pvvjd.exe ppjvp.exe PID 4524 wrote to memory of 216 4524 pvvjd.exe ppjvp.exe PID 4524 wrote to memory of 216 4524 pvvjd.exe ppjvp.exe PID 216 wrote to memory of 4844 216 ppjvp.exe tbtnhh.exe PID 216 wrote to memory of 4844 216 ppjvp.exe tbtnhh.exe PID 216 wrote to memory of 4844 216 ppjvp.exe tbtnhh.exe PID 4844 wrote to memory of 4032 4844 tbtnhh.exe vjjdv.exe PID 4844 wrote to memory of 4032 4844 tbtnhh.exe vjjdv.exe PID 4844 wrote to memory of 4032 4844 tbtnhh.exe vjjdv.exe PID 4032 wrote to memory of 848 4032 vjjdv.exe 5rrlffx.exe PID 4032 wrote to memory of 848 4032 vjjdv.exe 5rrlffx.exe PID 4032 wrote to memory of 848 4032 vjjdv.exe 5rrlffx.exe PID 848 wrote to memory of 3988 848 5rrlffx.exe lxxlfxl.exe PID 848 wrote to memory of 3988 848 5rrlffx.exe lxxlfxl.exe PID 848 wrote to memory of 3988 848 5rrlffx.exe lxxlfxl.exe PID 3988 wrote to memory of 1452 3988 lxxlfxl.exe vpvjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bdbff28d72bd1609e2ee58de7276b650N.exe"C:\Users\Admin\AppData\Local\Temp\bdbff28d72bd1609e2ee58de7276b650N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\jpppv.exec:\jpppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\vvjvp.exec:\vvjvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\5xlxxxf.exec:\5xlxxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\btbtnh.exec:\btbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\xflfxrl.exec:\xflfxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\hthbtt.exec:\hthbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\5djdv.exec:\5djdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:68 -
\??\c:\tnhbbh.exec:\tnhbbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\rlfxllx.exec:\rlfxllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\ttnntb.exec:\ttnntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\ppjdv.exec:\ppjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\ffxrlll.exec:\ffxrlll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\tnbtnn.exec:\tnbtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\pjjdv.exec:\pjjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\7xfxrfx.exec:\7xfxrfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\pvvjd.exec:\pvvjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\ppjvp.exec:\ppjvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\tbtnhh.exec:\tbtnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\vjjdv.exec:\vjjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\5rrlffx.exec:\5rrlffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\lxxlfxl.exec:\lxxlfxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\vpvjd.exec:\vpvjd.exe23⤵
- Executes dropped EXE
PID:1452 -
\??\c:\frlxlfr.exec:\frlxlfr.exe24⤵
- Executes dropped EXE
PID:8 -
\??\c:\tttnhb.exec:\tttnhb.exe25⤵
- Executes dropped EXE
PID:1448 -
\??\c:\vdjvj.exec:\vdjvj.exe26⤵
- Executes dropped EXE
PID:4764 -
\??\c:\rrrffxx.exec:\rrrffxx.exe27⤵
- Executes dropped EXE
PID:3716 -
\??\c:\fflfxxr.exec:\fflfxxr.exe28⤵
- Executes dropped EXE
PID:2856 -
\??\c:\bhhbbt.exec:\bhhbbt.exe29⤵
- Executes dropped EXE
PID:4136 -
\??\c:\ddjdj.exec:\ddjdj.exe30⤵
- Executes dropped EXE
PID:2680 -
\??\c:\5rrfxrl.exec:\5rrfxrl.exe31⤵
- Executes dropped EXE
PID:5032 -
\??\c:\5ffrfrx.exec:\5ffrfrx.exe32⤵
- Executes dropped EXE
PID:4808 -
\??\c:\vjpdv.exec:\vjpdv.exe33⤵
- Executes dropped EXE
PID:3948 -
\??\c:\frrffrl.exec:\frrffrl.exe34⤵
- Executes dropped EXE
PID:2500 -
\??\c:\vvjdj.exec:\vvjdj.exe35⤵
- Executes dropped EXE
PID:4892 -
\??\c:\xrrfxxr.exec:\xrrfxxr.exe36⤵
- Executes dropped EXE
PID:4460 -
\??\c:\ttnhbt.exec:\ttnhbt.exe37⤵
- Executes dropped EXE
PID:4580 -
\??\c:\jdvpp.exec:\jdvpp.exe38⤵
- Executes dropped EXE
PID:1200 -
\??\c:\llrfxrl.exec:\llrfxrl.exe39⤵
- Executes dropped EXE
PID:4876 -
\??\c:\btbhhn.exec:\btbhhn.exe40⤵
- Executes dropped EXE
PID:2516 -
\??\c:\5tthbt.exec:\5tthbt.exe41⤵
- Executes dropped EXE
PID:748 -
\??\c:\5jjdp.exec:\5jjdp.exe42⤵
- Executes dropped EXE
PID:4548 -
\??\c:\1xfllfx.exec:\1xfllfx.exe43⤵
- Executes dropped EXE
PID:3480 -
\??\c:\nntnht.exec:\nntnht.exe44⤵
- Executes dropped EXE
PID:3768 -
\??\c:\bhhtnn.exec:\bhhtnn.exe45⤵
- Executes dropped EXE
PID:2568 -
\??\c:\pdpdp.exec:\pdpdp.exe46⤵
- Executes dropped EXE
PID:1844 -
\??\c:\5frfxrf.exec:\5frfxrf.exe47⤵
- Executes dropped EXE
PID:3908 -
\??\c:\frrlxrf.exec:\frrlxrf.exe48⤵
- Executes dropped EXE
PID:5112 -
\??\c:\bbtnhb.exec:\bbtnhb.exe49⤵
- Executes dropped EXE
PID:3048 -
\??\c:\7jjdp.exec:\7jjdp.exe50⤵
- Executes dropped EXE
PID:408 -
\??\c:\5rrlrrf.exec:\5rrlrrf.exe51⤵
- Executes dropped EXE
PID:2056 -
\??\c:\fllrlrf.exec:\fllrlrf.exe52⤵
- Executes dropped EXE
PID:4108 -
\??\c:\5jjpv.exec:\5jjpv.exe53⤵
- Executes dropped EXE
PID:2544 -
\??\c:\9ddpd.exec:\9ddpd.exe54⤵
- Executes dropped EXE
PID:924 -
\??\c:\rfrrffr.exec:\rfrrffr.exe55⤵
- Executes dropped EXE
PID:3044 -
\??\c:\bhhtht.exec:\bhhtht.exe56⤵
- Executes dropped EXE
PID:5096 -
\??\c:\pjvpp.exec:\pjvpp.exe57⤵
- Executes dropped EXE
PID:4576 -
\??\c:\dppvj.exec:\dppvj.exe58⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rrxxxxl.exec:\rrxxxxl.exe59⤵
- Executes dropped EXE
PID:5008 -
\??\c:\5nttnn.exec:\5nttnn.exe60⤵
- Executes dropped EXE
PID:4436 -
\??\c:\btbbtb.exec:\btbbtb.exe61⤵
- Executes dropped EXE
PID:464 -
\??\c:\jvjvv.exec:\jvjvv.exe62⤵
- Executes dropped EXE
PID:4420 -
\??\c:\xfrrrrl.exec:\xfrrrrl.exe63⤵
- Executes dropped EXE
PID:852 -
\??\c:\bthhhb.exec:\bthhhb.exe64⤵
- Executes dropped EXE
PID:544 -
\??\c:\pppjd.exec:\pppjd.exe65⤵
- Executes dropped EXE
PID:844 -
\??\c:\vppjd.exec:\vppjd.exe66⤵PID:2384
-
\??\c:\rrlxflf.exec:\rrlxflf.exe67⤵PID:208
-
\??\c:\bnnhtn.exec:\bnnhtn.exe68⤵PID:4348
-
\??\c:\vjddp.exec:\vjddp.exe69⤵PID:1452
-
\??\c:\djdvp.exec:\djdvp.exe70⤵PID:3096
-
\??\c:\9lrrxxl.exec:\9lrrxxl.exe71⤵PID:4736
-
\??\c:\frfxrxr.exec:\frfxrxr.exe72⤵PID:2820
-
\??\c:\7hnhhb.exec:\7hnhhb.exe73⤵PID:4836
-
\??\c:\vdddv.exec:\vdddv.exe74⤵PID:1572
-
\??\c:\9xxrflf.exec:\9xxrflf.exe75⤵PID:2856
-
\??\c:\lrfxrrr.exec:\lrfxrrr.exe76⤵PID:4136
-
\??\c:\5hbtnh.exec:\5hbtnh.exe77⤵PID:2680
-
\??\c:\vpdvp.exec:\vpdvp.exe78⤵PID:2216
-
\??\c:\xrfxflr.exec:\xrfxflr.exe79⤵PID:4856
-
\??\c:\ffrrrrx.exec:\ffrrrrx.exe80⤵PID:4808
-
\??\c:\bnhnhn.exec:\bnhnhn.exe81⤵PID:2240
-
\??\c:\jvvvv.exec:\jvvvv.exe82⤵
- System Location Discovery: System Language Discovery
PID:4728 -
\??\c:\1pvpj.exec:\1pvpj.exe83⤵PID:4504
-
\??\c:\lxxxffl.exec:\lxxxffl.exe84⤵PID:932
-
\??\c:\bhthnb.exec:\bhthnb.exe85⤵PID:5116
-
\??\c:\9jjjd.exec:\9jjjd.exe86⤵PID:436
-
\??\c:\vdjdj.exec:\vdjdj.exe87⤵PID:4848
-
\??\c:\3fxrllx.exec:\3fxrllx.exe88⤵PID:3864
-
\??\c:\tnnhhh.exec:\tnnhhh.exe89⤵PID:1328
-
\??\c:\pjppj.exec:\pjppj.exe90⤵PID:1712
-
\??\c:\lflllfr.exec:\lflllfr.exe91⤵PID:1088
-
\??\c:\xflffxr.exec:\xflffxr.exe92⤵PID:4752
-
\??\c:\nnhhhh.exec:\nnhhhh.exe93⤵PID:3768
-
\??\c:\jddvp.exec:\jddvp.exe94⤵PID:2568
-
\??\c:\lllllff.exec:\lllllff.exe95⤵PID:2132
-
\??\c:\5hnhtt.exec:\5hnhtt.exe96⤵PID:3168
-
\??\c:\pjddv.exec:\pjddv.exe97⤵PID:3908
-
\??\c:\fffrxxr.exec:\fffrxxr.exe98⤵PID:4796
-
\??\c:\5xfxffl.exec:\5xfxffl.exe99⤵PID:1620
-
\??\c:\7bnhhh.exec:\7bnhhh.exe100⤵PID:2824
-
\??\c:\djjdd.exec:\djjdd.exe101⤵PID:540
-
\??\c:\dddvp.exec:\dddvp.exe102⤵PID:3684
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe103⤵PID:4180
-
\??\c:\rffrrfl.exec:\rffrrfl.exe104⤵PID:872
-
\??\c:\bhntbt.exec:\bhntbt.exe105⤵PID:3900
-
\??\c:\vjvpp.exec:\vjvpp.exe106⤵PID:4544
-
\??\c:\7pvpv.exec:\7pvpv.exe107⤵PID:5072
-
\??\c:\5rxffrr.exec:\5rxffrr.exe108⤵PID:1660
-
\??\c:\bbhnnn.exec:\bbhnnn.exe109⤵PID:4552
-
\??\c:\7nhbtt.exec:\7nhbtt.exe110⤵PID:5008
-
\??\c:\3jjdv.exec:\3jjdv.exe111⤵PID:4396
-
\??\c:\pdpjj.exec:\pdpjj.exe112⤵PID:3368
-
\??\c:\7ffxrll.exec:\7ffxrll.exe113⤵PID:4816
-
\??\c:\nbthth.exec:\nbthth.exe114⤵PID:852
-
\??\c:\bntbtn.exec:\bntbtn.exe115⤵PID:2848
-
\??\c:\vpjdv.exec:\vpjdv.exe116⤵PID:452
-
\??\c:\lfxfxrx.exec:\lfxfxrx.exe117⤵PID:2384
-
\??\c:\hbttnt.exec:\hbttnt.exe118⤵PID:3692
-
\??\c:\9thbhb.exec:\9thbhb.exe119⤵PID:880
-
\??\c:\fxlfxxf.exec:\fxlfxxf.exe120⤵PID:2688
-
\??\c:\rxlfrxr.exec:\rxlfrxr.exe121⤵PID:3836
-
\??\c:\1hnnnn.exec:\1hnnnn.exe122⤵PID:4736
-
\??\c:\pvjjp.exec:\pvjjp.exe123⤵PID:1564
-
\??\c:\jdddd.exec:\jdddd.exe124⤵PID:2400
-
\??\c:\rllrxxx.exec:\rllrxxx.exe125⤵PID:2284
-
\??\c:\btbtbb.exec:\btbtbb.exe126⤵PID:1232
-
\??\c:\thhbbt.exec:\thhbbt.exe127⤵PID:3980
-
\??\c:\7djdd.exec:\7djdd.exe128⤵PID:5032
-
\??\c:\rfxrllx.exec:\rfxrllx.exe129⤵PID:4372
-
\??\c:\tnhhbb.exec:\tnhhbb.exe130⤵PID:4452
-
\??\c:\tbhntb.exec:\tbhntb.exe131⤵PID:1652
-
\??\c:\1vvpp.exec:\1vvpp.exe132⤵PID:4892
-
\??\c:\rxxrrrr.exec:\rxxrrrr.exe133⤵PID:4700
-
\??\c:\hnnhbb.exec:\hnnhbb.exe134⤵PID:4772
-
\??\c:\jdpjd.exec:\jdpjd.exe135⤵PID:4152
-
\??\c:\pppdv.exec:\pppdv.exe136⤵PID:4916
-
\??\c:\xlrlllr.exec:\xlrlllr.exe137⤵PID:400
-
\??\c:\rrffllx.exec:\rrffllx.exe138⤵PID:4752
-
\??\c:\1ntnnn.exec:\1ntnnn.exe139⤵PID:68
-
\??\c:\jvvpj.exec:\jvvpj.exe140⤵PID:1980
-
\??\c:\lrxrllf.exec:\lrxrllf.exe141⤵PID:512
-
\??\c:\thnnnn.exec:\thnnnn.exe142⤵PID:1624
-
\??\c:\thnnhh.exec:\thnnhh.exe143⤵PID:1524
-
\??\c:\vjvdd.exec:\vjvdd.exe144⤵PID:4796
-
\??\c:\dpppj.exec:\dpppj.exe145⤵PID:4472
-
\??\c:\rffffff.exec:\rffffff.exe146⤵PID:2104
-
\??\c:\bbttnt.exec:\bbttnt.exe147⤵PID:4108
-
\??\c:\vpppj.exec:\vpppj.exe148⤵PID:5080
-
\??\c:\lxrrrrx.exec:\lxrrrrx.exe149⤵PID:1324
-
\??\c:\3hnnnn.exec:\3hnnnn.exe150⤵
- System Location Discovery: System Language Discovery
PID:5056 -
\??\c:\htbnnt.exec:\htbnnt.exe151⤵PID:3372
-
\??\c:\jjdjj.exec:\jjdjj.exe152⤵PID:4544
-
\??\c:\7xlrrxr.exec:\7xlrrxr.exe153⤵PID:5072
-
\??\c:\3hhhbb.exec:\3hhhbb.exe154⤵PID:3240
-
\??\c:\dpjvj.exec:\dpjvj.exe155⤵PID:1072
-
\??\c:\pjjvp.exec:\pjjvp.exe156⤵PID:232
-
\??\c:\lfrfffl.exec:\lfrfffl.exe157⤵PID:4396
-
\??\c:\htbtbn.exec:\htbtbn.exe158⤵PID:3628
-
\??\c:\pdjpv.exec:\pdjpv.exe159⤵PID:4816
-
\??\c:\rflllff.exec:\rflllff.exe160⤵PID:852
-
\??\c:\btnnbh.exec:\btnnbh.exe161⤵PID:2792
-
\??\c:\3nnhhn.exec:\3nnhhn.exe162⤵PID:1520
-
\??\c:\vvdvv.exec:\vvdvv.exe163⤵PID:1264
-
\??\c:\fffllrl.exec:\fffllrl.exe164⤵PID:1260
-
\??\c:\tbnnhh.exec:\tbnnhh.exe165⤵PID:720
-
\??\c:\bbbtnh.exec:\bbbtnh.exe166⤵PID:3720
-
\??\c:\dvdvp.exec:\dvdvp.exe167⤵PID:4280
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe168⤵PID:4736
-
\??\c:\nbhbht.exec:\nbhbht.exe169⤵PID:3804
-
\??\c:\9hnhbb.exec:\9hnhbb.exe170⤵PID:2776
-
\??\c:\7jjjd.exec:\7jjjd.exe171⤵PID:4424
-
\??\c:\3xxxlll.exec:\3xxxlll.exe172⤵PID:3824
-
\??\c:\frrllff.exec:\frrllff.exe173⤵PID:2492
-
\??\c:\httnhh.exec:\httnhh.exe174⤵PID:2328
-
\??\c:\3jppv.exec:\3jppv.exe175⤵PID:4144
-
\??\c:\1dvpp.exec:\1dvpp.exe176⤵PID:3948
-
\??\c:\rffxrfl.exec:\rffxrfl.exe177⤵PID:4116
-
\??\c:\tbbttb.exec:\tbbttb.exe178⤵PID:4892
-
\??\c:\dpvpv.exec:\dpvpv.exe179⤵PID:1904
-
\??\c:\xrrffrf.exec:\xrrffrf.exe180⤵PID:1200
-
\??\c:\lxfxfxx.exec:\lxfxfxx.exe181⤵PID:4976
-
\??\c:\hbbbbb.exec:\hbbbbb.exe182⤵PID:1088
-
\??\c:\pvvvv.exec:\pvvvv.exe183⤵PID:3480
-
\??\c:\vdjdd.exec:\vdjdd.exe184⤵PID:3488
-
\??\c:\frlxlxf.exec:\frlxlxf.exe185⤵PID:4272
-
\??\c:\5hbbbb.exec:\5hbbbb.exe186⤵PID:3340
-
\??\c:\nnnhbt.exec:\nnnhbt.exe187⤵PID:2040
-
\??\c:\jjvdv.exec:\jjvdv.exe188⤵PID:3908
-
\??\c:\7rxxxxx.exec:\7rxxxxx.exe189⤵PID:2376
-
\??\c:\nhhbtt.exec:\nhhbtt.exe190⤵PID:1836
-
\??\c:\bhnhhh.exec:\bhnhhh.exe191⤵PID:840
-
\??\c:\ppvpd.exec:\ppvpd.exe192⤵PID:2408
-
\??\c:\lfrrllx.exec:\lfrrllx.exe193⤵
- System Location Discovery: System Language Discovery
PID:1044 -
\??\c:\tbnbnt.exec:\tbnbnt.exe194⤵PID:3680
-
\??\c:\bntnnh.exec:\bntnnh.exe195⤵PID:2544
-
\??\c:\ppvdv.exec:\ppvdv.exe196⤵PID:4196
-
\??\c:\xxfxrrf.exec:\xxfxrrf.exe197⤵PID:4576
-
\??\c:\rfrlffx.exec:\rfrlffx.exe198⤵PID:3576
-
\??\c:\7hbtbb.exec:\7hbtbb.exe199⤵PID:4760
-
\??\c:\ppvpj.exec:\ppvpj.exe200⤵PID:216
-
\??\c:\xlrllrl.exec:\xlrllrl.exe201⤵PID:4552
-
\??\c:\bnnbnt.exec:\bnnbnt.exe202⤵PID:5008
-
\??\c:\tnntht.exec:\tnntht.exe203⤵PID:3368
-
\??\c:\vjpjd.exec:\vjpjd.exe204⤵PID:3272
-
\??\c:\flrlrlx.exec:\flrlrlx.exe205⤵PID:3496
-
\??\c:\nhhbtt.exec:\nhhbtt.exe206⤵PID:4072
-
\??\c:\nhhbtb.exec:\nhhbtb.exe207⤵PID:3528
-
\??\c:\ppdpj.exec:\ppdpj.exe208⤵PID:3860
-
\??\c:\rffxrrl.exec:\rffxrrl.exe209⤵PID:3692
-
\??\c:\3xrfrrl.exec:\3xrfrrl.exe210⤵PID:4076
-
\??\c:\tnbnbt.exec:\tnbnbt.exe211⤵PID:5084
-
\??\c:\vvddd.exec:\vvddd.exe212⤵PID:3300
-
\??\c:\rfxxrlf.exec:\rfxxrlf.exe213⤵PID:1636
-
\??\c:\bhnhht.exec:\bhnhht.exe214⤵PID:2156
-
\??\c:\jjjvj.exec:\jjjvj.exe215⤵PID:4496
-
\??\c:\jdjpd.exec:\jdjpd.exe216⤵PID:1816
-
\??\c:\fxrrfxl.exec:\fxrrfxl.exe217⤵PID:4296
-
\??\c:\thhhbb.exec:\thhhbb.exe218⤵PID:4592
-
\??\c:\tbnhnn.exec:\tbnhnn.exe219⤵PID:2368
-
\??\c:\3ppvp.exec:\3ppvp.exe220⤵PID:5032
-
\??\c:\lfffxrl.exec:\lfffxrl.exe221⤵PID:1492
-
\??\c:\rfrlxlx.exec:\rfrlxlx.exe222⤵PID:1760
-
\??\c:\ntbnhn.exec:\ntbnhn.exe223⤵PID:4700
-
\??\c:\pdjdv.exec:\pdjdv.exe224⤵PID:636
-
\??\c:\xllfxrr.exec:\xllfxrr.exe225⤵PID:4152
-
\??\c:\lffxllf.exec:\lffxllf.exe226⤵PID:2964
-
\??\c:\bbbtnh.exec:\bbbtnh.exe227⤵PID:400
-
\??\c:\5jdjd.exec:\5jdjd.exe228⤵PID:2732
-
\??\c:\rfffxfx.exec:\rfffxfx.exe229⤵PID:4384
-
\??\c:\xlrlxxx.exec:\xlrlxxx.exe230⤵PID:4080
-
\??\c:\lxrfxlf.exec:\lxrfxlf.exe231⤵PID:4492
-
\??\c:\thnnnh.exec:\thnnnh.exe232⤵PID:1632
-
\??\c:\djppp.exec:\djppp.exe233⤵PID:2152
-
\??\c:\1xxrrrl.exec:\1xxrrrl.exe234⤵PID:3152
-
\??\c:\1bbntb.exec:\1bbntb.exe235⤵PID:3600
-
\??\c:\tnhtnn.exec:\tnhtnn.exe236⤵PID:2632
-
\??\c:\9vvpp.exec:\9vvpp.exe237⤵PID:4472
-
\??\c:\3vvvv.exec:\3vvvv.exe238⤵PID:3120
-
\??\c:\9ffxffl.exec:\9ffxffl.exe239⤵PID:2408
-
\??\c:\nthtbt.exec:\nthtbt.exe240⤵PID:2912
-
\??\c:\hhtntt.exec:\hhtntt.exe241⤵PID:3044
-
\??\c:\7vdvp.exec:\7vdvp.exe242⤵PID:3900